canopycms 0.0.16 → 0.0.18

package/dist/paths/index.js

@@ -10,21 +10,21 @@
  *
  * Usage:
  * ```ts
- * import { normalizeFilesystemPath, createLogicalPath, parseSlug } from '../paths'
+ * import { normalizeFilesystemPath, createLogicalPath, parseSlug } from '../paths/index.js'
  * ```
  */
 // Normalization utilities (client-safe)
-export { normalizeFilesystemPath, normalizeCollectionPath, hasTraversalSequence, createLogicalPath, createPhysicalPath, joinPath, } from './normalize';
+export { normalizeFilesystemPath, normalizeCollectionPath, hasTraversalSequence, createLogicalPath, createPhysicalPath, joinPath, trimSlashes, } from './normalize.js';
 // Normalization utilities (server-only, requires Node.js path module)
-export { validateAndNormalizePath } from './normalize-server';
+export { validateAndNormalizePath } from './normalize-server.js';
 // Validation utilities
 export { validateContentPath, isValidCollectionPath, sanitizeForPath, 
 // Path type detection and parsing
 hasEmbeddedContentId, looksLikePhysicalPath, looksLikeLogicalPath, parseLogicalPath, parsePhysicalPath, isValidContentId, 
 // Branded type validation and parsing
-parseContentId, parseBranchName, parseSlug, } from './validation';
+parseContentId, parseBranchName, parseSlug, } from './validation.js';
 // Path resolution utilities
-export { resolveLogicalPath } from './resolve';
+export { resolveLogicalPath } from './resolve.js';
 // Branch path utilities
-export { resolveBranchPath, ensureBranchRoot, getDefaultBranchBase, resolveBranchPaths, sanitizeBranchName, BranchPathError, } from './branch';
+export { resolveBranchPath, ensureBranchRoot, getDefaultBranchBase, resolveBranchPaths, sanitizeBranchName, BranchPathError, } from './branch.js';
 //# sourceMappingURL=index.js.map

package/dist/paths/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/paths/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAaH,wCAAwC;AACxC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,GACT,MAAM,aAAa,CAAA;AAEpB,sEAAsE;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,uBAAuB;AACvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,eAAe;AACf,kCAAkC;AAClC,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB;AAChB,sCAAsC;AACtC,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,cAAc,CAAA;AAErB,4BAA4B;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,wBAAwB;AACxB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/paths/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAaH,wCAAwC;AACxC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,WAAW,GACZ,MAAM,aAAa,CAAA;AAEpB,sEAAsE;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,uBAAuB;AACvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,eAAe;AACf,kCAAkC;AAClC,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB;AAChB,sCAAsC;AACtC,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,cAAc,CAAA;AAErB,4BAA4B;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,wBAAwB;AACxB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,UAAU,CAAA"}

package/dist/paths/normalize.d.ts

@@ -51,6 +51,14 @@ export declare function createLogicalPath(...segments: string[]): LogicalPath;
  * createPhysicalPath('content', 'posts', 'my-post.ABC123.mdx') // as PhysicalPath
  */
 export declare function createPhysicalPath(...segments: string[]): PhysicalPath;
+/**
+ * Strip leading and trailing slashes from a path or URL segment.
+ *
+ * @example
+ * trimSlashes('/docs/guides/') // 'docs/guides'
+ * trimSlashes('///multi///') // 'multi'
+ */
+export declare function trimSlashes(path: string): string;
 /**
  * Join path segments with forward slashes.
  * Does not validate - use createLogicalPath/createPhysicalPath for validation.

package/dist/paths/normalize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/paths/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,SAAY,GAAG,MAAM,CAO/F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,WAAW,CAWpE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,CAWtE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAKtD"}
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/paths/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAExD;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,SAAY,GAAG,MAAM,CAO/F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,WAAW,CAWpE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,CAWtE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAKtD"}

package/dist/paths/normalize.js

@@ -83,6 +83,23 @@ export function createPhysicalPath(...segments) {
     }
     return normalized;
 }
+/**
+ * Strip leading and trailing slashes from a path or URL segment.
+ *
+ * @example
+ * trimSlashes('/docs/guides/') // 'docs/guides'
+ * trimSlashes('///multi///') // 'multi'
+ */
+export function trimSlashes(path) {
+    // Linear scan instead of regex to avoid polynomial ReDoS on repeated '/' chars
+    let start = 0;
+    let end = path.length;
+    while (start < end && path[start] === '/')
+        start++;
+    while (end > start && path[end - 1] === '/')
+        end--;
+    return path.slice(start, end);
+}
 /**
  * Join path segments with forward slashes.
  * Does not validate - use createLogicalPath/createPhysicalPath for validation.

package/dist/paths/normalize.js.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/paths/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,IAAI;SACR,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,WAAW,GAAG,SAAS;IACrF,MAAM,UAAU,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,GAAG,WAAW,GAAG,CAAA;IAChC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,QAAkB;IACrD,MAAM,UAAU,GAAG,QAAQ;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,UAAyB,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAG,QAAkB;IACtD,MAAM,UAAU,GAAG,QAAQ;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,UAA0B,CAAA;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAG,QAAkB;IAC5C,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/paths/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,OAAO,IAAI;SACR,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,WAAW,GAAG,SAAS;IACrF,MAAM,UAAU,GAAG,uBAAuB,CAAC,cAAc,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAG,GAAG,WAAW,GAAG,CAAA;IAChC,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAChD,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,QAAkB;IACrD,MAAM,UAAU,GAAG,QAAQ;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,UAAyB,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAG,QAAkB;IACtD,MAAM,UAAU,GAAG,QAAQ;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,IAAI,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,UAAU,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,UAA0B,CAAA;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,+EAA+E;IAC/E,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,OAAO,KAAK,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAA;IAClD,OAAO,GAAG,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAG,QAAkB;IAC5C,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;SACtC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/paths/test-utils.js

@@ -6,7 +6,7 @@
  *
  * @example
  * // In test files only:
- * import { unsafeAsLogicalPath, unsafeAsSlug } from '../paths/test-utils'
+ * import { unsafeAsLogicalPath, unsafeAsSlug } from '../paths/test-utils.js'
  */
 /** Test-only: cast a string to LogicalPath without validation. */
 export const unsafeAsLogicalPath = (path) => path;

package/dist/paths/validation.js

@@ -3,7 +3,7 @@
  *
  * Security-focused validation for content paths and slugs.
  */
-import { normalizeFilesystemPath, hasTraversalSequence } from './normalize';
+import { normalizeFilesystemPath, hasTraversalSequence } from './normalize.js';
 /**
  * Base58 alphabet used for content IDs (excludes ambiguous: 0, O, I, l)
  */

package/dist/reference-resolver.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { extractSlugFromFilename } from './content-id-index';
+import { extractSlugFromFilename } from './content-id-index.js';
 /**
  * ReferenceResolver resolves content IDs to display values for reference fields.
  *

