canopycms-next 0.0.67-int.89 → 0.0.67-int.91

package/dist/adapter.d.ts

@@ -1,23 +1,15 @@
 import { type CanopyHandlerOptions, type CanopyRequest } from 'canopycms/http';
 /**
- * Options for creating a Canopy Next.js handler.
  * Same as core CanopyHandlerOptions - re-exported for convenience.
  */
 export type CanopyNextOptions = CanopyHandlerOptions;
 /**
- * Wrap a standard Request (or NextRequest) to implement the CanopyRequest interface.
  * Only uses standard Request methods, so any Request subclass works.
  */
 export declare function wrapNextRequest(req: Request): CanopyRequest;
 /**
  * Catch-all Next.js handler for a single API route (e.g., /api/canopycms/[...canopycms]).
  *
- * This is a thin adapter that:
- * 1. Converts NextRequest to CanopyRequest
- * 2. Extracts path segments from Next.js params
- * 3. Delegates to the core handler
- * 4. Converts CanopyResponse to NextResponse
- *
  * @example
  * ```ts
  * // app/api/canopycms/[...canopycms]/route.ts

package/dist/adapter.js

@@ -2,7 +2,6 @@ import { NextResponse } from 'next/server';
 import { createCanopyRequestHandler, isCanopyBinaryResponse, } from 'canopycms/http';
 import { getErrorMessage, redactCredentials, sanitizeErrorMessage } from 'canopycms/utils/error';
 /**
- * Wrap a standard Request (or NextRequest) to implement the CanopyRequest interface.
  * Only uses standard Request methods, so any Request subclass works.
  */
 export function wrapNextRequest(req) {
@@ -30,10 +29,6 @@ export function wrapNextRequest(req) {
         },
     };
 }
-/**
- * Map a CanopyBinaryResponse's framework-agnostic header fields onto the
- * real HTTP header names, omitting any that weren't set.
- */
 function toBinaryHeaders(headers) {
     const result = {};
     if (headers.contentType)
@@ -46,17 +41,12 @@ function toBinaryHeaders(headers) {
         result['ETag'] = headers.etag;
     return result;
 }
-/**
- * Convert a CanopyResponse (or CanopyBinaryResponse) to a NextResponse.
- */
 function toNextResponse(response) {
     if (isCanopyBinaryResponse(response)) {
-        // A Uint8Array can be backed by an arbitrary ArrayBufferLike (e.g. a
-        // Node Buffer), which doesn't structurally satisfy the DOM lib's
-        // BodyInit/ArrayBufferView (specifically ArrayBuffer-backed). Copying
-        // through the typed-array constructor yields a plain ArrayBuffer-backed
-        // view so this type-checks without an unsafe cast; ReadableStream
-        // bodies pass through unchanged.
+        // A Uint8Array can be backed by an arbitrary ArrayBufferLike (e.g. a Node Buffer), which
+        // doesn't structurally satisfy the DOM lib's BodyInit/ArrayBufferView. Copying through the
+        // typed-array constructor yields a plain ArrayBuffer-backed view that type-checks without an
+        // unsafe cast; ReadableStream bodies pass through unchanged.
         const body = response.body instanceof Uint8Array ? new Uint8Array(response.body) : response.body;
         return new NextResponse(body, {
             status: response.status,
@@ -69,7 +59,6 @@ function toNextResponse(response) {
     });
 }
 /**
- * Extract path segments from Next.js catch-all route params.
  * Handles both Next.js 14 (direct object) and Next.js 15 (Promise) params.
  */
 async function extractPathSegments(ctx) {
@@ -81,12 +70,6 @@ async function extractPathSegments(ctx) {
 /**
  * Catch-all Next.js handler for a single API route (e.g., /api/canopycms/[...canopycms]).
  *
- * This is a thin adapter that:
- * 1. Converts NextRequest to CanopyRequest
- * 2. Extracts path segments from Next.js params
- * 3. Delegates to the core handler
- * 4. Converts CanopyResponse to NextResponse
- *
  * @example
  * ```ts
  * // app/api/canopycms/[...canopycms]/route.ts
@@ -116,17 +99,14 @@ export const createCanopyCatchAllHandler = (options) => {
             return toNextResponse(response);
         }
         catch (err) {
-            // Defense-in-depth (API-C1): coreHandler already guards itself with a
-            // top-level try/catch, but this adapter also wraps request conversion
-            // (wrapNextRequest/extractPathSegments/toNextResponse) so a failure there
-            // can never escape as Next's generic unhandled-error 500, which would
-            // break the uniform { ok, status, error } envelope the editor expects.
+            // Defense-in-depth (API-C1): coreHandler already guards itself with a top-level try/catch,
+            // but this adapter also wraps request conversion, so a failure there can never escape as
+            // Next's generic unhandled-error 500, which would break the uniform { ok, status, error }
+            // envelope the editor expects.
             const message = getErrorMessage(err);
-            // Redacted before logging, not just before responding. The HTTP body was
-            // already sanitized, but this line went to the server log verbatim -- and
-            // a git failure message can embed a token-bearing clone URL, which is the
-            // one thing that must not reach a log aggregator. Every failure surface
-            // in the worker already redacts; this was the outlier.
+            // Redacted before logging, not just before responding: the HTTP body is already sanitized,
+            // but this line reaches the server log verbatim, and a git failure message can embed a
+            // token-bearing clone URL — the one thing that must not reach a log aggregator.
             console.error('CanopyCMS: Unhandled error in Next.js catch-all handler:', redactCredentials(message));
             return toNextResponse({
                 status: 500,

package/dist/client.d.ts

@@ -3,13 +3,11 @@ import type { CanopyClientConfig, CustomFieldRenderers } from 'canopycms/client'
  * Next.js-specific wrapper for CanopyEditorPage that automatically reads
  * URL search params (branch, entry) using Next.js's useSearchParams hook.
  *
- * @param customRenderers Optional per-field-type render overrides, forwarded
- * to `CanopyEditorPage`. Forwarded rather than dropped for a specific reason:
- * Next is the primary target, so this wrapper is the entrypoint adopters
- * actually import (it is what the README's Quick Start scaffolds). Accepting
- * the argument only on the core `CanopyEditorPage` made the extension point
- * unreachable from the path every adopter uses, which is an extension point
- * in name only.
+ * @param customRenderers Optional per-field-type render overrides, forwarded to
+ * `CanopyEditorPage`. Forwarded (not dropped) because Next is the primary target: this wrapper
+ * is the entrypoint every adopter imports (the README's Quick Start scaffolds it), so accepting
+ * the argument only on core `CanopyEditorPage` would make the extension point unreachable from
+ * the path adopters actually use.
  *
  * @example
  * ```tsx

package/dist/client.js

@@ -7,13 +7,11 @@ import { CanopyEditorPage } from 'canopycms/client';
  * Next.js-specific wrapper for CanopyEditorPage that automatically reads
  * URL search params (branch, entry) using Next.js's useSearchParams hook.
  *
- * @param customRenderers Optional per-field-type render overrides, forwarded
- * to `CanopyEditorPage`. Forwarded rather than dropped for a specific reason:
- * Next is the primary target, so this wrapper is the entrypoint adopters
- * actually import (it is what the README's Quick Start scaffolds). Accepting
- * the argument only on the core `CanopyEditorPage` made the extension point
- * unreachable from the path every adopter uses, which is an extension point
- * in name only.
+ * @param customRenderers Optional per-field-type render overrides, forwarded to
+ * `CanopyEditorPage`. Forwarded (not dropped) because Next is the primary target: this wrapper
+ * is the entrypoint every adopter imports (the README's Quick Start scaffolds it), so accepting
+ * the argument only on core `CanopyEditorPage` would make the extension point unreachable from
+ * the path adopters actually use.
  *
  * @example
  * ```tsx
@@ -31,10 +29,9 @@ import { CanopyEditorPage } from 'canopycms/client';
  */
 export const NextCanopyEditorPage = (config, customRenderers) => {
     const CorePage = CanopyEditorPage(config, customRenderers);
-    // Reads URL search params. Next.js 15 requires useSearchParams() consumers to
-    // sit under a <Suspense> boundary, otherwise static rendering errors with
-    // "useSearchParams() should be wrapped in a suspense boundary". We provide the
-    // boundary here so adopters don't have to wrap their /edit page themselves.
+    // Next.js 15 requires useSearchParams() consumers to sit under a <Suspense> boundary, or static
+    // rendering errors with "useSearchParams() should be wrapped in a suspense boundary" — provided
+    // here so adopters don't have to wrap their /edit page themselves.
     function EditorWithSearchParams() {
         const urlSearchParams = useSearchParams();
         const searchParams = {

package/dist/config.cjs

@@ -36,7 +36,187 @@ module.exports = __toCommonJS(config_exports);
 
 // src/with-canopy.ts
 var import_node_module = require("node:module");
+var import_node_path2 = __toESM(require("node:path"), 1);
+
+// src/sharp-tracing.ts
+var import_node_fs = require("node:fs");
 var import_node_path = __toESM(require("node:path"), 1);
+var LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lock", "bun.lockb"];
+var LEGACY_LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "yarn.lock", "bun.lockb"];
+var NEXT_CONFIG_FILES = ["next.config.js", "next.config.mjs", "next.config.ts", "next.config.mts"];
+var GLOB_METACHARACTERS = /[*?[\]{}(),!\\]/;
+var LIBVIPS_PACKAGE = /^@img\/sharp-libvips-/;
+var NATIVE_BINDING_PACKAGE = /^@img\/sharp-(?!libvips-)/;
+function messageOf(err) {
+  if (err instanceof Error) return err.message;
+  if (typeof err === "string") return err;
+  return String(err);
+}
+function isFile(candidate) {
+  try {
+    return (0, import_node_fs.statSync)(candidate).isFile();
+  } catch {
+    return false;
+  }
+}
+function isDirectory(candidate) {
+  try {
+    return (0, import_node_fs.statSync)(candidate).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function isOutside(root, target) {
+  const relative = import_node_path.default.relative(root, target);
+  return relative === ".." || relative.startsWith(`..${import_node_path.default.sep}`) || import_node_path.default.isAbsolute(relative);
+}
+function readManifest(packageDir) {
+  const parsed = JSON.parse((0, import_node_fs.readFileSync)(import_node_path.default.join(packageDir, "package.json"), "utf8"));
+  const manifest = { optionalDependencyNames: [] };
+  if (typeof parsed !== "object" || parsed === null) return manifest;
+  if ("name" in parsed && typeof parsed.name === "string") manifest.name = parsed.name;
+  if ("version" in parsed && typeof parsed.version === "string") manifest.version = parsed.version;
+  if ("optionalDependencies" in parsed && typeof parsed.optionalDependencies === "object" && parsed.optionalDependencies !== null) {
+    manifest.optionalDependencyNames = Object.keys(parsed.optionalDependencies);
+  }
+  return manifest;
+}
+function nodeModulesLookupDirs(fromDir) {
+  const dirs = [];
+  for (let dir = import_node_path.default.resolve(fromDir); ; dir = import_node_path.default.dirname(dir)) {
+    if (import_node_path.default.basename(dir) !== "node_modules") dirs.push(import_node_path.default.join(dir, "node_modules"));
+    if (import_node_path.default.dirname(dir) === dir) return dirs;
+  }
+}
+function findInstalledPackage(fromDir, name) {
+  for (const lookupDir of nodeModulesLookupDirs(fromDir)) {
+    const candidate = import_node_path.default.join(lookupDir, name);
+    if (isFile(import_node_path.default.join(candidate, "package.json"))) return (0, import_node_fs.realpathSync)(candidate);
+  }
+  return null;
+}
+function installedNextMajor(projectDir) {
+  try {
+    const nextDir = findInstalledPackage(projectDir, "next");
+    if (!nextDir) return null;
+    const major = Number.parseInt(readManifest(nextDir).version ?? "", 10);
+    return Number.isNaN(major) ? null : major;
+  } catch {
+    return null;
+  }
+}
+function hasNextConfig(dir) {
+  return NEXT_CONFIG_FILES.some((name) => isFile(import_node_path.default.join(dir, name)));
+}
+function findLockFileUpwards(startDir, names) {
+  for (let dir = startDir; ; dir = import_node_path.default.dirname(dir)) {
+    for (const name of names) {
+      const candidate = import_node_path.default.join(dir, name);
+      if (isFile(candidate)) return candidate;
+    }
+    if (import_node_path.default.dirname(dir) === dir) return null;
+  }
+}
+function resolveTracingRoot(input) {
+  const configured = input.outputFileTracingRoot || input.turbopackRoot;
+  if (configured) return import_node_path.default.resolve(input.projectDir, configured);
+  if (input.lockfileRoot === "closest") {
+    const closest = findLockFileUpwards(input.projectDir, LEGACY_LOCKFILES);
+    return closest ? import_node_path.default.dirname(closest) : input.projectDir;
+  }
+  let lockFile = findLockFileUpwards(input.projectDir, LOCKFILES);
+  if (!lockFile) return input.projectDir;
+  for (; ; ) {
+    const lockDir = import_node_path.default.dirname(lockFile);
+    const parentDir = import_node_path.default.dirname(lockDir);
+    if (parentDir === lockDir) break;
+    const outer = findLockFileUpwards(parentDir, LOCKFILES);
+    if (!outer) break;
+    lockFile = outer;
+  }
+  return import_node_path.default.dirname(lockFile);
+}
+function nativeLibraryDirsFor(sharpDir) {
+  const found = /* @__PURE__ */ new Set();
+  const collectLibvips = (fromDir, dependencyNames) => {
+    for (const name of dependencyNames.filter((n) => LIBVIPS_PACKAGE.test(n))) {
+      const dir = findInstalledPackage(fromDir, name);
+      if (dir) found.add(dir);
+    }
+  };
+  const sharpDependencies = readManifest(sharpDir).optionalDependencyNames;
+  collectLibvips(sharpDir, sharpDependencies);
+  for (const bindingName of sharpDependencies.filter((n) => NATIVE_BINDING_PACKAGE.test(n))) {
+    const bindingDir = findInstalledPackage(sharpDir, bindingName);
+    if (!bindingDir) continue;
+    const bindingDependencies = readManifest(bindingDir).optionalDependencyNames;
+    if (bindingDependencies.some((n) => LIBVIPS_PACKAGE.test(n))) {
+      collectLibvips(bindingDir, bindingDependencies);
+    } else {
+      found.add(bindingDir);
+    }
+  }
+  return [...found];
+}
+function sharpTracingIncludes(input) {
+  try {
+    const projectDir = (0, import_node_fs.realpathSync)(input.projectDir);
+    const root = (0, import_node_fs.realpathSync)(resolveTracingRoot(input));
+    if (isOutside(root, projectDir)) {
+      return {
+        includes: [],
+        problem: `the project directory ${projectDir} is outside the tracing root ${root}`
+      };
+    }
+    const sharpDirs = /* @__PURE__ */ new Set();
+    const canopycmsDir = findInstalledPackage(projectDir, "canopycms");
+    for (const candidate of [
+      canopycmsDir && findInstalledPackage(canopycmsDir, "sharp"),
+      findInstalledPackage(projectDir, "sharp")
+    ]) {
+      if (candidate && readManifest(candidate).name === "sharp") sharpDirs.add(candidate);
+    }
+    if (sharpDirs.size === 0) {
+      return {
+        includes: [],
+        problem: canopycmsDir ? `no sharp is installed for canopycms at ${canopycmsDir}` : `canopycms is not installed where ${projectDir} can find it`
+      };
+    }
+    const includes = /* @__PURE__ */ new Set();
+    const notes = [];
+    for (const sharpDir of sharpDirs) {
+      const libraryDirs = nativeLibraryDirsFor(sharpDir);
+      if (libraryDirs.length === 0) {
+        notes.push(
+          `no libvips package is installed for sharp at ${sharpDir}, and no installed native binding carries its own library`
+        );
+      }
+      for (const libraryDir of libraryDirs) {
+        const libDir = import_node_path.default.join(libraryDir, "lib");
+        if (!isDirectory(libDir)) {
+          notes.push(`${libDir} does not exist`);
+          continue;
+        }
+        if (isOutside(root, libDir)) {
+          notes.push(`${libDir} is outside the tracing root ${root}`);
+          continue;
+        }
+        const relative = import_node_path.default.relative(projectDir, libDir).split(import_node_path.default.sep).join("/");
+        if (GLOB_METACHARACTERS.test(relative)) {
+          notes.push(`${relative} contains a glob metacharacter`);
+          continue;
+        }
+        includes.add(`${relative}/**/*`);
+      }
+    }
+    if (includes.size === 0) return { includes: [], problem: notes.join("; ") };
+    return { includes: [...includes] };
+  } catch (err) {
+    return { includes: [], problem: messageOf(err) };
+  }
+}
+
+// src/with-canopy.ts
 var REQUIRED_PACKAGES = ["canopycms"];
 var OPTIONAL_PACKAGES = [
   "canopycms-next",
@@ -70,8 +250,8 @@ function withAssetsRewrite(existingRewrites) {
 function resolveReactAliases(resolve) {
   try {
     return {
-      react: import_node_path.default.dirname(resolve("react")),
-      "react-dom": import_node_path.default.dirname(resolve("react-dom"))
+      react: import_node_path2.default.dirname(resolve("react")),
+      "react-dom": import_node_path2.default.dirname(resolve("react-dom"))
     };
   } catch {
     return null;
@@ -100,8 +280,82 @@ function resolveStaticBuildId() {
   }
   return trimmed;
 }
+var ALL_ROUTES = "/**";
+function isTracingIncludes(value) {
+  return typeof value === "object" && value !== null && Object.values(value).every(
+    (globs) => Array.isArray(globs) && globs.every((g) => typeof g === "string")
+  );
+}
+function readProperty(value, key) {
+  return typeof value === "object" && value !== null ? Reflect.get(value, key) : void 0;
+}
+function stringOrUndefined(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function isSet(value) {
+  return value !== void 0 && value !== null;
+}
+function mergeTracingIncludes(existing, includes) {
+  return {
+    ...existing,
+    [ALL_ROUTES]: [.../* @__PURE__ */ new Set([...existing?.[ALL_ROUTES] ?? [], ...includes])]
+  };
+}
+function sharpTracingWarning(problem, nextVersionUnknown) {
+  return "CanopyCMS: could not add sharp's libvips to this standalone build's file tracing" + (problem ? ` (${problem})` : "") + ". Next.js file tracing can miss that library for sharp 0.35 (https://github.com/vercel/next.js/issues/97973), and the built server then fails to load sharp with ERR_DLOPEN_FAILED. Add it in next.config yourself, with paths relative to the project directory. For pnpm: outputFileTracingIncludes: { '/**': ['node_modules/.pnpm/@img+sharp-libvips-*/node_modules/@img/*/lib/**/*'] }. For npm: outputFileTracingIncludes: { '/**': ['node_modules/@img/sharp-libvips-*/lib/**/*'] }." + (nextVersionUnknown ? " The installed Next.js version could not be read either: on Next 13 or 14, put outputFileTracingIncludes under experimental." : "");
+}
+function unknownNextVersionWarning(projectDir) {
+  return `CanopyCMS: could not read the version of the next package installed for ${projectDir}, so sharp's libvips was added to the top-level outputFileTracingIncludes key, which Next 15 and later read. Next 13 and 14 ignore that key: on those versions, move the entry under experimental.outputFileTracingIncludes.`;
+}
+var warnedAboutSharpTracing = false;
+function sharpTracingConfig(nextConfig, options) {
+  if (options.staticBuild || nextConfig.output === "export") return {};
+  const projectDir = process.cwd();
+  const nextMajor = installedNextMajor(projectDir);
+  const experimental = nextConfig.experimental ?? {};
+  const experimentalOnly = nextMajor !== null && nextMajor < 15;
+  const includesUnderExperimental = experimentalOnly || isSet(readProperty(experimental, "outputFileTracingIncludes"));
+  const rootUnderExperimental = experimentalOnly || isSet(readProperty(experimental, "outputFileTracingRoot"));
+  const writtenIncludes = includesUnderExperimental ? readProperty(experimental, "outputFileTracingIncludes") : nextConfig.outputFileTracingIncludes;
+  const existing = isSet(writtenIncludes) ? writtenIncludes : void 0;
+  if (existing !== void 0 && !isTracingIncludes(existing)) return {};
+  const configuredRoot = stringOrUndefined(
+    rootUnderExperimental ? readProperty(experimental, "outputFileTracingRoot") : nextConfig.outputFileTracingRoot
+  );
+  const turbopack = nextConfig.turbopack;
+  const turbopackHasRootKey = typeof turbopack === "object" && turbopack !== null && "root" in turbopack;
+  const legacyTurbopackRoot = nextMajor === 15 && !turbopackHasRootKey ? stringOrUndefined(readProperty(readProperty(experimental, "turbo"), "root")) : void 0;
+  const turbopackRoot = experimentalOnly ? void 0 : stringOrUndefined(readProperty(turbopack, "root")) ?? legacyTurbopackRoot;
+  const { includes, problem } = hasNextConfig(projectDir) ? sharpTracingIncludes({
+    projectDir,
+    outputFileTracingRoot: configuredRoot,
+    turbopackRoot,
+    lockfileRoot: experimentalOnly ? "closest" : "outermost"
+  }) : {
+    includes: [],
+    problem: `the working directory ${projectDir} has no next.config file, so withCanopy cannot tell where the project is`
+  };
+  const nextVersionUnknown = nextMajor === null;
+  if (includes.length === 0) {
+    if (nextConfig.output === "standalone" && !warnedAboutSharpTracing) {
+      warnedAboutSharpTracing = true;
+      console.warn(sharpTracingWarning(problem, nextVersionUnknown));
+    }
+    return {};
+  }
+  const merged = mergeTracingIncludes(existing, includes);
+  if (!includesUnderExperimental) {
+    if (nextVersionUnknown && nextConfig.output === "standalone" && !warnedAboutSharpTracing) {
+      warnedAboutSharpTracing = true;
+      console.warn(unknownNextVersionWarning(projectDir));
+    }
+    return { outputFileTracingIncludes: merged };
+  }
+  const legacyExperimental = { ...experimental, outputFileTracingIncludes: merged };
+  return { experimental: legacyExperimental };
+}
 function withCanopy(nextConfig = {}, options = {}) {
-  const resolve = (0, import_node_module.createRequire)(import_node_path.default.join(process.cwd(), "noop.js")).resolve;
+  const resolve = (0, import_node_module.createRequire)(import_node_path2.default.join(process.cwd(), "noop.js")).resolve;
   const installedOptional = OPTIONAL_PACKAGES.filter((pkg) => {
     try {
       resolve(pkg);
@@ -136,6 +390,8 @@ function withCanopy(nextConfig = {}, options = {}) {
     }
     return config;
   } : existingWebpack;
+  const nextMajor = installedNextMajor(process.cwd());
+  const answerTurbopackGuard = webpack !== void 0 && !isSet(existingWebpack) && !isSet(nextConfig.turbopack) && nextMajor !== null && nextMajor >= 16;
   const pageExtensions = [
     .../* @__PURE__ */ new Set([
       ...nextConfig.pageExtensions ?? NEXTJS_DEFAULT_PAGE_EXTENSIONS,
@@ -149,9 +405,11 @@ function withCanopy(nextConfig = {}, options = {}) {
     pageExtensions,
     webpack,
     rewrites: withAssetsRewrite(nextConfig.rewrites),
+    ...sharpTracingConfig(nextConfig, options),
     // Spread conditionally: emitting `generateBuildId: undefined` would be a key Next has to
     // reason about, where absence is unambiguous.
-    ...generateBuildId ? { generateBuildId } : {}
+    ...generateBuildId ? { generateBuildId } : {},
+    ...answerTurbopackGuard ? { turbopack: {} } : {}
   };
 }
 // Annotate the CommonJS export names for ESM import in node: