canopycms 0.0.61-int.75 → 0.0.62

package/dist/operating-mode/deployment-name.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Single resolution point for `deploymentName`.
+ *
+ * `deploymentName` namespaces the settings branch
+ * (`canopycms-settings-{deploymentName}`) so two CanopyCMS deployments can
+ * share one GitHub repo without both resolving to `canopycms-settings-prod`
+ * and fighting over the same orphan branch.
+ *
+ * Precedence (highest wins):
+ *   1. `process.env.CANOPYCMS_DEPLOYMENT_NAME` (trimmed; empty string ignored)
+ *   2. `config.deploymentName`
+ *   3. `modeDefault` (the caller's mode-specific fallback, e.g. 'prod'/'local')
+ *
+ * Env wins over config DELIBERATELY. The env var is stamped per-stack by
+ * infrastructure (CDK's `CanopyCmsServiceProps.deploymentName` ->
+ * `CANOPYCMS_DEPLOYMENT_NAME`), so it is the value GUARANTEED TO DIFFER
+ * between two deployments sharing a repo. `config.deploymentName` lives in
+ * the shared repo's `canopycms.config.ts`, so it is the value GUARANTEED TO
+ * BE IDENTICAL across both deployments (both Lambdas run the same checked-out
+ * config). If config won instead, an adopter who already wrote
+ * `deploymentName` into their shared config would find the CDK
+ * `deploymentName` prop silently doing nothing — exactly the two-stacks-one-repo
+ * case this feature exists to fix.
+ */
+/**
+ * Exported so `canopycms-cdk`'s suite can assert that its own synth-time copy
+ * of this rule (constructs/cms-service.ts) still agrees with this one. The
+ * construct itself must NOT import this: `canopycms-cdk` publishes without a
+ * runtime dependency on `canopycms`, so a source-level import would break the
+ * published construct. The drift check is therefore test-only — see
+ * `deployment-name-fixtures.ts`.
+ */
+export declare const isValidDeploymentName: (name: string) => boolean;
+export declare function resolveDeploymentName(config: {
+    deploymentName?: string;
+}, modeDefault: string): string;
+//# sourceMappingURL=deployment-name.d.ts.map

package/dist/operating-mode/deployment-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-name.d.ts","sourceRoot":"","sources":["../../src/operating-mode/deployment-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAsBH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,OAI5B,CAAA;AAEzB,wBAAgB,qBAAqB,CACnC,MAAM,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EACnC,WAAW,EAAE,MAAM,GAClB,MAAM,CAqCR"}

package/dist/operating-mode/deployment-name.js

@@ -0,0 +1,86 @@
+/**
+ * Single resolution point for `deploymentName`.
+ *
+ * `deploymentName` namespaces the settings branch
+ * (`canopycms-settings-{deploymentName}`) so two CanopyCMS deployments can
+ * share one GitHub repo without both resolving to `canopycms-settings-prod`
+ * and fighting over the same orphan branch.
+ *
+ * Precedence (highest wins):
+ *   1. `process.env.CANOPYCMS_DEPLOYMENT_NAME` (trimmed; empty string ignored)
+ *   2. `config.deploymentName`
+ *   3. `modeDefault` (the caller's mode-specific fallback, e.g. 'prod'/'local')
+ *
+ * Env wins over config DELIBERATELY. The env var is stamped per-stack by
+ * infrastructure (CDK's `CanopyCmsServiceProps.deploymentName` ->
+ * `CANOPYCMS_DEPLOYMENT_NAME`), so it is the value GUARANTEED TO DIFFER
+ * between two deployments sharing a repo. `config.deploymentName` lives in
+ * the shared repo's `canopycms.config.ts`, so it is the value GUARANTEED TO
+ * BE IDENTICAL across both deployments (both Lambdas run the same checked-out
+ * config). If config won instead, an adopter who already wrote
+ * `deploymentName` into their shared config would find the CDK
+ * `deploymentName` prop silently doing nothing — exactly the two-stacks-one-repo
+ * case this feature exists to fix.
+ */
+import { canopyLogWarn } from '../utils/logger.js';
+let warned = false;
+/**
+ * Conservative charset for a deployment name. The resolved value is
+ * interpolated straight into a git ref (`canopycms-settings-{name}`), and the
+ * env var route bypasses the config schema entirely — nothing else validates
+ * an infra-stamped value before it becomes a branch name. Rejecting anything
+ * outside this set keeps the result a single, well-formed ref component:
+ * no `/` (would add a ref hierarchy level and break sanitizeBranchName
+ * round-trips), no whitespace, no `..`/`~`/`^`/`:` (git-forbidden), no
+ * leading `-` (would parse as a git option).
+ *
+ * The charset alone is not sufficient: `..`, a trailing `.`, and a `.lock`
+ * suffix are all built from allowed characters but are still rejected by
+ * git's own ref rules (git-check-ref-format), so they are excluded separately.
+ */
+const VALID_DEPLOYMENT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+/**
+ * Exported so `canopycms-cdk`'s suite can assert that its own synth-time copy
+ * of this rule (constructs/cms-service.ts) still agrees with this one. The
+ * construct itself must NOT import this: `canopycms-cdk` publishes without a
+ * runtime dependency on `canopycms`, so a source-level import would break the
+ * published construct. The drift check is therefore test-only — see
+ * `deployment-name-fixtures.ts`.
+ */
+export const isValidDeploymentName = (name) => VALID_DEPLOYMENT_NAME.test(name) &&
+    !name.includes('..') &&
+    !name.endsWith('.') &&
+    !name.endsWith('.lock');
+export function resolveDeploymentName(config, modeDefault) {
+    const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
+    const configValue = config.deploymentName;
+    if (envValue && configValue && envValue !== configValue && !warned) {
+        // canopyLogWarn, not console.warn: cms-worker.ts imports this module and
+        // resolves through it inside start(), so this line lands in worker.log,
+        // where an unprefixed line is folded into the previous CloudWatch event.
+        // The mismatch this reports is exactly what an operator would be grepping
+        // for. Plain console under Lambda/dev, as everywhere else. See
+        // utils/logger.ts. (Missed by the worker-log sweep, which went by directory
+        // name and by the modules the finding named, rather than by the worker's
+        // real import graph.)
+        canopyLogWarn(`CanopyCMS: CANOPYCMS_DEPLOYMENT_NAME ("${envValue}") differs from config.deploymentName ` +
+            `("${configValue}") — using the env var (infra-stamped env wins over shared-repo config ` +
+            `by design; see resolveDeploymentName's doc comment). Update config.deploymentName to ` +
+            `match if this mismatch was unintentional.`);
+        warned = true;
+    }
+    const resolved = envValue || configValue || modeDefault;
+    if (!isValidDeploymentName(resolved)) {
+        const source = envValue
+            ? 'CANOPYCMS_DEPLOYMENT_NAME'
+            : configValue
+                ? 'config.deploymentName'
+                : 'the mode default';
+        throw new Error(`CanopyCMS: invalid deploymentName ${JSON.stringify(resolved)} (from ${source}). ` +
+            `It is interpolated into the settings branch name (canopycms-settings-<deploymentName>), ` +
+            `so it must start with a letter or digit, contain only letters, digits, '.', '_' or '-', ` +
+            `and must not contain '..' or end with '.' or '.lock'.`);
+    }
+    return resolved;
+}
+//# sourceMappingURL=deployment-name.js.map

package/dist/operating-mode/deployment-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-name.js","sourceRoot":"","sources":["../../src/operating-mode/deployment-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAE/C,IAAI,MAAM,GAAG,KAAK,CAAA;AAElB;;;;;;;;;;;;;GAaG;AACH,MAAM,qBAAqB,GAAG,8BAA8B,CAAA;AAE5D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAW,EAAE,CAC7D,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;IAChC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IACpB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IACnB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAEzB,MAAM,UAAU,qBAAqB,CACnC,MAAmC,EACnC,WAAmB;IAEnB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE,CAAA;IAC9D,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAA;IAEzC,IAAI,QAAQ,IAAI,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;QACnE,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,0EAA0E;QAC1E,+DAA+D;QAC/D,4EAA4E;QAC5E,yEAAyE;QACzE,sBAAsB;QACtB,aAAa,CACX,0CAA0C,QAAQ,wCAAwC;YACxF,KAAK,WAAW,yEAAyE;YACzF,uFAAuF;YACvF,2CAA2C,CAC9C,CAAA;QACD,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,IAAI,WAAW,IAAI,WAAW,CAAA;IACvD,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,QAAQ;YACrB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,kBAAkB,CAAA;QACxB,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,MAAM,KAAK;YAChF,0FAA0F;YAC1F,0FAA0F;YAC1F,uDAAuD,CAC1D,CAAA;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/operating-mode/index.d.ts

@@ -15,7 +15,10 @@
  * Server code:
  *   import { operatingStrategy } from '@/operating-mode'
  *   const strategy = operatingStrategy(mode)
- *   const contentRoot = strategy.getContentRoot()
+ *   // contentRoot is REQUIRED: pass config.contentRoot (falling back to 'content'
+ *   // at the call site), never a bare call — see getContentRoot's doc comment in
+ *   // types.ts for why a default here would silently disarm a caller.
+ *   const contentRoot = strategy.getContentRoot(config.contentRoot ?? 'content')
  *   const branchesRoot = strategy.getContentBranchesRoot()
  *   const branchRoot = strategy.getContentBranchRoot('my-branch')
  *   const settingsRoot = strategy.getSettingsRoot()
@@ -23,6 +26,8 @@
  */
 export { clientOperatingStrategy, clearClientStrategyCache } from './client-safe-strategy';
 export { operatingStrategy, clearStrategyCache } from './client-unsafe-strategy';
+export { resolveDeploymentName, isValidDeploymentName } from './deployment-name';
+export { resolveOperatingMode, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR } from './mode-env';
 export type OperatingMode = 'prod' | 'dev';
 export type { ClientSafeStrategy, ClientUnsafeStrategy, ResolveRemoteUrlOptions } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/operating-mode/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAG1F,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,CAAA;AAG1C,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAG1F,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAIhF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAIhF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAE5F,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,KAAK,CAAA;AAG1C,YAAY,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,SAAS,CAAA"}

package/dist/operating-mode/index.js

@@ -15,7 +15,10 @@
  * Server code:
  *   import { operatingStrategy } from '@/operating-mode'
  *   const strategy = operatingStrategy(mode)
- *   const contentRoot = strategy.getContentRoot()
+ *   // contentRoot is REQUIRED: pass config.contentRoot (falling back to 'content'
+ *   // at the call site), never a bare call — see getContentRoot's doc comment in
+ *   // types.ts for why a default here would silently disarm a caller.
+ *   const contentRoot = strategy.getContentRoot(config.contentRoot ?? 'content')
  *   const branchesRoot = strategy.getContentBranchesRoot()
  *   const branchRoot = strategy.getContentBranchRoot('my-branch')
  *   const settingsRoot = strategy.getSettingsRoot()
@@ -25,4 +28,10 @@
 export { clientOperatingStrategy, clearClientStrategyCache } from './client-safe-strategy.js';
 // Client-unsafe factory and strategy (server-side only)
 export { operatingStrategy, clearStrategyCache } from './client-unsafe-strategy.js';
+// Single resolution point for deploymentName (env > config > mode default) —
+// server-only (reads process.env), used by the strategies' getSettingsBranchName.
+export { resolveDeploymentName, isValidDeploymentName } from './deployment-name.js';
+// Single resolution point for `mode` (env > config.mode) — isomorphic, applied
+// inside validateCanopyConfig so every config-authoring path gets it.
+export { resolveOperatingMode, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR } from './mode-env.js';
 //# sourceMappingURL=index.js.map

