canopycms 0.0.61 → 0.0.62

package/dist/utils/content-write-lock.d.ts

@@ -0,0 +1,127 @@
+/**
+ * [SYNC-C1] Cross-host mutual exclusion between the worker's rebase loop and
+ * content writes against the same branch working tree.
+ *
+ * Production runs a Lambda (API) and an EC2 worker over one EFS filesystem.
+ * `ContentStore`'s write/delete/rename critical sections were guarded only by
+ * the in-process mutex (`utils/async-mutex`), which does not cross that
+ * boundary, while `CmsWorker.rebaseActiveBranches()` rewrites the very same
+ * working tree. A write landing after `git rebase` started is destroyed two
+ * ways -- `git checkout --theirs <file>` overwrites it with the branch's
+ * committed version (and the rebase then SUCCEEDS, logging nothing), and
+ * `git rebase --abort` hard-resets the tree. Either way the editor already got
+ * its 200. This lock is what serializes the two.
+ *
+ * **Asymmetric by design.** The worker retries every branch on its next sync
+ * cycle (~5 minutes) while the editor is a person waiting on a save, so the
+ * worker yields and the writer waits:
+ *
+ * - Worker: {@link tryAcquireContentWriteLock} -- zero retries. On contention
+ *   it skips that branch this cycle (an extension of the existing
+ *   skip-dirty-branches behavior) and picks it up next cycle.
+ * - Writers: {@link withContentWriteLock} -- a short bounded wait, then a
+ *   retriable failure the API surfaces as a 409.
+ *
+ * **Reads never take this lock.** An extra EFS round-trip on every read is not
+ * an acceptable price, and a read racing a rebase gets a consistent-enough
+ * older or newer file, never a destroyed one.
+ *
+ * ## Why the lock is anchored on `{branchRoot}/.canopy-meta`
+ *
+ * proper-lockfile keys its module-level `locks{}` bookkeeping (refresh timer,
+ * release function) by the **target path** passed to `lock()`, NOT by
+ * `lockfilePath`. The provisioning lock targets `path.dirname(branchRoot)` --
+ * the shared content-branches directory -- so anchoring here on that same
+ * directory with a different lock NAME would land on the same registry key:
+ * one process holding both (a Lambda container provisioning a workspace and
+ * writing content) would have the second acquisition clobber the first's
+ * bookkeeping. Targeting `{branchRoot}/.canopy-meta` instead gives:
+ *
+ * - a distinct in-process registry key from the provisioning lock (and from
+ *   every other branch's content lock -- the provisioning locks already share
+ *   one key across branches);
+ * - a distinct on-disk lock directory, so the server-enforced mkdir cannot
+ *   collide either; and
+ * - no deadlock potential: the two locks are never both required, and the only
+ *   possible acquisition order (provision, then write) is consistent.
+ *
+ * `.canopy-meta/` is git-excluded in every branch clone (`ensureGitExclude`),
+ * so the lock directory can never dirty the working tree or be swept into
+ * `git add .` at publish time.
+ *
+ * ## Honest caveat (do not oversell this)
+ *
+ * `proper-lockfile` decides a holder is dead by reading the lock directory's
+ * mtime with `fs.stat`, which on EFS is served through the NFS attribute
+ * cache. A live holder refreshes every `stale/2`, but a waiter can read a
+ * cached mtime and conclude the lock is stale when it is not, taking it over.
+ * The failure mode of a bad takeover is exactly today's behavior (two
+ * unsynchronized writers), so this is a strict improvement -- not a proof of
+ * mutual exclusion. See docs/concurrency.md.
+ */
+/** On-disk name of the lock marker (a directory, created by mkdir). */
+export declare const CONTENT_WRITE_LOCK_NAME = "content-write.lock";
+/**
+ * Default bounded wait for a content write.
+ *
+ * Deliberately short. A rebase holds this lock for a fetch plus a replay plus
+ * N conflict rounds of git subprocesses on EFS -- far longer than any wait an
+ * interactive save can absorb, and longer than the API's own latency budget.
+ * So the wait is not sized to outlast a rebase (nothing reasonable could); it
+ * is sized to absorb lock handoff and the short holds of other writers, and to
+ * turn everything longer into a fast, explicit "retry" the editor can act on
+ * rather than a request that hangs toward the Lambda timeout. The worker
+ * revisits the branch next cycle, so the blocked state is transient.
+ *
+ * This is ALSO the writer-vs-writer budget, not only the rebase one. The lock
+ * is per-branch-root, so every write to one branch now serializes behind it
+ * where in-process serialization used to be per-entry -- bounded on Lambda
+ * (one invocation per container), but real under `next dev` and build-time
+ * provisioning across worker processes. The case to watch is a write whose
+ * in-lock path triggers a full `idIndex()` rescan of a large tree over EFS:
+ * that can plausibly exceed this budget and start 409ing unrelated saves.
+ * Making it configurable for prod tuning is tracked in
+ * .claude/future-tasks/content-write-lock-tuning-and-granularity.md.
+ */
+export declare const DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS = 2000;
+/**
+ * Thrown when the bounded wait expires with the branch's content lock still
+ * held. Retriable -- callers translate this into a 409 with a message that
+ * says so.
+ *
+ * The message says "syncing OR another save" because BOTH produce it. The
+ * lock is taken by `write`/`delete`/`renameEntry` and by the admin
+ * repair-content-duplicates action as well as by the worker's rebase, so a
+ * message naming only the rebase was a confident claim about something that
+ * may not be happening. `api/content.ts` routes this error ahead of the
+ * generic conflict specifically so the editor sees this wording, which makes
+ * the wording load-bearing rather than cosmetic.
+ */
+export declare class ContentWriteLockBusyError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Acquire the branch's content-write lock WITHOUT waiting.
+ *
+ * Throws an error with `code === 'ELOCKED'` when a live holder has it. Used by
+ * the worker's rebase loop (which skips the branch and retries next cycle) and
+ * by tests standing in for a writer.
+ */
+export declare function tryAcquireContentWriteLock(branchRoot: string): Promise<() => Promise<void>>;
+/**
+ * Acquire the branch's content-write lock with a short bounded wait.
+ *
+ * Retries ONLY on genuine contention (`ELOCKED`), the same discipline
+ * `withOccFileLock` uses: proper-lockfile's own retry loop retries blindly on
+ * any error, which would burn the whole budget re-hitting e.g. ENOENT after
+ * the branch directory was deleted out from under the caller.
+ *
+ * @throws ContentWriteLockBusyError when the budget expires under contention.
+ */
+export declare function acquireContentWriteLock(branchRoot: string, waitMs?: number): Promise<() => Promise<void>>;
+/**
+ * Run `fn` holding the branch's content-write lock, releasing it in a
+ * `finally` so a throw can never strand it.
+ */
+export declare function withContentWriteLock<T>(branchRoot: string, fn: () => Promise<T>, waitMs?: number): Promise<T>;
+//# sourceMappingURL=content-write-lock.d.ts.map

package/dist/utils/content-write-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-write-lock.d.ts","sourceRoot":"","sources":["../../src/utils/content-write-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAUH,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,uBAAuB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,kCAAkC,OAAO,CAAA;AAEtD;;;;;;;;;;;;GAYG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBAEhD,OAAO,SAAuI;CAKjJ;AAYD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAE3F;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,MAAM,GAAE,MAA2C,GAClD,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAe9B;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,MAAM,GAAE,MAA2C,GAClD,OAAO,CAAC,CAAC,CAAC,CAOZ"}

package/dist/utils/content-write-lock.js

@@ -0,0 +1,170 @@
+/**
+ * [SYNC-C1] Cross-host mutual exclusion between the worker's rebase loop and
+ * content writes against the same branch working tree.
+ *
+ * Production runs a Lambda (API) and an EC2 worker over one EFS filesystem.
+ * `ContentStore`'s write/delete/rename critical sections were guarded only by
+ * the in-process mutex (`utils/async-mutex`), which does not cross that
+ * boundary, while `CmsWorker.rebaseActiveBranches()` rewrites the very same
+ * working tree. A write landing after `git rebase` started is destroyed two
+ * ways -- `git checkout --theirs <file>` overwrites it with the branch's
+ * committed version (and the rebase then SUCCEEDS, logging nothing), and
+ * `git rebase --abort` hard-resets the tree. Either way the editor already got
+ * its 200. This lock is what serializes the two.
+ *
+ * **Asymmetric by design.** The worker retries every branch on its next sync
+ * cycle (~5 minutes) while the editor is a person waiting on a save, so the
+ * worker yields and the writer waits:
+ *
+ * - Worker: {@link tryAcquireContentWriteLock} -- zero retries. On contention
+ *   it skips that branch this cycle (an extension of the existing
+ *   skip-dirty-branches behavior) and picks it up next cycle.
+ * - Writers: {@link withContentWriteLock} -- a short bounded wait, then a
+ *   retriable failure the API surfaces as a 409.
+ *
+ * **Reads never take this lock.** An extra EFS round-trip on every read is not
+ * an acceptable price, and a read racing a rebase gets a consistent-enough
+ * older or newer file, never a destroyed one.
+ *
+ * ## Why the lock is anchored on `{branchRoot}/.canopy-meta`
+ *
+ * proper-lockfile keys its module-level `locks{}` bookkeeping (refresh timer,
+ * release function) by the **target path** passed to `lock()`, NOT by
+ * `lockfilePath`. The provisioning lock targets `path.dirname(branchRoot)` --
+ * the shared content-branches directory -- so anchoring here on that same
+ * directory with a different lock NAME would land on the same registry key:
+ * one process holding both (a Lambda container provisioning a workspace and
+ * writing content) would have the second acquisition clobber the first's
+ * bookkeeping. Targeting `{branchRoot}/.canopy-meta` instead gives:
+ *
+ * - a distinct in-process registry key from the provisioning lock (and from
+ *   every other branch's content lock -- the provisioning locks already share
+ *   one key across branches);
+ * - a distinct on-disk lock directory, so the server-enforced mkdir cannot
+ *   collide either; and
+ * - no deadlock potential: the two locks are never both required, and the only
+ *   possible acquisition order (provision, then write) is consistent.
+ *
+ * `.canopy-meta/` is git-excluded in every branch clone (`ensureGitExclude`),
+ * so the lock directory can never dirty the working tree or be swept into
+ * `git add .` at publish time.
+ *
+ * ## Honest caveat (do not oversell this)
+ *
+ * `proper-lockfile` decides a holder is dead by reading the lock directory's
+ * mtime with `fs.stat`, which on EFS is served through the NFS attribute
+ * cache. A live holder refreshes every `stale/2`, but a waiter can read a
+ * cached mtime and conclude the lock is stale when it is not, taking it over.
+ * The failure mode of a bad takeover is exactly today's behavior (two
+ * unsynchronized writers), so this is a strict improvement -- not a proof of
+ * mutual exclusion. See docs/concurrency.md.
+ */
+import path from 'node:path';
+import { isNodeError } from './error.js';
+import { tryAcquireProvisioningLock } from './provisioning-lock.js';
+/** Directory the lock marker lives in, relative to the branch root. */
+const META_DIR = '.canopy-meta';
+/** On-disk name of the lock marker (a directory, created by mkdir). */
+export const CONTENT_WRITE_LOCK_NAME = 'content-write.lock';
+/**
+ * Default bounded wait for a content write.
+ *
+ * Deliberately short. A rebase holds this lock for a fetch plus a replay plus
