@elytracms/studio 0.0.92 → 0.0.93

package/dist/lib/operations/project-runtime-config.d.ts

@@ -1,5 +1,7 @@
-import type { ResolvedProject } from '@elytracms/core/studio-core';
-import type { LocaleConfig } from '@elytracms/core/cms-core';
+import type { CollectionDef, LocaleConfig } from '@elytracms/core/cms-core';
+import { ComponentRegistry } from '@elytracms/core/component-registry';
+import { configProjectFor } from '../workspace/index.js';
+export { configProjectFor };
 /**
  * EC-595 A2 — the config project an OPERATION runs for, by its project id (the slug),
  * whether or not it is the ACTIVE project.
@@ -11,10 +13,27 @@ import type { LocaleConfig } from '@elytracms/core/cms-core';
  * the operation's own `projectId`, never for whichever project the UI has active (A1
  * found-but-left #1: the manifest lookup read the active project's components).
  *
- * Reads the workspace state through its public reader only; zone B (EC-583) owns how the
- * resolved project is computed and may fold this lookup into its resolved-project
- * reader. `undefined` for an id no config project declares (env-only wiring, fixtures).
+ * The lookup itself is the workspace's ONE reader of "the config project with this slug"
+ * (`configProjectFor`, `lib/workspace` — EC-582 folded the copy that lived here into it);
+ * this module derives what an operation reads from it.
  */
-export declare function configProjectFor(projectId: string): ResolvedProject | undefined;
 /** The locale config of the operation's project (see {@link configProjectFor}). */
 export declare function projectLocaleConfig(projectId: string): LocaleConfig | undefined;
+/**
+ * The collections of the operation's project (see {@link configProjectFor}); `[]` for an
+ * id no config project declares (env-only wiring, engine fixtures). EC-585: the ONE
+ * reader of "the config project with this slug" — it replaced `lib/workspace`'s
+ * `resolveProjectCollections`, a second copy of the same lookup (EC-595 A2 found-but-left).
+ */
+export declare function projectCollections(projectId: string): CollectionDef[];
+/**
+ * EC-582 — the component registry of the operation's project (see
+ * {@link configProjectFor}): its config component entries' MANIFESTS, registered once per
+ * list (the implementations are the renderer's, not the validator's — this stays off
+ * `runtime-renderer`, like the manifest lookup). What the publish gate's canonical
+ * validator judges compositions and props with — never the ACTIVE project's registry
+ * (critic row 13: on a deployment shared by projects with different component lists the
+ * gate judged an inactive project's props with the wrong manifests). `undefined` for a
+ * project that lists no components (or an id no config declares).
+ */
+export declare function projectComponentRegistry(projectId: string): ComponentRegistry | undefined;

package/dist/lib/operations/project-runtime-config.js

@@ -1,4 +1,6 @@
-import { getWorkspaceState } from '../workspace/index.js';
+import { ComponentRegistry } from '@elytracms/core/component-registry';
+import { configProjectFor } from '../workspace/index.js';
+export { configProjectFor };
 /**
  * EC-595 A2 — the config project an OPERATION runs for, by its project id (the slug),
  * whether or not it is the ACTIVE project.
@@ -10,18 +12,43 @@ import { getWorkspaceState } from '../workspace/index.js';
  * the operation's own `projectId`, never for whichever project the UI has active (A1
  * found-but-left #1: the manifest lookup read the active project's components).
  *
- * Reads the workspace state through its public reader only; zone B (EC-583) owns how the
- * resolved project is computed and may fold this lookup into its resolved-project
- * reader. `undefined` for an id no config project declares (env-only wiring, fixtures).
+ * The lookup itself is the workspace's ONE reader of "the config project with this slug"
+ * (`configProjectFor`, `lib/workspace` — EC-582 folded the copy that lived here into it);
+ * this module derives what an operation reads from it.
  */
-export function configProjectFor(projectId) {
-    const state = getWorkspaceState();
-    if (state.kind !== 'config')
-        return undefined;
-    return state.projects.find((project) => project.slug === projectId);
-}
 /** The locale config of the operation's project (see {@link configProjectFor}). */
 export function projectLocaleConfig(projectId) {
     return configProjectFor(projectId)?.locales;
 }
+/**
+ * The collections of the operation's project (see {@link configProjectFor}); `[]` for an
+ * id no config project declares (env-only wiring, engine fixtures). EC-585: the ONE
+ * reader of "the config project with this slug" — it replaced `lib/workspace`'s
+ * `resolveProjectCollections`, a second copy of the same lookup (EC-595 A2 found-but-left).
+ */
+export function projectCollections(projectId) {
+    return configProjectFor(projectId)?.collections ?? [];
+}
+const registries = new WeakMap();
+/**
+ * EC-582 — the component registry of the operation's project (see
+ * {@link configProjectFor}): its config component entries' MANIFESTS, registered once per
+ * list (the implementations are the renderer's, not the validator's — this stays off
+ * `runtime-renderer`, like the manifest lookup). What the publish gate's canonical
+ * validator judges compositions and props with — never the ACTIVE project's registry
+ * (critic row 13: on a deployment shared by projects with different component lists the
+ * gate judged an inactive project's props with the wrong manifests). `undefined` for a
+ * project that lists no components (or an id no config declares).
+ */
+export function projectComponentRegistry(projectId) {
+    const entries = configProjectFor(projectId)?.components;
+    if (!entries)
+        return undefined;
+    let registry = registries.get(entries);
+    if (!registry) {
+        registry = new ComponentRegistry(entries.map((entry) => entry.manifest));
+        registries.set(entries, registry);
+    }
+    return registry;
+}
 //# sourceMappingURL=project-runtime-config.js.map

package/dist/lib/operations/project-runtime-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-runtime-config.js","sourceRoot":"","sources":["../../../src/lib/operations/project-runtime-config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAA;IACjC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;AACrE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;AAC7C,CAAC","sourcesContent":["import type { ResolvedProject } from '@elytracms/core/studio-core'\nimport type { LocaleConfig } from '@elytracms/core/cms-core'\nimport { getWorkspaceState } from '../workspace'\n\n/**\n * EC-595 A2 — the config project an OPERATION runs for, by its project id (the slug),\n * whether or not it is the ACTIVE project.\n *\n * One operations bundle is cached per deployment KEY (EC-179) and a deployment may\n * serve several config projects, so everything an operation reads from config — its\n * collections (A1's `resolveProjectCollections`), its component manifests (the write\n * canonicaliser), its locales (the publish gate's runtime validator) — is resolved for\n * the operation's own `projectId`, never for whichever project the UI has active (A1\n * found-but-left #1: the manifest lookup read the active project's components).\n *\n * Reads the workspace state through its public reader only; zone B (EC-583) owns how the\n * resolved project is computed and may fold this lookup into its resolved-project\n * reader. `undefined` for an id no config project declares (env-only wiring, fixtures).\n */\nexport function configProjectFor(projectId: string): ResolvedProject | undefined {\n  const state = getWorkspaceState()\n  if (state.kind !== 'config') return undefined\n  return state.projects.find((project) => project.slug === projectId)\n}\n\n/** The locale config of the operation's project (see {@link configProjectFor}). */\nexport function projectLocaleConfig(projectId: string): LocaleConfig | undefined {\n  return configProjectFor(projectId)?.locales\n}\n"]}
+{"version":3,"file":"project-runtime-config.js","sourceRoot":"","sources":["../../../src/lib/operations/project-runtime-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE/C,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAE3B;;;;;;;;;;;;;;GAcG;AAEH,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,gBAAgB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,gBAAgB,CAAC,SAAS,CAAC,EAAE,WAAW,IAAI,EAAE,CAAA;AACvD,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,OAAO,EAA6B,CAAA;AAE3D;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACxD,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAA;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,IAAI,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;QACxE,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC","sourcesContent":["import type { CollectionDef, LocaleConfig } from '@elytracms/core/cms-core'\nimport { ComponentRegistry } from '@elytracms/core/component-registry'\nimport { configProjectFor } from '../workspace'\n\nexport { configProjectFor }\n\n/**\n * EC-595 A2 — the config project an OPERATION runs for, by its project id (the slug),\n * whether or not it is the ACTIVE project.\n *\n * One operations bundle is cached per deployment KEY (EC-179) and a deployment may\n * serve several config projects, so everything an operation reads from config — its\n * collections (A1's `resolveProjectCollections`), its component manifests (the write\n * canonicaliser), its locales (the publish gate's runtime validator) — is resolved for\n * the operation's own `projectId`, never for whichever project the UI has active (A1\n * found-but-left #1: the manifest lookup read the active project's components).\n *\n * The lookup itself is the workspace's ONE reader of \"the config project with this slug\"\n * (`configProjectFor`, `lib/workspace` — EC-582 folded the copy that lived here into it);\n * this module derives what an operation reads from it.\n */\n\n/** The locale config of the operation's project (see {@link configProjectFor}). */\nexport function projectLocaleConfig(projectId: string): LocaleConfig | undefined {\n  return configProjectFor(projectId)?.locales\n}\n\n/**\n * The collections of the operation's project (see {@link configProjectFor}); `[]` for an\n * id no config project declares (env-only wiring, engine fixtures). EC-585: the ONE\n * reader of \"the config project with this slug\" — it replaced `lib/workspace`'s\n * `resolveProjectCollections`, a second copy of the same lookup (EC-595 A2 found-but-left).\n */\nexport function projectCollections(projectId: string): CollectionDef[] {\n  return configProjectFor(projectId)?.collections ?? []\n}\n\nconst registries = new WeakMap<object, ComponentRegistry>()\n\n/**\n * EC-582 — the component registry of the operation's project (see\n * {@link configProjectFor}): its config component entries' MANIFESTS, registered once per\n * list (the implementations are the renderer's, not the validator's — this stays off\n * `runtime-renderer`, like the manifest lookup). What the publish gate's canonical\n * validator judges compositions and props with — never the ACTIVE project's registry\n * (critic row 13: on a deployment shared by projects with different component lists the\n * gate judged an inactive project's props with the wrong manifests). `undefined` for a\n * project that lists no components (or an id no config declares).\n */\nexport function projectComponentRegistry(projectId: string): ComponentRegistry | undefined {\n  const entries = configProjectFor(projectId)?.components\n  if (!entries) return undefined\n  let registry = registries.get(entries)\n  if (!registry) {\n    registry = new ComponentRegistry(entries.map((entry) => entry.manifest))\n    registries.set(entries, registry)\n  }\n  return registry\n}\n"]}

package/dist/lib/operations/publish-with-revision.d.ts

@@ -1,6 +1,6 @@
 import type { CmsDocument, CmsValidationIssue, DocumentRef } from '@elytracms/core/cms-core';
 import type { CmsDocumentRecord } from '@elytracms/core/persistence';
-import type { OperationResult } from './operations-package.js';
+import type { OperationError, OperationResult } from './operations-package.js';
 /** EC-595 point 6: a publish refused because the draft moved is re-validated and retried this often. */
 export declare const PUBLISH_ATTEMPTS = 3;
 export interface PublishWithRevisionDeps {
@@ -30,3 +30,35 @@ export interface PublishWithRevisionDeps {
  * nothing unvalidated is published). Any other failure is returned as is.
  */
 export declare function publishWithRevision(ref: DocumentRef, deps: PublishWithRevisionDeps): Promise<OperationResult<CmsDocumentRecord>>;
+/**
+ * EC-585 — a publish the operation REFUSED (validation, a strict target, a conflict that
+ * did not settle, an unready asset library…), raised to the caller instead of resolving
+ * as if it had landed. Before this, the session's `publishDocument` recorded the error
+ * on the persist banner and RESOLVED, so the editor's controller set "Published" and
+ * promote toasted success on a refusal (read on the base: `cms-store.tsx:1065-1075`,
+ * `use-publish-controller.ts:94-96`). `message` is the localized sentence for a toast;
+ * `error` carries the full refusal (issues included).
+ */
+export declare class PublishRefusedError extends Error {
+    readonly error: OperationError;
+    constructor(error: OperationError, message: string);
+}
+export interface PublishInSessionDeps {
+    /** The optimistic flip of the session's published set (reconciled below). */
+    markPublished(ref: DocumentRef): void;
+    /** {@link publishWithRevision} for this session. */
+    publish(ref: DocumentRef): Promise<OperationResult<unknown>>;
+    /** Re-read the authoritative record (the pin, the flags) — after success AND refusal. */
+    reconcile(ref: DocumentRef): Promise<void>;
+    /** Surface the refusal on the session (the persist banner). */
+    report(error: OperationError): void;
+    /** The localized sentence for a refusal. */
+    describe(error: OperationError): string;
+}
+/**
+ * EC-585 — the session's publish of one document (pure, deps injected): optimistic flip
+ * → the one publish operation → reconcile against the backend record — and on a refusal,
+ * report it AND reject with {@link PublishRefusedError}, so no caller (the editor's
+ * Publish, the versions pane, promote) can show success for a publish that did not land.
+ */
+export declare function publishInSession(ref: DocumentRef, deps: PublishInSessionDeps): Promise<void>;

package/dist/lib/operations/publish-with-revision.js

@@ -31,4 +31,36 @@ export async function publishWithRevision(ref, deps) {
     }
     return result;
 }
+/**
+ * EC-585 — a publish the operation REFUSED (validation, a strict target, a conflict that
+ * did not settle, an unready asset library…), raised to the caller instead of resolving
+ * as if it had landed. Before this, the session's `publishDocument` recorded the error
+ * on the persist banner and RESOLVED, so the editor's controller set "Published" and
+ * promote toasted success on a refusal (read on the base: `cms-store.tsx:1065-1075`,
+ * `use-publish-controller.ts:94-96`). `message` is the localized sentence for a toast;
+ * `error` carries the full refusal (issues included).
+ */
+export class PublishRefusedError extends Error {
+    error;
+    constructor(error, message) {
+        super(message);
+        this.error = error;
+        this.name = 'PublishRefusedError';
+    }
+}
+/**
+ * EC-585 — the session's publish of one document (pure, deps injected): optimistic flip
+ * → the one publish operation → reconcile against the backend record — and on a refusal,
+ * report it AND reject with {@link PublishRefusedError}, so no caller (the editor's
+ * Publish, the versions pane, promote) can show success for a publish that did not land.
+ */
+export async function publishInSession(ref, deps) {
+    deps.markPublished(ref);
+    const result = await deps.publish(ref);
+    await deps.reconcile(ref);
+    if (!result.ok) {
+        deps.report(result.error);
+        throw new PublishRefusedError(result.error, deps.describe(result.error));
+    }
+}
 //# sourceMappingURL=publish-with-revision.js.map

package/dist/lib/operations/publish-with-revision.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-with-revision.js","sourceRoot":"","sources":["../../../src/lib/operations/publish-with-revision.ts"],"names":[],"mappings":"AAIA,wGAAwG;AACxG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAkBjC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAgB,EAChB,IAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IAClD,IAAI,MAAsD,CAAA;IAC1D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACxB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,MAAM,CAAA;QACvF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAA;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;YAAE,OAAO,MAAM,CAAA;IACpF,CAAC;IACD,OAAO,MAAO,CAAA;AAChB,CAAC","sourcesContent":["import type { CmsDocument, CmsValidationIssue, DocumentRef } from '@elytracms/core/cms-core'\nimport type { CmsDocumentRecord } from '@elytracms/core/persistence'\nimport type { OperationResult } from './operations-package'\n\n/** EC-595 point 6: a publish refused because the draft moved is re-validated and retried this often. */\nexport const PUBLISH_ATTEMPTS = 3\n\nexport interface PublishWithRevisionDeps {\n  /** The FORCED FLUSH: every queued patch of the document lands (the session adopts the committed draft). */\n  flush(ref: DocumentRef): Promise<void>\n  /** The revision the session's view of the document is at. */\n  revisionOf(ref: DocumentRef): number | undefined\n  /** `documents.publish({ ref, expectedRevision })`. */\n  publish(ref: DocumentRef, expectedRevision: number | undefined): Promise<OperationResult<CmsDocumentRecord>>\n  /** Adopt a server row (the publish result, or a refusal's `current`). */\n  adopt(record: CmsDocumentRecord): void\n  /** The session's view of the document after an adoption. */\n  documentOf(ref: DocumentRef): CmsDocument | undefined\n  /** The session's (display) validation — re-run on the moved draft before a retry. */\n  validate(document: CmsDocument): readonly CmsValidationIssue[]\n  attempts?: number\n}\n\n/**\n * EC-595 binding point 6 — publish the revision the client validated (pure, deps\n * injected — unit-tested without a React tree).\n *\n * FORCED FLUSH, then `documents.publish({ expectedRevision })`: the store refuses when\n * the draft moved since (a colleague's save landed between the flush and the publish —\n * Codex P05). On that refusal the session adopts the current row, RE-VALIDATES what\n * would now be published, and retries — bounded by {@link PUBLISH_ATTEMPTS}, and never\n * past a blocking issue the moved draft carries (the refusal is returned instead, so\n * nothing unvalidated is published). Any other failure is returned as is.\n */\nexport async function publishWithRevision(\n  ref: DocumentRef,\n  deps: PublishWithRevisionDeps,\n): Promise<OperationResult<CmsDocumentRecord>> {\n  const attempts = deps.attempts ?? PUBLISH_ATTEMPTS\n  let result: OperationResult<CmsDocumentRecord> | undefined\n  for (let attempt = 0; attempt < attempts; attempt += 1) {\n    await deps.flush(ref)\n    result = await deps.publish(ref, deps.revisionOf(ref))\n    if (result.ok) {\n      deps.adopt(result.value)\n      return result\n    }\n    const error = result.error\n    if (error.code !== 'conflict' || !('current' in error) || !error.current) return result\n    deps.adopt(error.current)\n    const view = deps.documentOf(ref) ?? error.current.document\n    if (deps.validate(view).some((issue) => issue.severity === 'error')) return result\n  }\n  return result!\n}\n"]}
+{"version":3,"file":"publish-with-revision.js","sourceRoot":"","sources":["../../../src/lib/operations/publish-with-revision.ts"],"names":[],"mappings":"AAIA,wGAAwG;AACxG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAA;AAkBjC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAgB,EAChB,IAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IAClD,IAAI,MAAsD,CAAA;IAC1D,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrB,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QACtD,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACxB,OAAO,MAAM,CAAA;QACf,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;QAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,MAAM,CAAA;QACvF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAA;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC;YAAE,OAAO,MAAM,CAAA;IACpF,CAAC;IACD,OAAO,MAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAEjC;IADX,YACW,KAAqB,EAC9B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAA;QAHL,UAAK,GAAL,KAAK,CAAgB;QAI9B,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAeD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAgB,EAAE,IAA0B;IACjF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACzB,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC","sourcesContent":["import type { CmsDocument, CmsValidationIssue, DocumentRef } from '@elytracms/core/cms-core'\nimport type { CmsDocumentRecord } from '@elytracms/core/persistence'\nimport type { OperationError, OperationResult } from './operations-package'\n\n/** EC-595 point 6: a publish refused because the draft moved is re-validated and retried this often. */\nexport const PUBLISH_ATTEMPTS = 3\n\nexport interface PublishWithRevisionDeps {\n  /** The FORCED FLUSH: every queued patch of the document lands (the session adopts the committed draft). */\n  flush(ref: DocumentRef): Promise<void>\n  /** The revision the session's view of the document is at. */\n  revisionOf(ref: DocumentRef): number | undefined\n  /** `documents.publish({ ref, expectedRevision })`. */\n  publish(ref: DocumentRef, expectedRevision: number | undefined): Promise<OperationResult<CmsDocumentRecord>>\n  /** Adopt a server row (the publish result, or a refusal's `current`). */\n  adopt(record: CmsDocumentRecord): void\n  /** The session's view of the document after an adoption. */\n  documentOf(ref: DocumentRef): CmsDocument | undefined\n  /** The session's (display) validation — re-run on the moved draft before a retry. */\n  validate(document: CmsDocument): readonly CmsValidationIssue[]\n  attempts?: number\n}\n\n/**\n * EC-595 binding point 6 — publish the revision the client validated (pure, deps\n * injected — unit-tested without a React tree).\n *\n * FORCED FLUSH, then `documents.publish({ expectedRevision })`: the store refuses when\n * the draft moved since (a colleague's save landed between the flush and the publish —\n * Codex P05). On that refusal the session adopts the current row, RE-VALIDATES what\n * would now be published, and retries — bounded by {@link PUBLISH_ATTEMPTS}, and never\n * past a blocking issue the moved draft carries (the refusal is returned instead, so\n * nothing unvalidated is published). Any other failure is returned as is.\n */\nexport async function publishWithRevision(\n  ref: DocumentRef,\n  deps: PublishWithRevisionDeps,\n): Promise<OperationResult<CmsDocumentRecord>> {\n  const attempts = deps.attempts ?? PUBLISH_ATTEMPTS\n  let result: OperationResult<CmsDocumentRecord> | undefined\n  for (let attempt = 0; attempt < attempts; attempt += 1) {\n    await deps.flush(ref)\n    result = await deps.publish(ref, deps.revisionOf(ref))\n    if (result.ok) {\n      deps.adopt(result.value)\n      return result\n    }\n    const error = result.error\n    if (error.code !== 'conflict' || !('current' in error) || !error.current) return result\n    deps.adopt(error.current)\n    const view = deps.documentOf(ref) ?? error.current.document\n    if (deps.validate(view).some((issue) => issue.severity === 'error')) return result\n  }\n  return result!\n}\n\n/**\n * EC-585 — a publish the operation REFUSED (validation, a strict target, a conflict that\n * did not settle, an unready asset library…), raised to the caller instead of resolving\n * as if it had landed. Before this, the session's `publishDocument` recorded the error\n * on the persist banner and RESOLVED, so the editor's controller set \"Published\" and\n * promote toasted success on a refusal (read on the base: `cms-store.tsx:1065-1075`,\n * `use-publish-controller.ts:94-96`). `message` is the localized sentence for a toast;\n * `error` carries the full refusal (issues included).\n */\nexport class PublishRefusedError extends Error {\n  constructor(\n    readonly error: OperationError,\n    message: string,\n  ) {\n    super(message)\n    this.name = 'PublishRefusedError'\n  }\n}\n\nexport interface PublishInSessionDeps {\n  /** The optimistic flip of the session's published set (reconciled below). */\n  markPublished(ref: DocumentRef): void\n  /** {@link publishWithRevision} for this session. */\n  publish(ref: DocumentRef): Promise<OperationResult<unknown>>\n  /** Re-read the authoritative record (the pin, the flags) — after success AND refusal. */\n  reconcile(ref: DocumentRef): Promise<void>\n  /** Surface the refusal on the session (the persist banner). */\n  report(error: OperationError): void\n  /** The localized sentence for a refusal. */\n  describe(error: OperationError): string\n}\n\n/**\n * EC-585 — the session's publish of one document (pure, deps injected): optimistic flip\n * → the one publish operation → reconcile against the backend record — and on a refusal,\n * report it AND reject with {@link PublishRefusedError}, so no caller (the editor's\n * Publish, the versions pane, promote) can show success for a publish that did not land.\n */\nexport async function publishInSession(ref: DocumentRef, deps: PublishInSessionDeps): Promise<void> {\n  deps.markPublished(ref)\n  const result = await deps.publish(ref)\n  await deps.reconcile(ref)\n  if (!result.ok) {\n    deps.report(result.error)\n    throw new PublishRefusedError(result.error, deps.describe(result.error))\n  }\n}\n"]}

package/dist/lib/operations/runtime-validator.d.ts

@@ -1,81 +1,32 @@
-import type { CmsDocument, CmsValidationIssue, LocaleConfig, ValidateDocumentOptions } from '@elytracms/core/cms-core';
-import type { AssetRecord, CmsDocumentRecord, PersistenceAdapter } from '@elytracms/core/persistence';
-import type { GateValidationInput } from '../../components/cms/gate-validation.js';
+import type { LocaleConfig } from '@elytracms/core/cms-core';
+import type { ComponentRegistry } from '@elytracms/core/component-registry';
 import type { CollectionsResolver, DocumentValidator } from './operations-package.js';
 /**
- * EC-595 A2 — THE publish gate's validator, bound to the OPERATIONS RUNTIME (Codex F23,
- * ruled EC-565 1f): built once per operations bundle from the resolved config, never
- * read from a React mount.
+ * EC-595 A2 → EC-582 — THE studio publish gate's validator, bound to the OPERATIONS
+ * RUNTIME (Codex F23, ruled EC-565 1f): built once per operations bundle, never read from
+ * a React mount. Since EC-582 it is core's `createDocumentValidator`
+ * (`@elytracms/core/validation` — the same gate a headless embedder and the CLI build):
+ * per call it resolves the OPERATION's project — its collections, locales and component
+ * registry (`registry(projectId)`: THAT project's manifests, never the active project's —
+ * a deployment may serve several projects with different component lists) — prefetches
+ * the oracles through the operation's adapter and runs the canonical validator.
  *
- * Before this module the gate read a module-global stack (`lib/cms/document-gate.ts`)
- * that every mounted `CmsProvider` pushed its session validator onto, innermost wins —
- * so the transfer dialog's second provider changed the verdict for the whole app, a
- * publish with no session mounted had nothing to ask, and an undeclared collection
- * answered `[]` (a pass). Measured red on the base (EC-595 Done, part A2).
- *
- * Per call (`documents.publish` → `validateDocument(document, { projectId, adapter })`):
- *
- * 1. **The project's config** — its collections (`collections(projectId)`) and locales.
- *    A collection the project does not declare is a BLOCKING issue: there are no field
- *    rules to judge it by, and passing it unjudged is the defect.
- * 2. **Oracles prefetched through the adapter** the operation runs on (the scratch
- *    adapter in a changeset dry run, the real one on apply): every document the draft
- *    references at every position THE reference walk reaches (`walkReferences`, EC-589 —
- *    existence + published-ness from the record's version pointer, what the
- *    validator's relation-target pass reads), the document's own collection (siblings — `validation.unique` and
- *    hierarchy cycles need the collection), and every asset it references
- *    (`assets.resolveMany` — existence + the field's `accept`).
- * 3. **An unready asset library refuses visibly** (EC-588 found-but-left, ruled 1f):
- *    when the asset read fails, a document that references assets is refused with a
- *    localised issue — never passed with the asset checks silently off.
- * 4. **The rules** — the ONE option bag (`gateValidateOptions`, EC-497: the same bag the
- *    editor's live validation builds over the session) over the prefetched world, so
- *    the sync `validateDocument` runs over data, not over the mount.
- *
- * The bag builder pulls in the composition leashes, which read the studio component
- * registry (→ `runtime-renderer`). `loadBag` is therefore imported DYNAMICALLY inside
- * the async validator, so the operations bootstrap's static module graph does not grow
- * by the registry (measured before/after, EC-595 Done part A2).
+ * `@elytracms/core/validation` (the composition leash pulls in the rich-text parser) is
+ * imported DYNAMICALLY inside the async validator, so the operations bootstrap's static
+ * module graph does not grow by it (measured before/after, EC-595 Done part A2 and EC-582
+ * Done).
  *
  * The editor's live validation keeps reading the session (that is display); the GATE
- * reads this.
+ * reads this. The refusals and their catalog keys (`GATE_*_MESSAGE_KEY`) are declared
+ * once, in core.
  */
-/** The catalog key of the unknown-collection refusal. */
-export declare const GATE_UNKNOWN_COLLECTION_MESSAGE_KEY = "cms.issueMessage.gateUnknownCollection";
-/** The catalog key of the unready-asset-library refusal. */
-export declare const GATE_ASSET_LIBRARY_UNREADY_MESSAGE_KEY = "cms.issueMessage.gateAssetLibraryUnready";
-/** The catalog key of the no-locales refusal. */
-export declare const GATE_NO_LOCALES_MESSAGE_KEY = "cms.issueMessage.gateNoLocales";
-/** The bag builder's signature (`components/cms/gate-validation.ts`), loaded lazily. */
-export type GateBagBuilder = (input: GateValidationInput) => ValidateDocumentOptions;
 export interface RuntimeValidatorOptions {
     /** The resolved config's collections, per project (the operations context's resolver). */
     readonly collections: CollectionsResolver;
-    /** The project's locale config; `undefined` → the project declares none (a blocking config issue elsewhere). */
+    /** The project's locale config; `undefined` → the project declares none (a blocking refusal). */
     readonly localeConfig: (projectId: string) => LocaleConfig | undefined;
-    /** THE option-bag builder, loaded on first use (see the module doc for why it is lazy). */
-    readonly loadBag: () => Promise<GateBagBuilder>;
+    /** The project's component registry (its manifests); `undefined` → it lists no components. */
+    readonly registry: (projectId: string) => ComponentRegistry | undefined;
 }
-/** The prefetched world one document is judged over. */
-export interface PrefetchedOracles {
-    /** The referenced documents + the document's own collection, as stored (drafts). */
-    readonly records: readonly CmsDocumentRecord[];
-    /** The referenced assets by id, or `'unready'` when the library could not be read. */
-    readonly assets: ReadonlyMap<string, AssetRecord> | 'unready';
-    /** Whether the document references any asset at all. */
-    readonly referencesAssets: boolean;
-}
-/**
- * Prefetch, through the adapter, exactly what `document` needs to be judged: the
- * documents it references, its own collection's documents, and the assets it
- * references. Exported for tests.
- */
-export declare function prefetchGateOracles(adapter: PersistenceAdapter, projectId: string, document: CmsDocument): Promise<PrefetchedOracles>;
-/** The unknown-collection refusal (exported for the catalog corpus test). */
-export declare function unknownCollectionRefusal(document: CmsDocument): CmsValidationIssue;
-/** The unready-asset-library refusal (exported for the catalog corpus test). */
-export declare function assetLibraryUnreadyRefusal(document: CmsDocument): CmsValidationIssue;
-/** The no-locales refusal (exported for the catalog corpus test). */
-export declare function noLocalesRefusal(document: CmsDocument): CmsValidationIssue;
 /** Build THE gate validator for an operations bundle. */
 export declare function createRuntimeDocumentValidator(options: RuntimeValidatorOptions): DocumentValidator;

package/dist/lib/operations/runtime-validator.js

@@ -1,144 +1,18 @@
-import { createCollectionRegistry, createDocumentStore, documentKey, validateDocument, walkReferences, } from '@elytracms/core/cms-core';
-/**
- * EC-595 A2 — THE publish gate's validator, bound to the OPERATIONS RUNTIME (Codex F23,
- * ruled EC-565 1f): built once per operations bundle from the resolved config, never
- * read from a React mount.
- *
- * Before this module the gate read a module-global stack (`lib/cms/document-gate.ts`)
- * that every mounted `CmsProvider` pushed its session validator onto, innermost wins —
- * so the transfer dialog's second provider changed the verdict for the whole app, a
- * publish with no session mounted had nothing to ask, and an undeclared collection
- * answered `[]` (a pass). Measured red on the base (EC-595 Done, part A2).
- *
- * Per call (`documents.publish` → `validateDocument(document, { projectId, adapter })`):
- *
- * 1. **The project's config** — its collections (`collections(projectId)`) and locales.
- *    A collection the project does not declare is a BLOCKING issue: there are no field
- *    rules to judge it by, and passing it unjudged is the defect.
- * 2. **Oracles prefetched through the adapter** the operation runs on (the scratch
- *    adapter in a changeset dry run, the real one on apply): every document the draft
- *    references at every position THE reference walk reaches (`walkReferences`, EC-589 —
- *    existence + published-ness from the record's version pointer, what the
- *    validator's relation-target pass reads), the document's own collection (siblings — `validation.unique` and
- *    hierarchy cycles need the collection), and every asset it references
- *    (`assets.resolveMany` — existence + the field's `accept`).
- * 3. **An unready asset library refuses visibly** (EC-588 found-but-left, ruled 1f):
- *    when the asset read fails, a document that references assets is refused with a
- *    localised issue — never passed with the asset checks silently off.
- * 4. **The rules** — the ONE option bag (`gateValidateOptions`, EC-497: the same bag the
- *    editor's live validation builds over the session) over the prefetched world, so
- *    the sync `validateDocument` runs over data, not over the mount.
- *
- * The bag builder pulls in the composition leashes, which read the studio component
- * registry (→ `runtime-renderer`). `loadBag` is therefore imported DYNAMICALLY inside
- * the async validator, so the operations bootstrap's static module graph does not grow
- * by the registry (measured before/after, EC-595 Done part A2).
- *
- * The editor's live validation keeps reading the session (that is display); the GATE
- * reads this.
- */
-/** The catalog key of the unknown-collection refusal. */
-export const GATE_UNKNOWN_COLLECTION_MESSAGE_KEY = 'cms.issueMessage.gateUnknownCollection';
-/** The catalog key of the unready-asset-library refusal. */
-export const GATE_ASSET_LIBRARY_UNREADY_MESSAGE_KEY = 'cms.issueMessage.gateAssetLibraryUnready';
-/** The catalog key of the no-locales refusal. */
-export const GATE_NO_LOCALES_MESSAGE_KEY = 'cms.issueMessage.gateNoLocales';
-/**
- * Prefetch, through the adapter, exactly what `document` needs to be judged: the
- * documents it references, its own collection's documents, and the assets it
- * references. Exported for tests.
- */
-export async function prefetchGateOracles(adapter, projectId, document) {
-    // THE reference walk (EC-589 `walkReferences`) — the one every reference reader calls,
-    // the validator's relation-target pass included: every position it reaches is a
-    // target whose existence and published-ness the pass reads, so it is exactly what is
-    // prefetched (a hidden position is a subset — the pass judges the publish strip).
-    const targetsByKey = new Map();
-    const assetIds = new Set();
-    walkReferences(document, (hit) => {
-        if (hit.target.type === 'document')
-            targetsByKey.set(documentKey(hit.target.ref), hit.target.ref);
-        else if (hit.target.type === 'asset')
-            assetIds.add(hit.target.id);
-    });
-    const siblings = adapter.cms.listDocuments(projectId, document.collection);
-    const targets = Promise.all([...targetsByKey.values()].map(async (ref) => 
-    // The document's own collection comes whole with the siblings (unique, hierarchy).
-    ref.collection === document.collection ? undefined : adapter.cms.findDocument(projectId, ref)));
-    let assets = new Map();
-    if (assetIds.size > 0) {
-        try {
-            assets = await adapter.assets.resolveMany(projectId, [...assetIds]);
-        }
-        catch {
-            assets = 'unready';
-        }
-    }
-    const [own, others] = await Promise.all([siblings, targets]);
-    return {
-        records: [...own, ...others.filter((record) => record !== undefined)],
-        assets,
-        referencesAssets: assetIds.size > 0,
-    };
-}
-function gateIssue(document, message, key, vars) {
-    return {
-        code: 'custom-validation',
-        severity: 'error',
-        message,
-        messageRef: { key, ...(vars ? { vars } : {}) },
-        path: [],
-        collectionId: document.collection,
-        documentId: document.id,
-    };
-}
-/** The unknown-collection refusal (exported for the catalog corpus test). */
-export function unknownCollectionRefusal(document) {
-    return gateIssue(document, `The project declares no collection “${document.collection}” — there are no rules to publish it by.`, GATE_UNKNOWN_COLLECTION_MESSAGE_KEY, { collection: document.collection });
-}
-/** The unready-asset-library refusal (exported for the catalog corpus test). */
-export function assetLibraryUnreadyRefusal(document) {
-    return gateIssue(document, 'The asset library could not be read — refusing to publish unverified asset references. Try again.', GATE_ASSET_LIBRARY_UNREADY_MESSAGE_KEY);
-}
-/** The no-locales refusal (exported for the catalog corpus test). */
-export function noLocalesRefusal(document) {
-    return gateIssue(document, 'The project declares no locales — refusing to publish without them.', GATE_NO_LOCALES_MESSAGE_KEY);
-}
 /** Build THE gate validator for an operations bundle. */
 export function createRuntimeDocumentValidator(options) {
+    let gate;
     return async (document, context) => {
-        const collections = options.collections(context.projectId);
-        const collection = collections.find((candidate) => candidate.id === document.collection);
-        if (!collection)
-            return [unknownCollectionRefusal(document)];
-        // EC-479: a project without locales has no storage key for a localized value; the
-        // gate refuses rather than inventing one.
-        const localeConfig = options.localeConfig(context.projectId);
-        if (!localeConfig)
-            return [noLocalesRefusal(document)];
-        const oracles = await prefetchGateOracles(context.adapter, context.projectId, document);
-        if (oracles.assets === 'unready' && oracles.referencesAssets) {
-            return [assetLibraryUnreadyRefusal(document)];
-        }
-        const published = new Set(oracles.records
-            .filter((record) => record.publishedVersion !== undefined)
-            .map((record) => documentKey(record.document)));
-        const assets = oracles.assets === 'unready' ? new Map() : oracles.assets;
-        const bag = await options.loadBag();
-        // The document under judgement is swapped into the store (the session bag's contract).
-        const store = createDocumentStore([
-            ...oracles.records
-                .map((record) => record.document)
-                .filter((doc) => !(doc.collection === document.collection && doc.id === document.id)),
-            document,
-        ]);
-        const validateOptions = bag({
-            store,
-            localeConfig,
-            isPublished: (ref) => published.has(documentKey(ref)),
-            findAsset: (id) => assets.get(id),
-        });
-        return validateDocument(createCollectionRegistry(collections), document, validateOptions);
+        gate ??= import('@elytracms/core/validation').then(({ createDocumentValidator }) => createDocumentValidator({
+            project: (projectId) => {
+                const registry = options.registry(projectId);
+                return {
+                    collections: options.collections(projectId),
+                    locales: options.localeConfig(projectId),
+                    ...(registry ? { registry } : {}),
+                };
+            },
+        }));
+        return (await gate)(document, context);
     };
 }
 //# sourceMappingURL=runtime-validator.js.map

package/dist/lib/operations/runtime-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-validator.js","sourceRoot":"","sources":["../../../src/lib/operations/runtime-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,cAAc,GACf,MAAM,0BAA0B,CAAA;AAYjC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,mCAAmC,GAAG,wCAAwC,CAAA;AAC3F,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sCAAsC,GAAG,0CAA0C,CAAA;AAEhG,iDAAiD;AACjD,MAAM,CAAC,MAAM,2BAA2B,GAAG,gCAAgC,CAAA;AAwB3E;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA2B,EAC3B,SAAiB,EACjB,QAAqB;IAErB,uFAAuF;IACvF,gFAAgF;IAChF,qFAAqF;IACrF,kFAAkF;IAClF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,cAAc,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;QAC/B,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;YAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;aAC5F,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CACzB,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC3C,mFAAmF;IACnF,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAC9F,CACF,CAAA;IACD,IAAI,MAAM,GAAgC,IAAI,GAAG,EAAE,CAAA;IACnD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAA;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAA;QACpB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IAC5D,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAA+B,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QAClG,MAAM;QACN,gBAAgB,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;KACpC,CAAA;AACH,CAAC;AAED,SAAS,SAAS,CAAC,QAAqB,EAAE,OAAe,EAAE,GAAW,EAAE,IAA6B;IACnG,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,OAAO;QACjB,OAAO;QACP,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QAC9C,IAAI,EAAE,EAAE;QACR,YAAY,EAAE,QAAQ,CAAC,UAAU;QACjC,UAAU,EAAE,QAAQ,CAAC,EAAE;KACxB,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,wBAAwB,CAAC,QAAqB;IAC5D,OAAO,SAAS,CACd,QAAQ,EACR,uCAAuC,QAAQ,CAAC,UAAU,0CAA0C,EACpG,mCAAmC,EACnC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CACpC,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,0BAA0B,CAAC,QAAqB;IAC9D,OAAO,SAAS,CACd,QAAQ,EACR,mGAAmG,EACnG,sCAAsC,CACvC,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,gBAAgB,CAAC,QAAqB;IACpD,OAAO,SAAS,CACd,QAAQ,EACR,qEAAqE,EACrE,2BAA2B,CAC5B,CAAA;AACH,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,8BAA8B,CAAC,OAAgC;IAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QACjC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC1D,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,UAAU,CAAC,CAAA;QACxF,IAAI,CAAC,UAAU;YAAE,OAAO,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC5D,kFAAkF;QAClF,0CAA0C;QAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC5D,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAA;QACtD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QACvF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC7D,OAAO,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC/C,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,OAAO,CAAC,OAAO;aACZ,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS,CAAC;aACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACjD,CAAA;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAA;QAC7F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACnC,uFAAuF;QACvF,MAAM,KAAK,GAAG,mBAAmB,CAAC;YAChC,GAAG,OAAO,CAAC,OAAO;iBACf,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;iBAChC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;YACvF,QAAQ;SACT,CAAC,CAAA;QACF,MAAM,eAAe,GAAG,GAAG,CAAC;YAC1B,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACrD,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;SAClC,CAAC,CAAA;QACF,OAAO,gBAAgB,CAAC,wBAAwB,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAA;IAC3F,CAAC,CAAA;AACH,CAAC","sourcesContent":["import {\n  createCollectionRegistry,\n  createDocumentStore,\n  documentKey,\n  validateDocument,\n  walkReferences,\n} from '@elytracms/core/cms-core'\nimport type {\n  CmsDocument,\n  CmsValidationIssue,\n  DocumentRef,\n  LocaleConfig,\n  ValidateDocumentOptions,\n} from '@elytracms/core/cms-core'\nimport type { AssetRecord, CmsDocumentRecord, PersistenceAdapter } from '@elytracms/core/persistence'\nimport type { GateValidationInput } from '../../components/cms/gate-validation'\nimport type { CollectionsResolver, DocumentValidator } from './operations-package'\n\n/**\n * EC-595 A2 — THE publish gate's validator, bound to the OPERATIONS RUNTIME (Codex F23,\n * ruled EC-565 1f): built once per operations bundle from the resolved config, never\n * read from a React mount.\n *\n * Before this module the gate read a module-global stack (`lib/cms/document-gate.ts`)\n * that every mounted `CmsProvider` pushed its session validator onto, innermost wins —\n * so the transfer dialog's second provider changed the verdict for the whole app, a\n * publish with no session mounted had nothing to ask, and an undeclared collection\n * answered `[]` (a pass). Measured red on the base (EC-595 Done, part A2).\n *\n * Per call (`documents.publish` → `validateDocument(document, { projectId, adapter })`):\n *\n * 1. **The project's config** — its collections (`collections(projectId)`) and locales.\n *    A collection the project does not declare is a BLOCKING issue: there are no field\n *    rules to judge it by, and passing it unjudged is the defect.\n * 2. **Oracles prefetched through the adapter** the operation runs on (the scratch\n *    adapter in a changeset dry run, the real one on apply): every document the draft\n *    references at every position THE reference walk reaches (`walkReferences`, EC-589 —\n *    existence + published-ness from the record's version pointer, what the\n *    validator's relation-target pass reads), the document's own collection (siblings — `validation.unique` and\n *    hierarchy cycles need the collection), and every asset it references\n *    (`assets.resolveMany` — existence + the field's `accept`).\n * 3. **An unready asset library refuses visibly** (EC-588 found-but-left, ruled 1f):\n *    when the asset read fails, a document that references assets is refused with a\n *    localised issue — never passed with the asset checks silently off.\n * 4. **The rules** — the ONE option bag (`gateValidateOptions`, EC-497: the same bag the\n *    editor's live validation builds over the session) over the prefetched world, so\n *    the sync `validateDocument` runs over data, not over the mount.\n *\n * The bag builder pulls in the composition leashes, which read the studio component\n * registry (→ `runtime-renderer`). `loadBag` is therefore imported DYNAMICALLY inside\n * the async validator, so the operations bootstrap's static module graph does not grow\n * by the registry (measured before/after, EC-595 Done part A2).\n *\n * The editor's live validation keeps reading the session (that is display); the GATE\n * reads this.\n */\n\n/** The catalog key of the unknown-collection refusal. */\nexport const GATE_UNKNOWN_COLLECTION_MESSAGE_KEY = 'cms.issueMessage.gateUnknownCollection'\n/** The catalog key of the unready-asset-library refusal. */\nexport const GATE_ASSET_LIBRARY_UNREADY_MESSAGE_KEY = 'cms.issueMessage.gateAssetLibraryUnready'\n\n/** The catalog key of the no-locales refusal. */\nexport const GATE_NO_LOCALES_MESSAGE_KEY = 'cms.issueMessage.gateNoLocales'\n\n/** The bag builder's signature (`components/cms/gate-validation.ts`), loaded lazily. */\nexport type GateBagBuilder = (input: GateValidationInput) => ValidateDocumentOptions\n\nexport interface RuntimeValidatorOptions {\n  /** The resolved config's collections, per project (the operations context's resolver). */\n  readonly collections: CollectionsResolver\n  /** The project's locale config; `undefined` → the project declares none (a blocking config issue elsewhere). */\n  readonly localeConfig: (projectId: string) => LocaleConfig | undefined\n  /** THE option-bag builder, loaded on first use (see the module doc for why it is lazy). */\n  readonly loadBag: () => Promise<GateBagBuilder>\n}\n\n/** The prefetched world one document is judged over. */\nexport interface PrefetchedOracles {\n  /** The referenced documents + the document's own collection, as stored (drafts). */\n  readonly records: readonly CmsDocumentRecord[]\n  /** The referenced assets by id, or `'unready'` when the library could not be read. */\n  readonly assets: ReadonlyMap<string, AssetRecord> | 'unready'\n  /** Whether the document references any asset at all. */\n  readonly referencesAssets: boolean\n}\n\n/**\n * Prefetch, through the adapter, exactly what `document` needs to be judged: the\n * documents it references, its own collection's documents, and the assets it\n * references. Exported for tests.\n */\nexport async function prefetchGateOracles(\n  adapter: PersistenceAdapter,\n  projectId: string,\n  document: CmsDocument,\n): Promise<PrefetchedOracles> {\n  // THE reference walk (EC-589 `walkReferences`) — the one every reference reader calls,\n  // the validator's relation-target pass included: every position it reaches is a\n  // target whose existence and published-ness the pass reads, so it is exactly what is\n  // prefetched (a hidden position is a subset — the pass judges the publish strip).\n  const targetsByKey = new Map<string, DocumentRef>()\n  const assetIds = new Set<string>()\n  walkReferences(document, (hit) => {\n    if (hit.target.type === 'document') targetsByKey.set(documentKey(hit.target.ref), hit.target.ref)\n    else if (hit.target.type === 'asset') assetIds.add(hit.target.id)\n  })\n  const siblings = adapter.cms.listDocuments(projectId, document.collection)\n  const targets = Promise.all(\n    [...targetsByKey.values()].map(async (ref) =>\n      // The document's own collection comes whole with the siblings (unique, hierarchy).\n      ref.collection === document.collection ? undefined : adapter.cms.findDocument(projectId, ref),\n    ),\n  )\n  let assets: PrefetchedOracles['assets'] = new Map()\n  if (assetIds.size > 0) {\n    try {\n      assets = await adapter.assets.resolveMany(projectId, [...assetIds])\n    } catch {\n      assets = 'unready'\n    }\n  }\n  const [own, others] = await Promise.all([siblings, targets])\n  return {\n    records: [...own, ...others.filter((record): record is CmsDocumentRecord => record !== undefined)],\n    assets,\n    referencesAssets: assetIds.size > 0,\n  }\n}\n\nfunction gateIssue(document: CmsDocument, message: string, key: string, vars?: Record<string, string>): CmsValidationIssue {\n  return {\n    code: 'custom-validation',\n    severity: 'error',\n    message,\n    messageRef: { key, ...(vars ? { vars } : {}) },\n    path: [],\n    collectionId: document.collection,\n    documentId: document.id,\n  }\n}\n\n/** The unknown-collection refusal (exported for the catalog corpus test). */\nexport function unknownCollectionRefusal(document: CmsDocument): CmsValidationIssue {\n  return gateIssue(\n    document,\n    `The project declares no collection “${document.collection}” — there are no rules to publish it by.`,\n    GATE_UNKNOWN_COLLECTION_MESSAGE_KEY,\n    { collection: document.collection },\n  )\n}\n\n/** The unready-asset-library refusal (exported for the catalog corpus test). */\nexport function assetLibraryUnreadyRefusal(document: CmsDocument): CmsValidationIssue {\n  return gateIssue(\n    document,\n    'The asset library could not be read — refusing to publish unverified asset references. Try again.',\n    GATE_ASSET_LIBRARY_UNREADY_MESSAGE_KEY,\n  )\n}\n\n/** The no-locales refusal (exported for the catalog corpus test). */\nexport function noLocalesRefusal(document: CmsDocument): CmsValidationIssue {\n  return gateIssue(\n    document,\n    'The project declares no locales — refusing to publish without them.',\n    GATE_NO_LOCALES_MESSAGE_KEY,\n  )\n}\n\n/** Build THE gate validator for an operations bundle. */\nexport function createRuntimeDocumentValidator(options: RuntimeValidatorOptions): DocumentValidator {\n  return async (document, context) => {\n    const collections = options.collections(context.projectId)\n    const collection = collections.find((candidate) => candidate.id === document.collection)\n    if (!collection) return [unknownCollectionRefusal(document)]\n    // EC-479: a project without locales has no storage key for a localized value; the\n    // gate refuses rather than inventing one.\n    const localeConfig = options.localeConfig(context.projectId)\n    if (!localeConfig) return [noLocalesRefusal(document)]\n    const oracles = await prefetchGateOracles(context.adapter, context.projectId, document)\n    if (oracles.assets === 'unready' && oracles.referencesAssets) {\n      return [assetLibraryUnreadyRefusal(document)]\n    }\n    const published = new Set(\n      oracles.records\n        .filter((record) => record.publishedVersion !== undefined)\n        .map((record) => documentKey(record.document)),\n    )\n    const assets = oracles.assets === 'unready' ? new Map<string, AssetRecord>() : oracles.assets\n    const bag = await options.loadBag()\n    // The document under judgement is swapped into the store (the session bag's contract).\n    const store = createDocumentStore([\n      ...oracles.records\n        .map((record) => record.document)\n        .filter((doc) => !(doc.collection === document.collection && doc.id === document.id)),\n      document,\n    ])\n    const validateOptions = bag({\n      store,\n      localeConfig,\n      isPublished: (ref) => published.has(documentKey(ref)),\n      findAsset: (id) => assets.get(id),\n    })\n    return validateDocument(createCollectionRegistry(collections), document, validateOptions)\n  }\n}\n"]}
+{"version":3,"file":"runtime-validator.js","sourceRoot":"","sources":["../../../src/lib/operations/runtime-validator.ts"],"names":[],"mappings":"AAiCA,yDAAyD;AACzD,MAAM,UAAU,8BAA8B,CAAC,OAAgC;IAC7E,IAAI,IAA8H,CAAA;IAClI,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;QACjC,IAAI,KAAK,MAAM,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,EAAE,CACjF,uBAAuB,CAAC;YACtB,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE;gBACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;gBAC5C,OAAO;oBACL,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;oBAC3C,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC;oBACxC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClC,CAAA;YACH,CAAC;SACF,CAAC,CACH,CAAA;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACxC,CAAC,CAAA;AACH,CAAC","sourcesContent":["import type { CmsDocument, CmsValidationIssue, LocaleConfig } from '@elytracms/core/cms-core'\nimport type { ComponentRegistry } from '@elytracms/core/component-registry'\nimport type { CollectionsResolver, DocumentValidator } from './operations-package'\n\n/**\n * EC-595 A2 → EC-582 — THE studio publish gate's validator, bound to the OPERATIONS\n * RUNTIME (Codex F23, ruled EC-565 1f): built once per operations bundle, never read from\n * a React mount. Since EC-582 it is core's `createDocumentValidator`\n * (`@elytracms/core/validation` — the same gate a headless embedder and the CLI build):\n * per call it resolves the OPERATION's project — its collections, locales and component\n * registry (`registry(projectId)`: THAT project's manifests, never the active project's —\n * a deployment may serve several projects with different component lists) — prefetches\n * the oracles through the operation's adapter and runs the canonical validator.\n *\n * `@elytracms/core/validation` (the composition leash pulls in the rich-text parser) is\n * imported DYNAMICALLY inside the async validator, so the operations bootstrap's static\n * module graph does not grow by it (measured before/after, EC-595 Done part A2 and EC-582\n * Done).\n *\n * The editor's live validation keeps reading the session (that is display); the GATE\n * reads this. The refusals and their catalog keys (`GATE_*_MESSAGE_KEY`) are declared\n * once, in core.\n */\n\nexport interface RuntimeValidatorOptions {\n  /** The resolved config's collections, per project (the operations context's resolver). */\n  readonly collections: CollectionsResolver\n  /** The project's locale config; `undefined` → the project declares none (a blocking refusal). */\n  readonly localeConfig: (projectId: string) => LocaleConfig | undefined\n  /** The project's component registry (its manifests); `undefined` → it lists no components. */\n  readonly registry: (projectId: string) => ComponentRegistry | undefined\n}\n\n/** Build THE gate validator for an operations bundle. */\nexport function createRuntimeDocumentValidator(options: RuntimeValidatorOptions): DocumentValidator {\n  let gate: Promise<(document: CmsDocument, context: Parameters<DocumentValidator>[1]) => Promise<CmsValidationIssue[]>> | undefined\n  return async (document, context) => {\n    gate ??= import('@elytracms/core/validation').then(({ createDocumentValidator }) =>\n      createDocumentValidator({\n        project: (projectId) => {\n          const registry = options.registry(projectId)\n          return {\n            collections: options.collections(projectId),\n            locales: options.localeConfig(projectId),\n            ...(registry ? { registry } : {}),\n          }\n        },\n      }),\n    )\n    return (await gate)(document, context)\n  }\n}\n"]}

package/dist/lib/operations/studio-operations.d.ts

@@ -1,6 +1,6 @@
 import type { DocumentListener, IdFactory, PersistenceAdapter, PresenceInput } from '@elytracms/core/persistence';
 import type { DocumentRef } from '@elytracms/core/cms-core';
-import type { ChangesetOperations, CollectionsResolver, DocumentValidator, ManifestLookupResolver, OperationsClient, Principal, ReferenceIndexAttachment } from './operations-package.js';
+import type { ChangesetOperations, CollectionsResolver, DocumentValidator, LocalesResolver, ManifestLookupResolver, OperationsClient, Principal, ReferenceIndexAttachment } from './operations-package.js';
 /**
  * The studio's single operations bootstrap (EC-141, vision AD-7).
  *
@@ -56,7 +56,7 @@ export interface CreateStudioOperationsOptions {
     /**
      * EC-583 / EC-559 — the collection definitions on the operations context, resolved for
      * each operation's OWN project id. Defaults to the workspace config's project with that
-     * slug (`resolveProjectCollections` — the resolved `elytra.config.ts`, functions
+     * slug (`projectCollections` — the resolved `elytra.config.ts`, functions
      * included), read on every call: the bundle is cached per deployment KEY (EC-179) and
      * one deployment may serve several config projects, so capturing one project's
      * collections at build time would canonicalise another project's documents against
@@ -81,6 +81,13 @@ export interface CreateStudioOperationsOptions {
      * through a mount.
      */
     validateDocument?: DocumentValidator;
+    /**
+     * EC-585 — the locale config on the operations context, per project: the view
+     * `documents.publish` runs its hidden-clear in. Defaults to that config project's
+     * `locales` (`projectLocaleConfig`) — the same project, read the same way, as the
+     * collections, the manifests and the gate's validator.
+     */
+    locales?: LocalesResolver;
 }
 /** Build a studio operations bundle over an adapter (exported for tests). */
 export declare function createStudioOperations(adapter: PersistenceAdapter, options?: CreateStudioOperationsOptions): StudioOperations;