@elytracms/studio 0.0.88 → 0.0.91

package/convex/asset-revalidate.test.ts

@@ -1,10 +1,25 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { convexTest } from 'convex-test'
 import { makeFunctionReference } from 'convex/server'
 import schema from './schema'
 
+// convex-test fires a `runAfter(0)` schedule on a REAL `setTimeout`. These tests assert
+// only on the `_scheduled_functions` rows, so the real `webhooks:deliver` action (a fetch
+// to host.invalid) must never run: under a loaded full run it failed after this file's
+// environment closed, and convex-test's `console.error` for it then failed the whole run
+// (`EnvironmentTeardownError … onUserConsoleLog`, measured in the wave-0092 gate). Fake
+// timers keep the delivery queued and never fired; the rows are still written.
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
 /**
- * EC-579 (no-owner-call carve-out) — an asset edit must reach the live site.
+ * EC-579 — an asset edit must reach the live site (the wave-0089 carve-out; since
+ * the ruling the trigger sends the typed EVENT `{ kind: 'asset', id }`, and the host
+ * receiver answers it with `asset:<id>` + the project sweep).
  *
  * An asset row rides the delivery wire field by field (`delivery.ts`: url, alt,
  * dimensions, focal point, lqip, the `meta` bag), so editing one changes
@@ -31,8 +46,7 @@ const removeAsset = makeFunctionReference<'mutation'>('assets:remove')
 const deliverySnapshot = makeFunctionReference<'query'>('delivery:snapshot')
 
 const SESSION_USER_ID = 'user_admin'
-const SCOPE = 'ec579-scope'
-const SWEEP = [`p:${SCOPE}:project`]
+const ASSET_EVENT = { kind: 'asset', id: 'asset_ec579_1' }
 
 async function freshBackend() {
   const t = convexTest(schema, modules)
@@ -48,33 +62,33 @@ async function freshBackend() {
   return t
 }
 
-/** The scheduled `webhooks:deliver` calls, in order, as `{event, tags}`. */
-async function scheduledRevalidations(
-  t: Awaited<ReturnType<typeof freshBackend>>,
-): Promise<{ event: unknown; tags: unknown }[]> {
+/** The scheduled `webhooks:deliver` calls, in order — the event each one carries. */
+async function scheduledRevalidations(t: Awaited<ReturnType<typeof freshBackend>>): Promise<unknown[]> {
   return t.run(async (ctx) => {
     const rows = await ctx.db.system.query('_scheduled_functions').collect()
     return rows
       .filter((row) => row.name.startsWith('webhooks'))
-      .map((row) => {
-        const [args] = row.args as [{ event?: unknown; tags?: unknown }]
-        return { event: args?.event, tags: args?.tags }
-      })
+      .map((row) => (row.args as [{ event?: unknown }])[0]?.event)
   })
 }
 
-function withScope<T>(scope: string | undefined, run: () => Promise<T>): Promise<T> {
-  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process
-    ?.env
-  const previous = env?.['CANVAS_PROJECT_SCOPE']
-  if (env) {
-    if (scope === undefined) delete env['CANVAS_PROJECT_SCOPE']
-    else env['CANVAS_PROJECT_SCOPE'] = scope
+/** The Convex gate (EC-579): the endpoint + secret pair the `deliver` action posts with. */
+function withRevalidationEnv<T>(configured: boolean, run: () => Promise<T>): Promise<T> {
+  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+  const keys = ['CANVAS_REVALIDATE_ENDPOINT', 'CANVAS_REVALIDATE_SECRET'] as const
+  const previous = keys.map((key) => env[key])
+  if (configured) {
+    env['CANVAS_REVALIDATE_ENDPOINT'] = 'https://host.invalid/api/revalidate'
+    env['CANVAS_REVALIDATE_SECRET'] = 'ec579-secret'
+  } else {
+    for (const key of keys) delete env[key]
   }
   return run().finally(() => {
-    if (!env) return
-    if (previous === undefined) delete env['CANVAS_PROJECT_SCOPE']
-    else env['CANVAS_PROJECT_SCOPE'] = previous
+    keys.forEach((key, index) => {
+      const value = previous[index]
+      if (value === undefined) delete env[key]
+      else env[key] = value
+    })
   })
 }
 
@@ -94,7 +108,7 @@ const assetArgs = {
 
 describe('EC-579 — the write chokepoint revalidates on every asset edit', () => {
   it('an alt edit schedules a project sweep; the create before it schedules nothing', async () => {
-    await withScope(SCOPE, async () => {
+    await withRevalidationEnv(true, async () => {
       const t = await freshBackend()
       const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
 
@@ -110,28 +124,24 @@ describe('EC-579 — the write chokepoint revalidates on every asset edit', () =
       })
       expect(await scheduledRevalidations(t)).toHaveLength(1)
 
-      // A brand-new asset is on no page yet, so its create invalidates nothing —
-      // the same rule the browser dispatcher applies (`webhooks/tags.ts`).
+      // A brand-new asset is on no page yet, so its create invalidates nothing.
       await asAdmin.mutation(upsertAsset, assetArgs)
       expect(await scheduledRevalidations(t)).toHaveLength(1)
 
       await asAdmin.mutation(upsertAsset, { ...assetArgs, alt: 'new' })
 
       // The edit IS live output: the published snapshot already serves it.
-      const snapshot = (await t.query(deliverySnapshot, { projectId: SCOPE })) as {
+      const snapshot = (await t.query(deliverySnapshot, { projectId: 'ec579' })) as {
         assets: { alt?: string }[]
       }
       expect(snapshot.assets[0]?.alt).toBe('new')
 
-      expect(await scheduledRevalidations(t)).toEqual([
-        { event: 'redirects.save', tags: SWEEP },
-        { event: 'assets.upsert', tags: SWEEP },
-      ])
+      expect(await scheduledRevalidations(t)).toEqual([{ kind: 'redirects' }, ASSET_EVENT])
     })
   })
 
   it('schedules a sweep on a focal-point edit, a meta edit, a re-upload, and a delete', async () => {
-    await withScope(SCOPE, async () => {
+    await withRevalidationEnv(true, async () => {
       const t = await freshBackend()
       const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
 
@@ -147,20 +157,16 @@ describe('EC-579 — the write chokepoint revalidates on every asset edit', () =
       })
       await asAdmin.mutation(removeAsset, { assetId: assetArgs.assetId })
 
-      // The sweep, never an `asset:<id>` tag: a page does not carry the tag for an
-      // asset it reads through a document asset FIELD (`next/src/route-core.ts`,
-      // `scopeAssetsToPage`), so a per-asset tag would miss exactly those pages.
-      expect(await scheduledRevalidations(t)).toEqual([
-        { event: 'assets.upsert', tags: SWEEP },
-        { event: 'assets.upsert', tags: SWEEP },
-        { event: 'assets.upsert', tags: SWEEP },
-        { event: 'assets.remove', tags: SWEEP },
-      ])
+      // One event per edit and per delete — the same event for both: the receiver
+      // derives `asset:<id>` + the sweep either way (a page reading the asset through
+      // a document asset FIELD carries no `asset:` tag — `next/src/route-core.ts`
+      // `scopeAssetsToPage`, EC-589).
+      expect(await scheduledRevalidations(t)).toEqual([ASSET_EVENT, ASSET_EVENT, ASSET_EVENT, ASSET_EVENT])
     })
   })
 
   it('removing an asset that does not exist writes nothing and schedules nothing', async () => {
-    await withScope(SCOPE, async () => {
+    await withRevalidationEnv(true, async () => {
       const t = await freshBackend()
       const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
       await asAdmin.mutation(removeAsset, { assetId: 'asset_never_existed' })
@@ -168,8 +174,8 @@ describe('EC-579 — the write chokepoint revalidates on every asset edit', () =
     })
   })
 