package/dist/schema/index.js

@@ -13,7 +13,7 @@
  * ```
  */
 // Meta loader (low-level API)
-export { loadCollectionMetaFiles, resolveCollectionReferences, watchCollectionMetaFiles, } from './meta-loader';
+export { loadCollectionMetaFiles, resolveCollectionReferences, watchCollectionMetaFiles, } from './meta-loader.js';
 // Resolver (high-level API)
-export { resolveSchema, hasSchemaFiles, isValidSchema } from './resolver';
+export { resolveSchema, hasSchemaFiles, isValidSchema } from './resolver.js';
 //# sourceMappingURL=index.js.map

package/dist/schema/meta-loader.js

@@ -2,7 +2,7 @@ import { promises as fs } from 'fs';
 import { join } from 'pathe';
 import { z } from 'zod';
 import chokidar from 'chokidar';
-import { extractSlugFromFilename, extractIdFromFilename } from '../content-id-index';
+import { extractSlugFromFilename, extractIdFromFilename } from '../content-id-index.js';
 /**
  * Zod schema for entry type metadata in .collection.json files.
  * Each entry type has a name, format, and schema reference to the entry schema registry.

package/dist/schema/resolver.js

@@ -7,7 +7,7 @@
  * Field schemas are defined in the entry schema registry and referenced by name
  * in .collection.json files for reusability and type safety.
  */
-import { loadCollectionMetaFiles, resolveCollectionReferences } from './meta-loader';
+import { loadCollectionMetaFiles, resolveCollectionReferences } from './meta-loader.js';
 /**
  * Resolve schema from .collection.json files.
  *

package/dist/schema/schema-store.js

@@ -11,10 +11,10 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { z } from 'zod';
-import { atomicWriteFile } from '../utils/atomic-write';
-import { resolveCollectionPath } from '../content-id-index';
-import { generateId, isValidId } from '../id';
-import { createLogicalPath, validateAndNormalizePath } from '../paths';
+import { atomicWriteFile } from '../utils/atomic-write.js';
+import { resolveCollectionPath } from '../content-id-index.js';
+import { generateId, isValidId } from '../id.js';
+import { createLogicalPath, validateAndNormalizePath } from '../paths/index.js';
 // ============================================================================
 // Zod Schemas for Validation
 // ============================================================================

package/dist/server.js

@@ -1,14 +1,14 @@
-export * from './content-reader';
-export * from './services';
-export * from './build-mode';
-export * from './context';
-export { operatingStrategy } from './operating-mode';
-export * from './authorization/groups';
-export * from './branch-workspace';
-export * from './content-store';
-export { loadCollectionMetaFiles, resolveCollectionReferences, watchCollectionMetaFiles, resolveSchema, } from './schema';
-export { createEntrySchemaRegistry, validateEntrySchemaRegistry } from './entry-schema-registry';
-export { generateId, isValidId } from './id';
-export { buildContentTree } from './content-tree';
-export { listEntries } from './content-listing';
+export * from './content-reader.js';
+export * from './services.js';
+export * from './build-mode.js';
+export * from './context.js';
+export { operatingStrategy } from './operating-mode/index.js';
+export * from './authorization/groups/index.js';
+export * from './branch-workspace.js';
+export * from './content-store.js';
+export { loadCollectionMetaFiles, resolveCollectionReferences, watchCollectionMetaFiles, resolveSchema, } from './schema/index.js';
+export { createEntrySchemaRegistry, validateEntrySchemaRegistry } from './entry-schema-registry.js';
+export { generateId, isValidId } from './id.js';
+export { buildContentTree } from './content-tree.js';
+export { listEntries } from './content-listing.js';
 //# sourceMappingURL=server.js.map

package/dist/services.js

@@ -1,16 +1,16 @@
 import path from 'node:path';
-import { getConfigDefaults } from './config';
-import { createCheckPathAccess, createCheckBranchAccess, createCheckContentAccess, loadPathPermissions, } from './authorization';
-import { GitManager } from './git-manager';
-import { BranchRegistry } from './branch-registry';
-import { SettingsWorkspaceManager } from './settings-workspace';
-import { getDefaultBranchBase } from './paths';
-import { createGitHubService } from './github-service';
-import { operatingStrategy } from './operating-mode';
-import { BranchSchemaCache } from './branch-schema-cache';
-import { enqueueTask } from './worker/task-queue';
-import { getTaskQueueDir } from './worker/task-queue-config';
-import { detectHeadBranch } from './utils/git';
+import { getConfigDefaults } from './config/index.js';
+import { createCheckPathAccess, createCheckBranchAccess, createCheckContentAccess, loadPathPermissions, } from './authorization/index.js';
+import { GitManager } from './git-manager.js';
+import { BranchRegistry } from './branch-registry.js';
+import { SettingsWorkspaceManager } from './settings-workspace.js';
+import { getDefaultBranchBase } from './paths/index.js';
+import { createGitHubService } from './github-service.js';
+import { operatingStrategy } from './operating-mode/index.js';
+import { BranchSchemaCache } from './branch-schema-cache.js';
+import { enqueueTask } from './worker/task-queue.js';
+import { getTaskQueueDir } from './worker/task-queue-config.js';
+import { detectHeadBranch } from './utils/git.js';
 /**
  * In dev mode, auto-detect the current HEAD branch if defaultBaseBranch is not set.
  * Eliminates the need to manually update defaultBaseBranch when working on a feature branch.

package/dist/settings-branch-utils.js

@@ -1,4 +1,4 @@
-import { operatingStrategy } from './operating-mode';
+import { operatingStrategy } from './operating-mode/index.js';
 /**
  * Check if a branch name is the settings branch for the current configuration
  */

package/dist/settings-workspace.js

@@ -1,8 +1,8 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { GitManager } from './git-manager';
-import { createDebugLogger } from './utils/debug';
-import { isFileExistsError } from './utils/error';
+import { GitManager } from './git-manager.js';
+import { createDebugLogger } from './utils/debug.js';
+import { isFileExistsError } from './utils/error.js';
 const log = createDebugLogger({ prefix: 'SettingsWorkspace' });
 // In-memory lock to prevent concurrent workspace initialization within the same process.
 // Settings only need one lock (not per-branch like content branches).

package/dist/task-queue/index.js

@@ -1,2 +1,2 @@
-export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, } from './task-queue';
+export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, recoverOrphanedTasks, cleanupOldTasks, getTask, listTasks, getQueueStats, } from './task-queue.js';
 //# sourceMappingURL=index.js.map

package/dist/task-queue/task-queue.js

@@ -21,7 +21,7 @@ import crypto from 'node:crypto';
 const DEFAULT_MAX_RETRIES = 3;
 // Silent no-op logger
 const nullLogger = { debug: () => { } };
-import { atomicWriteFile } from '../utils/atomic-write';
+import { atomicWriteFile } from '../utils/atomic-write.js';
 // Local helper — only stdlib dependency, keeps task-queue easy to extract.
 function isNotFoundError(err) {
     return err instanceof Error && 'code' in err && err.code === 'ENOENT';

package/dist/url-path-resolver.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolves a URL path to candidate entryPath/slug pairs for content lookup.
+ *
+ * Returns an ordered list of attempts:
+ * 1. Direct entry: last segment is slug, rest is collection path
+ * 2. Index fallback: full path is collection, slug is 'index'
+ *
+ * @param urlPath - URL path like '/docs/guides/getting-started' or 'docs/guides'
+ * @param contentRoot - Content root directory name (default: 'content')
+ * @returns Array of { entryPath, slug } candidates to try in order
+ */
+export declare function resolveUrlPathCandidates(urlPath: string, contentRoot: string): Array<{
+    entryPath: string;
+    slug: string;
+}>;
+//# sourceMappingURL=url-path-resolver.d.ts.map

package/dist/url-path-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-path-resolver.d.ts","sourceRoot":"","sources":["../src/url-path-resolver.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB5C"}

package/dist/url-path-resolver.js

@@ -0,0 +1,31 @@
+import { trimSlashes } from './paths/normalize.js';
+/**
+ * Resolves a URL path to candidate entryPath/slug pairs for content lookup.
+ *
+ * Returns an ordered list of attempts:
+ * 1. Direct entry: last segment is slug, rest is collection path
+ * 2. Index fallback: full path is collection, slug is 'index'
+ *
+ * @param urlPath - URL path like '/docs/guides/getting-started' or 'docs/guides'
+ * @param contentRoot - Content root directory name (default: 'content')
+ * @returns Array of { entryPath, slug } candidates to try in order
+ */
+export function resolveUrlPathCandidates(urlPath, contentRoot) {
+    const normalized = trimSlashes(urlPath);
+    const segments = normalized.split('/').filter(Boolean);
+    if (segments.length === 0)
+        return [];
+    const candidates = [];
+    // Try 1: last segment is the entry slug, rest is the collection path
+    const slug = segments[segments.length - 1];
+    const collectionSegments = segments.slice(0, -1);
+    const entryPath = collectionSegments.length > 0 ? `${contentRoot}/${collectionSegments.join('/')}` : contentRoot;
+    candidates.push({ entryPath, slug });
+    // Try 2: full path is a collection with an index entry
+    candidates.push({
+        entryPath: `${contentRoot}/${segments.join('/')}`,
+        slug: 'index',
+    });
+    return candidates;
+}
+//# sourceMappingURL=url-path-resolver.js.map

package/dist/url-path-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-path-resolver.js","sourceRoot":"","sources":["../src/url-path-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,WAAmB;IAEnB,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAEpC,MAAM,UAAU,GAA+C,EAAE,CAAA;IAEjE,qEAAqE;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAChD,MAAM,SAAS,GACb,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAA;IAEhG,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEpC,uDAAuD;IACvD,UAAU,CAAC,IAAI,CAAC;QACd,SAAS,EAAE,GAAG,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACjD,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/user.js

@@ -1,5 +1,5 @@
 // Import from client-safe subpaths to avoid pulling in server-only loader code
-import { RESERVED_GROUPS } from './authorization/helpers';
+import { RESERVED_GROUPS } from './authorization/helpers.js';
 /**
  * Branded ANONYMOUS_USER constant - use this for intentional anonymous access.
  * Callers must explicitly pass this to indicate anonymous access is intended.

package/dist/utils/body-field.d.ts

@@ -0,0 +1,18 @@
+import type { FieldConfig } from '../config';
+/**
+ * Count the number of top-level fields marked `isBody: true` in a schema.
+ * Does NOT recurse into objects — isBody only makes sense at the top level
+ * because it maps to the file's markdown content.
+ */
+export declare function countBodyFields(fields: readonly FieldConfig[]): number;
+/**
+ * Find the name of the field marked `isBody: true`, or `'body'` as the default.
+ * Used at read time to map the markdown file's content to the correct data field.
+ */
+export declare function findBodyFieldName(fields: readonly FieldConfig[]): string;
+/**
+ * Find isBody fields that have an invalid type (not 'markdown' or 'mdx').
+ * Returns field names that fail validation.
+ */
+export declare function findInvalidBodyFields(fields: readonly FieldConfig[]): string[];
+//# sourceMappingURL=body-field.d.ts.map

package/dist/utils/body-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-field.d.ts","sourceRoot":"","sources":["../../src/utils/body-field.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAI5C;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAMtE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAKxE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,EAAE,CAQ9E"}

package/dist/utils/body-field.js

@@ -0,0 +1,39 @@
+const BODY_FIELD_TYPES = new Set(['markdown', 'mdx']);
+/**
+ * Count the number of top-level fields marked `isBody: true` in a schema.
+ * Does NOT recurse into objects — isBody only makes sense at the top level
+ * because it maps to the file's markdown content.
+ */
+export function countBodyFields(fields) {
+    let count = 0;
+    for (const field of fields) {
+        if ('isBody' in field && field.isBody)
+            count++;
+    }
+    return count;
+}
+/**
+ * Find the name of the field marked `isBody: true`, or `'body'` as the default.
+ * Used at read time to map the markdown file's content to the correct data field.
+ */
+export function findBodyFieldName(fields) {
+    for (const field of fields) {
+        if ('isBody' in field && field.isBody)
+            return field.name;
+    }
+    return 'body';
+}
+/**
+ * Find isBody fields that have an invalid type (not 'markdown' or 'mdx').
+ * Returns field names that fail validation.
+ */
+export function findInvalidBodyFields(fields) {
+    const invalid = [];
+    for (const field of fields) {
+        if ('isBody' in field && field.isBody && !BODY_FIELD_TYPES.has(field.type)) {
+            invalid.push(field.name);
+        }
+    }
+    return invalid;
+}
+//# sourceMappingURL=body-field.js.map

package/dist/utils/body-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-field.js","sourceRoot":"","sources":["../../src/utils/body-field.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA8B;IAC5D,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IAC1D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/utils/fs.js

@@ -1,5 +1,5 @@
 import fs from 'node:fs/promises';
-import { isNotFoundError } from './error';
+import { isNotFoundError } from './error.js';
 /** Check if a path exists on disk. */
 export async function filePathExists(filePath) {
     try {

package/dist/utils/sanitize-href.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Sanitize an untrusted URL for use in `href` attributes.
+ *
+ * Parses the input with `new URL()` and only allows `http:` and `https:` protocols,
+ * blocking `javascript:`, `data:`, `vbscript:`, and other dangerous schemes.
+ * Returns the fallback (default `'#'`) for invalid or disallowed URLs.
+ *
+ * This utility breaks CodeQL's taint chain by constructing a new string from
+ * the parsed URL rather than passing the original input through.
+ *
+ * @example
+ * ```tsx
+ * import { sanitizeHref } from 'canopycms'
+ *
+ * <a href={sanitizeHref(cta.link)}>{cta.text}</a>
+ * ```
+ */
+export declare function sanitizeHref(url: string, fallback?: string): string;
+//# sourceMappingURL=sanitize-href.d.ts.map

package/dist/utils/sanitize-href.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-href.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAUhE"}

package/dist/utils/sanitize-href.js

@@ -0,0 +1,30 @@
+/**
+ * Sanitize an untrusted URL for use in `href` attributes.
+ *
+ * Parses the input with `new URL()` and only allows `http:` and `https:` protocols,
+ * blocking `javascript:`, `data:`, `vbscript:`, and other dangerous schemes.
+ * Returns the fallback (default `'#'`) for invalid or disallowed URLs.
+ *
+ * This utility breaks CodeQL's taint chain by constructing a new string from
+ * the parsed URL rather than passing the original input through.
+ *
+ * @example
+ * ```tsx
+ * import { sanitizeHref } from 'canopycms'
+ *
+ * <a href={sanitizeHref(cta.link)}>{cta.text}</a>
+ * ```
+ */
+export function sanitizeHref(url, fallback = '#') {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+            return parsed.href;
+        }
+    }
+    catch {
+        // invalid URL
+    }
+    return fallback;
+}
+//# sourceMappingURL=sanitize-href.js.map

package/dist/utils/sanitize-href.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-href.js","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAQ,GAAG,GAAG;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/validation/reference-validator.js

@@ -1,5 +1,5 @@
-import { isValidId } from '../id';
-import { findFieldsByType } from './field-traversal';
+import { isValidId } from '../id.js';
+import { findFieldsByType } from './field-traversal.js';
 /**
  * ReferenceValidator validates that referenced content IDs exist and match collection constraints.
  *

package/dist/worker/cms-worker.js

@@ -2,11 +2,11 @@ import fs from 'node:fs/promises';
 import path from 'node:path';
 import { simpleGit } from 'simple-git';
 import { Octokit } from '@octokit/rest';
-import { dequeueTask, completeTask, failTask, retryTask, recoverOrphanedTasks, cleanupOldTasks, cmsTaskQueueLogger, } from './task-queue';
-import { getBranchMetadataFileManager, BranchMetadataFileManager } from '../branch-metadata';
-import { extractIdFromFilename } from '../content-id-index';
-import { ROOT_COLLECTION_ID } from '../paths/types';
-import { isFileExistsError } from '../utils/error';
+import { dequeueTask, completeTask, failTask, retryTask, recoverOrphanedTasks, cleanupOldTasks, cmsTaskQueueLogger, } from './task-queue.js';
+import { getBranchMetadataFileManager, BranchMetadataFileManager } from '../branch-metadata.js';
+import { extractIdFromFilename } from '../content-id-index.js';
+import { ROOT_COLLECTION_ID } from '../paths/types.js';
+import { isFileExistsError } from '../utils/error.js';
 const DEFAULT_TASK_TIMEOUT = 60_000;
 const DEFAULT_MAX_RETRIES = 3;
 // Payload validation helpers — fail fast with clear errors instead of silent `as` casts

package/dist/worker/task-queue-config.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { DEFAULT_PROD_WORKSPACE } from '../config';
+import { DEFAULT_PROD_WORKSPACE } from '../config/index.js';
 /**
  * Get the task queue directory for async worker operations.
  *

package/dist/worker/task-queue.js

@@ -2,7 +2,7 @@
  * CanopyCMS task queue — re-exports from the generic task-queue module
  * with CMS-specific action types and a WorkerTask alias.
  */
-import { createDebugLogger } from '../utils/debug';
+import { createDebugLogger } from '../utils/debug.js';
 // ============================================================================
 // Shared logger instance for CMS task queue operations
 // ============================================================================
@@ -16,5 +16,5 @@ export const cmsTaskQueueLogger = {
 // Re-exports from generic task-queue module
 // ============================================================================
 export { enqueueTask, dequeueTask, completeTask, failTask, retryTask, recoverOrphanedTasks, cleanupOldTasks, getTask, getTask as getTaskResult, // backward-compatible alias
-listTasks, getQueueStats, } from '../task-queue';
+listTasks, getQueueStats, } from '../task-queue/index.js';
 //# sourceMappingURL=task-queue.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {