canopycms-cdk 0.0.59 → 0.0.61-int.74

package/lambda/asset-transform/dist/handler.js

@@ -4380,7 +4380,7 @@ var init_media = __esm({
 });
 
 // ../canopycms/src/config/schemas/config.ts
-var defaultBranchAccessSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema;
+var defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema;
 var init_config = __esm({
   "../canopycms/src/config/schemas/config.ts"() {
     "use strict";
@@ -4388,7 +4388,13 @@ var init_config = __esm({
     init_collection();
     init_media();
     defaultBranchAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema = external_exports.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema = external_exports.object({
+      read: defaultPathAccessLevelSchema.optional(),
+      edit: defaultPathAccessLevelSchema.optional(),
+      review: defaultPathAccessLevelSchema.optional()
+    }).strict();
+    defaultPathAccessSchema = external_exports.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
     defaultBaseBranchSchema = external_exports.string().default("main");
     defaultRemoteNameSchema = external_exports.string().default("origin");
     defaultRemoteUrlSchema = external_exports.string().min(1);
@@ -4421,6 +4427,10 @@ var init_config = __esm({
       // have .default('deny'), so the field is optional on input but always resolves to
       // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
       // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+      // still resolves to 'deny' and an omitted level inside the object form stays undefined
+      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
       defaultBranchAccess: defaultBranchAccessSchema,
       defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -6727,7 +6737,7 @@ var require_node = __commonJS({
     var tty = require("tty");
     var util2 = require("util");
     exports2.init = init;
-    exports2.log = log9;
+    exports2.log = log10;
     exports2.formatArgs = formatArgs;
     exports2.save = save;
     exports2.load = load;
@@ -6862,7 +6872,7 @@ var require_node = __commonJS({
       }
       return (/* @__PURE__ */ new Date()).toISOString() + " ";
     }
-    function log9(...args) {
+    function log10(...args) {
       return process.stderr.write(util2.formatWithOptions(exports2.inspectOpts, ...args) + "\n");
     }
     function save(namespaces) {
@@ -6916,27 +6926,27 @@ var require_src2 = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     var fs_1 = require("fs");
     var debug_1 = __importDefault(require_src());
-    var log9 = debug_1.default("@kwsites/file-exists");
+    var log10 = debug_1.default("@kwsites/file-exists");
     function check(path3, isFile, isDirectory) {
-      log9(`checking %s`, path3);
+      log10(`checking %s`, path3);
       try {
         const stat = fs_1.statSync(path3);
         if (stat.isFile() && isFile) {
-          log9(`[OK] path represents a file`);
+          log10(`[OK] path represents a file`);
           return true;
         }
         if (stat.isDirectory() && isDirectory) {
-          log9(`[OK] path represents a directory`);
+          log10(`[OK] path represents a directory`);
           return true;
         }
-        log9(`[FAIL] path represents something other than a file or directory`);
+        log10(`[FAIL] path represents something other than a file or directory`);
         return false;
       } catch (e) {
         if (e.code === "ENOENT") {
-          log9(`[FAIL] path is not accessible: %o`, e);
+          log10(`[FAIL] path is not accessible: %o`, e);
           return false;
         }
-        log9(`[FATAL] %o`, e);
+        log10(`[FATAL] %o`, e);
         throw e;
       }
     }
@@ -12528,7 +12538,7 @@ var require_merge2 = __commonJS({
 var require_addPairToJSMap = __commonJS({
   "../../node_modules/.pnpm/yaml@2.8.3/node_modules/yaml/dist/nodes/addPairToJSMap.js"(exports2) {
     "use strict";
-    var log9 = require_log();
+    var log10 = require_log();
     var merge = require_merge2();
     var stringify = require_stringify2();
     var identity = require_identity();
@@ -12577,7 +12587,7 @@ var require_addPairToJSMap = __commonJS({
           let jsonStr = JSON.stringify(strKey);
           if (jsonStr.length > 40)
             jsonStr = jsonStr.substring(0, 36) + '..."';
-          log9.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
+          log10.warn(ctx.doc.options.logLevel, `Keys with collection values will be stringified due to JS Object restrictions: ${jsonStr}. Set mapAsMap: true to use object keys.`);
           ctx.mapKeyWarned = true;
         }
         return strKey;
@@ -17973,7 +17983,7 @@ var require_public_api = __commonJS({
     var composer = require_composer();
     var Document = require_Document();
     var errors = require_errors();
-    var log9 = require_log();
+    var log10 = require_log();
     var identity = require_identity();
     var lineCounter = require_line_counter();
     var parser4 = require_parser();
@@ -18025,7 +18035,7 @@ var require_public_api = __commonJS({
       const doc = parseDocument(src, options2);
       if (!doc)
         return null;
-      doc.warnings.forEach((warning) => log9.warn(doc.options.logLevel, warning));
+      doc.warnings.forEach((warning) => log10.warn(doc.options.logLevel, warning));
       if (doc.errors.length > 0) {
         if (doc.options.logLevel !== "silent")
           throw doc.errors[0];
@@ -19062,7 +19072,7 @@ var require_dist_node5 = __commonJS({
     }
     function fetchWrapper(requestOptions) {
       var _a3, _b, _c, _d;
-      const log9 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
+      const log10 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
       const parseSuccessResponseBody = ((_a3 = requestOptions.request) == null ? void 0 : _a3.parseSuccessResponseBody) !== false;
       if (isPlainObject(requestOptions.body) || Array.isArray(requestOptions.body)) {
         requestOptions.body = JSON.stringify(requestOptions.body);
@@ -19097,7 +19107,7 @@ var require_dist_node5 = __commonJS({
         if ("deprecation" in headers) {
           const matches = headers.link && headers.link.match(/<([^<>]+)>; rel="deprecation"/);
           const deprecationLink = matches && matches.pop();
-          log9.warn(
+          log10.warn(
             `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${headers.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
           );
         }
@@ -25585,11 +25595,11 @@ function taskCallback(task, response, callback = NOOP) {
   response.then(onSuccess, onError2);
 }
 function addDeprecationNoticeToError(err2) {
-  let log9 = (name) => {
+  let log10 = (name) => {
     console.warn(
       `simple-git deprecation notice: accessing GitResponseError.${name} should be GitResponseError.git.${name}, this will no longer be available in version 3`
     );
-    log9 = NOOP;
+    log10 = NOOP;
   };
   return Object.create(err2, Object.getOwnPropertyNames(err2.git).reduce(descriptorReducer, {}));
   function descriptorReducer(all, name) {
@@ -25600,7 +25610,7 @@ function addDeprecationNoticeToError(err2) {
       enumerable: false,
       configurable: false,
       get() {
-        log9(name);
+        log10(name);
         return err2.git[name];
       }
     };
@@ -29882,9 +29892,12 @@ var permissionPathSchema = external_exports.string().min(1).transform((val, ctx)
   return result.path;
 });
 var PermissionsFileSchema = external_exports.object({
-  version: external_exports.literal(1),
-  contentVersion: external_exports.number().optional(),
-  // For optimistic locking
+  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
+  // the single OCC counter for this file. Optional so a hand-written file
+  // with no version field parses as version 0. A legacy `contentVersion`
+  // field (if present) is silently stripped by this non-strict zod parse.
+  version: external_exports.number().int().nonnegative().optional(),
+  writeId: external_exports.string().optional(),
   updatedAt: external_exports.string().datetime(),
   updatedBy: external_exports.string(),
   pathPermissions: external_exports.array(
@@ -29900,12 +29913,18 @@ var PermissionsFileSchema = external_exports.object({
 // ../canopycms/src/authorization/permissions/loader.ts
 init_operating_mode();
 
+// ../canopycms/src/authorization/settings-file-store.ts
+init_error();
+
 // ../canopycms/src/authorization/groups/schema.ts
 init_zod();
 var GroupsFileSchema = external_exports.object({
-  version: external_exports.literal(1),
-  contentVersion: external_exports.number().optional(),
-  // For optimistic locking
+  // Managed by writeOccJsonFile (see authorization/settings-file-store.ts) —
+  // the single OCC counter for this file. Optional so a hand-written file
+  // with no version field parses as version 0. A legacy `contentVersion`
+  // field (if present) is silently stripped by this non-strict zod parse.
+  version: external_exports.number().int().nonnegative().optional(),
+  writeId: external_exports.string().optional(),
   updatedAt: external_exports.string().datetime(),
   updatedBy: external_exports.string(),
   groups: external_exports.array(
@@ -29952,6 +29971,9 @@ init_error();
 init_id();
 var log8 = createDebugLogger({ prefix: "ContentListing" });
 
+// ../canopycms/src/context.ts
+var log9 = createDebugLogger({ prefix: "Context" });
+
 // ../canopycms/src/server.ts
 init_operating_mode();
 init_schema();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canopycms-cdk",
-  "version": "0.0.59",
+  "version": "0.0.61-int.74",
   "description": "AWS CDK constructs and EC2 worker for CanopyCMS deployment",
   "license": "MIT",
   "repository": {
@@ -53,8 +53,8 @@
     "tsx": "^4.19.0",
     "typescript": "^5.6.3",
     "vitest": "^4.1.0",
-    "canopycms": "0.0.59",
-    "canopycms-auth-clerk": "0.0.59"
+    "canopycms": "0.0.61-int.74",
+    "canopycms-auth-clerk": "0.0.61-int.74"
   },
   "scripts": {
     "build": "tsc",