canopycms 0.0.17 → 0.0.18

package/dist/url-path-resolver.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Resolves a URL path to candidate entryPath/slug pairs for content lookup.
+ *
+ * Returns an ordered list of attempts:
+ * 1. Direct entry: last segment is slug, rest is collection path
+ * 2. Index fallback: full path is collection, slug is 'index'
+ *
+ * @param urlPath - URL path like '/docs/guides/getting-started' or 'docs/guides'
+ * @param contentRoot - Content root directory name (default: 'content')
+ * @returns Array of { entryPath, slug } candidates to try in order
+ */
+export declare function resolveUrlPathCandidates(urlPath: string, contentRoot: string): Array<{
+    entryPath: string;
+    slug: string;
+}>;
+//# sourceMappingURL=url-path-resolver.d.ts.map

package/dist/url-path-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-path-resolver.d.ts","sourceRoot":"","sources":["../src/url-path-resolver.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB5C"}

package/dist/url-path-resolver.js

@@ -0,0 +1,31 @@
+import { trimSlashes } from './paths/normalize.js';
+/**
+ * Resolves a URL path to candidate entryPath/slug pairs for content lookup.
+ *
+ * Returns an ordered list of attempts:
+ * 1. Direct entry: last segment is slug, rest is collection path
+ * 2. Index fallback: full path is collection, slug is 'index'
+ *
+ * @param urlPath - URL path like '/docs/guides/getting-started' or 'docs/guides'
+ * @param contentRoot - Content root directory name (default: 'content')
+ * @returns Array of { entryPath, slug } candidates to try in order
+ */
+export function resolveUrlPathCandidates(urlPath, contentRoot) {
+    const normalized = trimSlashes(urlPath);
+    const segments = normalized.split('/').filter(Boolean);
+    if (segments.length === 0)
+        return [];
+    const candidates = [];
+    // Try 1: last segment is the entry slug, rest is the collection path
+    const slug = segments[segments.length - 1];
+    const collectionSegments = segments.slice(0, -1);
+    const entryPath = collectionSegments.length > 0 ? `${contentRoot}/${collectionSegments.join('/')}` : contentRoot;
+    candidates.push({ entryPath, slug });
+    // Try 2: full path is a collection with an index entry
+    candidates.push({
+        entryPath: `${contentRoot}/${segments.join('/')}`,
+        slug: 'index',
+    });
+    return candidates;
+}
+//# sourceMappingURL=url-path-resolver.js.map

package/dist/url-path-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-path-resolver.js","sourceRoot":"","sources":["../src/url-path-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAe,EACf,WAAmB;IAEnB,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAEpC,MAAM,UAAU,GAA+C,EAAE,CAAA;IAEjE,qEAAqE;IACrE,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1C,MAAM,kBAAkB,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAChD,MAAM,SAAS,GACb,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAA;IAEhG,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEpC,uDAAuD;IACvD,UAAU,CAAC,IAAI,CAAC;QACd,SAAS,EAAE,GAAG,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACjD,IAAI,EAAE,OAAO;KACd,CAAC,CAAA;IAEF,OAAO,UAAU,CAAA;AACnB,CAAC"}

package/dist/utils/body-field.d.ts

@@ -0,0 +1,18 @@
+import type { FieldConfig } from '../config';
+/**
+ * Count the number of top-level fields marked `isBody: true` in a schema.
+ * Does NOT recurse into objects — isBody only makes sense at the top level
+ * because it maps to the file's markdown content.
+ */
+export declare function countBodyFields(fields: readonly FieldConfig[]): number;
+/**
+ * Find the name of the field marked `isBody: true`, or `'body'` as the default.
+ * Used at read time to map the markdown file's content to the correct data field.
+ */
+export declare function findBodyFieldName(fields: readonly FieldConfig[]): string;
+/**
+ * Find isBody fields that have an invalid type (not 'markdown' or 'mdx').
+ * Returns field names that fail validation.
+ */
+export declare function findInvalidBodyFields(fields: readonly FieldConfig[]): string[];
+//# sourceMappingURL=body-field.d.ts.map

