@elytracms/studio 0.0.92 → 0.0.94

package/dist/lib/operations/studio-operations.js

@@ -1,8 +1,7 @@
 import { activeDeploymentKey, selectPersistenceAdapter } from '../persistence/index.js';
-import { resolveProjectCollections } from '../workspace/index.js';
 import { attachSessionExpiryReporting } from '../session-expiry.js';
 import { projectManifestLookup } from './config-manifest-lookup.js';
-import { configProjectFor, projectLocaleConfig } from './project-runtime-config.js';
+import { configProjectFor, projectCollections, projectComponentRegistry, projectLocaleConfig, projectRolePolicyFor, } from './project-runtime-config.js';
 import { createRuntimeDocumentValidator } from './runtime-validator.js';
 import { attachReferenceIndex, createChangesets, createOperations, createRoleAuthorization, summarizeInput, toOperationError, } from './operations-package.js';
 /**
@@ -15,31 +14,38 @@ function noopReferenceIndexAttachment() {
 }
 /** Build a studio operations bundle over an adapter (exported for tests). */
 export function createStudioOperations(adapter, options = {}) {
+    // EC-605: the role hook is built WITHOUT a fixed policy — it grants by the policy the
+    // runtime resolves for each operation's project (`rolePolicy` below), the same one the
+    // operation's roles were validated against: one injection point, not two copies.
     const authorized = options.actor
         ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }
         : {};
     // EC-583: the collections come from the config (never the store), per project id;
     // EC-595 A1: so does the manifest lookup. Both ride the changesets runtime too.
-    const collections = options.collections ?? ((projectId) => resolveProjectCollections(projectId));
+    // EC-585: every per-project fact below is read from ONE source — the config project
+    // with the operation's slug (`configProjectFor`): collections, manifests, locales.
+    const collections = options.collections ?? projectCollections;
+    const locales = options.locales ?? projectLocaleConfig;
+    const rolePolicy = options.rolePolicy ?? projectRolePolicyFor;
     const idFactory = options.idFactory ? { idFactory: options.idFactory } : {};
     const manifestLookup = options.manifestLookup ?? projectManifestLookup((projectId) => configProjectFor(projectId)?.components);
-    // EC-595 A2 (F23): the publish gate's validator is bound to THIS bundle — the
-    // operation's project config + oracles prefetched through the adapter — never to
-    // whichever CMS session happens to be mounted (the retired `lib/cms/document-gate.ts`
-    // stack, where the innermost provider won). The option bag is the session's own
-    // (`gateValidateOptions`, EC-497), loaded lazily so the registry behind the
-    // composition leashes stays out of this bootstrap's static graph.
+    // EC-595 A2 (F23) → EC-582: the publish gate's validator is bound to THIS bundle —
+    // core's canonical gate (`@elytracms/core/validation`) over the OPERATION's project:
+    // its collections, locales and component registry (never the active project's) +
+    // oracles prefetched through the adapter — never whichever CMS session is mounted.
     const validateDocument = options.validateDocument ??
         createRuntimeDocumentValidator({
             collections,
-            localeConfig: projectLocaleConfig,
-            loadBag: () => import('../../components/cms/gate-validation.js').then((module) => module.gateValidateOptions),
+            localeConfig: locales,
+            registry: projectComponentRegistry,
         });
     const operations = createOperations({
         adapter,
         collections,
         validateDocument,
         manifestLookup,
+        locales,
+        rolePolicy,
         ...idFactory,
         ...authorized,
     });
@@ -60,6 +66,7 @@ export function createStudioOperations(adapter, options = {}) {
         // runtime validator, prefetching through the step's own (scratch or real) adapter.
         validateDocument,
         manifestLookup,
+        locales,
         ...idFactory,
         ...authorized,
     });

package/dist/lib/operations/studio-operations.js.map

@@ -1 +1 @@
-{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AA8F7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,kFAAkF;IAClF,gFAAgF;IAChF,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,yBAAyB,CAAC,SAAS,CAAC,CAAC,CAAA;IAC9E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;IACzG,8EAA8E;IAC9E,iFAAiF;IACjF,sFAAsF;IACtF,gFAAgF;IAChF,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB;QACxB,8BAA8B,CAAC;YAC7B,WAAW;YACX,YAAY,EAAE,mBAAmB;YACjC,OAAO,EAAE,GAAG,EAAE,CACZ,MAAM,CAAC,sCAAsC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC;SAC9F,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,WAAW;QACX,gBAAgB;QAChB,cAAc;QACd,GAAG,SAAS;QACZ,GAAG,UAAU;KACd,CAAC,CAAA;IACF,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,WAAW;QACX,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,iFAAiF;QACjF,mFAAmF;QACnF,gBAAgB;QAChB,cAAc;QACd,GAAG,SAAS;QACZ,GAAG,UAAU;KACd,CAAC,CAAA;IACF,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAE/C,gGAAgG;IAChG,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,KAAc,EAAE,KAAc,EAAE,EAAE;QAC1E,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,SAAS;YACT,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC;YACnC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,OAAO;QACL,UAAU;QACV,UAAU;QACV,OAAO;QACP,UAAU;QACV,iBAAiB,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,EAAE;YAC5C,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,aAAa,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;gBAC/D,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;SACF,CAAC;QACJ,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;gBAC9D,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,aAAa,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC;KACnG,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type {\n  DocumentListener,\n  IdFactory,\n  PersistenceAdapter,\n  PresenceInput,\n} from '@elytracms/core/persistence'\nimport type { DocumentRef } from '@elytracms/core/cms-core'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { resolveProjectCollections } from '../workspace'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { projectManifestLookup } from './config-manifest-lookup'\nimport { configProjectFor, projectLocaleConfig } from './project-runtime-config'\nimport { createRuntimeDocumentValidator } from './runtime-validator'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n  summarizeInput,\n  toOperationError,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  CollectionsResolver,\n  DocumentValidator,\n  ManifestLookupResolver,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n  /**\n   * EC-595 binding point 7 — subscribe to ONE document (the narrow EC-309 slice): the\n   * listener gets the current row + the presence on it, then one snapshot per change\n   * (Convex: the reactive client's server push; playground: the in-memory store's own\n   * writes). An adapter capability exposed through the in-process bundle — the UI never\n   * holds a reactive Convex client. A subscription failure is ALSO emitted as a failed\n   * `documents.subscribe` event on the operations bus, so an expired session reaches\n   * EC-403's one session-expiry chokepoint like any failed operation (never a silently\n   * stopped stream). Returns the unsubscribe function.\n   */\n  subscribeDocument(projectId: string, ref: DocumentRef, listener: DocumentListener): () => void\n  /** EC-595 — this session's field-presence heartbeat on a document (thin presence, Stage A). */\n  reportPresence(projectId: string, ref: DocumentRef, presence: PresenceInput): Promise<void>\n  /** EC-595 — remove this session's presence from a document. */\n  clearPresence(projectId: string, ref: DocumentRef, sessionId: string): Promise<void>\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n  /**\n   * EC-583 / EC-559 — the collection definitions on the operations context, resolved for\n   * each operation's OWN project id. Defaults to the workspace config's project with that\n   * slug (`resolveProjectCollections` — the resolved `elytra.config.ts`, functions\n   * included), read on every call: the bundle is cached per deployment KEY (EC-179) and\n   * one deployment may serve several config projects, so capturing one project's\n   * collections at build time would canonicalise another project's documents against\n   * them (operator correction to phase 1). The store holds no schema.\n   */\n  collections?: CollectionsResolver\n  /** EC-578 — the document-id factory (`documents.create`); UUIDs by default. */\n  idFactory?: IdFactory\n  /**\n   * EC-595 A1 (critic correction 4) → A2 — the manifest half of the write canonicaliser\n   * on the operations context, resolved for each operation's OWN project. Defaults to a\n   * lookup over that config project's component entries (`projectManifestLookup`), so\n   * every patch / replace canonicalises a composition's props with its project's\n   * manifests — never the active project's (A1 found-but-left #1).\n   */\n  manifestLookup?: ManifestLookupResolver\n  /**\n   * EC-595 A2 (F23) — the publish gate's validator, bound to THIS bundle. Defaults to\n   * the runtime validator (`createRuntimeDocumentValidator`: the operation's project's\n   * config + oracles prefetched through the adapter). Tests that pin persistence\n   * routing rather than gate strength inject their own here — at construction, never\n   * through a mount.\n   */\n  validateDocument?: DocumentValidator\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  // EC-583: the collections come from the config (never the store), per project id;\n  // EC-595 A1: so does the manifest lookup. Both ride the changesets runtime too.\n  const collections: CollectionsResolver =\n    options.collections ?? ((projectId) => resolveProjectCollections(projectId))\n  const idFactory = options.idFactory ? { idFactory: options.idFactory } : {}\n  const manifestLookup =\n    options.manifestLookup ?? projectManifestLookup((projectId) => configProjectFor(projectId)?.components)\n  // EC-595 A2 (F23): the publish gate's validator is bound to THIS bundle — the\n  // operation's project config + oracles prefetched through the adapter — never to\n  // whichever CMS session happens to be mounted (the retired `lib/cms/document-gate.ts`\n  // stack, where the innermost provider won). The option bag is the session's own\n  // (`gateValidateOptions`, EC-497), loaded lazily so the registry behind the\n  // composition leashes stays out of this bootstrap's static graph.\n  const validateDocument =\n    options.validateDocument ??\n    createRuntimeDocumentValidator({\n      collections,\n      localeConfig: projectLocaleConfig,\n      loadBag: () =>\n        import('../../components/cms/gate-validation').then((module) => module.gateValidateOptions),\n    })\n  const operations = createOperations({\n    adapter,\n    collections,\n    validateDocument,\n    manifestLookup,\n    ...idFactory,\n    ...authorized,\n  })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({\n    adapter,\n    collections,\n    events: operations.events,\n    // EC-497 / EC-595 A2: a changeset-driven publish is gated identically — the same\n    // runtime validator, prefetching through the step's own (scratch or real) adapter.\n    validateDocument,\n    manifestLookup,\n    ...idFactory,\n    ...authorized,\n  })\n  // EC-579: no revalidation emitter attaches here. Host revalidation is a property\n  // of the Convex write chokepoint (`convex/triggers.ts`), the one emitter — it\n  // catches every writer, keeps the signing secret server-side, and the playground's\n  // in-browser adapter is read by no host, so there is nothing to emit there.\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n\n  /** Report a capability failure on the bus (EC-403 sees an expiry like any failed operation). */\n  const reportFailure = (operation: string, input: unknown, error: unknown) => {\n    operations.events.emit({\n      operation,\n      domain: 'documents',\n      kind: 'query',\n      status: 'failed',\n      inputSummary: summarizeInput(input),\n      error: toOperationError(error),\n    })\n  }\n  return {\n    operations,\n    changesets,\n    adapter,\n    references,\n    subscribeDocument: (projectId, ref, listener) =>\n      adapter.cms.subscribeDocument(projectId, ref, {\n        onSnapshot: (snapshot) => listener.onSnapshot(snapshot),\n        onError: (error) => {\n          reportFailure('documents.subscribe', { projectId, ref }, error)\n          listener.onError?.(error)\n        },\n      }),\n    reportPresence: async (projectId, ref, presence) => {\n      try {\n        await adapter.cms.reportPresence(projectId, ref, presence)\n      } catch (error) {\n        reportFailure('documents.presence', { projectId, ref }, error)\n        throw error\n      }\n    },\n    clearPresence: (projectId, ref, sessionId) => adapter.cms.clearPresence(projectId, ref, sessionId),\n  }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/**\n * EC-595 A2 — the signed-in principal the operations clients act as (`null` signed out):\n * what this session's presence heartbeat names (\"X is in this field\") and how a conflict\n * tells \"you, in another tab\" from a colleague. Read-only; set by {@link setStudioSession}.\n */\nexport function getStudioActor(): Principal | null {\n  return currentActor\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}
+{"version":3,"file":"studio-operations.js","sourceRoot":"","sources":["../../../src/lib/operations/studio-operations.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAC9E,OAAO,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AA+G7B;;;;GAIG;AACH,SAAS,4BAA4B;IACnC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;AACpD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,UAAyC,EAAE;IAE3C,sFAAsF;IACtF,uFAAuF;IACvF,iFAAiF;IACjF,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,kFAAkF;IAClF,gFAAgF;IAChF,oFAAoF;IACpF,mFAAmF;IACnF,MAAM,WAAW,GAAwB,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAA;IAClF,MAAM,OAAO,GAAoB,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAA;IACvE,MAAM,UAAU,GAAuB,OAAO,CAAC,UAAU,IAAI,oBAAoB,CAAA;IACjF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,MAAM,cAAc,GAClB,OAAO,CAAC,cAAc,IAAI,qBAAqB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;IACzG,mFAAmF;IACnF,qFAAqF;IACrF,iFAAiF;IACjF,mFAAmF;IACnF,MAAM,gBAAgB,GACpB,OAAO,CAAC,gBAAgB;QACxB,8BAA8B,CAAC;YAC7B,WAAW;YACX,YAAY,EAAE,OAAO;YACrB,QAAQ,EAAE,wBAAwB;SACnC,CAAC,CAAA;IACJ,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,WAAW;QACX,gBAAgB;QAChB,cAAc;QACd,OAAO;QACP,UAAU;QACV,GAAG,SAAS;QACZ,GAAG,UAAU;KACd,CAAC,CAAA;IACF,mFAAmF;IACnF,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,+EAA+E;IAC/E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;QAChD,CAAC,CAAC,4BAA4B,EAAE;QAChC,CAAC,CAAC,oBAAoB,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpD,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,OAAO;QACP,WAAW;QACX,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,iFAAiF;QACjF,mFAAmF;QACnF,gBAAgB;QAChB,cAAc;QACd,OAAO;QACP,GAAG,SAAS;QACZ,GAAG,UAAU;KACd,CAAC,CAAA;IACF,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,mCAAmC;IACnC,4BAA4B,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;IAE/C,gGAAgG;IAChG,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAE,KAAc,EAAE,KAAc,EAAE,EAAE;QAC1E,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,SAAS;YACT,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,QAAQ;YAChB,YAAY,EAAE,cAAc,CAAC,KAAK,CAAC;YACnC,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,OAAO;QACL,UAAU;QACV,UAAU;QACV,OAAO;QACP,UAAU;QACV,iBAAiB,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,GAAG,EAAE;YAC5C,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvD,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBACjB,aAAa,CAAC,qBAAqB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;gBAC/D,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAA;YAC3B,CAAC;SACF,CAAC;QACJ,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE;YACjD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC5D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,aAAa,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,CAAA;gBAC9D,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QACD,aAAa,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC;KACnG,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAA;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAqC,CAAA;AACnE,IAAI,YAAY,GAAqB,IAAI,CAAA;AAEzC;;;;;GAKG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,mBAAmB,EAAE,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAA;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,wBAAwB,EAAE,CAAA;QACpC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAA;IAC3B,IAAI,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,YAAY,CAAA;QAC1B,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1C,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxD,CAAA;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAuB;IACtD,IAAI,YAAY,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE;QAAE,OAAM,CAAC,8CAA8C;IACzF,YAAY,GAAG,KAAK,CAAA;IACpB,cAAc,CAAC,KAAK,EAAE,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CAAC,IAA6B;IACvE,IAAI,IAAI,EAAE,CAAC;QACT,cAAc,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1D,OAAM;IACR,CAAC;IACD,cAAc,CAAC,KAAK,EAAE,CAAA;IACtB,aAAa,CAAC,KAAK,EAAE,CAAA;IACrB,YAAY,GAAG,IAAI,CAAA;AACrB,CAAC","sourcesContent":["import type {\n  DocumentListener,\n  IdFactory,\n  PersistenceAdapter,\n  PresenceInput,\n} from '@elytracms/core/persistence'\nimport type { DocumentRef } from '@elytracms/core/cms-core'\nimport { activeDeploymentKey, selectPersistenceAdapter } from '../persistence'\nimport { attachSessionExpiryReporting } from '../session-expiry'\nimport { projectManifestLookup } from './config-manifest-lookup'\nimport {\n  configProjectFor,\n  projectCollections,\n  projectComponentRegistry,\n  projectLocaleConfig,\n  projectRolePolicyFor,\n} from './project-runtime-config'\nimport { createRuntimeDocumentValidator } from './runtime-validator'\nimport {\n  attachReferenceIndex,\n  createChangesets,\n  createOperations,\n  createRoleAuthorization,\n  summarizeInput,\n  toOperationError,\n} from './operations-package'\nimport type {\n  ChangesetOperations,\n  CollectionsResolver,\n  DocumentValidator,\n  LocalesResolver,\n  ManifestLookupResolver,\n  OperationsClient,\n  Principal,\n  ReferenceIndexAttachment,\n  RolePolicyResolver,\n} from './operations-package'\n\n/**\n * The studio's single operations bootstrap (EC-141, vision AD-7).\n *\n * One `OperationsClient` + one `ChangesetOperations` instance, built over the\n * selected persistence adapter, shared by every store and surface in the app.\n * The UI never talks to a repository for writes — every mutation is a typed\n * operation command (validate → authorize → mutate → event), so the studio\n * dogfoods the same seam plugins, AI changesets, and the CLI use.\n *\n * The EC-155 reference index is attached to the shared event bus here, so any\n * document/graph/publishing command issued anywhere in the studio keeps the\n * index maintained.\n */\nexport interface StudioOperations {\n  readonly operations: OperationsClient\n  readonly changesets: ChangesetOperations\n  /**\n   * The raw adapter, exposed for *transport and read paths only*: blob byte\n   * upload/download (`adapter.blobs`) and existing read stores. Studio code\n   * must not call repository write methods on it — writes go through\n   * `operations`.\n   */\n  readonly adapter: PersistenceAdapter\n  /** EC-155 maintained-on-write index attachment (flushable in tests). */\n  readonly references: ReferenceIndexAttachment\n  /**\n   * EC-595 binding point 7 — subscribe to ONE document (the narrow EC-309 slice): the\n   * listener gets the current row + the presence on it, then one snapshot per change\n   * (Convex: the reactive client's server push; playground: the in-memory store's own\n   * writes). An adapter capability exposed through the in-process bundle — the UI never\n   * holds a reactive Convex client. A subscription failure is ALSO emitted as a failed\n   * `documents.subscribe` event on the operations bus, so an expired session reaches\n   * EC-403's one session-expiry chokepoint like any failed operation (never a silently\n   * stopped stream). Returns the unsubscribe function.\n   */\n  subscribeDocument(projectId: string, ref: DocumentRef, listener: DocumentListener): () => void\n  /** EC-595 — this session's field-presence heartbeat on a document (thin presence, Stage A). */\n  reportPresence(projectId: string, ref: DocumentRef, presence: PresenceInput): Promise<void>\n  /** EC-595 — remove this session's presence from a document. */\n  clearPresence(projectId: string, ref: DocumentRef, sessionId: string): Promise<void>\n}\n\nexport interface CreateStudioOperationsOptions {\n  /**\n   * The signed-in principal (EC-150). When present, the EC-150 role hook\n   * (`createRoleAuthorization` over `adapter.members`) becomes the\n   * authorization chokepoint for every command and query — viewers get\n   * structured denials on mutations, editors on administration. Without an\n   * actor the client runs pass-through (seeds, fixtures, tests that exercise\n   * domain logic rather than permissions); the route guard keeps\n   * unauthenticated users away from every operation surface.\n   */\n  actor?: Principal\n  /**\n   * EC-583 / EC-559 — the collection definitions on the operations context, resolved for\n   * each operation's OWN project id. Defaults to the workspace config's project with that\n   * slug (`projectCollections` — the resolved `elytra.config.ts`, functions\n   * included), read on every call: the bundle is cached per deployment KEY (EC-179) and\n   * one deployment may serve several config projects, so capturing one project's\n   * collections at build time would canonicalise another project's documents against\n   * them (operator correction to phase 1). The store holds no schema.\n   */\n  collections?: CollectionsResolver\n  /** EC-578 — the document-id factory (`documents.create`); UUIDs by default. */\n  idFactory?: IdFactory\n  /**\n   * EC-595 A1 (critic correction 4) → A2 — the manifest half of the write canonicaliser\n   * on the operations context, resolved for each operation's OWN project. Defaults to a\n   * lookup over that config project's component entries (`projectManifestLookup`), so\n   * every patch / replace canonicalises a composition's props with its project's\n   * manifests — never the active project's (A1 found-but-left #1).\n   */\n  manifestLookup?: ManifestLookupResolver\n  /**\n   * EC-595 A2 (F23) — the publish gate's validator, bound to THIS bundle. Defaults to\n   * the runtime validator (`createRuntimeDocumentValidator`: the operation's project's\n   * config + oracles prefetched through the adapter). Tests that pin persistence\n   * routing rather than gate strength inject their own here — at construction, never\n   * through a mount.\n   */\n  validateDocument?: DocumentValidator\n  /**\n   * EC-585 — the locale config on the operations context, per project: the view\n   * `documents.publish` runs its hidden-clear in. Defaults to that config project's\n   * `locales` (`projectLocaleConfig`) — the same project, read the same way, as the\n   * collections, the manifests and the gate's validator.\n   */\n  locales?: LocalesResolver\n  /**\n   * EC-605 — the role policy, per project: what a role an operation grants is validated\n   * against and what the role hook (`createRoleAuthorization`, which reads it from the\n   * runtime) grants by. Defaults to that config project's `roles` declaration\n   * (`projectRolePolicyFor`; the default policy when it declares none) — read the same\n   * way as the collections and locales.\n   */\n  rolePolicy?: RolePolicyResolver\n}\n\n/**\n * A no-op {@link ReferenceIndexAttachment} for self-maintaining adapters (EC-277):\n * nothing is subscribed, so `detach` and `flush` are trivially satisfied (the index\n * is kept current in the adapter's write path, not by a queued subscriber).\n */\nfunction noopReferenceIndexAttachment(): ReferenceIndexAttachment {\n  return { detach: () => {}, flush: async () => {} }\n}\n\n/** Build a studio operations bundle over an adapter (exported for tests). */\nexport function createStudioOperations(\n  adapter: PersistenceAdapter,\n  options: CreateStudioOperationsOptions = {},\n): StudioOperations {\n  // EC-605: the role hook is built WITHOUT a fixed policy — it grants by the policy the\n  // runtime resolves for each operation's project (`rolePolicy` below), the same one the\n  // operation's roles were validated against: one injection point, not two copies.\n  const authorized = options.actor\n    ? { actor: options.actor, authorize: createRoleAuthorization(adapter.members) }\n    : {}\n  // EC-583: the collections come from the config (never the store), per project id;\n  // EC-595 A1: so does the manifest lookup. Both ride the changesets runtime too.\n  // EC-585: every per-project fact below is read from ONE source — the config project\n  // with the operation's slug (`configProjectFor`): collections, manifests, locales.\n  const collections: CollectionsResolver = options.collections ?? projectCollections\n  const locales: LocalesResolver = options.locales ?? projectLocaleConfig\n  const rolePolicy: RolePolicyResolver = options.rolePolicy ?? projectRolePolicyFor\n  const idFactory = options.idFactory ? { idFactory: options.idFactory } : {}\n  const manifestLookup =\n    options.manifestLookup ?? projectManifestLookup((projectId) => configProjectFor(projectId)?.components)\n  // EC-595 A2 (F23) → EC-582: the publish gate's validator is bound to THIS bundle —\n  // core's canonical gate (`@elytracms/core/validation`) over the OPERATION's project:\n  // its collections, locales and component registry (never the active project's) +\n  // oracles prefetched through the adapter — never whichever CMS session is mounted.\n  const validateDocument =\n    options.validateDocument ??\n    createRuntimeDocumentValidator({\n      collections,\n      localeConfig: locales,\n      registry: projectComponentRegistry,\n    })\n  const operations = createOperations({\n    adapter,\n    collections,\n    validateDocument,\n    manifestLookup,\n    locales,\n    rolePolicy,\n    ...idFactory,\n    ...authorized,\n  })\n  // EC-277: when the adapter maintains the index in its own write path (AD-6 \"at the\n  // source\" — the Convex provider does this server-side, so a raw `convex run` is\n  // caught too), the client-side subscriber would only double the work. Attach it\n  // ONLY for providers that don't self-maintain. Where it does run, extraction is a\n  // schema-free, manifest-free walk over self-describing content, so it needs no\n  // registry (compositions self-typed their relation/asset props on write).\n  const references = adapter.maintainsReferenceIndex\n    ? noopReferenceIndexAttachment()\n    : attachReferenceIndex(operations.events, adapter)\n  const changesets = createChangesets({\n    adapter,\n    collections,\n    events: operations.events,\n    // EC-497 / EC-595 A2: a changeset-driven publish is gated identically — the same\n    // runtime validator, prefetching through the step's own (scratch or real) adapter.\n    validateDocument,\n    manifestLookup,\n    locales,\n    ...idFactory,\n    ...authorized,\n  })\n  // EC-579: no revalidation emitter attaches here. Host revalidation is a property\n  // of the Convex write chokepoint (`convex/triggers.ts`), the one emitter — it\n  // catches every writer, keeps the signing secret server-side, and the playground's\n  // in-browser adapter is read by no host, so there is nothing to emit there.\n  // EC-403: session-expiry detection rides the SAME lifecycle bus — every failed\n  // command/query/changeset operation is checked against the session-expired\n  // predicate here, so expiry raises the ONE app-level blocking re-auth state no\n  // matter which surface issued the operation (per-surface banners can't cover\n  // surfaces that render no banner).\n  attachSessionExpiryReporting(operations.events)\n\n  /** Report a capability failure on the bus (EC-403 sees an expiry like any failed operation). */\n  const reportFailure = (operation: string, input: unknown, error: unknown) => {\n    operations.events.emit({\n      operation,\n      domain: 'documents',\n      kind: 'query',\n      status: 'failed',\n      inputSummary: summarizeInput(input),\n      error: toOperationError(error),\n    })\n  }\n  return {\n    operations,\n    changesets,\n    adapter,\n    references,\n    subscribeDocument: (projectId, ref, listener) =>\n      adapter.cms.subscribeDocument(projectId, ref, {\n        onSnapshot: (snapshot) => listener.onSnapshot(snapshot),\n        onError: (error) => {\n          reportFailure('documents.subscribe', { projectId, ref }, error)\n          listener.onError?.(error)\n        },\n      }),\n    reportPresence: async (projectId, ref, presence) => {\n      try {\n        await adapter.cms.reportPresence(projectId, ref, presence)\n      } catch (error) {\n        reportFailure('documents.presence', { projectId, ref }, error)\n        throw error\n      }\n    },\n    clearPresence: (projectId, ref, sessionId) => adapter.cms.clearPresence(projectId, ref, sessionId),\n  }\n}\n\n// One adapter + one operations bundle per backend (EC-179): keyed by the active\n// deployment so switching to a project on another Convex deployment selects (or\n// lazily builds) that backend's client, rather than reusing the first one.\nconst adaptersByKey = new Map<string, Promise<PersistenceAdapter>>()\nconst instancesByKey = new Map<string, Promise<StudioOperations>>()\nlet currentActor: Principal | null = null\n\n/**\n * The active backend key, tolerant of an unconfigured env: the real app never\n * reaches `getStudioOperations` while misconfigured (the `DeploymentSetupGate` renders a\n * boot error first), but tests inject a bundle directly via the seam below — so\n * a missing backend resolves to one stable key rather than throwing.\n */\nfunction deploymentKey(): string {\n  try {\n    return activeDeploymentKey()\n  } catch {\n    return '__unconfigured__'\n  }\n}\n\nfunction getAdapter(key: string): Promise<PersistenceAdapter> {\n  let adapter = adaptersByKey.get(key)\n  if (!adapter) {\n    adapter = selectPersistenceAdapter()\n    adaptersByKey.set(key, adapter)\n  }\n  return adapter\n}\n\n/**\n * The shared studio operations client for the active backend (lazily\n * bootstrapped, cached per deployment). In-memory mode this owns the one seeded\n * adapter the whole session mutates; against Convex it owns one client per\n * deployment — the active project (EC-179) selects which.\n */\nexport function getStudioOperations(): Promise<StudioOperations> {\n  const key = deploymentKey()\n  let instance = instancesByKey.get(key)\n  if (!instance) {\n    const actor = currentActor\n    instance = getAdapter(key).then((adapter) =>\n      createStudioOperations(adapter, actor ? { actor } : {}),\n    )\n    instancesByKey.set(key, instance)\n  }\n  return instance\n}\n\n/**\n * Bind (or clear) the session principal (EC-150). Called by the auth context\n * on sign-in/sign-out. Rebuilds the operations clients over the *same* adapters\n * — the persisted state (and, in-memory, the whole session's edits) survives;\n * only the authorization identity changes. All cached backends are rebuilt so a\n * later switch picks up the new actor too.\n */\nexport function setStudioSession(actor: Principal | null): void {\n  if (currentActor?.id === actor?.id) return // same user (or both null) — keep the clients\n  currentActor = actor\n  instancesByKey.clear()\n}\n\n/**\n * EC-595 A2 — the signed-in principal the operations clients act as (`null` signed out):\n * what this session's presence heartbeat names (\"X is in this field\") and how a conflict\n * tells \"you, in another tab\" from a colleague. Read-only; set by {@link setStudioSession}.\n */\nexport function getStudioActor(): Principal | null {\n  return currentActor\n}\n\n/** Test seam: replace (or clear) the singleton for the active backend. */\nexport function setStudioOperationsForTests(next: StudioOperations | null): void {\n  if (next) {\n    instancesByKey.set(deploymentKey(), Promise.resolve(next))\n    return\n  }\n  instancesByKey.clear()\n  adaptersByKey.clear()\n  currentActor = null\n}\n"]}

package/dist/lib/persistence/convex-adapter.d.ts

@@ -1,6 +1,16 @@
 import type { ConvexHttpClient } from 'convex/browser';
-import type { AssetRepository, BackendStatus, BackendValidationInput, BackendValidationResult, BlobStorageAdapter, CmsRepository, DeliveryRepository, MembersRepository, PersistenceAdapter, ReferenceIndexRepository, RedirectRepository, UserRepository, InviteRepository } from '@elytracms/core/persistence';
+import type { RecordStore, AssetRepository, BackendStatus, BackendValidationInput, BackendValidationResult, BlobStorageAdapter, CmsRepository, DeliveryRepository, MembersRepository, PersistenceAdapter, ProjectRole, ReferenceIndexRepository, UserRepository, InviteRepository } from '@elytracms/core/persistence';
 import type { ReactiveDocumentClient } from './convex-client.js';
+/**
+ * The single `members.role` column a deployment stores for the 240c-ready `roles[]`
+ * (the 240a→240c bridge). EC-605: exactly ONE role, passed through as given — the
+ * operations layer validated it against the project's policy, and `members:set`
+ * refuses one the DEPLOYED policy does not declare, visibly. This used to filter
+ * against the default policy and floor an unknown or empty set to `viewer` — a silent
+ * rewrite that turned a project's own role into a viewer. Several roles cannot be
+ * collapsed here without a policy, so they are refused rather than guessed at.
+ */
+export declare function singleStoredRole(roles: readonly string[]): ProjectRole;
 /**
  * Convex-backed {@link PersistenceAdapter} (brief §10, EC-039). Every repository
  * is implemented against the Convex functions in `apps/builder/convex/*`, mapping
@@ -17,8 +27,11 @@ export declare class ConvexPersistenceAdapter implements PersistenceAdapter {
     readonly invites: InviteRepository;
     /** Studio users rail — role + custom fields joined to auth identity (EC-240). */
     readonly users: UserRepository;
-    /** Editorial redirects rail — data-backed 301/302 forwards (EC-303). */
-    readonly redirects: RedirectRepository;
+    /**
+     * EC-616 — the generic record store: one repository per declared kind, each over its
+     * kind's Convex module (cached per kind object, so a rail and its foot share one).
+     */
+    readonly records: RecordStore;
     /** Convex file storage behind the EC-133 blob boundary (EC-151). */
     readonly blobs: BlobStorageAdapter;
     /** Delivery-pipeline (instant-publish) health, read-only (EC-268/EC-329). */

package/dist/lib/persistence/convex-adapter.js

@@ -1,6 +1,6 @@
 import { ConvexError } from 'convex/values';
 import { DRAFT_VARIANT, documentKey, documentSchema } from '@elytracms/core/cms-core';
-import { PRESENCE_TTL_MS, RecordNotFoundError, PersistenceValidationError, presenceInputSchema, assetCreateDefaults, assetRecordFromRow, compareReferenceEntries, highestRole, isKnownRole, persistenceIssueSchema, presentWriteKeys, redirectEntryFromRow, validateForPersistence, } from '@elytracms/core/persistence';
+import { PRESENCE_TTL_MS, RecordNotFoundError, PersistenceValidationError, presenceInputSchema, assetCreateDefaults, assetRecordFromRow, compareReferenceEntries, persistenceIssueSchema, presentWriteKeys, recordEntryFromWire, validateForPersistence, versionNotPinnableError, } from '@elytracms/core/persistence';
 import { normalizeInviteEmail } from '@elytracms/core/persistence';
 import { createUuidIdFactory } from '@elytracms/core/determinism';
 import { SUBSCRIPTION_UNAUTHENTICATED_MESSAGE, queryRef, mutationRef } from './convex-client.js';
@@ -52,6 +52,7 @@ function versionRecordFromDoc(doc, projectId) {
         createdAt: doc.createdAt,
         ...(doc.label ? { label: doc.label } : {}),
         ...(doc.origin ? { origin: doc.origin } : {}),
+        ...(doc.kind ? { kind: doc.kind } : {}),
     };
 }
 /**
@@ -312,6 +313,10 @@ class ConvexCmsRepository {
         if (result.status === 'missing-version') {
             throw new RecordNotFoundError('cms-document-version', `${projectId}/${documentKey(ref)}#${version}`);
         }
+        // EC-585: the version was recorded by a snapshot, never by a publish — the same
+        // refusal the in-memory store raises.
+        if (result.status === 'not-pinnable')
+            throw versionNotPinnableError(`${projectId}/${documentKey(ref)}`, version);
         return docRecordFromDoc(result.row, projectId);
     }
     async unpublishDocument(projectId, ref) {
@@ -589,15 +594,26 @@ function userRecordFromDoc(doc, projectId) {
     };
 }
 /**
- * Collapse the 240c-ready `roles[]` to the single `members.role` column by
- * applying the strongest role (the 240a→240c enforcement bridge). Unknown
- * strings are ignored; an empty/unknown set floors to `viewer`.
+ * The single `members.role` column a deployment stores for the 240c-ready `roles[]`
+ * (the 240a→240c bridge). EC-605: exactly ONE role, passed through as given — the
+ * operations layer validated it against the project's policy, and `members:set`
+ * refuses one the DEPLOYED policy does not declare, visibly. This used to filter
+ * against the default policy and floor an unknown or empty set to `viewer` — a silent
+ * rewrite that turned a project's own role into a viewer. Several roles cannot be
+ * collapsed here without a policy, so they are refused rather than guessed at.
  */
-function strongestRole(roles) {
-    // Validate against the active role policy (EC-240c) rather than a hardcoded
-    // enum, then take the canonical rank max; floor an empty/unknown set to `viewer`.
-    const valid = roles.filter((r) => isKnownRole(r));
-    return highestRole(valid) ?? 'viewer';
+export function singleStoredRole(roles) {
+    if (roles.length !== 1) {
+        throw new PersistenceValidationError('A deployment stores exactly one role per member.', [
+            {
+                code: 'invalid-role-count',
+                message: `Expected exactly one role, got ${roles.length} (${roles.join(', ') || 'none'}).`,
+                path: ['roles'],
+                domain: 'users',
+            },
+        ]);
+    }
+    return roles[0];
 }
 /**
  * Convex-backed {@link UserRepository} (EC-240, 240a). Reads are the admin-gated
@@ -638,7 +654,7 @@ class ConvexUserRepository {
         const now = this.clock();
         await this.client.mutation(mutationRef('members:set'), {
             userId: input.id,
-            role: strongestRole(input.roles),
+            role: singleStoredRole(input.roles),
             ...(input.meta !== undefined ? { meta: input.meta } : {}),
             createdAt: now,
             updatedAt: now,
@@ -717,56 +733,65 @@ class ConvexInviteRepository {
     }
 }
 /**
- * Convex-backed {@link RedirectRepository} (EC-303) — editorial redirects as data
- * (not config). Content-gated CRUD over the `redirects` table; the studio's
- * editorial surface + the delivery snapshot both read through here. A save sends
- * the write as written (EC-577): the create defaults live in the record schema and
- * apply inside the handler's transaction, only when the save creates the redirect.
+ * Convex-backed {@link RecordRepository} (EC-616) — one record kind over its own Convex
+ * module (`<kind.module>:save|get|list|remove`, built by `defineRecordFunctions(kind)`),
+ * stored in the one `records` table. The write is sent as written (EC-577): the handler
+ * resolves it against the stored record in its transaction with the rule the in-memory
+ * store uses. Reads come back in the ONE order (`orderRecords`, applied server-side), and
+ * a refused query or write arrives as the same `PersistenceValidationError` the in-memory
+ * store throws.
  */
-class ConvexRedirectRepository {
+class ConvexRecordRepository {
     client;
+    kind;
     clock;
-    constructor(client, clock = realClock) {
+    constructor(client, kind, clock = realClock) {
         this.client = client;
+        this.kind = kind;
         this.clock = clock;
     }
-    async saveRedirect(projectId, input) {
-        const now = this.clock();
-        const { id: givenId, ...write } = input;
-        const id = givenId ?? newId('redirect');
-        const doc = (await this.client
-            .mutation(mutationRef('redirects:save'), {
-            redirectId: id,
-            ...presentWriteKeys(write),
-            createdAt: now,
-            updatedAt: now,
-        })
+    ref(fn) {
+        return `${this.kind.module}:${fn}`;
+    }
+    async list(projectId, query = {}) {
+        const rows = (await this.client
+            .query(queryRef(this.ref('list')), presentWriteKeys({ ...query }))
             .catch((error) => {
             throw asRailWriteError(error);
         }));
-        return redirectEntryFromRow(doc, projectId);
+        return rows.map((row) => recordEntryFromWire(this.kind, row, projectId));
     }
-    async getRedirect(projectId, id) {
-        const found = await this.findRedirect(projectId, id);
+    async get(projectId, id) {
+        const found = await this.find(projectId, id);
         if (!found)
-            throw new RecordNotFoundError('redirect', `${projectId}/${id}`);
+            throw new RecordNotFoundError(this.kind.kind, `${projectId}/${id}`);
         return found;
     }
-    async findRedirect(projectId, id) {
-        const doc = (await this.client.query(queryRef('redirects:get'), {
-            redirectId: id,
+    async find(projectId, id) {
+        const row = (await this.client.query(queryRef(this.ref('get')), {
+            [this.kind.idKey]: id,
         }));
-        return doc ? redirectEntryFromRow(doc, projectId) : undefined;
+        return row ? recordEntryFromWire(this.kind, row, projectId) : undefined;
     }
-    async listRedirects(projectId) {
-        const docs = (await this.client.query(queryRef('redirects:list'), {}));
-        return docs
-            .map((doc) => redirectEntryFromRow(doc, projectId))
-            .sort((a, b) => (a.from < b.from ? -1 : a.from > b.from ? 1 : 0));
+    async save(projectId, input) {
+        const now = this.clock();
+        const { id: givenId, ...write } = input;
+        const id = givenId ?? newId(this.kind.idPrefix);
+        const row = (await this.client
+            .mutation(mutationRef(this.ref('save')), {
+            [this.kind.idKey]: id,
+            ...presentWriteKeys(write),
+            createdAt: now,
+            updatedAt: now,
+        })
+            .catch((error) => {
+            throw asRailWriteError(error);
+        }));
+        return recordEntryFromWire(this.kind, row, projectId);
     }
-    async removeRedirect(projectId, id) {
-        await this.getRedirect(projectId, id); // not-found parity with the in-memory rail
-        await this.client.mutation(mutationRef('redirects:remove'), { redirectId: id });
+    async remove(projectId, id) {
+        await this.get(projectId, id); // not-found parity with the in-memory store
+        await this.client.mutation(mutationRef(this.ref('remove')), { [this.kind.idKey]: id });
     }
 }
 /**
@@ -802,8 +827,11 @@ export class ConvexPersistenceAdapter {
     invites;
     /** Studio users rail — role + custom fields joined to auth identity (EC-240). */
     users;
-    /** Editorial redirects rail — data-backed 301/302 forwards (EC-303). */
-    redirects;
+    /**
+     * EC-616 — the generic record store: one repository per declared kind, each over its
+     * kind's Convex module (cached per kind object, so a rail and its foot share one).
+     */
+    records;
     /** Convex file storage behind the EC-133 blob boundary (EC-151). */
     blobs;
     /** Delivery-pipeline (instant-publish) health, read-only (EC-268/EC-329). */
@@ -837,7 +865,15 @@ export class ConvexPersistenceAdapter {
         this.members = new ConvexMembersRepository(client, projectId);
         this.users = new ConvexUserRepository(client);
         this.invites = new ConvexInviteRepository(client);
-        this.redirects = new ConvexRedirectRepository(client);
+        const recordRepositories = new Map();
+        this.records = (kind) => {
+            let repository = recordRepositories.get(kind);
+            if (!repository) {
+                repository = new ConvexRecordRepository(client, kind);
+                recordRepositories.set(kind, repository);
+            }
+            return repository;
+        };
         this.blobs = new ConvexBlobStorage(client);
         this.delivery = new ConvexDeliveryRepository(client);
     }