@elytracms/studio 0.0.91 → 0.0.93

package/dist/lib/operations/session-hydration.d.ts

@@ -5,7 +5,7 @@ import type { OperationResult, OperationsClient } from './operations-package.js'
  * Persisted-session hydration (Milestone B sign-off fix, EC-177 gap 1).
  *
  * Against a persistent backend (Convex mode) a studio session must BOOT from
- * what is persisted — the saved CMS schema + documents (+ asset records) — and
+ * what is persisted — the CMS documents (+ asset records) — and
  * fall back to the deterministic fixtures only when the project has nothing
  * persisted yet (first run). Before this, every session seeded from fixtures,
  * so reloads hid the editor's work.
@@ -25,10 +25,19 @@ import type { OperationResult, OperationsClient } from './operations-package.js'
  * SAME loader (over the seeded in-memory adapter, through operations — AD-17)
  * to hydrate the canvas/preview content session; only the render-gating is
  * Convex-specific.
+ *
+ * **EC-583 / EC-559 — content only, never a schema.** This loader used to read the
+ * schema back through `schema.get`, and `HydratedCms` carried it as `collections`. In
+ * the playground that record was the in-memory adapter's JSON projection (config
+ * functions stripped), and it WON the CMS surfaces' schema rung over the config — so
+ * `validate`, `form.hidden` predicates and function `titleField`s were undefined in
+ * the playground and every playground check of them was a false pass. The store holds
+ * no schema now: the caller hands the DECLARED collections in (the resolved config),
+ * hydration only uses them to keep the declared collections' documents and count the
+ * rest, and the CMS surfaces read their schema from the config in both modes.
  */
-/** The persisted CMS content of a project: the declared schema + the documents of its collections. */
+/** The persisted CMS content of a project: the documents of its declared collections. */
 export interface HydratedCms {
-    collections: CollectionDef[];
     /** Documents of the declared collections only — see {@link orphans} for the rest. */
     documents: CmsDocument[];
     /**
@@ -85,6 +94,14 @@ export interface HydratedCms {
      * pre-EC-449 fixtures/callers stay valid; `loadHydratedCms` always sets it.
      */
     changedKeys?: string[];
+    /**
+     * EC-595 A2 — each document's REVISION, keyed by `documentKey`: the base the session's
+     * edits are made against. The persister checks a field's patch against the changes
+     * since the revision the user's view was hydrated at, so a colleague's earlier change
+     * of that field is refused per path instead of overwritten (Codex P06). Optional for
+     * fixture sessions; `loadHydratedCms` always sets it.
+     */
+    revisions?: Record<string, number>;
     /**
      * The project's asset records (the `assets` table — NOT cms `asset`-collection
      * documents). The preview content engine wires these into its lookup so listing/
@@ -95,22 +112,22 @@ export interface HydratedCms {
      */
     assets: AssetRecord[];
 }
-/** Everything a Convex-mode session boots from. `null` fields mean "nothing persisted" (first run). */
+/** Everything a Convex-mode session boots from. `null` fields mean "nothing to hydrate". */
 export interface HydratedProjectSession {
-    /** Persisted CMS schema + documents, or `null` when no content schema was ever saved. */
+    /** Persisted CMS documents, or `null` when the project declares no collections. */
     cms: HydratedCms | null;
 }
 /**
- * Load the persisted CMS content state. `null` when the project has no
- * persisted content schema, or one that declares no collections (first run —
- * the session seeds fixtures and the persister's baseline will persist them on
- * the first edit).
+ * Load the persisted CMS content state for the project's DECLARED collections (the
+ * resolved config's — EC-583: the store holds no schema). `null` when the config
+ * declares no collections: there is nothing a CMS surface could show the documents
+ * under (every stored row would be an orphan).
  */
-export declare function loadHydratedCms(operations: OperationsClient, projectId: string): Promise<OperationResult<HydratedCms | null>>;
+export declare function loadHydratedCms(operations: OperationsClient, projectId: string, collections: readonly CollectionDef[]): Promise<OperationResult<HydratedCms | null>>;
 /**
  * Load everything a project session hydrates from. Post-EC-287 that is just the
- * persisted CMS content (schema + documents + assets): the project graph and its
- * publish path are gone, so there is no graph revision or graph-publishing state
- * to load. Per-document `publishedVersion` (EC-224) is the only published surface.
+ * persisted CMS content (documents + assets): the project graph and its publish
+ * path are gone, so there is no graph revision or graph-publishing state to load.
+ * Per-document `publishedVersion` (EC-224) is the only published surface.
  */
-export declare function loadProjectSession(operations: OperationsClient, projectId: string): Promise<OperationResult<HydratedProjectSession>>;
+export declare function loadProjectSession(operations: OperationsClient, projectId: string, collections: readonly CollectionDef[]): Promise<OperationResult<HydratedProjectSession>>;

package/dist/lib/operations/session-hydration.js

@@ -1,16 +1,11 @@
 import { documentKey, orphanedCollections } from '@elytracms/core/cms-core';
 /**
- * Load the persisted CMS content state. `null` when the project has no
- * persisted content schema, or one that declares no collections (first run —
- * the session seeds fixtures and the persister's baseline will persist them on
- * the first edit).
+ * Load the persisted CMS content state for the project's DECLARED collections (the
+ * resolved config's — EC-583: the store holds no schema). `null` when the config
+ * declares no collections: there is nothing a CMS surface could show the documents
+ * under (every stored row would be an orphan).
  */
-export async function loadHydratedCms(operations, projectId) {
-    const schema = await operations.schema.get({ projectId });
-    if (!schema.ok) {
-        return schema.error.code === 'not-found' ? { ok: true, value: null } : schema;
-    }
-    const collections = schema.value.collections;
+export async function loadHydratedCms(operations, projectId, collections) {
     if (collections.length === 0)
         return { ok: true, value: null };
     const documents = await operations.documents.list({ projectId });
@@ -35,7 +30,6 @@ export async function loadHydratedCms(operations, projectId) {
     return {
         ok: true,
         value: {
-            collections,
             orphans,
             // The live row hydrates AS PERSISTED — a continuous draft (EC-224). We no
             // longer stamp a `state:'published'` mirror: published-ness is the version
@@ -60,18 +54,20 @@ export async function loadHydratedCms(operations, projectId) {
             changedKeys: contentRecords
                 .filter((record) => record.hasUnpublishedChanges === true)
                 .map((record) => documentKey(record.document)),
+            // EC-595 A2: the revision each document was hydrated at — the per-patch base.
+            revisions: Object.fromEntries(contentRecords.map((record) => [documentKey(record.document), record.revision])),
             assets: assets.ok ? assets.value : [],
         },
     };
 }
 /**
  * Load everything a project session hydrates from. Post-EC-287 that is just the
- * persisted CMS content (schema + documents + assets): the project graph and its
- * publish path are gone, so there is no graph revision or graph-publishing state
- * to load. Per-document `publishedVersion` (EC-224) is the only published surface.
+ * persisted CMS content (documents + assets): the project graph and its publish
+ * path are gone, so there is no graph revision or graph-publishing state to load.
+ * Per-document `publishedVersion` (EC-224) is the only published surface.
  */
-export async function loadProjectSession(operations, projectId) {
-    const cms = await loadHydratedCms(operations, projectId);
+export async function loadProjectSession(operations, projectId, collections) {
+    const cms = await loadHydratedCms(operations, projectId, collections);
     if (!cms.ok)
         return cms;
     return { ok: true, value: { cms: cms.value } };

package/dist/lib/operations/session-hydration.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-hydration.js","sourceRoot":"","sources":["../../../src/lib/operations/session-hydration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AA2G3E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA4B,EAC5B,SAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IACzD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IAC/E,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAA;IAC5C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC9D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAA;IACnC,+EAA+E;IAC/E,oFAAoF;IACpF,gFAAgF;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1D,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,CAAC,MAAwC,EAAE,EAAE,CACrE,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAA;IACvC,0EAA0E;IAC1E,6EAA6E;IAC7E,YAAY;IACZ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3E,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC5C,CAAA;IACD,MAAM,OAAO,GAAG,mBAAmB,CACjC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,iBAAiB,CAAC,MAAM,CAAC;KACrC,CAAC,CAAC,EACH,WAAW,CACZ,CAAA;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,WAAW;YACX,OAAO;YACP,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC1D,aAAa,EAAE,cAAc;iBAC1B,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,8EAA8E;YAC9E,2EAA2E;YAC3E,UAAU,EAAE,MAAM,CAAC,WAAW,CAC5B,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACjF;YACD,2EAA2E;YAC3E,0EAA0E;YAC1E,yEAAyE;YACzE,iBAAiB,EAAE,MAAM,CAAC,WAAW,CACnC,cAAc;iBACX,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;iBACpD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,WAAqB,CAAC,CAAC,CACjF;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,+DAA+D;YAC/D,WAAW,EAAE,cAAc;iBACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,KAAK,IAAI,CAAC;iBACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;SACtC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA4B,EAC5B,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;IACxD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAA;AAChD,CAAC","sourcesContent":["import { documentKey, orphanedCollections } from '@elytracms/core/cms-core'\nimport type { CmsDocument, CollectionDef, OrphanedCollection } from '@elytracms/core/cms-core'\nimport type { AssetRecord } from '@elytracms/core/persistence'\nimport type { OperationResult, OperationsClient } from './operations-package'\n\n/**\n * Persisted-session hydration (Milestone B sign-off fix, EC-177 gap 1).\n *\n * Against a persistent backend (Convex mode) a studio session must BOOT from\n * what is persisted — the saved CMS schema + documents (+ asset records) — and\n * fall back to the deterministic fixtures only when the project has nothing\n * persisted yet (first run). Before this, every session seeded from fixtures,\n * so reloads hid the editor's work.\n *\n * EC-287: the DB-resident project graph and its publish path are retired —\n * layouts/config/schema/components are CODE, the DB holds content only. A\n * session no longer hydrates a graph revision or graph-publishing state; CMS\n * content (with per-document `publishedVersion`, EC-224) is the only persisted\n * surface a session boots from.\n *\n * This module is the pure load half: read-only `@elytracms/core/operations` queries\n * composed into one hydration result. `not-found` is a *normal* answer (the\n * first-run fallback); every other failure propagates as the structured\n * operation error so the gate renders it — never a silent fixture fallback.\n * The React gate that applies it lives in\n * `components/studio/project-session.tsx`. EC-361: the playground calls the\n * SAME loader (over the seeded in-memory adapter, through operations — AD-17)\n * to hydrate the canvas/preview content session; only the render-gating is\n * Convex-specific.\n */\n\n/** The persisted CMS content of a project: the declared schema + the documents of its collections. */\nexport interface HydratedCms {\n  collections: CollectionDef[]\n  /** Documents of the declared collections only — see {@link orphans} for the rest. */\n  documents: CmsDocument[]\n  /**\n   * EC-606 — the stored rows the session does NOT carry: every collection id that\n   * stored documents use but the project does not declare, with its row count and\n   * how many of those rows are published. Sorted by collection id; empty when every\n   * row belongs to a declared collection.\n   *\n   * Hydration keeps only declared collections' documents (there is no schema to edit\n   * the rest under). Before EC-606 the others were dropped right here with no count,\n   * so renaming a collection id in config made its documents vanish without a trace.\n   * Counted by the one core counter (`orphanedCollections`), which `elytra doctor`\n   * also runs over the published snapshot. The rail foot reports this list through\n   * the content session (`configureContentSession(contentSessionOf(cms))`).\n   *\n   * EC-606 B1: there is no \"system collection\" exemption any more. The only one left\n   * was `cms-saved-views`, the editor saved views EC-246b retired; nothing reads\n   * those rows, so they are counted like any other undeclared collection.\n   */\n  orphans: OrphanedCollection[]\n  /**\n   * Published document keys (EC-224), via the version pointer: a record is\n   * published iff `publishedVersion` is set. The session boots its\n   * `publishedKeys` from this — published-ness is the pointer, nothing else.\n   */\n  publishedKeys: string[]\n  /**\n   * Per-document last-write timestamps (EC-445), keyed by `documentKey`\n   * (`collection:id`) → the persisted `cmsDocuments.updatedAt` ISO string. Backs the\n   * `$updatedAt` list column; the session seeds its `documentUpdatedAt` map from this.\n   * Optional so pre-EC-445 fixtures/callers stay valid (the session falls back to a\n   * session-start stamp for the seeded documents); `loadHydratedCms` always sets it.\n   */\n  timestamps?: Record<string, string>\n  /**\n   * Per-document FIRST-publish instants (EC-447), keyed by `documentKey`\n   * (`collection:id`) → the persisted `cmsDocuments.publishedAt` ISO string. Present\n   * only for documents that carry one (currently published, with a recorded publish\n   * instant); the session seeds its `documentPublishedAt` map from this. Backs the\n   * `$publishedAt` list column. UNLIKE {@link timestamps} there is no session-start\n   * fallback — an absent entry is a real \"no publish date\" (EmDash), and the store\n   * re-stamps/clears it authoritatively on publish/unpublish. Optional so pre-EC-447\n   * fixtures/callers stay valid; `loadHydratedCms` always sets it.\n   */\n  publishTimestamps?: Record<string, string>\n  /**\n   * Document keys whose working draft carries UNPUBLISHED CHANGES (EC-449) — the\n   * persisted `cmsDocuments.hasUnpublishedChanges === true` set, keyed like\n   * {@link publishedKeys}. Backs the amber \"changed\" state of the `$state` list\n   * dot; the session seeds its changed-set from this and re-stamps it\n   * authoritatively on save/publish/unpublish from the returned records. Only\n   * `true` flags contribute — an absent entry means \"no unpublished changes\"\n   * (`false` or not yet materialized both render the same dot). Optional so\n   * pre-EC-449 fixtures/callers stay valid; `loadHydratedCms` always sets it.\n   */\n  changedKeys?: string[]\n  /**\n   * The project's asset records (the `assets` table — NOT cms `asset`-collection\n   * documents). The preview content engine wires these into its lookup so listing/\n   * relation results resolve their `asset`-typed FIELDS (e.g. a ProductGrid product's\n   * `gallery`) to delivery shape — matching what the renderer's `resolveAsset` already\n   * does for static `asset` props (EC-262). Without them, the studio canvas renders\n   * such nested images blank even though the documents reference real assets.\n   */\n  assets: AssetRecord[]\n}\n\n/** Everything a Convex-mode session boots from. `null` fields mean \"nothing persisted\" (first run). */\nexport interface HydratedProjectSession {\n  /** Persisted CMS schema + documents, or `null` when no content schema was ever saved. */\n  cms: HydratedCms | null\n}\n\n/**\n * Load the persisted CMS content state. `null` when the project has no\n * persisted content schema, or one that declares no collections (first run —\n * the session seeds fixtures and the persister's baseline will persist them on\n * the first edit).\n */\nexport async function loadHydratedCms(\n  operations: OperationsClient,\n  projectId: string,\n): Promise<OperationResult<HydratedCms | null>> {\n  const schema = await operations.schema.get({ projectId })\n  if (!schema.ok) {\n    return schema.error.code === 'not-found' ? { ok: true, value: null } : schema\n  }\n  const collections = schema.value.collections\n  if (collections.length === 0) return { ok: true, value: null }\n  const documents = await operations.documents.list({ projectId })\n  if (!documents.ok) return documents\n  // The project's asset records (assets table), wired into the preview lookup so\n  // listing/relation results resolve their nested `asset` fields (EC-262). Non-fatal:\n  // a failed asset list degrades previews to no images, never blocks the session.\n  const assets = await operations.assets.list({ projectId })\n  // EC-224: a record is published when its version pointer is set — the same\n  // gate delivery reads. There is no flat-state fallback (the field is gone).\n  const isRecordPublished = (record: (typeof documents.value)[number]) =>\n    record.publishedVersion !== undefined\n  // The declared set, read once: the session carries the documents of these\n  // collections, and every other stored row is COUNTED (EC-606), never dropped\n  // silently.\n  const declaredIds = new Set(collections.map((collection) => collection.id))\n  const contentRecords = documents.value.filter((record) =>\n    declaredIds.has(record.document.collection),\n  )\n  const orphans = orphanedCollections(\n    documents.value.map((record) => ({\n      collection: record.document.collection,\n      published: isRecordPublished(record),\n    })),\n    declaredIds,\n  )\n  return {\n    ok: true,\n    value: {\n      collections,\n      orphans,\n      // The live row hydrates AS PERSISTED — a continuous draft (EC-224). We no\n      // longer stamp a `state:'published'` mirror: published-ness is the version\n      // pointer (`publishedKeys`), which every studio reader now consults (the\n      // table badge/$state via `isPublished`, the preview engine via the pin).\n      documents: contentRecords.map((record) => record.document),\n      publishedKeys: contentRecords\n        .filter(isRecordPublished)\n        .map((record) => documentKey(record.document)),\n      // EC-445: carry each record's `updatedAt` onto the session for the $updatedAt\n      // column — a per-document metadata accessor, exactly like `publishedKeys`.\n      timestamps: Object.fromEntries(\n        contentRecords.map((record) => [documentKey(record.document), record.updatedAt]),\n      ),\n      // EC-447: carry each PUBLISHED record's materialized `publishedAt` for the\n      // $publishedAt column. Only records that actually have one contribute (no\n      // session-start fallback) — an absent entry is a real \"no publish date\".\n      publishTimestamps: Object.fromEntries(\n        contentRecords\n          .filter((record) => record.publishedAt !== undefined)\n          .map((record) => [documentKey(record.document), record.publishedAt as string]),\n      ),\n      // EC-449: the documents whose draft carries unpublished changes (the amber\n      // list dot) — only materialized `true` flags contribute (absent/false both\n      // mean \"not changed\"; the flag only exists on published docs).\n      changedKeys: contentRecords\n        .filter((record) => record.hasUnpublishedChanges === true)\n        .map((record) => documentKey(record.document)),\n      assets: assets.ok ? assets.value : [],\n    },\n  }\n}\n\n/**\n * Load everything a project session hydrates from. Post-EC-287 that is just the\n * persisted CMS content (schema + documents + assets): the project graph and its\n * publish path are gone, so there is no graph revision or graph-publishing state\n * to load. Per-document `publishedVersion` (EC-224) is the only published surface.\n */\nexport async function loadProjectSession(\n  operations: OperationsClient,\n  projectId: string,\n): Promise<OperationResult<HydratedProjectSession>> {\n  const cms = await loadHydratedCms(operations, projectId)\n  if (!cms.ok) return cms\n  return { ok: true, value: { cms: cms.value } }\n}\n"]}
+{"version":3,"file":"session-hydration.js","sourceRoot":"","sources":["../../../src/lib/operations/session-hydration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AA4H3E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA4B,EAC5B,SAAiB,EACjB,WAAqC;IAErC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC9D,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,OAAO,SAAS,CAAA;IACnC,+EAA+E;IAC/E,oFAAoF;IACpF,gFAAgF;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;IAC1D,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,CAAC,MAAwC,EAAE,EAAE,CACrE,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAA;IACvC,0EAA0E;IAC1E,6EAA6E;IAC7E,YAAY;IACZ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3E,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC5C,CAAA;IACD,MAAM,OAAO,GAAG,mBAAmB,CACjC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,SAAS,EAAE,iBAAiB,CAAC,MAAM,CAAC;KACrC,CAAC,CAAC,EACH,WAAW,CACZ,CAAA;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE;YACL,OAAO;YACP,0EAA0E;YAC1E,2EAA2E;YAC3E,yEAAyE;YACzE,yEAAyE;YACzE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC1D,aAAa,EAAE,cAAc;iBAC1B,MAAM,CAAC,iBAAiB,CAAC;iBACzB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,8EAA8E;YAC9E,2EAA2E;YAC3E,UAAU,EAAE,MAAM,CAAC,WAAW,CAC5B,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CACjF;YACD,2EAA2E;YAC3E,0EAA0E;YAC1E,yEAAyE;YACzE,iBAAiB,EAAE,MAAM,CAAC,WAAW,CACnC,cAAc;iBACX,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC;iBACpD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,WAAqB,CAAC,CAAC,CACjF;YACD,2EAA2E;YAC3E,2EAA2E;YAC3E,+DAA+D;YAC/D,WAAW,EAAE,cAAc;iBACxB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,KAAK,IAAI,CAAC;iBACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAChD,8EAA8E;YAC9E,SAAS,EAAE,MAAM,CAAC,WAAW,CAC3B,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAChF;YACD,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;SACtC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAA4B,EAC5B,SAAiB,EACjB,WAAqC;IAErC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;IACrE,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAA;IACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAA;AAChD,CAAC","sourcesContent":["import { documentKey, orphanedCollections } from '@elytracms/core/cms-core'\nimport type { CmsDocument, CollectionDef, OrphanedCollection } from '@elytracms/core/cms-core'\nimport type { AssetRecord } from '@elytracms/core/persistence'\nimport type { OperationResult, OperationsClient } from './operations-package'\n\n/**\n * Persisted-session hydration (Milestone B sign-off fix, EC-177 gap 1).\n *\n * Against a persistent backend (Convex mode) a studio session must BOOT from\n * what is persisted — the CMS documents (+ asset records) — and\n * fall back to the deterministic fixtures only when the project has nothing\n * persisted yet (first run). Before this, every session seeded from fixtures,\n * so reloads hid the editor's work.\n *\n * EC-287: the DB-resident project graph and its publish path are retired —\n * layouts/config/schema/components are CODE, the DB holds content only. A\n * session no longer hydrates a graph revision or graph-publishing state; CMS\n * content (with per-document `publishedVersion`, EC-224) is the only persisted\n * surface a session boots from.\n *\n * This module is the pure load half: read-only `@elytracms/core/operations` queries\n * composed into one hydration result. `not-found` is a *normal* answer (the\n * first-run fallback); every other failure propagates as the structured\n * operation error so the gate renders it — never a silent fixture fallback.\n * The React gate that applies it lives in\n * `components/studio/project-session.tsx`. EC-361: the playground calls the\n * SAME loader (over the seeded in-memory adapter, through operations — AD-17)\n * to hydrate the canvas/preview content session; only the render-gating is\n * Convex-specific.\n *\n * **EC-583 / EC-559 — content only, never a schema.** This loader used to read the\n * schema back through `schema.get`, and `HydratedCms` carried it as `collections`. In\n * the playground that record was the in-memory adapter's JSON projection (config\n * functions stripped), and it WON the CMS surfaces' schema rung over the config — so\n * `validate`, `form.hidden` predicates and function `titleField`s were undefined in\n * the playground and every playground check of them was a false pass. The store holds\n * no schema now: the caller hands the DECLARED collections in (the resolved config),\n * hydration only uses them to keep the declared collections' documents and count the\n * rest, and the CMS surfaces read their schema from the config in both modes.\n */\n\n/** The persisted CMS content of a project: the documents of its declared collections. */\nexport interface HydratedCms {\n  /** Documents of the declared collections only — see {@link orphans} for the rest. */\n  documents: CmsDocument[]\n  /**\n   * EC-606 — the stored rows the session does NOT carry: every collection id that\n   * stored documents use but the project does not declare, with its row count and\n   * how many of those rows are published. Sorted by collection id; empty when every\n   * row belongs to a declared collection.\n   *\n   * Hydration keeps only declared collections' documents (there is no schema to edit\n   * the rest under). Before EC-606 the others were dropped right here with no count,\n   * so renaming a collection id in config made its documents vanish without a trace.\n   * Counted by the one core counter (`orphanedCollections`), which `elytra doctor`\n   * also runs over the published snapshot. The rail foot reports this list through\n   * the content session (`configureContentSession(contentSessionOf(cms))`).\n   *\n   * EC-606 B1: there is no \"system collection\" exemption any more. The only one left\n   * was `cms-saved-views`, the editor saved views EC-246b retired; nothing reads\n   * those rows, so they are counted like any other undeclared collection.\n   */\n  orphans: OrphanedCollection[]\n  /**\n   * Published document keys (EC-224), via the version pointer: a record is\n   * published iff `publishedVersion` is set. The session boots its\n   * `publishedKeys` from this — published-ness is the pointer, nothing else.\n   */\n  publishedKeys: string[]\n  /**\n   * Per-document last-write timestamps (EC-445), keyed by `documentKey`\n   * (`collection:id`) → the persisted `cmsDocuments.updatedAt` ISO string. Backs the\n   * `$updatedAt` list column; the session seeds its `documentUpdatedAt` map from this.\n   * Optional so pre-EC-445 fixtures/callers stay valid (the session falls back to a\n   * session-start stamp for the seeded documents); `loadHydratedCms` always sets it.\n   */\n  timestamps?: Record<string, string>\n  /**\n   * Per-document FIRST-publish instants (EC-447), keyed by `documentKey`\n   * (`collection:id`) → the persisted `cmsDocuments.publishedAt` ISO string. Present\n   * only for documents that carry one (currently published, with a recorded publish\n   * instant); the session seeds its `documentPublishedAt` map from this. Backs the\n   * `$publishedAt` list column. UNLIKE {@link timestamps} there is no session-start\n   * fallback — an absent entry is a real \"no publish date\" (EmDash), and the store\n   * re-stamps/clears it authoritatively on publish/unpublish. Optional so pre-EC-447\n   * fixtures/callers stay valid; `loadHydratedCms` always sets it.\n   */\n  publishTimestamps?: Record<string, string>\n  /**\n   * Document keys whose working draft carries UNPUBLISHED CHANGES (EC-449) — the\n   * persisted `cmsDocuments.hasUnpublishedChanges === true` set, keyed like\n   * {@link publishedKeys}. Backs the amber \"changed\" state of the `$state` list\n   * dot; the session seeds its changed-set from this and re-stamps it\n   * authoritatively on save/publish/unpublish from the returned records. Only\n   * `true` flags contribute — an absent entry means \"no unpublished changes\"\n   * (`false` or not yet materialized both render the same dot). Optional so\n   * pre-EC-449 fixtures/callers stay valid; `loadHydratedCms` always sets it.\n   */\n  changedKeys?: string[]\n  /**\n   * EC-595 A2 — each document's REVISION, keyed by `documentKey`: the base the session's\n   * edits are made against. The persister checks a field's patch against the changes\n   * since the revision the user's view was hydrated at, so a colleague's earlier change\n   * of that field is refused per path instead of overwritten (Codex P06). Optional for\n   * fixture sessions; `loadHydratedCms` always sets it.\n   */\n  revisions?: Record<string, number>\n  /**\n   * The project's asset records (the `assets` table — NOT cms `asset`-collection\n   * documents). The preview content engine wires these into its lookup so listing/\n   * relation results resolve their `asset`-typed FIELDS (e.g. a ProductGrid product's\n   * `gallery`) to delivery shape — matching what the renderer's `resolveAsset` already\n   * does for static `asset` props (EC-262). Without them, the studio canvas renders\n   * such nested images blank even though the documents reference real assets.\n   */\n  assets: AssetRecord[]\n}\n\n/** Everything a Convex-mode session boots from. `null` fields mean \"nothing to hydrate\". */\nexport interface HydratedProjectSession {\n  /** Persisted CMS documents, or `null` when the project declares no collections. */\n  cms: HydratedCms | null\n}\n\n/**\n * Load the persisted CMS content state for the project's DECLARED collections (the\n * resolved config's — EC-583: the store holds no schema). `null` when the config\n * declares no collections: there is nothing a CMS surface could show the documents\n * under (every stored row would be an orphan).\n */\nexport async function loadHydratedCms(\n  operations: OperationsClient,\n  projectId: string,\n  collections: readonly CollectionDef[],\n): Promise<OperationResult<HydratedCms | null>> {\n  if (collections.length === 0) return { ok: true, value: null }\n  const documents = await operations.documents.list({ projectId })\n  if (!documents.ok) return documents\n  // The project's asset records (assets table), wired into the preview lookup so\n  // listing/relation results resolve their nested `asset` fields (EC-262). Non-fatal:\n  // a failed asset list degrades previews to no images, never blocks the session.\n  const assets = await operations.assets.list({ projectId })\n  // EC-224: a record is published when its version pointer is set — the same\n  // gate delivery reads. There is no flat-state fallback (the field is gone).\n  const isRecordPublished = (record: (typeof documents.value)[number]) =>\n    record.publishedVersion !== undefined\n  // The declared set, read once: the session carries the documents of these\n  // collections, and every other stored row is COUNTED (EC-606), never dropped\n  // silently.\n  const declaredIds = new Set(collections.map((collection) => collection.id))\n  const contentRecords = documents.value.filter((record) =>\n    declaredIds.has(record.document.collection),\n  )\n  const orphans = orphanedCollections(\n    documents.value.map((record) => ({\n      collection: record.document.collection,\n      published: isRecordPublished(record),\n    })),\n    declaredIds,\n  )\n  return {\n    ok: true,\n    value: {\n      orphans,\n      // The live row hydrates AS PERSISTED — a continuous draft (EC-224). We no\n      // longer stamp a `state:'published'` mirror: published-ness is the version\n      // pointer (`publishedKeys`), which every studio reader now consults (the\n      // table badge/$state via `isPublished`, the preview engine via the pin).\n      documents: contentRecords.map((record) => record.document),\n      publishedKeys: contentRecords\n        .filter(isRecordPublished)\n        .map((record) => documentKey(record.document)),\n      // EC-445: carry each record's `updatedAt` onto the session for the $updatedAt\n      // column — a per-document metadata accessor, exactly like `publishedKeys`.\n      timestamps: Object.fromEntries(\n        contentRecords.map((record) => [documentKey(record.document), record.updatedAt]),\n      ),\n      // EC-447: carry each PUBLISHED record's materialized `publishedAt` for the\n      // $publishedAt column. Only records that actually have one contribute (no\n      // session-start fallback) — an absent entry is a real \"no publish date\".\n      publishTimestamps: Object.fromEntries(\n        contentRecords\n          .filter((record) => record.publishedAt !== undefined)\n          .map((record) => [documentKey(record.document), record.publishedAt as string]),\n      ),\n      // EC-449: the documents whose draft carries unpublished changes (the amber\n      // list dot) — only materialized `true` flags contribute (absent/false both\n      // mean \"not changed\"; the flag only exists on published docs).\n      changedKeys: contentRecords\n        .filter((record) => record.hasUnpublishedChanges === true)\n        .map((record) => documentKey(record.document)),\n      // EC-595 A2: the revision each document was hydrated at — the per-patch base.\n      revisions: Object.fromEntries(\n        contentRecords.map((record) => [documentKey(record.document), record.revision]),\n      ),\n      assets: assets.ok ? assets.value : [],\n    },\n  }\n}\n\n/**\n * Load everything a project session hydrates from. Post-EC-287 that is just the\n * persisted CMS content (documents + assets): the project graph and its publish\n * path are gone, so there is no graph revision or graph-publishing state to load.\n * Per-document `publishedVersion` (EC-224) is the only published surface.\n */\nexport async function loadProjectSession(\n  operations: OperationsClient,\n  projectId: string,\n  collections: readonly CollectionDef[],\n): Promise<OperationResult<HydratedProjectSession>> {\n  const cms = await loadHydratedCms(operations, projectId, collections)\n  if (!cms.ok) return cms\n  return { ok: true, value: { cms: cms.value } }\n}\n"]}

package/dist/lib/operations/studio-operations.d.ts

@@ -1,5 +1,6 @@
-import type { PersistenceAdapter } from '@elytracms/core/persistence';
-import type { ChangesetOperations, OperationsClient, Principal, ReferenceIndexAttachment } from './operations-package.js';
+import type { DocumentListener, IdFactory, PersistenceAdapter, PresenceInput } from '@elytracms/core/persistence';
+import type { DocumentRef } from '@elytracms/core/cms-core';
+import type { ChangesetOperations, CollectionsResolver, DocumentValidator, LocalesResolver, ManifestLookupResolver, OperationsClient, Principal, ReferenceIndexAttachment } from './operations-package.js';
 /**
  * The studio's single operations bootstrap (EC-141, vision AD-7).
  *
@@ -25,6 +26,21 @@ export interface StudioOperations {
     readonly adapter: PersistenceAdapter;
     /** EC-155 maintained-on-write index attachment (flushable in tests). */
     readonly references: ReferenceIndexAttachment;
+    /**
+     * EC-595 binding point 7 — subscribe to ONE document (the narrow EC-309 slice): the
+     * listener gets the current row + the presence on it, then one snapshot per change
+     * (Convex: the reactive client's server push; playground: the in-memory store's own
+     * writes). An adapter capability exposed through the in-process bundle — the UI never
+     * holds a reactive Convex client. A subscription failure is ALSO emitted as a failed
+     * `documents.subscribe` event on the operations bus, so an expired session reaches
+     * EC-403's one session-expiry chokepoint like any failed operation (never a silently
+     * stopped stream). Returns the unsubscribe function.
+     */
+    subscribeDocument(projectId: string, ref: DocumentRef, listener: DocumentListener): () => void;
+    /** EC-595 — this session's field-presence heartbeat on a document (thin presence, Stage A). */
+    reportPresence(projectId: string, ref: DocumentRef, presence: PresenceInput): Promise<void>;
+    /** EC-595 — remove this session's presence from a document. */
+    clearPresence(projectId: string, ref: DocumentRef, sessionId: string): Promise<void>;
 }
 export interface CreateStudioOperationsOptions {
     /**
@@ -37,6 +53,41 @@ export interface CreateStudioOperationsOptions {
      * unauthenticated users away from every operation surface.
      */
     actor?: Principal;
+    /**
+     * EC-583 / EC-559 — the collection definitions on the operations context, resolved for
+     * each operation's OWN project id. Defaults to the workspace config's project with that
+     * slug (`projectCollections` — the resolved `elytra.config.ts`, functions
+     * included), read on every call: the bundle is cached per deployment KEY (EC-179) and
+     * one deployment may serve several config projects, so capturing one project's
+     * collections at build time would canonicalise another project's documents against
+     * them (operator correction to phase 1). The store holds no schema.
+     */
+    collections?: CollectionsResolver;
+    /** EC-578 — the document-id factory (`documents.create`); UUIDs by default. */
+    idFactory?: IdFactory;
+    /**
+     * EC-595 A1 (critic correction 4) → A2 — the manifest half of the write canonicaliser
+     * on the operations context, resolved for each operation's OWN project. Defaults to a
+     * lookup over that config project's component entries (`projectManifestLookup`), so
+     * every patch / replace canonicalises a composition's props with its project's
+     * manifests — never the active project's (A1 found-but-left #1).
+     */
+    manifestLookup?: ManifestLookupResolver;
+    /**
+     * EC-595 A2 (F23) — the publish gate's validator, bound to THIS bundle. Defaults to
+     * the runtime validator (`createRuntimeDocumentValidator`: the operation's project's
+     * config + oracles prefetched through the adapter). Tests that pin persistence
+     * routing rather than gate strength inject their own here — at construction, never
+     * through a mount.
+     */
+    validateDocument?: DocumentValidator;
+    /**
+     * EC-585 — the locale config on the operations context, per project: the view
+     * `documents.publish` runs its hidden-clear in. Defaults to that config project's
+     * `locales` (`projectLocaleConfig`) — the same project, read the same way, as the
+     * collections, the manifests and the gate's validator.
+     */
+    locales?: LocalesResolver;
 }
 /** Build a studio operations bundle over an adapter (exported for tests). */
 export declare function createStudioOperations(adapter: PersistenceAdapter, options?: CreateStudioOperationsOptions): StudioOperations;
@@ -55,5 +106,11 @@ export declare function getStudioOperations(): Promise<StudioOperations>;
  * later switch picks up the new actor too.
  */
 export declare function setStudioSession(actor: Principal | null): void;
+/**
+ * EC-595 A2 — the signed-in principal the operations clients act as (`null` signed out):
+ * what this session's presence heartbeat names ("X is in this field") and how a conflict
+ * tells "you, in another tab" from a colleague. Read-only; set by {@link setStudioSession}.
+ */
+export declare function getStudioActor(): Principal | null;
 /** Test seam: replace (or clear) the singleton for the active backend. */
 export declare function setStudioOperationsForTests(next: StudioOperations | null): void;

package/dist/lib/operations/studio-operations.js

@@ -1,7 +1,9 @@
 import { activeDeploymentKey, selectPersistenceAdapter } from '../persistence/index.js';
 import { attachSessionExpiryReporting } from '../session-expiry.js';
-import { sessionValidateDocument } from '../cms/document-gate.js';
-import { attachReferenceIndex, createChangesets, createOperations, createRoleAuthorization, } from './operations-package.js';
+import { projectManifestLookup } from './config-manifest-lookup.js';
+import { configProjectFor, projectCollections, projectComponentRegistry, projectLocaleConfig, } from './project-runtime-config.js';
+import { createRuntimeDocumentValidator } from './runtime-validator.js';
+import { attachReferenceIndex, createChangesets, createOperations, createRoleAuthorization, summarizeInput, toOperationError, } from './operations-package.js';
 /**
  * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):
  * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index
@@ -15,17 +17,31 @@ export function createStudioOperations(adapter, options = {}) {
     const authorized = options.actor
         ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }
         : {};
-    // EC-497: the publish gate validates with the CMS session's canonical option
-    // bag — the same one the detail editor, bulk publish, cell edit, import and
-    // every AI path use — instead of deciding its own (weaker, mode-dependent)
-    // strength off the adapter-served schema record. The seam reads a validator the
-    // mounted session published; with no session it answers with ONE blocking issue
-    // (EC-546) — a publish issued outside a mounted CMS session is refused, never
-    // waved through on weaker rules. The validator is required by the operations
-    // layer, so this bundle cannot be built without it.
+    // EC-583: the collections come from the config (never the store), per project id;
+    // EC-595 A1: so does the manifest lookup. Both ride the changesets runtime too.
+    // EC-585: every per-project fact below is read from ONE source — the config project
+    // with the operation's slug (`configProjectFor`): collections, manifests, locales.
+    const collections = options.collections ?? projectCollections;
+    const locales = options.locales ?? projectLocaleConfig;
+    const idFactory = options.idFactory ? { idFactory: options.idFactory } : {};
+    const manifestLookup = options.manifestLookup ?? projectManifestLookup((projectId) => configProjectFor(projectId)?.components);
+    // EC-595 A2 (F23) → EC-582: the publish gate's validator is bound to THIS bundle —
+    // core's canonical gate (`@elytracms/core/validation`) over the OPERATION's project:
+    // its collections, locales and component registry (never the active project's) +
+    // oracles prefetched through the adapter — never whichever CMS session is mounted.
+    const validateDocument = options.validateDocument ??
+        createRuntimeDocumentValidator({
+            collections,
+            localeConfig: locales,
+            registry: projectComponentRegistry,
+        });
     const operations = createOperations({
         adapter,
-        validateDocument: sessionValidateDocument,
+        collections,
+        validateDocument,
+        manifestLookup,
+        locales,
+        ...idFactory,
         ...authorized,
     });
     // EC-277: when the adapter maintains the index in its own write path (AD-6 "at the
@@ -39,9 +55,14 @@ export function createStudioOperations(adapter, options = {}) {
         : attachReferenceIndex(operations.events, adapter);
     const changesets = createChangesets({
         adapter,
+        collections,
         events: operations.events,
-        // EC-497: a changeset-driven publish is gated identically — same seam, same bag.
-        validateDocument: sessionValidateDocument,
+        // EC-497 / EC-595 A2: a changeset-driven publish is gated identically — the same
+        // runtime validator, prefetching through the step's own (scratch or real) adapter.
+        validateDocument,
+        manifestLookup,
+        locales,
+        ...idFactory,
         ...authorized,
     });
     // EC-579: no revalidation emitter attaches here. Host revalidation is a property
@@ -54,7 +75,40 @@ export function createStudioOperations(adapter, options = {}) {
     // matter which surface issued the operation (per-surface banners can't cover
     // surfaces that render no banner).
     attachSessionExpiryReporting(operations.events);
-    return { operations, changesets, adapter, references };
+    /** Report a capability failure on the bus (EC-403 sees an expiry like any failed operation). */
+    const reportFailure = (operation, input, error) => {
+        operations.events.emit({
+            operation,
+            domain: 'documents',
+            kind: 'query',
+            status: 'failed',
+            inputSummary: summarizeInput(input),
+            error: toOperationError(error),
+        });
+    };
+    return {
+        operations,
+        changesets,
+        adapter,
+        references,
+        subscribeDocument: (projectId, ref, listener) => adapter.cms.subscribeDocument(projectId, ref, {
+            onSnapshot: (snapshot) => listener.onSnapshot(snapshot),
+            onError: (error) => {
+                reportFailure('documents.subscribe', { projectId, ref }, error);
+                listener.onError?.(error);
+            },
+        }),
+        reportPresence: async (projectId, ref, presence) => {
+            try {
+                await adapter.cms.reportPresence(projectId, ref, presence);
+            }
+            catch (error) {
+                reportFailure('documents.presence', { projectId, ref }, error);
+                throw error;
+            }
+        },
+        clearPresence: (projectId, ref, sessionId) => adapter.cms.clearPresence(projectId, ref, sessionId),
+    };
 }
 // One adapter + one operations bundle per backend (EC-179): keyed by the active
 // deployment so switching to a project on another Convex deployment selects (or
@@ -113,6 +167,14 @@ export function setStudioSession(actor) {
     currentActor = actor;
     instancesByKey.clear();
 }
+/**
+ * EC-595 A2 — the signed-in principal the operations clients act as (`null` signed out):
+ * what this session's presence heartbeat names ("X is in this field") and how a conflict
+ * tells "you, in another tab" from a colleague. Read-only; set by {@link setStudioSession}.
+ */
+export function getStudioActor() {
+    return currentActor;
+}
 /** Test seam: replace (or clear) the singleton for the active backend. */
 export function setStudioOperationsForTests(next) {
     if (next) {

package/dist/lib/operations/studio-operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAA;AAC9D,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,sBAAsB,CAAA;AAgD7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,gBAAgB,EAAE,uBAAuB;QACzC,GAAG,UAAU;KACd,CAAC,CAAA;IACF,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,iFAAiF;QACjF,gBAAgB,EAAE,uBAAuB;QACzC,GAAG,UAAU;KACd,CAAC,CAAA;IACF,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;AACxD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type { PersistenceAdapter } from '@elytracms/core/persistence'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { sessionValidateDocument } from '../cms/document-gate'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  // EC-497: the publish gate validates with the CMS session's canonical option\n  // bag — the same one the detail editor, bulk publish, cell edit, import and\n  // every AI path use — instead of deciding its own (weaker, mode-dependent)\n  // strength off the adapter-served schema record. The seam reads a validator the\n  // mounted session published; with no session it answers with ONE blocking issue\n  // (EC-546) — a publish issued outside a mounted CMS session is refused, never\n  // waved through on weaker rules. The validator is required by the operations\n  // layer, so this bundle cannot be built without it.\n  const operations = createOperations({\n    adapter,\n    validateDocument: sessionValidateDocument,\n    ...authorized,\n  })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({\n    adapter,\n    events: operations.events,\n    // EC-497: a changeset-driven publish is gated identically — same seam, same bag.\n    validateDocument: sessionValidateDocument,\n    ...authorized,\n  })\n  // EC-579: no revalidation emitter attaches here. Host revalidation is a property\n  // of the Convex write chokepoint (`convex/triggers.ts`), the one emitter — it\n  // catches every writer, keeps the signing secret server-side, and the playground's\n  // in-browser adapter is read by no host, so there is nothing to emit there.\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n  return { operations, changesets, adapter, references }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}
+{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAsG7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,kFAAkF;IAClF,gFAAgF;IAChF,oFAAoF;IACpF,mFAAmF;IACnF,MAAM,WAAW,GAAwB,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAA;IAClF,MAAM,OAAO,GAAoB,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAA;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;IACzG,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,mFAAmF;IACnF,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB;QACxB,8BAA8B,CAAC;YAC7B,WAAW;YACX,YAAY,EAAE,OAAO;YACrB,QAAQ,EAAE,wBAAwB;SACnC,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,WAAW;QACX,gBAAgB;QAChB,cAAc;QACd,OAAO;QACP,GAAG,SAAS;QACZ,GAAG,UAAU;KACd,CAAC,CAAA;IACF,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,WAAW;QACX,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,iFAAiF;QACjF,mFAAmF;QACnF,gBAAgB;QAChB,cAAc;QACd,OAAO;QACP,GAAG,SAAS;QACZ,GAAG,UAAU;KACd,CAAC,CAAA;IACF,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAE/C,gGAAgG;IAChG,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,KAAc,EAAE,KAAc,EAAE,EAAE;QAC1E,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,SAAS;YACT,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC;YACnC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,OAAO;QACL,UAAU;QACV,UAAU;QACV,OAAO;QACP,UAAU;QACV,iBAAiB,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,EAAE;YAC5C,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,aAAa,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;gBAC/D,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;SACF,CAAC;QACJ,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;gBAC9D,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,aAAa,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC;KACnG,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type {\n  DocumentListener,\n  IdFactory,\n  PersistenceAdapter,\n  PresenceInput,\n} from '@elytracms/core/persistence'\nimport type { DocumentRef } from '@elytracms/core/cms-core'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { projectManifestLookup } from './config-manifest-lookup'\nimport {\n  configProjectFor,\n  projectCollections,\n  projectComponentRegistry,\n  projectLocaleConfig,\n} from './project-runtime-config'\nimport { createRuntimeDocumentValidator } from './runtime-validator'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n  summarizeInput,\n  toOperationError,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  CollectionsResolver,\n  DocumentValidator,\n  LocalesResolver,\n  ManifestLookupResolver,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n  /**\n   * EC-595 binding point 7 — subscribe to ONE document (the narrow EC-309 slice): the\n   * listener gets the current row + the presence on it, then one snapshot per change\n   * (Convex: the reactive client's server push; playground: the in-memory store's own\n   * writes). An adapter capability exposed through the in-process bundle — the UI never\n   * holds a reactive Convex client. A subscription failure is ALSO emitted as a failed\n   * `documents.subscribe` event on the operations bus, so an expired session reaches\n   * EC-403's one session-expiry chokepoint like any failed operation (never a silently\n   * stopped stream). Returns the unsubscribe function.\n   */\n  subscribeDocument(projectId: string, ref: DocumentRef, listener: DocumentListener): () => void\n  /** EC-595 — this session's field-presence heartbeat on a document (thin presence, Stage A). */\n  reportPresence(projectId: string, ref: DocumentRef, presence: PresenceInput): Promise<void>\n  /** EC-595 — remove this session's presence from a document. */\n  clearPresence(projectId: string, ref: DocumentRef, sessionId: string): Promise<void>\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n  /**\n   * EC-583 / EC-559 — the collection definitions on the operations context, resolved for\n   * each operation's OWN project id. Defaults to the workspace config's project with that\n   * slug (`projectCollections` — the resolved `elytra.config.ts`, functions\n   * included), read on every call: the bundle is cached per deployment KEY (EC-179) and\n   * one deployment may serve several config projects, so capturing one project's\n   * collections at build time would canonicalise another project's documents against\n   * them (operator correction to phase 1). The store holds no schema.\n   */\n  collections?: CollectionsResolver\n  /** EC-578 — the document-id factory (`documents.create`); UUIDs by default. */\n  idFactory?: IdFactory\n  /**\n   * EC-595 A1 (critic correction 4) → A2 — the manifest half of the write canonicaliser\n   * on the operations context, resolved for each operation's OWN project. Defaults to a\n   * lookup over that config project's component entries (`projectManifestLookup`), so\n   * every patch / replace canonicalises a composition's props with its project's\n   * manifests — never the active project's (A1 found-but-left #1).\n   */\n  manifestLookup?: ManifestLookupResolver\n  /**\n   * EC-595 A2 (F23) — the publish gate's validator, bound to THIS bundle. Defaults to\n   * the runtime validator (`createRuntimeDocumentValidator`: the operation's project's\n   * config + oracles prefetched through the adapter). Tests that pin persistence\n   * routing rather than gate strength inject their own here — at construction, never\n   * through a mount.\n   */\n  validateDocument?: DocumentValidator\n  /**\n   * EC-585 — the locale config on the operations context, per project: the view\n   * `documents.publish` runs its hidden-clear in. Defaults to that config project's\n   * `locales` (`projectLocaleConfig`) — the same project, read the same way, as the\n   * collections, the manifests and the gate's validator.\n   */\n  locales?: LocalesResolver\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  // EC-583: the collections come from the config (never the store), per project id;\n  // EC-595 A1: so does the manifest lookup. Both ride the changesets runtime too.\n  // EC-585: every per-project fact below is read from ONE source — the config project\n  // with the operation's slug (`configProjectFor`): collections, manifests, locales.\n  const collections: CollectionsResolver = options.collections ?? projectCollections\n  const locales: LocalesResolver = options.locales ?? projectLocaleConfig\n  const idFactory = options.idFactory ? { idFactory: options.idFactory } : {}\n  const manifestLookup =\n    options.manifestLookup ?? projectManifestLookup((projectId) => configProjectFor(projectId)?.components)\n  // EC-595 A2 (F23) → EC-582: the publish gate's validator is bound to THIS bundle —\n  // core's canonical gate (`@elytracms/core/validation`) over the OPERATION's project:\n  // its collections, locales and component registry (never the active project's) +\n  // oracles prefetched through the adapter — never whichever CMS session is mounted.\n  const validateDocument =\n    options.validateDocument ??\n    createRuntimeDocumentValidator({\n      collections,\n      localeConfig: locales,\n      registry: projectComponentRegistry,\n    })\n  const operations = createOperations({\n    adapter,\n    collections,\n    validateDocument,\n    manifestLookup,\n    locales,\n    ...idFactory,\n    ...authorized,\n  })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({\n    adapter,\n    collections,\n    events: operations.events,\n    // EC-497 / EC-595 A2: a changeset-driven publish is gated identically — the same\n    // runtime validator, prefetching through the step's own (scratch or real) adapter.\n    validateDocument,\n    manifestLookup,\n    locales,\n    ...idFactory,\n    ...authorized,\n  })\n  // EC-579: no revalidation emitter attaches here. Host revalidation is a property\n  // of the Convex write chokepoint (`convex/triggers.ts`), the one emitter — it\n  // catches every writer, keeps the signing secret server-side, and the playground's\n  // in-browser adapter is read by no host, so there is nothing to emit there.\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n\n  /** Report a capability failure on the bus (EC-403 sees an expiry like any failed operation). */\n  const reportFailure = (operation: string, input: unknown, error: unknown) => {\n    operations.events.emit({\n      operation,\n      domain: 'documents',\n      kind: 'query',\n      status: 'failed',\n      inputSummary: summarizeInput(input),\n      error: toOperationError(error),\n    })\n  }\n  return {\n    operations,\n    changesets,\n    adapter,\n    references,\n    subscribeDocument: (projectId, ref, listener) =>\n      adapter.cms.subscribeDocument(projectId, ref, {\n        onSnapshot: (snapshot) => listener.onSnapshot(snapshot),\n        onError: (error) => {\n          reportFailure('documents.subscribe', { projectId, ref }, error)\n          listener.onError?.(error)\n        },\n      }),\n    reportPresence: async (projectId, ref, presence) => {\n      try {\n        await adapter.cms.reportPresence(projectId, ref, presence)\n      } catch (error) {\n        reportFailure('documents.presence', { projectId, ref }, error)\n        throw error\n      }\n    },\n    clearPresence: (projectId, ref, sessionId) => adapter.cms.clearPresence(projectId, ref, sessionId),\n  }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/**\n * EC-595 A2 — the signed-in principal the operations clients act as (`null` signed out):\n * what this session's presence heartbeat names (\"X is in this field\") and how a conflict\n * tells \"you, in another tab\" from a colleague. Read-only; set by {@link setStudioSession}.\n */\nexport function getStudioActor(): Principal | null {\n  return currentActor\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}

package/dist/lib/persistence/convex-adapter.d.ts

@@ -1,6 +1,6 @@
 import type { ConvexHttpClient } from 'convex/browser';
-import type { CollectionDef } from '@elytracms/core/cms-core';
 import type { AssetRepository, BackendStatus, BackendValidationInput, BackendValidationResult, BlobStorageAdapter, CmsRepository, DeliveryRepository, MembersRepository, PersistenceAdapter, ReferenceIndexRepository, RedirectRepository, UserRepository, InviteRepository } from '@elytracms/core/persistence';
+import type { ReactiveDocumentClient } from './convex-client.js';
 /**
  * Convex-backed {@link PersistenceAdapter} (brief §10, EC-039). Every repository
  * is implemented against the Convex functions in `apps/builder/convex/*`, mapping
@@ -34,11 +34,19 @@ export declare class ConvexPersistenceAdapter implements PersistenceAdapter {
      * @param client      the Convex client bound to this deployment (one project).
      * @param projectId   the slug of this deployment's one project (EC-179). Used to
      *   stamp deployment-scoped member records onto the still-project-keyed contract.
-     * @param collections the active project's config-owned CMS collections (EC-183,
-     *   AD-11), from `elytra.config.ts`. The backend has no `cmsSchemas` table, so
-     *   the CMS repository serves the schema from these.
+     *
+     * @param options.reactive the reactive client a document subscription runs on (EC-595),
+     *   built lazily — the studio passes `() => getReactiveConvexClient(url)`. Absent (a
+     *   seed script, a test double without push), `subscribeDocument` fails loudly.
+     *
+     * EC-583: the third argument is no longer the collections. They only fed the
+     * synthesized schema record (`getSchema`/`findSchema`), which the contract no longer
+     * has — collections reach the operations layer on its context
+     * (`createOperations({ collections })`).
      */
-    constructor(client: ConvexHttpClient, projectId: string, collections?: readonly CollectionDef[]);
+    constructor(client: ConvexHttpClient, projectId: string, options?: {
+        reactive?: () => ReactiveDocumentClient;
+    });
     status(): Promise<BackendStatus>;
     validate(input: BackendValidationInput): BackendValidationResult;
 }