@elytracms/studio 0.0.94 → 0.0.96

package/convex/delivery-redirects.test.ts

@@ -0,0 +1,167 @@
+import { describe, expect, it } from 'vitest'
+import { convexTest } from 'convex-test'
+import { makeFunctionReference } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import type { ConvexHttpClient } from 'convex/browser'
+// The host's two readers, from their own modules — the package index also loads the React
+// delivery kit, which the edge-runtime environment cannot evaluate.
+import { assembleLiveSource } from '../../next/src/host-content'
+import { createContentSnapshot } from '../../next/src/snapshot'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import schema from './schema'
+
+/**
+ * The delivery snapshot's redirect strand, end to end: rows stored in the deployment's
+ * `records` table (kind `redirect`) → the REAL `delivery:snapshot` query (convex-test) →
+ * the REAL host loader (`assembleLiveSource`, `@elytracms/next`).
+ *
+ * EC-628 (Codex F04, `tasks/codex-review-2026-10-27/backend.convex.test.ts` "F04 upstream"):
+ * the record store's open data bag accepts drift the normal CRUD refuses (a dashboard edit,
+ * an older writer). Before, an enabled row with `to: 42` was SERVED by the snapshot and
+ * vanished in the host with zero issues, and a switch that is not a boolean was decided by
+ * truthiness (`'false'` served, a missing switch silently paused). Now the snapshot reads
+ * every stored redirect through the one rule (`readLiveRedirects`): what it cannot read is
+ * withheld and reported on the snapshot's `redirectIssues` strand, which the host carries
+ * into its `sourceIssues` and onto the 404 at the redirect's `from`.
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+const snapshot = makeFunctionReference<'query'>('delivery:snapshot')
+
+const AT = '2026-10-27T12:00:00.000Z'
+const LOCALES = { default: 'en', locales: ['en'] }
+
+/** Insert redirect rows as the record store holds them — raw, as drift reaches it. */
+async function deploymentWith(rows: ReadonlyArray<{ id: string; data: Record<string, unknown> }>) {
+  const t = convexTest(schema, modules)
+  await t.run(async (ctx) => {
+    for (const row of rows) {
+      await ctx.db.insert('records', { kind: 'redirect', recordId: row.id, data: row.data, at: AT, createdAt: AT, updatedAt: AT })
+    }
+  })
+  return t
+}
+
+const redirect = (id: string, data: Record<string, unknown> = {}) => ({
+  id,
+  data: { from: `/${id}`, to: '/target', permanent: true, enabled: true, ...data },
+})
+
+describe('EC-628 — the snapshot names every stored redirect it cannot serve', () => {
+  it('drift is withheld and reported upstream, then located by the host (F04 + disabled-state drift)', async () => {
+    const t = await deploymentWith([
+      redirect('good'),
+      redirect('bad', { to: 42 }), // F04's row
+      redirect('paused', { enabled: false }), // a paused redirect: not live, not a finding
+      redirect('string-off', { enabled: 'false' }), // truthy: was SERVED before
+      { id: 'no-switch', data: { from: '/no-switch', to: '/target', permanent: true } }, // falsy: was silently paused
+    ])
+    const payload = (await t.query(snapshot, { projectId: 'site' })) as {
+      redirects: unknown[]
+      redirectIssues: Array<{ code: string; path: unknown[] }>
+    }
+    expect(payload.redirects).toEqual([{ id: 'good', from: '/good', to: '/target', permanent: true }])
+    expect(payload.redirectIssues.map((issue) => [issue.code, issue.path])).toEqual([
+      ['invalid-redirect', ['redirects', 'bad']],
+      ['invalid-redirect', ['redirects', 'no-switch']],
+      ['invalid-redirect', ['redirects', 'string-off']],
+    ])
+
+    const client = assembleLiveSource(payload as never, { locales: LOCALES, collections: [], routes: [] }, 'published').client({
+      perspective: 'published',
+    })
+    // Control: the readable redirect traverses the whole pipeline, with no issue.
+    expect(client.resolvePage('/good').status).toBe('redirect')
+    expect(client.resolvePage('/good').issues).toEqual([])
+    expect(client.sourceIssues.map((issue) => issue.path[1])).toEqual(['bad', 'no-switch', 'string-off'])
+    for (const path of ['/bad', '/string-off', '/no-switch']) {
+      const result = client.resolvePage(path)
+      expect(result.status).toBe('notFound')
+      expect(result.issues.map((issue) => issue.code)).toEqual(['invalid-redirect'])
+    }
+    // The paused redirect is a 404 with nothing to say — pausing is not drift.
+    expect(client.resolvePage('/paused').status).toBe('notFound')
+    expect(client.resolvePage('/paused').issues).toEqual([])
+  })
+})
+
+/**
+ * EC-627 — "which redirects are live" is decided by ONE reader on every side. The same
+ * stored set is read (1) by the Convex delivery snapshot (`delivery:snapshot`, through
+ * `readLiveRedirects`) and assembled by the host's live loader, and (2) by the host's OTHER
+ * reader, `createContentSnapshot` (`next/src/snapshot.ts`, `readLiveRedirects` over
+ * `adapter.records(redirectRecordKind).list`) — through the REAL `ConvexPersistenceAdapter`
+ * over the same convex-test deployment, so both sides read the very same stored rows.
+ *
+ * The set holds what a hand-built copy of the rule gets wrong: a paused redirect (a copy that
+ * forgets the switch serves it), a switch that is not a boolean (a truthy copy serves
+ * `'false'`), a duplicate `from` (`/old` and `/old/` — the lower id applies on both sides)
+ * and an editorial `meta` bag (never on the routing record). Measured: replacing either
+ * side's call with a hand-built `.filter((r) => r.enabled)` projection turns this red.
+ */
+describe('EC-627 — the Convex snapshot and the host adapter snapshot serve one live set', () => {
+  const STORED = [
+    redirect('a', { meta: { note: 'editorial only' } }),
+    redirect('paused', { enabled: false }),
+    redirect('string-off', { enabled: 'false' }),
+    { id: 'dup-1', data: { from: '/old', to: '/one', permanent: true, enabled: true } },
+    { id: 'dup-2', data: { from: '/old/', to: '/two', permanent: false, enabled: true } },
+  ]
+  const PATHS = ['/a', '/paused', '/string-off', '/old', '/old/']
+
+  /** The decision a reader makes per URL: what a visitor gets. */
+  const outcomes = (client: { resolvePage(url: string): { status: string; redirect: unknown } }) =>
+    PATHS.map((path) => {
+      const result = client.resolvePage(path)
+      return { path, status: result.status, redirect: result.redirect }
+    })
+
+  it('the same stored set yields the same live set through both readers', async () => {
+    const t = await deploymentWith(STORED)
+    await t.run(async (ctx) => {
+      await ctx.db.insert('members', { userId: 'admin', role: 'admin', createdAt: AT, updatedAt: AT })
+    })
+
+    // (1) the deployment's public snapshot → the host's live loader
+    const payload = await t.query(snapshot, { projectId: 'site' })
+    const viaSnapshot = assembleLiveSource(payload as never, { locales: LOCALES, collections: [], routes: [] }, 'published')
+      .client({ perspective: 'published' })
+
+    // (2) the host's adapter reader over the same deployment
+    const asAdmin = t.withIdentity({ subject: 'admin', issuer: 'https://convex.test' })
+    const adapter = new ConvexPersistenceAdapter(
+      {
+        query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin.query(ref, args ?? {}),
+        mutation: (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => asAdmin.mutation(ref, args ?? {}),
+      } as unknown as ConvexHttpClient,
+      'site',
+    )
+    const viaAdapter = (await createContentSnapshot(adapter, 'site', { locales: LOCALES, collections: [], routes: [] }))
+      .client({ perspective: 'published' })
+
+    // The instrument can tell outcomes apart — pinned explicitly, not only compared.
+    expect(outcomes(viaSnapshot)).toEqual([
+      { path: '/a', status: 'redirect', redirect: { target: '/target', permanent: true } },
+      { path: '/paused', status: 'notFound', redirect: null },
+      { path: '/string-off', status: 'notFound', redirect: null },
+      { path: '/old', status: 'redirect', redirect: { target: '/one', permanent: true } },
+      { path: '/old/', status: 'redirect', redirect: { target: '/one', permanent: true } },
+    ])
+    expect(outcomes(viaAdapter)).toEqual(outcomes(viaSnapshot))
+    // The duplicate is one issue, the same on both sides (the router's one redirect set).
+    const duplicates = (issues: readonly { code: string; path: readonly unknown[] }[]) =>
+      issues.filter((issue) => issue.code === 'invalid-redirect').map((issue) => issue.path)
+    expect(duplicates(viaSnapshot.routerIssues)).toEqual([['redirects', 'dup-2']])
+    expect(duplicates(viaAdapter.routerIssues)).toEqual(duplicates(viaSnapshot.routerIssues))
+
+    // EC-628 (the adapter snapshot): the drifted row is NAMED on both sides, not only withheld —
+    // on the source and on the 404 at its `from`. (Before, the adapter path withheld it silently.)
+    const sourcePaths = (client: typeof viaSnapshot) => client.sourceIssues.map((issue) => [issue.code, issue.path])
+    expect(sourcePaths(viaSnapshot)).toEqual([['invalid-redirect', ['redirects', 'string-off']]])
+    expect(sourcePaths(viaAdapter)).toEqual(sourcePaths(viaSnapshot))
+    expect(viaAdapter.resolvePage('/string-off').issues.map((issue) => issue.code)).toEqual(['invalid-redirect'])
+  })
+})

package/convex/delivery.ts

@@ -1,5 +1,5 @@
 import { v } from 'convex/values'
-import { DRAFT_PERSPECTIVE, DRAFT_VARIANT, liveRedirectRecords, unfoldValue, variantOf } from '@elytracms/core/cms-core'
+import { DRAFT_PERSPECTIVE, DRAFT_VARIANT, readLiveRedirects, unfoldValue, variantOf } from '@elytracms/core/cms-core'
 import type { Perspective } from '@elytracms/core/cms-core'
 import { assetRecordFromRow, deliveryAssetRecord } from '@elytracms/core/persistence'
 import { constantTimeEquals } from '@elytracms/core/revalidation'
@@ -77,6 +77,12 @@ interface DeliverySnapshot {
    * infra redirects stay native (`next.config`/`vercel`), evaluated before these.
    */
   redirects: unknown[]
+  /**
+   * EC-628 — one `invalid-redirect` issue per stored redirect the live rule withheld because
+   * it could not read it (id, `from` and the kind of fault — never the target or a value).
+   * Paused redirects are not here: pausing is not drift.
+   */
+  redirectIssues: unknown[]
 }
 
 /**
@@ -161,16 +167,20 @@ export async function loadSnapshot(
   // Editorial redirects (EC-303): only ENABLED entries serve — a disabled redirect is
   // stored but never live, in either perspective. EC-616: read through the redirect
   // kind's one server-side reader (records + the marked legacy tolerant read) and
-  // projected by the ONE enabled-redirect reader, `liveRedirectRecords` (EC-590 / EC-627 —
-  // this was the last hand-built copy on Convex).
-  const redirects = liveRedirectRecords(await loadRedirectEntries(ctx, projectId))
+  // decided by the ONE live-redirect rule, `readLiveRedirects` (EC-590 / EC-627 — this
+  // was the last hand-built copy on Convex). EC-628: a stored redirect the rule cannot
+  // read (a non-boolean switch, a non-string `to`) is withheld AND reported — the host
+  // carries `redirectIssues` into its source issues — instead of being served or dropped
+  // by truthiness. The record kind's own read, not the project schema (EC-585 1e).
+  const live = readLiveRedirects(await loadRedirectEntries(ctx, projectId))
 
   return {
     projectId,
     perspective,
     documents,
     assets,
-    redirects,
+    redirects: live.redirects,
+    redirectIssues: live.issues,
   }
 }
 

package/convex/rail-write-parity.test.ts

@@ -70,19 +70,19 @@ async function seedHero(adapter: PersistenceAdapter) {
 
 /**
  * "Reset to centre", then clear alt — the two connected clears that never persisted.
- * EC-587: the alt is cleared the way the options dialog clears it, by writing the bag
- * without it (`meta.alt` is its one home).
+ * EC-587: the alt is cleared the way the options dialog clears it — since EC-634 the
+ * per-key patch removing `meta.alt` (its one home).
  */
 async function metadataClears(adapter: PersistenceAdapter) {
   await seedHero(adapter)
   const assets = adapter.assets
   const reset = await updateAssetMetadata({ assets }, PROJECT_ID, 'asset_hero', { focalPoint: null })
-  const clearedAlt = await updateAssetMetadata({ assets }, PROJECT_ID, 'asset_hero', { meta: { legacyKey: 'kept' } })
+  const clearedAlt = await updateAssetMetadata({ assets }, PROJECT_ID, 'asset_hero', { metaPatch: { alt: null } })
   expect([reset.ok, clearedAlt.ok]).toEqual([true, true])
   const after = await adapter.assets.getAsset(PROJECT_ID, 'asset_hero')
   return {
     focalPoint: after.focalPoint ?? null,
-    alt: assetAlt(after),
+    alt: assetAlt(after, null),
     title: after.title ?? null,
     thumb: after.thumb ?? null,
     lqip: after.lqip ?? null,
@@ -131,7 +131,7 @@ describe('EC-577 — the asset writers mean the same thing on both adapters', ()
         async get() {
           // An editor saves alt while the backfill is fetching this original — the
           // backfill's write lands after it, from a listing taken before it.
-          await updateAssetMetadata({ assets: adapter.assets }, PROJECT_ID, 'asset_big', { meta: { alt: 'Mid-run alt' } })
+          await updateAssetMetadata({ assets: adapter.assets }, PROJECT_ID, 'asset_big', { metaPatch: { alt: 'Mid-run alt' } })
           return new Uint8Array([1])
         },
       }
@@ -145,7 +145,7 @@ describe('EC-577 — the asset writers mean the same thing on both adapters', ()
       )
       expect(progress.generated).toBe(1)
       const after = await adapter.assets.getAsset(PROJECT_ID, 'asset_big')
-      expect([assetAlt(after), after.thumb, after.lqip]).toEqual(['Mid-run alt', THUMB, LQIP])
+      expect([assetAlt(after, null), after.thumb, after.lqip]).toEqual(['Mid-run alt', THUMB, LQIP])
     }
   })
 })

package/convex/redirects.ts

@@ -70,7 +70,7 @@ export const { save, get, list, remove } = defineRecordFunctions(redirectRecordK
 /**
  * Every stored redirect of this deployment (records + the tolerant legacy read), ordered
  * by `from` — the ONE server-side reader; the delivery snapshot projects it through
- * `liveRedirectRecords` (EC-590 / EC-627: one enabled-redirect reader).
+ * `readLiveRedirects` (EC-590 / EC-627 / EC-628: the one live-redirect rule).
  */
 export async function loadRedirectEntries(ctx: QueryCtx, projectId: string): Promise<RedirectEntry[]> {
   const rows = await listRecordWire(ctx, redirectRecordKind, resolveRecordQuery(redirectRecordKind), legacyRedirects)

package/convex/schema.ts

@@ -277,6 +277,12 @@ export default defineSchema({
     lqip: v.optional(v.string()),
     /** Schema-driven asset metadata bag (EC-301): alt, copyright, credit, …. */
     meta: v.optional(v.any()),
+    /**
+     * EC-632 — the per-locale values of the asset collection's `localized: true` fields,
+     * `{ [locale]: { [field]: value } }` (the document mechanism beside `meta`). Optional:
+     * every row without one reads its shared `meta`, exactly as before.
+     */
+    localizedMeta: v.optional(v.any()),
     createdAt: v.string(),
     updatedAt: v.string(),
   }).index('by_asset', ['assetId']),

package/convex/strict-reference-race.test.ts

@@ -0,0 +1,139 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { convexTest } from 'convex-test'
+import type { ConvexHttpClient } from 'convex/browser'
+import { getFunctionName } from 'convex/server'
+import type { FunctionReference } from 'convex/server'
+import { createOperations } from '@elytracms/core/operations'
+import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
+import schema from './schema'
+
+// convex-test fires a `runAfter(0)` on a REAL timer (the publish trigger's revalidation);
+// fake timers keep it queued.
+beforeEach(() => {
+  vi.useFakeTimers()
+})
+afterEach(() => {
+  vi.useRealTimers()
+})
+
+/**
+ * EC-649 — Codex F08 and its reverse, on Convex: the real `cms:*` handlers, schema and
+ * write-chokepoint triggers under convex-test, driven by the production operations over the
+ * production `ConvexPersistenceAdapter`. Each race is an explicit interleaving — the client
+ * HOLDS one operation's store mutation after its guard, runs the other operation, then sends
+ * the held mutation — and the sink REFUSES it inside its transaction. convex-test serialises
+ * mutations, so this proves the sink's data check and its refusal, not Convex's OCC retry
+ * (which is what makes the same check serializable against a truly concurrent mutation).
+ */
+
+const modules = {
+  ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
+  './_generated/api.ts': async () => ({}),
+}
+
+const PROJECT_ID = 'strict-race'
+const SESSION_USER_ID = 'user_admin'
+const projectId = PROJECT_ID
+const author = { collection: 'author', id: 'a' }
+const post = { collection: 'post', id: 'p' }
+const collections = () => [
+  { id: 'author', kind: 'document' as const, fields: [{ name: 'name', type: 'text' as const }] },
+  { id: 'post', kind: 'document' as const, fields: [{ name: 'author', type: 'relation' as const, target: 'author', multiple: false, strict: true }] },
+]
+
+/** A held store mutation: `atStore` resolves once it is held; `resume` sends it. */
+interface Hold {
+  readonly atStore: Promise<void>
+  readonly resume: () => void
+}
+
+async function convexWorld() {
+  const t = convexTest(schema, modules)
+  const now = new Date().toISOString()
+  await t.run(async (ctx) => {
+    await ctx.db.insert('members', { userId: SESSION_USER_ID, role: 'admin', createdAt: now, updatedAt: now })
+  })
+  const asAdmin = t.withIdentity({ subject: SESSION_USER_ID, issuer: 'https://convex.test' })
+  const holds = new Map<string, { reached: () => void; proceed: Promise<void> }>()
+  const client = {
+    query: (ref: FunctionReference<'query'>, args?: Record<string, unknown>) => asAdmin.query(ref, args ?? {}),
+    mutation: async (ref: FunctionReference<'mutation'>, args?: Record<string, unknown>) => {
+      const key = `${getFunctionName(ref)}#${String(args?.docId)}`
+      const hold = holds.get(key)
+      if (hold) {
+        holds.delete(key)
+        hold.reached()
+        await hold.proceed
+      }
+      return asAdmin.mutation(ref, args ?? {})
+    },
+  } as unknown as ConvexHttpClient
+  const adapter = new ConvexPersistenceAdapter(client, PROJECT_ID)
+  const ops = createOperations({ adapter, collections, validateDocument: () => [] })
+  /** Hold the next `cms:<mutation>` for document `id` at the client, after every guard ran. */
+  const hold = (mutation: string, id: string): Hold => {
+    let reached!: () => void
+    let resume!: () => void
+    const atStore = new Promise<void>((resolve) => { reached = resolve })
+    const proceed = new Promise<void>((resolve) => { resume = resolve })
+    holds.set(`cms:${mutation}#${id}`, { reached, proceed })
+    return { atStore, resume }
+  }
+  for (const document of [
+    { ...author, values: { name: 'Ada' } },
+    { ...post, values: { author: { type: 'reference', ...author } } },
+  ]) expect((await ops.documents.replace({ projectId, document, precondition: { ifAbsent: true } })).ok).toBe(true)
+  return { adapter, ops, hold }
+}
+
+describe('EC-649 — strict-reference preconditions at the Convex sink (convex-parity)', () => {
+  it('F08: the author unpublished between the post’s publish guard and its mutation — `cms:publishDocument` refuses', async () => {
+    const { adapter, ops, hold } = await convexWorld()
+    expect((await ops.documents.publish({ projectId, ref: author })).ok).toBe(true)
+    // Known-positive control: the sequential case is refused by the guard.
+    expect((await ops.documents.publish({ projectId, ref: post })).ok).toBe(true)
+    const blocked = await ops.documents.unpublish({ projectId, ref: author })
+    expect(!blocked.ok && blocked.error.code).toBe('conflict')
+    expect((await ops.documents.unpublish({ projectId, ref: post })).ok).toBe(true)
+
+    const held = hold('publishDocument', post.id)
+    const publishing = ops.documents.publish({ projectId, ref: post })
+    await held.atStore
+    expect((await ops.documents.unpublish({ projectId, ref: author })).ok).toBe(true)
+    held.resume()
+    const published = await publishing
+    expect(published.ok).toBe(false)
+    if (!published.ok) expect(published.error.messageRef?.key).toBe('operations.error.strictTargetsUnpublishedOne')
+    expect((await adapter.cms.getDocument(projectId, author)).publishedVersion).toBeUndefined()
+    expect(await adapter.cms.listPublishedDocuments(projectId, 'post')).toEqual([])
+  })
+
+  it('the reverse: the post published between the author’s unpublish guard and its mutation — `cms:unpublishDocument` refuses', async () => {
+    const { adapter, ops, hold } = await convexWorld()
+    expect((await ops.documents.publish({ projectId, ref: author })).ok).toBe(true)
+    const held = hold('unpublishDocument', author.id)
+    const unpublishing = ops.documents.unpublish({ projectId, ref: author })
+    await held.atStore // the guard found no published strict referrer
+    expect((await ops.documents.publish({ projectId, ref: post })).ok).toBe(true)
+    held.resume()
+    const unpublished = await unpublishing
+    expect(unpublished.ok).toBe(false)
+    if (!unpublished.ok) {
+      expect(unpublished.error.code).toBe('conflict')
+      expect(unpublished.error.messageRef?.key).toBe('operations.error.strictReferencesBlockUnpublishOne')
+    }
+    expect((await adapter.cms.getDocument(projectId, author)).publishedVersion).toBe(1)
+    expect((await adapter.cms.getDocument(projectId, post)).publishedVersion).toBe(1)
+  })
+
+  it('control: the held unpublish with nothing racing it lands (the sink reads the index, finds no unjudged referrer)', async () => {
+    const { adapter, ops, hold } = await convexWorld()
+    expect((await ops.documents.publish({ projectId, ref: author })).ok).toBe(true)
+    const held = hold('unpublishDocument', author.id)
+    const unpublishing = ops.documents.unpublish({ projectId, ref: author })
+    await held.atStore
+    held.resume()
+    expect((await unpublishing).ok).toBe(true)
+    expect((await adapter.cms.getDocument(projectId, author)).publishedVersion).toBeUndefined()
+  })
+})

package/dist/addon.d.ts

@@ -48,7 +48,7 @@ export { assembleRailViewSource, metaBagProjection, normalizeOkResult, useRailVi
 export type { OkResult, RailAdapter } from './components/rail-view-source.js';
 export type { CollectionViewCapabilities, CollectionViewSource, FieldAccess, } from './lib/collection-view/collection-view-source.js';
 export { useOperationCache, useOperationQuery } from './lib/query/index.js';
-export type { OperationCache, UseOperationQueryOptions } from './lib/query/index.js';
+export type { OperationCache, ReadState, UseOperationQueryOptions } from './lib/query/index.js';
 export { useStudioLocale } from './lib/locale/index.js';
 export type { StudioLocale } from './lib/locale/index.js';
 export { useSetBreadcrumb } from './components/breadcrumb-context.js';

package/dist/addon.js.map

@@ -1 +1 @@
-{"version":3,"file":"addon.js","sourceRoot":"","sources":["../src/addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,0FAA0F;AAE1F,OAAO,EAAE,GAAG,EAAE,MAAM,wCAAwC,CAAA;AAkB5D,2FAA2F;AAE3F,8EAA8E;AAC9E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,aAAa,EACb,aAAa,GACd,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAEjH,4FAA4F;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AAC5F,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,+BAA+B,CAAA;AAQtC,4FAA4F;AAE5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAG/D,4FAA4F;AAE5F,4GAA4G;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAA;AAGpE,gGAAgG;AAEhG;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACrE,yGAAyG;AACzG,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAChE,6FAA6F;AAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA","sourcesContent":["/**\n * `@elytracms/studio/addon` — THE public addon API (EC-616, ruling EC-565 § 6b item 2).\n *\n * An addon (`@elytracms/forms`, `@elytracms/analytics`, or your own) is an optional\n * package whose studio half contributes navigation items to a project's\n * `defineStudio({ sidebar })` — a rail bound to a record kind, or a view with its own\n * component — and whose backend half is a record kind in the generic record store\n * (`defineRecordKind` / `adapter.records(kind)` in `@elytracms/core/persistence`, its\n * Convex functions from `defineRecordFunctions` in `@elytracms/studio/convex/\n * record-functions`). Everything an addon's studio code touches is exported HERE; the\n * studio's internals (`lib/*`, `components/*`) are not part of the published package.\n * `@elytracms/studio/ui` stays the primitive set (Button, Panel, Text, …).\n *\n * ## The chrome contract\n *\n * The SHELL draws the top bar, the breadcrumb (its section crumb is the view's `label`;\n * deeper crumbs are contributed with {@link useSetBreadcrumb}), the rail with its issues\n * foot (findings contributed with {@link useNavIssues}, or always-on through a view's\n * `useIssues`), the banners and the theme. A VIEW owns the whole scrollable content area\n * under it — including its own title header: the shell adds no frame, title or padding.\n * A view reaches the studio through its {@link AppViewContext}: the project, its deep\n * link and search, the operations client (every read and write goes through the one\n * authorized chokepoint), the query hooks over the one cache, the content locale, and\n * the signed-in user with their role.\n *\n * ## The two navigation items\n *\n * ```tsx\n * import { nav } from '@elytracms/studio/addon'\n * import { submissionRecordKind } from './kinds'\n *\n * // a rail bound to a record kind — the portable list/edit surfaces, no component to write\n * nav.rail(submissionRecordKind, { label: 'Submissions' })\n * // a custom component — the whole content area is yours\n * nav.view({ id: 'forms-stats', label: 'Form stats', render: (ctx) => <Stats ctx={ctx} /> })\n * ```\n */\n\n// --- Navigation items and the view contract --------------------------------------------\n\nexport { nav } from './components/app-views/default-modules'\nexport type {\n  CustomViewConfig,\n  RailViewConfig,\n  BuiltinViewConfig,\n} from './components/app-views/default-modules'\nexport type {\n  AppViewContext,\n  AppViewDeepLink,\n  AppViewModule,\n  AppViewQueryHooks,\n  NavIssuesHook,\n  NavPermission,\n  NavPermissionContext,\n  SidebarNode,\n  SidebarViewNode,\n} from './components/app-views/module'\n\n// --- Rails: a record kind, or your own source -------------------------------------------\n\n/** A record rail's pieces, for an addon composing its own view around one. */\nexport {\n  RECORD_RAIL_CAPABILITIES,\n  RecordRailModule,\n  RecordRailProvider,\n  useRecordCollectionViewSource,\n  useRecordList,\n  useRecordRail,\n} from './components/records/record-rail'\nexport type { RecordRailModuleProps, RecordRailPaths, RecordRailStore } from './components/records/record-rail'\nexport { lensDocumentToRecordWrite, recordLensDef, recordToLensDocument } from './components/records/record-lens'\n\n/** The portable list/edit surfaces over any source, and the scaffold that assembles one. */\nexport { CollectionViewSurface } from './components/collection-view/collection-view-surface'\nexport {\n  assembleRailViewSource,\n  metaBagProjection,\n  normalizeOkResult,\n  useRailViewSource,\n} from './components/rail-view-source'\nexport type { OkResult, RailAdapter } from './components/rail-view-source'\nexport type {\n  CollectionViewCapabilities,\n  CollectionViewSource,\n  FieldAccess,\n} from './lib/collection-view/collection-view-source'\n\n// --- Hooks: the cache, the locale, the breadcrumb, the rail foot -------------------------\n\nexport { useOperationCache, useOperationQuery } from './lib/query'\nexport type { OperationCache, UseOperationQueryOptions } from './lib/query'\nexport { useStudioLocale } from './lib/locale'\nexport type { StudioLocale } from './lib/locale'\nexport { useSetBreadcrumb } from './components/breadcrumb-context'\nexport type { BreadcrumbItem } from './components/breadcrumb-context'\nexport { useNavIssues } from './components/nav-issues-registry'\nexport type { NavIssue } from './components/nav-issues-registry'\n\n// --- The document editor: contributed inspector panes (EC-618) ---------------------------\n\n/** A pane in the document editor's inspector — `defineStudio({ documentPanes: [documentPane({ … })] })`. */\nexport { documentPane } from './components/inspector/document-panes'\nexport type { DocumentPane, DocumentPaneContext } from './components/inspector/document-panes'\n\n// --- EC-613 (the forms addon): an own source's edit shell, its list key, the UI language -----\n\n/**\n * The portable edit shell alone (AD-19), with its form-column appendix seam (EC-396): an addon\n * that assembles its own source (`useRailViewSource`) renders one record's detail with\n * read-only sections below the editable fields — the forms inbox shows a submission's answers,\n * files and delivery log there.\n */\nexport { PortableDetailEditor } from './components/cms/detail-editor'\n/** The one query key of a kind's records in a project — patch it after a write (`useOperationCache`). */\nexport { recordListKey } from './components/records/record-rail'\n/** Resolve a `LocalizedString` (`'Text'` or `{ en, de, … }`) in the studio's UI language. */\nexport { useLabel } from './lib/i18n'\n"]}
+{"version":3,"file":"addon.js","sourceRoot":"","sources":["../src/addon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,0FAA0F;AAE1F,OAAO,EAAE,GAAG,EAAE,MAAM,wCAAwC,CAAA;AAkB5D,2FAA2F;AAE3F,8EAA8E;AAC9E,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,6BAA6B,EAC7B,aAAa,EACb,aAAa,GACd,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAEjH,4FAA4F;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sDAAsD,CAAA;AAC5F,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,+BAA+B,CAAA;AAQtC,4FAA4F;AAE5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAE9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAElE,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAA;AAG/D,4FAA4F;AAE5F,4GAA4G;AAC5G,OAAO,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAA;AAGpE,gGAAgG;AAEhG;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAA;AACrE,yGAAyG;AACzG,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAA;AAChE,6FAA6F;AAC7F,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA","sourcesContent":["/**\n * `@elytracms/studio/addon` — THE public addon API (EC-616, ruling EC-565 § 6b item 2).\n *\n * An addon (`@elytracms/forms`, `@elytracms/analytics`, or your own) is an optional\n * package whose studio half contributes navigation items to a project's\n * `defineStudio({ sidebar })` — a rail bound to a record kind, or a view with its own\n * component — and whose backend half is a record kind in the generic record store\n * (`defineRecordKind` / `adapter.records(kind)` in `@elytracms/core/persistence`, its\n * Convex functions from `defineRecordFunctions` in `@elytracms/studio/convex/\n * record-functions`). Everything an addon's studio code touches is exported HERE; the\n * studio's internals (`lib/*`, `components/*`) are not part of the published package.\n * `@elytracms/studio/ui` stays the primitive set (Button, Panel, Text, …).\n *\n * ## The chrome contract\n *\n * The SHELL draws the top bar, the breadcrumb (its section crumb is the view's `label`;\n * deeper crumbs are contributed with {@link useSetBreadcrumb}), the rail with its issues\n * foot (findings contributed with {@link useNavIssues}, or always-on through a view's\n * `useIssues`), the banners and the theme. A VIEW owns the whole scrollable content area\n * under it — including its own title header: the shell adds no frame, title or padding.\n * A view reaches the studio through its {@link AppViewContext}: the project, its deep\n * link and search, the operations client (every read and write goes through the one\n * authorized chokepoint), the query hooks over the one cache, the content locale, and\n * the signed-in user with their role.\n *\n * ## The two navigation items\n *\n * ```tsx\n * import { nav } from '@elytracms/studio/addon'\n * import { submissionRecordKind } from './kinds'\n *\n * // a rail bound to a record kind — the portable list/edit surfaces, no component to write\n * nav.rail(submissionRecordKind, { label: 'Submissions' })\n * // a custom component — the whole content area is yours\n * nav.view({ id: 'forms-stats', label: 'Form stats', render: (ctx) => <Stats ctx={ctx} /> })\n * ```\n */\n\n// --- Navigation items and the view contract --------------------------------------------\n\nexport { nav } from './components/app-views/default-modules'\nexport type {\n  CustomViewConfig,\n  RailViewConfig,\n  BuiltinViewConfig,\n} from './components/app-views/default-modules'\nexport type {\n  AppViewContext,\n  AppViewDeepLink,\n  AppViewModule,\n  AppViewQueryHooks,\n  NavIssuesHook,\n  NavPermission,\n  NavPermissionContext,\n  SidebarNode,\n  SidebarViewNode,\n} from './components/app-views/module'\n\n// --- Rails: a record kind, or your own source -------------------------------------------\n\n/** A record rail's pieces, for an addon composing its own view around one. */\nexport {\n  RECORD_RAIL_CAPABILITIES,\n  RecordRailModule,\n  RecordRailProvider,\n  useRecordCollectionViewSource,\n  useRecordList,\n  useRecordRail,\n} from './components/records/record-rail'\nexport type { RecordRailModuleProps, RecordRailPaths, RecordRailStore } from './components/records/record-rail'\nexport { lensDocumentToRecordWrite, recordLensDef, recordToLensDocument } from './components/records/record-lens'\n\n/** The portable list/edit surfaces over any source, and the scaffold that assembles one. */\nexport { CollectionViewSurface } from './components/collection-view/collection-view-surface'\nexport {\n  assembleRailViewSource,\n  metaBagProjection,\n  normalizeOkResult,\n  useRailViewSource,\n} from './components/rail-view-source'\nexport type { OkResult, RailAdapter } from './components/rail-view-source'\nexport type {\n  CollectionViewCapabilities,\n  CollectionViewSource,\n  FieldAccess,\n} from './lib/collection-view/collection-view-source'\n\n// --- Hooks: the cache, the locale, the breadcrumb, the rail foot -------------------------\n\nexport { useOperationCache, useOperationQuery } from './lib/query'\nexport type { OperationCache, ReadState, UseOperationQueryOptions } from './lib/query'\nexport { useStudioLocale } from './lib/locale'\nexport type { StudioLocale } from './lib/locale'\nexport { useSetBreadcrumb } from './components/breadcrumb-context'\nexport type { BreadcrumbItem } from './components/breadcrumb-context'\nexport { useNavIssues } from './components/nav-issues-registry'\nexport type { NavIssue } from './components/nav-issues-registry'\n\n// --- The document editor: contributed inspector panes (EC-618) ---------------------------\n\n/** A pane in the document editor's inspector — `defineStudio({ documentPanes: [documentPane({ … })] })`. */\nexport { documentPane } from './components/inspector/document-panes'\nexport type { DocumentPane, DocumentPaneContext } from './components/inspector/document-panes'\n\n// --- EC-613 (the forms addon): an own source's edit shell, its list key, the UI language -----\n\n/**\n * The portable edit shell alone (AD-19), with its form-column appendix seam (EC-396): an addon\n * that assembles its own source (`useRailViewSource`) renders one record's detail with\n * read-only sections below the editable fields — the forms inbox shows a submission's answers,\n * files and delivery log there.\n */\nexport { PortableDetailEditor } from './components/cms/detail-editor'\n/** The one query key of a kind's records in a project — patch it after a write (`useOperationCache`). */\nexport { recordListKey } from './components/records/record-rail'\n/** Resolve a `LocalizedString` (`'Text'` or `{ en, de, … }`) in the studio's UI language. */\nexport { useLabel } from './lib/i18n'\n"]}

package/dist/components/ai/ai-chat-panel.js

@@ -66,6 +66,12 @@ export function AiChatPanel() {
         ...doc.values,
         ...(doc.localized?.[activeLocale] ?? {}),
     }), [activeLocale]);
+    /**
+     * EC-647 — the revision each document the assistant READ was at, keyed by the value the
+     * reader returned (the token the proposal is built from): an update / translation
+     * proposal records it, and its apply writes at it.
+     */
+    const readRevisions = useRef(new WeakMap());
     /** Operations-backed tool readers — client-side, with the user's own session. */
     const readers = useMemo(() => {
         const matches = (query, ...fields) => !query || fields.some((f) => f?.toLowerCase().includes(query.toLowerCase()));
@@ -118,8 +124,12 @@ export function AiChatPanel() {
                 await cms.flushPersistence({ collection, id });
                 const { operations } = await getStudioOperations();
                 const result = await operations.documents.get({ projectId, ref: { collection, id } });
-                return result.ok ? result.value?.document ?? null : null;
+                if (!result.ok || !result.value)
+                    return null;
+                readRevisions.current.set(result.value.document, result.value.revision);
+                return result.value.document;
             },
+            revisionOf: (document) => readRevisions.current.get(document),
         };
     }, [projectId, cms, localeValues]);
     /** EC-578: a fresh document id from the session's injected id factory (UUIDs). */
@@ -338,7 +348,10 @@ export function AiChatPanel() {
         if (current && current.collection === ref.collection && current.id === ref.id)
             await current.flush();
         if (existing && proposal.patches) {
-            const outcome = await cms.commitPatches(ref, proposal.patches);
+            // EC-647: AT the revision of the read the proposal was built from — a position
+            // changed since then by anyone else is refused (the apply fails visibly), never
+            // overwritten by content the assistant never saw.
+            const outcome = await cms.commitPatches(ref, proposal.patches, proposal.patches.map(() => proposal.revision));
             if (outcome?.status === 'failed' || outcome?.status === 'refused') {
                 dispatch({ type: 'fail', message: translate('ai.error.applyFailed') });
                 return;