+ * N conflict rounds of git subprocesses on EFS -- far longer than any wait an
+ * interactive save can absorb, and longer than the API's own latency budget.
+ * So the wait is not sized to outlast a rebase (nothing reasonable could); it
+ * is sized to absorb lock handoff and the short holds of other writers, and to
+ * turn everything longer into a fast, explicit "retry" the editor can act on
+ * rather than a request that hangs toward the Lambda timeout. The worker
+ * revisits the branch next cycle, so the blocked state is transient.
+ *
+ * This is ALSO the writer-vs-writer budget, not only the rebase one. The lock
+ * is per-branch-root, so every write to one branch now serializes behind it
+ * where in-process serialization used to be per-entry -- bounded on Lambda
+ * (one invocation per container), but real under `next dev` and build-time
+ * provisioning across worker processes. The case to watch is a write whose
+ * in-lock path triggers a full `idIndex()` rescan of a large tree over EFS:
+ * that can plausibly exceed this budget and start 409ing unrelated saves.
+ * Making it configurable for prod tuning is tracked in
+ * .claude/future-tasks/content-write-lock-tuning-and-granularity.md.
+ */
+export const DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS = 2000;
+/**
+ * Thrown when the bounded wait expires with the branch's content lock still
+ * held. Retriable -- callers translate this into a 409 with a message that
+ * says so.
+ *
+ * The message says "syncing OR another save" because BOTH produce it. The
+ * lock is taken by `write`/`delete`/`renameEntry` and by the admin
+ * repair-content-duplicates action as well as by the worker's rebase, so a
+ * message naming only the rebase was a confident claim about something that
+ * may not be happening. `api/content.ts` routes this error ahead of the
+ * generic conflict specifically so the editor sees this wording, which makes
+ * the wording load-bearing rather than cosmetic.
+ */
+export class ContentWriteLockBusyError extends Error {
+    constructor(message = 'This branch is busy (syncing with the base branch, or another save is in flight); the change was not saved. Try again in a moment.') {
+        super(message);
+        this.name = 'ContentWriteLockBusyError';
+    }
+}
+/** The directory proper-lockfile anchors on -- also its in-process registry key. */
+function lockTargetDir(branchRoot) {
+    return path.join(path.resolve(branchRoot), META_DIR);
+}
+const sleep = (ms) => new Promise((resolve) => {
+    setTimeout(resolve, ms);
+});
+/**
+ * Acquire the branch's content-write lock WITHOUT waiting.
+ *
+ * Throws an error with `code === 'ELOCKED'` when a live holder has it. Used by
+ * the worker's rebase loop (which skips the branch and retries next cycle) and
+ * by tests standing in for a writer.
+ */
+export function tryAcquireContentWriteLock(branchRoot) {
+    return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME);
+}
+/**
+ * Acquire the branch's content-write lock with a short bounded wait.
+ *
+ * Retries ONLY on genuine contention (`ELOCKED`), the same discipline
+ * `withOccFileLock` uses: proper-lockfile's own retry loop retries blindly on
+ * any error, which would burn the whole budget re-hitting e.g. ENOENT after
+ * the branch directory was deleted out from under the caller.
+ *
+ * @throws ContentWriteLockBusyError when the budget expires under contention.
+ */
+export async function acquireContentWriteLock(branchRoot, waitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS) {
+    const startedAt = Date.now();
+    for (let attempt = 0;; attempt++) {
+        try {
+            return await tryAcquireContentWriteLock(branchRoot);
+        }
+        catch (err) {
+            if (!isNodeError(err) || err.code !== 'ELOCKED')
+                throw err;
+            const remaining = waitMs - (Date.now() - startedAt);
+            if (remaining <= 0)
+                throw new ContentWriteLockBusyError();
+            // Exponential backoff with jitter, capped so a long budget still polls
+            // often enough to pick the lock up promptly when the holder releases.
+            const base = Math.min(40 * 2 ** attempt, 250);
+            await sleep(Math.min(base * (0.5 + Math.random()), remaining));
+        }
+    }
+}
+/**
+ * Run `fn` holding the branch's content-write lock, releasing it in a
+ * `finally` so a throw can never strand it.
+ */
+export async function withContentWriteLock(branchRoot, fn, waitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS) {
+    const release = await acquireContentWriteLock(branchRoot, waitMs);
+    try {
+        return await fn();
+    }
+    finally {
+        await release();
+    }
+}
+//# sourceMappingURL=content-write-lock.js.map

package/dist/utils/content-write-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-write-lock.js","sourceRoot":"","sources":["../../src/utils/content-write-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAA;AAE5B,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAEhE,uEAAuE;AACvE,MAAM,QAAQ,GAAG,cAAc,CAAA;AAE/B,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AAE3D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,IAAI,CAAA;AAEtD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YACE,OAAO,GAAG,oIAAoI;QAE9I,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,UAAkB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACzB,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,UAAkB;IAC3D,OAAO,0BAA0B,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAC,CAAA;AACvF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,UAAkB,EAClB,SAAiB,kCAAkC;IAEnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC5B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,0BAA0B,CAAC,UAAU,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,GAAG,CAAA;YAC1D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAA;YACnD,IAAI,SAAS,IAAI,CAAC;gBAAE,MAAM,IAAI,yBAAyB,EAAE,CAAA;YACzD,uEAAuE;YACvE,sEAAsE;YACtE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,GAAG,CAAC,CAAA;YAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAA;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,UAAkB,EAClB,EAAoB,EACpB,SAAiB,kCAAkC;IAEnD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IACjE,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAA;IACnB,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/utils/error.d.ts

@@ -15,7 +15,7 @@
  * try {
  *   await riskyOperation()
  * } catch (err: unknown) {
- *   console.error('Operation failed:', getErrorMessage(err))
+ *   canopyLogError('Operation failed:', getErrorMessage(err))
  * }
  * ```
  */

package/dist/utils/error.js

@@ -15,7 +15,7 @@
  * try {
  *   await riskyOperation()
  * } catch (err: unknown) {
- *   console.error('Operation failed:', getErrorMessage(err))
+ *   canopyLogError('Operation failed:', getErrorMessage(err))
  * }
  * ```
  */