-  it('stays a silent no-op on a deployment with no CANVAS_PROJECT_SCOPE', async () => {
-    await withScope(undefined, async () => {
+  it('stays a silent no-op on a deployment without the endpoint/secret pair', async () => {
+    await withRevalidationEnv(false, async () => {
       const t = await freshBackend()
       const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
       await asAdmin.mutation(upsertAsset, assetArgs)

package/convex/cms.ts

@@ -64,9 +64,9 @@ export const upsertDocument = mutation({
       // pinned published snapshot — the mutation has both sides, so the compare runs
       // ONCE here, in-transaction (never per list render). A no-op save compares
       // equal → `false` (never flips to true); a revert back to the published
-      // content clears a previously-true flag the same way. Schema-less lens
-      // (AD-11 — the deployment stores documents only); the compare is the editor's
-      // exact `documentsSemanticEqual`. Unpublished doc / missing pinned row →
+      // content clears a previously-true flag the same way. Schema-free (AD-11 — the
+      // deployment stores documents only); the compare is the editor's exact
+      // `documentsSemanticEqual`, the ONE def-less verdict over canonical forms (EC-586). Unpublished doc / missing pinned row →
       // absent-key patch preserves the row as-is (the flag doesn't apply).
       let changedFlag = {}
       if (existing.publishedVersion !== undefined) {
@@ -82,7 +82,6 @@ export const upsertDocument = mutation({
         if (pinned) {
           changedFlag = {
             hasUnpublishedChanges: !documentsSemanticEqual(
-              undefined,
               unfoldDocument(pinned.snapshot as CmsDocument),
               args.document as CmsDocument,
             ),

package/convex/delivery.ts

@@ -211,19 +211,17 @@ export const draftSnapshot = query({
 /**
  * EC-268: instant-publish configuration health for the studio UI. Returns ONLY
  * whether each delivery env var is set — never the values — so the studio can warn
- * when a publish would silently no-op. The pipeline gates on these: a publish only
- * schedules the webhook when `CANVAS_PROJECT_SCOPE` is set (the write-chokepoint
- * trigger's `scheduleRevalidate`, `triggers.ts`), and the webhook only fires when
- * `CANVAS_REVALIDATE_ENDPOINT` + `CANVAS_REVALIDATE_SECRET` are set
- * (`webhooks.ts` `deliver`). A future `elytra doctor` (EC-259) can read the same
- * query. Gated to deployment members (EC-304) — config state is not public, and
- * an authenticated non-member (open Password sign-up) is not a member.
+ * when a publish would silently no-op. The pipeline gates on exactly this pair: the
+ * write-chokepoint trigger schedules the webhook, and the `deliver` action sends it,
+ * only when `CANVAS_REVALIDATE_ENDPOINT` + `CANVAS_REVALIDATE_SECRET` are both set
+ * (`webhooks.ts` `revalidationTarget`). EC-579: there is no third, scope var — the
+ * host derives its tags with its own scope. Gated to deployment members (EC-304) —
+ * config state is not public, and an authenticated non-member (open Password
+ * sign-up) is not a member.
  */
 export const deliveryConfig = query({
   args: {},
-  handler: async (
-    ctx,
-  ): Promise<{ projectScope: boolean; revalidateEndpoint: boolean; revalidateSecret: boolean }> => {
+  handler: async (ctx): Promise<{ revalidateEndpoint: boolean; revalidateSecret: boolean }> => {
     await requireCapability(ctx, 'content.read')
     const env = process.env as Record<string, string | undefined>
     const isSet = (key: string): boolean => {
@@ -231,7 +229,6 @@ export const deliveryConfig = query({
       return typeof value === 'string' && value.trim() !== ''
     }
     return {
-      projectScope: isSet('CANVAS_PROJECT_SCOPE'),
       revalidateEndpoint: isSet('CANVAS_REVALIDATE_ENDPOINT'),
       revalidateSecret: isSet('CANVAS_REVALIDATE_SECRET'),
     }

package/convex/document-revalidate.test.ts

@@ -0,0 +1,188 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import schema from './schema'
+
+// convex-test fires a `runAfter(0)` schedule on a REAL `setTimeout`. These tests assert
+// only on the `_scheduled_functions` rows, so the real `webhooks:deliver` action (a fetch
+// to host.invalid) must never run: under a loaded full run it failed after this file's
+// environment closed, and convex-test's `console.error` for it then failed the whole run
+// (`EnvironmentTeardownError … onUserConsoleLog`, measured in the wave-0092 gate). Fake
+// timers keep the delivery queued and never fired; the rows are still written.
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * EC-579 — the write chokepoint is the ONE revalidation emitter, and it sends the
+ * EVENT, not tags.
+ *
+ * The REAL `cms:*` mutations through the REAL `functions.ts` trigger wrapper on
+ * `convex-test`'s in-memory backend, asserting on the `_scheduled_functions` system
+ * table: what `scheduleRevalidate` hands the `webhooks:deliver` action. The host
+ * receiver derives the tags from the event with its own scope and locales
+ * (`@elytracms/next` `revalidationTags`), so nothing here knows a tag format or a
+ * scope — the event carries only what changed.
+ *
+ * Documents reach the live wire only through their published pin (`delivery.ts`),
+ * so only a pin move or the delete of a pinned row is an event; a draft save, a
+ * version snapshot and the delete of a never-published row are not.
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+
+const upsertDocument = makeFunctionReference<'mutation'>('cms:upsertDocument')
+const saveVersion = makeFunctionReference<'mutation'>('cms:saveDocumentVersion')
+const publishVersion = makeFunctionReference<'mutation'>('cms:publishDocumentVersion')
+const unpublishDocument = makeFunctionReference<'mutation'>('cms:unpublishDocument')
+const deleteDocument = makeFunctionReference<'mutation'>('cms:deleteDocument')
+const deliverySnapshot = makeFunctionReference<'query'>('delivery:snapshot')
+
+const SESSION_USER_ID = 'user_admin'
+const STAMP = '2026-10-25T00:00:00.000Z'
+
+async function freshBackend() {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: SESSION_USER_ID, role: 'admin', createdAt: STAMP, updatedAt: STAMP })
+  })
+  return { t, asAdmin: t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' }) }
+}
+
+type Backend = Awaited<ReturnType<typeof freshBackend>>
+
+/** The scheduled `webhooks:deliver` calls, in order — the event each one carries. */
+async function scheduledEvents({ t }: Backend): Promise<unknown[]> {
+  return t.run(async (ctx) => {
+    const rows = await ctx.db.system.query('_scheduled_functions').collect()
+    return rows
+      .filter((row) => row.name.startsWith('webhooks'))
+      .map((row) => (row.args as [{ event?: unknown }])[0]?.event)
+  })
+}
+
+/** The Convex gate: the endpoint + secret pair the `deliver` action posts with. */
+function withRevalidationEnv<T>(configured: boolean, run: () => Promise<T>): Promise<T> {
+  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+  const keys = ['CANVAS_REVALIDATE_ENDPOINT', 'CANVAS_REVALIDATE_SECRET'] as const
+  const previous = keys.map((key) => env[key])
+  if (configured) {
+    env['CANVAS_REVALIDATE_ENDPOINT'] = 'https://host.invalid/api/revalidate'
+    env['CANVAS_REVALIDATE_SECRET'] = 'ec579-secret'
+  } else {
+    for (const key of keys) delete env[key]
+  }
+  return run().finally(() => {
+    keys.forEach((key, index) => {
+      const value = previous[index]
+      if (value === undefined) delete env[key]
+      else env[key] = value
+    })
+  })
+}
+
+function doc(collection: string, id: string, values: Record<string, unknown>) {
+  return { collection, id, values }
+}
+
+async function saveDraft({ asAdmin }: Backend, collection: string, id: string, values: Record<string, unknown>) {
+  await asAdmin.mutation(upsertDocument, {
+    collection,
+    docId: id,
+    document: doc(collection, id, values),
+    createdAt: STAMP,
+    updatedAt: STAMP,
+  })
+}
+
+async function publish(backend: Backend, collection: string, id: string, values: Record<string, unknown>) {
+  const version = (await backend.asAdmin.mutation(saveVersion, {
+    collection,
+    docId: id,
+    snapshot: doc(collection, id, values),
+    createdAt: STAMP,
+  })) as { version: number }
+  await backend.asAdmin.mutation(publishVersion, {
+    collection,
+    docId: id,
+    version: version.version,
+    updatedAt: STAMP,
+    publishedAt: STAMP,
+  })
+}
+
+describe('EC-579 — documents: one event per change to the live pin', () => {
+  it('publish, republish, unpublish and delete each schedule exactly one event with collection + id', async () => {
+    await withRevalidationEnv(true, async () => {
+      const backend = await freshBackend()
+      await saveDraft(backend, 'post', 'hello', { title: 'Draft' })
+      // A draft save is not live output: nothing scheduled.
+      expect(await scheduledEvents(backend)).toEqual([])
+
+      await publish(backend, 'post', 'hello', { title: 'v1' })
+      await publish(backend, 'post', 'hello', { title: 'v2' })
+      await backend.asAdmin.mutation(unpublishDocument, { collection: 'post', docId: 'hello', updatedAt: STAMP })
+      await publish(backend, 'post', 'hello', { title: 'v3' })
+      await backend.asAdmin.mutation(deleteDocument, { collection: 'post', docId: 'hello' })
+
+      expect(await scheduledEvents(backend)).toEqual([
+        { kind: 'publish', collection: 'post', id: 'hello' },
+        { kind: 'publish', collection: 'post', id: 'hello' },
+        { kind: 'unpublish', collection: 'post', id: 'hello' },
+        { kind: 'publish', collection: 'post', id: 'hello' },
+        { kind: 'delete', collection: 'post', id: 'hello' },
+      ])
+    })
+  })
+
+  it('a draft save on a PUBLISHED document, and the delete of a never-published one, schedule nothing', async () => {
+    await withRevalidationEnv(true, async () => {
+      const backend = await freshBackend()
+      await saveDraft(backend, 'post', 'live', { title: 'v1' })
+      await publish(backend, 'post', 'live', { title: 'v1' })
+      // Known-positive control: this instrument sees the publish.
+      expect(await scheduledEvents(backend)).toHaveLength(1)
+
+      await saveDraft(backend, 'post', 'live', { title: 'edited draft' })
+      await saveDraft(backend, 'post', 'never', { title: 'draft only' })
+      await backend.asAdmin.mutation(deleteDocument, { collection: 'post', docId: 'never' })
+      expect(await scheduledEvents(backend)).toHaveLength(1)
+    })
+  })
+
+  /**
+   * The wave-0089 finding (EC-579 Done § Found-but-left 4): a draft write to a
+   * `cms-data-sources` record changed the public snapshot and no revalidation fired.
+   * EC-574 deleted the snapshot's `sources` strand; this pins that it stays closed —
+   * the draft row is not on the published wire, so silence is correct.
+   */
+  it('a cms-data-sources draft write changes no published output and schedules nothing', async () => {
+    await withRevalidationEnv(true, async () => {
+      const backend = await freshBackend()
+      const before = await backend.t.query(deliverySnapshot, { projectId: 'p' })
+      await saveDraft(backend, 'cms-data-sources', 'source-1', { title: 'A data source' })
+      const after = await backend.t.query(deliverySnapshot, { projectId: 'p' })
+      expect(after).toEqual(before)
+      expect(await scheduledEvents(backend)).toEqual([])
+    })
+  })
+
+  it('stays a silent no-op on a deployment without the endpoint/secret pair — the write still lands', async () => {
+    await withRevalidationEnv(false, async () => {
+      const backend = await freshBackend()
+      await saveDraft(backend, 'post', 'hello', { title: 'v1' })
+      await publish(backend, 'post', 'hello', { title: 'v1' })
+      // The first test is the known-positive control for the same publish.
+      expect(await scheduledEvents(backend)).toEqual([])
+      expect(
+        await backend.t.run(async (ctx) => (await ctx.db.query('cmsDocuments').first())?.publishedVersion),
+      ).toBe(1)
+    })
+  })
+})

package/convex/redirect-revalidate.test.ts

@@ -1,15 +1,28 @@
-import { describe, expect, it } from 'vitest'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { convexTest } from 'convex-test'
 import { makeFunctionReference } from 'convex/server'
 import schema from './schema'
 
+// convex-test fires a `runAfter(0)` schedule on a REAL `setTimeout`. These tests assert
+// only on the `_scheduled_functions` rows, so the real `webhooks:deliver` action (a fetch
+// to host.invalid) must never run: under a loaded full run it failed after this file's
+// environment closed, and convex-test's `console.error` for it then failed the whole run
+// (`EnvironmentTeardownError … onUserConsoleLog`, measured in the wave-0092 gate). Fake
+// timers keep the delivery queued and never fired; the rows are still written.
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
 /**
- * EC-510 — the Convex half of "a redirect change must reach the live site".
+ * EC-510 — "a redirect change must reach the live site".
  *
- * The browser dispatcher (`src/lib/webhooks`) is one emitter; the EC-286 write
- * chokepoint is the other, and it is the one that catches writers the studio
- * does not own. Before this ticket a redirect write reached the host by
- * NEITHER, while a document publish reached it by both.
+ * The EC-286 write chokepoint is the ONE emitter (EC-579 deleted the studio's
+ * browser dispatcher), and it catches writers the studio does not own. Before
+ * EC-510 a redirect write reached the host by NO path, while a document publish
+ * reached it by two.
  *
  * This runs the REAL `redirects.save`/`redirects.remove` mutations through the
  * REAL `functions.ts` trigger wrapper on `convex-test`'s in-memory backend, and
@@ -17,10 +30,10 @@ import schema from './schema'
  * `scheduleRevalidate` actually produces (a mutation cannot `fetch`, so it hands
  * the signed POST to the `webhooks:deliver` action).
  *
- * The env var is the gate `scheduleRevalidate` reads: an unconfigured
- * deployment must stay a silent no-op, because publishing may never depend on a
- * reachable host. Both sides are pinned here so neither can regress into the
- * other.
+ * The endpoint/secret pair is the gate `scheduleRevalidate` reads: an
+ * unconfigured deployment must stay a silent no-op, because publishing may never
+ * depend on a reachable host. Both sides are pinned here so neither can regress
+ * into the other.
  */
 
 const modules = {
@@ -34,7 +47,6 @@ const saveRedirect = makeFunctionReference<'mutation'>('redirects:save')
 const removeRedirect = makeFunctionReference<'mutation'>('redirects:remove')
 
 const SESSION_USER_ID = 'user_admin'
-const SCOPE = 'ec510-scope'
 
 async function freshBackend() {
   const t = convexTest(schema, modules)
@@ -50,33 +62,33 @@ async function freshBackend() {
   return t
 }
 
-/** The scheduled `webhooks:deliver` calls, in order, as `{event, tags}`. */
-async function scheduledRevalidations(
-  t: Awaited<ReturnType<typeof freshBackend>>,
-): Promise<{ event: unknown; tags: unknown }[]> {
+/** The scheduled `webhooks:deliver` calls, in order — the event each one carries. */
+async function scheduledRevalidations(t: Awaited<ReturnType<typeof freshBackend>>): Promise<unknown[]> {
   return t.run(async (ctx) => {
     const rows = await ctx.db.system.query('_scheduled_functions').collect()
     return rows
       .filter((row) => row.name.startsWith('webhooks'))
-      .map((row) => {
-        const [args] = row.args as [{ event?: unknown; tags?: unknown }]
-        return { event: args?.event, tags: args?.tags }
-      })
+      .map((row) => (row.args as [{ event?: unknown }])[0]?.event)
   })
 }
 
-function withScope<T>(scope: string | undefined, run: () => Promise<T>): Promise<T> {
-  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process
-    ?.env
-  const previous = env?.['CANVAS_PROJECT_SCOPE']
-  if (env) {
-    if (scope === undefined) delete env['CANVAS_PROJECT_SCOPE']
-    else env['CANVAS_PROJECT_SCOPE'] = scope
+/** The Convex gate (EC-579): the endpoint + secret pair the `deliver` action posts with. */
+function withRevalidationEnv<T>(configured: boolean, run: () => Promise<T>): Promise<T> {
+  const env = (globalThis as { process: { env: Record<string, string | undefined> } }).process.env
+  const keys = ['CANVAS_REVALIDATE_ENDPOINT', 'CANVAS_REVALIDATE_SECRET'] as const
+  const previous = keys.map((key) => env[key])
+  if (configured) {
+    env['CANVAS_REVALIDATE_ENDPOINT'] = 'https://host.invalid/api/revalidate'
+    env['CANVAS_REVALIDATE_SECRET'] = 'ec579-secret'
+  } else {
+    for (const key of keys) delete env[key]
   }
   return run().finally(() => {
-    if (!env) return
-    if (previous === undefined) delete env['CANVAS_PROJECT_SCOPE']
-    else env['CANVAS_PROJECT_SCOPE'] = previous
+    keys.forEach((key, index) => {
+      const value = previous[index]
+      if (value === undefined) delete env[key]
+      else env[key] = value
+    })
   })
 }
 
@@ -91,8 +103,8 @@ const redirectArgs = {
 }
 
 describe('EC-510 — the write chokepoint revalidates on every redirect write', () => {
-  it('schedules a project sweep on create, retarget, disable, and delete', async () => {
-    await withScope(SCOPE, async () => {
+  it('schedules one `redirects` event on create, retarget, disable, and delete', async () => {
+    await withRevalidationEnv(true, async () => {
       const t = await freshBackend()
       const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
 
@@ -103,17 +115,18 @@ describe('EC-510 — the write chokepoint revalidates on every redirect write',
       await asAdmin.mutation(saveRedirect, { ...redirectArgs, enabled: false })
       await asAdmin.mutation(removeRedirect, { redirectId: redirectArgs.redirectId })
 
+      // The receiver answers each with the project sweep (`revalidationTags`).
       expect(await scheduledRevalidations(t)).toEqual([
-        { event: 'redirects.save', tags: [`p:${SCOPE}:project`] },
-        { event: 'redirects.save', tags: [`p:${SCOPE}:project`] },
-        { event: 'redirects.save', tags: [`p:${SCOPE}:project`] },
-        { event: 'redirects.remove', tags: [`p:${SCOPE}:project`] },
+        { kind: 'redirects' },
+        { kind: 'redirects' },
+        { kind: 'redirects' },
+        { kind: 'redirects' },
       ])
     })
   })
 
-  it('stays a silent no-op on a deployment with no CANVAS_PROJECT_SCOPE', async () => {
-    await withScope(undefined, async () => {
+  it('stays a silent no-op on a deployment without the endpoint/secret pair', async () => {
+    await withRevalidationEnv(false, async () => {
       const t = await freshBackend()
       const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
       await asAdmin.mutation(saveRedirect, redirectArgs)

package/convex/revalidate.ts

@@ -1,5 +1,7 @@
 import { makeFunctionReference } from 'convex/server'
+import type { RevalidationEvent } from '@elytracms/core/revalidation'
 import type { MutationCtx } from './functions'
+import { revalidationTarget } from './webhooks'
 
 // EC-223: the studio's convex functions address each other by STRING ref
 // (resolved against the consumer's deployment), never the per-deployment
@@ -7,40 +9,26 @@ import type { MutationCtx } from './functions'
 const webhooksDeliver = makeFunctionReference<'action'>('webhooks:deliver')
 
 /**
- * EC-146 / EC-180 — schedule the host revalidation webhook after a publish-state
- * change. A mutation cannot `fetch`, so it hands off to the `webhooks.deliver`
- * internal action (it signs + POSTs server-side; the secret never leaves Convex).
+ * EC-146 / EC-180 / EC-579 — schedule the host revalidation webhook for one change to
+ * the live wire. A mutation cannot `fetch`, so it hands the typed event to the
+ * `webhooks.deliver` internal action (it signs + POSTs server-side; the secret never
+ * leaves Convex).
  *
- * The v1 invalidation is the whole-project sweep tag `p:<scope>:project` — every
- * cached host page carries it (`@elytracms/next` `nextCacheTags` stamps it on
- * every entry), so it is GUARANTEED to drop the affected pages with no tag-format
- * coupling that could silently miss. `scope` must equal the host's `cache.scope`
- * (its `ELYTRA_PROJECT_ID`); it comes from the `CANVAS_PROJECT_SCOPE` Convex env
- * var. An unconfigured deployment (local dev, no env) is a silent no-op —
- * publishing must never depend on a reachable host.
+ * The event says WHAT changed (`{ kind, collection?, id? }`); it carries no tags and no
+ * scope. The host receiver derives the tags with its own scope and locales
+ * (`@elytracms/next` `revalidationTags`), which is the one place that knows how its
+ * cache entries are tagged — including, until EC-515 lands, the project sweep it adds
+ * to every event that changes live output.
+ *
+ * Gate: the endpoint + secret pair (`revalidationTarget`, the one reader of it). An
+ * unconfigured deployment (local dev, no env) is a silent no-op — publishing must never
+ * depend on a reachable host.
  *
  * Called from the EC-286 write-chokepoint triggers only, so every writer of a
  * live-wire table is covered by construction. Which tables, and which of their
  * writes, is declared once — in `triggers.ts`, not here.
- *
- * Doc/collection-scoped tags (matching the client dispatcher's
- * `webhookTagsForEvent`) would be more surgical for DOCUMENTS, but need the
- * project locales — not available in the Convex env here. The sweep is the
- * honest, reliable v1; threading scoped tags is a precision follow-up. For
- * redirects the sweep is not a compromise but the correct answer — see
- * `ROUTING_OPERATIONS` in `src/lib/webhooks/tags.ts`. For assets it is the only
- * correct answer today: a page reading an asset through a document asset field
- * carries no `asset:<id>` tag (EC-566 D16), so the per-asset tag the browser
- * dispatcher emits would miss it.
  */
-export async function scheduleRevalidate(ctx: MutationCtx, event: string): Promise<void> {
-  const env =
-    (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ?? {}
-  const scope = env['CANVAS_PROJECT_SCOPE']
-  if (!scope) return
-  await ctx.scheduler.runAfter(0, webhooksDeliver, {
-    projectId: scope,
-    event,
-    tags: [`p:${scope}:project`],
-  })
+export async function scheduleRevalidate(ctx: MutationCtx, event: RevalidationEvent): Promise<void> {
+  if (!revalidationTarget()) return
+  await ctx.scheduler.runAfter(0, webhooksDeliver, { event })
 }