@elytracms/studio 0.0.91 → 0.0.93

package/dist/lib/persistence/index.js

@@ -1,7 +1,7 @@
 import { SEED_PROJECT_ID, createSeededPersistenceAdapter } from '@elytracms/core/persistence';
 import { resolveDeploymentCollections, resolveDeploymentProjectId, resolveDeploymentUrl, } from '../workspace/index.js';
 import { createBrowserBlobStorage } from '../assets/browser-blob-storage.js';
-import { getConvexClient } from './convex-client.js';
+import { getConvexClient, getReactiveConvexClient } from './convex-client.js';
 import { ConvexPersistenceAdapter } from './convex-adapter.js';
 import { resolveBackendConfig } from './backend-mode.js';
 /**
@@ -18,11 +18,14 @@ import { resolveBackendConfig } from './backend-mode.js';
 export async function selectPersistenceAdapter() {
     const config = resolveBackendConfig();
     if (config.kind === 'convex') {
-        return new ConvexPersistenceAdapter(getConvexClient(resolveDeploymentUrl(config.url)), resolveDeploymentProjectId('aurora-marketing'), 
-        // CMS collections are config-owned (EC-183, AD-11): inject the active
-        // project's collections so the adapter serves the schema from config (the
-        // backend has no `cmsSchemas` table).
-        resolveDeploymentCollections());
+        // EC-583: no collections here — the store holds no schema; the operations
+        // context carries the config's collections (`createStudioOperations`).
+        const url = resolveDeploymentUrl(config.url);
+        return new ConvexPersistenceAdapter(getConvexClient(url), resolveDeploymentProjectId('aurora-marketing'), {
+            // EC-595: the document subscription's reactive client — built lazily on the first
+            // subscribe, authenticated from the same URL's client (the token it mirrors).
+            reactive: () => getReactiveConvexClient(url),
+        });
     }
     if (config.kind === 'playground') {
         // EC-207: routes/redirects are config-sourced, never seeded to the backend —
@@ -32,18 +35,14 @@ export async function selectPersistenceAdapter() {
         // sit under the same id the studio operates on. Otherwise authorization denies
         // every read ("not a member of project 'aurora'") and content resolves empty.
         const projectId = resolveDeploymentProjectId(SEED_PROJECT_ID);
-        // EC-361 (AD-11 parity with the Convex adapter above): when a config project
-        // declares collections, the playground serves the CONFIG-OWNED schema — not the
-        // engine's seeded sample schema — so every schema reader (the content-session
-        // hydration, the persister baseline, query validation's `filterable` set) sees
-        // the same declarations connected mode serves. The resolved config already
-        // carries the EC-257 default asset collection. Without a config (engine
-        // fixtures/tests) the seeded sample schema stands, byte-identical to before.
-        // EC-424: passing `collections` straight into the seed (not a follow-up
-        // `saveSchema`) also reconciles the seeded DOCUMENTS against them — a field a
-        // config declares localized but the shared fixture stores plain (e.g. this
-        // repo's demo `post.slug`, EC-315) gets promoted into `localized`, not just
-        // the schema — see `reconcileSeedDocumentLocalization` in `@elytracms/core/persistence`.
+        // EC-361/EC-424: when a config project declares collections, the seed is
+        // reconciled against them (a field the config declares localized but the shared
+        // fixture stores plain — this repo's demo `post.slug`, EC-315 — is promoted into
+        // `localized`), and only their documents are written (EC-606). EC-583: the
+        // collections are the seed's LENS only — the store holds no schema; every
+        // schema reader (hydration, the CMS surfaces, the operations context) reads the
+        // config itself. Without a config (engine fixtures/tests) the sample schema is
+        // the lens.
         const collections = resolveDeploymentCollections();
         // EC-459: seed with a studio-owned blob adapter that mints real browser-
         // displayable URLs (object URLs) instead of the engine default's opaque

package/dist/lib/persistence/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/persistence/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAE7F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAGrD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,wBAAwB,CACjC,eAAe,CAAC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EACjD,0BAA0B,CAAC,kBAAkB,CAAC;QAC9C,sEAAsE;QACtE,0EAA0E;QAC1E,sCAAsC;QACtC,4BAA4B,EAAE,CAC/B,CAAA;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,6EAA6E;QAC7E,0DAA0D;QAC1D,0EAA0E;QAC1E,+EAA+E;QAC/E,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,SAAS,GAAG,0BAA0B,CAAC,eAAe,CAAC,CAAA;QAC7D,6EAA6E;QAC7E,gFAAgF;QAChF,8EAA8E;QAC9E,+EAA+E;QAC/E,2EAA2E;QAC3E,wEAAwE;QACxE,6EAA6E;QAC7E,wEAAwE;QACxE,8EAA8E;QAC9E,2EAA2E;QAC3E,4EAA4E;QAC5E,yFAAyF;QACzF,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAA;QAClD,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAClD,SAAS,EACT,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAChD,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,CACtC,CAAA;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACrE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,YAAY,CAAA;IACrD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,8BAA8B,EAC9B,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,GACV,MAAM,gBAAgB,CAAA;AAQvB,kFAAkF;AAClF,gFAAgF;AAChF,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA","sourcesContent":["import { SEED_PROJECT_ID, createSeededPersistenceAdapter } from '@elytracms/core/persistence'\nimport type { PersistenceAdapter } from '@elytracms/core/persistence'\nimport {\n  resolveDeploymentCollections,\n  resolveDeploymentProjectId,\n  resolveDeploymentUrl,\n} from '../workspace'\nimport { createBrowserBlobStorage } from '../assets/browser-blob-storage'\nimport { getConvexClient } from './convex-client'\nimport { ConvexPersistenceAdapter } from './convex-adapter'\nimport { resolveBackendConfig } from './backend-mode'\nimport type { StudioBackendMode } from './backend-mode'\n\n/**\n * Select the persistence backend (EC-153, vision AD-1). **Convex is the\n * default**: a configured `VITE_CONVEX_URL` is required unless the explicit\n * playground flag (`VITE_ELYTRA_MODE=playground`) opts into the deterministic,\n * seeded in-memory adapter. There is **no automatic in-memory fallback** —\n * missing configuration is a hard, descriptive error (the `DeploymentSetupGate`\n * renders it as a boot-error screen before any adapter is requested).\n *\n * EC-150: the Convex path uses the *shared* client so the auth adapter's\n * session JWT (set via `client.setAuth`) authenticates every persistence call.\n */\nexport async function selectPersistenceAdapter(): Promise<PersistenceAdapter> {\n  const config = resolveBackendConfig()\n  if (config.kind === 'convex') {\n    return new ConvexPersistenceAdapter(\n      getConvexClient(resolveDeploymentUrl(config.url)),\n      resolveDeploymentProjectId('aurora-marketing'),\n      // CMS collections are config-owned (EC-183, AD-11): inject the active\n      // project's collections so the adapter serves the schema from config (the\n      // backend has no `cmsSchemas` table).\n      resolveDeploymentCollections(),\n    )\n  }\n  if (config.kind === 'playground') {\n    // EC-207: routes/redirects are config-sourced, never seeded to the backend —\n    // the playground adapter no longer seeds route documents.\n    // EC-310: key the seed under the ACTIVE project id (the config slug, e.g.\n    // `aurora`) — not the engine's default `prj_aurora` — so content + memberships\n    // sit under the same id the studio operates on. Otherwise authorization denies\n    // every read (\"not a member of project 'aurora'\") and content resolves empty.\n    const projectId = resolveDeploymentProjectId(SEED_PROJECT_ID)\n    // EC-361 (AD-11 parity with the Convex adapter above): when a config project\n    // declares collections, the playground serves the CONFIG-OWNED schema — not the\n    // engine's seeded sample schema — so every schema reader (the content-session\n    // hydration, the persister baseline, query validation's `filterable` set) sees\n    // the same declarations connected mode serves. The resolved config already\n    // carries the EC-257 default asset collection. Without a config (engine\n    // fixtures/tests) the seeded sample schema stands, byte-identical to before.\n    // EC-424: passing `collections` straight into the seed (not a follow-up\n    // `saveSchema`) also reconciles the seeded DOCUMENTS against them — a field a\n    // config declares localized but the shared fixture stores plain (e.g. this\n    // repo's demo `post.slug`, EC-315) gets promoted into `localized`, not just\n    // the schema — see `reconcileSeedDocumentLocalization` in `@elytracms/core/persistence`.\n    const collections = resolveDeploymentCollections()\n    // EC-459: seed with a studio-owned blob adapter that mints real browser-\n    // displayable URLs (object URLs) instead of the engine default's opaque\n    // `memory://` locator — see `browser-blob-storage.ts` for the full\n    // rationale. Playground-only; the Convex branch above is untouched.\n    const adapter = await createSeededPersistenceAdapter(\n      projectId,\n      collections.length > 0 ? collections : undefined,\n      { blobs: createBrowserBlobStorage() },\n    )\n    return adapter\n  }\n  throw new Error(config.detail)\n}\n\n/**\n * A stable key identifying the active backend (EC-179): the resolved deployment\n * URL for the active project under Convex, or `playground`. The operations\n * bootstrap caches one bundle per key, so switching to a project on a different\n * deployment transparently selects (or builds) that backend's operations client.\n */\nexport function activeDeploymentKey(): string {\n  const config = resolveBackendConfig()\n  if (config.kind === 'convex') return resolveDeploymentUrl(config.url)\n  if (config.kind === 'playground') return 'playground'\n  throw new Error(config.detail)\n}\n\n/**\n * The active backend mode. Throws the same descriptive error as\n * {@link selectPersistenceAdapter} when the studio is misconfigured — UI that\n * only needs \"is this the playground?\" should use `isPlaygroundMode()`.\n */\nexport function persistenceMode(): StudioBackendMode {\n  const config = resolveBackendConfig()\n  if (config.kind === 'misconfigured') throw new Error(config.detail)\n  return config.kind\n}\n\nexport { ConvexPersistenceAdapter } from './convex-adapter'\nexport {\n  CONVEX_URL_ENV_VAR,\n  DEV_LOGIN_ENV_VAR,\n  MODE_ENV_VAR,\n  PLAYGROUND_MODE,\n  STUDIO_ENV_KEYS,\n  detectStudioEnvAnomaly,\n  isDevAutoLoginActive,\n  isDevRuntime,\n  isPlaygroundMode,\n  provideStudioEnv,\n  resetProvidedStudioEnvForTests,\n  resolveBackendConfig,\n  resolveDevAutoLogin,\n  studioEnv,\n} from './backend-mode'\nexport type {\n  DevAutoLoginCredentials,\n  EnvRecord,\n  StudioBackendConfig,\n  StudioBackendMode,\n  StudioEnvAnomaly,\n} from './backend-mode'\n// EC-258: the deployment-readiness facts mapper (the boot DeploymentSetupGate + a\n// future `elytra doctor` CLI compose the same `checkDeploymentReady` contract).\nexport { studioDeploymentReadiness, studioReadinessFacts } from './deployment-readiness'\nexport type { StudioReadinessInputs } from './deployment-readiness'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/persistence/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAA;AAE7F,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA;AAGrD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAO,IAAI,wBAAwB,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,0BAA0B,CAAC,kBAAkB,CAAC,EAAE;YACxG,kFAAkF;YAClF,8EAA8E;YAC9E,QAAQ,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC;SAC7C,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,6EAA6E;QAC7E,0DAA0D;QAC1D,0EAA0E;QAC1E,+EAA+E;QAC/E,+EAA+E;QAC/E,8EAA8E;QAC9E,MAAM,SAAS,GAAG,0BAA0B,CAAC,eAAe,CAAC,CAAA;QAC7D,yEAAyE;QACzE,gFAAgF;QAChF,iFAAiF;QACjF,2EAA2E;QAC3E,0EAA0E;QAC1E,gFAAgF;QAChF,+EAA+E;QAC/E,YAAY;QACZ,MAAM,WAAW,GAAG,4BAA4B,EAAE,CAAA;QAClD,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAClD,SAAS,EACT,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAChD,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,CACtC,CAAA;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACrE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,YAAY,CAAA;IACrD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG,oBAAoB,EAAE,CAAA;IACrC,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,8BAA8B,EAC9B,oBAAoB,EACpB,mBAAmB,EACnB,SAAS,GACV,MAAM,gBAAgB,CAAA;AAQvB,kFAAkF;AAClF,gFAAgF;AAChF,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA","sourcesContent":["import { SEED_PROJECT_ID, createSeededPersistenceAdapter } from '@elytracms/core/persistence'\nimport type { PersistenceAdapter } from '@elytracms/core/persistence'\nimport {\n  resolveDeploymentCollections,\n  resolveDeploymentProjectId,\n  resolveDeploymentUrl,\n} from '../workspace'\nimport { createBrowserBlobStorage } from '../assets/browser-blob-storage'\nimport { getConvexClient, getReactiveConvexClient } from './convex-client'\nimport { ConvexPersistenceAdapter } from './convex-adapter'\nimport { resolveBackendConfig } from './backend-mode'\nimport type { StudioBackendMode } from './backend-mode'\n\n/**\n * Select the persistence backend (EC-153, vision AD-1). **Convex is the\n * default**: a configured `VITE_CONVEX_URL` is required unless the explicit\n * playground flag (`VITE_ELYTRA_MODE=playground`) opts into the deterministic,\n * seeded in-memory adapter. There is **no automatic in-memory fallback** —\n * missing configuration is a hard, descriptive error (the `DeploymentSetupGate`\n * renders it as a boot-error screen before any adapter is requested).\n *\n * EC-150: the Convex path uses the *shared* client so the auth adapter's\n * session JWT (set via `client.setAuth`) authenticates every persistence call.\n */\nexport async function selectPersistenceAdapter(): Promise<PersistenceAdapter> {\n  const config = resolveBackendConfig()\n  if (config.kind === 'convex') {\n    // EC-583: no collections here — the store holds no schema; the operations\n    // context carries the config's collections (`createStudioOperations`).\n    const url = resolveDeploymentUrl(config.url)\n    return new ConvexPersistenceAdapter(getConvexClient(url), resolveDeploymentProjectId('aurora-marketing'), {\n      // EC-595: the document subscription's reactive client — built lazily on the first\n      // subscribe, authenticated from the same URL's client (the token it mirrors).\n      reactive: () => getReactiveConvexClient(url),\n    })\n  }\n  if (config.kind === 'playground') {\n    // EC-207: routes/redirects are config-sourced, never seeded to the backend —\n    // the playground adapter no longer seeds route documents.\n    // EC-310: key the seed under the ACTIVE project id (the config slug, e.g.\n    // `aurora`) — not the engine's default `prj_aurora` — so content + memberships\n    // sit under the same id the studio operates on. Otherwise authorization denies\n    // every read (\"not a member of project 'aurora'\") and content resolves empty.\n    const projectId = resolveDeploymentProjectId(SEED_PROJECT_ID)\n    // EC-361/EC-424: when a config project declares collections, the seed is\n    // reconciled against them (a field the config declares localized but the shared\n    // fixture stores plain — this repo's demo `post.slug`, EC-315 — is promoted into\n    // `localized`), and only their documents are written (EC-606). EC-583: the\n    // collections are the seed's LENS only — the store holds no schema; every\n    // schema reader (hydration, the CMS surfaces, the operations context) reads the\n    // config itself. Without a config (engine fixtures/tests) the sample schema is\n    // the lens.\n    const collections = resolveDeploymentCollections()\n    // EC-459: seed with a studio-owned blob adapter that mints real browser-\n    // displayable URLs (object URLs) instead of the engine default's opaque\n    // `memory://` locator — see `browser-blob-storage.ts` for the full\n    // rationale. Playground-only; the Convex branch above is untouched.\n    const adapter = await createSeededPersistenceAdapter(\n      projectId,\n      collections.length > 0 ? collections : undefined,\n      { blobs: createBrowserBlobStorage() },\n    )\n    return adapter\n  }\n  throw new Error(config.detail)\n}\n\n/**\n * A stable key identifying the active backend (EC-179): the resolved deployment\n * URL for the active project under Convex, or `playground`. The operations\n * bootstrap caches one bundle per key, so switching to a project on a different\n * deployment transparently selects (or builds) that backend's operations client.\n */\nexport function activeDeploymentKey(): string {\n  const config = resolveBackendConfig()\n  if (config.kind === 'convex') return resolveDeploymentUrl(config.url)\n  if (config.kind === 'playground') return 'playground'\n  throw new Error(config.detail)\n}\n\n/**\n * The active backend mode. Throws the same descriptive error as\n * {@link selectPersistenceAdapter} when the studio is misconfigured — UI that\n * only needs \"is this the playground?\" should use `isPlaygroundMode()`.\n */\nexport function persistenceMode(): StudioBackendMode {\n  const config = resolveBackendConfig()\n  if (config.kind === 'misconfigured') throw new Error(config.detail)\n  return config.kind\n}\n\nexport { ConvexPersistenceAdapter } from './convex-adapter'\nexport {\n  CONVEX_URL_ENV_VAR,\n  DEV_LOGIN_ENV_VAR,\n  MODE_ENV_VAR,\n  PLAYGROUND_MODE,\n  STUDIO_ENV_KEYS,\n  detectStudioEnvAnomaly,\n  isDevAutoLoginActive,\n  isDevRuntime,\n  isPlaygroundMode,\n  provideStudioEnv,\n  resetProvidedStudioEnvForTests,\n  resolveBackendConfig,\n  resolveDevAutoLogin,\n  studioEnv,\n} from './backend-mode'\nexport type {\n  DevAutoLoginCredentials,\n  EnvRecord,\n  StudioBackendConfig,\n  StudioBackendMode,\n  StudioEnvAnomaly,\n} from './backend-mode'\n// EC-258: the deployment-readiness facts mapper (the boot DeploymentSetupGate + a\n// future `elytra doctor` CLI compose the same `checkDeploymentReady` contract).\nexport { studioDeploymentReadiness, studioReadinessFacts } from './deployment-readiness'\nexport type { StudioReadinessInputs } from './deployment-readiness'\n"]}

package/dist/lib/persona/labels.js

@@ -30,7 +30,8 @@ import { humanizeName } from '../utils.js';
  * as the known-positive control that the search finds a render site when one exists.
  *
  * The graph table was unreachable structurally, not just unused: the ONE live path from
- * graph validation into the studio is `cms-composition-validators.ts`, which maps a
+ * graph validation into the studio was `cms-composition-validators.ts` (since EC-582
+ * `@elytracms/core/validation`'s `compositionValidators`), which maps a
  * graph issue to `CompositionIssue` — a type with `message`/`severity`/`nodePath` and
  * **no `code` field at all** (`cms-core/validate-document.ts:809`). The code an
  * exhaustiveness guard exists to force a label for cannot reach an editor surface.
@@ -75,6 +76,7 @@ const CMS_ISSUE_LABEL_KEYS = {
     'missing-localized-value': 'cms.issue.missing-localized-value',
     'route-conflict': 'cms.issue.route-conflict',
     'redirect-loop': 'cms.issue.redirect-loop',
+    'invalid-redirect': 'cms.issue.invalid-redirect',
     'unknown-route-target': 'cms.issue.unknown-route-target',
     'hierarchy-cycle': 'cms.issue.hierarchy-cycle',
     'document-nesting-depth': 'cms.issue.document-nesting-depth',
@@ -86,6 +88,7 @@ const CMS_ISSUE_LABEL_KEYS = {
     'hidden-predicate-error': 'cms.issue.hidden-predicate-error',
     'unaddressable-url': 'cms.issue.unaddressable-url',
     'unknown-version': 'cms.issue.unknown-version',
+    'invalid-stored-document': 'cms.issue.invalid-stored-document',
 };
 /**
  * EC-507 rider — the few codes whose TITLE overstates at `warning` severity.

package/dist/lib/persona/labels.js.map

@@ -1 +1 @@
-{"version":3,"file":"labels.js","sourceRoot":"","sources":["../../../src/lib/persona/labels.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAMvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAiC;IACzD,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,oBAAoB,EAAE,8BAA8B;IACpD,2BAA2B,EAAE,qCAAqC;IAClE,sBAAsB,EAAE,gCAAgC;IACxD,qBAAqB,EAAE,+BAA+B;IACtD,wBAAwB,EAAE,kCAAkC;IAC5D,qBAAqB,EAAE,+BAA+B;IACtD,yBAAyB,EAAE,mCAAmC;IAC9D,6BAA6B,EAAE,uCAAuC;IACtE,uBAAuB,EAAE,iCAAiC;IAC1D,eAAe,EAAE,yBAAyB;IAC1C,oBAAoB,EAAE,8BAA8B;IACpD,gBAAgB,EAAE,0BAA0B;IAC5C,yBAAyB,EAAE,mCAAmC;IAC9D,gBAAgB,EAAE,0BAA0B;IAC5C,eAAe,EAAE,yBAAyB;IAC1C,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,wBAAwB,EAAE,kCAAkC;IAC5D,0BAA0B,EAAE,oCAAoC;IAChE,iBAAiB,EAAE,2BAA2B;IAC9C,eAAe,EAAE,yBAAyB;IAC1C,eAAe,EAAE,yBAAyB;IAC1C,mBAAmB,EAAE,6BAA6B;IAClD,wBAAwB,EAAE,kCAAkC;IAC5D,mBAAmB,EAAE,6BAA6B;IAClD,iBAAiB,EAAE,2BAA2B;CAC/C,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,4BAA4B,GAA0C;IAC1E,qBAAqB,EAAE,uCAAuC;CAC/D,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAuC;IACrE,UAAU,EAAE,kCAAkC;IAC9C,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,gCAAgC;IAC1C,qBAAqB,EAAE,2CAA2C;IAClE,YAAY,EAAE,oCAAoC;IAClD,OAAO,EAAE,+BAA+B;CACzC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB,EAAE,QAA2B;IAC3E,MAAM,GAAG,GACP,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,oBAAoB,CAAC,IAAI,CAAwB,CAAA;IACpD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAA;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAA;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,iBAAiB,CACxB,GAQa,EACb,QAAgB;IAEhB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAA;IACzB,MAAM,IAAI,GAAoC,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7D,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8C;IAClF,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAuB,CAAA;IAClE,OAAO,SAAS,CAAC,GAAG,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAA;AAC7D,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,QAAwC,EACxC,MAAe;IAEf,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACxG,OAAO,QAAQ,IAAI,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["import type { CmsIssueCode, CmsIssueSeverity, CmsValidationIssue } from '@elytracms/core/cms-core'\nimport { resolveLabel } from '@elytracms/core/cms-core'\nimport type { OperationError, OperationErrorCode, OperationIssue } from '@elytracms/core/operations'\nimport type { BuildFragmentError, FragmentParseError } from '@elytracms/core/clipboard'\nimport type { ContentQueryError } from '@elytracms/core/content'\nimport type { CustomizationIssue } from '@elytracms/core/studio-core'\nimport type { ComponentManifest } from '@elytracms/core/component-registry'\nimport { localizedLabel, translate } from '@elytracms/studio/lib/i18n'\nimport { humanizeName } from '../utils'\n\n/**\n * Persona-aware labels (EC-192 item 2, Milestone B promise).\n *\n * A non-technical editor must never see a manifest/binding/path-token/validation\n * identifier on — or one click off — the editor path. The engine speaks in stable\n * machine codes (`cmsIssueCodeSchema`, `operationErrorCodeSchema`) and machine ids\n * (`Heading`, `r-blog-slug-en`); this module is the single translation layer the\n * editor-facing surfaces route through.\n *\n * The maps are exhaustive `Record<…Code, string>` over the Zod enums, so adding a\n * code in `@elytracms/core/cms-core` or `@elytracms/core/operations`\n * fails typecheck here until it is given an editor-facing label — the persona\n * boundary cannot silently regress. A table is only worth that guard while something\n * renders it: EC-509 deleted two that nothing did (see below). Engineers keep the raw\n * code: every surface that\n * shows a label also carries the code in a `title=`/`data-*` attribute (inspectable\n * via hover/devtools, never rendered as visible copy).\n */\n\n/**\n * EC-509 — two label tables were DELETED here rather than localized, because measuring\n * first showed nothing rendered them.\n *\n * `GRAPH_ISSUE_LABELS`/`graphIssueLabel` (16 entries, project-graph `IssueCode`) and\n * `CONDITION_OPERATOR_LABELS`/`conditionOperatorLabel` (8, `ConditionOperator`) had\n * **zero call sites** outside this file and its own test — measured by grep over\n * `packages/` + `apps/`, with `cmsIssueLabel` (4 sites) and `operationErrorLabel` (1)\n * as the known-positive control that the search finds a render site when one exists.\n *\n * The graph table was unreachable structurally, not just unused: the ONE live path from\n * graph validation into the studio is `cms-composition-validators.ts`, which maps a\n * graph issue to `CompositionIssue` — a type with `message`/`severity`/`nodePath` and\n * **no `code` field at all** (`cms-core/validate-document.ts:809`). The code an\n * exhaustiveness guard exists to force a label for cannot reach an editor surface.\n * `ConditionOperator` is live in the runtime renderer's condition gate\n * (`runtime-renderer/render.tsx:48`) but has no studio surface: v1 canvas is static\n * props, editor bindings parked, so no inspector ever shows an operator to name.\n *\n * **This overturns an EC-210 decision** (2026-06-17), which kept `graphIssueLabel` when\n * the validation panel was removed, on the rationale that it was \"the EC-192 boundary's\n * exhaustiveness guard, not panel code\". That was right then and its premise is false\n * now — the guard guards a boundary with no traffic, so it only forced editor copy for\n * strings no editor can see. Localizing them would have added 24 keys to the same\n * effect. If a surface ever renders these codes it needs labels written for it, and\n * will write them localized from the start.\n *\n * Neither symbol is referenced by either consumer repo (measured read-only) and neither\n * appears in docs.\n */\n\n/**\n * EC-443: the CMS issue titles live in the EC-241 message catalog\n * (`cms.issue.<code>`, EN source + shipped de), so the Issues pane / for-review\n * lane localize with the rest of the chrome. This map stays the exhaustive\n * `Record` over the Zod enum — a new code still fails typecheck here until it\n * gets an editor-facing catalog key (the persona boundary cannot silently\n * regress); {@link cmsIssueLabel} resolves it through `translate`.\n */\nconst CMS_ISSUE_LABEL_KEYS: Record<CmsIssueCode, string> = {\n  'duplicate-collection': 'cms.issue.duplicate-collection',\n  'duplicate-field': 'cms.issue.duplicate-field',\n  'unknown-collection': 'cms.issue.unknown-collection',\n  'invalid-collection-config': 'cms.issue.invalid-collection-config',\n  'invalid-field-config': 'cms.issue.invalid-field-config',\n  'reserved-field-name': 'cms.issue.reserved-field-name',\n  'missing-required-field': 'cms.issue.missing-required-field',\n  'invalid-field-value': 'cms.issue.invalid-field-value',\n  'unknown-relation-target': 'cms.issue.unknown-relation-target',\n  'unpublished-relation-target': 'cms.issue.unpublished-relation-target',\n  'cardinality-violation': 'cms.issue.cardinality-violation',\n  'unknown-asset': 'cms.issue.unknown-asset',\n  'duplicate-document': 'cms.issue.duplicate-document',\n  'unknown-locale': 'cms.issue.unknown-locale',\n  'missing-localized-value': 'cms.issue.missing-localized-value',\n  'route-conflict': 'cms.issue.route-conflict',\n  'redirect-loop': 'cms.issue.redirect-loop',\n  'unknown-route-target': 'cms.issue.unknown-route-target',\n  'hierarchy-cycle': 'cms.issue.hierarchy-cycle',\n  'document-nesting-depth': 'cms.issue.document-nesting-depth',\n  'singleton-document-drift': 'cms.issue.singleton-document-drift',\n  'duplicate-alias': 'cms.issue.duplicate-alias',\n  'unknown-alias': 'cms.issue.unknown-alias',\n  'unfilled-slot': 'cms.issue.unfilled-slot',\n  'custom-validation': 'cms.issue.custom-validation',\n  'hidden-predicate-error': 'cms.issue.hidden-predicate-error',\n  'unaddressable-url': 'cms.issue.unaddressable-url',\n  'unknown-version': 'cms.issue.unknown-version',\n}\n\n/**\n * EC-507 rider — the few codes whose TITLE overstates at `warning` severity.\n *\n * `invalid-field-value` reads \"Invalid value\", which is right when the value is\n * rejected (wrong type, not among its options) and wrong when it is not: EC-472\n * deliberately STORES `0202-09-18` as a legal ISO date and merely flags the year as\n * probably unintended. A title calling that invalid contradicts the value the editor\n * can plainly see was accepted, on all three surfaces at once.\n *\n * Keyed on SEVERITY rather than on the implausible-year case specifically, because\n * the overstatement belongs to the severity: any future warning under this code has\n * the same property (the value was kept), and the fix then needs no new entry. A\n * sparse `Partial` on purpose — a code with no entry keeps one title for both\n * severities, which is the correct default and keeps\n * {@link CMS_ISSUE_LABEL_KEYS} the single exhaustive map.\n */\nconst CMS_ISSUE_WARNING_LABEL_KEYS: Partial<Record<CmsIssueCode, string>> = {\n  'invalid-field-value': 'cms.issue.invalid-field-value.warning',\n}\n\n/**\n * EC-494: the badge titles live in the EC-241 catalog (`operations.errorLabel.<code>`),\n * exactly as EC-443 moved the CMS issue titles. **Measured before changing it:** this\n * map was a hard-coded English `Record`, so once the EC-494 bodies localized the banner\n * rendered a German sentence under an English badge — the inverse of the bug this\n * ticket exists for, and not what the ticket said was there. Still the exhaustive\n * `Record` over the Zod enum, so a new code fails typecheck until it has a key.\n */\nconst OPERATION_ERROR_LABEL_KEYS: Record<OperationErrorCode, string> = {\n  validation: 'operations.errorLabel.validation',\n  'not-found': 'operations.errorLabel.not-found',\n  conflict: 'operations.errorLabel.conflict',\n  'backend-unavailable': 'operations.errorLabel.backend-unavailable',\n  unauthorized: 'operations.errorLabel.unauthorized',\n  unknown: 'operations.errorLabel.unknown',\n}\n\n/**\n * Plain-language title for a CMS validation issue code — localized against the\n * active studio-UI locale (EC-443). A runtime-unknown code (impossible typewise;\n * a cast could smuggle one) degrades to its humanized form, never the raw enum.\n *\n * `severity` is optional and additive (EC-507): pass the issue's own severity and a\n * code with a softer warning title (see {@link CMS_ISSUE_WARNING_LABEL_KEYS}) uses\n * it; omit it, or pass `'error'`, and nothing changes. Every render site passes it —\n * the parameter is optional so that a pure/unit caller naming only a code still\n * compiles, not because a surface may skip it.\n */\nexport function cmsIssueLabel(code: CmsIssueCode, severity?: CmsIssueSeverity): string {\n  const key =\n    (severity === 'warning' ? CMS_ISSUE_WARNING_LABEL_KEYS[code] : undefined) ??\n    (CMS_ISSUE_LABEL_KEYS[code] as string | undefined)\n  return key !== undefined ? translate(key) : humanizeName(code)\n}\n\n/**\n * The localized text of a {@link CustomizationIssue} (EC-478) — the ONE place the\n * studio turns a config-level finding into rendered prose.\n *\n * The producing layer (`studio-core/customization.ts`, `app-views/default-modules.tsx`,\n * `builder/reuse.ts`) cannot own the wording: the EC-236 seam lives in `packages/core`,\n * a leaf of the DAG that may not import this catalog. So it emits a\n * `CustomizationMessageRef` — a stable key plus its interpolation values, all of\n * which are IDENTIFIERS (entry ids, extension points, component ids) and therefore the\n * same in every language — and this resolves it against the active UI locale. Same\n * shape as {@link cmsIssueLabel}, one layer down: the engine speaks codes and keys, the\n * studio speaks the editor's language.\n *\n * `messageRef.reason` fills the `{reason}` slot of `invalid-override`, whose detail is\n * itself prose (a `validate` rejection) and so carries its own key. A ref-less issue —\n * a third-party producer of this published type — degrades to its English\n * `issue.message`, which is honest: a visible English sentence beats a missing key.\n */\nexport function customizationIssueMessage(issue: CustomizationIssue): string {\n  const ref = issue.messageRef\n  if (!ref) return issue.message\n  const vars = { ...ref.vars }\n  if (ref.reason) vars.reason = translate(ref.reason.key, ref.reason.vars)\n  return translate(ref.key, vars)\n}\n\n/**\n * The localized BODY of a {@link CmsValidationIssue} (EC-487) — the ONE place the\n * studio turns a CMS validation finding into rendered prose, exactly as\n * {@link customizationIssueMessage} does one layer up.