package/dist/utils/git.d.ts

@@ -56,6 +56,22 @@ export declare function isNonFastForwardRejection(message: string): boolean;
  * callers MUST pin the locale (`gitChildEnv`/`gitNetworkChildEnv`).
  */
 export declare function isStaleLeaseRejection(message: string): boolean;
+/**
+ * Whether a `git fetch <remote> <branch>` failure is specifically "that ref
+ * doesn't exist on the remote" -- the ONLY benign fetch outcome, meaning the
+ * branch has never been pushed.
+ *
+ * Narrow on purpose, and the narrowness is the whole point. This predicate
+ * exists because a bare `catch` around the fetch classified EVERY failure --
+ * unreachable remote, auth denial, permission error on the workspace, corrupt
+ * object store -- as "nothing to pull", which callers then logged as normal
+ * and proceeded past. Anything this does not recognize must reach the caller
+ * as the genuine error it is.
+ *
+ * Same locale caveat as the predicates above: the text is gettext-translated,
+ * so callers MUST run git with a locale-pinning env (`gitChildEnv`).
+ */
+export declare function isMissingRemoteRefFailure(message: string): boolean;
 /**
  * Detect the current HEAD branch name for a given repository root.
  * Returns the branch name, or the provided fallback (default 'main')

package/dist/utils/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAmBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOvD;AAyBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAKlE;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAe,GACxB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,IAAI,EAAE,aAAa,CAAA;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAAC,MAAM,CAAC,CAMlB"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAmBtD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOvD;AAyBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAKlE;AAMD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElE;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,MAAe,GACxB,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,IAAI,EAAE,aAAa,CAAA;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAAC,MAAM,CAAC,CAMlB"}

package/dist/utils/git.js

@@ -115,6 +115,28 @@ const STALE_LEASE_REASON = 'stale info';
 export function isStaleLeaseRejection(message) {
     return message.includes(REJECTED_MARKER) && message.includes(STALE_LEASE_REASON);
 }
+// git's message when `git fetch <remote> <branch>` names a ref the remote does
+// not have. Both spellings occur: modern git prints the lowercase form, older
+// versions and some transports capitalize it.
+const MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find remote ref"];
+/**
+ * Whether a `git fetch <remote> <branch>` failure is specifically "that ref
+ * doesn't exist on the remote" -- the ONLY benign fetch outcome, meaning the
+ * branch has never been pushed.
+ *
+ * Narrow on purpose, and the narrowness is the whole point. This predicate
+ * exists because a bare `catch` around the fetch classified EVERY failure --
+ * unreachable remote, auth denial, permission error on the workspace, corrupt
+ * object store -- as "nothing to pull", which callers then logged as normal
+ * and proceeded past. Anything this does not recognize must reach the caller
+ * as the genuine error it is.
+ *
+ * Same locale caveat as the predicates above: the text is gettext-translated,
+ * so callers MUST run git with a locale-pinning env (`gitChildEnv`).
+ */
+export function isMissingRemoteRefFailure(message) {
+    return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
+}
 /**
  * Detect the current HEAD branch name for a given repository root.
  * Returns the branch name, or the provided fallback (default 'main')

package/dist/utils/git.js.map

@@ -1 +1 @@
-{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAItC,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,yBAAyB,CAAA;AACxD,6EAA6E;AAC7E,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAAG,uBAAuB,CAAA;AACxD,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAA;AACnC,uEAAuE;AACvE,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,8BAA8B;AAC9B,MAAM,qBAAqB,GAAG,iBAAiB,CAAA;AAC/C,MAAM,0BAA0B,GAAG,aAAa,CAAA;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACjD,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,wEAAwE;AACxE,sEAAsE;AACtE,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAC9E,4EAA4E;AAC5E,wCAAwC;AACxC,MAAM,eAAe,GAAG,YAAY,CAAA;AACpC,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,oEAAoE;AACpE,MAAM,wBAAwB,GAAG,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAA;AACpE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,6CAA6C;AAC7C,MAAM,cAAc,GAAG,+BAA+B,CAAA;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,0BAA0B,GAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACrE,OAAO,0BAA0B,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;AACvE,CAAC;AAED,4EAA4E;AAC5E,wCAAwC;AACxC,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,WAAmB,MAAM;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAClE,OAAO,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAKvC;IACC,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAA;IAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,gBAAgB,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../src/utils/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAItC,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,yBAAyB,CAAA;AACxD,6EAA6E;AAC7E,8EAA8E;AAC9E,6DAA6D;AAC7D,MAAM,wBAAwB,GAAG,uBAAuB,CAAA;AACxD,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,sBAAsB,GAAG,IAAI,CAAA;AACnC,uEAAuE;AACvE,6EAA6E;AAC7E,8EAA8E;AAC9E,uEAAuE;AACvE,8BAA8B;AAC9B,MAAM,qBAAqB,GAAG,iBAAiB,CAAA;AAC/C,MAAM,0BAA0B,GAAG,aAAa,CAAA;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACnD,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACjD,OAAO,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7C,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,wEAAwE;AACxE,sEAAsE;AACtE,8EAA8E;AAC9E,+DAA+D;AAC/D,8EAA8E;AAC9E,4EAA4E;AAC5E,wCAAwC;AACxC,MAAM,eAAe,GAAG,YAAY,CAAA;AACpC,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,oEAAoE;AACpE,MAAM,wBAAwB,GAAG,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAA;AACpE,wEAAwE;AACxE,yEAAyE;AACzE,sEAAsE;AACtE,6CAA6C;AAC7C,MAAM,cAAc,GAAG,+BAA+B,CAAA;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,MAAM,0BAA0B,GAC9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,wBAAwB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IACrE,OAAO,0BAA0B,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;AACvE,CAAC;AAED,4EAA4E;AAC5E,wCAAwC;AACxC,MAAM,kBAAkB,GAAG,YAAY,CAAA;AAEvC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAA;AAClF,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,8CAA8C;AAC9C,MAAM,0BAA0B,GAAG,CAAC,0BAA0B,EAAE,0BAA0B,CAAC,CAAA;AAE3F;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe;IACvD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,WAAmB,MAAM;IAEzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAClE,OAAO,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAKvC;IACC,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAA;IAC/D,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,gBAAgB,CAAC,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/utils/sanitize-href.d.ts

@@ -1,9 +1,34 @@
 /**
  * Sanitize an untrusted URL for use in `href` attributes.
  *
- * Parses the input with `new URL()` and only allows `http:` and `https:` protocols,
- * blocking `javascript:`, `data:`, `vbscript:`, and other dangerous schemes.
- * Returns the fallback (default `'#'`) for invalid or disallowed URLs.
+ * Handles both absolute URLs (`https://example.com`) and relative
+ * references (`/about`, `docs/guide`, `#section`, `?q=1`) by parsing
+ * against a fixed sentinel base, then only allows `http:` and `https:`
+ * protocols, blocking `javascript:`, `data:`, `vbscript:`, and other
+ * dangerous schemes (an absolute URL supplies its own protocol regardless
+ * of the sentinel). Returns the fallback (default `'#'`) for invalid,
+ * empty, or disallowed input.
+ *
+ * Design decisions (deliberate, not oversights):
+ * - Protocol-relative input is rejected rather than resolved onto the
+ *   sentinel's `https:` scheme. In a CMS content field, `//host` is far more
+ *   likely to be a paste error or an injection attempt than an intentional
+ *   protocol-relative link, so we don't let it through as an absolute
+ *   off-site URL. This is enforced by checking whether the input DECLARES a
+ *   scheme, not by matching a `//` prefix: WHATWG URL treats backslash as
+ *   equivalent to slash for special schemes, so `/\evil.com`, `\\evil.com`
+ *   and `\/evil.com` are all protocol-relative in effect. An earlier version
+ *   of this function checked `startsWith('//')` and let all three through as
+ *   `https://evil.com/` -- an open redirect out of the one function whose
+ *   job is to prevent exactly that.
+ * - Fragment-only (`#section`) and query-only (`?q=1`) input resolves
+ *   against the sentinel with pathname `/`; we strip that synthetic leading
+ *   slash so the result stays a same-page reference (`#section`) instead of
+ *   silently becoming a navigation to the site root (`/#section`).
+ * - Path-relative input with no leading slash (`docs/guide`) is returned as
+ *   a root-relative path (`/docs/guide`). There is no notion of "current
+ *   page" at sanitize time, so true path-relative resolution can't be
+ *   reproduced faithfully - root-relative is the closest safe behavior.
  *
  * This utility breaks CodeQL's taint chain by constructing a new string from
  * the parsed URL rather than passing the original input through.