package/dist/operating-mode/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,6DAA6D;AAC7D,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAE1F,wDAAwD;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/operating-mode/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,6DAA6D;AAC7D,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAE1F,wDAAwD;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAEhF,6EAA6E;AAC7E,kFAAkF;AAClF,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEhF,+EAA+E;AAC/E,sEAAsE;AACtE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA"}

package/dist/operating-mode/mode-env.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Single resolution point for the operating `mode`.
+ *
+ * `mode` is required in `canopycms.config.ts` (SEC-C1) and that file lives in
+ * the adopter's repo — the SAME file is loaded by `next dev` locally, by
+ * `next build` inside the image builder, and by the deployed Lambda. Those
+ * three want different answers, so a literal in the config file cannot be
+ * right for all of them:
+ *
+ *   - `next dev` must be `dev` (workspace at `<cwd>/.canopy-dev`).
+ *   - `next build` must be `dev` too: prod-mode build reads would try to open
+ *     a branch workspace on EFS that cannot exist in an image builder (see
+ *     the note in `cli/template-files/Dockerfile.cms.template`).
+ *   - The deployed Lambda must be `prod`: dev mode resolves the workspace to
+ *     `<cwd>/.canopy-dev`, and Lambda's filesystem is read-only outside /tmp,
+ *     so the first write fails with EROFS.
+ *
+ * Only a value resolved at RUN time can satisfy all three, which is why this
+ * is an environment override rather than a flag baked into the generated
+ * config file. `CANOPY_MODE` is the name the deployment templates already
+ * referred to; before this module existed nothing read it.
+ *
+ * Precedence (highest wins):
+ *   1. the environment value for the current runtime (see `readModeEnv`)
+ *   2. `config.mode` (the literal in `canopycms.config.ts`)
+ *
+ * ## Two variable names, on purpose
+ *
+ * Server code reads `CANOPY_MODE`, which the CDK construct stamps onto the
+ * Lambda (`CanopyCmsService` sets `CANOPY_MODE=prod`). It is deliberately NOT
+ * set during `next build`, so build-time content reads stay in dev mode.
+ *
+ * Browser code cannot read a runtime environment at all — the editor page
+ * imports `canopycms.config.ts` directly (`config.client()`), so the browser's
+ * copy of `mode` is whatever was inlined when the bundle was built. Next.js
+ * only inlines `NEXT_PUBLIC_*`, so the browser reads
+ * `NEXT_PUBLIC_CANOPY_MODE`, which the generated CDK stack passes as a Docker
+ * build arg. Both names must be spelled as literal `process.env.X` member
+ * expressions here or the bundler cannot substitute them.
+ *
+ * An unrecognized value throws rather than falling back. Falling back would
+ * turn a typo (`CANOPY_MODE=production`) into a silent dev-mode deployment
+ * running header-trusting dev auth semantics — the exact failure SEC-C1 made
+ * `mode` required to prevent.
+ */
+import type { OperatingMode } from './types';
+export declare const SERVER_MODE_ENV_VAR = "CANOPY_MODE";
+export declare const BROWSER_MODE_ENV_VAR = "NEXT_PUBLIC_CANOPY_MODE";
+/** Reset the once-per-process warning latch. Test-only. */
+export declare function resetModeWarning(): void;
+/**
+ * Resolve the effective operating mode from the environment and the config
+ * literal. Called from `validateCanopyConfig`, the one point every documented
+ * config-authoring path (`defineCanopyConfig`, `composeCanopyConfig`) funnels
+ * through.
+ */
+export declare function resolveOperatingMode(configMode: OperatingMode): OperatingMode;
+//# sourceMappingURL=mode-env.d.ts.map

package/dist/operating-mode/mode-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-env.d.ts","sourceRoot":"","sources":["../../src/operating-mode/mode-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,eAAO,MAAM,mBAAmB,gBAAgB,CAAA;AAChD,eAAO,MAAM,oBAAoB,4BAA4B,CAAA;AAI7D,2DAA2D;AAC3D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAkBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,aAAa,GAAG,aAAa,CA0B7E"}

package/dist/operating-mode/mode-env.js

@@ -0,0 +1,97 @@
+/**
+ * Single resolution point for the operating `mode`.
+ *
+ * `mode` is required in `canopycms.config.ts` (SEC-C1) and that file lives in
+ * the adopter's repo — the SAME file is loaded by `next dev` locally, by
+ * `next build` inside the image builder, and by the deployed Lambda. Those
+ * three want different answers, so a literal in the config file cannot be
+ * right for all of them:
+ *
+ *   - `next dev` must be `dev` (workspace at `<cwd>/.canopy-dev`).
+ *   - `next build` must be `dev` too: prod-mode build reads would try to open
+ *     a branch workspace on EFS that cannot exist in an image builder (see
+ *     the note in `cli/template-files/Dockerfile.cms.template`).
+ *   - The deployed Lambda must be `prod`: dev mode resolves the workspace to
+ *     `<cwd>/.canopy-dev`, and Lambda's filesystem is read-only outside /tmp,
+ *     so the first write fails with EROFS.
+ *
+ * Only a value resolved at RUN time can satisfy all three, which is why this
+ * is an environment override rather than a flag baked into the generated
+ * config file. `CANOPY_MODE` is the name the deployment templates already
+ * referred to; before this module existed nothing read it.
+ *
+ * Precedence (highest wins):
+ *   1. the environment value for the current runtime (see `readModeEnv`)
+ *   2. `config.mode` (the literal in `canopycms.config.ts`)
+ *
+ * ## Two variable names, on purpose
+ *
+ * Server code reads `CANOPY_MODE`, which the CDK construct stamps onto the
+ * Lambda (`CanopyCmsService` sets `CANOPY_MODE=prod`). It is deliberately NOT
+ * set during `next build`, so build-time content reads stay in dev mode.
+ *
+ * Browser code cannot read a runtime environment at all — the editor page
+ * imports `canopycms.config.ts` directly (`config.client()`), so the browser's
+ * copy of `mode` is whatever was inlined when the bundle was built. Next.js
+ * only inlines `NEXT_PUBLIC_*`, so the browser reads
+ * `NEXT_PUBLIC_CANOPY_MODE`, which the generated CDK stack passes as a Docker
+ * build arg. Both names must be spelled as literal `process.env.X` member
+ * expressions here or the bundler cannot substitute them.
+ *
+ * An unrecognized value throws rather than falling back. Falling back would
+ * turn a typo (`CANOPY_MODE=production`) into a silent dev-mode deployment
+ * running header-trusting dev auth semantics — the exact failure SEC-C1 made
+ * `mode` required to prevent.
+ */
+import { canopyLogWarn } from '../utils/logger.js';
+export const SERVER_MODE_ENV_VAR = 'CANOPY_MODE';
+export const BROWSER_MODE_ENV_VAR = 'NEXT_PUBLIC_CANOPY_MODE';
+let warned = false;
+/** Reset the once-per-process warning latch. Test-only. */
+export function resetModeWarning() {
+    warned = false;
+}
+/**
+ * The environment value for the current runtime, or undefined when unset.
+ *
+ * Guarded with `typeof process` because a non-Next bundler may leave no
+ * `process` shim in the browser at all; the member expressions themselves stay
+ * literal so Next's DefinePlugin substitution still applies.
+ */
+function readModeEnv() {
+    if (typeof process === 'undefined' || typeof process.env === 'undefined')
+        return undefined;
+    const inBrowser = typeof window !== 'undefined';
+    const name = inBrowser ? BROWSER_MODE_ENV_VAR : SERVER_MODE_ENV_VAR;
+    const raw = inBrowser ? process.env.NEXT_PUBLIC_CANOPY_MODE : process.env.CANOPY_MODE;
+    const value = raw?.trim();
+    return value ? { name, value } : undefined;
+}
+/**
+ * Resolve the effective operating mode from the environment and the config
+ * literal. Called from `validateCanopyConfig`, the one point every documented
+ * config-authoring path (`defineCanopyConfig`, `composeCanopyConfig`) funnels
+ * through.
+ */
+export function resolveOperatingMode(configMode) {
+    const env = readModeEnv();
+    if (!env)
+        return configMode;
+    if (env.value !== 'prod' && env.value !== 'dev') {
+        throw new Error(`CanopyCMS: invalid ${env.name}=${JSON.stringify(env.value)}. ` +
+            `It must be exactly "prod" or "dev". Refusing to fall back to the configured mode ` +
+            `(${JSON.stringify(configMode)}): a typo here would silently deploy dev auth semantics.`);
+    }
+    if (env.value !== configMode && !warned) {
+        // canopyLogWarn, not console.warn: shared modules can run inside the
+        // worker daemon, where an unprefixed line is folded into the previous
+        // CloudWatch event (see utils/logger.ts).
+        canopyLogWarn(`CanopyCMS: ${env.name}="${env.value}" overrides config.mode="${configMode}". ` +
+            `The environment wins by design — it is the per-deployment value, while ` +
+            `canopycms.config.ts is shared by local dev, the image build and the deployment. ` +
+            `See operating-mode/mode-env.ts.`);
+        warned = true;
+    }
+    return env.value;
+}
+//# sourceMappingURL=mode-env.js.map

package/dist/operating-mode/mode-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-env.js","sourceRoot":"","sources":["../../src/operating-mode/mode-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAG/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAA;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,IAAI,MAAM,GAAG,KAAK,CAAA;AAElB,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,KAAK,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IAC1F,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACnE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACrF,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAA;IACzB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAyB;IAC5D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAA;IAE3B,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI;YAC7D,mFAAmF;YACnF,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,0DAA0D,CAC3F,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,qEAAqE;QACrE,sEAAsE;QACtE,0CAA0C;QAC1C,aAAa,CACX,cAAc,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,4BAA4B,UAAU,KAAK;YAC7E,yEAAyE;YACzE,kFAAkF;YAClF,iCAAiC,CACpC,CAAA;QACD,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC"}

package/dist/operating-mode/types.d.ts

@@ -79,10 +79,20 @@ export interface ClientUnsafeStrategy extends ClientSafeStrategy {
     getWorkspaceRoot(sourceRoot?: string): string;
     /**
      * Get the content directory path (at project/workspace root).
-     * - dev: {cwd}/content
-     * - prod (in workspaces): {workspaceRoot}/content
+     * - dev: {sourceRoot ?? cwd}/{contentRoot}
+     * - prod (in workspaces): {sourceRoot ?? cwd}/{contentRoot}
+     *
+     * `contentRoot` is REQUIRED and must be the caller's already-resolved
+     * `config.contentRoot` (falling back to 'content' at the call site, not here).
+     * A default here is deliberately not provided: this method used to hardcode
+     * the literal 'content', which silently disarmed callers configured with a
+     * non-default contentRoot (e.g. dev-content-watcher.ts's divergence watcher
+     * resolved a content directory that never existed, hit its existsSync guard,
+     * and permanently no-op'd — with no error, since a missing directory looks
+     * like "nothing to watch yet"). Making the parameter required means a future
+     * caller cannot silently reintroduce that bug by omitting it.
      */
-    getContentRoot(sourceRoot?: string): string;
+    getContentRoot(contentRoot: string, sourceRoot?: string): string;
     /**
      * Get the parent directory of all content branch workspaces (contains branches.json and branch directories).
      * - dev: {cwd}/.canopy-dev/content-branches

package/dist/operating-mode/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/operating-mode/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,IAAI,EAAE,EAAE,MAAM,GAAG,CAAA;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAG7C,MAAM,MAAM,aAAa,GAAG,EAAE,CAAA;AAE9B;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAA;IACzB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAM5B,4DAA4D;IAC5D,iBAAiB,IAAI,OAAO,CAAA;IAE5B,yCAAyC;IACzC,mBAAmB,IAAI,OAAO,CAAA;IAE9B,0DAA0D;IAC1D,gBAAgB,IAAI,OAAO,CAAA;IAE3B,kDAAkD;IAClD,oBAAoB,IAAI,OAAO,CAAA;IAM/B,2FAA2F;IAC3F,sBAAsB,IAAI,MAAM,CAAA;IAEhC,4EAA4E;IAC5E,iBAAiB,IAAI,MAAM,CAAA;IAE3B,sDAAsD;IACtD,YAAY,IAAI,OAAO,CAAA;IAEvB,qDAAqD;IACrD,UAAU,IAAI,OAAO,CAAA;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAK9D;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAE7C;;;;OAIG;IACH,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAE3C;;;;OAIG;IACH,sBAAsB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnD;;;OAGG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAErE;;;OAGG;IACH,oBAAoB,IAAI,MAAM,CAAA;IAM9B,gDAAgD;IAChD,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAE5C,2CAA2C;IAC3C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAMvC,kFAAkF;IAClF,kBAAkB,IAAI,eAAe,CAAA;IAErC,4DAA4D;IAC5D,oBAAoB,IAAI,OAAO,CAAA;IAM/B;;;OAGG;IACH,qBAAqB,CAAC,MAAM,EAAE;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC3B,GAAG,MAAM,CAAA;IAEV;;;;OAIG;IACH,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAE5C,6DAA6D;IAC7D,0BAA0B,IAAI,OAAO,CAAA;IAMrC,2CAA2C;IAC3C,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAMnD,wEAAwE;IACxE,sBAAsB,CAAC,MAAM,EAAE;QAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAA;CAC5E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/operating-mode/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,IAAI,EAAE,EAAE,MAAM,GAAG,CAAA;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAG7C,MAAM,MAAM,aAAa,GAAG,EAAE,CAAA;AAE9B;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,mBAAmB,EAAE,OAAO,CAAA;IAC5B,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAA;IACzB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAM5B,4DAA4D;IAC5D,iBAAiB,IAAI,OAAO,CAAA;IAE5B,yCAAyC;IACzC,mBAAmB,IAAI,OAAO,CAAA;IAE9B,0DAA0D;IAC1D,gBAAgB,IAAI,OAAO,CAAA;IAE3B,kDAAkD;IAClD,oBAAoB,IAAI,OAAO,CAAA;IAM/B,2FAA2F;IAC3F,sBAAsB,IAAI,MAAM,CAAA;IAEhC,4EAA4E;IAC5E,iBAAiB,IAAI,MAAM,CAAA;IAE3B,sDAAsD;IACtD,YAAY,IAAI,OAAO,CAAA;IAEvB,qDAAqD;IACrD,UAAU,IAAI,OAAO,CAAA;CACtB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAK9D;;;;;OAKG;IACH,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAE7C;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAEhE;;;;OAIG;IACH,sBAAsB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAEnD;;;OAGG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAErE;;;OAGG;IACH,oBAAoB,IAAI,MAAM,CAAA;IAM9B,gDAAgD;IAChD,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAE5C,2CAA2C;IAC3C,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IAMvC,kFAAkF;IAClF,kBAAkB,IAAI,eAAe,CAAA;IAErC,4DAA4D;IAC5D,oBAAoB,IAAI,OAAO,CAAA;IAM/B;;;OAGG;IACH,qBAAqB,CAAC,MAAM,EAAE;QAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC3B,GAAG,MAAM,CAAA;IAEV;;;;OAIG;IACH,eAAe,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAE5C,6DAA6D;IAC7D,0BAA0B,IAAI,OAAO,CAAA;IAMrC,2CAA2C;IAC3C,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;IAMnD,wEAAwE;IACxE,sBAAsB,CAAC,MAAM,EAAE;QAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAA;CAC5E"}

package/dist/paths/branch-name.d.ts

@@ -17,4 +17,42 @@ import type { SanitizedBranchName } from './types';
  * - Trims leading/trailing dots
  */
 export declare function sanitizeBranchName(branchName: string): SanitizedBranchName;
+/**
+ * Prefix reserved for CanopyCMS settings branches (`canopycms-settings-{name}`,
+ * see operating-mode/client-unsafe-strategy.ts's `getSettingsBranchName` and
+ * operating-mode/deployment-name.ts's `resolveDeploymentName`). Exported from
+ * this dependency-free module -- not constructed ad hoc at each call site --
+ * so every consumer that needs to recognize the settings-branch namespace
+ * agrees on the exact string: worker/cms-worker.ts's `pushSettingsBranches`
+ * (never push a `canopycms-settings-*` branch this deployment doesn't own),
+ * and api/branch.ts's `createBranchHandler` (reject a user-requested branch
+ * whose SANITIZED name falls in this namespace).
+ *
+ * Two CanopyCMS deployments can share one GitHub repo, each with its own
+ * settings branch under this prefix (`canopycms-settings-prod` vs
+ * `canopycms-settings-staging`, say). A content-branch request that lands on
+ * ANOTHER deployment's settings branch name would silently corrupt that
+ * deployment's permissions/groups the next time its worker treats the ref as
+ * an orphan settings branch -- so the whole prefix is reserved for branch
+ * creation, not just this deployment's own settings branch name.
+ */
+export declare const RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
+/**
+ * Branch names that collide with a static top-level API route namespace.
+ *
+ * http/router.ts's `compareSpecificity` ranks a literal pattern segment above a
+ * `:param`, so a branch named e.g. `admin` has its `/:branch/...` routes
+ * shadowed by the static `/admin/...` ones. The failure is a *partial* one,
+ * which is what makes it confusing: bare `GET /admin` still reaches the branch
+ * handler (there is no single-segment static `/admin` route), so the branch
+ * looks half-alive while every nested route 404s or 403s.
+ *
+ * Lives in this dependency-free module for the same reason as
+ * {@link RESERVED_SETTINGS_BRANCH_PREFIX}: api/validators.ts is imported *by*
+ * the route modules, so nothing on the validation side can import the router to
+ * derive this at runtime without a cycle. http/router.test.ts derives the same
+ * set from the live route table and asserts it equals this constant, so adding
+ * a new top-level namespace fails that test until this list is updated.
+ */
+export declare const RESERVED_ROUTE_BRANCH_NAMES: readonly string[];
 //# sourceMappingURL=branch-name.d.ts.map

package/dist/paths/branch-name.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"branch-name.d.ts","sourceRoot":"","sources":["../../src/paths/branch-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAElD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAK1E"}
+{"version":3,"file":"branch-name.d.ts","sourceRoot":"","sources":["../../src/paths/branch-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAElD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,mBAAmB,CAK1E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,+BAA+B,wBAAwB,CAAA;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAQxD,CAAA"}

package/dist/paths/branch-name.js

@@ -21,4 +21,50 @@ export function sanitizeBranchName(branchName) {
     const trimmedDots = squashed.replace(/^\.+/, '').replace(/(?<!\.)\.+$/, '');
     return (trimmedDots || 'branch');
 }
+/**
+ * Prefix reserved for CanopyCMS settings branches (`canopycms-settings-{name}`,
+ * see operating-mode/client-unsafe-strategy.ts's `getSettingsBranchName` and
+ * operating-mode/deployment-name.ts's `resolveDeploymentName`). Exported from
+ * this dependency-free module -- not constructed ad hoc at each call site --
+ * so every consumer that needs to recognize the settings-branch namespace
+ * agrees on the exact string: worker/cms-worker.ts's `pushSettingsBranches`
+ * (never push a `canopycms-settings-*` branch this deployment doesn't own),
+ * and api/branch.ts's `createBranchHandler` (reject a user-requested branch
+ * whose SANITIZED name falls in this namespace).
+ *
+ * Two CanopyCMS deployments can share one GitHub repo, each with its own
+ * settings branch under this prefix (`canopycms-settings-prod` vs
+ * `canopycms-settings-staging`, say). A content-branch request that lands on
+ * ANOTHER deployment's settings branch name would silently corrupt that
+ * deployment's permissions/groups the next time its worker treats the ref as
+ * an orphan settings branch -- so the whole prefix is reserved for branch
+ * creation, not just this deployment's own settings branch name.
+ */
+export const RESERVED_SETTINGS_BRANCH_PREFIX = 'canopycms-settings-';
+/**
+ * Branch names that collide with a static top-level API route namespace.
+ *
+ * http/router.ts's `compareSpecificity` ranks a literal pattern segment above a
+ * `:param`, so a branch named e.g. `admin` has its `/:branch/...` routes
+ * shadowed by the static `/admin/...` ones. The failure is a *partial* one,
+ * which is what makes it confusing: bare `GET /admin` still reaches the branch
+ * handler (there is no single-segment static `/admin` route), so the branch
+ * looks half-alive while every nested route 404s or 403s.
+ *
+ * Lives in this dependency-free module for the same reason as
+ * {@link RESERVED_SETTINGS_BRANCH_PREFIX}: api/validators.ts is imported *by*
+ * the route modules, so nothing on the validation side can import the router to
+ * derive this at runtime without a cycle. http/router.test.ts derives the same
+ * set from the live route table and asserts it equals this constant, so adding
+ * a new top-level namespace fails that test until this list is updated.
+ */
+export const RESERVED_ROUTE_BRANCH_NAMES = [
+    'admin',
+    'assets',
+    'branches',
+    'groups',
+    'permissions',
+    'users',
+    'whoami',
+];
 //# sourceMappingURL=branch-name.js.map

package/dist/paths/branch-name.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch-name.js","sourceRoot":"","sources":["../../src/paths/branch-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAwB,CAAA;AACzD,CAAC"}
+{"version":3,"file":"branch-name.js","sourceRoot":"","sources":["../../src/paths/branch-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;IAC3E,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAwB,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,qBAAqB,CAAA;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,OAAO;IACP,QAAQ;CACT,CAAA"}

package/dist/paths/index.d.ts

@@ -19,5 +19,5 @@ export { validateAndNormalizePath } from './normalize-server';
 export { validateContentPath, isValidCollectionPath, sanitizeForPath, hasEmbeddedContentId, looksLikePhysicalPath, looksLikeLogicalPath, parseLogicalPath, parsePhysicalPath, isValidContentId, parseContentId, parseBranchName, parseSlug, } from './validation';
 export { resolveLogicalPath } from './resolve';
 export { resolveBranchPath, ensureBranchRoot, getDefaultBranchBase, resolveBranchPaths, BranchPathError, type BranchPathOptions, type BranchPathResult, } from './branch';
-export { sanitizeBranchName } from './branch-name';
+export { sanitizeBranchName, RESERVED_SETTINGS_BRANCH_PREFIX, RESERVED_ROUTE_BRANCH_NAMES, } from './branch-name';
 //# sourceMappingURL=index.d.ts.map

package/dist/paths/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/paths/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,YAAY,EACV,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,IAAI,EACJ,oBAAoB,GACrB,MAAM,SAAS,CAAA;AAGhB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,WAAW,GACZ,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAG7D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EAEf,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAG9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/paths/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,YAAY,EACV,WAAW,EACX,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,SAAS,EACT,IAAI,EACJ,oBAAoB,GACrB,MAAM,SAAS,CAAA;AAGhB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,WAAW,GACZ,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAG7D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EAEf,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAG9C,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,UAAU,CAAA;AAGjB,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,eAAe,CAAA"}

package/dist/paths/index.js

@@ -29,5 +29,5 @@ export { resolveLogicalPath } from './resolve.js';
 export { resolveBranchPath, ensureBranchRoot, getDefaultBranchBase, resolveBranchPaths, BranchPathError, } from './branch.js';
 // From the dependency-free module (NOT ./branch, which imports node:fs) so
 // client-reachable importers of 'canopycms/src/paths' stay browser-safe.
-export { sanitizeBranchName } from './branch-name.js';
+export { sanitizeBranchName, RESERVED_SETTINGS_BRANCH_PREFIX, RESERVED_ROUTE_BRANCH_NAMES, } from './branch-name.js';
 //# sourceMappingURL=index.js.map

package/dist/paths/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/paths/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAaH,wCAAwC;AACxC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,WAAW,GACZ,MAAM,aAAa,CAAA;AAEpB,sEAAsE;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,uBAAuB;AACvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,eAAe;AACf,kCAAkC;AAClC,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB;AAChB,sCAAsC;AACtC,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,cAAc,CAAA;AAErB,4BAA4B;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,wBAAwB;AACxB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,UAAU,CAAA;AACjB,2EAA2E;AAC3E,yEAAyE;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/paths/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAaH,wCAAwC;AACxC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,QAAQ,EACR,WAAW,GACZ,MAAM,aAAa,CAAA;AAEpB,sEAAsE;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAE7D,uBAAuB;AACvB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,eAAe;AACf,kCAAkC;AAClC,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB;AAChB,sCAAsC;AACtC,cAAc,EACd,eAAe,EACf,SAAS,GACV,MAAM,cAAc,CAAA;AAErB,4BAA4B;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAE9C,wBAAwB;AACxB,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,GAGhB,MAAM,UAAU,CAAA;AACjB,2EAA2E;AAC3E,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,eAAe,CAAA"}

package/dist/reference-resolver.d.ts

@@ -1,6 +1,6 @@
 import type { ContentStore } from './content-store';
 import type { ContentIdIndex } from './content-id-index';
-import type { LogicalPath, Slug } from './paths';
+import type { LogicalPath, PhysicalPath, Slug } from './paths';
 export interface ResolvedReference {
     id: string;
     exists: boolean;
@@ -44,8 +44,12 @@ export declare class ReferenceResolver {
      * @param displayField - Field to use for option labels (default: 'title')
      * @param search - Optional search string to filter options
      * @param entryTypes - Optional entry type names to filter by (e.g., ['partner'])
+     * @param canAccess - Optional permission predicate, called with each candidate's
+     *   relative path before it is read. Returning false skips the entry entirely --
+     *   no file I/O, no label, no option -- so a caller who can't read a path never
+     *   triggers a read for content they won't be allowed to see anyway.
      */
-    loadReferenceOptions(collections?: LogicalPath[], displayField?: string, search?: string, entryTypes?: string[]): Promise<ReferenceOption[]>;
+    loadReferenceOptions(collections?: LogicalPath[], displayField?: string, search?: string, entryTypes?: string[], canAccess?: (relativePath: PhysicalPath) => boolean): Promise<ReferenceOption[]>;
     /**
      * Resolve multiple IDs at once.
      * Useful for displaying lists of referenced items.

package/dist/reference-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference-resolver.d.ts","sourceRoot":"","sources":["../src/reference-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,oBAAoB,CAAA;AAEpE,OAAO,KAAK,EAAE,WAAW,EAAgB,IAAI,EAAE,MAAM,SAAS,CAAA;AAE9D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,WAAW,CAAA;IACxB,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,OAAO;gBADP,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc;IAGjC;;;;;;OAMG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,SAAU,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAgCpF;;;;;;;;;;OAUG;IACG,oBAAoB,CACxB,WAAW,CAAC,EAAE,WAAW,EAAE,EAC3B,YAAY,SAAU,EACtB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EAAE,GACpB,OAAO,CAAC,eAAe,EAAE,CAAC;IAqE7B;;;OAGG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,YAAY,SAAU,GAAG,OAAO,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,CAAC;CAGhG"}
+{"version":3,"file":"reference-resolver.d.ts","sourceRoot":"","sources":["../src/reference-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAc,MAAM,oBAAoB,CAAA;AAEpE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAE9D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,WAAW,CAAA;IACxB,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,OAAO;gBADP,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,cAAc;IAGjC;;;;;;OAMG;IACG,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,SAAU,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAgCpF;;;;;;;;;;;;;;OAcG;IACG,oBAAoB,CACxB,WAAW,CAAC,EAAE,WAAW,EAAE,EAC3B,YAAY,SAAU,EACtB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,EAAE,EACrB,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,GAClD,OAAO,CAAC,eAAe,EAAE,CAAC;IAuE7B;;;OAGG;IACG,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,YAAY,SAAU,GAAG,OAAO,CAAC,CAAC,iBAAiB,GAAG,IAAI,CAAC,EAAE,CAAC;CAGhG"}

package/dist/reference-resolver.js

@@ -60,8 +60,12 @@ export class ReferenceResolver {
      * @param displayField - Field to use for option labels (default: 'title')
      * @param search - Optional search string to filter options
      * @param entryTypes - Optional entry type names to filter by (e.g., ['partner'])
+     * @param canAccess - Optional permission predicate, called with each candidate's
+     *   relative path before it is read. Returning false skips the entry entirely --
+     *   no file I/O, no label, no option -- so a caller who can't read a path never
+     *   triggers a read for content they won't be allowed to see anyway.
      */
-    async loadReferenceOptions(collections, displayField = 'title', search, entryTypes) {
+    async loadReferenceOptions(collections, displayField = 'title', search, entryTypes, canAccess) {
         const options = [];
         let candidates;
         if (collections && collections.length > 0) {
@@ -86,6 +90,9 @@ export class ReferenceResolver {
         for (const location of candidates) {
             if (!location.collection || !location.slug)
                 continue;
+            // Skip denied paths before any file I/O.
+            if (canAccess && !canAccess(location.relativePath))
+                continue;
             const id = this.idIndex.findByPath(location.relativePath);
             if (!id)
                 continue;

package/dist/reference-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"reference-resolver.js","sourceRoot":"","sources":["../src/reference-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AAiB1F;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAC5B,YACU,KAAmB,EACnB,OAAuB;QADvB,UAAK,GAAL,KAAK,CAAc;QACnB,YAAO,GAAP,OAAO,CAAgB;IAC9B,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,YAAY,GAAG,OAAO;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE;gBACF,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,EAAE,EAAE,oCAAoC;aACvD,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,IAAK,CAAC,CAAA;YACvE,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAA;YAEtF,OAAO;gBACL,EAAE;gBACF,MAAM,EAAE,IAAI;gBACZ,YAAY;gBACZ,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,OAAO;gBACL,EAAE;gBACF,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,EAAE;aACjB,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,oBAAoB,CACxB,WAA2B,EAC3B,YAAY,GAAG,OAAO,EACtB,MAAe,EACf,UAAqB;QAErB,MAAM,OAAO,GAAsB,EAAE,CAAA;QAMrC,IAAI,UAAuB,CAAA;QAC3B,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,sEAAsE;YACtE,sFAAsF;YACtF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAClE,CAAA;YACD,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,UAAU,GAAG,IAAI,CAAC,OAAO;iBACtB,oBAAoB,EAAE;iBACtB,MAAM,CACL,CAAC,GAAG,EAA+D,EAAE,CACnE,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CACzD,CAAA;QACL,CAAC;QAED,oCAAoC;QACpC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACrC,MAAM,SAAS,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;gBACnF,OAAO,SAAS,IAAI,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC5D,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,SAAQ;YAEpD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;YACzD,IAAI,CAAC,EAAE;gBAAE,SAAQ;YAEjB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;gBACzD,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;gBAExD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,cAAsB,CAAC,CAAA;gBAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,CAAA;gBAEhF,kCAAkC;gBAClC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAClE,SAAQ;gBACV,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,EAAE;oBACF,KAAK;oBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC3D,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,KAAK;iBACN,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,GAAa,EAAE,YAAY,GAAG,OAAO;QACrD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;IACrE,CAAC;CACF"}
+{"version":3,"file":"reference-resolver.js","sourceRoot":"","sources":["../src/reference-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAA;AAIhC,OAAO,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAA;AAiB1F;;;;;;;;GAQG;AACH,MAAM,OAAO,iBAAiB;IAC5B,YACU,KAAmB,EACnB,OAAuB;QADvB,UAAK,GAAL,KAAK,CAAc;QACnB,YAAO,GAAP,OAAO,CAAgB;IAC9B,CAAC;IAEJ;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,YAAY,GAAG,OAAO;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAE1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE;gBACF,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,EAAE,EAAE,oCAAoC;aACvD,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAW,EAAE,QAAQ,CAAC,IAAK,CAAC,CAAA;YACvE,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAA;YAEtF,OAAO;gBACL,EAAE;gBACF,MAAM,EAAE,IAAI;gBACZ,YAAY;gBACZ,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;aACpB,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC5D,OAAO;gBACL,EAAE;gBACF,MAAM,EAAE,KAAK;gBACb,YAAY,EAAE,EAAE;aACjB,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,oBAAoB,CACxB,WAA2B,EAC3B,YAAY,GAAG,OAAO,EACtB,MAAe,EACf,UAAqB,EACrB,SAAmD;QAEnD,MAAM,OAAO,GAAsB,EAAE,CAAA;QAMrC,IAAI,UAAuB,CAAA;QAC3B,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,sEAAsE;YACtE,sFAAsF;YACtF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAClE,CAAA;YACD,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,UAAU,GAAG,IAAI,CAAC,OAAO;iBACtB,oBAAoB,EAAE;iBACtB,MAAM,CACL,CAAC,GAAG,EAA+D,EAAE,CACnE,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CACzD,CAAA;QACL,CAAC;QAED,oCAAoC;QACpC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACrC,MAAM,SAAS,GAAG,4BAA4B,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;gBACnF,OAAO,SAAS,IAAI,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;YAC5D,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,SAAQ;YACpD,yCAAyC;YACzC,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,SAAQ;YAE5D,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;YACzD,IAAI,CAAC,EAAE;gBAAE,SAAQ;YAEjB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;gBACzD,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAA;gBAExD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,cAAsB,CAAC,CAAA;gBAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,CAAA;gBAEhF,kCAAkC;gBAClC,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBAClE,SAAQ;gBACV,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,EAAE;oBACF,KAAK;oBACL,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE;oBAC3D,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,KAAK;iBACN,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,GAAa,EAAE,YAAY,GAAG,OAAO;QACrD,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;IACrE,CAAC;CACF"}