package/dist/utils/body-field.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-field.d.ts","sourceRoot":"","sources":["../../src/utils/body-field.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AAI5C;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAMtE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAKxE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,EAAE,CAQ9E"}

package/dist/utils/body-field.js

@@ -0,0 +1,39 @@
+const BODY_FIELD_TYPES = new Set(['markdown', 'mdx']);
+/**
+ * Count the number of top-level fields marked `isBody: true` in a schema.
+ * Does NOT recurse into objects — isBody only makes sense at the top level
+ * because it maps to the file's markdown content.
+ */
+export function countBodyFields(fields) {
+    let count = 0;
+    for (const field of fields) {
+        if ('isBody' in field && field.isBody)
+            count++;
+    }
+    return count;
+}
+/**
+ * Find the name of the field marked `isBody: true`, or `'body'` as the default.
+ * Used at read time to map the markdown file's content to the correct data field.
+ */
+export function findBodyFieldName(fields) {
+    for (const field of fields) {
+        if ('isBody' in field && field.isBody)
+            return field.name;
+    }
+    return 'body';
+}
+/**
+ * Find isBody fields that have an invalid type (not 'markdown' or 'mdx').
+ * Returns field names that fail validation.
+ */
+export function findInvalidBodyFields(fields) {
+    const invalid = [];
+    for (const field of fields) {
+        if ('isBody' in field && field.isBody && !BODY_FIELD_TYPES.has(field.type)) {
+            invalid.push(field.name);
+        }
+    }
+    return invalid;
+}
+//# sourceMappingURL=body-field.js.map

package/dist/utils/body-field.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-field.js","sourceRoot":"","sources":["../../src/utils/body-field.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;AAErD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA8B;IAC5D,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,EAAE,CAAA;IAChD,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IAC1D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA8B;IAClE,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/utils/sanitize-href.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Sanitize an untrusted URL for use in `href` attributes.
+ *
+ * Parses the input with `new URL()` and only allows `http:` and `https:` protocols,
+ * blocking `javascript:`, `data:`, `vbscript:`, and other dangerous schemes.
+ * Returns the fallback (default `'#'`) for invalid or disallowed URLs.
+ *
+ * This utility breaks CodeQL's taint chain by constructing a new string from
+ * the parsed URL rather than passing the original input through.
+ *
+ * @example
+ * ```tsx
+ * import { sanitizeHref } from 'canopycms'
+ *
+ * <a href={sanitizeHref(cta.link)}>{cta.text}</a>
+ * ```
+ */
+export declare function sanitizeHref(url: string, fallback?: string): string;
+//# sourceMappingURL=sanitize-href.d.ts.map

package/dist/utils/sanitize-href.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-href.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAUhE"}

package/dist/utils/sanitize-href.js

@@ -0,0 +1,30 @@
+/**
+ * Sanitize an untrusted URL for use in `href` attributes.
+ *
+ * Parses the input with `new URL()` and only allows `http:` and `https:` protocols,
+ * blocking `javascript:`, `data:`, `vbscript:`, and other dangerous schemes.
+ * Returns the fallback (default `'#'`) for invalid or disallowed URLs.
+ *
+ * This utility breaks CodeQL's taint chain by constructing a new string from
+ * the parsed URL rather than passing the original input through.
+ *
+ * @example
+ * ```tsx
+ * import { sanitizeHref } from 'canopycms'
+ *
+ * <a href={sanitizeHref(cta.link)}>{cta.text}</a>
+ * ```
+ */
+export function sanitizeHref(url, fallback = '#') {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
+            return parsed.href;
+        }
+    }
+    catch {
+        // invalid URL
+    }
+    return fallback;
+}
+//# sourceMappingURL=sanitize-href.js.map

package/dist/utils/sanitize-href.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-href.js","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAQ,GAAG,GAAG;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.17",
+  "version": "0.0.18",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {