@elytracms/studio 0.0.88 → 0.0.91

package/dist/lib/webhooks/config.js

@@ -1,65 +0,0 @@
-import { attachRevalidationWebhooks } from './dispatcher.js';
-import { studioEnv } from '../persistence/backend-mode.js';
-import { resolveDeploymentLocales } from '../workspace/index.js';
-/**
- * Environment wiring for the EC-146 revalidation webhooks. The dispatcher is
- * attached only when a host endpoint is configured, so dev sessions and tests
- * (no env) run with zero webhook overhead.
- *
- * Configuration (Vite client env; SSR falls back to `process.env`):
- *
- * - `VITE_REVALIDATE_ENDPOINT` — the host's revalidate route URL
- *   (e.g. `https://example-site.vercel.app/api/revalidate`)
- * - `VITE_REVALIDATE_SECRET` — shared HMAC secret (must equal the host's
- *   `REVALIDATE_SECRET`). Browser-exposed by design in the v1 dispatch path —
- *   see the CORS/secret notes in `dispatcher.ts`.
- * - `VITE_REVALIDATE_LOCALES` — optional comma-separated locale list that can ADD
- *   locales to the revalidation tag set. It can never NARROW it: the project's
- *   `elytra.config.ts` locales are always covered (EC-192), so a non-default
- *   locale like `/de` can never be the one left stale after a publish.
- *
- * The host must allow the studio origin via
- * `createRevalidateRoute({ allowOrigin })` for the browser preflight to pass.
- */
-// EC-357: env reads go through the ONE studio env surface (`studioEnv()` — the
-// mount-provided env first, then the engine-visible Vite env over `process.env`).
-// A direct `import.meta.env` read here would be dep-optimized away in a real
-// consumer (pinned by `env-read-discipline.test.ts`).
-function readEnv(name) {
-    return studioEnv()[name];
-}
-/**
- * Attach the dispatcher from environment configuration. Returns `null` when
- * no endpoint/secret is configured (the common local-dev case).
- */
-export function attachConfiguredRevalidationWebhooks(events) {
-    const url = readEnv('VITE_REVALIDATE_ENDPOINT');
-    const secret = readEnv('VITE_REVALIDATE_SECRET');
-    if (!url || !secret)
-        return null;
-    return attachRevalidationWebhooks(events, {
-        endpoints: [{ url, secret }],
-        locales: revalidationLocales(),
-        onError: (error, context) => {
-            // Visible, never fatal: a host outage must not break editing.
-            console.warn(`[elytra] revalidation webhook delivery failed (${context.url})`, error);
-        },
-    });
-}
-/**
- * The locales the dispatcher emits per-collection tags for. The project's
- * configured locales (the same set the host tags by) are always covered so no
- * locale can be silently dropped (EC-192 — the `/de` freshness fix); the
- * `VITE_REVALIDATE_LOCALES` env may only ADD to that set. Falls back to `en`
- * only when neither config nor env supplies a locale (env-only wiring).
- */
-export function revalidationLocales() {
-    const configLocales = resolveDeploymentLocales();
-    const envLocales = (readEnv('VITE_REVALIDATE_LOCALES') ?? '')
-        .split(',')
-        .map((locale) => locale.trim())
-        .filter((locale) => locale.length > 0);
-    const union = [...new Set([...configLocales, ...envLocales])];
-    return union.length > 0 ? union : ['en'];
-}
-//# sourceMappingURL=config.js.map

package/dist/lib/webhooks/config.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/webhooks/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAA;AAEvD;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+EAA+E;AAC/E,kFAAkF;AAClF,6EAA6E;AAC7E,sDAAsD;AACtD,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,SAAS,EAAE,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAClD,MAAyB;IAEzB,MAAM,GAAG,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAChD,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAEhC,OAAO,0BAA0B,CAAC,MAAM,EAAE;QACxC,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,mBAAmB,EAAE;QAC9B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1B,8DAA8D;YAC9D,OAAO,CAAC,IAAI,CAAC,kDAAkD,OAAO,CAAC,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;QACvF,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,aAAa,GAAG,wBAAwB,EAAE,CAAA;IAChD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC;SAC1D,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAC1C,CAAC","sourcesContent":["import type { OperationEventBus } from '@elytracms/core/operations'\nimport { attachRevalidationWebhooks } from './dispatcher'\nimport type { WebhookDispatcherAttachment } from './dispatcher'\nimport { studioEnv } from '../persistence/backend-mode'\nimport { resolveDeploymentLocales } from '../workspace'\n\n/**\n * Environment wiring for the EC-146 revalidation webhooks. The dispatcher is\n * attached only when a host endpoint is configured, so dev sessions and tests\n * (no env) run with zero webhook overhead.\n *\n * Configuration (Vite client env; SSR falls back to `process.env`):\n *\n * - `VITE_REVALIDATE_ENDPOINT` — the host's revalidate route URL\n *   (e.g. `https://example-site.vercel.app/api/revalidate`)\n * - `VITE_REVALIDATE_SECRET` — shared HMAC secret (must equal the host's\n *   `REVALIDATE_SECRET`). Browser-exposed by design in the v1 dispatch path —\n *   see the CORS/secret notes in `dispatcher.ts`.\n * - `VITE_REVALIDATE_LOCALES` — optional comma-separated locale list that can ADD\n *   locales to the revalidation tag set. It can never NARROW it: the project's\n *   `elytra.config.ts` locales are always covered (EC-192), so a non-default\n *   locale like `/de` can never be the one left stale after a publish.\n *\n * The host must allow the studio origin via\n * `createRevalidateRoute({ allowOrigin })` for the browser preflight to pass.\n */\n\n// EC-357: env reads go through the ONE studio env surface (`studioEnv()` — the\n// mount-provided env first, then the engine-visible Vite env over `process.env`).\n// A direct `import.meta.env` read here would be dep-optimized away in a real\n// consumer (pinned by `env-read-discipline.test.ts`).\nfunction readEnv(name: string): string | undefined {\n  return studioEnv()[name]\n}\n\n/**\n * Attach the dispatcher from environment configuration. Returns `null` when\n * no endpoint/secret is configured (the common local-dev case).\n */\nexport function attachConfiguredRevalidationWebhooks(\n  events: OperationEventBus,\n): WebhookDispatcherAttachment | null {\n  const url = readEnv('VITE_REVALIDATE_ENDPOINT')\n  const secret = readEnv('VITE_REVALIDATE_SECRET')\n  if (!url || !secret) return null\n\n  return attachRevalidationWebhooks(events, {\n    endpoints: [{ url, secret }],\n    locales: revalidationLocales(),\n    onError: (error, context) => {\n      // Visible, never fatal: a host outage must not break editing.\n      console.warn(`[elytra] revalidation webhook delivery failed (${context.url})`, error)\n    },\n  })\n}\n\n/**\n * The locales the dispatcher emits per-collection tags for. The project's\n * configured locales (the same set the host tags by) are always covered so no\n * locale can be silently dropped (EC-192 — the `/de` freshness fix); the\n * `VITE_REVALIDATE_LOCALES` env may only ADD to that set. Falls back to `en`\n * only when neither config nor env supplies a locale (env-only wiring).\n */\nexport function revalidationLocales(): string[] {\n  const configLocales = resolveDeploymentLocales()\n  const envLocales = (readEnv('VITE_REVALIDATE_LOCALES') ?? '')\n    .split(',')\n    .map((locale) => locale.trim())\n    .filter((locale) => locale.length > 0)\n  const union = [...new Set([...configLocales, ...envLocales])]\n  return union.length > 0 ? union : ['en']\n}\n"]}

package/dist/lib/webhooks/dispatcher.d.ts

@@ -1,70 +0,0 @@
-import type { OperationEvent, OperationEventBus } from '@elytracms/core/operations';
-/**
- * Revalidation webhook dispatcher (EC-146): subscribes to the EC-139
- * operations event bus and POSTs a signed `{projectId, event, tags,
- * timestamp}` payload to every configured host revalidate endpoint whenever a
- * command that can change **published** output succeeds (document
- * publish/unpublish/pinVersion/delete, editorial redirect save/remove, plus
- * asset edits — EC-501 narrowed this from "any document write": a draft save
- * cannot move published state, so it fires nothing; EC-510 added the redirect
- * writes, which plainly can). The host's `createRevalidateRoute` (`@elytracms/next`)
- * verifies the HMAC and maps the tags onto `revalidateTag`.
- *
- * This runs **wherever the operations client runs** — in the v1 studio that
- * is the browser, so deliveries are cross-origin `fetch` calls. CORS
- * implications (documented honestly):
- *
- * - the custom signature header always triggers a preflight, so the host
- *   endpoint must answer `OPTIONS` and allow the studio origin —
- *   `createRevalidateRoute({ allowOrigin })` does both;
- * - the shared secret necessarily ships in the studio bundle in this mode.
- *   Acceptable for v1 (the secret only gates cache invalidation, never
- *   content access); the server-side Convex action variant
- *   (`apps/builder/convex/webhooks.ts`) keeps the secret out of the browser
- *   for Convex-backed deployments.
- *
- * Deliveries are fire-and-forget on a serial queue (same pattern as the
- * EC-155 reference index): a slow or unreachable host never blocks the
- * command pipeline, failures surface through `onError` only, and tests await
- * `flush()` for determinism.
- */
-export interface WebhookEndpoint {
-    /** Absolute URL of the host's revalidate route, e.g. `https://site/api/revalidate`. */
-    url: string;
-    /** Shared HMAC secret for this endpoint. */
-    secret: string;
-}
-export interface WebhookDispatcherOptions {
-    endpoints: readonly WebhookEndpoint[];
-    /**
-     * All locales the project serves. Document events sweep the collection
-     * membership tag once per locale (`collection:<name>:<locale>`).
-     */
-    locales: readonly string[];
-    /** Injectable transport (tests); defaults to global `fetch`. */
-    fetchFn?: typeof fetch;
-    /** Injectable clock (tests); payload `timestamp` is `now().toISOString()`. */
-    now?: () => Date;
-    /** Delivery failures land here (never thrown into the command pipeline). */
-    onError?: (error: unknown, context: {
-        url: string;
-        event: OperationEvent;
-    }) => void;
-}
-export interface WebhookDispatcherAttachment {
-    detach(): void;
-    /** Await all queued deliveries (tests / shutdown). */
-    flush(): Promise<void>;
-}
-/** The signed payload shape (mirror of `revalidatePayloadSchema` in @elytracms/next). */
-export interface RevalidateWebhookPayload {
-    projectId: string;
-    event: string;
-    tags: string[];
-    timestamp: string;
-}
-/**
- * Attach the dispatcher to an event bus; returns a detach/flush handle.
- * With no endpoints configured this still subscribes but never queues work.
- */
-export declare function attachRevalidationWebhooks(events: OperationEventBus, options: WebhookDispatcherOptions): WebhookDispatcherAttachment;

package/dist/lib/webhooks/dispatcher.js

@@ -1,61 +0,0 @@
-import { WEBHOOK_SIGNATURE_HEADER, signWebhookBody } from './signing.js';
-import { webhookTagsForEvent } from './tags.js';
-async function deliver(endpoint, tagSet, timestamp, fetchFn) {
-    const payload = {
-        projectId: tagSet.projectId,
-        event: tagSet.event,
-        tags: tagSet.tags,
-        timestamp,
-    };
-    // Sign the exact string that goes on the wire.
-    const rawBody = JSON.stringify(payload);
-    const signature = await signWebhookBody(rawBody, endpoint.secret);
-    const response = await fetchFn(endpoint.url, {
-        method: 'POST',
-        headers: {
-            'content-type': 'application/json',
-            [WEBHOOK_SIGNATURE_HEADER]: signature,
-        },
-        body: rawBody,
-    });
-    if (!response.ok) {
-        throw new Error(`Revalidation webhook to ${endpoint.url} answered ${response.status}.`);
-    }
-}
-/**
- * Attach the dispatcher to an event bus; returns a detach/flush handle.
- * With no endpoints configured this still subscribes but never queues work.
- */
-export function attachRevalidationWebhooks(events, options) {
-    const fetchFn = options.fetchFn ?? fetch;
-    const now = options.now ?? (() => new Date());
-    let pending = Promise.resolve();
-    const listener = (event) => {
-        if (options.endpoints.length === 0)
-            return;
-        const tagSet = webhookTagsForEvent(event, { locales: options.locales });
-        if (!tagSet)
-            return;
-        const timestamp = now().toISOString();
-        for (const endpoint of options.endpoints) {
-            pending = pending
-                .then(() => deliver(endpoint, tagSet, timestamp, fetchFn))
-                .catch((error) => {
-                options.onError?.(error, { url: endpoint.url, event });
-            });
-        }
-    };
-    const unsubscribe = events.subscribe(listener);
-    return {
-        detach: unsubscribe,
-        flush: async () => {
-            // Drain until no new deliveries were queued while awaiting.
-            let current;
-            do {
-                current = pending;
-                await current;
-            } while (current !== pending);
-        },
-    };
-}
-//# sourceMappingURL=dispatcher.js.map

package/dist/lib/webhooks/dispatcher.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../../src/lib/webhooks/dispatcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAA;AAqE5C,KAAK,UAAU,OAAO,CACpB,QAAyB,EACzB,MAAqB,EACrB,SAAiB,EACjB,OAAqB;IAErB,MAAM,OAAO,GAA6B;QACxC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS;KACV,CAAA;IACD,+CAA+C;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,CAAC,wBAAwB,CAAC,EAAE,SAAS;SACtC;QACD,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,2BAA2B,QAAQ,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACzF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAyB,EACzB,OAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAA;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAE7C,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAE9C,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAQ,EAAE;QAC/C,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACvE,IAAI,CAAC,MAAM;YAAE,OAAM;QACnB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,WAAW,EAAE,CAAA;QACrC,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzC,OAAO,GAAG,OAAO;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;iBACzD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACxB,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;YACxD,CAAC,CAAC,CAAA;QACN,CAAC;IACH,CAAC,CAAA;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC9C,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,4DAA4D;YAC5D,IAAI,OAAsB,CAAA;YAC1B,GAAG,CAAC;gBACF,OAAO,GAAG,OAAO,CAAA;gBACjB,MAAM,OAAO,CAAA;YACf,CAAC,QAAQ,OAAO,KAAK,OAAO,EAAC;QAC/B,CAAC;KACF,CAAA;AACH,CAAC","sourcesContent":["import type { OperationEvent, OperationEventBus } from '@elytracms/core/operations'\nimport { WEBHOOK_SIGNATURE_HEADER, signWebhookBody } from './signing'\nimport { webhookTagsForEvent } from './tags'\nimport type { WebhookTagSet } from './tags'\n\n/**\n * Revalidation webhook dispatcher (EC-146): subscribes to the EC-139\n * operations event bus and POSTs a signed `{projectId, event, tags,\n * timestamp}` payload to every configured host revalidate endpoint whenever a\n * command that can change **published** output succeeds (document\n * publish/unpublish/pinVersion/delete, editorial redirect save/remove, plus\n * asset edits — EC-501 narrowed this from \"any document write\": a draft save\n * cannot move published state, so it fires nothing; EC-510 added the redirect\n * writes, which plainly can). The host's `createRevalidateRoute` (`@elytracms/next`)\n * verifies the HMAC and maps the tags onto `revalidateTag`.\n *\n * This runs **wherever the operations client runs** — in the v1 studio that\n * is the browser, so deliveries are cross-origin `fetch` calls. CORS\n * implications (documented honestly):\n *\n * - the custom signature header always triggers a preflight, so the host\n *   endpoint must answer `OPTIONS` and allow the studio origin —\n *   `createRevalidateRoute({ allowOrigin })` does both;\n * - the shared secret necessarily ships in the studio bundle in this mode.\n *   Acceptable for v1 (the secret only gates cache invalidation, never\n *   content access); the server-side Convex action variant\n *   (`apps/builder/convex/webhooks.ts`) keeps the secret out of the browser\n *   for Convex-backed deployments.\n *\n * Deliveries are fire-and-forget on a serial queue (same pattern as the\n * EC-155 reference index): a slow or unreachable host never blocks the\n * command pipeline, failures surface through `onError` only, and tests await\n * `flush()` for determinism.\n */\n\nexport interface WebhookEndpoint {\n  /** Absolute URL of the host's revalidate route, e.g. `https://site/api/revalidate`. */\n  url: string\n  /** Shared HMAC secret for this endpoint. */\n  secret: string\n}\n\nexport interface WebhookDispatcherOptions {\n  endpoints: readonly WebhookEndpoint[]\n  /**\n   * All locales the project serves. Document events sweep the collection\n   * membership tag once per locale (`collection:<name>:<locale>`).\n   */\n  locales: readonly string[]\n  /** Injectable transport (tests); defaults to global `fetch`. */\n  fetchFn?: typeof fetch\n  /** Injectable clock (tests); payload `timestamp` is `now().toISOString()`. */\n  now?: () => Date\n  /** Delivery failures land here (never thrown into the command pipeline). */\n  onError?: (error: unknown, context: { url: string; event: OperationEvent }) => void\n}\n\nexport interface WebhookDispatcherAttachment {\n  detach(): void\n  /** Await all queued deliveries (tests / shutdown). */\n  flush(): Promise<void>\n}\n\n/** The signed payload shape (mirror of `revalidatePayloadSchema` in @elytracms/next). */\nexport interface RevalidateWebhookPayload {\n  projectId: string\n  event: string\n  tags: string[]\n  timestamp: string\n}\n\nasync function deliver(\n  endpoint: WebhookEndpoint,\n  tagSet: WebhookTagSet,\n  timestamp: string,\n  fetchFn: typeof fetch,\n): Promise<void> {\n  const payload: RevalidateWebhookPayload = {\n    projectId: tagSet.projectId,\n    event: tagSet.event,\n    tags: tagSet.tags,\n    timestamp,\n  }\n  // Sign the exact string that goes on the wire.\n  const rawBody = JSON.stringify(payload)\n  const signature = await signWebhookBody(rawBody, endpoint.secret)\n  const response = await fetchFn(endpoint.url, {\n    method: 'POST',\n    headers: {\n      'content-type': 'application/json',\n      [WEBHOOK_SIGNATURE_HEADER]: signature,\n    },\n    body: rawBody,\n  })\n  if (!response.ok) {\n    throw new Error(`Revalidation webhook to ${endpoint.url} answered ${response.status}.`)\n  }\n}\n\n/**\n * Attach the dispatcher to an event bus; returns a detach/flush handle.\n * With no endpoints configured this still subscribes but never queues work.\n */\nexport function attachRevalidationWebhooks(\n  events: OperationEventBus,\n  options: WebhookDispatcherOptions,\n): WebhookDispatcherAttachment {\n  const fetchFn = options.fetchFn ?? fetch\n  const now = options.now ?? (() => new Date())\n\n  let pending: Promise<void> = Promise.resolve()\n\n  const listener = (event: OperationEvent): void => {\n    if (options.endpoints.length === 0) return\n    const tagSet = webhookTagsForEvent(event, { locales: options.locales })\n    if (!tagSet) return\n    const timestamp = now().toISOString()\n    for (const endpoint of options.endpoints) {\n      pending = pending\n        .then(() => deliver(endpoint, tagSet, timestamp, fetchFn))\n        .catch((error: unknown) => {\n          options.onError?.(error, { url: endpoint.url, event })\n        })\n    }\n  }\n\n  const unsubscribe = events.subscribe(listener)\n  return {\n    detach: unsubscribe,\n    flush: async () => {\n      // Drain until no new deliveries were queued while awaiting.\n      let current: Promise<void>\n      do {\n        current = pending\n        await current\n      } while (current !== pending)\n    },\n  }\n}\n"]}

package/dist/lib/webhooks/index.d.ts

@@ -1,11 +0,0 @@
-/**
- * EC-146 instant publish, emitter side: operations-event-driven webhook
- * dispatch to host revalidate endpoints. See `dispatcher.ts` for the
- * delivery/CORS model and `tags.ts` for the tag computation.
- */
-export { attachRevalidationWebhooks } from './dispatcher.js';
-export type { RevalidateWebhookPayload, WebhookDispatcherAttachment, WebhookDispatcherOptions, WebhookEndpoint, } from './dispatcher.js';
-export { attachConfiguredRevalidationWebhooks } from './config.js';
-export { WEBHOOK_SIGNATURE_HEADER, signWebhookBody } from './signing.js';
-export { collectionWebhookTag, docWebhookTag, projectSweepWebhookTag, webhookTagsForEvent, } from './tags.js';
-export type { WebhookTagSet } from './tags.js';

package/dist/lib/webhooks/index.js

@@ -1,10 +0,0 @@
-/**
- * EC-146 instant publish, emitter side: operations-event-driven webhook
- * dispatch to host revalidate endpoints. See `dispatcher.ts` for the
- * delivery/CORS model and `tags.ts` for the tag computation.
- */
-export { attachRevalidationWebhooks } from './dispatcher.js';
-export { attachConfiguredRevalidationWebhooks } from './config.js';
-export { WEBHOOK_SIGNATURE_HEADER, signWebhookBody } from './signing.js';
-export { collectionWebhookTag, docWebhookTag, projectSweepWebhookTag, webhookTagsForEvent, } from './tags.js';
-//# sourceMappingURL=index.js.map

package/dist/lib/webhooks/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAOzD,OAAO,EAAE,oCAAoC,EAAE,MAAM,UAAU,CAAA;AAC/D,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,QAAQ,CAAA","sourcesContent":["/**\n * EC-146 instant publish, emitter side: operations-event-driven webhook\n * dispatch to host revalidate endpoints. See `dispatcher.ts` for the\n * delivery/CORS model and `tags.ts` for the tag computation.\n */\nexport { attachRevalidationWebhooks } from './dispatcher'\nexport type {\n  RevalidateWebhookPayload,\n  WebhookDispatcherAttachment,\n  WebhookDispatcherOptions,\n  WebhookEndpoint,\n} from './dispatcher'\nexport { attachConfiguredRevalidationWebhooks } from './config'\nexport { WEBHOOK_SIGNATURE_HEADER, signWebhookBody } from './signing'\nexport {\n  collectionWebhookTag,\n  docWebhookTag,\n  projectSweepWebhookTag,\n  webhookTagsForEvent,\n} from './tags'\nexport type { WebhookTagSet } from './tags'\n"]}

package/dist/lib/webhooks/signing.d.ts

@@ -1,15 +0,0 @@
-/**
- * HMAC-SHA256 webhook signing (EC-146), emitter side.
- *
- * Uses the Web Crypto API (`crypto.subtle`) so the same code runs in the
- * browser (the v1 studio dispatcher), in Node tests, and in Convex actions.
- * The receiving end (`@elytracms/next` `evaluateRevalidateRequest`) verifies
- * the same scheme with `node:crypto` and a timing-safe compare.
- *
- * The signature is computed over the **exact raw body string** that is sent
- * — never re-serialize between signing and sending.
- */
-/** Header carrying the signature (mirror of `REVALIDATE_SIGNATURE_HEADER`). */
-export declare const WEBHOOK_SIGNATURE_HEADER = "x-elytra-signature";
-/** Sign a raw webhook body: `sha256=<hex hmac>`. */
-export declare function signWebhookBody(rawBody: string, secret: string): Promise<string>;

package/dist/lib/webhooks/signing.js

@@ -1,24 +0,0 @@
-/**
- * HMAC-SHA256 webhook signing (EC-146), emitter side.
- *
- * Uses the Web Crypto API (`crypto.subtle`) so the same code runs in the
- * browser (the v1 studio dispatcher), in Node tests, and in Convex actions.
- * The receiving end (`@elytracms/next` `evaluateRevalidateRequest`) verifies
- * the same scheme with `node:crypto` and a timing-safe compare.
- *
- * The signature is computed over the **exact raw body string** that is sent
- * — never re-serialize between signing and sending.
- */
-/** Header carrying the signature (mirror of `REVALIDATE_SIGNATURE_HEADER`). */
-export const WEBHOOK_SIGNATURE_HEADER = 'x-elytra-signature';
-function toHex(buffer) {
-    return [...new Uint8Array(buffer)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
-}
-/** Sign a raw webhook body: `sha256=<hex hmac>`. */
-export async function signWebhookBody(rawBody, secret) {
-    const encoder = new TextEncoder();
-    const key = await crypto.subtle.importKey('raw', encoder.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-    const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(rawBody));
-    return `sha256=${toHex(signature)}`;
-}
-//# sourceMappingURL=signing.js.map

package/dist/lib/webhooks/signing.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../../src/lib/webhooks/signing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAA;AAE5D,SAAS,KAAK,CAAC,MAAmB;IAChC,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC/F,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc;IACnE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAChF,OAAO,UAAU,KAAK,CAAC,SAAS,CAAC,EAAE,CAAA;AACrC,CAAC","sourcesContent":["/**\n * HMAC-SHA256 webhook signing (EC-146), emitter side.\n *\n * Uses the Web Crypto API (`crypto.subtle`) so the same code runs in the\n * browser (the v1 studio dispatcher), in Node tests, and in Convex actions.\n * The receiving end (`@elytracms/next` `evaluateRevalidateRequest`) verifies\n * the same scheme with `node:crypto` and a timing-safe compare.\n *\n * The signature is computed over the **exact raw body string** that is sent\n * — never re-serialize between signing and sending.\n */\n\n/** Header carrying the signature (mirror of `REVALIDATE_SIGNATURE_HEADER`). */\nexport const WEBHOOK_SIGNATURE_HEADER = 'x-elytra-signature'\n\nfunction toHex(buffer: ArrayBuffer): string {\n  return [...new Uint8Array(buffer)].map((byte) => byte.toString(16).padStart(2, '0')).join('')\n}\n\n/** Sign a raw webhook body: `sha256=<hex hmac>`. */\nexport async function signWebhookBody(rawBody: string, secret: string): Promise<string> {\n  const encoder = new TextEncoder()\n  const key = await crypto.subtle.importKey(\n    'raw',\n    encoder.encode(secret),\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(rawBody))\n  return `sha256=${toHex(signature)}`\n}\n"]}

package/dist/lib/webhooks/tags.d.ts

@@ -1,25 +0,0 @@
-import type { OperationEvent } from '@elytracms/core/operations';
-/** `p:<projectId>:doc:<collection>:<id>` — mirror of `docCacheTag`. */
-export declare function docWebhookTag(projectId: string, collection: string, id: string): string;
-/** `p:<projectId>:collection:<name>:<locale>` — mirror of `collectionCacheTag`. */
-export declare function collectionWebhookTag(projectId: string, collection: string, locale: string): string;
-/** `p:<projectId>:asset:<id>` — mirror of `assetCacheTag` (EC-227). */
-export declare function assetWebhookTag(projectId: string, assetId: string): string;
-/** `p:<projectId>:project` — mirror of `projectSweepTag`. */
-export declare function projectSweepWebhookTag(projectId: string): string;
-/** One computed webhook emission: which project, why, and which tags. */
-export interface WebhookTagSet {
-    projectId: string;
-    /** The operation name, carried verbatim as the webhook `event`. */
-    event: string;
-    /** Sorted, deduplicated, fully scoped Next tag strings. */
-    tags: string[];
-}
-/**
- * Compute the webhook tag set for one lifecycle event, or `null` when the
- * event is not a successful publish-shaped command (queries, failures, and
- * unrelated domains never fire webhooks).
- */
-export declare function webhookTagsForEvent(event: Pick<OperationEvent, 'operation' | 'kind' | 'status' | 'inputSummary'>, options: {
-    locales: readonly string[];
-}): WebhookTagSet | null;

package/dist/lib/webhooks/tags.js

@@ -1,289 +0,0 @@
-/**
- * Pure tag computation for the EC-146 revalidation webhooks: map a succeeded
- * publish-shaped operation event onto the Next cache tags it invalidates.
- *
- * ## Tag format (mirror of `packages/next/src/cache.ts`)
- *
- * The canonical tag format lives in `@elytracms/next` (`src/cache.ts`). The
- * builder cannot depend on that package — it would drag the `next` peer
- * dependency into the studio bundle — so the three formatters are mirrored
- * here. Both sides pin the exact literal strings in their tests
- * (`tags.test.ts` here, `cache.test.ts` there) to keep them in lock-step.
- *
- * Every emitted tag is scoped `p:<projectId>:…` — the dispatcher always knows
- * the project id, and the scope keeps multi-project hosts from
- * cross-invalidating. Hosts must configure the same id as `cache.scope`.
- *
- * ## Which events produce which tags
- *
- * The gate is **"can this operation change PUBLISHED output?"** — not "did this
- * operation touch a document" (EC-501). Live delivery is published-only, so an
- * operation that cannot move published state has no cache entry to drop and
- * every tag it emits is waste by construction.
- *
- * - **Document publish/unpublish/pin/delete** (`documents.publish`,
- *   `documents.unpublish`, `documents.pinVersion`, `documents.delete`): the
- *   document's own
- *   `doc:<collection>:<id>` tag — dropping its detail page *and every cached
- *   list that actually contained it* (fetch-time tagging) — plus the coarse
- *   `collection:<name>:<locale>` membership tag for **all** configured
- *   locales, sweeping cached lists whose membership may have changed
- *   (new/removed/newly-matching documents).
- * - **Document SAVE** (`documents.upsert`) fires **nothing** — see
- *   {@link PUBLISHED_STATE_OPERATIONS}.
- * - **Editorial redirect write** (`redirects.save`, `redirects.remove`,
- *   EC-510): the whole-project sweep tag — deliberately coarse, see
- *   {@link ROUTING_OPERATIONS}.
- * - **Asset edit** (`assets.upsert` of an existing asset, `assets.remove`,
- *   EC-227): the `asset:<id>` tag, dropping exactly the pages that *baked* that
- *   asset's delivery shape (alt/dimensions/url). An `assets.upsert` CREATE (no
- *   id in the summary — minted server-side) fires nothing: a brand-new asset is
- *   in no cached page yet.
- * - **Fallback**: when a `documents` (or `assets.remove`) event's input summary
- *   was truncated past the identity (EC-139 caps summaries at 160 chars), the
- *   project sweep tag is emitted — coarse, always correct, mirroring the EC-155
- *   reference-index fallback. Since EC-501 the surviving document operations
- *   all carry a small `{ projectId, ref }` input, so this is a defensive path
- *   rather than a routine one — the routine truncation was the document-bearing
- *   `documents.upsert`, which no longer reaches here at all.
- *
- * Every branch needs only the `projectId`, which serializes FIRST in every
- * operation input (measured 2026-08-01 across the real `redirects.save`
- * shapes), so {@link projectIdOfSummary}'s regex survives truncation even when
- * the rest of the summary is cut mid-string.
- */
-function scoped(projectId, tag) {
-    return `p:${projectId}:${tag}`;
-}
-/** `p:<projectId>:doc:<collection>:<id>` — mirror of `docCacheTag`. */
-export function docWebhookTag(projectId, collection, id) {
-    return scoped(projectId, `doc:${collection}:${id}`);
-}
-/** `p:<projectId>:collection:<name>:<locale>` — mirror of `collectionCacheTag`. */
-export function collectionWebhookTag(projectId, collection, locale) {
-    return scoped(projectId, `collection:${collection}:${locale}`);
-}
-/** `p:<projectId>:asset:<id>` — mirror of `assetCacheTag` (EC-227). */
-export function assetWebhookTag(projectId, assetId) {
-    return scoped(projectId, `asset:${assetId}`);
-}
-/** `p:<projectId>:project` — mirror of `projectSweepTag`. */
-export function projectSweepWebhookTag(projectId) {
-    return scoped(projectId, 'project');
-}
-/**
- * The document operations that can change **published** output, and therefore
- * the ones whose success must reach the host's revalidate endpoint.
- *
- * EC-224: publish/unpublish/pinVersion move the version pointer; their
- * `{ projectId, ref }` input drives the doc + per-locale collection tag set
- * (the flat `documents.setState` op is gone). `documents.delete` removes the
- * row outright, taking any pinned version with it.
- *
- * ## Why `documents.upsert` (a draft SAVE) is NOT here — EC-501
- *
- * A save writes the **draft row only**; published readers serve the *pinned
- * version snapshot*, never the draft. That is structural, not a heuristic:
- *
- * - the operation hands the document straight to `cms.upsertDocument`
- *   (`core/operations/documents.ts`), whose Convex arg list has no
- *   `publishedVersion` field at all (`studio/convex/cms.ts` `upsertDocument`),
- *   and whose in-memory twin re-attaches the previous pin verbatim with the
- *   comment "only publish/unpublish move the pointer"
- *   (`core/persistence/cms.ts`);
- * - the published delivery snapshot skips every row without a pin and serves
- *   the pinned snapshot, "never falling back to the draft"
- *   (`studio/convex/delivery.ts`);
- * - the Convex write-chokepoint trigger already encodes exactly this verdict
- *   server-side — it schedules a revalidation only when `publishedVersion`
- *   actually changed, "a plain draft save must not invalidate the published
- *   host cache" (`studio/convex/triggers.ts`, EC-286/EC-146). This emitter was
- *   simply the one path that never asked.
- *
- * Measured before the change (connected studio → capture endpoint, one short
- * editing session): 12 `documents.upsert` deliveries to 1 `documents.publish`,
- * and 7 of those 12 carried the **whole-project sweep** tag rather than the
- * document's own — because a real document's `inputSummary` exceeds the EC-139
- * 160-char cap, so the identity parse below fails and falls back to the sweep.
- * A single keystroke-batch on a live page was dropping every cached page *and*
- * every cached 404 on the site (EC-489 widened 404s to carry collection tags).
- *
- * ## No exceptions (EC-574)
- *
- * This set used to carry one documented exception: `cms-data-sources` rows, the
- * one document class the published delivery snapshot read from the **draft**
- * side, so a draft save there could change published output silently (the
- * wave-0089 finding). EC-574 deleted the data-binding subsystem and the
- * snapshot's `sources` strand with it (`studio/convex/delivery.ts`), so every
- * document class now reaches delivery through its published pin only and this
- * set is complete as written.
- */
-const PUBLISHED_STATE_OPERATIONS = new Set([
-    'documents.delete',
-    // EC-576: the drop takes every pinned version with it; its input carries no `ref`,
-    // so it resolves to the whole-project sweep below — the only correct tag for it.
-    'documents.clear',
-    'documents.publish',
-    'documents.unpublish',
-    'documents.pinVersion',
-]);
-/**
- * The **routing** operations (EC-510): editorial redirects, which EC-303 moved
- * out of config and into the database. Every *enabled* redirect row is
- * projected into the delivery snapshot the router and `resolvePage` consume
- * (`studio/convex/delivery.ts`), in BOTH perspectives — so saving, retargeting,
- * disabling or deleting one changes published output, exactly the question
- * {@link PUBLISHED_STATE_OPERATIONS} asks. They belong to that question, not a
- * parallel one; they are a separate set only because their tag is different.
- *
- * ## Why the coarse project sweep and NOT a targeted `route:<from>:<locale>`
- *
- * The tag vocabulary has `route:<pattern>:<locale>` and a redirect's `from` IS
- * a route path, so a targeted tag looks available. It is not — it would be
- * silently wrong in four independent ways, and a silent wrong invalidation is
- * the exact failure family EC-489/EC-501/this ticket exist to remove:
- *
- * 1. **`redirects.remove` has no `from` at all.** Its input is
- *    `{ projectId, id }` (`core/operations/redirects.ts`), so the path whose
- *    cache entry must drop is not in the event. Precision is unobtainable, and
- *    a delete is the single most important case to get right.
- * 2. **A save can RENAME `from`.** The event carries only the NEW path; the OLD
- *    one keeps serving a redirect that no longer exists. `OperationEvent` has
- *    `operation`/`kind`/`status`/`inputSummary` and nothing else — no result,
- *    no previous row (EC-501 rejected widening it for the same reason) — so the
- *    emitter cannot even detect that a rename happened.
- * 3. **Normalization would have to be mirrored.** The cached entry is tagged
- *    with the resolver's `normalizePath(url)`; `from` is editor-typed free text
- *    (`z.string().min(1)`), stored verbatim and normalized only at match time.
- *    A trailing slash or a query string would produce a tag that matches
- *    nothing — no error, no invalidation.
- * 4. **The identity truncates.** MEASURED 2026-08-01 on the real schema: a
- *    Konditorei-shaped migration redirect (legacy permalink → new path)
- *    serializes to 226 chars and an EC-311 `meta` bag to 216, both past the
- *    EC-139 160-char cap. A `from`-based tag would work on a demo-sized
- *    redirect and degrade on the real one — EC-501's pathology in reverse.
- *
- * The sweep has none of those failure modes: it needs only `projectId`, which
- * serializes first and therefore survives truncation, so **the truncation
- * fallback and the primary answer are the same tag** — correct by design rather
- * than by accident. `nextCacheTags` stamps `project` on every cached entry, so
- * it is guaranteed to reach the affected URL whatever the redirect changed.
- *
- * ## The cost, and why it is affordable here (unlike EC-501)
- *
- * A sweep drops every cached entry, lazily on next read. That was intolerable
- * for `documents.upsert` because it fired on every ~1s keystroke batch and
- * *none* of those invalidations were necessary. A redirect write is an
- * explicit form save on a rail with `inlineEdit: false` and no autosave
- * (`redirects-collection-view-source.ts`), and every one of them IS a routing
- * change. Measured on a connected studio: a session that deliberately exercised
- * every mutation kind — create, retarget, disable, rename, delete — produced 5
- * writes. The Convex-side path already sweeps the project on every document
- * publish (`convex/revalidate.ts`, "the honest, reliable v1"), so this is
- * strictly rarer than a cost the engine already pays.
- *
- * If a precise redirect tag is ever wanted, the place to get it is the Convex
- * write chokepoint, where `change.oldDoc` holds the previous `from` — not here,
- * where the information does not exist.
- */
-const ROUTING_OPERATIONS = new Set(['redirects.save', 'redirects.remove']);
-/**
- * Asset-record mutations (EC-227): editing an asset (alt/dimensions/re-upload)
- * must drop the published pages that *baked* its delivery shape, which carry the
- * `asset:<id>` tag. `assets.remove` always carries `assetId`; `assets.upsert`
- * carries `asset.id` only on an EDIT (a CREATE mints the id server-side).
- */
-const ASSET_OPERATIONS = new Set(['assets.upsert', 'assets.remove']);
-/** Tolerant parse of an EC-139 input summary (may be truncated past 160 chars). */
-function parseSummary(summary) {
-    try {
-        const parsed = JSON.parse(summary);
-        return typeof parsed === 'object' && parsed !== null
-            ? parsed
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-/** Extract the projectId even from a truncated summary (it serializes first). */
-function projectIdOfSummary(summary) {
-    const match = /"projectId":"([^"]+)"/.exec(summary);
-    return match?.[1];
-}
-function documentRefOf(value) {
-    if (typeof value !== 'object' || value === null)
-        return undefined;
-    const candidate = value;
-    return typeof candidate.collection === 'string' &&
-        candidate.collection.length > 0 &&
-        typeof candidate.id === 'string' &&
-        candidate.id.length > 0
-        ? { collection: candidate.collection, id: candidate.id }
-        : undefined;
-}
-/**
- * Compute the webhook tag set for one lifecycle event, or `null` when the
- * event is not a successful publish-shaped command (queries, failures, and
- * unrelated domains never fire webhooks).
- */
-export function webhookTagsForEvent(event, options) {
-    if (event.status !== 'succeeded' || event.kind !== 'command')
-        return null;
-    const isDocument = PUBLISHED_STATE_OPERATIONS.has(event.operation);
-    const isAsset = ASSET_OPERATIONS.has(event.operation);
-    const isRouting = ROUTING_OPERATIONS.has(event.operation);
-    if (!isDocument && !isAsset && !isRouting)
-        return null;
-    const projectId = projectIdOfSummary(event.inputSummary);
-    if (projectId === undefined)
-        return null;
-    // EC-510: one answer for every redirect write — see `ROUTING_OPERATIONS` for
-    // why the targeted `route:` tag is unobtainable and the sweep is the honest one.
-    if (isRouting) {
-        return { projectId, event: event.operation, tags: [projectSweepWebhookTag(projectId)] };
-    }
-    if (isAsset)
-        return assetTagsForEvent(projectId, event);
-    const parsed = parseSummary(event.inputSummary);
-    const ref = documentRefOf(parsed?.['ref']) ?? documentRefOf(parsed?.['document']);
-    if (!ref) {
-        // Truncated summary (large upsert payload): honest coarse fallback.
-        return { projectId, event: event.operation, tags: [projectSweepWebhookTag(projectId)] };
-    }
-    const tags = new Set([docWebhookTag(projectId, ref.collection, ref.id)]);
-    for (const locale of options.locales) {
-        tags.add(collectionWebhookTag(projectId, ref.collection, locale));
-    }
-    // EC-207: ROUTES are config-owned (a code deploy, which rebuilds the host), so
-    // a document event never needs a `route:` tag. Redirects are NOT — EC-303 made
-    // them editorial data and EC-510 gives their own operations the project sweep
-    // (see `ROUTING_OPERATIONS`); a *document* write still cannot change them.
-    return { projectId, event: event.operation, tags: [...tags].sort() };
-}
-/** A non-empty string, else `undefined` (the asset id out of a summary). */
-function stringOf(value) {
-    return typeof value === 'string' && value.length > 0 ? value : undefined;
-}
-/**
- * Tags for an asset mutation (EC-227). The edit cases — `assets.remove` (carries
- * `assetId`) and `assets.upsert` of an existing asset (carries `asset.id`) —
- * emit exactly `asset:<id>`, dropping the pages that baked that asset. An
- * `assets.upsert` with **no** id is a CREATE: the id is minted server-side and a
- * brand-new asset cannot be baked into any existing page, so it invalidates
- * nothing (`null`, no webhook). A `remove` missing its id means a truncated
- * summary — sweep the project (coarse, always correct — the document fallback).
- */
-function assetTagsForEvent(projectId, event) {
-    const parsed = parseSummary(event.inputSummary);
-    const assetId = event.operation === 'assets.remove'
-        ? stringOf(parsed?.['assetId'])
-        : stringOf(parsed?.['asset']?.id);
-    if (assetId) {
-        return { projectId, event: event.operation, tags: [assetWebhookTag(projectId, assetId)] };
-    }
-    return event.operation === 'assets.remove'
-        ? { projectId, event: event.operation, tags: [projectSweepWebhookTag(projectId)] }
-        : null;
-}
-//# sourceMappingURL=tags.js.map