@elytracms/studio 0.0.92 → 0.0.93

package/dist/lib/collection-view/collection-view-source.d.ts

@@ -97,7 +97,7 @@ export interface CollectionViewSource {
      * when there is no asset backend (a source without assets degrades to a label
      * via {@link titleOf}, matching today's "no AssetsProvider" behaviour).
      */
-    resolveAsset?(id: string): ResolvedAsset | undefined;
+    resolveAsset?(id: string): AssetDisplay | undefined;
     /**
      * How this rail's records are addressed in the EC-155 reference index — the
      * target shape the delete/unpublish confirmation's inbound pre-flight queries
@@ -279,8 +279,12 @@ export type FieldAccess = 'edit' | 'read' | 'hidden';
  * principal edit / see this field?", so the default-open fallback lives in one spot.
  */
 export declare function resolveFieldAccess(source: CollectionViewSource, field: FieldDef, record?: CmsDocument): FieldAccess;
-/** Asset display metadata a cell/field renders (thumbnail or labelled badge). */
-export interface ResolvedAsset {
+/**
+ * Asset display metadata a cell/field renders (thumbnail or labelled badge). EC-587:
+ * named apart from core's `ResolvedAsset` (the delivery shape) — this is the studio's
+ * label/thumbnail slice; its `alt` is the one reader's (`assetAlt`).
+ */
+export interface AssetDisplay {
     readonly url?: string;
     readonly contentType?: string;
     readonly title?: string;

package/dist/lib/collection-view/collection-view-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"collection-view-source.js","sourceRoot":"","sources":["../../../src/lib/collection-view/collection-view-source.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAmSvD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA4B,EAC5B,KAAe,EACf,MAAoB;IAEpB,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AACjG,CAAC;AAiDD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS;QAC3C,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;KACtC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type {\n  CmsDocument,\n  CollectionDef,\n  DocumentPatch,\n  DocumentRef,\n  ValuePath,\n  DocumentUrl,\n  FieldDef,\n  Locale,\n  LocaleConfig,\n  LocalizedString,\n  RestoreScope,\n} from '@elytracms/core/cms-core'\nimport type { CmsValidationIssue } from '@elytracms/core/cms-core'\nimport type { OperationError } from '@elytracms/core/operations'\nimport type { CmsDocumentRecord, PresenceEntry, ReferenceTarget } from '@elytracms/core/persistence'\nimport type { CommitOutcome, DocumentConflict } from '../operations/cms-persistence'\nimport type { TableViewState } from '../cms-views/view-model'\nimport { pseudoColumns } from '../cms-views/view-model'\n// The concrete inline-edit + bulk vocabulary (Stream A relocates it into `lib` as it settles).\nimport type { CellCommitInput, CellCommitOutcome } from '../../components/cms/cell-edit'\nimport type { BulkAction, BulkReport, BulkSetField } from '../../components/cms/bulk-actions'\nimport type { DocumentVersionsView, ImportReport } from '../../components/cms/cms-store'\n\n/**\n * `CollectionViewSource` — the studio's UNIVERSAL interaction seam (EC-240,\n * vision AD-19).\n *\n * The list surface (`CollectionTable`) and the edit-shell (`DetailEditor`) are\n * the studio's universal interaction surfaces. Historically they read the\n * concrete `CmsStore` through `useCms()`, so they only served `cmsDocuments`.\n * This interface is the data-agnostic seam they render over instead, so the SAME\n * surfaces drive the users rail (EC-240), redirects (EC-303), the Components app\n * edit-shell, and any future rail — no hand-rolled UI per rail.\n *\n * **Shape:** the source is scoped to ONE collection (it carries `schema` +\n * `collectionId`), and its methods mirror the subset of `CmsStore` the surfaces\n * actually use — dropping the `collectionId` argument (the source already knows\n * it). Keeping the names/signatures aligned makes the CMS adapter a\n * behaviour-preserving pass-through and the migration near-mechanical.\n *\n * **Referential stability:** the surfaces put `documents`, `isPublished`,\n * `localeConfig`, etc. in `useMemo` dependency arrays. An implementation MUST\n * return stable references across renders (delegate to the underlying store's\n * already-stable methods; never wrap in a fresh closure each render) or memos\n * bust and the inline-edit order snapshot / perf regress.\n *\n * **Capabilities:** flags gate whole shell regions AND method presence — a source\n * with `capabilities.versions === false` (the users rail) never mounts the\n * Versions pane, so no `listVersions` read fires on credential records. Optional\n * method groups are present iff the flag is set.\n */\nexport interface CollectionViewSource {\n  /** The rail/collection this source serves. */\n  readonly collectionId: string\n  /** The schema lens: fields, form tabs/groups, `titleField`, display nouns. */\n  readonly schema: CollectionDef\n  /** Which regions/methods this source supports. */\n  readonly capabilities: CollectionViewCapabilities\n\n  /** The project scope (asset picker, published-pool queries). Absent in fixture sessions. */\n  readonly projectId?: string\n  /**\n   * The collection id assets live in (for a cell/field's `titleOf` label fallback\n   * when {@link resolveAsset} finds no record). Present only for sources that\n   * reference assets — a rail without assets (users) omits it.\n   */\n  readonly assetCollectionId?: string\n  /** The ambient locale lens (only meaningful when `capabilities.locales`). */\n  readonly localeConfig: LocaleConfig\n  readonly activeLocale: Locale\n\n  // --- Reads -----------------------------------------------------------------\n  /** The full row set (view mechanics filter/sort this client-side). */\n  documents(): CmsDocument[]\n  get(ref: DocumentRef): CmsDocument | undefined\n  /** A relation/asset target's display title (hides the string-vs-function `titleField`). */\n  titleOf(ref: DocumentRef): string\n  /**\n   * List the candidate records of a relation field's declared `target` collection\n   * — the pick-list for a relation picker (EC-072). References are first-class and\n   * collection-based: the field's schema declares which collection(s) it targets,\n   * and this resolves those rows for ANY target (cross-collection), not just this\n   * source's own collection. The caller passes `field.target`; a multi-target field\n   * (future) merges one call per declared target. An unknown/empty target yields `[]`.\n   */\n  referenceCandidates(collectionId: string): CmsDocument[]\n  /**\n   * The workspace schema a reference/asset can point at — the schema counterpart to\n   * {@link referenceCandidates}. Needed for the cases that read a TARGET collection's\n   * fields (an asset field editing the asset collection's own metadata; the reuse\n   * capability correlating embed manifests against their target collection). A\n   * reference is collection-based, so resolving one sometimes needs the target's\n   * schema, not just its rows.\n   */\n  readonly collections: readonly CollectionDef[]\n  isFieldReadOnly(field: FieldDef): boolean\n  /**\n   * Principal-based field access (EC-240, vision AD-18): `edit` (writable), `read`\n   * (visible but read-only), or `hidden` (not rendered for this principal). This is\n   * IDENTITY-driven and distinct from a field's content-conditional `hidden(values)`\n   * — e.g. an editor's own `role` resolves to `read`, a viewer never SEES a\n   * sensitive field (`hidden`). A single tri-state (never two independent flags) so\n   * the nonsensical writable-but-invisible state can't be expressed. Optional:\n   * absent ⇒ derived from {@link isFieldReadOnly} (`read`|`edit`), i.e. default-open\n   * (permissions RESTRICT, never grant a baseline). Per-rail policy lives on the\n   * source; the starter's policy flows into its construction (engine = mechanism).\n   * Prefer {@link resolveFieldAccess} over calling this directly (it applies the\n   * default-open fallback).\n   */\n  fieldAccess?(field: FieldDef, record?: CmsDocument): FieldAccess\n  validate(doc: CmsDocument): CmsValidationIssue[]\n  /**\n   * Resolve an asset id to its display metadata for a cell/field, or `undefined`\n   * when there is no asset backend (a source without assets degrades to a label\n   * via {@link titleOf}, matching today's \"no AssetsProvider\" behaviour).\n   */\n  resolveAsset?(id: string): ResolvedAsset | undefined\n  /**\n   * How this rail's records are addressed in the EC-155 reference index — the\n   * target shape the delete/unpublish confirmation's inbound pre-flight queries\n   * (EC-433). Absent ⇒ the document shape (`{ type: 'document', id: 'collection:id' }`),\n   * which every `cmsDocuments` collection uses. The assets rail supplies\n   * `{ type: 'asset' }` so its list/bulk delete confirmation enumerates the SAME\n   * inbound references its detail surface does — a document-shaped lookup would\n   * report a referenced asset as \"not referenced\" (the EC-319 objection that\n   * originally kept `remove` off the assets rail).\n   */\n  referenceTarget?(ref: DocumentRef): ReferenceTarget\n  /** The last failed/denied mutation, surfaced by the shell (never a silent failure). */\n  readonly lastError: OperationError | null\n  clearLastError(): void\n  /**\n   * Land any queued/optimistic writes so a subsequent pre-flight READ sees them\n   * (the reference index is maintained on write). A source with no async\n   * persistence omits it — its reads are already authoritative.\n   */\n  flush?(): Promise<void>\n\n  /**\n   * The studio route splat for a record's detail surface (the row link + the\n   * post-create navigation target), e.g. `studioPath.cmsDocument(collectionId, id)`.\n   * Rail-owned so the list never hard-codes the CMS route. `undefined` ⇒ the rail\n   * has no detail surface, so rows render as plain text (no navigation).\n   */\n  detailPath?(id: string): string\n  /**\n   * The studio route splat for this rail's LIST surface — the edit shell's\n   * \"back to list\" breadcrumb crumb and its post-delete navigation target, e.g.\n   * `studioPath.cmsCollection(collectionId)`. Rail-owned so the edit shell never\n   * hard-codes the CMS route (the counterpart to {@link detailPath}). `undefined`\n   * ⇒ the crumb is unlinked and delete falls back to the project index.\n   */\n  readonly listPath?: string\n\n  // --- View state (list) -----------------------------------------------------\n  viewState(): TableViewState\n  setViewState(update: TableViewState | ((prev: TableViewState) => TableViewState)): void\n\n  // --- Writes ----------------------------------------------------------------\n  create(): DocumentRef\n  /**\n   * EC-595 A2 — HOW this source's records are written: exactly one model per source,\n   * so a surface can never write a revisioned document the record way or vice versa.\n   * `record` — the explicit-save rails (users, redirects, assets, the account): the\n   * editor's Save button hands the whole record over. `document` — the CMS: every\n   * writer emits patches at its source, committed on quiescence and merged per path\n   * at the store; the editor shows per-field conflicts and follows the subscription.\n   */\n  readonly writes: CollectionWrites\n  remove(ref: DocumentRef): void\n  /**\n   * Bulk publish/unpublish/delete/set-field (only when `capabilities.bulk`): one\n   * command PER item, per-item outcomes enumerated in the report (partial failure\n   * is never silent).\n   */\n  bulk?(ids: readonly string[], action: BulkAction, setField?: BulkSetField): Promise<BulkReport>\n\n  // --- Capability method groups (present iff the matching flag is set) --------\n  /** `publish` — published-pool predicate + publish/unpublish. */\n  readonly publishing?: PublishingCapability\n  /**\n   * Per-document timestamps (EC-445) — the data behind the `$updatedAt`\n   * pseudo-column (and, once its data path lands, `$publishedAt`). Present iff the\n   * source materializes them (the CMS source, sourced through session-hydration);\n   * a rail that carries no timestamps omits it, so those pseudo-columns simply don't\n   * apply (see {@link pseudoColumnsForSource}). The accessor shape mirrors\n   * {@link PublishingCapability.isPublished} — a per-ref lookup, referentially stable.\n   */\n  readonly timestamps?: DocumentTimestampsCapability\n  /** `versions` — version history + restore. */\n  readonly versioning?: VersioningCapability\n  /** `inlineEdit` — the list's single-command optimistic cell write. */\n  readonly inlineEditing?: InlineEditCapability\n  /**\n   * Config-as-code named lenses (EC-246b) the header view selector switches\n   * between. Optional: a source that declares no named views (a non-CMS rail\n   * like users) omits it, and the selector renders nothing (single default).\n   */\n  readonly views?: NamedViewsCapability\n  /**\n   * `importExport` — JSON round-trip of the collection's records. CMS-specific;\n   * a rail whose records are credential-bearing (users) omits it, so neither the\n   * import dialog nor the export action mounts (identities aren't dumped to JSON).\n   */\n  readonly imports?: ImportCapability\n}\n\n/** EC-595 A2 — the write model of a source (see {@link CollectionViewSource.writes}). */\nexport type CollectionWrites = RecordWrites | DocumentWrites\n\n/** An explicit-save rail: the editor's Save button writes the whole record. */\nexport interface RecordWrites {\n  readonly kind: 'record'\n  save(doc: CmsDocument): void\n}\n\n/**\n * The revisioned-document write model (EC-595, ratified 2026-10-24): patches at the\n * source, the persister's queue, per-field conflicts, the document subscription.\n */\nexport interface DocumentWrites {\n  readonly kind: 'document'\n  /**\n   * Commit the patches a writer made; resolves once acknowledged (`undefined` in a\n   * fixture session). `bases` — per patch, the revision the edit was started at.\n   */\n  commit(\n    ref: DocumentRef,\n    patches: readonly DocumentPatch[],\n    bases?: readonly (number | undefined)[],\n  ): Promise<CommitOutcome | undefined>\n  /** The revision the session's view of a document is at. */\n  revisionOf(ref: DocumentRef): number | undefined\n  /** Create a document from a whole value (insert-if-absent): duplicate. */\n  insert(doc: CmsDocument): void\n  /** A fresh document id from the session's injected factory (EC-578). */\n  newId(): string\n  /** The open per-field conflicts on a document. */\n  conflicts(ref: DocumentRef): readonly DocumentConflict[]\n  resolveConflict(ref: DocumentRef, conflictId: string, choice: 'theirs' | 'mine'): void\n  /** Adopt a row the document subscription pushed (local edits win on their paths until flushed). */\n  adoptSnapshot(ref: DocumentRef, record: CmsDocumentRecord | undefined): void\n  /** The forced flush's persistence half: await every queued write of the document. */\n  flush(ref: DocumentRef): Promise<void>\n  /**\n   * Write the whole document at the revision the session holds (a document-level key\n   * the value-position grammar has no position for — the slot `alias`). A move since\n   * is refused, never overwritten.\n   */\n  replace(doc: CmsDocument): void\n  /**\n   * EC-595 point 7 — follow ONE document while it is open: every pushed row is adopted\n   * under the local edits (the editor rebases), and the presence on it is delivered to\n   * `onPresence`. Returns the unsubscribe function.\n   */\n  subscribe(ref: DocumentRef, onPresence: (presence: readonly PresenceEntry[]) => void): () => void\n  /** Thin presence (Stage A): this session is on the document, in `path`'s field (or on no field). */\n  reportPresence(ref: DocumentRef, path: ValuePath | undefined): void\n  /** This session left the document. */\n  clearPresence(ref: DocumentRef): void\n  /** This session's presence id (one per tab), so the editor can leave itself out. */\n  readonly presenceSessionId: string\n}\n\n/**\n * The capability matrix. Each flag gates a shell region AND the presence of its\n * method group. The **users rail** (EC-240) sets `publish:false`, `versions:false`\n * (credential caution), `create:false` (identity minted by sign-up), and no\n * `liveUrl`/`hierarchy`.\n */\nexport interface CollectionViewCapabilities {\n  readonly publish: boolean\n  readonly versions: boolean\n  readonly locales: boolean\n  readonly inlineEdit: boolean\n  readonly create: boolean\n  /**\n   * Duplicate-document action (EC-442, amended same day). Deliberately its own\n   * flag, never derived from `create`: the owner call (2026-07-17) is CMS\n   * collections ONLY — no primitive rail offers Duplicate for now (identities\n   * and uploads aren't copyable content; redirects deferred until requested as\n   * a product feature).\n   */\n  readonly duplicate: boolean\n  readonly remove: boolean\n  readonly bulk: boolean\n  /** The derived live-URL column (published pool × deployment routes). */\n  readonly liveUrl: boolean\n  /** Parent-self-relation tree mode (hierarchical collections only). */\n  readonly hierarchy: boolean\n  /** JSON import/export of the collection's records (off for credential rails). */\n  readonly importExport: boolean\n  /**\n   * The rail is administration-scoped (mirrors `ADMIN_ONLY_OPERATIONS`). The\n   * nav-permission layer reads this to gate the rail item. Absent ⇒ not admin-only.\n   */\n  readonly adminOnly?: boolean\n}\n\n/**\n * Principal-based field access (EC-240, AD-18). One tri-state drives BOTH visibility\n * and writability: `edit` (writable), `read` (visible, read-only), `hidden` (not\n * rendered). Default `edit` (default-open). Distinct from content-`hidden(values)`;\n * they compose — a field shows iff *not content-hidden AND access ≠ hidden*, and is\n * editable iff *access = edit AND not otherwise read-only* (published view, `form.readOnly`).\n */\nexport type FieldAccess = 'edit' | 'read' | 'hidden'\n\n/**\n * Resolve a field's effective principal access for a source — its {@link\n * CollectionViewSource.fieldAccess} policy when present, else derived from the\n * boolean `isFieldReadOnly` (default-open). The one place the shell asks \"may this\n * principal edit / see this field?\", so the default-open fallback lives in one spot.\n */\nexport function resolveFieldAccess(\n  source: CollectionViewSource,\n  field: FieldDef,\n  record?: CmsDocument,\n): FieldAccess {\n  return source.fieldAccess?.(field, record) ?? (source.isFieldReadOnly(field) ? 'read' : 'edit')\n}\n\n/** Asset display metadata a cell/field renders (thumbnail or labelled badge). */\nexport interface ResolvedAsset {\n  readonly url?: string\n  readonly contentType?: string\n  readonly title?: string\n  readonly filename?: string\n  readonly alt?: string\n}\n\n/** `publish` capability. */\nexport interface PublishingCapability {\n  /** Published-ness from the version pointer (NOT a row field). */\n  isPublished(ref: DocumentRef): boolean\n  /**\n   * Does this PUBLISHED document's working draft carry unpublished changes\n   * (EC-449)? The cheap per-row signal behind the amber \"changed\" `$state` dot —\n   * sourced from the MATERIALIZED `hasUnpublishedChanges` record flag (computed\n   * once at the write chokepoint), never a per-row snapshot compare. Optional: a\n   * source without the signal omits it, and the list derives only\n   * published/draft (exactly the pre-EC-449 rendering). Same referentially-stable\n   * per-ref accessor shape as {@link isPublished}.\n   */\n  hasUnpublishedChanges?(ref: DocumentRef): boolean\n  publish(ref: DocumentRef): Promise<void>\n  unpublish(ref: DocumentRef): Promise<void>\n  /**\n   * Live URLs for the routable documents, keyed by id — derived from the\n   * PUBLISHED pool (never draft rows) so an unpublished slug/parent edit can't\n   * leak into a live link (EC-205/EC-216). `null` when the collection is not\n   * routable → the live-URL column is hidden. Only present when `capabilities.liveUrl`.\n   */\n  liveUrls?(): Map<string, DocumentUrl> | null\n}\n\n/**\n * `timestamps` capability (EC-445/EC-447): per-document record timestamps as ISO\n * strings, or `undefined` when a document carries none. The `$updatedAt`/`$publishedAt`\n * pseudo-columns read + sort by these. `updatedAt` is the last-write instant;\n * `publishedAt` (EC-447) is the FIRST-publish instant — set-once on publish, cleared on\n * unpublish, so it is `undefined` for a draft / never-published / currently-unpublished\n * document (the column shows EmDash).\n */\nexport interface DocumentTimestampsCapability {\n  updatedAt(ref: DocumentRef): string | undefined\n  publishedAt(ref: DocumentRef): string | undefined\n}\n\n/**\n * The reserved pseudo-columns applicable to a source's list (EC-445), derived from\n * its capabilities: `$updatedAt` iff it materializes timestamps, `$state` iff it has a\n * publish lifecycle, `$url` iff it resolves delivery URLs. The one place the list\n * surface + the Display picker agree on which pseudo-columns exist for a source, so\n * the column universe never drifts between where columns render and where they toggle.\n */\nexport function pseudoColumnsForSource(source: CollectionViewSource): string[] {\n  return pseudoColumns(source.schema, {\n    timestamps: source.timestamps !== undefined,\n    publishing: source.publishing !== undefined,\n    routable: source.capabilities.liveUrl,\n  })\n}\n\n/** `versions` capability. */\nexport interface VersioningCapability {\n  restore(ref: DocumentRef, version: number, scope?: RestoreScope): Promise<CmsDocument | null>\n  /**\n   * The document's recorded version history + live pin. Folds the flush-before-read\n   * ordering INTO the loader (the adapter's concern), so every fetch lists an\n   * authoritative history regardless of which surface triggered the change (EC-224).\n   */\n  load(ref: DocumentRef): Promise<DocumentVersionsView>\n}\n\n/** `inlineEdit` capability: the list's single-command optimistic cell write (EC-168). */\nexport interface InlineEditCapability {\n  commitField(input: CellCommitInput): Promise<CellCommitOutcome>\n}\n\n/** A named lens the header selector offers — id + display name only (the header never needs its state). */\nexport interface NamedView {\n  readonly id: string\n  /** Display name; a {@link LocalizedString} (EC-343), resolved at the render site like `form.label`. */\n  readonly name: LocalizedString\n}\n\n/** `importExport` capability: validate + fold external JSON records into the collection (EC-079). */\nexport interface ImportCapability {\n  importDocuments(items: unknown[]): ImportReport\n}\n\n/**\n * `views` capability: config-as-code named lenses (EC-246b). The header selector\n * only *picks* a lens — it never creates/edits/deletes one (shared views are code).\n */\nexport interface NamedViewsCapability {\n  /** The built-in default + config-declared named views. */\n  list(): readonly NamedView[]\n  /** The currently-selected view id. */\n  activeId(): string\n  /** Switch views (resets the working table state to the view's baseline). */\n  setActive(id: string): void\n}\n\nexport type { CellCommitInput, CellCommitOutcome, ImportReport }\n"]}
+{"version":3,"file":"collection-view-source.js","sourceRoot":"","sources":["../../../src/lib/collection-view/collection-view-source.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAmSvD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA4B,EAC5B,KAAe,EACf,MAAoB;IAEpB,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AACjG,CAAC;AAqDD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAA4B;IACjE,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS;QAC3C,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS;QAC3C,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,OAAO;KACtC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import type {\n  CmsDocument,\n  CollectionDef,\n  DocumentPatch,\n  DocumentRef,\n  ValuePath,\n  DocumentUrl,\n  FieldDef,\n  Locale,\n  LocaleConfig,\n  LocalizedString,\n  RestoreScope,\n} from '@elytracms/core/cms-core'\nimport type { CmsValidationIssue } from '@elytracms/core/cms-core'\nimport type { OperationError } from '@elytracms/core/operations'\nimport type { CmsDocumentRecord, PresenceEntry, ReferenceTarget } from '@elytracms/core/persistence'\nimport type { CommitOutcome, DocumentConflict } from '../operations/cms-persistence'\nimport type { TableViewState } from '../cms-views/view-model'\nimport { pseudoColumns } from '../cms-views/view-model'\n// The concrete inline-edit + bulk vocabulary (Stream A relocates it into `lib` as it settles).\nimport type { CellCommitInput, CellCommitOutcome } from '../../components/cms/cell-edit'\nimport type { BulkAction, BulkReport, BulkSetField } from '../../components/cms/bulk-actions'\nimport type { DocumentVersionsView, ImportReport } from '../../components/cms/cms-store'\n\n/**\n * `CollectionViewSource` — the studio's UNIVERSAL interaction seam (EC-240,\n * vision AD-19).\n *\n * The list surface (`CollectionTable`) and the edit-shell (`DetailEditor`) are\n * the studio's universal interaction surfaces. Historically they read the\n * concrete `CmsStore` through `useCms()`, so they only served `cmsDocuments`.\n * This interface is the data-agnostic seam they render over instead, so the SAME\n * surfaces drive the users rail (EC-240), redirects (EC-303), the Components app\n * edit-shell, and any future rail — no hand-rolled UI per rail.\n *\n * **Shape:** the source is scoped to ONE collection (it carries `schema` +\n * `collectionId`), and its methods mirror the subset of `CmsStore` the surfaces\n * actually use — dropping the `collectionId` argument (the source already knows\n * it). Keeping the names/signatures aligned makes the CMS adapter a\n * behaviour-preserving pass-through and the migration near-mechanical.\n *\n * **Referential stability:** the surfaces put `documents`, `isPublished`,\n * `localeConfig`, etc. in `useMemo` dependency arrays. An implementation MUST\n * return stable references across renders (delegate to the underlying store's\n * already-stable methods; never wrap in a fresh closure each render) or memos\n * bust and the inline-edit order snapshot / perf regress.\n *\n * **Capabilities:** flags gate whole shell regions AND method presence — a source\n * with `capabilities.versions === false` (the users rail) never mounts the\n * Versions pane, so no `listVersions` read fires on credential records. Optional\n * method groups are present iff the flag is set.\n */\nexport interface CollectionViewSource {\n  /** The rail/collection this source serves. */\n  readonly collectionId: string\n  /** The schema lens: fields, form tabs/groups, `titleField`, display nouns. */\n  readonly schema: CollectionDef\n  /** Which regions/methods this source supports. */\n  readonly capabilities: CollectionViewCapabilities\n\n  /** The project scope (asset picker, published-pool queries). Absent in fixture sessions. */\n  readonly projectId?: string\n  /**\n   * The collection id assets live in (for a cell/field's `titleOf` label fallback\n   * when {@link resolveAsset} finds no record). Present only for sources that\n   * reference assets — a rail without assets (users) omits it.\n   */\n  readonly assetCollectionId?: string\n  /** The ambient locale lens (only meaningful when `capabilities.locales`). */\n  readonly localeConfig: LocaleConfig\n  readonly activeLocale: Locale\n\n  // --- Reads -----------------------------------------------------------------\n  /** The full row set (view mechanics filter/sort this client-side). */\n  documents(): CmsDocument[]\n  get(ref: DocumentRef): CmsDocument | undefined\n  /** A relation/asset target's display title (hides the string-vs-function `titleField`). */\n  titleOf(ref: DocumentRef): string\n  /**\n   * List the candidate records of a relation field's declared `target` collection\n   * — the pick-list for a relation picker (EC-072). References are first-class and\n   * collection-based: the field's schema declares which collection(s) it targets,\n   * and this resolves those rows for ANY target (cross-collection), not just this\n   * source's own collection. The caller passes `field.target`; a multi-target field\n   * (future) merges one call per declared target. An unknown/empty target yields `[]`.\n   */\n  referenceCandidates(collectionId: string): CmsDocument[]\n  /**\n   * The workspace schema a reference/asset can point at — the schema counterpart to\n   * {@link referenceCandidates}. Needed for the cases that read a TARGET collection's\n   * fields (an asset field editing the asset collection's own metadata; the reuse\n   * capability correlating embed manifests against their target collection). A\n   * reference is collection-based, so resolving one sometimes needs the target's\n   * schema, not just its rows.\n   */\n  readonly collections: readonly CollectionDef[]\n  isFieldReadOnly(field: FieldDef): boolean\n  /**\n   * Principal-based field access (EC-240, vision AD-18): `edit` (writable), `read`\n   * (visible but read-only), or `hidden` (not rendered for this principal). This is\n   * IDENTITY-driven and distinct from a field's content-conditional `hidden(values)`\n   * — e.g. an editor's own `role` resolves to `read`, a viewer never SEES a\n   * sensitive field (`hidden`). A single tri-state (never two independent flags) so\n   * the nonsensical writable-but-invisible state can't be expressed. Optional:\n   * absent ⇒ derived from {@link isFieldReadOnly} (`read`|`edit`), i.e. default-open\n   * (permissions RESTRICT, never grant a baseline). Per-rail policy lives on the\n   * source; the starter's policy flows into its construction (engine = mechanism).\n   * Prefer {@link resolveFieldAccess} over calling this directly (it applies the\n   * default-open fallback).\n   */\n  fieldAccess?(field: FieldDef, record?: CmsDocument): FieldAccess\n  validate(doc: CmsDocument): CmsValidationIssue[]\n  /**\n   * Resolve an asset id to its display metadata for a cell/field, or `undefined`\n   * when there is no asset backend (a source without assets degrades to a label\n   * via {@link titleOf}, matching today's \"no AssetsProvider\" behaviour).\n   */\n  resolveAsset?(id: string): AssetDisplay | undefined\n  /**\n   * How this rail's records are addressed in the EC-155 reference index — the\n   * target shape the delete/unpublish confirmation's inbound pre-flight queries\n   * (EC-433). Absent ⇒ the document shape (`{ type: 'document', id: 'collection:id' }`),\n   * which every `cmsDocuments` collection uses. The assets rail supplies\n   * `{ type: 'asset' }` so its list/bulk delete confirmation enumerates the SAME\n   * inbound references its detail surface does — a document-shaped lookup would\n   * report a referenced asset as \"not referenced\" (the EC-319 objection that\n   * originally kept `remove` off the assets rail).\n   */\n  referenceTarget?(ref: DocumentRef): ReferenceTarget\n  /** The last failed/denied mutation, surfaced by the shell (never a silent failure). */\n  readonly lastError: OperationError | null\n  clearLastError(): void\n  /**\n   * Land any queued/optimistic writes so a subsequent pre-flight READ sees them\n   * (the reference index is maintained on write). A source with no async\n   * persistence omits it — its reads are already authoritative.\n   */\n  flush?(): Promise<void>\n\n  /**\n   * The studio route splat for a record's detail surface (the row link + the\n   * post-create navigation target), e.g. `studioPath.cmsDocument(collectionId, id)`.\n   * Rail-owned so the list never hard-codes the CMS route. `undefined` ⇒ the rail\n   * has no detail surface, so rows render as plain text (no navigation).\n   */\n  detailPath?(id: string): string\n  /**\n   * The studio route splat for this rail's LIST surface — the edit shell's\n   * \"back to list\" breadcrumb crumb and its post-delete navigation target, e.g.\n   * `studioPath.cmsCollection(collectionId)`. Rail-owned so the edit shell never\n   * hard-codes the CMS route (the counterpart to {@link detailPath}). `undefined`\n   * ⇒ the crumb is unlinked and delete falls back to the project index.\n   */\n  readonly listPath?: string\n\n  // --- View state (list) -----------------------------------------------------\n  viewState(): TableViewState\n  setViewState(update: TableViewState | ((prev: TableViewState) => TableViewState)): void\n\n  // --- Writes ----------------------------------------------------------------\n  create(): DocumentRef\n  /**\n   * EC-595 A2 — HOW this source's records are written: exactly one model per source,\n   * so a surface can never write a revisioned document the record way or vice versa.\n   * `record` — the explicit-save rails (users, redirects, assets, the account): the\n   * editor's Save button hands the whole record over. `document` — the CMS: every\n   * writer emits patches at its source, committed on quiescence and merged per path\n   * at the store; the editor shows per-field conflicts and follows the subscription.\n   */\n  readonly writes: CollectionWrites\n  remove(ref: DocumentRef): void\n  /**\n   * Bulk publish/unpublish/delete/set-field (only when `capabilities.bulk`): one\n   * command PER item, per-item outcomes enumerated in the report (partial failure\n   * is never silent).\n   */\n  bulk?(ids: readonly string[], action: BulkAction, setField?: BulkSetField): Promise<BulkReport>\n\n  // --- Capability method groups (present iff the matching flag is set) --------\n  /** `publish` — published-pool predicate + publish/unpublish. */\n  readonly publishing?: PublishingCapability\n  /**\n   * Per-document timestamps (EC-445) — the data behind the `$updatedAt`\n   * pseudo-column (and, once its data path lands, `$publishedAt`). Present iff the\n   * source materializes them (the CMS source, sourced through session-hydration);\n   * a rail that carries no timestamps omits it, so those pseudo-columns simply don't\n   * apply (see {@link pseudoColumnsForSource}). The accessor shape mirrors\n   * {@link PublishingCapability.isPublished} — a per-ref lookup, referentially stable.\n   */\n  readonly timestamps?: DocumentTimestampsCapability\n  /** `versions` — version history + restore. */\n  readonly versioning?: VersioningCapability\n  /** `inlineEdit` — the list's single-command optimistic cell write. */\n  readonly inlineEditing?: InlineEditCapability\n  /**\n   * Config-as-code named lenses (EC-246b) the header view selector switches\n   * between. Optional: a source that declares no named views (a non-CMS rail\n   * like users) omits it, and the selector renders nothing (single default).\n   */\n  readonly views?: NamedViewsCapability\n  /**\n   * `importExport` — JSON round-trip of the collection's records. CMS-specific;\n   * a rail whose records are credential-bearing (users) omits it, so neither the\n   * import dialog nor the export action mounts (identities aren't dumped to JSON).\n   */\n  readonly imports?: ImportCapability\n}\n\n/** EC-595 A2 — the write model of a source (see {@link CollectionViewSource.writes}). */\nexport type CollectionWrites = RecordWrites | DocumentWrites\n\n/** An explicit-save rail: the editor's Save button writes the whole record. */\nexport interface RecordWrites {\n  readonly kind: 'record'\n  save(doc: CmsDocument): void\n}\n\n/**\n * The revisioned-document write model (EC-595, ratified 2026-10-24): patches at the\n * source, the persister's queue, per-field conflicts, the document subscription.\n */\nexport interface DocumentWrites {\n  readonly kind: 'document'\n  /**\n   * Commit the patches a writer made; resolves once acknowledged (`undefined` in a\n   * fixture session). `bases` — per patch, the revision the edit was started at.\n   */\n  commit(\n    ref: DocumentRef,\n    patches: readonly DocumentPatch[],\n    bases?: readonly (number | undefined)[],\n  ): Promise<CommitOutcome | undefined>\n  /** The revision the session's view of a document is at. */\n  revisionOf(ref: DocumentRef): number | undefined\n  /** Create a document from a whole value (insert-if-absent): duplicate. */\n  insert(doc: CmsDocument): void\n  /** A fresh document id from the session's injected factory (EC-578). */\n  newId(): string\n  /** The open per-field conflicts on a document. */\n  conflicts(ref: DocumentRef): readonly DocumentConflict[]\n  resolveConflict(ref: DocumentRef, conflictId: string, choice: 'theirs' | 'mine'): void\n  /** Adopt a row the document subscription pushed (local edits win on their paths until flushed). */\n  adoptSnapshot(ref: DocumentRef, record: CmsDocumentRecord | undefined): void\n  /** The forced flush's persistence half: await every queued write of the document. */\n  flush(ref: DocumentRef): Promise<void>\n  /**\n   * Write the whole document at the revision the session holds (a document-level key\n   * the value-position grammar has no position for — the slot `alias`). A move since\n   * is refused, never overwritten.\n   */\n  replace(doc: CmsDocument): void\n  /**\n   * EC-595 point 7 — follow ONE document while it is open: every pushed row is adopted\n   * under the local edits (the editor rebases), and the presence on it is delivered to\n   * `onPresence`. Returns the unsubscribe function.\n   */\n  subscribe(ref: DocumentRef, onPresence: (presence: readonly PresenceEntry[]) => void): () => void\n  /** Thin presence (Stage A): this session is on the document, in `path`'s field (or on no field). */\n  reportPresence(ref: DocumentRef, path: ValuePath | undefined): void\n  /** This session left the document. */\n  clearPresence(ref: DocumentRef): void\n  /** This session's presence id (one per tab), so the editor can leave itself out. */\n  readonly presenceSessionId: string\n}\n\n/**\n * The capability matrix. Each flag gates a shell region AND the presence of its\n * method group. The **users rail** (EC-240) sets `publish:false`, `versions:false`\n * (credential caution), `create:false` (identity minted by sign-up), and no\n * `liveUrl`/`hierarchy`.\n */\nexport interface CollectionViewCapabilities {\n  readonly publish: boolean\n  readonly versions: boolean\n  readonly locales: boolean\n  readonly inlineEdit: boolean\n  readonly create: boolean\n  /**\n   * Duplicate-document action (EC-442, amended same day). Deliberately its own\n   * flag, never derived from `create`: the owner call (2026-07-17) is CMS\n   * collections ONLY — no primitive rail offers Duplicate for now (identities\n   * and uploads aren't copyable content; redirects deferred until requested as\n   * a product feature).\n   */\n  readonly duplicate: boolean\n  readonly remove: boolean\n  readonly bulk: boolean\n  /** The derived live-URL column (published pool × deployment routes). */\n  readonly liveUrl: boolean\n  /** Parent-self-relation tree mode (hierarchical collections only). */\n  readonly hierarchy: boolean\n  /** JSON import/export of the collection's records (off for credential rails). */\n  readonly importExport: boolean\n  /**\n   * The rail is administration-scoped (mirrors `ADMIN_ONLY_OPERATIONS`). The\n   * nav-permission layer reads this to gate the rail item. Absent ⇒ not admin-only.\n   */\n  readonly adminOnly?: boolean\n}\n\n/**\n * Principal-based field access (EC-240, AD-18). One tri-state drives BOTH visibility\n * and writability: `edit` (writable), `read` (visible, read-only), `hidden` (not\n * rendered). Default `edit` (default-open). Distinct from content-`hidden(values)`;\n * they compose — a field shows iff *not content-hidden AND access ≠ hidden*, and is\n * editable iff *access = edit AND not otherwise read-only* (published view, `form.readOnly`).\n */\nexport type FieldAccess = 'edit' | 'read' | 'hidden'\n\n/**\n * Resolve a field's effective principal access for a source — its {@link\n * CollectionViewSource.fieldAccess} policy when present, else derived from the\n * boolean `isFieldReadOnly` (default-open). The one place the shell asks \"may this\n * principal edit / see this field?\", so the default-open fallback lives in one spot.\n */\nexport function resolveFieldAccess(\n  source: CollectionViewSource,\n  field: FieldDef,\n  record?: CmsDocument,\n): FieldAccess {\n  return source.fieldAccess?.(field, record) ?? (source.isFieldReadOnly(field) ? 'read' : 'edit')\n}\n\n/**\n * Asset display metadata a cell/field renders (thumbnail or labelled badge). EC-587:\n * named apart from core's `ResolvedAsset` (the delivery shape) — this is the studio's\n * label/thumbnail slice; its `alt` is the one reader's (`assetAlt`).\n */\nexport interface AssetDisplay {\n  readonly url?: string\n  readonly contentType?: string\n  readonly title?: string\n  readonly filename?: string\n  readonly alt?: string\n}\n\n/** `publish` capability. */\nexport interface PublishingCapability {\n  /** Published-ness from the version pointer (NOT a row field). */\n  isPublished(ref: DocumentRef): boolean\n  /**\n   * Does this PUBLISHED document's working draft carry unpublished changes\n   * (EC-449)? The cheap per-row signal behind the amber \"changed\" `$state` dot —\n   * sourced from the MATERIALIZED `hasUnpublishedChanges` record flag (computed\n   * once at the write chokepoint), never a per-row snapshot compare. Optional: a\n   * source without the signal omits it, and the list derives only\n   * published/draft (exactly the pre-EC-449 rendering). Same referentially-stable\n   * per-ref accessor shape as {@link isPublished}.\n   */\n  hasUnpublishedChanges?(ref: DocumentRef): boolean\n  publish(ref: DocumentRef): Promise<void>\n  unpublish(ref: DocumentRef): Promise<void>\n  /**\n   * Live URLs for the routable documents, keyed by id — derived from the\n   * PUBLISHED pool (never draft rows) so an unpublished slug/parent edit can't\n   * leak into a live link (EC-205/EC-216). `null` when the collection is not\n   * routable → the live-URL column is hidden. Only present when `capabilities.liveUrl`.\n   */\n  liveUrls?(): Map<string, DocumentUrl> | null\n}\n\n/**\n * `timestamps` capability (EC-445/EC-447): per-document record timestamps as ISO\n * strings, or `undefined` when a document carries none. The `$updatedAt`/`$publishedAt`\n * pseudo-columns read + sort by these. `updatedAt` is the last-write instant;\n * `publishedAt` (EC-447) is the FIRST-publish instant — set-once on publish, cleared on\n * unpublish, so it is `undefined` for a draft / never-published / currently-unpublished\n * document (the column shows EmDash).\n */\nexport interface DocumentTimestampsCapability {\n  updatedAt(ref: DocumentRef): string | undefined\n  publishedAt(ref: DocumentRef): string | undefined\n}\n\n/**\n * The reserved pseudo-columns applicable to a source's list (EC-445), derived from\n * its capabilities: `$updatedAt` iff it materializes timestamps, `$state` iff it has a\n * publish lifecycle, `$url` iff it resolves delivery URLs. The one place the list\n * surface + the Display picker agree on which pseudo-columns exist for a source, so\n * the column universe never drifts between where columns render and where they toggle.\n */\nexport function pseudoColumnsForSource(source: CollectionViewSource): string[] {\n  return pseudoColumns(source.schema, {\n    timestamps: source.timestamps !== undefined,\n    publishing: source.publishing !== undefined,\n    routable: source.capabilities.liveUrl,\n  })\n}\n\n/** `versions` capability. */\nexport interface VersioningCapability {\n  restore(ref: DocumentRef, version: number, scope?: RestoreScope): Promise<CmsDocument | null>\n  /**\n   * The document's recorded version history + live pin. Folds the flush-before-read\n   * ordering INTO the loader (the adapter's concern), so every fetch lists an\n   * authoritative history regardless of which surface triggered the change (EC-224).\n   */\n  load(ref: DocumentRef): Promise<DocumentVersionsView>\n}\n\n/** `inlineEdit` capability: the list's single-command optimistic cell write (EC-168). */\nexport interface InlineEditCapability {\n  commitField(input: CellCommitInput): Promise<CellCommitOutcome>\n}\n\n/** A named lens the header selector offers — id + display name only (the header never needs its state). */\nexport interface NamedView {\n  readonly id: string\n  /** Display name; a {@link LocalizedString} (EC-343), resolved at the render site like `form.label`. */\n  readonly name: LocalizedString\n}\n\n/** `importExport` capability: validate + fold external JSON records into the collection (EC-079). */\nexport interface ImportCapability {\n  importDocuments(items: unknown[]): ImportReport\n}\n\n/**\n * `views` capability: config-as-code named lenses (EC-246b). The header selector\n * only *picks* a lens — it never creates/edits/deletes one (shared views are code).\n */\nexport interface NamedViewsCapability {\n  /** The built-in default + config-declared named views. */\n  list(): readonly NamedView[]\n  /** The currently-selected view id. */\n  activeId(): string\n  /** Switch views (resets the working table state to the view's baseline). */\n  setActive(id: string): void\n}\n\nexport type { CellCommitInput, CellCommitOutcome, ImportReport }\n"]}

package/dist/lib/data/collection-content.js

@@ -149,7 +149,7 @@ export function withPlaygroundFilterable(collections) {
 }
 /**
  * Synthesize the persistence-shaped asset record the asset resolver reads. EC-580:
- * the record's single `alt` is the DEFAULT locale's displayed value
+ * the record's single alt (`meta.alt`, EC-587) is the DEFAULT locale's displayed value
  * (`valuesInLocale`, the project's config default) — it used to read
  * `localized.en.alt` whatever the project's locales were (MODE F5b, "further
  * evidence"), so a `de`-default project's previews had no alt and a shared `alt`
@@ -167,7 +167,8 @@ function assetRecordOf(doc, collection, locales) {
         filename: typeof values.filename === 'string' ? values.filename : doc.id,
         contentType: 'image/png',
         byteSize: 0,
-        alt: typeof alt === 'string' ? alt : undefined,
+        // EC-587: an asset's alt lives in `meta` (its one home), never the legacy column.
+        ...(typeof alt === 'string' ? { meta: { alt } } : {}),
         storageKey: typeof values.url === 'string' ? values.url : doc.id,
         createdAt: '2026-01-01T00:00:00.000Z',
         updatedAt: '2026-01-01T00:00:00.000Z',

package/dist/lib/data/collection-content.js.map

@@ -1 +1 @@
-{"version":3,"file":"collection-content.js","sourceRoot":"","sources":["../../../src/lib/data/collection-content.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,aAAa,GACd,MAAM,yBAAyB,CAAA;AAWhC,OAAO,EACL,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,cAAc,GACf,MAAM,0BAA0B,CAAA;AAYjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AAGnE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAwE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,EAAE,CAAA;AAEjE,IAAI,cAAc,GAA+B,IAAI,CAAA;AACrD,IAAI,MAAM,GAAkB,YAAY,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AACvE,iFAAiF;AACjF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;AAEhD,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,sFAAsF;AACtF,6BAA6B;AAC7B,IAAI,YAAY,GAAG,CAAC,CAAA;AACpB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAc,CAAA;AAE9C,oFAAoF;AACpF,MAAM,UAAU,mBAAmB;IACjC,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAoB;IAC1D,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,OAAO,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAgC;IACtE,cAAc,GAAG,IAAI,CAAA;IACrB,MAAM,GAAG,IAAI;QACX,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;QACpG,CAAC,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/C,OAAO,CAAC,KAAK,EAAE,CAAA;IACf,YAAY,IAAI,CAAC,CAAA;IACjB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,gBAAgB,CAAC;QAAE,QAAQ,EAAE,CAAA;AAC1D,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,KAAK,IAAI,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,GAAkC,EAAE,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,cAAc,EAAE,OAAO,IAAI,UAAU,CAAA;AAC9C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,2BAA2B;IACzC,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,WAAW,IAAI,qBAAqB,CAAA;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB;;;;;;GAMG;AACH,SAAS,aAAa;IACpB,OAAO,eAAe,EAAE,IAAI,cAAc,EAAE,YAAY,EAAE,OAAO,IAAI,SAAS,CAAA;AAChF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,cAAc,EAAE,YAAY,IAAI,qBAAqB,EAAE,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;IACpE,OAAO,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,OAAO,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAqC;IAErC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACpC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;YAAE,OAAO,UAAU,CAAA;QACnF,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QACvD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,UAAU,CAAA;QAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC3F,CAAA;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,UAAU,CAAA;QACzC,OAAO;YACL,GAAG,UAAU;YACb,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CACjE;SACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,GAAgB,EAChB,UAAqC,EACrC,OAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;IACzB,MAAM,GAAG,GACP,UAAU,IAAI,OAAO;QACnB,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG;QAC/D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;IAChB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QACxE,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,CAAC;QACX,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAC9C,UAAU,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAChE,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,0BAA0B;KACtC,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CACnB,cAAwC,EACxC,SAAiC,EACjC,aAAiC,EACjC,YAAqC,EACrC,OAAsB;IAEtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/D,MAAM,QAAQ,GAAG,CAAC,GAAgB,EAAyB,EAAE;QAC3D,IAAI,CAAC,SAAS;YAAE,OAAO,GAAG,CAAA;QAC1B,OAAO,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACxD,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAU,CAAC,CAChF,CAAA;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,YAAY,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACtE,OAAO;QACL,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3D,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE,CAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1E,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,uEAAuE;QACvE,4EAA4E;QAC5E,kFAAkF;QAClF,0EAA0E;QAC1E,iDAAiD;QACjD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,UAAU;KACnD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,cAA2B,WAAW;IACvE,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC1C,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,mCAAmC;IACnC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC;QACjC,MAAM;QACN,OAAO,EAAE,oBAAoB,CAAC;YAC5B,MAAM;YACN,WAAW;YACX,OAAO;SACR,CAAC;QACF,8EAA8E;QAC9E,0CAA0C;QAC1C,MAAM,EAAE,cAAc,EAAE,MAAM,IAAI,EAAE;KACrC,CAAC,CAAA;IACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACxB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,QAA4B,EAAE,EAC9B,SAAiB,aAAa,EAAE;IAEhC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AAC7D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAgB,EAChB,SAAiB,aAAa,EAAE;IAEhC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAgB,EAChB,SAAiB,aAAa,EAAE,EAChC,cAA2B,WAAW;IAEtC,OAAO,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED,4FAA4F;AAC5F,MAAM,WAAW,GAAU,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAEzD;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAmB,EAAE,KAAY;IAC7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC9C,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAoC;QACnD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAmB,EACnB,SAAiB,aAAa,EAAE,EAChC,cAA2B,WAAW,EACtC,QAAe,WAAW;IAE1B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,aAAa,CACzD,KAAK,CAAC,UAAU,EAChB,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CACnC,CAAA;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAmB,EACnB,QAAe,WAAW;IAE1B,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,UAAU,CACR,oBAAoB,EACpB,eAAe,KAAK,CAAC,UAAU,mBAAmB,EAClD,CAAC,YAAY,CAAC,EACd,SAAS,EACT,EAAE,GAAG,EAAE,sCAAsC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CACxF;SACF,CAAA;IACH,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAClD,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAgB,EAChB,SAAiB,aAAa,EAAE,EAChC,cAA2B,WAAW;IAEtC,OAAO,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;AACxD,CAAC;AAQD,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,UAAU,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,CAAA;IACzB,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;KAC3E,CAAC,CAAC,CAAA;AACL,CAAC","sourcesContent":["import {\n  createContentClient,\n  createContentContext,\n  queryError,\n  validateLimit,\n  validateSort,\n  validateWhere,\n} from '@elytracms/core/content'\nimport type {\n  ContentClient,\n  ContentDocumentSource,\n  ContentLookup,\n  ContentQueryError,\n  GetDocumentResult,\n  ListDocumentsQuery,\n  ListDocumentsResult,\n  ResolvedDocument,\n} from '@elytracms/core/content'\nimport {\n  documentKey,\n  localeSchema,\n  parseLocaleConfig,\n  perspectiveKey,\n  resolveDocumentTitle,\n  valuesInLocale,\n} from '@elytracms/core/cms-core'\nimport type {\n  CmsDocument,\n  CollectionDef,\n  DocumentRef,\n  Locale,\n  LocaleConfig,\n  OrphanedCollection,\n  Perspective,\n  RouteRecord,\n} from '@elytracms/core/cms-core'\nimport type { AssetRecord } from '@elytracms/core/persistence'\nimport { listingRequestOf } from '@elytracms/core/runtime-renderer'\nimport type { ListingQuery } from '@elytracms/core/runtime-renderer'\nimport type { Clock } from '@elytracms/core/determinism'\nimport { getStudioLocale, getStudioLocaleConfig } from '../locale/locale-store'\n\n/**\n * The studio's content delivery engine for canvas previews (EC-166).\n *\n * Repeating sections and template pages preview *delivery-shaped* documents —\n * the exact shape `@elytracms/core/content` serves in production — so the canvas\n * shows what publishing will show. This module wires the canonical content\n * client (closed AD-3 query vocabulary, published perspective, EC-018 locale\n * fallback, depth-1 population, resolved assets) over a **content session**:\n *\n * - Convex mode: the project-session gate (`components/studio/project-session`)\n *   configures the session with the project's HYDRATED schema + documents, so\n *   \"Preview with\" lists and section previews show the live content — never\n *   fixture titles (EC-177 gap 1).\n * - Playground mode (EC-361): the SAME hydration loader runs over the seeded\n *   in-memory adapter (through operations — AD-17), so canvas listing/relation\n *   population resolves from the in-memory session documents with identical\n *   semantics. With no session configured (tests, boot instants, no persisted\n *   content) the engine serves nothing.\n *\n * Nothing here invents query semantics; both modes go through the same\n * canonical client.\n */\n\n/** The schema + documents the preview engine serves (one project session). */\nexport interface ContentSessionState {\n  collections: readonly CollectionDef[]\n  documents: readonly CmsDocument[]\n  /**\n   * Published document keys via the version POINTER (EC-224). When present, the\n   * preview's published perspective resolves by the pin — never the flat\n   * `state` enum — so it matches what delivery serves. Absent (playground\n   * fixtures / tests) → the rows' own `state` gates the perspective, unchanged.\n   */\n  publishedKeys?: readonly string[]\n  /**\n   * Locale config of the session content — the project's own, composed by\n   * `contentSessionOf` from `elytra.config.ts`. Absent (a kit session, tests) →\n   * the ambient studio config, then the single locale being asked for; EC-479\n   * retired the engine's `sampleLocaleConfig` fallback here.\n   */\n  localeConfig?: LocaleConfig\n  /**\n   * The project's config-sourced routes (EC-207). Wired into the content client so\n   * the canvas preview's `resolveLink` (EC-291) derives a rich-text link's URL from\n   * the SAME routes delivery serves — the studio-live half of the host link bake.\n   * Absent (playground/tests) → no routes, so `resolveLink` returns null and a\n   * reference link degrades to the visible `unresolved-ref` issue.\n   */\n  routes?: readonly RouteRecord[]\n  /**\n   * The project's asset records (assets table). Wired into the lookup so the\n   * content client resolves `asset`-typed FIELDS on listing/relation results\n   * (e.g. a ProductGrid product's `gallery`) to delivery shape — the same assets\n   * the renderer's `resolveAsset` reads for static props (EC-262). Absent\n   * (playground/tests) → assets come only from `asset`-collection fixture docs.\n   */\n  assets?: readonly AssetRecord[]\n  /**\n   * EC-606 — the stored rows the session does NOT serve: per undeclared collection,\n   * how many rows and how many published (`HydratedCms.orphans`, carried here by\n   * `contentSessionOf`'s spread). The preview engine never reads it. It rides this\n   * session because this is the one hydrated-content channel that reaches the\n   * section rail in both modes: the rail renders outside `ProjectSessionProvider`,\n   * so it cannot read the project session context, and a second documents query\n   * would be a parallel data flow (AD-17). Read via {@link contentSessionOrphans}.\n   * Absent (a kit session, tests) → none.\n   */\n  orphans?: readonly OrphanedCollection[]\n}\n\n/**\n * Default (no-session) collection schema: EMPTY. The studio ships no demo content\n * (Oli, 2026-06-19) — with no backend/content session configured, there is nothing\n * to preview, and the studio says so rather than serving fixtures. A real project's\n * collections + documents arrive via {@link configureContentSession} in BOTH modes\n * (EC-361): Convex hydration, or the playground's seeded in-memory adapter through\n * the same loader.\n */\nexport const playgroundCollections: readonly CollectionDef[] = []\n\nlet contentSession: ContentSessionState | null = null\nlet lookup: ContentLookup = createLookup(playgroundCollections, [], [])\n// Keyed by locale + perspective (EC-300) + the resolved locale CONFIG (EC-479) —\n// one deterministic client per distinct resolution context. See `clientFor`.\nconst clients = new Map<string, ContentClient>()\n\n// EC-460: a monotonically increasing session epoch + listener set, so a REACT\n// surface (the canvas render context) can re-render when the session is\n// re-pointed at fresher content. The session itself stays a module global (the\n// EC-361 design); this only makes \"it changed\" observable — `configureContentSession`\n// remains the single setter.\nlet sessionEpoch = 0\nconst sessionListeners = new Set<() => void>()\n\n/** The current content-session epoch — bumps on every `configureContentSession`. */\nexport function contentSessionEpoch(): number {\n  return sessionEpoch\n}\n\n/**\n * Subscribe to content-session swaps (EC-460). The listener fires after every\n * `configureContentSession`; returns the unsubscribe. Shaped for\n * `useSyncExternalStore(subscribeContentSession, contentSessionEpoch)`.\n */\nexport function subscribeContentSession(listener: () => void): () => void {\n  sessionListeners.add(listener)\n  return () => sessionListeners.delete(listener)\n}\n\n/**\n * Point the preview engine at a project's hydrated content — Convex hydration\n * or the playground's in-memory persisted state (EC-361), both through the same\n * `loadHydratedCms` loader — or back at the empty no-session default (`null`).\n */\nexport function configureContentSession(next: ContentSessionState | null): void {\n  contentSession = next\n  lookup = next\n    ? createLookup(next.collections, next.documents, next.publishedKeys, next.assets, next.localeConfig)\n    : createLookup(playgroundCollections, [], [])\n  clients.clear()\n  sessionEpoch += 1\n  for (const listener of [...sessionListeners]) listener()\n}\n\n/** Whether a hydrated content session is configured (Convex mode). */\nexport function hasContentSession(): boolean {\n  return contentSession !== null\n}\n\nconst NO_ORPHANS: readonly OrphanedCollection[] = []\n\n/**\n * The active session's orphaned collections (EC-606), or an empty list with no\n * session. Referentially stable between `configureContentSession` calls (the\n * session's own array, or one shared empty constant), so it is a valid\n * `useSyncExternalStore(subscribeContentSession, contentSessionOrphans, …)`\n * snapshot — the rail foot reads it exactly that way.\n */\nexport function contentSessionOrphans(): readonly OrphanedCollection[] {\n  return contentSession?.orphans ?? NO_ORPHANS\n}\n\n/** The server snapshot for {@link contentSessionOrphans}: no session exists during SSR. */\nexport function serverContentSessionOrphans(): readonly OrphanedCollection[] {\n  return NO_ORPHANS\n}\n\n/** The collections the preview engine currently serves (session or fixtures). */\nfunction activeCollections(): readonly CollectionDef[] {\n  return contentSession?.collections ?? playgroundCollections\n}\n\n/**\n * The sentinel {@link previewLocale} yields when NOTHING has declared a locale —\n * no ambient studio config, no content session. It is not a locale code and\n * matches no stored key, which is the point: with no session the lookup is empty\n * (`playgroundCollections` is `[]`), so every query already resolves to nothing\n * and this only fills `CacheTags.locale`, which no studio surface reads. EC-479:\n * the engine used to answer this question with its `sampleLocaleConfig` fixture's\n * `en` — a locale nobody chose, standing in for the project's own.\n */\nconst NO_LOCALE = ''\n\n/**\n * The locale a canvas preview resolves in, when the caller names none: the\n * ambient studio locale (installed from the PROJECT's config by `CmsProvider`),\n * else the active content session's own declared default (surfaces that render\n * outside a CMS session — the Components view's previews — still resolve in the\n * project's locale), else {@link NO_LOCALE}. Never an engine fixture.\n */\nfunction previewLocale(): Locale {\n  return getStudioLocale() ?? contentSession?.localeConfig?.default ?? NO_LOCALE\n}\n\n/**\n * The locale set a preview resolves fallbacks against (EC-018): the session's own\n * declaration, else the ambient studio config (the project's, via `elytra.config.ts`),\n * else the single locale actually being asked for.\n *\n * That last step is a DERIVATION, not an invention — it says \"the only locale we\n * know of is the one you named\", so the default-locale fallback is the requested\n * locale itself (a no-op) and a localized read falls through to `doc.values`.\n * Before EC-479 this line read `?? sampleLocaleConfig`, which silently declared\n * every locale-less studio bilingual `en/de` and resolved fallbacks through an `en`\n * no project had chosen. Only reached with no session AND no installed config, so\n * no stored key is ever written against it.\n */\nfunction activeLocaleConfig(locale: Locale): LocaleConfig {\n  return contentSession?.localeConfig ?? getStudioLocaleConfig() ?? requestedLocaleOnly(locale)\n}\n\n/**\n * The single-locale derivation above, through the one constructor (EC-580:\n * `LocaleConfig` is parse-only). {@link NO_LOCALE} — or anything else that is not\n * a locale code — becomes `und`, BCP 47's own \"undetermined\", which likewise\n * matches no stored key.\n */\nfunction requestedLocaleOnly(locale: Locale): LocaleConfig {\n  const code = localeSchema.safeParse(locale).success ? locale : 'und'\n  return parseLocaleConfig({ default: code, locales: [code] })\n}\n\n/** Resolve a collection in the active content session (fixtures in playground). */\nexport function playgroundCollection(id: string): CollectionDef | undefined {\n  return activeCollections().find((collection) => collection.id === id)\n}\n\n/**\n * Overlay the active session's canonical `filterable` declarations onto a\n * schema that doesn't carry any of its own. The inspector hands the Content\n * tab fixture collection defs; the filter/sort pickers must offer exactly the\n * EC-143 declaration set the delivery engine enforces, so both ends agree. A\n * collection that declares its own filterable fields is left untouched.\n */\nexport function withPlaygroundFilterable(\n  collections: readonly CollectionDef[],\n): readonly CollectionDef[] {\n  return collections.map((collection) => {\n    if (collection.fields.some((field) => field.filterable === true)) return collection\n    const counterpart = playgroundCollection(collection.id)\n    if (counterpart === undefined) return collection\n    const flagged = new Set(\n      counterpart.fields.filter((field) => field.filterable === true).map((field) => field.name),\n    )\n    if (flagged.size === 0) return collection\n    return {\n      ...collection,\n      fields: collection.fields.map((field) =>\n        flagged.has(field.name) ? { ...field, filterable: true } : field,\n      ),\n    }\n  })\n}\n\n/**\n * Synthesize the persistence-shaped asset record the asset resolver reads. EC-580:\n * the record's single `alt` is the DEFAULT locale's displayed value\n * (`valuesInLocale`, the project's config default) — it used to read\n * `localized.en.alt` whatever the project's locales were (MODE F5b, \"further\n * evidence\"), so a `de`-default project's previews had no alt and a shared `alt`\n * was never read. Without a locale model (no session config) only the shared bag\n * can be read.\n */\nfunction assetRecordOf(\n  doc: CmsDocument,\n  collection: CollectionDef | undefined,\n  locales: LocaleConfig | undefined,\n): AssetRecord {\n  const values = doc.values\n  const alt =\n    collection && locales\n      ? valuesInLocale(collection, doc, locales.default, locales).alt\n      : values.alt\n  return {\n    id: doc.id,\n    projectId: 'playground',\n    filename: typeof values.filename === 'string' ? values.filename : doc.id,\n    contentType: 'image/png',\n    byteSize: 0,\n    alt: typeof alt === 'string' ? alt : undefined,\n    storageKey: typeof values.url === 'string' ? values.url : doc.id,\n    createdAt: '2026-01-01T00:00:00.000Z',\n    updatedAt: '2026-01-01T00:00:00.000Z',\n  }\n}\n\nfunction createLookup(\n  collectionDefs: readonly CollectionDef[],\n  documents: readonly CmsDocument[],\n  publishedKeys?: readonly string[],\n  assetRecords?: readonly AssetRecord[],\n  locales?: LocaleConfig,\n): ContentLookup {\n  const collections = new Map(collectionDefs.map((c) => [c.id, c]))\n  // EC-224: published-ness is the version POINTER, not the flat `state` enum.\n  // A hydrated session hands `publishedKeys` (the pinned set) → wrap each row as\n  // a `DocumentHistory` so the published perspective resolves by the pin (the\n  // live row is always a draft now) with ZERO dependence on `state`. Without a\n  // pointer set (playground fixtures / tests) we keep bare rows, whose own\n  // `state` gates the published perspective — byte-identical to before.\n  const published = publishedKeys ? new Set(publishedKeys) : null\n  const toSource = (doc: CmsDocument): ContentDocumentSource => {\n    if (!published) return doc\n    return published.has(documentKey({ collection: doc.collection, id: doc.id }))\n      ? { draft: doc, published: doc, versions: [] }\n      : { draft: doc, published: undefined, versions: [] }\n  }\n  const byKey = new Map(\n    documents.map((doc) => [`${doc.collection}:${doc.id}`, toSource(doc)] as const),\n  )\n  // Asset resolution source for `asset`-typed FIELDS on resolved documents\n  // (listing/relation results, e.g. a product's `gallery`). Two sources, real\n  // records last so they win: (1) `asset`-collection fixture documents — how\n  // playground/tests model assets; (2) the project's real asset-table records\n  // (EC-262) — a Convex session has its assets here, NOT as `asset` documents,\n  // so without these the content client resolves no nested image.\n  const assets = new Map<string, AssetRecord>()\n  for (const doc of documents) {\n    if (doc.collection === 'asset') {\n      assets.set(doc.id, assetRecordOf(doc, collections.get(doc.collection), locales))\n    }\n  }\n  for (const record of assetRecords ?? []) assets.set(record.id, record)\n  return {\n    collection: (id) => collections.get(id),\n    document: (ref) => byKey.get(`${ref.collection}:${ref.id}`),\n    documents: (collectionId) =>\n      documents.filter((doc) => doc.collection === collectionId).map(toSource),\n    asset: (id) => assets.get(id),\n    // Prefer the record's resolved servable `url` — the one the renderer's\n    // resolveAsset reads (EC-262). Real asset-table records carry a Convex blob\n    // locator in `storageKey` and the servable URL in `url`; fixture/`asset`-document\n    // records (assetRecordOf) leave `url` unset and store the servable url in\n    // `storageKey`. Falling back keeps both correct.\n    assetUrl: (asset) => asset.url ?? asset.storageKey,\n  }\n}\n\n/**\n * One deterministic client per (locale, perspective): EC-018 locale fallback,\n * draft-or-published perspective (EC-300/AD-16, default `'published'`). The canvas is\n * draft-coherent: the editable Draft view resolves references against the draft\n * perspective (`DRAFT_PERSPECTIVE` — a just-made reusable shows immediately), the\n * read-only Published view against `'published'` (an honest preview of what delivery\n * serves; an unpublished hard ref shows the in-canvas placeholder). Delivery stays\n * published-only — this does not weaken `live-is-published-only`. The studio's\n * ambient active locale (EC-176, `lib/locale`) picks the locale at query time, so the\n * canvas previews follow the locale switcher exactly like delivery would; the canvas's\n * Draft/Published view picks the perspective. The cache resets whenever the content\n * session changes.\n */\nfunction clientFor(locale: Locale, perspective: Perspective = 'published'): ContentClient {\n  const locales = activeLocaleConfig(locale)\n  // EC-479: the locale CONFIG is part of the client's identity now — it may come\n  // from the ambient studio store, which changes independently of the session the\n  // cache is cleared on, so keying by locale alone could serve a client built\n  // against a superseded locale set.\n  const key = `${locale}:${perspectiveKey(perspective)}:${locales.default}|${locales.locales.join(',')}`\n  const existing = clients.get(key)\n  if (existing) return existing\n  const client = createContentClient({\n    lookup,\n    context: createContentContext({\n      locale,\n      perspective,\n      locales,\n    }),\n    // EC-291: the routes a rich-text link resolves against (config-sourced) — the\n    // studio-live half of the host link bake.\n    routes: contentSession?.routes ?? [],\n  })\n  clients.set(key, client)\n  return client\n}\n\n/**\n * Run a closed-vocabulary list query (AD-3: eq/in/lt/lte/gt/gte, AND-only,\n * filterable fields only) and return the delivery-shaped result. Invalid\n * queries come back as structured errors — never thrown, never silently\n * widened. Resolves in the studio's active locale unless one is passed.\n */\nexport function runCollectionListQuery(\n  collectionId: string,\n  query: ListDocumentsQuery = {},\n  locale: Locale = previewLocale(),\n): ListDocumentsResult {\n  return clientFor(locale).listDocuments(collectionId, query)\n}\n\n/** Resolve one document (by id or slug) into delivery shape. */\nexport function getCollectionDocument(\n  collectionId: string,\n  idOrSlug: string,\n  locale: Locale = previewLocale(),\n): GetDocumentResult {\n  return clientFor(locale).getDocument(collectionId, idOrSlug)\n}\n\n/**\n * Populate a composition-node `relation` prop to delivery shape for the canvas\n * (EC-254) — the studio analog of the host's baked relations map. Resolves the\n * ref through the active session's client (published perspective, active locale),\n * so the canvas previews a block's picked documents (a ProductGrid's products, a\n * Reusable's element) exactly as delivery renders them. `null` when the target is\n * missing or not visible → the block degrades to its own empty state.\n */\nexport function resolveCanvasRelation(\n  ref: DocumentRef,\n  locale: Locale = previewLocale(),\n  perspective: Perspective = 'published',\n): ResolvedDocument | null {\n  return clientFor(locale, perspective).resolveRelation(ref)\n}\n\n/** The real clock — the canvas boundary's default; tests inject a fixed one (EC-581 6a). */\nconst systemClock: Clock = () => new Date().toISOString()\n\n/**\n * A listing query as `listDocuments` input (EC-581 6a): executed through\n * `listingRequestOf` — the phase the delivery host runs too, so canvas and site\n * build the identical request — with `{ now: true }` read from `clock`. The\n * operands are JSON bound from authored props; the cast hands them to the one\n * validator (`validateWhere`/`validateLimit`), which reports anything invalid.\n */\nfunction listDocumentsQueryOf(query: ListingQuery, clock: Clock): ListDocumentsQuery {\n  const request = listingRequestOf(query, clock)\n  return {\n    where: request.where as ListDocumentsQuery['where'],\n    ...(request.sort ? { sort: request.sort } : {}),\n    ...(request.limit !== undefined ? { limit: request.limit as number } : {}),\n  }\n}\n\n/**\n * Resolve a listing block's query to its documents for the canvas (EC-255) — the\n * studio analog of the host's baked listings map. Runs the query (collection +\n * AND-only `where`, optional sort/limit; EC-581 6a: `now` read from `clock`)\n * through the active session's client (published perspective, active locale), so\n * the canvas previews a dynamic grid (a ProductGrid keyed to a category) exactly as\n * delivery renders it. An invalid query (structured, never thrown) or a non-list\n * lookup yields `[]` → the block's empty state, and the canvas notice\n * ({@link validateCanvasListingQuery}) says why. Reuses the same `listDocuments`\n * path as `runCollectionListQuery`.\n */\nexport function resolveCanvasListing(\n  query: ListingQuery,\n  locale: Locale = previewLocale(),\n  perspective: Perspective = 'published',\n  clock: Clock = systemClock,\n): ResolvedDocument[] {\n  const result = clientFor(locale, perspective).listDocuments(\n    query.collection,\n    listDocumentsQueryOf(query, clock),\n  )\n  return result.ok ? result.documents : []\n}\n\n/**\n * Statically validate a listing block's query against the ACTIVE session schema\n * (EC-460, the never-silent rule): the exact `validateWhere`/`validateSort`/\n * `validateLimit` checks `listDocuments` runs, WITHOUT executing the query — so\n * the canvas can surface a config-invalid listing (a filter/sort field the\n * collection doesn't declare `filterable`, an unknown collection) as a visible\n * notice instead of the block's indistinguishable empty state. With no content\n * session configured (boot instants, fixtures) there is no schema to judge\n * against, so it reports nothing rather than false-flagging every listing.\n */\nexport function validateCanvasListingQuery(\n  query: ListingQuery,\n  clock: Clock = systemClock,\n): ContentQueryError[] {\n  if (contentSession === null) return []\n  const collection = playgroundCollection(query.collection)\n  if (!collection) {\n    return [\n      queryError(\n        'unknown-collection',\n        `Collection \"${query.collection}\" is not defined.`,\n        ['collection'],\n        undefined,\n        { key: 'content.queryError.unknownCollection', vars: { collection: query.collection } },\n      ),\n    ]\n  }\n  // EC-581 6a: judge the request the query EXECUTES as (`now` bound), with the\n  // same three validators `listDocuments` runs — notice and execution agree.\n  const request = listDocumentsQueryOf(query, clock)\n  return [\n    ...(request.where ? validateWhere(collection, request.where) : []),\n    ...(request.sort ? validateSort(collection, request.sort) : []),\n    ...(request.limit !== undefined ? validateLimit(request.limit) : []),\n  ]\n}\n\n/**\n * Resolve a rich-text internal link's target document to its URL path for the canvas\n * (EC-291) — the studio analog of the host's baked links map. Derives the URL through\n * the active session's client (published perspective, active locale, config-sourced\n * routes), so the canvas previews a `{type:'reference'}` link's `href` exactly as\n * delivery serves it. `null` when the target is unpublished, missing, or addressed by\n * no route → the rich-text renderer shows the EC-290 `unresolved-ref` issue. Reuses\n * the same `resolveLink` path as the host bake, so both agree on the derived URL.\n */\nexport function resolveCanvasLink(\n  ref: DocumentRef,\n  locale: Locale = previewLocale(),\n  perspective: Perspective = 'published',\n): string | null {\n  return clientFor(locale, perspective).resolveLink(ref)\n}\n\n/** A pickable entry of a collection (the template-page preview switcher). */\nexport interface CollectionEntrySummary {\n  id: string\n  label: string\n}\n\n/** Published entries of a collection, labeled by the schema's title field. */\nexport function listCollectionEntries(collectionId: string): CollectionEntrySummary[] {\n  const collection = playgroundCollection(collectionId)\n  const result = runCollectionListQuery(collectionId)\n  if (!result.ok) return []\n  // EC-242: label via the shared identity resolver (string `titleField` or a\n  // function pattern), over the delivery-shape values; falls back to the id.\n  return result.documents.map((doc) => ({\n    id: doc.id,\n    label: collection ? resolveDocumentTitle(collection, doc, doc.id) : doc.id,\n  }))\n}\n"]}
+{"version":3,"file":"collection-content.js","sourceRoot":"","sources":["../../../src/lib/data/collection-content.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,aAAa,GACd,MAAM,yBAAyB,CAAA;AAWhC,OAAO,EACL,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,oBAAoB,EACpB,cAAc,GACf,MAAM,0BAA0B,CAAA;AAYjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AAGnE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAwE/E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAA6B,EAAE,CAAA;AAEjE,IAAI,cAAc,GAA+B,IAAI,CAAA;AACrD,IAAI,MAAM,GAAkB,YAAY,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;AACvE,iFAAiF;AACjF,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;AAEhD,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,sFAAsF;AACtF,6BAA6B;AAC7B,IAAI,YAAY,GAAG,CAAC,CAAA;AACpB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAc,CAAA;AAE9C,oFAAoF;AACpF,MAAM,UAAU,mBAAmB;IACjC,OAAO,YAAY,CAAA;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAoB;IAC1D,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,OAAO,GAAG,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAgC;IACtE,cAAc,GAAG,IAAI,CAAA;IACrB,MAAM,GAAG,IAAI;QACX,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;QACpG,CAAC,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/C,OAAO,CAAC,KAAK,EAAE,CAAA;IACf,YAAY,IAAI,CAAC,CAAA;IACjB,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,gBAAgB,CAAC;QAAE,QAAQ,EAAE,CAAA;AAC1D,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,cAAc,KAAK,IAAI,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,GAAkC,EAAE,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,cAAc,EAAE,OAAO,IAAI,UAAU,CAAA;AAC9C,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,2BAA2B;IACzC,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,iFAAiF;AACjF,SAAS,iBAAiB;IACxB,OAAO,cAAc,EAAE,WAAW,IAAI,qBAAqB,CAAA;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,EAAE,CAAA;AAEpB;;;;;;GAMG;AACH,SAAS,aAAa;IACpB,OAAO,eAAe,EAAE,IAAI,cAAc,EAAE,YAAY,EAAE,OAAO,IAAI,SAAS,CAAA;AAChF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,cAAc,EAAE,YAAY,IAAI,qBAAqB,EAAE,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAA;AAC/F,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAA;IACpE,OAAO,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAAC,EAAU;IAC7C,OAAO,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAqC;IAErC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QACpC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;YAAE,OAAO,UAAU,CAAA;QACnF,MAAM,WAAW,GAAG,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;QACvD,IAAI,WAAW,KAAK,SAAS;YAAE,OAAO,UAAU,CAAA;QAChD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAC3F,CAAA;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,UAAU,CAAA;QACzC,OAAO;YACL,GAAG,UAAU;YACb,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CACjE;SACF,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CACpB,GAAgB,EAChB,UAAqC,EACrC,OAAiC;IAEjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;IACzB,MAAM,GAAG,GACP,UAAU,IAAI,OAAO;QACnB,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG;QAC/D,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;IAChB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QACxE,WAAW,EAAE,WAAW;QACxB,QAAQ,EAAE,CAAC;QACX,kFAAkF;QAClF,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,UAAU,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;QAChE,SAAS,EAAE,0BAA0B;QACrC,SAAS,EAAE,0BAA0B;KACtC,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CACnB,cAAwC,EACxC,SAAiC,EACjC,aAAiC,EACjC,YAAqC,EACrC,OAAsB;IAEtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC/D,MAAM,QAAQ,GAAG,CAAC,GAAgB,EAAyB,EAAE;QAC3D,IAAI,CAAC,SAAS;YAAE,OAAO,GAAG,CAAA;QAC1B,OAAO,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC9C,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IACxD,CAAC,CAAA;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAU,CAAC,CAChF,CAAA;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,gEAAgE;IAChE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QAClF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,YAAY,IAAI,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;IACtE,OAAO;QACL,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3D,SAAS,EAAE,CAAC,YAAY,EAAE,EAAE,CAC1B,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,YAAY,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1E,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,uEAAuE;QACvE,4EAA4E;QAC5E,kFAAkF;QAClF,0EAA0E;QAC1E,iDAAiD;QACjD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,UAAU;KACnD,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,cAA2B,WAAW;IACvE,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAA;IAC1C,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,mCAAmC;IACnC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;IACtG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAC7B,MAAM,MAAM,GAAG,mBAAmB,CAAC;QACjC,MAAM;QACN,OAAO,EAAE,oBAAoB,CAAC;YAC5B,MAAM;YACN,WAAW;YACX,OAAO;SACR,CAAC;QACF,8EAA8E;QAC9E,0CAA0C;QAC1C,MAAM,EAAE,cAAc,EAAE,MAAM,IAAI,EAAE;KACrC,CAAC,CAAA;IACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACxB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAoB,EACpB,QAA4B,EAAE,EAC9B,SAAiB,aAAa,EAAE;IAEhC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AAC7D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAgB,EAChB,SAAiB,aAAa,EAAE;IAEhC,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAgB,EAChB,SAAiB,aAAa,EAAE,EAChC,cAA2B,WAAW;IAEtC,OAAO,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;AAC5D,CAAC;AAED,4FAA4F;AAC5F,MAAM,WAAW,GAAU,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAEzD;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,KAAmB,EAAE,KAAY;IAC7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC9C,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAoC;QACnD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAmB,EACnB,SAAiB,aAAa,EAAE,EAChC,cAA2B,WAAW,EACtC,QAAe,WAAW;IAE1B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,aAAa,CACzD,KAAK,CAAC,UAAU,EAChB,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CACnC,CAAA;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAmB,EACnB,QAAe,WAAW;IAE1B,IAAI,cAAc,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,UAAU,CACR,oBAAoB,EACpB,eAAe,KAAK,CAAC,UAAU,mBAAmB,EAClD,CAAC,YAAY,CAAC,EACd,SAAS,EACT,EAAE,GAAG,EAAE,sCAAsC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,CACxF;SACF,CAAA;IACH,CAAC;IACD,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAClD,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrE,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAgB,EAChB,SAAiB,aAAa,EAAE,EAChC,cAA2B,WAAW;IAEtC,OAAO,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;AACxD,CAAC;AAQD,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,UAAU,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,CAAA;IACzB,2EAA2E;IAC3E,2EAA2E;IAC3E,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;KAC3E,CAAC,CAAC,CAAA;AACL,CAAC","sourcesContent":["import {\n  createContentClient,\n  createContentContext,\n  queryError,\n  validateLimit,\n  validateSort,\n  validateWhere,\n} from '@elytracms/core/content'\nimport type {\n  ContentClient,\n  ContentDocumentSource,\n  ContentLookup,\n  ContentQueryError,\n  GetDocumentResult,\n  ListDocumentsQuery,\n  ListDocumentsResult,\n  ResolvedDocument,\n} from '@elytracms/core/content'\nimport {\n  documentKey,\n  localeSchema,\n  parseLocaleConfig,\n  perspectiveKey,\n  resolveDocumentTitle,\n  valuesInLocale,\n} from '@elytracms/core/cms-core'\nimport type {\n  CmsDocument,\n  CollectionDef,\n  DocumentRef,\n  Locale,\n  LocaleConfig,\n  OrphanedCollection,\n  Perspective,\n  RouteRecord,\n} from '@elytracms/core/cms-core'\nimport type { AssetRecord } from '@elytracms/core/persistence'\nimport { listingRequestOf } from '@elytracms/core/runtime-renderer'\nimport type { ListingQuery } from '@elytracms/core/runtime-renderer'\nimport type { Clock } from '@elytracms/core/determinism'\nimport { getStudioLocale, getStudioLocaleConfig } from '../locale/locale-store'\n\n/**\n * The studio's content delivery engine for canvas previews (EC-166).\n *\n * Repeating sections and template pages preview *delivery-shaped* documents —\n * the exact shape `@elytracms/core/content` serves in production — so the canvas\n * shows what publishing will show. This module wires the canonical content\n * client (closed AD-3 query vocabulary, published perspective, EC-018 locale\n * fallback, depth-1 population, resolved assets) over a **content session**:\n *\n * - Convex mode: the project-session gate (`components/studio/project-session`)\n *   configures the session with the project's HYDRATED schema + documents, so\n *   \"Preview with\" lists and section previews show the live content — never\n *   fixture titles (EC-177 gap 1).\n * - Playground mode (EC-361): the SAME hydration loader runs over the seeded\n *   in-memory adapter (through operations — AD-17), so canvas listing/relation\n *   population resolves from the in-memory session documents with identical\n *   semantics. With no session configured (tests, boot instants, no persisted\n *   content) the engine serves nothing.\n *\n * Nothing here invents query semantics; both modes go through the same\n * canonical client.\n */\n\n/** The schema + documents the preview engine serves (one project session). */\nexport interface ContentSessionState {\n  collections: readonly CollectionDef[]\n  documents: readonly CmsDocument[]\n  /**\n   * Published document keys via the version POINTER (EC-224). When present, the\n   * preview's published perspective resolves by the pin — never the flat\n   * `state` enum — so it matches what delivery serves. Absent (playground\n   * fixtures / tests) → the rows' own `state` gates the perspective, unchanged.\n   */\n  publishedKeys?: readonly string[]\n  /**\n   * Locale config of the session content — the project's own, composed by\n   * `contentSessionOf` from `elytra.config.ts`. Absent (a kit session, tests) →\n   * the ambient studio config, then the single locale being asked for; EC-479\n   * retired the engine's `sampleLocaleConfig` fallback here.\n   */\n  localeConfig?: LocaleConfig\n  /**\n   * The project's config-sourced routes (EC-207). Wired into the content client so\n   * the canvas preview's `resolveLink` (EC-291) derives a rich-text link's URL from\n   * the SAME routes delivery serves — the studio-live half of the host link bake.\n   * Absent (playground/tests) → no routes, so `resolveLink` returns null and a\n   * reference link degrades to the visible `unresolved-ref` issue.\n   */\n  routes?: readonly RouteRecord[]\n  /**\n   * The project's asset records (assets table). Wired into the lookup so the\n   * content client resolves `asset`-typed FIELDS on listing/relation results\n   * (e.g. a ProductGrid product's `gallery`) to delivery shape — the same assets\n   * the renderer's `resolveAsset` reads for static props (EC-262). Absent\n   * (playground/tests) → assets come only from `asset`-collection fixture docs.\n   */\n  assets?: readonly AssetRecord[]\n  /**\n   * EC-606 — the stored rows the session does NOT serve: per undeclared collection,\n   * how many rows and how many published (`HydratedCms.orphans`, carried here by\n   * `contentSessionOf`'s spread). The preview engine never reads it. It rides this\n   * session because this is the one hydrated-content channel that reaches the\n   * section rail in both modes: the rail renders outside `ProjectSessionProvider`,\n   * so it cannot read the project session context, and a second documents query\n   * would be a parallel data flow (AD-17). Read via {@link contentSessionOrphans}.\n   * Absent (a kit session, tests) → none.\n   */\n  orphans?: readonly OrphanedCollection[]\n}\n\n/**\n * Default (no-session) collection schema: EMPTY. The studio ships no demo content\n * (Oli, 2026-06-19) — with no backend/content session configured, there is nothing\n * to preview, and the studio says so rather than serving fixtures. A real project's\n * collections + documents arrive via {@link configureContentSession} in BOTH modes\n * (EC-361): Convex hydration, or the playground's seeded in-memory adapter through\n * the same loader.\n */\nexport const playgroundCollections: readonly CollectionDef[] = []\n\nlet contentSession: ContentSessionState | null = null\nlet lookup: ContentLookup = createLookup(playgroundCollections, [], [])\n// Keyed by locale + perspective (EC-300) + the resolved locale CONFIG (EC-479) —\n// one deterministic client per distinct resolution context. See `clientFor`.\nconst clients = new Map<string, ContentClient>()\n\n// EC-460: a monotonically increasing session epoch + listener set, so a REACT\n// surface (the canvas render context) can re-render when the session is\n// re-pointed at fresher content. The session itself stays a module global (the\n// EC-361 design); this only makes \"it changed\" observable — `configureContentSession`\n// remains the single setter.\nlet sessionEpoch = 0\nconst sessionListeners = new Set<() => void>()\n\n/** The current content-session epoch — bumps on every `configureContentSession`. */\nexport function contentSessionEpoch(): number {\n  return sessionEpoch\n}\n\n/**\n * Subscribe to content-session swaps (EC-460). The listener fires after every\n * `configureContentSession`; returns the unsubscribe. Shaped for\n * `useSyncExternalStore(subscribeContentSession, contentSessionEpoch)`.\n */\nexport function subscribeContentSession(listener: () => void): () => void {\n  sessionListeners.add(listener)\n  return () => sessionListeners.delete(listener)\n}\n\n/**\n * Point the preview engine at a project's hydrated content — Convex hydration\n * or the playground's in-memory persisted state (EC-361), both through the same\n * `loadHydratedCms` loader — or back at the empty no-session default (`null`).\n */\nexport function configureContentSession(next: ContentSessionState | null): void {\n  contentSession = next\n  lookup = next\n    ? createLookup(next.collections, next.documents, next.publishedKeys, next.assets, next.localeConfig)\n    : createLookup(playgroundCollections, [], [])\n  clients.clear()\n  sessionEpoch += 1\n  for (const listener of [...sessionListeners]) listener()\n}\n\n/** Whether a hydrated content session is configured (Convex mode). */\nexport function hasContentSession(): boolean {\n  return contentSession !== null\n}\n\nconst NO_ORPHANS: readonly OrphanedCollection[] = []\n\n/**\n * The active session's orphaned collections (EC-606), or an empty list with no\n * session. Referentially stable between `configureContentSession` calls (the\n * session's own array, or one shared empty constant), so it is a valid\n * `useSyncExternalStore(subscribeContentSession, contentSessionOrphans, …)`\n * snapshot — the rail foot reads it exactly that way.\n */\nexport function contentSessionOrphans(): readonly OrphanedCollection[] {\n  return contentSession?.orphans ?? NO_ORPHANS\n}\n\n/** The server snapshot for {@link contentSessionOrphans}: no session exists during SSR. */\nexport function serverContentSessionOrphans(): readonly OrphanedCollection[] {\n  return NO_ORPHANS\n}\n\n/** The collections the preview engine currently serves (session or fixtures). */\nfunction activeCollections(): readonly CollectionDef[] {\n  return contentSession?.collections ?? playgroundCollections\n}\n\n/**\n * The sentinel {@link previewLocale} yields when NOTHING has declared a locale —\n * no ambient studio config, no content session. It is not a locale code and\n * matches no stored key, which is the point: with no session the lookup is empty\n * (`playgroundCollections` is `[]`), so every query already resolves to nothing\n * and this only fills `CacheTags.locale`, which no studio surface reads. EC-479:\n * the engine used to answer this question with its `sampleLocaleConfig` fixture's\n * `en` — a locale nobody chose, standing in for the project's own.\n */\nconst NO_LOCALE = ''\n\n/**\n * The locale a canvas preview resolves in, when the caller names none: the\n * ambient studio locale (installed from the PROJECT's config by `CmsProvider`),\n * else the active content session's own declared default (surfaces that render\n * outside a CMS session — the Components view's previews — still resolve in the\n * project's locale), else {@link NO_LOCALE}. Never an engine fixture.\n */\nfunction previewLocale(): Locale {\n  return getStudioLocale() ?? contentSession?.localeConfig?.default ?? NO_LOCALE\n}\n\n/**\n * The locale set a preview resolves fallbacks against (EC-018): the session's own\n * declaration, else the ambient studio config (the project's, via `elytra.config.ts`),\n * else the single locale actually being asked for.\n *\n * That last step is a DERIVATION, not an invention — it says \"the only locale we\n * know of is the one you named\", so the default-locale fallback is the requested\n * locale itself (a no-op) and a localized read falls through to `doc.values`.\n * Before EC-479 this line read `?? sampleLocaleConfig`, which silently declared\n * every locale-less studio bilingual `en/de` and resolved fallbacks through an `en`\n * no project had chosen. Only reached with no session AND no installed config, so\n * no stored key is ever written against it.\n */\nfunction activeLocaleConfig(locale: Locale): LocaleConfig {\n  return contentSession?.localeConfig ?? getStudioLocaleConfig() ?? requestedLocaleOnly(locale)\n}\n\n/**\n * The single-locale derivation above, through the one constructor (EC-580:\n * `LocaleConfig` is parse-only). {@link NO_LOCALE} — or anything else that is not\n * a locale code — becomes `und`, BCP 47's own \"undetermined\", which likewise\n * matches no stored key.\n */\nfunction requestedLocaleOnly(locale: Locale): LocaleConfig {\n  const code = localeSchema.safeParse(locale).success ? locale : 'und'\n  return parseLocaleConfig({ default: code, locales: [code] })\n}\n\n/** Resolve a collection in the active content session (fixtures in playground). */\nexport function playgroundCollection(id: string): CollectionDef | undefined {\n  return activeCollections().find((collection) => collection.id === id)\n}\n\n/**\n * Overlay the active session's canonical `filterable` declarations onto a\n * schema that doesn't carry any of its own. The inspector hands the Content\n * tab fixture collection defs; the filter/sort pickers must offer exactly the\n * EC-143 declaration set the delivery engine enforces, so both ends agree. A\n * collection that declares its own filterable fields is left untouched.\n */\nexport function withPlaygroundFilterable(\n  collections: readonly CollectionDef[],\n): readonly CollectionDef[] {\n  return collections.map((collection) => {\n    if (collection.fields.some((field) => field.filterable === true)) return collection\n    const counterpart = playgroundCollection(collection.id)\n    if (counterpart === undefined) return collection\n    const flagged = new Set(\n      counterpart.fields.filter((field) => field.filterable === true).map((field) => field.name),\n    )\n    if (flagged.size === 0) return collection\n    return {\n      ...collection,\n      fields: collection.fields.map((field) =>\n        flagged.has(field.name) ? { ...field, filterable: true } : field,\n      ),\n    }\n  })\n}\n\n/**\n * Synthesize the persistence-shaped asset record the asset resolver reads. EC-580:\n * the record's single alt (`meta.alt`, EC-587) is the DEFAULT locale's displayed value\n * (`valuesInLocale`, the project's config default) — it used to read\n * `localized.en.alt` whatever the project's locales were (MODE F5b, \"further\n * evidence\"), so a `de`-default project's previews had no alt and a shared `alt`\n * was never read. Without a locale model (no session config) only the shared bag\n * can be read.\n */\nfunction assetRecordOf(\n  doc: CmsDocument,\n  collection: CollectionDef | undefined,\n  locales: LocaleConfig | undefined,\n): AssetRecord {\n  const values = doc.values\n  const alt =\n    collection && locales\n      ? valuesInLocale(collection, doc, locales.default, locales).alt\n      : values.alt\n  return {\n    id: doc.id,\n    projectId: 'playground',\n    filename: typeof values.filename === 'string' ? values.filename : doc.id,\n    contentType: 'image/png',\n    byteSize: 0,\n    // EC-587: an asset's alt lives in `meta` (its one home), never the legacy column.\n    ...(typeof alt === 'string' ? { meta: { alt } } : {}),\n    storageKey: typeof values.url === 'string' ? values.url : doc.id,\n    createdAt: '2026-01-01T00:00:00.000Z',\n    updatedAt: '2026-01-01T00:00:00.000Z',\n  }\n}\n\nfunction createLookup(\n  collectionDefs: readonly CollectionDef[],\n  documents: readonly CmsDocument[],\n  publishedKeys?: readonly string[],\n  assetRecords?: readonly AssetRecord[],\n  locales?: LocaleConfig,\n): ContentLookup {\n  const collections = new Map(collectionDefs.map((c) => [c.id, c]))\n  // EC-224: published-ness is the version POINTER, not the flat `state` enum.\n  // A hydrated session hands `publishedKeys` (the pinned set) → wrap each row as\n  // a `DocumentHistory` so the published perspective resolves by the pin (the\n  // live row is always a draft now) with ZERO dependence on `state`. Without a\n  // pointer set (playground fixtures / tests) we keep bare rows, whose own\n  // `state` gates the published perspective — byte-identical to before.\n  const published = publishedKeys ? new Set(publishedKeys) : null\n  const toSource = (doc: CmsDocument): ContentDocumentSource => {\n    if (!published) return doc\n    return published.has(documentKey({ collection: doc.collection, id: doc.id }))\n      ? { draft: doc, published: doc, versions: [] }\n      : { draft: doc, published: undefined, versions: [] }\n  }\n  const byKey = new Map(\n    documents.map((doc) => [`${doc.collection}:${doc.id}`, toSource(doc)] as const),\n  )\n  // Asset resolution source for `asset`-typed FIELDS on resolved documents\n  // (listing/relation results, e.g. a product's `gallery`). Two sources, real\n  // records last so they win: (1) `asset`-collection fixture documents — how\n  // playground/tests model assets; (2) the project's real asset-table records\n  // (EC-262) — a Convex session has its assets here, NOT as `asset` documents,\n  // so without these the content client resolves no nested image.\n  const assets = new Map<string, AssetRecord>()\n  for (const doc of documents) {\n    if (doc.collection === 'asset') {\n      assets.set(doc.id, assetRecordOf(doc, collections.get(doc.collection), locales))\n    }\n  }\n  for (const record of assetRecords ?? []) assets.set(record.id, record)\n  return {\n    collection: (id) => collections.get(id),\n    document: (ref) => byKey.get(`${ref.collection}:${ref.id}`),\n    documents: (collectionId) =>\n      documents.filter((doc) => doc.collection === collectionId).map(toSource),\n    asset: (id) => assets.get(id),\n    // Prefer the record's resolved servable `url` — the one the renderer's\n    // resolveAsset reads (EC-262). Real asset-table records carry a Convex blob\n    // locator in `storageKey` and the servable URL in `url`; fixture/`asset`-document\n    // records (assetRecordOf) leave `url` unset and store the servable url in\n    // `storageKey`. Falling back keeps both correct.\n    assetUrl: (asset) => asset.url ?? asset.storageKey,\n  }\n}\n\n/**\n * One deterministic client per (locale, perspective): EC-018 locale fallback,\n * draft-or-published perspective (EC-300/AD-16, default `'published'`). The canvas is\n * draft-coherent: the editable Draft view resolves references against the draft\n * perspective (`DRAFT_PERSPECTIVE` — a just-made reusable shows immediately), the\n * read-only Published view against `'published'` (an honest preview of what delivery\n * serves; an unpublished hard ref shows the in-canvas placeholder). Delivery stays\n * published-only — this does not weaken `live-is-published-only`. The studio's\n * ambient active locale (EC-176, `lib/locale`) picks the locale at query time, so the\n * canvas previews follow the locale switcher exactly like delivery would; the canvas's\n * Draft/Published view picks the perspective. The cache resets whenever the content\n * session changes.\n */\nfunction clientFor(locale: Locale, perspective: Perspective = 'published'): ContentClient {\n  const locales = activeLocaleConfig(locale)\n  // EC-479: the locale CONFIG is part of the client's identity now — it may come\n  // from the ambient studio store, which changes independently of the session the\n  // cache is cleared on, so keying by locale alone could serve a client built\n  // against a superseded locale set.\n  const key = `${locale}:${perspectiveKey(perspective)}:${locales.default}|${locales.locales.join(',')}`\n  const existing = clients.get(key)\n  if (existing) return existing\n  const client = createContentClient({\n    lookup,\n    context: createContentContext({\n      locale,\n      perspective,\n      locales,\n    }),\n    // EC-291: the routes a rich-text link resolves against (config-sourced) — the\n    // studio-live half of the host link bake.\n    routes: contentSession?.routes ?? [],\n  })\n  clients.set(key, client)\n  return client\n}\n\n/**\n * Run a closed-vocabulary list query (AD-3: eq/in/lt/lte/gt/gte, AND-only,\n * filterable fields only) and return the delivery-shaped result. Invalid\n * queries come back as structured errors — never thrown, never silently\n * widened. Resolves in the studio's active locale unless one is passed.\n */\nexport function runCollectionListQuery(\n  collectionId: string,\n  query: ListDocumentsQuery = {},\n  locale: Locale = previewLocale(),\n): ListDocumentsResult {\n  return clientFor(locale).listDocuments(collectionId, query)\n}\n\n/** Resolve one document (by id or slug) into delivery shape. */\nexport function getCollectionDocument(\n  collectionId: string,\n  idOrSlug: string,\n  locale: Locale = previewLocale(),\n): GetDocumentResult {\n  return clientFor(locale).getDocument(collectionId, idOrSlug)\n}\n\n/**\n * Populate a composition-node `relation` prop to delivery shape for the canvas\n * (EC-254) — the studio analog of the host's baked relations map. Resolves the\n * ref through the active session's client (published perspective, active locale),\n * so the canvas previews a block's picked documents (a ProductGrid's products, a\n * Reusable's element) exactly as delivery renders them. `null` when the target is\n * missing or not visible → the block degrades to its own empty state.\n */\nexport function resolveCanvasRelation(\n  ref: DocumentRef,\n  locale: Locale = previewLocale(),\n  perspective: Perspective = 'published',\n): ResolvedDocument | null {\n  return clientFor(locale, perspective).resolveRelation(ref)\n}\n\n/** The real clock — the canvas boundary's default; tests inject a fixed one (EC-581 6a). */\nconst systemClock: Clock = () => new Date().toISOString()\n\n/**\n * A listing query as `listDocuments` input (EC-581 6a): executed through\n * `listingRequestOf` — the phase the delivery host runs too, so canvas and site\n * build the identical request — with `{ now: true }` read from `clock`. The\n * operands are JSON bound from authored props; the cast hands them to the one\n * validator (`validateWhere`/`validateLimit`), which reports anything invalid.\n */\nfunction listDocumentsQueryOf(query: ListingQuery, clock: Clock): ListDocumentsQuery {\n  const request = listingRequestOf(query, clock)\n  return {\n    where: request.where as ListDocumentsQuery['where'],\n    ...(request.sort ? { sort: request.sort } : {}),\n    ...(request.limit !== undefined ? { limit: request.limit as number } : {}),\n  }\n}\n\n/**\n * Resolve a listing block's query to its documents for the canvas (EC-255) — the\n * studio analog of the host's baked listings map. Runs the query (collection +\n * AND-only `where`, optional sort/limit; EC-581 6a: `now` read from `clock`)\n * through the active session's client (published perspective, active locale), so\n * the canvas previews a dynamic grid (a ProductGrid keyed to a category) exactly as\n * delivery renders it. An invalid query (structured, never thrown) or a non-list\n * lookup yields `[]` → the block's empty state, and the canvas notice\n * ({@link validateCanvasListingQuery}) says why. Reuses the same `listDocuments`\n * path as `runCollectionListQuery`.\n */\nexport function resolveCanvasListing(\n  query: ListingQuery,\n  locale: Locale = previewLocale(),\n  perspective: Perspective = 'published',\n  clock: Clock = systemClock,\n): ResolvedDocument[] {\n  const result = clientFor(locale, perspective).listDocuments(\n    query.collection,\n    listDocumentsQueryOf(query, clock),\n  )\n  return result.ok ? result.documents : []\n}\n\n/**\n * Statically validate a listing block's query against the ACTIVE session schema\n * (EC-460, the never-silent rule): the exact `validateWhere`/`validateSort`/\n * `validateLimit` checks `listDocuments` runs, WITHOUT executing the query — so\n * the canvas can surface a config-invalid listing (a filter/sort field the\n * collection doesn't declare `filterable`, an unknown collection) as a visible\n * notice instead of the block's indistinguishable empty state. With no content\n * session configured (boot instants, fixtures) there is no schema to judge\n * against, so it reports nothing rather than false-flagging every listing.\n */\nexport function validateCanvasListingQuery(\n  query: ListingQuery,\n  clock: Clock = systemClock,\n): ContentQueryError[] {\n  if (contentSession === null) return []\n  const collection = playgroundCollection(query.collection)\n  if (!collection) {\n    return [\n      queryError(\n        'unknown-collection',\n        `Collection \"${query.collection}\" is not defined.`,\n        ['collection'],\n        undefined,\n        { key: 'content.queryError.unknownCollection', vars: { collection: query.collection } },\n      ),\n    ]\n  }\n  // EC-581 6a: judge the request the query EXECUTES as (`now` bound), with the\n  // same three validators `listDocuments` runs — notice and execution agree.\n  const request = listDocumentsQueryOf(query, clock)\n  return [\n    ...(request.where ? validateWhere(collection, request.where) : []),\n    ...(request.sort ? validateSort(collection, request.sort) : []),\n    ...(request.limit !== undefined ? validateLimit(request.limit) : []),\n  ]\n}\n\n/**\n * Resolve a rich-text internal link's target document to its URL path for the canvas\n * (EC-291) — the studio analog of the host's baked links map. Derives the URL through\n * the active session's client (published perspective, active locale, config-sourced\n * routes), so the canvas previews a `{type:'reference'}` link's `href` exactly as\n * delivery serves it. `null` when the target is unpublished, missing, or addressed by\n * no route → the rich-text renderer shows the EC-290 `unresolved-ref` issue. Reuses\n * the same `resolveLink` path as the host bake, so both agree on the derived URL.\n */\nexport function resolveCanvasLink(\n  ref: DocumentRef,\n  locale: Locale = previewLocale(),\n  perspective: Perspective = 'published',\n): string | null {\n  return clientFor(locale, perspective).resolveLink(ref)\n}\n\n/** A pickable entry of a collection (the template-page preview switcher). */\nexport interface CollectionEntrySummary {\n  id: string\n  label: string\n}\n\n/** Published entries of a collection, labeled by the schema's title field. */\nexport function listCollectionEntries(collectionId: string): CollectionEntrySummary[] {\n  const collection = playgroundCollection(collectionId)\n  const result = runCollectionListQuery(collectionId)\n  if (!result.ok) return []\n  // EC-242: label via the shared identity resolver (string `titleField` or a\n  // function pattern), over the delivery-shape values; falls back to the id.\n  return result.documents.map((doc) => ({\n    id: doc.id,\n    label: collection ? resolveDocumentTitle(collection, doc, doc.id) : doc.id,\n  }))\n}\n"]}

package/dist/lib/dnd/drop-rules.d.ts

@@ -1,4 +1,4 @@
-import type { ComponentNode, GridContainerOptions, InsertTarget, LayoutContainerIds } from '@elytracms/core/project-graph';
+import type { ComponentNode, GridContainerOptions, InsertTarget, LayoutContainerIds, PlacementScope } from '@elytracms/core/project-graph';
 import type { ComponentManifest } from '@elytracms/core/component-registry';
 /**
  * Drag & drop eligibility rules (EC-160 + EC-162, vision §3.1) — pure
@@ -76,9 +76,14 @@ export type DropRejectionCode =
  | 'not-allowed'
 /**
  * EC-554: the composition FIELD's top-level `allow` rejects the component
- * landing as a direct child of the composition root (see {@link fieldAllowAt}).
