canopycms 0.0.52 → 0.0.54

package/dist/api/reference-options.js

@@ -69,13 +69,16 @@ const getReferenceOptionsHandler = async (gc, ctx, req, _params) => {
     // Load reference options
     const resolver = new ReferenceResolver(store, idIndex);
     const allOptions = await resolver.loadReferenceOptions(collections, displayField, search, entryTypes);
-    // Filter by path-level read permissions
+    // Filter by path-level read permissions. Build the access checker once so
+    // permissions are loaded a single time and reused for every option, instead of
+    // re-loading per option inside the loop.
+    const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
     const options = [];
     for (const option of allOptions) {
         const location = idIndex.findById(option.id);
         if (!location)
             continue;
-        const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, location.relativePath, req.user, 'read');
+        const access = checkAccess(location.relativePath, 'read');
         if (!access.allowed)
             continue;
         options.push(option);

package/dist/api/reference-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"reference-options.js","sourceRoot":"","sources":["../../src/api/reference-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAW/C,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAA;AAEF,MAAM,0BAA0B,GAAG,KAAK,EACtC,EAA8C,EAC9C,GAAe,EACf,GAAe,EACf,OAAwD,EACrB,EAAE;IACrC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAA;IAE5B,qFAAqF;IACrF,MAAM,WAAW,GAAG,CAAC;SAClB,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE;QACrD,OAAO,EAAE,4EAA4E;KACtF,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,0BAA0B;SAC1E,CAAA;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAA;IACrD,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAA;IACnD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAA;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAA;IAEtC,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAA;IAC3C,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAEpE,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;IAErC,mDAAmD;IACnD,IAAI,WAAsC,CAAA;IAC1C,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,gBAAgB;aACpC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,WAAW,GAAG,EAAE,CAAA;QAChB,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,4BAA4B,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE;iBAC3D,CAAA;YACH,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,eAAe;QAChC,CAAC,CAAC,eAAe;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,SAAS,CAAA;IAEb,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CACpD,WAAW,EACX,YAAY,EACZ,MAAM,EACN,UAAU,CACX,CAAA;IAED,wCAAwC;IACxC,MAAM,OAAO,GAAG,EAAE,CAAA;IAClB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAe,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAClD,aAAa,EACb,aAAa,CAAC,UAAU,EACxB,QAAQ,CAAC,YAAY,EACrB,GAAG,CAAC,IAAI,EACR,MAAM,CACP,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAQ;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,OAAO,EAAE;KAClB,CAAA;AACH,CAAC,CAAA;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,cAAc,CAAC;IACzC,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,qBAAqB;IAC3B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,4BAA4B;IAClC,MAAM,EAAE,+BAA+B;IACvC,YAAY,EAAE,0BAA0B;IACxC,QAAQ,EAAE,EAA8B;IACxC,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAChC,MAAM,EAAE,CAAC,wBAAwB,CAAU;IAC3C,OAAO,EAAE,0BAA0B;CACpC,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,GAAG,EAAE,mBAAmB;CAChB,CAAA"}
+{"version":3,"file":"reference-options.js","sourceRoot":"","sources":["../../src/api/reference-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAW/C,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAA;AAEF,MAAM,0BAA0B,GAAG,KAAK,EACtC,EAA8C,EAC9C,GAAe,EACf,GAAe,EACf,OAAwD,EACrB,EAAE;IACrC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAA;IAE5B,qFAAqF;IACrF,MAAM,WAAW,GAAG,CAAC;SAClB,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE;QACrD,OAAO,EAAE,4EAA4E;KACtF,CAAC,CAAA;IACJ,MAAM,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,0BAA0B;SAC1E,CAAA;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAA;IACrD,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAA;IACnD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAA;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAA;IAEtC,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAA;IAC3C,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAEpE,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;IAErC,mDAAmD;IACnD,IAAI,WAAsC,CAAA;IAC1C,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,cAAc,GAAG,gBAAgB;aACpC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAA;QAClB,WAAW,GAAG,EAAE,CAAA;QAChB,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,4BAA4B,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE;iBAC3D,CAAA;YACH,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,eAAe;QAChC,CAAC,CAAC,eAAe;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,SAAS,CAAA;IAEb,yBAAyB;IACzB,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CACpD,WAAW,EACX,YAAY,EACZ,MAAM,EACN,UAAU,CACX,CAAA;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,yCAAyC;IACzC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,0BAA0B,CAC/D,aAAa,EACb,aAAa,CAAC,UAAU,EACxB,GAAG,CAAC,IAAI,CACT,CAAA;IACD,MAAM,OAAO,GAAG,EAAE,CAAA;IAClB,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAe,CAAC,CAAA;QACzD,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAQ;QAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,OAAO,EAAE;KAClB,CAAA;AACH,CAAC,CAAA;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,cAAc,CAAC;IACzC,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,qBAAqB;IAC3B,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,4BAA4B;IAClC,MAAM,EAAE,+BAA+B;IACvC,YAAY,EAAE,0BAA0B;IACxC,QAAQ,EAAE,EAA8B;IACxC,eAAe,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IAChC,MAAM,EAAE,CAAC,wBAAwB,CAAU;IAC3C,OAAO,EAAE,0BAA0B;CACpC,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,GAAG,EAAE,mBAAmB;CAChB,CAAA"}

package/dist/api/resolve-references.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-references.d.ts","sourceRoot":"","sources":["../../src/api/resolve-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAA0B,WAAW,EAAE,MAAM,SAAS,CAAA;AAOlE,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,EAAE,CAAA;CACd;AAED,4CAA4C;AAC5C,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,CAAC,CAAA;AAgGF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;CAE5B,CAAA"}
+{"version":3,"file":"resolve-references.d.ts","sourceRoot":"","sources":["../../src/api/resolve-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAA0B,WAAW,EAAE,MAAM,SAAS,CAAA;AAOlE,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,EAAE,CAAA;CACd;AAED,4CAA4C;AAC5C,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC,CAAC,CAAA;AAoGF;;GAEG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;CAE5B,CAAA"}

package/dist/api/resolve-references.js

@@ -21,6 +21,11 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
     const idIndex = await store.idIndex();
     // Resolve each ID to full document
     const resolver = new ReferenceResolver(store, idIndex);
+    // Build the access checker once: permissions are loaded a single time and reused
+    // for every id, instead of re-loading per id inside the loop. A failure here
+    // (e.g. settings workspace unavailable) surfaces as a handler error rather than
+    // being silently swallowed per id.
+    const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
     const resolved = {};
     for (const id of ids) {
         try {
@@ -28,7 +33,7 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
             if (result && result.exists && result.collection && result.slug) {
                 // Check path-level read permission before returning content
                 const resolvedPath = await store.resolveDocumentPath(result.collection, result.slug);
-                const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, resolvedPath.relativePath, req.user, 'read');
+                const access = checkAccess(resolvedPath.relativePath, 'read');
                 if (!access.allowed)
                     continue;
                 const doc = await store.read(result.collection, result.slug);

package/dist/api/resolve-references.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-references.js","sourceRoot":"","sources":["../../src/api/resolve-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAWhE,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAA;AAEF,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,KAAK,EACpC,EAA8C,EAC9C,GAAe,EACf,GAAe,EACf,MAAqD,EACrD,IAAiD,EACb,EAAE;IACtC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAA;IAE5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAEpB,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAA;IAC3C,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAEpE,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;IAErC,mCAAmC;IACnC,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAEtD,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAE5C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACzC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChE,4DAA4D;gBAC5D,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;gBACpF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAClD,aAAa,EACb,aAAa,CAAC,UAAU,EACxB,YAAY,CAAC,YAAY,EACzB,GAAG,CAAC,IAAI,EACR,MAAM,CACP,CAAA;gBACD,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,SAAQ;gBAE7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC5D,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACpB,QAAQ,CAAC,EAAE,CAAC,GAAG;wBACb,EAAE;wBACF,GAAG,GAAG,CAAC,IAAI;qBACZ,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sDAAsD;YACtD,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE;KACnB,CAAA;AACH,CAAC,CAAA;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,cAAc,CAAC;IACvC,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,6BAA6B;IACnC,MAAM,EAAE,6BAA6B;IACrC,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,uBAAuB;IACjC,YAAY,EAAE,2BAA2B;IACzC,QAAQ,EAAE,EAA+B;IACzC,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACjC,MAAM,EAAE,CAAC,wBAAwB,CAAU;IAC3C,OAAO,EAAE,wBAAwB;CAClC,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,IAAI,EAAE,iBAAiB;CACf,CAAA"}
+{"version":3,"file":"resolve-references.js","sourceRoot":"","sources":["../../src/api/resolve-references.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAWhE,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,MAAM,EAAE,gBAAgB;CACzB,CAAC,CAAA;AAEF,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACrC,CAAC,CAAA;AAEF,MAAM,wBAAwB,GAAG,KAAK,EACpC,EAA8C,EAC9C,GAAe,EACf,GAAe,EACf,MAAqD,EACrD,IAAiD,EACb,EAAE;IACtC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,CAAA;IAE5B,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;IAEpB,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAA;IAC3C,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAEpE,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;IAErC,mCAAmC;IACnC,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAEtD,iFAAiF;IACjF,6EAA6E;IAC7E,gFAAgF;IAChF,mCAAmC;IACnC,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,0BAA0B,CAC/D,aAAa,EACb,aAAa,CAAC,UAAU,EACxB,GAAG,CAAC,IAAI,CACT,CAAA;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAE5C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YACzC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChE,4DAA4D;gBAC5D,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;gBACpF,MAAM,MAAM,GAAG,WAAW,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;gBAC7D,IAAI,CAAC,MAAM,CAAC,OAAO;oBAAE,SAAQ;gBAE7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC5D,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACpB,QAAQ,CAAC,EAAE,CAAC,GAAG;wBACb,EAAE;wBACF,GAAG,GAAG,CAAC,IAAI;qBACZ,CAAA;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sDAAsD;YACtD,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,QAAQ,EAAE;KACnB,CAAA;AACH,CAAC,CAAA;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,cAAc,CAAC;IACvC,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,mBAAmB;IACzB,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,6BAA6B;IACnC,MAAM,EAAE,6BAA6B;IACrC,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,uBAAuB;IACjC,YAAY,EAAE,2BAA2B;IACzC,QAAQ,EAAE,EAA+B;IACzC,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACjC,MAAM,EAAE,CAAC,wBAAwB,CAAU;IAC3C,OAAO,EAAE,wBAAwB;CAClC,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,IAAI,EAAE,iBAAiB;CACf,CAAA"}

package/dist/authorization/content.d.ts

@@ -19,6 +19,28 @@ import type { PermissionLevel } from '../config';
 import type { CanopyUser } from '../user';
 import type { ContentAccessResult, ContentAccessDeps } from './types';
 import type { PhysicalPath } from '../paths/types';
+/**
+ * A bound content-access checker: evaluates a single path/level synchronously
+ * against permissions that were already loaded when the checker was created.
+ */
+export type ContentAccessChecker = (relativePath: PhysicalPath, level: PermissionLevel) => ContentAccessResult;
+/**
+ * Create a content-access checker that resolves the request-constant work once
+ * (branch access, the settings/permissions root, and the path-permission rules)
+ * and returns a synchronous per-path checker.
+ *
+ * Branch access, the resolved permissions root, and the loaded rules are identical
+ * for a fixed `(context, branchRoot, user)`, so hoisting them out of the per-path
+ * check avoids re-reading the permissions file (and, in modes with a separate
+ * settings branch, re-ensuring the settings workspace) for every entry. This is
+ * the batch primitive used by listing endpoints that check many paths per request.
+ *
+ * @param deps - Dependencies including branch access checker and path permissions loader
+ * @param context - Branch context containing branch metadata
+ * @param branchRoot - Root directory of the branch
+ * @param user - User to check access for
+ */
+export declare function createContentAccessChecker(deps: ContentAccessDeps, context: BranchContext, branchRoot: string, user: CanopyUser): Promise<ContentAccessChecker>;
 /**
  * Check content access by evaluating both branch and path permissions.
  * Path permissions are loaded dynamically from the branch root.

package/dist/authorization/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/authorization/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAmC9B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,IAE5D,SAAS,aAAa,EACtB,YAAY,MAAM,EAClB,cAAc,YAAY,EAC1B,MAAM,UAAU,EAChB,OAAO,eAAe,KACrB,OAAO,CAAC,mBAAmB,CAAC,CAEhC"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/authorization/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAElD;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,YAAY,EAAE,YAAY,EAC1B,KAAK,EAAE,eAAe,KACnB,mBAAmB,CAAA;AAExB;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,oBAAoB,CAAC,CAqC/B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,YAAY,EAC1B,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,mBAAmB,CAAC,CAG9B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,iBAAiB,IAE5D,SAAS,aAAa,EACtB,YAAY,MAAM,EAClB,cAAc,YAAY,EAC1B,MAAM,UAAU,EAChB,OAAO,eAAe,KACrB,OAAO,CAAC,mBAAmB,CAAC,CAEhC"}

package/dist/authorization/content.js

@@ -17,17 +17,22 @@
 import { operatingStrategy } from '../operating-mode/index.js';
 import { createCheckPathAccess } from './path.js';
 /**
- * Check content access by evaluating both branch and path permissions.
- * Path permissions are loaded dynamically from the branch root.
+ * Create a content-access checker that resolves the request-constant work once
+ * (branch access, the settings/permissions root, and the path-permission rules)
+ * and returns a synchronous per-path checker.
+ *
+ * Branch access, the resolved permissions root, and the loaded rules are identical
+ * for a fixed `(context, branchRoot, user)`, so hoisting them out of the per-path
+ * check avoids re-reading the permissions file (and, in modes with a separate
+ * settings branch, re-ensuring the settings workspace) for every entry. This is
+ * the batch primitive used by listing endpoints that check many paths per request.
  *
  * @param deps - Dependencies including branch access checker and path permissions loader
  * @param context - Branch context containing branch metadata
  * @param branchRoot - Root directory of the branch
- * @param relativePath - Physical path relative to branch root (with embedded IDs)
  * @param user - User to check access for
- * @param level - Permission level to check ('read', 'edit', or 'review')
  */
-export async function checkContentAccess(deps, context, branchRoot, relativePath, user, level) {
+export async function createContentAccessChecker(deps, context, branchRoot, user) {
     const branch = deps.checkBranchAccess(context, user);
     // Load permissions from appropriate location based on operating mode
     // Modes with separate settings branch: load from settings branch
@@ -45,17 +50,34 @@ export async function checkContentAccess(deps, context, branchRoot, relativePath
     }
     const rules = await deps.loadPathPermissions(permissionsRoot, deps.mode);
     const pathChecker = createCheckPathAccess(rules, deps.defaultPathAccess);
-    const path = pathChecker({
-        relativePath,
-        user,
-        level,
-    });
-    return {
-        allowed: branch.allowed && path.allowed,
-        branch,
-        path,
+    return (relativePath, level) => {
+        const path = pathChecker({
+            relativePath,
+            user,
+            level,
+        });
+        return {
+            allowed: branch.allowed && path.allowed,
+            branch,
+            path,
+        };
     };
 }
+/**
+ * Check content access by evaluating both branch and path permissions.
+ * Path permissions are loaded dynamically from the branch root.
+ *
+ * @param deps - Dependencies including branch access checker and path permissions loader
+ * @param context - Branch context containing branch metadata
+ * @param branchRoot - Root directory of the branch
+ * @param relativePath - Physical path relative to branch root (with embedded IDs)
+ * @param user - User to check access for
+ * @param level - Permission level to check ('read', 'edit', or 'review')
+ */
+export async function checkContentAccess(deps, context, branchRoot, relativePath, user, level) {
+    const check = await createContentAccessChecker(deps, context, branchRoot, user);
+    return check(relativePath, level);
+}
 /**
  * Create a content access checker with bound dependencies.
  */

package/dist/authorization/content.js.map

@@ -1 +1 @@
-{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/authorization/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAI9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,OAAsB,EACtB,UAAkB,EAClB,YAA0B,EAC1B,IAAgB,EAChB,KAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAEpD,qEAAqE;IACrE,iEAAiE;IACjE,4CAA4C;IAC5C,IAAI,eAAe,GAAG,UAAU,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAExC,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,iFAAiF;QACjF,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACxE,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAExE,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,YAAY;QACZ,IAAI;QACJ,KAAK;KACN,CAAC,CAAA;IAEF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;QACvC,MAAM;QACN,IAAI;KACL,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,OAAO,CACL,OAAsB,EACtB,UAAkB,EAClB,YAA0B,EAC1B,IAAgB,EAChB,KAAsB,EACQ,EAAE,CAChC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC"}
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/authorization/content.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAa9C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAuB,EACvB,OAAsB,EACtB,UAAkB,EAClB,IAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAEpD,qEAAqE;IACrE,iEAAiE;IACjE,4CAA4C;IAC5C,IAAI,eAAe,GAAG,UAAU,CAAA;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAExC,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,iFAAiF;QACjF,eAAe,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;IACtD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACxE,MAAM,WAAW,GAAG,qBAAqB,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAExE,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,WAAW,CAAC;YACvB,YAAY;YACZ,IAAI;YACJ,KAAK;SACN,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YACvC,MAAM;YACN,IAAI;SACL,CAAA;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,OAAsB,EACtB,UAAkB,EAClB,YAA0B,EAC1B,IAAgB,EAChB,KAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;IAC/E,OAAO,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAuB;IAC9D,OAAO,CACL,OAAsB,EACtB,UAAkB,EAClB,YAA0B,EAC1B,IAAgB,EAChB,KAAsB,EACQ,EAAE,CAChC,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/authorization/index.d.ts

@@ -27,7 +27,7 @@
  */
 export type { BranchAccessResult, PathPermissionResult, ContentAccessResult, ContentAccessDeps, PermissionPath, } from './types';
 export { parsePermissionPath } from './validation';
-export { checkContentAccess, createCheckContentAccess } from './content';
+export { checkContentAccess, createCheckContentAccess, createContentAccessChecker, type ContentAccessChecker, } from './content';
 export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch';
 export { checkPathAccess, createCheckPathAccess } from './path';
 export { RESERVED_GROUPS, type ReservedGroupId, isReservedGroup, isAdmin, isReviewer, isPrivileged, } from './helpers';

package/dist/authorization/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAGxE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAG/D,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,YAAY,EACV,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GACf,MAAM,SAAS,CAAA;AAGhB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAG/D,OAAO,EACL,eAAe,EACf,KAAK,eAAe,EACpB,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,KAAK,eAAe,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAGtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}

package/dist/authorization/index.js

@@ -28,7 +28,7 @@
 // Validation
 export { parsePermissionPath } from './validation.js';
 // Main content access (recommended for most cases)
-export { checkContentAccess, createCheckContentAccess } from './content.js';
+export { checkContentAccess, createCheckContentAccess, createContentAccessChecker, } from './content.js';
 // Branch-level access
 export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch.js';
 // Path-level access

package/dist/authorization/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAExE,sBAAsB;AACtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAEjB,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAE/D,mBAAmB;AACnB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAElB,4BAA4B;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EAGvB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAWH,aAAa;AACb,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAElD,mDAAmD;AACnD,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,WAAW,CAAA;AAElB,sBAAsB;AACtB,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,UAAU,CAAA;AAEjB,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAA;AAE/D,mBAAmB;AACnB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,WAAW,CAAA;AAElB,4BAA4B;AAC5B,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EAGvB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,UAAU,CAAA"}

package/dist/authorization/test-utils.d.ts

@@ -8,7 +8,19 @@
  * // In test files only:
  * import { unsafeAsPermissionPath } from '../authorization/test-utils'
  */
-import type { PermissionPath } from './types';
+import type { PermissionPath, ContentAccessDeps } from './types';
+import type { BranchContext } from '../types';
+import type { CanopyUser } from '../user';
+import { createCheckContentAccess, type ContentAccessChecker } from './content';
 /** Test-only: cast a string to PermissionPath without validation. */
 export declare const unsafeAsPermissionPath: (path: string) => PermissionPath;
+/**
+ * Test-only: build the single-call `checkContentAccess` and the batch
+ * `createContentAccessChecker` from one shared deps object, so tests can wire both
+ * into mock services without duplicating deps. Mirrors how `services.ts` binds them.
+ */
+export declare const createTestContentAccess: (deps: ContentAccessDeps) => {
+    checkContentAccess: ReturnType<typeof createCheckContentAccess>;
+    createContentAccessChecker: (context: BranchContext, branchRoot: string, user: CanopyUser) => Promise<ContentAccessChecker>;
+};
 //# sourceMappingURL=test-utils.d.ts.map

package/dist/authorization/test-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"test-utils.d.ts","sourceRoot":"","sources":["../../src/authorization/test-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,KAAG,cAAwC,CAAA"}
+{"version":3,"file":"test-utils.d.ts","sourceRoot":"","sources":["../../src/authorization/test-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzC,OAAO,EACL,wBAAwB,EAExB,KAAK,oBAAoB,EAC1B,MAAM,WAAW,CAAA;AAElB,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,KAAG,cAAwC,CAAA;AAE9F;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAClC,MAAM,iBAAiB,KACtB;IACD,kBAAkB,EAAE,UAAU,CAAC,OAAO,wBAAwB,CAAC,CAAA;IAC/D,0BAA0B,EAAE,CAC1B,OAAO,EAAE,aAAa,EACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,UAAU,KACb,OAAO,CAAC,oBAAoB,CAAC,CAAA;CAKlC,CAAA"}

package/dist/authorization/test-utils.js

@@ -8,6 +8,16 @@
  * // In test files only:
  * import { unsafeAsPermissionPath } from '../authorization/test-utils.js'
  */
+import { createCheckContentAccess, createContentAccessChecker, } from './content.js';
 /** Test-only: cast a string to PermissionPath without validation. */
 export const unsafeAsPermissionPath = (path) => path;
+/**
+ * Test-only: build the single-call `checkContentAccess` and the batch
+ * `createContentAccessChecker` from one shared deps object, so tests can wire both
+ * into mock services without duplicating deps. Mirrors how `services.ts` binds them.
+ */
+export const createTestContentAccess = (deps) => ({
+    checkContentAccess: createCheckContentAccess(deps),
+    createContentAccessChecker: (context, branchRoot, user) => createContentAccessChecker(deps, context, branchRoot, user),
+});
 //# sourceMappingURL=test-utils.js.map

package/dist/authorization/test-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-utils.js","sourceRoot":"","sources":["../../src/authorization/test-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAkB,EAAE,CAAC,IAAsB,CAAA"}
+{"version":3,"file":"test-utils.js","sourceRoot":"","sources":["../../src/authorization/test-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EACL,wBAAwB,EACxB,0BAA0B,GAE3B,MAAM,WAAW,CAAA;AAElB,qEAAqE;AACrE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAkB,EAAE,CAAC,IAAsB,CAAA;AAE9F;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,IAAuB,EAQvB,EAAE,CAAC,CAAC;IACJ,kBAAkB,EAAE,wBAAwB,CAAC,IAAI,CAAC;IAClD,0BAA0B,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CACxD,0BAA0B,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC;CAC9D,CAAC,CAAA"}