chore(cms-190): remove apps/studio-review and audit-confirmed dead code

.changeset/config.json

@@ -7,10 +7,5 @@
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
-  "ignore": [
-    "@mdcms/server",
-    "@mdcms/modules",
-    "@mdcms/studio-example",
-    "@mdcms/studio-review"
-  ]
+  "ignore": ["@mdcms/server", "@mdcms/modules", "@mdcms/studio-example"]
 }

AGENTS.md

@@ -19,7 +19,6 @@ Upcoming work is focused on live preview (real-time content rendering in the con
 | `apps/server`         | Elysia HTTP server, the backend for everything         |
 | `apps/cli`            | CLI binary (`mdcms`) for push/pull/sync workflows      |
 | `apps/studio-example` | Next.js app that embeds the Studio component           |
-| `apps/studio-review`  | Internal app for visual PR review of Studio changes    |
 | `packages/shared`     | Contracts, types, and schema utilities used everywhere |
 | `packages/sdk`        | Client SDK for reading content from applications       |
 | `packages/studio`     | The embeddable React Studio component                  |

apps/cli/src/lib/credentials.ts

@@ -1,12 +1,5 @@
 import { spawnSync } from "node:child_process";
-import {
-  chmod,
-  mkdir,
-  readFile,
-  rename,
-  rm,
-  writeFile,
-} from "node:fs/promises";
+import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
@@ -520,7 +513,3 @@ export function createInMemoryCredentialStore(
     },
   };
 }
-
-export async function clearCredentialsFile(path: string): Promise<void> {
-  await rm(path, { force: true });
-}

apps/docs/architecture/overview.mdx

@@ -78,7 +78,6 @@ mdcms/
 │   ├── server/           # Elysia HTTP server (the CMS API)
 │   ├── cli/              # `mdcms` CLI tool for push/pull/schema sync/migrate
 │   ├── studio-example/   # Next.js reference app embedding @mdcms/studio
-│   ├── studio-review/    # Scenario-based visual review environment for Studio
 │   └── docs/             # Mintlify documentation site (you are here)
 ├── packages/
 │   ├── shared/           # Runtime utilities, contracts, error types, validation
@@ -105,7 +104,6 @@ graph LR
     server["apps/server"]
     cli["apps/cli"]
     studioExample["apps/studio-example"]
-    studioReview["apps/studio-review"]
 
     sdk --> shared
     studio --> shared
@@ -118,8 +116,6 @@ graph LR
     cli --> sdk
     studioExample --> studio
     studioExample --> sdk
-    studioReview --> studio
-    studioReview --> sdk
 ```
 
 <Tip>

apps/docs/development/packages.mdx

@@ -27,7 +27,6 @@ graph TD
     cli --> modules
     studioEx["apps/studio-example"] --> studio["packages/studio"]
     studioEx --> sdk["packages/sdk"]
-    studioReview["apps/studio-review"] --> studio
     studio --> shared
     sdk --> shared
     modules --> shared
@@ -86,18 +85,6 @@ A demo Next.js application that embeds the `<Studio />` component from `@mdcms/s
 
 Dependencies: `@mdcms/studio`, `@mdcms/sdk`.
 
-### apps/studio-review
-
-|                 |                            |
-| --------------- | -------------------------- |
-| **Package**     | `@mdcms/studio-review`     |
-| **Port**        | 3000                       |
-| **Dev command** | `bun nx dev studio-review` |
-
-An internal visual review application that renders deterministic scenarios for PR review. Deployed as a standalone Vercel deployment, allowing reviewers to see UI changes across predefined states without needing a full local setup.
-
-Dependencies: `@mdcms/studio`.
-
 ## Shared Packages
 
 ### packages/shared

apps/docs/development/setup.mdx

@@ -14,12 +14,12 @@ This guide walks you through setting up a local MDCMS development environment fr
 
 Before you begin, install the following tools:
 
-| Tool                        | Version                            | Purpose                                                   |
-| --------------------------- | ---------------------------------- | --------------------------------------------------------- |
-| **Bun**                     | 1.3.11+ (pinned in `.bun-version`) | Package manager, runtime, and test runner                 |
-| **Docker & Docker Compose** | Latest stable                      | Infrastructure services (PostgreSQL, Redis, MinIO)        |
-| **Node.js**                 | 20+                                | Required for Next.js apps (studio-example, studio-review) |
-| **Git**                     | Latest stable                      | Source control                                            |
+| Tool                        | Version                            | Purpose                                            |
+| --------------------------- | ---------------------------------- | -------------------------------------------------- |
+| **Bun**                     | 1.3.11+ (pinned in `.bun-version`) | Package manager, runtime, and test runner          |
+| **Docker & Docker Compose** | Latest stable                      | Infrastructure services (PostgreSQL, Redis, MinIO) |
+| **Node.js**                 | 20+                                | Required for Next.js apps (studio-example)         |
+| **Git**                     | Latest stable                      | Source control                                     |
 
 <Tabs>
   <Tab title="macOS">
@@ -181,7 +181,6 @@ Once running, these services are available:
 | -------------- | ---------------------------------------------- |
 | Server API     | [http://localhost:4000](http://localhost:4000) |
 | Studio Example | [http://localhost:4173](http://localhost:4173) |
-| Studio Review  | [http://localhost:3000](http://localhost:3000) |
 | MinIO Console  | [http://localhost:9001](http://localhost:9001) |
 | Mailhog        | [http://localhost:8025](http://localhost:8025) |
 | PostgreSQL     | `localhost:5432`                               |

apps/server/src/lib/rbac.test.ts

@@ -2,7 +2,6 @@ import assert from "node:assert/strict";
 import { test } from "bun:test";
 
 import {
-  assertOwnerInvariant,
   assertOwnerMutationAllowed,
   evaluateEffectiveRole,
   evaluatePermission,
@@ -254,28 +253,6 @@ test("RBAC rejects non-global Owner/Admin grants", () => {
   );
 });
 
-test("owner invariant accepts exactly one active owner", () => {
-  const snapshot = assertOwnerInvariant({
-    activeOwnerCount: 1,
-  });
-
-  assert.equal(snapshot.activeOwnerCount, 1);
-});
-
-test("owner invariant rejects zero or multiple active owners", () => {
-  assert.throws(() =>
-    assertOwnerInvariant({
-      activeOwnerCount: 0,
-    }),
-  );
-
-  assert.throws(() =>
-    assertOwnerInvariant({
-      activeOwnerCount: 2,
-    }),
-  );
-});
-
 test("owner mutation guard rejects removing/demoting the last owner", () => {
   assert.throws(() =>
     assertOwnerMutationAllowed({

apps/server/src/lib/rbac.ts

@@ -222,28 +222,6 @@ export function evaluatePermission(input: {
   };
 }
 
-export type OwnerInvariantSnapshot = {
-  activeOwnerCount: number;
-};
-
-export function assertOwnerInvariant(
-  snapshot: OwnerInvariantSnapshot,
-): OwnerInvariantSnapshot {
-  if (snapshot.activeOwnerCount !== 1) {
-    throw new RuntimeError({
-      code: "OWNER_INVARIANT_VIOLATION",
-      message:
-        "Exactly one non-removable Owner must exist per instance at all times.",
-      statusCode: 409,
-      details: {
-        activeOwnerCount: snapshot.activeOwnerCount,
-      },
-    });
-  }
-
-  return snapshot;
-}
-
 export type OwnerMutationIntent = "remove_owner" | "demote_owner";
 
 export function assertOwnerMutationAllowed(input: {
@@ -263,18 +241,3 @@ export function assertOwnerMutationAllowed(input: {
     });
   }
 }
-
-/**
- * CMS-44 close work (March 4) will replace this with DB-backed checks around
- * membership/grant mutation flows.
- */
-export type OwnerInvariantStore = {
-  countActiveOwners: () => Promise<number>;
-};
-
-export async function assertOwnerInvariantFromStore(
-  store: OwnerInvariantStore,
-): Promise<void> {
-  const activeOwnerCount = await store.countActiveOwners();
-  assertOwnerInvariant({ activeOwnerCount });
-}