+ * landing as a direct child of the composition root (see {@link placementRefusal}).
  */
  | 'field-not-allowed'
+/**
+ * EC-584: the component is not canvas-eligible (server-only, `clientRenderable:
+ * false`) — refused wherever it would land, by the same judge the reducer runs.
+ */
+ | 'server-only'
 /** Moving a node into itself or its own subtree (cycle). */
  | 'own-subtree'
 /** The page root cannot be moved, and nothing can drop beside it. */
@@ -130,39 +135,28 @@ export type DropResolution = DropPlan | DropRejection;
 export declare function primaryInsertSlot(manifest: ManifestRules | undefined): SlotRule | undefined;
 /** True when a component can receive `into` drops at all (declares an insertable slot). */
 export declare function canNestInto(getManifest: ManifestLookup, componentId: string): boolean;
-/** True when a slot's allow-list (if any) permits the component id. */
-export declare function slotAllows(slot: SlotRule | undefined, componentId: string): boolean;
 /**
- * The composition FIELD's top-level vocabulary as it applies to a placement under
- * `parentId` (EC-188, EC-554) — the ONE reader of a field's `allow` on the studio
- * side: every insertion surface (the insert offer in `insert-context`, drag-and-drop
- * on the canvas and the page tree incl. the wrap gesture, paste) asks here, so no
- * surface can apply the field leash differently or not at all.
+ * Which rule refuses `componentId` landing under `parentId` in `slot` — `null` when
+ * the placement is admitted. EC-584: this is a READER of the one core placement judge
+ * (`@elytracms/core/project-graph` `placementRefusal` over `allowAt`'s vocabulary —
+ * the field's at the composition root, keyed on node identity; the parent's slot
+ * below), the SAME call the builder reducer enforces and the publish gate applies.
+ * Every insertion surface (the insert offer, drag-and-drop on the canvas and the page
+ * tree incl. the wrap gesture, paste) pre-checks here so its indicator says what the
+ * sink will do; the reducer refuses whatever a surface forgot.
  *
- * A field `allow` governs only the value's TOP level — a direct child of the
- * composition root, mirroring `validateCompositionValue` — so this returns the
- * field vocabulary when `parentId` IS the root node and `undefined` (no field
- * constraint) anywhere deeper. Keyed on node IDENTITY, never on the component id:
- * the composition editor's synthetic root is the `layout.stack` component, which
- * is also a nestable block, and a rule keyed on the component id would leash
- * every nested Stack. EC-544: an omitted `allow` is `undefined` here (any registered
- * component); a declared list is a closed set.
- */
-export declare function fieldAllowAt(root: ComponentNode, parentId: string, fieldAllow: readonly string[] | undefined): readonly string[] | undefined;
-/**
- * Which declared leash refuses `componentId` landing under `parentId` in `slot`
- * (EC-545 slot leash, EC-554 field leash) — `null` when both admit it. The field
- * is judged first: it can only refuse at the composition root, where the slot is
- * the invisible synthetic root's and the field is the declaration the author sees.
+ * `'field'` / `'slot'` name the vocabulary that refused (the field is the declaration
+ * the author sees at the root — the synthetic root's own slot is invisible);
+ * `'server-only'` is canvas eligibility, wherever it would land.
  */
 export declare function placementRefusal(args: {
     root: ComponentNode;
     /** The node the placement lands under (the insertion target's `parentId`). */
     parentId: string;
-    slot: SlotRule | undefined;
-    fieldAllow: readonly string[] | undefined;
+    slot: string;
+    placement: PlacementScope;
     componentId: string;
-}): 'field' | 'slot' | null;
+}): 'field' | 'slot' | 'server-only' | null;
 /**
  * Resolve a prospective drop into either an executable plan (one `move` or
  * `insert` builder action → one operations command → one undo step) or a
@@ -179,11 +173,11 @@ export declare function resolveDrop(args: {
      */
     layout: LayoutContainerIds;
     /**
-     * The composition field's top-level `allow` (EC-554) — `undefined` when the
-     * field declares none. Required so no surface can forget to pass it; judged
-     * through {@link fieldAllowAt} for drops whose parent is the root.
+     * EC-584: what the placement judge reads — the manifest lookup and the composition
+     * field's effective top-level vocabulary (the builder store's `placement`).
+     * Required so no surface can forget it; the reducer judges the same scope.
      */
-    fieldAllow: readonly string[] | undefined;
+    placement: PlacementScope;
     subject: DragSubject;
     location: DropLocation;
 }): DropResolution;

package/dist/lib/dnd/drop-rules.js

@@ -1,4 +1,4 @@
-import { DEFAULT_SLOT, OUTLET_SLOT, getNode, getParentInfo, gridContainerNode, isDescendantOf, isStaticProp, layoutContainerKind, removeNode, updateNode, } from '@elytracms/core/project-graph';
+import { DEFAULT_SLOT, OUTLET_SLOT, allowAt, getNode, getParentInfo, gridContainerNode, isDescendantOf, isStaticProp, layoutContainerKind, placementRefusal as judgePlacement, removeNode, slotAllowList, updateNode, } from '@elytracms/core/project-graph';
 import { manifestSlots } from '@elytracms/core/component-registry';
 /**
  * The canonical `ManifestRules` view of a full manifest (EC-386): the declared
@@ -37,50 +37,42 @@ export function canNestInto(getManifest, componentId) {
     return primaryInsertSlot(getManifest(componentId)) !== undefined;
 }
 /**
- * True when an allow-list permits the component id — absent = any, a present
- * list (even an empty one) is a closed set (EC-544). The one membership rule the
- * slot leash and the field leash share.
- */
-function allowListPermits(allow, componentId) {
-    return !allow || allow.includes(componentId);
-}
-/** True when a slot's allow-list (if any) permits the component id. */
-export function slotAllows(slot, componentId) {
-    return allowListPermits(slot?.allow, componentId);
-}
-/**
- * The composition FIELD's top-level vocabulary as it applies to a placement under
- * `parentId` (EC-188, EC-554) — the ONE reader of a field's `allow` on the studio
- * side: every insertion surface (the insert offer in `insert-context`, drag-and-drop
- * on the canvas and the page tree incl. the wrap gesture, paste) asks here, so no
- * surface can apply the field leash differently or not at all.
+ * Which rule refuses `componentId` landing under `parentId` in `slot` — `null` when
+ * the placement is admitted. EC-584: this is a READER of the one core placement judge
+ * (`@elytracms/core/project-graph` `placementRefusal` over `allowAt`'s vocabulary —
+ * the field's at the composition root, keyed on node identity; the parent's slot
+ * below), the SAME call the builder reducer enforces and the publish gate applies.
+ * Every insertion surface (the insert offer, drag-and-drop on the canvas and the page
+ * tree incl. the wrap gesture, paste) pre-checks here so its indicator says what the
+ * sink will do; the reducer refuses whatever a surface forgot.
  *
- * A field `allow` governs only the value's TOP level — a direct child of the
- * composition root, mirroring `validateCompositionValue` — so this returns the
- * field vocabulary when `parentId` IS the root node and `undefined` (no field
- * constraint) anywhere deeper. Keyed on node IDENTITY, never on the component id:
- * the composition editor's synthetic root is the `layout.stack` component, which
- * is also a nestable block, and a rule keyed on the component id would leash
- * every nested Stack. EC-544: an omitted `allow` is `undefined` here (any registered
- * component); a declared list is a closed set.
- */
-export function fieldAllowAt(root, parentId, fieldAllow) {
-    return parentId === root.id ? fieldAllow : undefined;
-}
-/**
- * Which declared leash refuses `componentId` landing under `parentId` in `slot`
- * (EC-545 slot leash, EC-554 field leash) — `null` when both admit it. The field
- * is judged first: it can only refuse at the composition root, where the slot is
- * the invisible synthetic root's and the field is the declaration the author sees.
+ * `'field'` / `'slot'` name the vocabulary that refused (the field is the declaration
+ * the author sees at the root — the synthetic root's own slot is invisible);
+ * `'server-only'` is canvas eligibility, wherever it would land.
  */
 export function placementRefusal(args) {
-    const { root, parentId, slot, fieldAllow, componentId } = args;
-    if (!allowListPermits(fieldAllowAt(root, parentId, fieldAllow), componentId))
-        return 'field';
-    if (!slotAllows(slot, componentId))
-        return 'slot';
+    const { root, parentId, slot, placement, componentId } = args;
+    const code = judgePlacement({
+        componentId,
+        view: placement.components.get(componentId),
+        allow: allowAt(root, parentId, slot, placement),
+    });
+    if (code === 'server-only-component')
+        return 'server-only';
+    if (code === 'forbidden-component')
+        return parentId === root.id ? 'field' : 'slot';
     return null;
 }
+/** The rejection a refused placement shows during a drag (EC-584: the judge's verdict). */
+function placementRejection(refusal, componentId, slotName) {
+    if (refusal === 'server-only') {
+        return rejected('server-only', `"${componentId}" is server-only and cannot be placed on the canvas.`);
+    }
+    if (refusal === 'field') {
+        return rejected('field-not-allowed', `The field's top-level vocabulary does not allow "${componentId}".`);
+    }
+    return rejected('not-allowed', `Slot "${slotName}" does not allow "${componentId}".`);
+}
 // ---------------------------------------------------------------------------
 // Resolution
 // ---------------------------------------------------------------------------
@@ -91,7 +83,7 @@ export function placementRefusal(args) {
  * same answer, on both surfaces.
  */
 export function resolveDrop(args) {
-    const { root, getManifest, layout, fieldAllow, subject, location } = args;
+    const { root, getManifest, layout, placement, subject, location } = args;
     if (subject.kind === 'node' && subject.nodeId === root.id) {
         return rejected('root', 'The page root cannot be moved.');
     }
@@ -101,11 +93,10 @@ export function resolveDrop(args) {
     }
     // EC-162: dropping beside the reference wraps both in a two-column Grid.
     if (location.position === 'left' || location.position === 'right') {
-        return resolveWrap({ root, getManifest, layout, fieldAllow, subject, reference, side: location.position });
+        return resolveWrap({ root, getManifest, layout, placement, subject, reference, side: location.position });
     }
     // Resolve the concrete insertion point: parent node, slot, index.
     let parentId;
-    let slotRule;
     let slotName;
     let index;
     if (location.position === 'into') {
@@ -115,7 +106,6 @@ export function resolveDrop(args) {
             return rejected('no-slot', `"${reference.componentId}" does not accept children.`);
         }
         parentId = reference.id;
-        slotRule = slot;
         slotName = slot.name;
         index = (reference.slots?.[slot.name] ?? []).length;
     }
@@ -126,16 +116,16 @@ export function resolveDrop(args) {
         }
         parentId = info.parent.id;
         slotName = info.slot;
-        // Unknown parent manifests impose no allow-list; validation owns that issue.
-        slotRule = getManifest(info.parent.componentId)?.slots.find((s) => s.name === info.slot);
         index = info.index + (location.position === 'after' ? 1 : 0);
     }
-    const refusal = placementRefusal({ root, parentId, slot: slotRule, fieldAllow, componentId: subject.componentId });
-    if (refusal === 'field') {
-        return rejected('field-not-allowed', `The field's top-level vocabulary does not allow "${subject.componentId}".`);
-    }
-    if (refusal === 'slot') {
-        return rejected('not-allowed', `Slot "${slotName}" does not allow "${subject.componentId}".`);
+    // EC-584: a move inside its own slot is a reorder — the placement does not change,
+    // so the judge (and the reducer) leave it alone.
+    const current = subject.kind === 'node' ? getParentInfo(root, subject.nodeId) : null;
+    const relocates = !current || current.parent.id !== parentId || current.slot !== slotName;
+    if (relocates) {
+        const refusal = placementRefusal({ root, parentId, slot: slotName, placement, componentId: subject.componentId });
+        if (refusal)
+            return placementRejection(refusal, subject.componentId, slotName);
     }
     const target = { parentId, slot: slotName, index };
     if (subject.kind === 'component') {
@@ -147,7 +137,6 @@ export function resolveDrop(args) {
     }
     // No-op detection: the final position (after same-slot removal compensation,
     // matching `moveNode`) equals the node's current position.
-    const current = getParentInfo(root, subject.nodeId);
     if (current && current.parent.id === parentId && current.slot === slotName) {
         const finalIndex = index > current.index ? index - 1 : index;
         if (finalIndex === current.index) {
@@ -172,7 +161,7 @@ export function resolveDrop(args) {
 export const WRAP_GRID_OPTIONS = { columns: 2, gap: '4' };
 /** Eligibility for a `left`/`right` (wrap-beside) drop. */
 function resolveWrap(args) {
-    const { root, getManifest, layout, fieldAllow, subject, reference, side } = args;
+    const { root, getManifest, layout, placement, subject, reference, side } = args;
     // EC-591: the gesture builds the `layout.grid` component — a role nobody fills
     // switches it off (the canvas shows the role notice), never a hidden default id.
     const gridId = layout.grid;
@@ -188,12 +177,11 @@ function resolveWrap(args) {
     if (!info) {
         return rejected('root', 'The page root cannot be wrapped in a container.');
     }
-    const parentSlotRule = getManifest(info.parent.componentId)?.slots.find((s) => s.name === info.slot);
     const refusal = placementRefusal({
         root,
         parentId: info.parent.id,
-        slot: parentSlotRule,
-        fieldAllow,
+        slot: info.slot,
+        placement,
         componentId: gridId,
     });
     if (refusal === 'field') {
@@ -202,10 +190,16 @@ function resolveWrap(args) {
     if (refusal === 'slot') {
         return rejected('not-allowed', `Slot "${info.slot}" does not allow a Grid container.`);
     }
-    // Both columns land in the Grid's children slot.
+    if (refusal === 'server-only')
+        return placementRejection(refusal, gridId, info.slot);
+    // Both columns land in the Grid's children slot — judged by the same core judge.
     const gridSlot = primaryInsertSlot(getManifest(gridId));
+    const gridSlotAllow = slotAllowList(placement.components.get(gridId)?.slots?.find((s) => s.name === (gridSlot?.name ?? DEFAULT_SLOT)));
     for (const componentId of [reference.componentId, subject.componentId]) {
-        if (!slotAllows(gridSlot, componentId)) {
+        const code = judgePlacement({ componentId, view: placement.components.get(componentId), allow: gridSlotAllow });
+        if (code === 'server-only-component')
+            return placementRejection('server-only', componentId, gridSlot?.name ?? DEFAULT_SLOT);
+        if (code === 'forbidden-component') {
             return rejected('not-allowed', `A Grid container does not allow "${componentId}".`);
         }
     }