canopycms 0.0.62 → 0.0.63

package/dist/authorization/branch.js

@@ -4,10 +4,20 @@
  * Handles checking if a user can access a branch based on ACLs.
  */
 import { isAdmin, isReviewer } from './helpers.js';
+import { getBranchProtection } from './protected-branch.js';
 /**
  * Check if user has access to a branch with explicit default behavior.
+ *
+ * Precedence, highest first:
+ * 1. Admins and Reviewers
+ * 2. `managerOrAdminAllowed` lockdown
+ * 3. An explicit user/group ACL -- an allowlist omitting the creator still
+ *    denies them, so an admin can lock down a branch someone else created
+ * 4. With no ACL: the branch creator, then `defaultAccess`, and only where that
+ *    would deny, the protected base branch grant
+ *    (see {@link BranchAccessOptions.isProtectedBranch})
  */
-export function checkBranchAccessWithDefault(context, user, defaultAccess = 'deny') {
+export function checkBranchAccessWithDefault(context, user, defaultAccess = 'deny', options) {
     // Admins and Reviewers have full branch access
     if (isAdmin(user.groups) || isReviewer(user.groups)) {
         return { allowed: true, reason: 'privileged' };
@@ -16,12 +26,34 @@ export function checkBranchAccessWithDefault(context, user, defaultAccess = 'den
     const hasUserConstraint = !!access.allowedUsers?.length;
     const hasGroupConstraint = !!access.allowedGroups?.length;
     const managerOrAdminAllowed = access.managerOrAdminAllowed ?? false;
+    if (!hasUserConstraint && !hasGroupConstraint && managerOrAdminAllowed) {
+        return { allowed: false, reason: 'denied_by_acl' };
+    }
     if (!hasUserConstraint && !hasGroupConstraint) {
-        if (managerOrAdminAllowed) {
-            return { allowed: false, reason: 'denied_by_acl' };
+        // The branch creator owns their own un-ACL'd branch. This matches the three
+        // places the server already grants on creator-ownership independently of
+        // branch access (listBranchesHandler, canDeleteBranch, canModifyBranchAccess)
+        // -- without it, under 'deny' a creator could delete their branch and rewrite
+        // its ACL but not read a single file on it.
+        //
+        // Deliberately scoped to the no-ACL case: an EXPLICIT allowlist that omits
+        // the creator still denies them, because that is how an admin locks down a
+        // branch someone else created. Granting creator ahead of the ACL would make
+        // that lockdown silently ineffective.
+        if (context.branch.createdBy === user.userId) {
+            return { allowed: true, reason: 'creator' };
+        }
+        if (defaultAccess === 'allow') {
+            return { allowed: true, reason: 'no_acl' };
         }
-        const allowed = defaultAccess === 'allow';
-        return { allowed, reason: 'no_acl' };
+        // Same scoping rationale for the base branch: only where the bare default
+        // would otherwise decide. A short-circuit higher up would replace
+        // 'allowed_by_acl' with 'base_branch' and silently strip Withdraw rights
+        // from ACL-listed users, and would override an explicit 'denied_by_acl'.
+        if (options?.isProtectedBranch) {
+            return { allowed: true, reason: 'base_branch' };
+        }
+        return { allowed: false, reason: 'no_acl' };
     }
     const userAllowed = hasUserConstraint && access.allowedUsers?.includes(user.userId);
     const groupAllowed = hasGroupConstraint && user.groups?.some((g) => access.allowedGroups?.includes(g));
@@ -30,9 +62,17 @@ export function checkBranchAccessWithDefault(context, user, defaultAccess = 'den
 }
 /**
  * Create a branch access checker with bound default access.
+ *
+ * `config` is needed to resolve whether a branch is the protected base branch;
+ * it routes through `getBranchProtection`, the single source of truth for that
+ * question, rather than repeating the base-branch test here.
  */
-export function createCheckBranchAccess(defaultAccess = 'deny') {
-    return (context, user) => checkBranchAccessWithDefault(context, user, defaultAccess);
+export function createCheckBranchAccess(defaultAccess = 'deny', config) {
+    return (context, user) => checkBranchAccessWithDefault(context, user, defaultAccess, {
+        isProtectedBranch: config
+            ? getBranchProtection(config, context.branch.name, context.branch.baseBranch).isProtected
+            : false,
+    });
 }
 /**
  * Check if user can perform workflow actions (submit/withdraw) on a branch.
@@ -45,10 +85,16 @@ export function createCheckBranchAccess(defaultAccess = 'deny') {
  * - Admins and Reviewers always have access (via checkBranchAccess)
  * - Unless `options.isProtectedBranch` is set, in which case the system-branch
  *   grant above is disabled (see {@link WorkflowActionOptions})
+ *
+ * The creator grant is enforced twice over: `checkBranchAccessWithDefault` now
+ * admits the creator (so the gate below no longer swallows them under
+ * `defaultBranchAccess: 'deny'`), and `userIsCreator` still decides the result.
  */
 export function canPerformWorkflowAction(context, user, defaultAccess = 'deny', options) {
-    // Check if user has general branch access (handles admins, reviewers, ACLs)
-    const accessResult = checkBranchAccessWithDefault(context, user, defaultAccess);
+    // Check if user has general branch access (handles admins, reviewers, creator, ACLs)
+    const accessResult = checkBranchAccessWithDefault(context, user, defaultAccess, {
+        isProtectedBranch: options?.isProtectedBranch,
+    });
     // If user doesn't have basic branch access, deny immediately
     if (!accessResult.allowed) {
         return false;

package/dist/authorization/branch.js.map

@@ -1 +1 @@
-{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../src/authorization/branch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAI/C;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM;IAE3C,+CAA+C;IAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IACzD,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAA;IAEnE,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;QACpD,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,KAAK,OAAO,CAAA;QACzC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IACtC,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAEnF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAA;AAC1E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,gBAAqC,MAAM;IACjF,OAAO,CAAC,OAAsB,EAAE,IAAgB,EAAsB,EAAE,CACtE,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;AAC9D,CAAC;AAcD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM,EAC3C,OAA+B;IAE/B,4EAA4E;IAC5E,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,CAAA;IAE/E,6DAA6D;IAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAA;IAE9D,kFAAkF;IAClF,MAAM,cAAc,GAClB,CAAC,OAAO,EAAE,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAA;IAEhF,YAAY;IACZ,6BAA6B;IAC7B,wEAAwE;IACxE,uCAAuC;IACvC,OAAO,CACL,aAAa;QACb,YAAY,CAAC,MAAM,KAAK,YAAY;QACpC,YAAY,CAAC,MAAM,KAAK,gBAAgB;QACxC,CAAC,cAAc,IAAI,YAAY,CAAC,OAAO,CAAC,CACzC,CAAA;AACH,CAAC"}
+{"version":3,"file":"branch.js","sourceRoot":"","sources":["../../src/authorization/branch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAiCxD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM,EAC3C,OAA6B;IAE7B,+CAA+C;IAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAA;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAA;IACvD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAA;IACzD,MAAM,qBAAqB,GAAG,MAAM,CAAC,qBAAqB,IAAI,KAAK,CAAA;IAEnE,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,IAAI,qBAAqB,EAAE,CAAC;QACvE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IACpD,CAAC;IAED,IAAI,CAAC,iBAAiB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,4EAA4E;QAC5E,yEAAyE;QACzE,8EAA8E;QAC9E,8EAA8E;QAC9E,4CAA4C;QAC5C,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,sCAAsC;QACtC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;QAC7C,CAAC;QACD,IAAI,aAAa,KAAK,OAAO,EAAE,CAAC;YAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;QAC5C,CAAC;QACD,0EAA0E;QAC1E,kEAAkE;QAClE,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,OAAO,EAAE,iBAAiB,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAA;QACjD,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC7C,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,IAAI,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnF,MAAM,YAAY,GAChB,kBAAkB,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAEnF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAA;IACpD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,gBAAqC,MAAM,EAC3C,MAAyD;IAEzD,OAAO,CAAC,OAAsB,EAAE,IAAgB,EAAsB,EAAE,CACtE,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;QACzD,iBAAiB,EAAE,MAAM;YACvB,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW;YACzF,CAAC,CAAC,KAAK;KACV,CAAC,CAAA;AACN,CAAC;AAqBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAsB,EACtB,IAAgB,EAChB,gBAAqC,MAAM,EAC3C,OAA+B;IAE/B,qFAAqF;IACrF,MAAM,YAAY,GAAG,4BAA4B,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE;QAC9E,iBAAiB,EAAE,OAAO,EAAE,iBAAiB;KAC9C,CAAC,CAAA;IAEF,6DAA6D;IAC7D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,CAAA;IAE9D,kFAAkF;IAClF,MAAM,cAAc,GAClB,CAAC,OAAO,EAAE,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,kBAAkB,CAAA;IAEhF,YAAY;IACZ,6BAA6B;IAC7B,wEAAwE;IACxE,uCAAuC;IACvC,OAAO,CACL,aAAa;QACb,YAAY,CAAC,MAAM,KAAK,YAAY;QACpC,YAAY,CAAC,MAAM,KAAK,gBAAgB;QACxC,CAAC,cAAc,IAAI,YAAY,CAAC,OAAO,CAAC,CACzC,CAAA;AACH,CAAC"}

package/dist/authorization/types.d.ts

@@ -19,7 +19,7 @@ export type PermissionPath = string & {
  */
 export interface BranchAccessResult {
     allowed: boolean;
-    reason: 'privileged' | 'allowed_by_acl' | 'denied_by_acl' | 'no_acl';
+    reason: 'privileged' | 'base_branch' | 'creator' | 'allowed_by_acl' | 'denied_by_acl' | 'no_acl';
 }
 /**
  * Result of checking path-level permissions

package/dist/authorization/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAG3D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE3C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE5E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,YAAY,GAAG,gBAAgB,GAAG,eAAe,GAAG,QAAQ,CAAA;CACrE;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,WAAW,EAAE,cAAc,CAAA;IAChD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,kBAAkB,CAAA;IAC1B,IAAI,EAAE,oBAAoB,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,CACjB,OAAO,EAAE,OAAO,UAAU,EAAE,aAAa,EACzC,IAAI,EAAE,OAAO,SAAS,EAAE,UAAU,KAC/B,kBAAkB,CAAA;IACvB,mBAAmB,EAAE,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,mBAAmB,EAAE,aAAa,KAC5C,OAAO,CAAC,OAAO,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;IAClD,iBAAiB,EAAE,OAAO,WAAW,EAAE,iBAAiB,CAAA;IACxD,IAAI,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAA;IAC/C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CAC9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/authorization/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAG3D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,CAAA;AAE3C;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAA;AAE5E;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,YAAY,GAAG,aAAa,GAAG,SAAS,GAAG,gBAAgB,GAAG,eAAe,GAAG,QAAQ,CAAA;CACjG;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,WAAW,EAAE,cAAc,CAAA;IAChD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,kBAAkB,CAAA;IAC1B,IAAI,EAAE,oBAAoB,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,iBAAiB,EAAE,CACjB,OAAO,EAAE,OAAO,UAAU,EAAE,aAAa,EACzC,IAAI,EAAE,OAAO,SAAS,EAAE,UAAU,KAC/B,kBAAkB,CAAA;IACvB,mBAAmB,EAAE,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,OAAO,mBAAmB,EAAE,aAAa,KAC5C,OAAO,CAAC,OAAO,WAAW,EAAE,cAAc,EAAE,CAAC,CAAA;IAClD,iBAAiB,EAAE,OAAO,WAAW,EAAE,iBAAiB,CAAA;IACxD,IAAI,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAA;IAC/C;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CAC9C"}

package/dist/build-canopy.d.ts

@@ -0,0 +1,49 @@
+import type { CanopyConfig } from './config';
+import type { EntrySchemaRegistry } from './schema/types';
+import { type CanopyBuildContext } from './context';
+export interface CreateBuildCanopyOptions {
+    /**
+     * Entry schema registry for resolving `.collection.json` references.
+     * Same shape as `createCanopyServices`'s option of the same name.
+     */
+    entrySchemaRegistry?: EntrySchemaRegistry;
+}
+/**
+ * One-call factory for a **build/admin** Canopy context — for standalone
+ * scripts that run entirely outside a Next.js request or build phase (index
+ * builders, content audits, codegen, ad hoc reports).
+ *
+ * **This is a build/admin context: it reads the filesystem directly as a
+ * synthetic admin user (`STATIC_DEPLOY_USER`) and bypasses ALL branch and
+ * path ACLs.** There is no per-request auth to enforce because there is no
+ * request. Do not reach for this from request-handling code (an API route,
+ * a server component rendering for a specific visitor, anything with a real
+ * user on the other end) — there, use `createNextCanopyContext(...)`'s
+ * `getCanopy()` (or its phase-selecting `read`/`readByUrlPath`), which
+ * enforce branch/path permissions per user. This factory mirrors the same
+ * `createCanopyServices` + `createCanopyContext` + `STATIC_DEPLOY_USER` boot
+ * sequence that `createNextCanopyContext`'s own `getCanopyForBuild()` uses
+ * internally, minus the Next.js pieces (no `next/headers`, no React
+ * `cache()`, no request-time misuse guard — there is no request phase for
+ * it to guard against) — so it works in a plain script run with `tsx`/`node`.
+ *
+ * Trivially stubbable by design: the boot sequence is one function call
+ * taking a plain config object and returning a plain context, so a script
+ * that calls it can be imported and exercised from a test with the config
+ * (or this function itself) swapped out. Contrast with a hand-rolled
+ * top-level-`await` boot block, which can never be imported by a test at
+ * all — that's the concrete problem this factory removes.
+ *
+ * @example
+ * ```ts
+ * // scripts/build-search-index.ts
+ * import { createBuildCanopy } from 'canopycms/server'
+ * import config from '../canopycms.config'
+ * import { entrySchemaRegistry } from '../src/schemas'
+ *
+ * const canopy = await createBuildCanopy(config.server, { entrySchemaRegistry })
+ * const entries = await canopy.listEntries()
+ * ```
+ */
+export declare function createBuildCanopy(config: CanopyConfig, options?: CreateBuildCanopyOptions): Promise<CanopyBuildContext>;
+//# sourceMappingURL=build-canopy.d.ts.map

package/dist/build-canopy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-canopy.d.ts","sourceRoot":"","sources":["../src/build-canopy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAEzD,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,WAAW,CAAA;AAGxE,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,kBAAkB,CAAC,CAiB7B"}

package/dist/build-canopy.js

@@ -0,0 +1,51 @@
+import { createCanopyServices } from './services.js';
+import { createCanopyContext } from './context.js';
+import { STATIC_DEPLOY_USER } from './build-mode.js';
+/**
+ * One-call factory for a **build/admin** Canopy context — for standalone
+ * scripts that run entirely outside a Next.js request or build phase (index
+ * builders, content audits, codegen, ad hoc reports).
+ *
+ * **This is a build/admin context: it reads the filesystem directly as a
+ * synthetic admin user (`STATIC_DEPLOY_USER`) and bypasses ALL branch and
+ * path ACLs.** There is no per-request auth to enforce because there is no
+ * request. Do not reach for this from request-handling code (an API route,
+ * a server component rendering for a specific visitor, anything with a real
+ * user on the other end) — there, use `createNextCanopyContext(...)`'s
+ * `getCanopy()` (or its phase-selecting `read`/`readByUrlPath`), which
+ * enforce branch/path permissions per user. This factory mirrors the same
+ * `createCanopyServices` + `createCanopyContext` + `STATIC_DEPLOY_USER` boot
+ * sequence that `createNextCanopyContext`'s own `getCanopyForBuild()` uses
+ * internally, minus the Next.js pieces (no `next/headers`, no React
+ * `cache()`, no request-time misuse guard — there is no request phase for
+ * it to guard against) — so it works in a plain script run with `tsx`/`node`.
+ *
+ * Trivially stubbable by design: the boot sequence is one function call
+ * taking a plain config object and returning a plain context, so a script
+ * that calls it can be imported and exercised from a test with the config
+ * (or this function itself) swapped out. Contrast with a hand-rolled
+ * top-level-`await` boot block, which can never be imported by a test at
+ * all — that's the concrete problem this factory removes.
+ *
+ * @example
+ * ```ts
+ * // scripts/build-search-index.ts
+ * import { createBuildCanopy } from 'canopycms/server'
+ * import config from '../canopycms.config.js'
+ * import { entrySchemaRegistry } from '../src/schemas.js'
+ *
+ * const canopy = await createBuildCanopy(config.server, { entrySchemaRegistry })
+ * const entries = await canopy.listEntries()
+ * ```
+ */
+export async function createBuildCanopy(config, options = {}) {
+    const services = await createCanopyServices(config, {
+        entrySchemaRegistry: options.entrySchemaRegistry,
+    });
+    const { buildContentTree, listEntries, read, readByUrlPath, services: contextServices, } = await createCanopyContext({
+        services,
+        extractUser: async () => STATIC_DEPLOY_USER,
+    }).getContext();
+    return { buildContentTree, listEntries, read, readByUrlPath, services: contextServices };
+}
+//# sourceMappingURL=build-canopy.js.map

package/dist/build-canopy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-canopy.js","sourceRoot":"","sources":["../src/build-canopy.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAA2B,MAAM,WAAW,CAAA;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAUjD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoB,EACpB,UAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE;QAClD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CAAA;IAEF,MAAM,EACJ,gBAAgB,EAChB,WAAW,EACX,IAAI,EACJ,aAAa,EACb,QAAQ,EAAE,eAAe,GAC1B,GAAG,MAAM,mBAAmB,CAAC;QAC5B,QAAQ;QACR,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,kBAAkB;KAC5C,CAAC,CAAC,UAAU,EAAE,CAAA;IAEf,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAA;AAC1F,CAAC"}

package/dist/cli/cli.js

@@ -2590,14 +2590,44 @@ function parseComponentProps(attrString) {
   }
   return props;
 }
+function isFenceCloseLine(line, marker) {
+  return line.startsWith(marker) && /^\s*$/.test(line.slice(marker.length));
+}
+function maskFencedCodeBlocks(body, blocks) {
+  const lines = body.split("\n");
+  const lineCount = lines.length;
+  const nextCloseLine = {
+    "```": new Array(lineCount + 1).fill(-1),
+    "~~~": new Array(lineCount + 1).fill(-1)
+  };
+  for (let i2 = lineCount - 1; i2 >= 0; i2--) {
+    nextCloseLine["```"][i2] = isFenceCloseLine(lines[i2], "```") ? i2 : nextCloseLine["```"][i2 + 1];
+    nextCloseLine["~~~"][i2] = isFenceCloseLine(lines[i2], "~~~") ? i2 : nextCloseLine["~~~"][i2 + 1];
+  }
+  const outLines = [];
+  let i = 0;
+  while (i < lineCount) {
+    const line = lines[i];
+    const marker = line.startsWith("```") ? "```" : line.startsWith("~~~") ? "~~~" : null;
+    const searchFrom = i + 2;
+    const closeIndex = marker && searchFrom < lineCount ? nextCloseLine[marker][searchFrom] : -1;
+    if (!marker || closeIndex === -1) {
+      outLines.push(line);
+      i++;
+      continue;
+    }
+    const block = lines.slice(i, closeIndex + 1).join("\n");
+    const idx = blocks.length;
+    blocks.push(block);
+    outLines.push(`${BLOCK_PREFIX}${idx}${BLOCK_SUFFIX}`);
+    i = closeIndex + 1;
+  }
+  return outLines.join("\n");
+}
 function maskCodeBlocks(body) {
   const blocks = [];
   const inlines = [];
-  let masked = body.replace(/^(```|~~~).*\n[\s\S]*?\n\1\s*$/gm, (block) => {
-    const idx = blocks.length;
-    blocks.push(block);
-    return `${BLOCK_PREFIX}${idx}${BLOCK_SUFFIX}`;
-  });
+  let masked = maskFencedCodeBlocks(body, blocks);
   masked = masked.replace(/``[^`]+``|`[^`]+`/g, (span) => {
     const idx = inlines.length;
     inlines.push(span);
@@ -3631,16 +3661,25 @@ async function resolveBranchRoot(config) {
   });
   return context.branchRoot;
 }
-async function listEntries(branchRoot, flatSchema, contentRootName, options) {
+async function listEntries(branchRoot, flatSchema, contentRootName, options, visibility) {
   const rootPath = options?.rootPath ?? contentRootName;
   const extract = options?.extract;
   const filter = options?.filter;
   const customSort = options?.sort;
   const collections = flatSchema.filter((item) => item.type === "collection" && item.entries !== void 0 && (item.logicalPath === rootPath || item.logicalPath.startsWith(`${rootPath}/`)));
+  const shouldInclude = visibility?.shouldInclude;
+  const skippedFiles = [];
   const collectionResults = await Promise.all(collections.map(async (collection) => {
-    const entries = await listCollectionEntries(branchRoot, collection);
-    return entries.map((entry) => ({ entry, collection }));
+    const entries = await listCollectionEntries(branchRoot, collection, (file) => skippedFiles.push(file));
+    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.physicalPath)) : entries;
+    return visible.map((entry) => ({ entry, collection }));
   }));
+  if (isBuildMode() && skippedFiles.length > 0) {
+    const lines = skippedFiles.map(({ filename, collectionPath }) => `  - ${collectionPath}/${filename}`);
+    throw new Error(`CanopyCMS static build: found ${skippedFiles.length} file(s) that look like malformed content entries inside a content collection:
+${lines.join("\n")}
+Expected {type}.{slug}.{id}.{ext} with a known entry type (a name declared in that collection's entries config) and a valid 12-char Base58 ID. This usually means a schema rename without a matching file rename, an entry type declared in one collection but not another, or a stray file placed directly in a collection directory. If this is meant to be a colocated sibling artifact (e.g. an entry's contentId-prefixed data file read via an entryTransforms readSibling call), keep its name to three or fewer dot-separated segments (id.suffix.ext) so it is never mistaken for an entry attempt. Otherwise rename or move the file, or fix the schema, then rebuild.`);
+  }
   const contentPrefix = contentRootName ? `${contentRootName}/` : "";
   const items = [];
   for (const results of collectionResults) {
@@ -3667,7 +3706,8 @@ async function listEntries(branchRoot, flatSchema, contentRootName, options) {
         entryType: entry.entryType,
         format: entry.format,
         data,
-        schema: collection.entries?.find((e) => e.name === entry.entryType)?.schema
+        schema: collection.entries?.find((e) => e.name === entry.entryType)?.schema,
+        updatedAt: entry.updatedAt
       };
       if (filter && !filter(item))
         continue;
@@ -4022,7 +4062,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, active2, init_logger2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, active2, init_logger2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -7846,29 +7886,38 @@ var init_generate_ai_content = __esm({
       }
     };
     parseTypedFilename = (filename, entryTypes) => {
+      if (filename.startsWith("."))
+        return null;
       const lastDot = filename.lastIndexOf(".");
       if (lastDot === -1)
         return null;
       const nameWithoutExt = filename.slice(0, lastDot);
       const parts = nameWithoutExt.split(".");
-      if (parts.length >= 3) {
-        const potentialType = parts[0];
-        const matchingType = entryTypes.find((e) => e.name === potentialType);
-        if (matchingType) {
-          const id = parts[parts.length - 1];
-          if (!isValidId(id))
-            return null;
-          const slug = parts.slice(1, -1).join(".").toLowerCase();
-          return {
-            type: potentialType,
-            slug,
-            id
-          };
-        }
+      if (parts.length < 3)
+        return null;
+      const potentialType = parts[0];
+      if (entryTypes && !entryTypes.some((e) => e.name === potentialType)) {
+        return null;
       }
-      return null;
+      const id = parts[parts.length - 1];
+      if (!isValidId(id))
+        return null;
+      const slug = parts.slice(1, -1).join(".").toLowerCase();
+      return {
+        type: potentialType,
+        slug,
+        id
+      };
     };
-    listCollectionEntries = async (root, collection) => {
+    looksLikeMalformedEntry = (filename, entryTypes) => {
+      if (filename.startsWith(".") || filename.startsWith("_"))
+        return false;
+      const segments = filename.split(".");
+      if (segments.length >= 4)
+        return true;
+      return segments.length === 3 && entryTypes.some((e) => e.name === segments[0]);
+    };
+    listCollectionEntries = async (root, collection, onSkip) => {
       if (collection.type !== "collection" || !collection.entries) {
         return [];
       }
@@ -7901,6 +7950,9 @@ var init_generate_ai_content = __esm({
         const parsed = parseTypedFilename(file.name, entryTypes);
         if (!parsed) {
           log7.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
+          if (looksLikeMalformedEntry(file.name, entryTypes)) {
+            onSkip?.({ filename: file.name, collectionPath: collection.logicalPath });
+          }
           return null;
         }
         const { type: entryTypeName, slug, id: contentId } = parsed;

package/dist/cli/generate-ai-content.js

@@ -3298,14 +3298,44 @@ var BLOCK_RESTORE_RE = /<<CODEBLOCK(\d+)>>/g;
 var INLINE_PREFIX = "<<INLINECODE";
 var INLINE_SUFFIX = ">>";
 var INLINE_RESTORE_RE = /<<INLINECODE(\d+)>>/g;
+function isFenceCloseLine(line, marker) {
+  return line.startsWith(marker) && /^\s*$/.test(line.slice(marker.length));
+}
+function maskFencedCodeBlocks(body, blocks) {
+  const lines = body.split("\n");
+  const lineCount = lines.length;
+  const nextCloseLine = {
+    "```": new Array(lineCount + 1).fill(-1),
+    "~~~": new Array(lineCount + 1).fill(-1)
+  };
+  for (let i2 = lineCount - 1; i2 >= 0; i2--) {
+    nextCloseLine["```"][i2] = isFenceCloseLine(lines[i2], "```") ? i2 : nextCloseLine["```"][i2 + 1];
+    nextCloseLine["~~~"][i2] = isFenceCloseLine(lines[i2], "~~~") ? i2 : nextCloseLine["~~~"][i2 + 1];
+  }
+  const outLines = [];
+  let i = 0;
+  while (i < lineCount) {
+    const line = lines[i];
+    const marker = line.startsWith("```") ? "```" : line.startsWith("~~~") ? "~~~" : null;
+    const searchFrom = i + 2;
+    const closeIndex = marker && searchFrom < lineCount ? nextCloseLine[marker][searchFrom] : -1;
+    if (!marker || closeIndex === -1) {
+      outLines.push(line);
+      i++;
+      continue;
+    }
+    const block = lines.slice(i, closeIndex + 1).join("\n");
+    const idx = blocks.length;
+    blocks.push(block);
+    outLines.push(`${BLOCK_PREFIX}${idx}${BLOCK_SUFFIX}`);
+    i = closeIndex + 1;
+  }
+  return outLines.join("\n");
+}
 function maskCodeBlocks(body) {
   const blocks = [];
   const inlines = [];
-  let masked = body.replace(/^(```|~~~).*\n[\s\S]*?\n\1\s*$/gm, (block) => {
-    const idx = blocks.length;
-    blocks.push(block);
-    return `${BLOCK_PREFIX}${idx}${BLOCK_SUFFIX}`;
-  });
+  let masked = maskFencedCodeBlocks(body, blocks);
   masked = masked.replace(/``[^`]+``|`[^`]+`/g, (span) => {
     const idx = inlines.length;
     inlines.push(span);
@@ -5772,38 +5802,48 @@ var readEntryData = async (filePath, format, bodyFieldName = "body") => {
   }
 };
 var parseTypedFilename = (filename, entryTypes) => {
+  if (filename.startsWith("."))
+    return null;
   const lastDot = filename.lastIndexOf(".");
   if (lastDot === -1)
     return null;
   const nameWithoutExt = filename.slice(0, lastDot);
   const parts = nameWithoutExt.split(".");
-  if (parts.length >= 3) {
-    const potentialType = parts[0];
-    const matchingType = entryTypes.find((e) => e.name === potentialType);
-    if (matchingType) {
-      const id = parts[parts.length - 1];
-      if (!isValidId(id))
-        return null;
-      const slug = parts.slice(1, -1).join(".").toLowerCase();
-      return {
-        type: potentialType,
-        slug,
-        id
-      };
-    }
+  if (parts.length < 3)
+    return null;
+  const potentialType = parts[0];
+  if (entryTypes && !entryTypes.some((e) => e.name === potentialType)) {
+    return null;
   }
-  return null;
+  const id = parts[parts.length - 1];
+  if (!isValidId(id))
+    return null;
+  const slug = parts.slice(1, -1).join(".").toLowerCase();
+  return {
+    type: potentialType,
+    slug,
+    id
+  };
 };
-async function listEntries(branchRoot, flatSchema, contentRootName, options) {
+async function listEntries(branchRoot, flatSchema, contentRootName, options, visibility) {
   const rootPath = options?.rootPath ?? contentRootName;
   const extract = options?.extract;
   const filter = options?.filter;
   const customSort = options?.sort;
   const collections = flatSchema.filter((item) => item.type === "collection" && item.entries !== void 0 && (item.logicalPath === rootPath || item.logicalPath.startsWith(`${rootPath}/`)));
+  const shouldInclude = visibility?.shouldInclude;
+  const skippedFiles = [];
   const collectionResults = await Promise.all(collections.map(async (collection) => {
-    const entries = await listCollectionEntries(branchRoot, collection);
-    return entries.map((entry) => ({ entry, collection }));
+    const entries = await listCollectionEntries(branchRoot, collection, (file) => skippedFiles.push(file));
+    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.physicalPath)) : entries;
+    return visible.map((entry) => ({ entry, collection }));
   }));
+  if (isBuildMode() && skippedFiles.length > 0) {
+    const lines = skippedFiles.map(({ filename, collectionPath }) => `  - ${collectionPath}/${filename}`);
+    throw new Error(`CanopyCMS static build: found ${skippedFiles.length} file(s) that look like malformed content entries inside a content collection:
+${lines.join("\n")}
+Expected {type}.{slug}.{id}.{ext} with a known entry type (a name declared in that collection's entries config) and a valid 12-char Base58 ID. This usually means a schema rename without a matching file rename, an entry type declared in one collection but not another, or a stray file placed directly in a collection directory. If this is meant to be a colocated sibling artifact (e.g. an entry's contentId-prefixed data file read via an entryTransforms readSibling call), keep its name to three or fewer dot-separated segments (id.suffix.ext) so it is never mistaken for an entry attempt. Otherwise rename or move the file, or fix the schema, then rebuild.`);
+  }
   const contentPrefix = contentRootName ? `${contentRootName}/` : "";
   const items = [];
   for (const results of collectionResults) {
@@ -5830,7 +5870,8 @@ async function listEntries(branchRoot, flatSchema, contentRootName, options) {
         entryType: entry.entryType,
         format: entry.format,
         data,
-        schema: collection.entries?.find((e) => e.name === entry.entryType)?.schema
+        schema: collection.entries?.find((e) => e.name === entry.entryType)?.schema,
+        updatedAt: entry.updatedAt
       };
       if (filter && !filter(item))
         continue;
@@ -5844,7 +5885,15 @@ async function listEntries(branchRoot, flatSchema, contentRootName, options) {
   }
   return items;
 }
-var listCollectionEntries = async (root, collection) => {
+var looksLikeMalformedEntry = (filename, entryTypes) => {
+  if (filename.startsWith(".") || filename.startsWith("_"))
+    return false;
+  const segments = filename.split(".");
+  if (segments.length >= 4)
+    return true;
+  return segments.length === 3 && entryTypes.some((e) => e.name === segments[0]);
+};
+var listCollectionEntries = async (root, collection, onSkip) => {
   if (collection.type !== "collection" || !collection.entries) {
     return [];
   }
@@ -5877,6 +5926,9 @@ var listCollectionEntries = async (root, collection) => {
     const parsed = parseTypedFilename(file.name, entryTypes);
     if (!parsed) {
       log7.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
+      if (looksLikeMalformedEntry(file.name, entryTypes)) {
+        onSkip?.({ filename: file.name, collectionPath: collection.logicalPath });
+      }
       return null;
     }
     const { type: entryTypeName, slug, id: contentId } = parsed;

package/dist/cli/template-files/canopycms.config.ts.template

@@ -1,7 +1,24 @@
 import { defineCanopyConfig } from 'canopycms'
 
 export default defineCanopyConfig({
-  defaultBranchAccess: 'allow',
+  // Access defaults are fail-closed. Both layers are checked on every content
+  // read or write, and BOTH must allow it.
+  //
+  // 'deny' means "branches you neither created nor were invited to". You still
+  // get your own branches (the creator of an un-ACL'd branch always has access)
+  // and the base branch everyone lands on, so this is not a lockout -- it stops
+  // one editor from wandering into another's in-progress work.
+  //
+  // The PATH layer defaults to public read rather than 'deny': without this, a
+  // non-admin visitor (including the dev-auth default user this scaffold uses
+  // out of the box) gets "Forbidden: path access denied" on every route the
+  // moment you run `npm run dev`. Edit and review stay closed -- this is not
+  // a security walk-back, just the posture README.md's "Public read on
+  // server deployments" section recommends, applied from the start so the
+  // first run isn't a wall. Tighten to 'deny' yourself if you don't want
+  // public read (e.g. an internal-only site).
+  defaultBranchAccess: 'deny',
+  defaultPathAccess: { read: 'allow' },
   // Leave this as 'dev'. This file is loaded by `next dev`, by `next build`
   // inside the deployment image, and by the deployed server -- and the first
   // two must be 'dev' (a prod-mode build read would look for a branch