\n *\n * EC-443 localized the issue TITLES ({@link cmsIssueLabel}); the bodies stayed English\n * because their producers live in `packages/core`, below this catalog in the DAG. So\n * the producer emits a `CmsMessageRef` — a stable key plus its interpolation values,\n * all of which are IDENTIFIERS (field/collection/route ids, locales, patterns, counts)\n * and therefore the same in every language — and this resolves it against the active\n * UI locale.\n *\n * `messageRef.details` fill placeholders whose text is itself prose, keyed by\n * placeholder name. A placeholder with no entry keeps whatever the producer put in\n * `vars` — the honest outcome for prose the engine did not author (a config-as-code\n * `validate` message, a composition finding), which then stays in its original\n * language rather than vanishing. A ref-less issue — a third-party producer of this\n * published type — degrades to its English `issue.message`: a visible English sentence\n * beats a missing key.\n */\nexport function cmsValidationIssueMessage(issue: CmsValidationIssue): string {\n  return resolveMessageRef(issue.messageRef, issue.message)\n}\n\n/**\n * EC-494 — the ONE resolver every carried message ref goes through.\n *\n * Four published types now carry the same `{ key, vars?, details? }` reference —\n * `CmsValidationIssue` (EC-487), `CustomizationIssue` (EC-478, via its own `reason`\n * slot), and now `OperationIssue`/`OperationError` and the clipboard + content-query\n * errors. They are separate declarations only because the EC-265 DAG forbids the\n * lower subpaths from importing `cms-core`; the RESOLUTION is one rule, so it lives\n * in one function.\n *\n * `fallback` is the producer's prebuilt English, rendered whenever there is no ref —\n * a third-party producer, a Zod diagnostic, a persistence-layer message, a\n * config-authored `validate` string. A visible English sentence beats a missing key\n * (EC-443).\n */\nfunction resolveMessageRef(\n  ref:\n    | {\n        readonly key: string\n        readonly vars?: Readonly<Record<string, string | number>>\n        readonly details?: Readonly<\n          Record<string, { readonly key: string; readonly vars?: Readonly<Record<string, string | number>> }>\n        >\n      }\n    | undefined,\n  fallback: string,\n): string {\n  if (!ref) return fallback\n  const vars: Record<string, string | number> = { ...ref.vars }\n  for (const [placeholder, nested] of Object.entries(ref.details ?? {})) {\n    vars[placeholder] = translate(nested.key, nested.vars)\n  }\n  return translate(ref.key, vars)\n}\n\n/**\n * The localized text of ONE {@link OperationIssue} line in the error banner (EC-494).\n *\n * These issues cross a process boundary: `operations/documents.ts` rebuilds a\n * `CmsValidationIssue` as an `OperationIssue` **server-side, with no locale**, so the\n * producer cannot translate and the catalog key rides on the wire instead. A ref-less\n * issue — a Zod input diagnostic, a persistence-layer message, a third-party producer\n * of this published type — keeps its English.\n */\nexport function operationIssueMessage(issue: OperationIssue): string {\n  return resolveMessageRef(issue.messageRef, issue.message)\n}\n\n/**\n * The localized ENVELOPE sentence of an {@link OperationError} (EC-494) — the line\n * beside the localized badge in `OperationErrorBanner`. Localizing only the issue\n * lines would have left exactly one English sentence under a German badge.\n */\nexport function operationErrorMessage(error: OperationError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * The localized text of a clipboard fragment failure (EC-494) — parse (`corrupt-json`,\n * `foreign-format`, `unsupported-version`, `invalid-payload`) or build\n * (`node-not-found`, `fixture-not-found`), rendered by the builder's paste notice.\n */\nexport function clipboardErrorMessage(error: FragmentParseError | BuildFragmentError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * The localized text of a {@link ContentQueryError} (EC-494) — the filter builder's\n * per-clause line and the canvas listing notice, both of which render errors built by\n * `core/content`'s `validateWhere`/`validateSort`/`validateLimit`.\n */\nexport function contentQueryErrorMessage(error: ContentQueryError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * Plain-language title for an operation failure code — localized against the active\n * studio-UI locale. A runtime-unknown code (impossible typewise; a cast could smuggle\n * one) degrades to the generic title, never the raw enum.\n */\nexport function operationErrorLabel(code: OperationErrorCode): string {\n  const key = OPERATION_ERROR_LABEL_KEYS[code] as string | undefined\n  return translate(key ?? OPERATION_ERROR_LABEL_KEYS.unknown)\n}\n\n/** The last dot-segment of a component id (`site.Hero` → `Hero`; `Heading` → `Heading`). */\nexport function componentLeafId(componentId: string): string {\n  const dot = componentId.lastIndexOf('.')\n  return dot === -1 ? componentId : componentId.slice(dot + 1)\n}\n\n/**\n * The human display name of a component TYPE for editor-facing surfaces: the\n * manifest's authored `title` (EC-407: resolved through {@link resolveLabel}, so a\n * `{ en, de }` localized title renders in the active studio-UI locale) when present,\n * else the humanized leaf of its id (`Heading` → `Heading`,\n * `site.MarketingHero` → `Marketing hero`). EC-591: the engine strips no id\n * prefix anywhere else — a label reads the manifest title.\n *\n * `locale` is optional: omit it (the render-site default) to resolve against the\n * active studio-UI locale non-reactively; pass it explicitly for pure/unit callers.\n */\nexport function componentDisplayName(\n  componentId: string,\n  manifest?: ComponentManifest | undefined,\n  locale?: string,\n): string {\n  const resolved =\n    locale === undefined ? localizedLabel(manifest?.title) : (resolveLabel(manifest?.title, locale) ?? '')\n  return resolved || humanizeName(componentLeafId(componentId))\n}\n"]}
+{"version":3,"file":"labels.js","sourceRoot":"","sources":["../../../src/lib/persona/labels.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAMvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAEvC;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAiC;IACzD,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,oBAAoB,EAAE,8BAA8B;IACpD,2BAA2B,EAAE,qCAAqC;IAClE,sBAAsB,EAAE,gCAAgC;IACxD,qBAAqB,EAAE,+BAA+B;IACtD,wBAAwB,EAAE,kCAAkC;IAC5D,qBAAqB,EAAE,+BAA+B;IACtD,yBAAyB,EAAE,mCAAmC;IAC9D,6BAA6B,EAAE,uCAAuC;IACtE,uBAAuB,EAAE,iCAAiC;IAC1D,eAAe,EAAE,yBAAyB;IAC1C,oBAAoB,EAAE,8BAA8B;IACpD,gBAAgB,EAAE,0BAA0B;IAC5C,yBAAyB,EAAE,mCAAmC;IAC9D,gBAAgB,EAAE,0BAA0B;IAC5C,eAAe,EAAE,yBAAyB;IAC1C,kBAAkB,EAAE,4BAA4B;IAChD,sBAAsB,EAAE,gCAAgC;IACxD,iBAAiB,EAAE,2BAA2B;IAC9C,wBAAwB,EAAE,kCAAkC;IAC5D,0BAA0B,EAAE,oCAAoC;IAChE,iBAAiB,EAAE,2BAA2B;IAC9C,eAAe,EAAE,yBAAyB;IAC1C,eAAe,EAAE,yBAAyB;IAC1C,mBAAmB,EAAE,6BAA6B;IAClD,wBAAwB,EAAE,kCAAkC;IAC5D,mBAAmB,EAAE,6BAA6B;IAClD,iBAAiB,EAAE,2BAA2B;IAC9C,yBAAyB,EAAE,mCAAmC;CAC/D,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,4BAA4B,GAA0C;IAC1E,qBAAqB,EAAE,uCAAuC;CAC/D,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAuC;IACrE,UAAU,EAAE,kCAAkC;IAC9C,WAAW,EAAE,iCAAiC;IAC9C,QAAQ,EAAE,gCAAgC;IAC1C,qBAAqB,EAAE,2CAA2C;IAClE,YAAY,EAAE,oCAAoC;IAClD,OAAO,EAAE,+BAA+B;CACzC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAkB,EAAE,QAA2B;IAC3E,MAAM,GAAG,GACP,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,oBAAoB,CAAC,IAAI,CAAwB,CAAA;IACpD,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAA;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,OAAO,CAAA;IAC9B,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,GAAG,CAAC,MAAM;QAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAyB;IACjE,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,iBAAiB,CACxB,GAQa,EACb,QAAgB;IAEhB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAA;IACzB,MAAM,IAAI,GAAoC,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC7D,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAqB;IACzD,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA8C;IAClF,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,OAAO,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAwB;IAC1D,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAuB,CAAA;IAClE,OAAO,SAAS,CAAC,GAAG,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAA;AAC7D,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,QAAwC,EACxC,MAAe;IAEf,MAAM,QAAQ,GACZ,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IACxG,OAAO,QAAQ,IAAI,YAAY,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAA;AAC/D,CAAC","sourcesContent":["import type { CmsIssueCode, CmsIssueSeverity, CmsValidationIssue } from '@elytracms/core/cms-core'\nimport { resolveLabel } from '@elytracms/core/cms-core'\nimport type { OperationError, OperationErrorCode, OperationIssue } from '@elytracms/core/operations'\nimport type { BuildFragmentError, FragmentParseError } from '@elytracms/core/clipboard'\nimport type { ContentQueryError } from '@elytracms/core/content'\nimport type { CustomizationIssue } from '@elytracms/core/studio-core'\nimport type { ComponentManifest } from '@elytracms/core/component-registry'\nimport { localizedLabel, translate } from '@elytracms/studio/lib/i18n'\nimport { humanizeName } from '../utils'\n\n/**\n * Persona-aware labels (EC-192 item 2, Milestone B promise).\n *\n * A non-technical editor must never see a manifest/binding/path-token/validation\n * identifier on — or one click off — the editor path. The engine speaks in stable\n * machine codes (`cmsIssueCodeSchema`, `operationErrorCodeSchema`) and machine ids\n * (`Heading`, `r-blog-slug-en`); this module is the single translation layer the\n * editor-facing surfaces route through.\n *\n * The maps are exhaustive `Record<…Code, string>` over the Zod enums, so adding a\n * code in `@elytracms/core/cms-core` or `@elytracms/core/operations`\n * fails typecheck here until it is given an editor-facing label — the persona\n * boundary cannot silently regress. A table is only worth that guard while something\n * renders it: EC-509 deleted two that nothing did (see below). Engineers keep the raw\n * code: every surface that\n * shows a label also carries the code in a `title=`/`data-*` attribute (inspectable\n * via hover/devtools, never rendered as visible copy).\n */\n\n/**\n * EC-509 — two label tables were DELETED here rather than localized, because measuring\n * first showed nothing rendered them.\n *\n * `GRAPH_ISSUE_LABELS`/`graphIssueLabel` (16 entries, project-graph `IssueCode`) and\n * `CONDITION_OPERATOR_LABELS`/`conditionOperatorLabel` (8, `ConditionOperator`) had\n * **zero call sites** outside this file and its own test — measured by grep over\n * `packages/` + `apps/`, with `cmsIssueLabel` (4 sites) and `operationErrorLabel` (1)\n * as the known-positive control that the search finds a render site when one exists.\n *\n * The graph table was unreachable structurally, not just unused: the ONE live path from\n * graph validation into the studio was `cms-composition-validators.ts` (since EC-582\n * `@elytracms/core/validation`'s `compositionValidators`), which maps a\n * graph issue to `CompositionIssue` — a type with `message`/`severity`/`nodePath` and\n * **no `code` field at all** (`cms-core/validate-document.ts:809`). The code an\n * exhaustiveness guard exists to force a label for cannot reach an editor surface.\n * `ConditionOperator` is live in the runtime renderer's condition gate\n * (`runtime-renderer/render.tsx:48`) but has no studio surface: v1 canvas is static\n * props, editor bindings parked, so no inspector ever shows an operator to name.\n *\n * **This overturns an EC-210 decision** (2026-06-17), which kept `graphIssueLabel` when\n * the validation panel was removed, on the rationale that it was \"the EC-192 boundary's\n * exhaustiveness guard, not panel code\". That was right then and its premise is false\n * now — the guard guards a boundary with no traffic, so it only forced editor copy for\n * strings no editor can see. Localizing them would have added 24 keys to the same\n * effect. If a surface ever renders these codes it needs labels written for it, and\n * will write them localized from the start.\n *\n * Neither symbol is referenced by either consumer repo (measured read-only) and neither\n * appears in docs.\n */\n\n/**\n * EC-443: the CMS issue titles live in the EC-241 message catalog\n * (`cms.issue.<code>`, EN source + shipped de), so the Issues pane / for-review\n * lane localize with the rest of the chrome. This map stays the exhaustive\n * `Record` over the Zod enum — a new code still fails typecheck here until it\n * gets an editor-facing catalog key (the persona boundary cannot silently\n * regress); {@link cmsIssueLabel} resolves it through `translate`.\n */\nconst CMS_ISSUE_LABEL_KEYS: Record<CmsIssueCode, string> = {\n  'duplicate-collection': 'cms.issue.duplicate-collection',\n  'duplicate-field': 'cms.issue.duplicate-field',\n  'unknown-collection': 'cms.issue.unknown-collection',\n  'invalid-collection-config': 'cms.issue.invalid-collection-config',\n  'invalid-field-config': 'cms.issue.invalid-field-config',\n  'reserved-field-name': 'cms.issue.reserved-field-name',\n  'missing-required-field': 'cms.issue.missing-required-field',\n  'invalid-field-value': 'cms.issue.invalid-field-value',\n  'unknown-relation-target': 'cms.issue.unknown-relation-target',\n  'unpublished-relation-target': 'cms.issue.unpublished-relation-target',\n  'cardinality-violation': 'cms.issue.cardinality-violation',\n  'unknown-asset': 'cms.issue.unknown-asset',\n  'duplicate-document': 'cms.issue.duplicate-document',\n  'unknown-locale': 'cms.issue.unknown-locale',\n  'missing-localized-value': 'cms.issue.missing-localized-value',\n  'route-conflict': 'cms.issue.route-conflict',\n  'redirect-loop': 'cms.issue.redirect-loop',\n  'invalid-redirect': 'cms.issue.invalid-redirect',\n  'unknown-route-target': 'cms.issue.unknown-route-target',\n  'hierarchy-cycle': 'cms.issue.hierarchy-cycle',\n  'document-nesting-depth': 'cms.issue.document-nesting-depth',\n  'singleton-document-drift': 'cms.issue.singleton-document-drift',\n  'duplicate-alias': 'cms.issue.duplicate-alias',\n  'unknown-alias': 'cms.issue.unknown-alias',\n  'unfilled-slot': 'cms.issue.unfilled-slot',\n  'custom-validation': 'cms.issue.custom-validation',\n  'hidden-predicate-error': 'cms.issue.hidden-predicate-error',\n  'unaddressable-url': 'cms.issue.unaddressable-url',\n  'unknown-version': 'cms.issue.unknown-version',\n  'invalid-stored-document': 'cms.issue.invalid-stored-document',\n}\n\n/**\n * EC-507 rider — the few codes whose TITLE overstates at `warning` severity.\n *\n * `invalid-field-value` reads \"Invalid value\", which is right when the value is\n * rejected (wrong type, not among its options) and wrong when it is not: EC-472\n * deliberately STORES `0202-09-18` as a legal ISO date and merely flags the year as\n * probably unintended. A title calling that invalid contradicts the value the editor\n * can plainly see was accepted, on all three surfaces at once.\n *\n * Keyed on SEVERITY rather than on the implausible-year case specifically, because\n * the overstatement belongs to the severity: any future warning under this code has\n * the same property (the value was kept), and the fix then needs no new entry. A\n * sparse `Partial` on purpose — a code with no entry keeps one title for both\n * severities, which is the correct default and keeps\n * {@link CMS_ISSUE_LABEL_KEYS} the single exhaustive map.\n */\nconst CMS_ISSUE_WARNING_LABEL_KEYS: Partial<Record<CmsIssueCode, string>> = {\n  'invalid-field-value': 'cms.issue.invalid-field-value.warning',\n}\n\n/**\n * EC-494: the badge titles live in the EC-241 catalog (`operations.errorLabel.<code>`),\n * exactly as EC-443 moved the CMS issue titles. **Measured before changing it:** this\n * map was a hard-coded English `Record`, so once the EC-494 bodies localized the banner\n * rendered a German sentence under an English badge — the inverse of the bug this\n * ticket exists for, and not what the ticket said was there. Still the exhaustive\n * `Record` over the Zod enum, so a new code fails typecheck until it has a key.\n */\nconst OPERATION_ERROR_LABEL_KEYS: Record<OperationErrorCode, string> = {\n  validation: 'operations.errorLabel.validation',\n  'not-found': 'operations.errorLabel.not-found',\n  conflict: 'operations.errorLabel.conflict',\n  'backend-unavailable': 'operations.errorLabel.backend-unavailable',\n  unauthorized: 'operations.errorLabel.unauthorized',\n  unknown: 'operations.errorLabel.unknown',\n}\n\n/**\n * Plain-language title for a CMS validation issue code — localized against the\n * active studio-UI locale (EC-443). A runtime-unknown code (impossible typewise;\n * a cast could smuggle one) degrades to its humanized form, never the raw enum.\n *\n * `severity` is optional and additive (EC-507): pass the issue's own severity and a\n * code with a softer warning title (see {@link CMS_ISSUE_WARNING_LABEL_KEYS}) uses\n * it; omit it, or pass `'error'`, and nothing changes. Every render site passes it —\n * the parameter is optional so that a pure/unit caller naming only a code still\n * compiles, not because a surface may skip it.\n */\nexport function cmsIssueLabel(code: CmsIssueCode, severity?: CmsIssueSeverity): string {\n  const key =\n    (severity === 'warning' ? CMS_ISSUE_WARNING_LABEL_KEYS[code] : undefined) ??\n    (CMS_ISSUE_LABEL_KEYS[code] as string | undefined)\n  return key !== undefined ? translate(key) : humanizeName(code)\n}\n\n/**\n * The localized text of a {@link CustomizationIssue} (EC-478) — the ONE place the\n * studio turns a config-level finding into rendered prose.\n *\n * The producing layer (`studio-core/customization.ts`, `app-views/default-modules.tsx`,\n * `builder/reuse.ts`) cannot own the wording: the EC-236 seam lives in `packages/core`,\n * a leaf of the DAG that may not import this catalog. So it emits a\n * `CustomizationMessageRef` — a stable key plus its interpolation values, all of\n * which are IDENTIFIERS (entry ids, extension points, component ids) and therefore the\n * same in every language — and this resolves it against the active UI locale. Same\n * shape as {@link cmsIssueLabel}, one layer down: the engine speaks codes and keys, the\n * studio speaks the editor's language.\n *\n * `messageRef.reason` fills the `{reason}` slot of `invalid-override`, whose detail is\n * itself prose (a `validate` rejection) and so carries its own key. A ref-less issue —\n * a third-party producer of this published type — degrades to its English\n * `issue.message`, which is honest: a visible English sentence beats a missing key.\n */\nexport function customizationIssueMessage(issue: CustomizationIssue): string {\n  const ref = issue.messageRef\n  if (!ref) return issue.message\n  const vars = { ...ref.vars }\n  if (ref.reason) vars.reason = translate(ref.reason.key, ref.reason.vars)\n  return translate(ref.key, vars)\n}\n\n/**\n * The localized BODY of a {@link CmsValidationIssue} (EC-487) — the ONE place the\n * studio turns a CMS validation finding into rendered prose, exactly as\n * {@link customizationIssueMessage} does one layer up.\n *\n * EC-443 localized the issue TITLES ({@link cmsIssueLabel}); the bodies stayed English\n * because their producers live in `packages/core`, below this catalog in the DAG. So\n * the producer emits a `CmsMessageRef` — a stable key plus its interpolation values,\n * all of which are IDENTIFIERS (field/collection/route ids, locales, patterns, counts)\n * and therefore the same in every language — and this resolves it against the active\n * UI locale.\n *\n * `messageRef.details` fill placeholders whose text is itself prose, keyed by\n * placeholder name. A placeholder with no entry keeps whatever the producer put in\n * `vars` — the honest outcome for prose the engine did not author (a config-as-code\n * `validate` message, a composition finding), which then stays in its original\n * language rather than vanishing. A ref-less issue — a third-party producer of this\n * published type — degrades to its English `issue.message`: a visible English sentence\n * beats a missing key.\n */\nexport function cmsValidationIssueMessage(issue: CmsValidationIssue): string {\n  return resolveMessageRef(issue.messageRef, issue.message)\n}\n\n/**\n * EC-494 — the ONE resolver every carried message ref goes through.\n *\n * Four published types now carry the same `{ key, vars?, details? }` reference —\n * `CmsValidationIssue` (EC-487), `CustomizationIssue` (EC-478, via its own `reason`\n * slot), and now `OperationIssue`/`OperationError` and the clipboard + content-query\n * errors. They are separate declarations only because the EC-265 DAG forbids the\n * lower subpaths from importing `cms-core`; the RESOLUTION is one rule, so it lives\n * in one function.\n *\n * `fallback` is the producer's prebuilt English, rendered whenever there is no ref —\n * a third-party producer, a Zod diagnostic, a persistence-layer message, a\n * config-authored `validate` string. A visible English sentence beats a missing key\n * (EC-443).\n */\nfunction resolveMessageRef(\n  ref:\n    | {\n        readonly key: string\n        readonly vars?: Readonly<Record<string, string | number>>\n        readonly details?: Readonly<\n          Record<string, { readonly key: string; readonly vars?: Readonly<Record<string, string | number>> }>\n        >\n      }\n    | undefined,\n  fallback: string,\n): string {\n  if (!ref) return fallback\n  const vars: Record<string, string | number> = { ...ref.vars }\n  for (const [placeholder, nested] of Object.entries(ref.details ?? {})) {\n    vars[placeholder] = translate(nested.key, nested.vars)\n  }\n  return translate(ref.key, vars)\n}\n\n/**\n * The localized text of ONE {@link OperationIssue} line in the error banner (EC-494).\n *\n * These issues cross a process boundary: `operations/documents.ts` rebuilds a\n * `CmsValidationIssue` as an `OperationIssue` **server-side, with no locale**, so the\n * producer cannot translate and the catalog key rides on the wire instead. A ref-less\n * issue — a Zod input diagnostic, a persistence-layer message, a third-party producer\n * of this published type — keeps its English.\n */\nexport function operationIssueMessage(issue: OperationIssue): string {\n  return resolveMessageRef(issue.messageRef, issue.message)\n}\n\n/**\n * The localized ENVELOPE sentence of an {@link OperationError} (EC-494) — the line\n * beside the localized badge in `OperationErrorBanner`. Localizing only the issue\n * lines would have left exactly one English sentence under a German badge.\n */\nexport function operationErrorMessage(error: OperationError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * The localized text of a clipboard fragment failure (EC-494) — parse (`corrupt-json`,\n * `foreign-format`, `unsupported-version`, `invalid-payload`) or build\n * (`node-not-found`, `fixture-not-found`), rendered by the builder's paste notice.\n */\nexport function clipboardErrorMessage(error: FragmentParseError | BuildFragmentError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * The localized text of a {@link ContentQueryError} (EC-494) — the filter builder's\n * per-clause line and the canvas listing notice, both of which render errors built by\n * `core/content`'s `validateWhere`/`validateSort`/`validateLimit`.\n */\nexport function contentQueryErrorMessage(error: ContentQueryError): string {\n  return resolveMessageRef(error.messageRef, error.message)\n}\n\n/**\n * Plain-language title for an operation failure code — localized against the active\n * studio-UI locale. A runtime-unknown code (impossible typewise; a cast could smuggle\n * one) degrades to the generic title, never the raw enum.\n */\nexport function operationErrorLabel(code: OperationErrorCode): string {\n  const key = OPERATION_ERROR_LABEL_KEYS[code] as string | undefined\n  return translate(key ?? OPERATION_ERROR_LABEL_KEYS.unknown)\n}\n\n/** The last dot-segment of a component id (`site.Hero` → `Hero`; `Heading` → `Heading`). */\nexport function componentLeafId(componentId: string): string {\n  const dot = componentId.lastIndexOf('.')\n  return dot === -1 ? componentId : componentId.slice(dot + 1)\n}\n\n/**\n * The human display name of a component TYPE for editor-facing surfaces: the\n * manifest's authored `title` (EC-407: resolved through {@link resolveLabel}, so a\n * `{ en, de }` localized title renders in the active studio-UI locale) when present,\n * else the humanized leaf of its id (`Heading` → `Heading`,\n * `site.MarketingHero` → `Marketing hero`). EC-591: the engine strips no id\n * prefix anywhere else — a label reads the manifest title.\n *\n * `locale` is optional: omit it (the render-site default) to resolve against the\n * active studio-UI locale non-reactively; pass it explicitly for pure/unit callers.\n */\nexport function componentDisplayName(\n  componentId: string,\n  manifest?: ComponentManifest | undefined,\n  locale?: string,\n): string {\n  const resolved =\n    locale === undefined ? localizedLabel(manifest?.title) : (resolveLabel(manifest?.title, locale) ?? '')\n  return resolved || humanizeName(componentLeafId(componentId))\n}\n"]}

package/dist/lib/query/operations-query.d.ts

@@ -23,7 +23,7 @@ import type { OperationsClient } from '@elytracms/studio/lib/operations';
  */
 /**
  * Trailing-debounce window (ms) for event-driven invalidation: a burst of
- * commands — e.g. one `documents.upsert` per keystroke from autosave, or one
+ * commands — e.g. a run of `documents.patch` commits from one editor, or one
  * event per row in a bulk action — coalesces into a single refetch once the
  * writes settle. (The shared replacement for the per-store `*_RELOAD_DEBOUNCE_MS`.)
  */

package/dist/lib/query/operations-query.js

@@ -24,7 +24,7 @@ import { getStudioOperations } from '@elytracms/studio/lib/operations';
  */
 /**
  * Trailing-debounce window (ms) for event-driven invalidation: a burst of
- * commands — e.g. one `documents.upsert` per keystroke from autosave, or one
+ * commands — e.g. a run of `documents.patch` commits from one editor, or one
  * event per row in a bulk action — coalesces into a single refetch once the
  * writes settle. (The shared replacement for the per-store `*_RELOAD_DEBOUNCE_MS`.)
  */

package/dist/lib/query/operations-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"operations-query.js","sourceRoot":"","sources":["../../../src/lib/query/operations-query.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEjE,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,cAAc,GACf,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAGtE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAA;AAEnD,sFAAsF;AACtF,SAAS,uBAAuB;IAC9B,OAAO,IAAI,WAAW,CAAC;QACrB,cAAc,EAAE;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,KAAK;gBAChB,oBAAoB,EAAE,KAAK;gBAC3B,KAAK,EAAE,KAAK;aACb;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAE,QAAQ,EAA2B;IACvE,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAA;IAClD,OAAO,KAAC,mBAAmB,IAAC,MAAM,EAAE,MAAM,YAAG,QAAQ,GAAuB,CAAA;AAC9E,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAI,OAAoC;IACvE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAClE,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IAEpC,MAAM,MAAM,GAAG,QAAQ,CAAI;QACzB,QAAQ;QACR,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAA;YAClD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO;KACR,CAAC,CAAA;IAEF,iFAAiF;IACjF,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,KAAK,CAAC,cAAc,CAAa,CAAC,CAAA;QACxE,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAM;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAA;QAC3C,IAAI,KAAgD,CAAA;QACpD,IAAI,WAAqC,CAAA;QACzC,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,MAAM,OAAO,GAAG,CAAC,KAAqB,EAAW,EAAE,CACjD,KAAK,CAAC,IAAI,KAAK,SAAS;YACxB,KAAK,CAAC,MAAM,KAAK,WAAW;YAC5B,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/D,KAAK,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAM;YACpB,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,OAAM;gBAC3B,oEAAoE;gBACpE,yEAAyE;gBACzE,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAC9B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,KAAK,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;gBACvD,CAAC,EAAE,gCAAgC,CAAC,CAAA;YACtC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,EAAE;YACV,QAAQ,GAAG,IAAI,CAAA;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC9B,WAAW,EAAE,EAAE,CAAA;QACjB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;IAE1C,OAAO,MAAM,CAAA;AACf,CAAC;AAwBD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,WAAW,CACvB,CAAK,QAAkB,EAAE,OAAmC,EAAQ,EAAE;QACpE,WAAW,CAAC,YAAY,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,QAAkB,EAAiB,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAClF,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAA+D;IAI5F,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACvE,YAAY,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KAC9F,CAAA;AACH,CAAC","sourcesContent":["import { useCallback, useEffect, useMemo, useState } from 'react'\nimport type { ReactNode } from 'react'\nimport {\n  QueryClient,\n  QueryClientProvider,\n  useQuery,\n  useQueryClient,\n} from '@tanstack/react-query'\nimport type { QueryKey, UseQueryResult } from '@tanstack/react-query'\nimport { getStudioOperations } from '@elytracms/studio/lib/operations'\nimport type { OperationEvent, OperationsClient } from '@elytracms/studio/lib/operations'\n\n/**\n * EC-308 / AD-17 — the ONE studio client read seam.\n *\n * Every studio **server read** goes through {@link useOperationQuery} over the\n * shared operations client, cached by TanStack Query; invalidation rides the\n * operations event bus into the same cache. This replaces the bespoke per-store\n * `useState` + epoch-guard + debounce + reload machinery that each store used to\n * hand-roll (the patchwork AD-17 calls out). See\n * [`docs/client-data-flow.md`](../../../../../docs/client-data-flow.md) and\n * [`docs/principles.md`](../../../../../docs/principles.md) §12.\n *\n * It is also the **Phase-2 prep** (EC-309): reactivity/multiplayer is added by\n * swapping pull → push *behind this hook* (an adapter `subscribe` capability\n * driving `queryClient.setQueryData`), never at the call sites — so call sites\n * never change when push lands.\n *\n * Deliberately NOT here: the optimistic editing session (the draft being typed,\n * live validation, the table working view-state in `cms-store`). That is client\n * state, not server state, and stays local (principle 12).\n */\n\n/**\n * Trailing-debounce window (ms) for event-driven invalidation: a burst of\n * commands — e.g. one `documents.upsert` per keystroke from autosave, or one\n * event per row in a bulk action — coalesces into a single refetch once the\n * writes settle. (The shared replacement for the per-store `*_RELOAD_DEBOUNCE_MS`.)\n */\nexport const OPERATION_INVALIDATE_DEBOUNCE_MS = 300\n\n/** Studio-tuned cache defaults: invalidation (not polling/focus) drives freshness. */\nfunction createStudioQueryClient(): QueryClient {\n  return new QueryClient({\n    defaultOptions: {\n      queries: {\n        staleTime: 5_000,\n        refetchOnWindowFocus: false,\n        retry: false,\n      },\n    },\n  })\n}\n\n/**\n * Mounts the single studio `QueryClient` (one per studio lifetime, surviving\n * project switches). Mounted package-owned in `StudioProvider`, above every\n * per-project provider, so every studio hook can reach the cache.\n */\nexport function StudioQueryProvider({ children }: { children: ReactNode }): ReactNode {\n  const [client] = useState(createStudioQueryClient)\n  return <QueryClientProvider client={client}>{children}</QueryClientProvider>\n}\n\nexport interface UseOperationQueryOptions<T> {\n  /** Stable query key; the first element is the domain tag used for grouping. */\n  queryKey: QueryKey\n  /** Loads the data from the shared operations client. */\n  loader: (operations: OperationsClient) => Promise<T>\n  /**\n   * Which succeeded commands invalidate this query — a list of operation names\n   * (`'documents.publish'`) and/or domains (`'documents'`). A succeeded command\n   * matches when its `operation` OR `domain` is in the list. Keep it a stable\n   * (module-level) array. Omit for a query that only loads once / refetches\n   * manually.\n   */\n  invalidateOn?: readonly string[]\n  /** Skip the query (e.g. fixture/playground sessions with no backend). */\n  enabled?: boolean\n}\n\n/**\n * One operations-backed, cached, self-invalidating query. Thin wrapper over\n * `useQuery` whose `queryFn` resolves the shared operations client and runs the\n * loader, plus one shared invalidation subscriber (the only place that touches\n * the operations event bus for reads).\n */\nexport function useOperationQuery<T>(options: UseOperationQueryOptions<T>): UseQueryResult<T> {\n  const { queryKey, loader, invalidateOn, enabled = true } = options\n  const queryClient = useQueryClient()\n\n  const result = useQuery<T>({\n    queryKey,\n    queryFn: async () => {\n      const { operations } = await getStudioOperations()\n      return loader(operations)\n    },\n    enabled,\n  })\n\n  // Stable serializations so an inline `queryKey`/`invalidateOn` doesn't churn the\n  // subscription every render (re-subscribe only when their CONTENTS change).\n  const keyJson = JSON.stringify(queryKey)\n  const invalidateJson = JSON.stringify(invalidateOn ?? [])\n\n  useEffect(() => {\n    const triggers = new Set<string>(JSON.parse(invalidateJson) as string[])\n    if (triggers.size === 0) return\n    const key = JSON.parse(keyJson) as QueryKey\n    let timer: ReturnType<typeof setTimeout> | undefined\n    let unsubscribe: (() => void) | undefined\n    let disposed = false\n    const matches = (event: OperationEvent): boolean =>\n      event.kind === 'command' &&\n      event.status === 'succeeded' &&\n      (triggers.has(event.operation) || triggers.has(event.domain))\n    void getStudioOperations().then((studio) => {\n      if (disposed) return\n      unsubscribe = studio.operations.events.subscribe((event) => {\n        if (!matches(event)) return\n        // Trailing-debounce: a burst (per-keystroke autosave, bulk actions)\n        // collapses into one invalidation; the active query then refetches once.\n        if (timer) clearTimeout(timer)\n        timer = setTimeout(() => {\n          void queryClient.invalidateQueries({ queryKey: key })\n        }, OPERATION_INVALIDATE_DEBOUNCE_MS)\n      })\n    })\n    return () => {\n      disposed = true\n      if (timer) clearTimeout(timer)\n      unsubscribe?.()\n    }\n  }, [keyJson, invalidateJson, queryClient])\n\n  return result\n}\n\n/**\n * The write-side companion to {@link useOperationQuery}: an imperative handle on\n * the studio cache for a store that OWNS its writes. Lets a store apply an\n * EC-301-style optimistic patch (drop/replace one record) instead of re-listing\n * the whole collection on every edit — keeping `@tanstack/react-query` out of the\n * call sites so the seam stays the only place that knows the cache exists.\n */\nexport interface OperationCache {\n  /**\n   * Patch a cached query in place — no refetch. The EC-301 pattern: a focal-point\n   * or alt edit patches the one changed record; it does NOT trigger a full\n   * `*.list` round-trip. No-op if nothing is cached under `queryKey` yet.\n   */\n  patch<T>(queryKey: QueryKey, updater: (prev: T | undefined) => T): void\n  /**\n   * Invalidate a cached query, refetching it if it is currently active. Returns a\n   * promise that settles when the refetch does, so a caller that must sequence a\n   * read after a local write (e.g. flush-then-reload) can await it.\n   */\n  invalidate(queryKey: QueryKey): Promise<void>\n}\n\nexport function useOperationCache(): OperationCache {\n  const queryClient = useQueryClient()\n  const patch = useCallback(\n    <T,>(queryKey: QueryKey, updater: (prev: T | undefined) => T): void => {\n      queryClient.setQueryData<T>(queryKey, updater)\n    },\n    [queryClient],\n  )\n  const invalidate = useCallback(\n    (queryKey: QueryKey): Promise<void> => queryClient.invalidateQueries({ queryKey }),\n    [queryClient],\n  )\n  return useMemo(() => ({ patch, invalidate }), [patch, invalidate])\n}\n\n/**\n * Derive a list store's public `{ status, errorMessage }` from its operation query —\n * the identical mapping the assets/users/redirects rail stores (EC-319) each\n * hand-rolled. `errorMessage` is set only on an error; a store spreads it\n * conditionally onto its public shape.\n */\nexport function listStoreState(query: { isPending: boolean; isError: boolean; error: unknown }): {\n  status: 'loading' | 'ready' | 'error'\n  errorMessage: string | undefined\n} {\n  return {\n    status: query.isPending ? 'loading' : query.isError ? 'error' : 'ready',\n    errorMessage: query.isError && query.error instanceof Error ? query.error.message : undefined,\n  }\n}\n"]}
+{"version":3,"file":"operations-query.js","sourceRoot":"","sources":["../../../src/lib/query/operations-query.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AAEjE,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,cAAc,GACf,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AAGtE;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,GAAG,CAAA;AAEnD,sFAAsF;AACtF,SAAS,uBAAuB;IAC9B,OAAO,IAAI,WAAW,CAAC;QACrB,cAAc,EAAE;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,KAAK;gBAChB,oBAAoB,EAAE,KAAK;gBAC3B,KAAK,EAAE,KAAK;aACb;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAE,QAAQ,EAA2B;IACvE,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAA;IAClD,OAAO,KAAC,mBAAmB,IAAC,MAAM,EAAE,MAAM,YAAG,QAAQ,GAAuB,CAAA;AAC9E,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAI,OAAoC;IACvE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,OAAO,CAAA;IAClE,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IAEpC,MAAM,MAAM,GAAG,QAAQ,CAAI;QACzB,QAAQ;QACR,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAA;YAClD,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;QAC3B,CAAC;QACD,OAAO;KACR,CAAC,CAAA;IAEF,iFAAiF;IACjF,4EAA4E;IAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAA;IAEzD,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,IAAI,CAAC,KAAK,CAAC,cAAc,CAAa,CAAC,CAAA;QACxE,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,OAAM;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAA;QAC3C,IAAI,KAAgD,CAAA;QACpD,IAAI,WAAqC,CAAA;QACzC,IAAI,QAAQ,GAAG,KAAK,CAAA;QACpB,MAAM,OAAO,GAAG,CAAC,KAAqB,EAAW,EAAE,CACjD,KAAK,CAAC,IAAI,KAAK,SAAS;YACxB,KAAK,CAAC,MAAM,KAAK,WAAW;YAC5B,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/D,KAAK,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACzC,IAAI,QAAQ;gBAAE,OAAM;YACpB,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;gBACzD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,OAAM;gBAC3B,oEAAoE;gBACpE,yEAAyE;gBACzE,IAAI,KAAK;oBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;gBAC9B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBACtB,KAAK,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAA;gBACvD,CAAC,EAAE,gCAAgC,CAAC,CAAA;YACtC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,EAAE;YACV,QAAQ,GAAG,IAAI,CAAA;YACf,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YAC9B,WAAW,EAAE,EAAE,CAAA;QACjB,CAAC,CAAA;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;IAE1C,OAAO,MAAM,CAAA;AACf,CAAC;AAwBD,MAAM,UAAU,iBAAiB;IAC/B,MAAM,WAAW,GAAG,cAAc,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,WAAW,CACvB,CAAK,QAAkB,EAAE,OAAmC,EAAQ,EAAE;QACpE,WAAW,CAAC,YAAY,CAAI,QAAQ,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAA;IACD,MAAM,UAAU,GAAG,WAAW,CAC5B,CAAC,QAAkB,EAAiB,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,CAAC,EAClF,CAAC,WAAW,CAAC,CACd,CAAA;IACD,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAA+D;IAI5F,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACvE,YAAY,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KAC9F,CAAA;AACH,CAAC","sourcesContent":["import { useCallback, useEffect, useMemo, useState } from 'react'\nimport type { ReactNode } from 'react'\nimport {\n  QueryClient,\n  QueryClientProvider,\n  useQuery,\n  useQueryClient,\n} from '@tanstack/react-query'\nimport type { QueryKey, UseQueryResult } from '@tanstack/react-query'\nimport { getStudioOperations } from '@elytracms/studio/lib/operations'\nimport type { OperationEvent, OperationsClient } from '@elytracms/studio/lib/operations'\n\n/**\n * EC-308 / AD-17 — the ONE studio client read seam.\n *\n * Every studio **server read** goes through {@link useOperationQuery} over the\n * shared operations client, cached by TanStack Query; invalidation rides the\n * operations event bus into the same cache. This replaces the bespoke per-store\n * `useState` + epoch-guard + debounce + reload machinery that each store used to\n * hand-roll (the patchwork AD-17 calls out). See\n * [`docs/client-data-flow.md`](../../../../../docs/client-data-flow.md) and\n * [`docs/principles.md`](../../../../../docs/principles.md) §12.\n *\n * It is also the **Phase-2 prep** (EC-309): reactivity/multiplayer is added by\n * swapping pull → push *behind this hook* (an adapter `subscribe` capability\n * driving `queryClient.setQueryData`), never at the call sites — so call sites\n * never change when push lands.\n *\n * Deliberately NOT here: the optimistic editing session (the draft being typed,\n * live validation, the table working view-state in `cms-store`). That is client\n * state, not server state, and stays local (principle 12).\n */\n\n/**\n * Trailing-debounce window (ms) for event-driven invalidation: a burst of\n * commands — e.g. a run of `documents.patch` commits from one editor, or one\n * event per row in a bulk action — coalesces into a single refetch once the\n * writes settle. (The shared replacement for the per-store `*_RELOAD_DEBOUNCE_MS`.)\n */\nexport const OPERATION_INVALIDATE_DEBOUNCE_MS = 300\n\n/** Studio-tuned cache defaults: invalidation (not polling/focus) drives freshness. */\nfunction createStudioQueryClient(): QueryClient {\n  return new QueryClient({\n    defaultOptions: {\n      queries: {\n        staleTime: 5_000,\n        refetchOnWindowFocus: false,\n        retry: false,\n      },\n    },\n  })\n}\n\n/**\n * Mounts the single studio `QueryClient` (one per studio lifetime, surviving\n * project switches). Mounted package-owned in `StudioProvider`, above every\n * per-project provider, so every studio hook can reach the cache.\n */\nexport function StudioQueryProvider({ children }: { children: ReactNode }): ReactNode {\n  const [client] = useState(createStudioQueryClient)\n  return <QueryClientProvider client={client}>{children}</QueryClientProvider>\n}\n\nexport interface UseOperationQueryOptions<T> {\n  /** Stable query key; the first element is the domain tag used for grouping. */\n  queryKey: QueryKey\n  /** Loads the data from the shared operations client. */\n  loader: (operations: OperationsClient) => Promise<T>\n  /**\n   * Which succeeded commands invalidate this query — a list of operation names\n   * (`'documents.publish'`) and/or domains (`'documents'`). A succeeded command\n   * matches when its `operation` OR `domain` is in the list. Keep it a stable\n   * (module-level) array. Omit for a query that only loads once / refetches\n   * manually.\n   */\n  invalidateOn?: readonly string[]\n  /** Skip the query (e.g. fixture/playground sessions with no backend). */\n  enabled?: boolean\n}\n\n/**\n * One operations-backed, cached, self-invalidating query. Thin wrapper over\n * `useQuery` whose `queryFn` resolves the shared operations client and runs the\n * loader, plus one shared invalidation subscriber (the only place that touches\n * the operations event bus for reads).\n */\nexport function useOperationQuery<T>(options: UseOperationQueryOptions<T>): UseQueryResult<T> {\n  const { queryKey, loader, invalidateOn, enabled = true } = options\n  const queryClient = useQueryClient()\n\n  const result = useQuery<T>({\n    queryKey,\n    queryFn: async () => {\n      const { operations } = await getStudioOperations()\n      return loader(operations)\n    },\n    enabled,\n  })\n\n  // Stable serializations so an inline `queryKey`/`invalidateOn` doesn't churn the\n  // subscription every render (re-subscribe only when their CONTENTS change).\n  const keyJson = JSON.stringify(queryKey)\n  const invalidateJson = JSON.stringify(invalidateOn ?? [])\n\n  useEffect(() => {\n    const triggers = new Set<string>(JSON.parse(invalidateJson) as string[])\n    if (triggers.size === 0) return\n    const key = JSON.parse(keyJson) as QueryKey\n    let timer: ReturnType<typeof setTimeout> | undefined\n    let unsubscribe: (() => void) | undefined\n    let disposed = false\n    const matches = (event: OperationEvent): boolean =>\n      event.kind === 'command' &&\n      event.status === 'succeeded' &&\n      (triggers.has(event.operation) || triggers.has(event.domain))\n    void getStudioOperations().then((studio) => {\n      if (disposed) return\n      unsubscribe = studio.operations.events.subscribe((event) => {\n        if (!matches(event)) return\n        // Trailing-debounce: a burst (per-keystroke autosave, bulk actions)\n        // collapses into one invalidation; the active query then refetches once.\n        if (timer) clearTimeout(timer)\n        timer = setTimeout(() => {\n          void queryClient.invalidateQueries({ queryKey: key })\n        }, OPERATION_INVALIDATE_DEBOUNCE_MS)\n      })\n    })\n    return () => {\n      disposed = true\n      if (timer) clearTimeout(timer)\n      unsubscribe?.()\n    }\n  }, [keyJson, invalidateJson, queryClient])\n\n  return result\n}\n\n/**\n * The write-side companion to {@link useOperationQuery}: an imperative handle on\n * the studio cache for a store that OWNS its writes. Lets a store apply an\n * EC-301-style optimistic patch (drop/replace one record) instead of re-listing\n * the whole collection on every edit — keeping `@tanstack/react-query` out of the\n * call sites so the seam stays the only place that knows the cache exists.\n */\nexport interface OperationCache {\n  /**\n   * Patch a cached query in place — no refetch. The EC-301 pattern: a focal-point\n   * or alt edit patches the one changed record; it does NOT trigger a full\n   * `*.list` round-trip. No-op if nothing is cached under `queryKey` yet.\n   */\n  patch<T>(queryKey: QueryKey, updater: (prev: T | undefined) => T): void\n  /**\n   * Invalidate a cached query, refetching it if it is currently active. Returns a\n   * promise that settles when the refetch does, so a caller that must sequence a\n   * read after a local write (e.g. flush-then-reload) can await it.\n   */\n  invalidate(queryKey: QueryKey): Promise<void>\n}\n\nexport function useOperationCache(): OperationCache {\n  const queryClient = useQueryClient()\n  const patch = useCallback(\n    <T,>(queryKey: QueryKey, updater: (prev: T | undefined) => T): void => {\n      queryClient.setQueryData<T>(queryKey, updater)\n    },\n    [queryClient],\n  )\n  const invalidate = useCallback(\n    (queryKey: QueryKey): Promise<void> => queryClient.invalidateQueries({ queryKey }),\n    [queryClient],\n  )\n  return useMemo(() => ({ patch, invalidate }), [patch, invalidate])\n}\n\n/**\n * Derive a list store's public `{ status, errorMessage }` from its operation query —\n * the identical mapping the assets/users/redirects rail stores (EC-319) each\n * hand-rolled. `errorMessage` is set only on an error; a store spreads it\n * conditionally onto its public shape.\n */\nexport function listStoreState(query: { isPending: boolean; isError: boolean; error: unknown }): {\n  status: 'loading' | 'ready' | 'error'\n  errorMessage: string | undefined\n} {\n  return {\n    status: query.isPending ? 'loading' : query.isError ? 'error' : 'ready',\n    errorMessage: query.isError && query.error instanceof Error ? query.error.message : undefined,\n  }\n}\n"]}

package/dist/lib/references/impact.d.ts

@@ -1,4 +1,5 @@
-import type { CollectionDef, DocumentRef, RelationFieldDef } from '@elytracms/core/cms-core';
+import type { DocumentRef } from '@elytracms/core/cms-core';
+import type { ConflictReferrer } from '@elytracms/core/operations';
 import type { ReferenceEntryView } from './reference-model.js';
 /**
  * Pure impact model for the EC-173 safe-unpublish/delete flows: given the
@@ -12,26 +13,30 @@ import type { ReferenceEntryView } from './reference-model.js';
  *   draft-only reference never serves the published site, so it neither
  *   counts nor blocks.
  * - **delete** breaks both variants — the stored value dangles either way.
- * - An entry **blocks** when its holding field is a relation declared
- *   `strict: true` in the schema (and, for unpublish, it is published).
- * - Entries whose *source* is itself among the acted-on documents are
- *   excluded: a reference between two documents deleted/unpublished together
- *   does not survive the action, so it cannot break.
+ * - **Blocking is the guard's own answer** (EC-589): the strict referrers the core
+ *   `documents.delete` / `unpublish` guard computes (`references.strictReferrers` — THE
+ *   reference walk over live drafts and pinned snapshots, every position, severity off
+ *   the declaration). The preview used to re-derive it from the index path's first
+ *   field and the top-level `collection.fields`, so a nested strict relation never
+ *   showed as blocking while the core refused (round3-D), and a bulk selection
+ *   excluded acted-on referrers the core still met (IDENTITY #4).
+ * - Entries whose *source* is itself among the acted-on documents do not count as
+ *   broken: a reference between two documents deleted/unpublished together does not
+ *   survive the action. They still BLOCK when the guard says so — the core runs one
+ *   operation per document and meets the referrer.
  */
 export type ReferenceAction = 'unpublish' | 'delete';
 /** Does this entry break (dangle / fall back) when `action` proceeds? */
 export declare function entryBreaksOnAction(entry: ReferenceEntryView, action: ReferenceAction): boolean;
-/** The relation field holding a document-sourced relation entry, if resolvable. */
-export declare function relationFieldOfEntry(collections: readonly CollectionDef[], entry: ReferenceEntryView): RelationFieldDef | undefined;
-/** Does this entry *block* the action (strict opt-in, EC-173)? */
-export declare function entryBlocksAction(collections: readonly CollectionDef[], entry: ReferenceEntryView, action: ReferenceAction): boolean;
 /** The impact of one action on one target document. */
 export interface DocumentReferenceImpact {
     ref: DocumentRef;
     /** Inbound entries that will break (fallbacks + validation issues). */
     broken: ReferenceEntryView[];
-    /** The subset held by strict relation fields — these block the action. */
+    /** The inbound entries the guard's strict referrers hold — these block the action. */
     blocking: ReferenceEntryView[];
+    /** The guard's strict referrers themselves (EC-589) — the count the core refuses with. */
+    strictReferrers: readonly ConflictReferrer[];
 }
 /** The aggregate impact of one action over a set of target documents. */
 export interface ReferenceImpact {
@@ -42,13 +47,14 @@ export interface ReferenceImpact {
     totalBlocking: number;
 }
 /**
- * Build the impact of `action` over `targets` from their raw inbound entry
- * views (keyed by `documentKey`). Sources that are themselves targets are
- * excluded — they do not survive the action.
+ * Build the impact of `action` over `targets` from their raw inbound entry views
+ * (keyed by `documentKey`) and the guard's strict referrers per target. Sources that
+ * are themselves targets do not count as broken (they do not survive the action).
  */
-export declare function buildReferenceImpact(collections: readonly CollectionDef[], action: ReferenceAction, targets: readonly {
+export declare function buildReferenceImpact(action: ReferenceAction, targets: readonly {
     ref: DocumentRef;
     inbound: readonly ReferenceEntryView[];
+    strictReferrers?: readonly ConflictReferrer[];
 }[]): ReferenceImpact;
 /**
  * Impact of deleting an ASSET (EC-202), reusing the document break/block model.

package/dist/lib/references/impact.js

@@ -1,48 +1,35 @@
 import { documentKey } from '@elytracms/core/cms-core';
-import { parseDocumentFieldPath, parseDocumentKey } from './reference-model.js';
 /** Does this entry break (dangle / fall back) when `action` proceeds? */
 export function entryBreaksOnAction(entry, action) {
     return action === 'delete' ? entry.draft || entry.published : entry.published;
 }
-/** The relation field holding a document-sourced relation entry, if resolvable. */
-export function relationFieldOfEntry(collections, entry) {
-    if (entry.kind !== 'relation-field' || entry.source.type !== 'document')
-        return undefined;
-    const sourceRef = parseDocumentKey(entry.source.id);
-    const parsedPath = parseDocumentFieldPath(entry.path);
-    if (!sourceRef || !parsedPath)
-        return undefined;
-    const collection = collections.find((c) => c.id === sourceRef.collection);
-    const field = collection?.fields.find((f) => f.name === parsedPath.field);
-    return field?.type === 'relation' ? field : undefined;
-}
-/** Does this entry *block* the action (strict opt-in, EC-173)? */
-export function entryBlocksAction(collections, entry, action) {
-    if (!entryBreaksOnAction(entry, action))
-        return false;
-    return relationFieldOfEntry(collections, entry)?.strict === true;
+/** The (source, path) identity a guard referrer and an index entry share. */
+function referrerKey(sourceId, path) {
+    return `${sourceId}\n${path}`;
 }
 /**
- * Build the impact of `action` over `targets` from their raw inbound entry
- * views (keyed by `documentKey`). Sources that are themselves targets are
- * excluded — they do not survive the action.
+ * Build the impact of `action` over `targets` from their raw inbound entry views
+ * (keyed by `documentKey`) and the guard's strict referrers per target. Sources that
+ * are themselves targets do not count as broken (they do not survive the action).
  */
-export function buildReferenceImpact(collections, action, targets) {
+export function buildReferenceImpact(action, targets) {
     const actedKeys = new Set(targets.map((target) => documentKey(target.ref)));
     const documents = targets.map((target) => {
         const surviving = target.inbound.filter((entry) => !(entry.source.type === 'document' && actedKeys.has(entry.source.id)));
-        const broken = surviving.filter((entry) => entryBreaksOnAction(entry, action));
+        const strictReferrers = target.strictReferrers ?? [];
+        const strictKeys = new Set(strictReferrers.map((referrer) => referrerKey(documentKey(referrer), referrer.path)));
         return {
             ref: target.ref,
-            broken,
-            blocking: broken.filter((entry) => entryBlocksAction(collections, entry, action)),
+            broken: surviving.filter((entry) => entryBreaksOnAction(entry, action)),
+            blocking: target.inbound.filter((entry) => entry.source.type === 'document' && strictKeys.has(referrerKey(entry.source.id, entry.path))),
+            strictReferrers,
         };
     });
     return {
         action,
         documents,
         totalBroken: documents.reduce((sum, doc) => sum + doc.broken.length, 0),
-        totalBlocking: documents.reduce((sum, doc) => sum + doc.blocking.length, 0),
+        totalBlocking: documents.reduce((sum, doc) => sum + doc.strictReferrers.length, 0),
     };
 }
 /**

package/dist/lib/references/impact.js.map

@@ -1 +1 @@
-{"version":3,"file":"impact.js","sourceRoot":"","sources":["../../../src/lib/references/impact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAEtD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAwB5E,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,MAAuB;IACpF,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,WAAqC,EACrC,KAAyB;IAEzB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IACzF,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACnD,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACrD,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IAC/C,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,UAAU,CAAC,CAAA;IACzE,MAAM,KAAK,GAAG,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,KAAK,CAAC,CAAA;IACzE,OAAO,KAAK,EAAE,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACvD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAC/B,WAAqC,EACrC,KAAyB,EACzB,MAAuB;IAEvB,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IACrD,OAAO,oBAAoB,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;AAClE,CAAC;AAoBD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAqC,EACrC,MAAuB,EACvB,OAAgF;IAEhF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3E,MAAM,SAAS,GAA8B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACjF,CAAA;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;QAC9E,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM;YACN,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;SAClF,CAAA;IACH,CAAC,CAAC,CAAA;IACF,OAAO;QACL,MAAM;QACN,SAAS;QACT,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;KAC5E,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAsC;IAI9E,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,QAAQ,EAAE,EAAE;KACb,CAAA;AACH,CAAC","sourcesContent":["import { documentKey } from '@elytracms/core/cms-core'\nimport type { CollectionDef, DocumentRef, RelationFieldDef } from '@elytracms/core/cms-core'\nimport { parseDocumentFieldPath, parseDocumentKey } from './reference-model'\nimport type { ReferenceEntryView } from './reference-model'\n\n/**\n * Pure impact model for the EC-173 safe-unpublish/delete flows: given the\n * inbound reference entries of one or more target documents (the EC-172 panel\n * views), compute what *breaks* when the action proceeds and what *blocks* it\n * outright (strict relation fields). No data fetching, no React — fully\n * deterministic and node-testable, like `reference-model.ts`.\n *\n * Semantics (weak by default, vision 3.6):\n * - **unpublish** breaks only the *published* variant of an entry — a\n *   draft-only reference never serves the published site, so it neither\n *   counts nor blocks.\n * - **delete** breaks both variants — the stored value dangles either way.\n * - An entry **blocks** when its holding field is a relation declared\n *   `strict: true` in the schema (and, for unpublish, it is published).\n * - Entries whose *source* is itself among the acted-on documents are\n *   excluded: a reference between two documents deleted/unpublished together\n *   does not survive the action, so it cannot break.\n */\n\nexport type ReferenceAction = 'unpublish' | 'delete'\n\n/** Does this entry break (dangle / fall back) when `action` proceeds? */\nexport function entryBreaksOnAction(entry: ReferenceEntryView, action: ReferenceAction): boolean {\n  return action === 'delete' ? entry.draft || entry.published : entry.published\n}\n\n/** The relation field holding a document-sourced relation entry, if resolvable. */\nexport function relationFieldOfEntry(\n  collections: readonly CollectionDef[],\n  entry: ReferenceEntryView,\n): RelationFieldDef | undefined {\n  if (entry.kind !== 'relation-field' || entry.source.type !== 'document') return undefined\n  const sourceRef = parseDocumentKey(entry.source.id)\n  const parsedPath = parseDocumentFieldPath(entry.path)\n  if (!sourceRef || !parsedPath) return undefined\n  const collection = collections.find((c) => c.id === sourceRef.collection)\n  const field = collection?.fields.find((f) => f.name === parsedPath.field)\n  return field?.type === 'relation' ? field : undefined\n}\n\n/** Does this entry *block* the action (strict opt-in, EC-173)? */\nexport function entryBlocksAction(\n  collections: readonly CollectionDef[],\n  entry: ReferenceEntryView,\n  action: ReferenceAction,\n): boolean {\n  if (!entryBreaksOnAction(entry, action)) return false\n  return relationFieldOfEntry(collections, entry)?.strict === true\n}\n\n/** The impact of one action on one target document. */\nexport interface DocumentReferenceImpact {\n  ref: DocumentRef\n  /** Inbound entries that will break (fallbacks + validation issues). */\n  broken: ReferenceEntryView[]\n  /** The subset held by strict relation fields — these block the action. */\n  blocking: ReferenceEntryView[]\n}\n\n/** The aggregate impact of one action over a set of target documents. */\nexport interface ReferenceImpact {\n  action: ReferenceAction\n  documents: DocumentReferenceImpact[]\n  /** Sum of `broken` across documents (\"M inbound references will break\"). */\n  totalBroken: number\n  totalBlocking: number\n}\n\n/**\n * Build the impact of `action` over `targets` from their raw inbound entry\n * views (keyed by `documentKey`). Sources that are themselves targets are\n * excluded — they do not survive the action.\n */\nexport function buildReferenceImpact(\n  collections: readonly CollectionDef[],\n  action: ReferenceAction,\n  targets: readonly { ref: DocumentRef; inbound: readonly ReferenceEntryView[] }[],\n): ReferenceImpact {\n  const actedKeys = new Set(targets.map((target) => documentKey(target.ref)))\n  const documents: DocumentReferenceImpact[] = targets.map((target) => {\n    const surviving = target.inbound.filter(\n      (entry) => !(entry.source.type === 'document' && actedKeys.has(entry.source.id)),\n    )\n    const broken = surviving.filter((entry) => entryBreaksOnAction(entry, action))\n    return {\n      ref: target.ref,\n      broken,\n      blocking: broken.filter((entry) => entryBlocksAction(collections, entry, action)),\n    }\n  })\n  return {\n    action,\n    documents,\n    totalBroken: documents.reduce((sum, doc) => sum + doc.broken.length, 0),\n    totalBlocking: documents.reduce((sum, doc) => sum + doc.blocking.length, 0),\n  }\n}\n\n/**\n * Impact of deleting an ASSET (EC-202), reusing the document break/block model.\n * A delete dangles EVERY inbound reference (`delete` breaks both variants), and\n * nothing *blocks*: assets are held by `asset` fields / `asset`-typed props,\n * never by `strict: true` relation fields, so the asset path has no block\n * concept — it is always weak-by-default. Returns the same `{ broken, blocking }`\n * shape the shared EC-173 impact rows render.\n */\nexport function buildAssetReferenceImpact(inbound: readonly ReferenceEntryView[]): {\n  broken: ReferenceEntryView[]\n  blocking: ReferenceEntryView[]\n} {\n  return {\n    broken: inbound.filter((entry) => entryBreaksOnAction(entry, 'delete')),\n    blocking: [],\n  }\n}\n"]}
+{"version":3,"file":"impact.js","sourceRoot":"","sources":["../../../src/lib/references/impact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAgCtD,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,MAAuB;IACpF,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAA;AAC/E,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,OAAO,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAA;AAC/B,CAAC;AAsBD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,OAIG;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3E,MAAM,SAAS,GAA8B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAClE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CACrC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACjF,CAAA;QACD,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CACrF,CAAA;QACD,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACvE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CACxG;YACD,eAAe;SAChB,CAAA;IACH,CAAC,CAAC,CAAA;IACF,OAAO;QACL,MAAM;QACN,SAAS;QACT,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC;KACnF,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAsC;IAI9E,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvE,QAAQ,EAAE,EAAE;KACb,CAAA;AACH,CAAC","sourcesContent":["import { documentKey } from '@elytracms/core/cms-core'\nimport type { DocumentRef } from '@elytracms/core/cms-core'\nimport type { ConflictReferrer } from '@elytracms/core/operations'\nimport type { ReferenceEntryView } from './reference-model'\n\n/**\n * Pure impact model for the EC-173 safe-unpublish/delete flows: given the\n * inbound reference entries of one or more target documents (the EC-172 panel\n * views), compute what *breaks* when the action proceeds and what *blocks* it\n * outright (strict relation fields). No data fetching, no React — fully\n * deterministic and node-testable, like `reference-model.ts`.\n *\n * Semantics (weak by default, vision 3.6):\n * - **unpublish** breaks only the *published* variant of an entry — a\n *   draft-only reference never serves the published site, so it neither\n *   counts nor blocks.\n * - **delete** breaks both variants — the stored value dangles either way.\n * - **Blocking is the guard's own answer** (EC-589): the strict referrers the core\n *   `documents.delete` / `unpublish` guard computes (`references.strictReferrers` — THE\n *   reference walk over live drafts and pinned snapshots, every position, severity off\n *   the declaration). The preview used to re-derive it from the index path's first\n *   field and the top-level `collection.fields`, so a nested strict relation never\n *   showed as blocking while the core refused (round3-D), and a bulk selection\n *   excluded acted-on referrers the core still met (IDENTITY #4).\n * - Entries whose *source* is itself among the acted-on documents do not count as\n *   broken: a reference between two documents deleted/unpublished together does not\n *   survive the action. They still BLOCK when the guard says so — the core runs one\n *   operation per document and meets the referrer.\n */\n\nexport type ReferenceAction = 'unpublish' | 'delete'\n\n/** Does this entry break (dangle / fall back) when `action` proceeds? */\nexport function entryBreaksOnAction(entry: ReferenceEntryView, action: ReferenceAction): boolean {\n  return action === 'delete' ? entry.draft || entry.published : entry.published\n}\n\n/** The (source, path) identity a guard referrer and an index entry share. */\nfunction referrerKey(sourceId: string, path: string): string {\n  return `${sourceId}\\n${path}`\n}\n\n/** The impact of one action on one target document. */\nexport interface DocumentReferenceImpact {\n  ref: DocumentRef\n  /** Inbound entries that will break (fallbacks + validation issues). */\n  broken: ReferenceEntryView[]\n  /** The inbound entries the guard's strict referrers hold — these block the action. */\n  blocking: ReferenceEntryView[]\n  /** The guard's strict referrers themselves (EC-589) — the count the core refuses with. */\n  strictReferrers: readonly ConflictReferrer[]\n}\n\n/** The aggregate impact of one action over a set of target documents. */\nexport interface ReferenceImpact {\n  action: ReferenceAction\n  documents: DocumentReferenceImpact[]\n  /** Sum of `broken` across documents (\"M inbound references will break\"). */\n  totalBroken: number\n  totalBlocking: number\n}\n\n/**\n * Build the impact of `action` over `targets` from their raw inbound entry views\n * (keyed by `documentKey`) and the guard's strict referrers per target. Sources that\n * are themselves targets do not count as broken (they do not survive the action).\n */\nexport function buildReferenceImpact(\n  action: ReferenceAction,\n  targets: readonly {\n    ref: DocumentRef\n    inbound: readonly ReferenceEntryView[]\n    strictReferrers?: readonly ConflictReferrer[]\n  }[],\n): ReferenceImpact {\n  const actedKeys = new Set(targets.map((target) => documentKey(target.ref)))\n  const documents: DocumentReferenceImpact[] = targets.map((target) => {\n    const surviving = target.inbound.filter(\n      (entry) => !(entry.source.type === 'document' && actedKeys.has(entry.source.id)),\n    )\n    const strictReferrers = target.strictReferrers ?? []\n    const strictKeys = new Set(\n      strictReferrers.map((referrer) => referrerKey(documentKey(referrer), referrer.path)),\n    )\n    return {\n      ref: target.ref,\n      broken: surviving.filter((entry) => entryBreaksOnAction(entry, action)),\n      blocking: target.inbound.filter(\n        (entry) => entry.source.type === 'document' && strictKeys.has(referrerKey(entry.source.id, entry.path)),\n      ),\n      strictReferrers,\n    }\n  })\n  return {\n    action,\n    documents,\n    totalBroken: documents.reduce((sum, doc) => sum + doc.broken.length, 0),\n    totalBlocking: documents.reduce((sum, doc) => sum + doc.strictReferrers.length, 0),\n  }\n}\n\n/**\n * Impact of deleting an ASSET (EC-202), reusing the document break/block model.\n * A delete dangles EVERY inbound reference (`delete` breaks both variants), and\n * nothing *blocks*: assets are held by `asset` fields / `asset`-typed props,\n * never by `strict: true` relation fields, so the asset path has no block\n * concept — it is always weak-by-default. Returns the same `{ broken, blocking }`\n * shape the shared EC-173 impact rows render.\n */\nexport function buildAssetReferenceImpact(inbound: readonly ReferenceEntryView[]): {\n  broken: ReferenceEntryView[]\n  blocking: ReferenceEntryView[]\n} {\n  return {\n    broken: inbound.filter((entry) => entryBreaksOnAction(entry, 'delete')),\n    blocking: [],\n  }\n}\n"]}

package/dist/lib/references/references-store.d.ts

@@ -1,4 +1,5 @@
 import type { DocumentRef } from '@elytracms/core/cms-core';
+import type { ConflictReferrer } from '@elytracms/core/operations';
 import type { ReferenceSource, ReferenceTarget } from '@elytracms/core/persistence';
 import type { OperationEvent, StudioOperations } from '../operations/index.js';
 import type { ReferenceEntryView } from './reference-model.js';
@@ -49,6 +50,14 @@ export declare function loadInboundReferenceViews(projectId: string, targets: re
     ref: DocumentRef;
     inbound: ReferenceEntryView[];
 }[]>;
+/**
+ * The strict referrers of each acted-on document (EC-589) — the core guard's OWN
+ * computation (`references.strictReferrers`: THE reference walk over live drafts and
+ * pinned snapshots, every position, severity off the declaration), so the dialog blocks
+ * exactly when `documents.delete` / `unpublish` would refuse. One list per target, in
+ * `targets` order; pair with {@link loadInboundReferenceViews} in `buildReferenceImpact`.
+ */
+export declare function loadStrictReferrers(projectId: string, targets: readonly DocumentRef[], action: 'delete' | 'unpublish'): Promise<ConflictReferrer[][]>;
 /**
  * Inbound reference views for ONE asset (EC-202): the "what uses this asset"
  * pre-flight of the asset-delete dialog, index-accurate (the EC-155 reference

package/dist/lib/references/references-store.js

@@ -3,7 +3,7 @@ import { documentKey } from '@elytracms/core/cms-core';
 import { useOperationQuery } from '@elytracms/studio/lib/query';
 import { localizedLabel } from '../i18n/index.js';
 import { getStudioLocaleConfig } from '../locale/locale-store.js';
-import { resolveDeploymentLocaleConfig } from '../workspace/index.js';
+import { resolveDeploymentCollections, resolveDeploymentLocaleConfig } from '../workspace/index.js';
 import { getStudioOperations } from '../operations/index.js';
 import { getStudioRegistry } from '../registry/index.js';
 import { buildReferenceEntryViews } from './reference-model.js';
@@ -52,12 +52,12 @@ export function ensureReferenceIndex(studio, projectId) {
 }
 // --- Label context loading -------------------------------------------------------
 async function loadLabelContext(operations, projectId) {
-    const [schemaResult, documentsResult, assetsResult] = await Promise.all([
-        operations.schema.get({ projectId }),
+    const [documentsResult, assetsResult] = await Promise.all([
         operations.documents.list({ projectId }),
         operations.assets.list({ projectId }),
     ]);
-    const collections = schemaResult.ok ? schemaResult.value.collections : [];
+    // EC-583 / EC-559: the labels' schema is the config's (the store holds no schema).
+    const collections = resolveDeploymentCollections();
     const documents = new Map();
     if (documentsResult.ok) {
         for (const record of documentsResult.value) {
@@ -183,6 +183,26 @@ export async function loadInboundReferenceViews(projectId, targets, toTarget = (
         inbound: buildReferenceEntryViews(recordsPerTarget[index] ?? [], context),
     }));
 }
+/**
+ * The strict referrers of each acted-on document (EC-589) — the core guard's OWN
+ * computation (`references.strictReferrers`: THE reference walk over live drafts and
+ * pinned snapshots, every position, severity off the declaration), so the dialog blocks
+ * exactly when `documents.delete` / `unpublish` would refuse. One list per target, in
+ * `targets` order; pair with {@link loadInboundReferenceViews} in `buildReferenceImpact`.
+ */
+export async function loadStrictReferrers(projectId, targets, action) {
+    if (targets.length === 0)
+        return [];
+    const studio = await getStudioOperations();
+    const result = await studio.operations.references.strictReferrers({
+        projectId,
+        targets: [...targets],
+        mode: action,
+    });
+    if (!result.ok)
+        throw new Error(result.error.message);
+    return result.value.map((referrers) => [...referrers]);
+}
 /**
  * Inbound reference views for ONE asset (EC-202): the "what uses this asset"
  * pre-flight of the asset-delete dialog, index-accurate (the EC-155 reference