package/dist/utils/sanitize-href.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-href.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAUhE"}
+{"version":3,"file":"sanitize-href.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAyChE"}

package/dist/utils/sanitize-href.js

@@ -1,9 +1,38 @@
+// Fixed sentinel base so relative references (root-relative, path-relative,
+// fragment-only, query-only) resolve instead of throwing under `new URL()`.
+// Never exposed in output - see the relative-reference branch below.
+const SENTINEL_BASE = 'https://relative.invalid';
 /**
  * Sanitize an untrusted URL for use in `href` attributes.
  *
- * Parses the input with `new URL()` and only allows `http:` and `https:` protocols,
- * blocking `javascript:`, `data:`, `vbscript:`, and other dangerous schemes.
- * Returns the fallback (default `'#'`) for invalid or disallowed URLs.
+ * Handles both absolute URLs (`https://example.com`) and relative
+ * references (`/about`, `docs/guide`, `#section`, `?q=1`) by parsing
+ * against a fixed sentinel base, then only allows `http:` and `https:`
+ * protocols, blocking `javascript:`, `data:`, `vbscript:`, and other
+ * dangerous schemes (an absolute URL supplies its own protocol regardless
+ * of the sentinel). Returns the fallback (default `'#'`) for invalid,
+ * empty, or disallowed input.
+ *
+ * Design decisions (deliberate, not oversights):
+ * - Protocol-relative input is rejected rather than resolved onto the
+ *   sentinel's `https:` scheme. In a CMS content field, `//host` is far more
+ *   likely to be a paste error or an injection attempt than an intentional
+ *   protocol-relative link, so we don't let it through as an absolute
+ *   off-site URL. This is enforced by checking whether the input DECLARES a
+ *   scheme, not by matching a `//` prefix: WHATWG URL treats backslash as
+ *   equivalent to slash for special schemes, so `/\evil.com`, `\\evil.com`
+ *   and `\/evil.com` are all protocol-relative in effect. An earlier version
+ *   of this function checked `startsWith('//')` and let all three through as
+ *   `https://evil.com/` -- an open redirect out of the one function whose
+ *   job is to prevent exactly that.
+ * - Fragment-only (`#section`) and query-only (`?q=1`) input resolves
+ *   against the sentinel with pathname `/`; we strip that synthetic leading
+ *   slash so the result stays a same-page reference (`#section`) instead of
+ *   silently becoming a navigation to the site root (`/#section`).
+ * - Path-relative input with no leading slash (`docs/guide`) is returned as
+ *   a root-relative path (`/docs/guide`). There is no notion of "current
+ *   page" at sanitize time, so true path-relative resolution can't be
+ *   reproduced faithfully - root-relative is the closest safe behavior.
  *
  * This utility breaks CodeQL's taint chain by constructing a new string from
  * the parsed URL rather than passing the original input through.
@@ -16,11 +45,40 @@
  * ```
  */
 export function sanitizeHref(url, fallback = '#') {
+    const trimmed = url.trim();
+    if (trimmed === '')
+        return fallback;
     try {
-        const parsed = new URL(url);
-        if (parsed.protocol === 'http:' || parsed.protocol === 'https:') {
-            return parsed.href;
+        const parsed = new URL(trimmed, SENTINEL_BASE);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return fallback;
+        }
+        // Reject protocol-relative references in EVERY spelling, by testing the
+        // property we actually care about rather than by enumerating syntax.
+        //
+        // A string-prefix check on '//' is not sufficient: WHATWG URL treats a
+        // backslash as equivalent to a forward slash for special schemes, so
+        // '/\evil.com', '\\evil.com' and '\/evil.com' are all protocol-relative
+        // in effect and each resolved to https://evil.com/ while sailing past a
+        // startsWith('//') guard. Tabs and newlines are stripped during parsing
+        // too, so the set of spellings is not one you can enumerate confidently.
+        //
+        // The property that actually distinguishes "the author asked for another
+        // origin" from "the parser inferred one" is whether the input DECLARES a
+        // scheme. If it does not and still resolved off the sentinel, it is
+        // protocol-relative however it was written.
+        const declaresScheme = /^[a-z][a-z0-9+.-]*:/i.test(trimmed);
+        if (parsed.origin !== SENTINEL_BASE && !declaresScheme)
+            return fallback;
+        if (parsed.origin === SENTINEL_BASE) {
+            // Input was relative: return it as a relative reference rather than
+            // an absolute URL rebased onto the sentinel host.
+            const relative = parsed.pathname + parsed.search + parsed.hash;
+            // Fragment-only/query-only input resolves with pathname '/'; strip
+            // that synthetic leading slash so it stays a same-page reference.
+            return parsed.pathname === '/' && !trimmed.startsWith('/') ? relative.slice(1) : relative;
         }
+        return parsed.href;
     }
     catch {
         // invalid URL

package/dist/utils/sanitize-href.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize-href.js","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAQ,GAAG,GAAG;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,MAAM,CAAC,IAAI,CAAA;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"sanitize-href.js","sourceRoot":"","sources":["../../src/utils/sanitize-href.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,qEAAqE;AACrE,MAAM,aAAa,GAAG,0BAA0B,CAAA;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAQ,GAAG,GAAG;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAA;IAEnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;QAC9C,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,wEAAwE;QACxE,qEAAqE;QACrE,EAAE;QACF,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,4CAA4C;QAC5C,MAAM,cAAc,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC3D,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,cAAc;YAAE,OAAO,QAAQ,CAAA;QAEvE,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,oEAAoE;YACpE,kDAAkD;YAClD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAA;YAC9D,mEAAmE;YACnE,kEAAkE;YAClE,OAAO,MAAM,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC3F,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/validation/entry-link-validator.d.ts

@@ -20,7 +20,7 @@ export interface EntryLinkValidationResult {
 /**
  * Validate entry links in body/markdown/mdx fields of the provided data.
  *
- * Scans all markdown, mdx, and rich-text fields for entry:ID patterns
+ * Scans all markdown and mdx fields for entry:ID patterns
  * and checks that each referenced ID exists in the content index.
  */
 export declare function validateEntryLinks(data: Record<string, unknown>, schema: readonly FieldConfig[], idIndex: ContentIdIndex, bodyContent?: string): EntryLinkValidationResult;

package/dist/validation/entry-link-validator.js

@@ -11,7 +11,7 @@ import { findFieldsByType } from './field-traversal.js';
 /**
  * Validate entry links in body/markdown/mdx fields of the provided data.
  *
- * Scans all markdown, mdx, and rich-text fields for entry:ID patterns
+ * Scans all markdown and mdx fields for entry:ID patterns
  * and checks that each referenced ID exists in the content index.
  */
 export function validateEntryLinks(data, schema, idIndex, bodyContent) {
@@ -20,8 +20,8 @@ export function validateEntryLinks(data, schema, idIndex, bodyContent) {
     if (bodyContent) {
         checkText(bodyContent, 'body', 'body', idIndex, warnings);
     }
-    // Check markdown/mdx/rich-text fields in structured data
-    const markdownTypes = ['markdown', 'mdx', 'rich-text'];
+    // Check markdown/mdx fields in structured data
+    const markdownTypes = ['markdown', 'mdx'];
     for (const fieldType of markdownTypes) {
         const contexts = findFieldsByType(schema, data, fieldType);
         for (const ctx of contexts) {

package/dist/validation/entry-link-validator.js.map

@@ -1 +1 @@
-{"version":3,"file":"entry-link-validator.js","sourceRoot":"","sources":["../../src/validation/entry-link-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA6B,EAC7B,MAA8B,EAC9B,OAAuB,EACvB,WAAoB;IAEpB,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,sEAAsE;IACtE,IAAI,WAAW,EAAE,CAAC;QAChB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAED,yDAAyD;IACzD,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,WAAW,CAAU,CAAA;IAC/D,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAC1D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,OAAuB,EACvB,QAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,SAAS;gBAChB,SAAS;gBACT,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,OAAO,EAAE,sCAAsC,IAAI,CAAC,EAAE,EAAE;aACzD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"entry-link-validator.js","sourceRoot":"","sources":["../../src/validation/entry-link-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAapD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA6B,EAC7B,MAA8B,EAC9B,OAAuB,EACvB,WAAoB;IAEpB,MAAM,QAAQ,GAAuB,EAAE,CAAA;IAEvC,sEAAsE;IACtE,IAAI,WAAW,EAAE,CAAC;QAChB,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;IAED,+CAA+C;IAC/C,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,KAAK,CAAU,CAAA;IAClD,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;QAC1D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC/C,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAA;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,CAAA;AACrB,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,OAAuB,EACvB,QAA4B;IAE5B,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,SAAS;gBAChB,SAAS;gBACT,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,OAAO,EAAE,sCAAsC,IAAI,CAAC,EAAE,EAAE;aACzD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/validation/entry-validator.js

@@ -28,7 +28,7 @@ import { findBodyFieldName } from '../utils/body-field.js';
 import { isDataOnlyFormat } from '../utils/format.js';
 const KNOWN_FIELD_TYPES = new Set(fieldTypes);
 /** Field types whose value is a plain string. */
-const STRING_FIELD_TYPES = new Set(['string', 'rich-text', 'markdown', 'mdx', 'code']);
+const STRING_FIELD_TYPES = new Set(['string', 'markdown', 'mdx', 'code']);
 function isPlainRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }