canopycms 0.0.62 → 0.0.64

package/dist/schema/resolver.d.ts

@@ -7,8 +7,8 @@
  * Field schemas are defined in the entry schema registry and referenced by name
  * in .collection.json files for reusability and type safety.
  */
-import type { RootCollectionConfig } from '../config';
-import type { EntrySchemaRegistry, SchemaResolutionResult } from './types';
+import type { RootCollectionConfig } from '../config/index.js';
+import type { EntrySchemaRegistry, SchemaResolutionResult } from './types.js';
 /**
  * Resolve schema from .collection.json files.
  *
@@ -39,4 +39,3 @@ export declare function hasSchemaFiles(contentRoot: string): Promise<boolean>;
  * @returns true if schema is valid
  */
 export declare function isValidSchema(schema: RootCollectionConfig): boolean;
-//# sourceMappingURL=resolver.d.ts.map

package/dist/schema/resolver.js

@@ -67,4 +67,3 @@ export function isValidSchema(schema) {
     const hasCollections = !!(schema.collections && schema.collections.length > 0);
     return hasEntries || hasCollections;
 }
-//# sourceMappingURL=resolver.js.map

package/dist/schema/schema-store-types.d.ts

@@ -4,8 +4,8 @@
  * These types are separated from schema-store.ts to allow client-side code
  * to import them without pulling in Node.js dependencies (fs, path).
  */
-import type { ContentFormat } from '../config';
-import type { LogicalPath } from '../paths/types';
+import type { ContentFormat } from '../config/index.js';
+import type { LogicalPath } from '../paths/types.js';
 /**
  * Input for creating a new collection
  */
@@ -45,4 +45,3 @@ export interface UpdateEntryTypeInput {
     default?: boolean;
     maxItems?: number;
 }
-//# sourceMappingURL=schema-store-types.d.ts.map

package/dist/schema/schema-store-types.js

@@ -5,4 +5,3 @@
  * to import them without pulling in Node.js dependencies (fs, path).
  */
 export {};
-//# sourceMappingURL=schema-store-types.js.map

package/dist/schema/schema-store.d.ts

@@ -44,12 +44,12 @@
  * ever starts).
  */
 import { z } from 'zod';
-import type { ContentFormat } from '../config';
-import type { EntrySchemaRegistry } from './types';
-import type { LogicalPath, ContentId } from '../paths/types';
-import type { CanopyServices } from '../services';
-export type { CreateCollectionInput, CreateEntryTypeInput, UpdateCollectionInput, UpdateEntryTypeInput, } from './schema-store-types';
-import type { CreateCollectionInput, CreateEntryTypeInput, UpdateCollectionInput, UpdateEntryTypeInput } from './schema-store-types';
+import type { ContentFormat } from '../config/index.js';
+import type { EntrySchemaRegistry } from './types.js';
+import type { LogicalPath, ContentId } from '../paths/types.js';
+import type { CanopyServices } from '../services.js';
+export type { CreateCollectionInput, CreateEntryTypeInput, UpdateCollectionInput, UpdateEntryTypeInput, } from './schema-store-types.js';
+import type { CreateCollectionInput, CreateEntryTypeInput, UpdateCollectionInput, UpdateEntryTypeInput } from './schema-store-types.js';
 /**
  * Raw collection meta as stored in .collection.json
  */
@@ -440,4 +440,3 @@ export declare class SchemaOps {
     private updateOrderInner;
 }
 export { createCollectionInputSchema, updateCollectionInputSchema, entryTypeInputSchema, updateEntryTypeInputSchema, };
-//# sourceMappingURL=schema-store.d.ts.map

package/dist/schema/schema-store.js

@@ -52,6 +52,8 @@ import { createDebugLogger } from '../utils/debug.js';
 import { getErrorMessage, isNotFoundError } from '../utils/error.js';
 import { withOccFileLock, OccWriteConflictError } from '../utils/occ-json-write.js';
 import { resolveCollectionPath } from '../content-id-index.js';
+import { findIndexEntryIn, findEntryBySlugIn } from '../url-collision.js';
+import { isIndexSlug } from '../utils/entry-url.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
 import { generateId, isValidId } from '../id.js';
 import { createLogicalPath, normalizeCollectionPath as stripContentRootPrefix, validateAndNormalizePath, } from '../paths/index.js';
@@ -647,6 +649,37 @@ export class SchemaOps {
                     }
                     // Ignore other errors (e.g., ENOENT if parent dir doesn't exist somehow)
                 }
+                // [URL] Contested-URL guard. Renaming a collection re-paths every entry beneath it, so
+                // its index entry -- the one whose URL is the collection's own path -- lands on the new
+                // name. If an entry with that slug already sits in the parent, the two would contest one
+                // URL and only one could be served. See url-collision.ts.
+                //
+                // Only the index entry can collide: the sibling-name check above has already established
+                // that no `{slug}.{id}` directory exists at the destination, so no descendant DEEPER than
+                // the index entry has anything to collide with.
+                //
+                // That holds only as far as the check above does, and it is narrower than it looks: it
+                // compares case-SENSITIVELY (so `guides` beside an existing `Guides.{id}` passes it) and
+                // it requires `parts.length === 2 && isValidId(parts[1])` (so a plain, ID-less `docs/`
+                // directory at the destination passes it too). Descendants CAN then contest.
+                // See .claude/future-tasks/collection-sibling-name-uniqueness.md, which tracks both the
+                // missing create-side check and this case hole.
+                if (await findIndexEntryIn(physicalPath)) {
+                    // Renaming TO "index" collapses this collection onto ITS OWN new path
+                    // (`<parentPath>/index`), not onto `<parentPath>` -- see `computeEntryUrl`. An entry in
+                    // the parent whose slug is the literal string "index" is the PARENT's own index/landing
+                    // entry, which collapses onto `<parentPath>` itself -- a different URL, not a collision.
+                    // Skip the lookup in that case; see url-collision.ts's `findUrlPathClaimant` for the
+                    // create-time version of this same false positive.
+                    const conflicting = isIndexSlug(updates.slug)
+                        ? null
+                        : await findEntryBySlugIn(parentDir, updates.slug);
+                    if (conflicting) {
+                        throw new Error(`Renaming this collection to "${updates.slug}" would make its landing page share a ` +
+                            `URL with the "${updates.slug}" entry already in the parent collection, and only ` +
+                            `one of them could be served there. Rename or remove that entry first.`);
+                    }
+                }
                 // Atomically rename the directory — this re-paths every entry beneath
                 // it, so already-loaded ID indexes (here and in other processes) must
                 // be told to rebuild.
@@ -952,4 +985,3 @@ export class SchemaOps {
 // Exports
 // ============================================================================
 export { createCollectionInputSchema, updateCollectionInputSchema, entryTypeInputSchema, updateEntryTypeInputSchema, };
-//# sourceMappingURL=schema-store.js.map

package/dist/schema/types.d.ts

@@ -1,7 +1,7 @@
 /**
  * Types for schema loading and resolution.
  */
-import type { EntrySchema, RootCollectionConfig } from '../config';
+import type { EntrySchema, RootCollectionConfig } from '../config/index.js';
 /**
  * Entry schema registry maps entry schema names to field definitions.
  * Used by .collection.json files to reference reusable entry schemas.
@@ -27,4 +27,3 @@ export interface SchemaResolutionResult {
     /** Information about schema sources for debugging */
     sources: SchemaSourceInfo[];
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/schema/types.js

@@ -2,4 +2,3 @@
  * Types for schema loading and resolution.
  */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/server.d.ts

@@ -1,9 +1,19 @@
-export * from './content-reader';
-export * from './services';
-export * from './build-mode';
-export * from './context';
-export { operatingStrategy } from './operating-mode';
-export * from './authorization/groups';
+export * from './content-reader.js';
+export * from './services.js';
+export * from './build-mode.js';
+export * from './context.js';
+export { operatingStrategy } from './operating-mode/index.js';
+export * from './authorization/groups/index.js';
+/**
+ * One-call factory for a **build/admin** Canopy context — for standalone
+ * scripts that run entirely outside a Next.js request or build phase (index
+ * builders, content audits, codegen, ad hoc reports). Reads the filesystem
+ * directly as a synthetic admin user and bypasses ALL branch/path ACLs —
+ * never use it in request-handling code. See the source JSDoc for the full
+ * security note and the `createNextCanopyContext().getCanopyForBuild()`
+ * comparison this mirrors.
+ */
+export { createBuildCanopy, type CreateBuildCanopyOptions } from './build-canopy.js';
 /**
  * Resolve a CanopyUser for a request: loads internal groups from the
  * settings workspace (the single source of truth — never a content branch
@@ -12,11 +22,11 @@ export * from './authorization/groups';
  * SSR wrapper so the "authenticate -> load groups -> merge" pipeline can't
  * drift between the two again.
  */
-export { resolveCanopyUser, type ResolveCanopyUserDeps } from './resolve-canopy-user';
-export * from './branch-workspace';
-export * from './content-store';
-export { loadCollectionMetaFiles, resolveCollectionReferences, watchCollectionMetaFiles, resolveSchema, } from './schema';
-export type { CollectionMeta, RootCollectionMeta } from './schema';
+export { resolveCanopyUser, type ResolveCanopyUserDeps } from './resolve-canopy-user.js';
+export * from './branch-workspace.js';
+export * from './content-store.js';
+export { loadCollectionMetaFiles, resolveCollectionReferences, watchCollectionMetaFiles, resolveSchema, } from './schema/index.js';
+export type { CollectionMeta, RootCollectionMeta } from './schema/index.js';
 /**
  * Create a type-safe entry schema registry with runtime validation.
  *
@@ -29,24 +39,39 @@ export type { CollectionMeta, RootCollectionMeta } from './schema';
  * automatically. See `createEntrySchemaRegistry`'s source-file JSDoc for the
  * full example.
  */
-export { createEntrySchemaRegistry } from './entry-schema-registry';
+export { createEntrySchemaRegistry } from './entry-schema-registry.js';
 /**
  * Validate that entry-schema references in `.collection.json` files exist in
  * the registry. Useful at build time to fail fast on stale references rather
  * than at request time.
  */
-export { validateEntrySchemaRegistry } from './entry-schema-registry';
+export { validateEntrySchemaRegistry } from './entry-schema-registry.js';
 /**
  * Derive a discriminated-union entry-type map from a registry value. Pass
  * `typeof entrySchemaRegistry` as the type argument. The registry must be
  * keyed by entry-type name for the result to plug straight into
  * `buildContentTree`'s `TEntryTypes` generic.
  */
-export type { EntryTypesFromRegistry } from './entry-schema';
+export type { EntryTypesFromRegistry } from './entry-schema.js';
+/**
+ * Resolve a display title for an entry using the full fallback chain: a
+ * schema-marked `isTitle` field, then `data.title`/`data.name`, then an
+ * entry-type label, then a humanized slug, then `"Untitled"`. Useful
+ * anywhere an entry needs a display title without re-deriving this chain —
+ * search-document/index builders in particular, since a search UI needs a
+ * title for every result regardless of which field the schema uses.
+ *
+ * Client-safe (no dependencies beyond `FieldConfig`/`InlineGroupFieldConfig`
+ * type imports, which are erased at compile time) — also re-exported from
+ * the root `canopycms` entry for that reason. Exported here too because
+ * build/admin scripts (the primary reason this was unreachable before) are
+ * more likely to `import` from `canopycms/server` than the root entry.
+ */
+export { resolveEntryTitle } from './utils/title-field.js';
 /** Generate a Canopy-format 12-character Base58 content ID. */
-export { generateId } from './id';
+export { generateId } from './id.js';
 /** Returns true if a string is a valid 12-character Base58 Canopy ID. */
-export { isValidId } from './id';
+export { isValidId } from './id.js';
 /**
  * Build a hierarchical tree of content nodes from the schema and filesystem.
  *
@@ -57,29 +82,65 @@ export { isValidId } from './id';
  * Adopters using `canopycms-next` typically call `canopy.buildContentTree(...)`
  * via `getCanopyForBuild()` rather than the bare function.
  */
-export { buildContentTree } from './content-tree';
-export type { ContentTreeNode, BuildContentTreeOptions, ContentTreeExtractMeta, EntryTypeMap, DefaultEntryTypes, } from './content-tree';
+export { buildContentTree } from './content-tree.js';
+export type { ContentTreeNode, BuildContentTreeOptions, ContentTreeExtractMeta, EntryTypeMap, DefaultEntryTypes, } from './content-tree.js';
+/**
+ * `buildContentTree`'s default URL path builder: strips the `{contentRootName}/`
+ * prefix, collapses an entry's `index` slug to its parent collection's path, and
+ * lowercases the result. Call it from inside a custom `buildPath` to extend the
+ * default rather than reimplement it — `buildContentTree`'s `buildPath` option
+ * replaces the default outright, it does not compose with it.
+ */
+export { defaultBuildPath } from './content-tree.js';
 /** List all content entries as a flat array. */
-export { listEntries } from './content-listing';
-export type { ListEntriesItem, ListEntriesOptions } from './content-listing';
+export { listEntries } from './content-listing.js';
+export type { ListEntriesItem, ListEntriesOptions } from './content-listing.js';
+/**
+ * Parse a content filename of the form `{type}.{slug}.{id}.{ext}` into its
+ * `{ type, slug, id }` parts. `id` must be a valid 12-character Base58 content ID
+ * (excludes the ambiguous characters `0`, `O`, `I`, `l`) or the parse fails.
+ * Pass `entryTypes` to also require `type` to match a known entry-type name;
+ * omit it to parse the filename shape without that check. See the source JSDoc
+ * for the full filename grammar.
+ */
+export { parseTypedFilename } from './content-listing.js';
 /**
  * Resolve a canopy entry-link to its URL. Pair with the field-walker variants
  * (`resolveEntryLinksInText`, `resolveEntryLinksInData`) when rendering MDX
  * bodies or arbitrary frontmatter that may contain link tokens.
  */
-export { resolveEntryUrl, resolveEntryLinksInText, resolveEntryLinksInData, extractEntryLinkIds, } from './entry-link-resolver';
-export type { EntryLinkUrlResolver } from './entry-link-resolver';
-/** Compute the canonical URL for an entry given its logical path + slug. */
-export { computeEntryUrl } from './utils/entry-url';
+export { resolveEntryUrl, resolveEntryLinksInText, resolveEntryLinksInData, extractEntryLinkIds, } from './entry-link-resolver.js';
+export type { EntryLinkUrlResolver } from './entry-link-resolver.js';
+/**
+ * Compute the canonical URL for an entry given its logical path + slug, and the shared
+ * "is this the collection-index slug?" predicate that decides whether it collapses.
+ */
+export { computeEntryUrl, isIndexSlug } from './utils/entry-url.js';
 /** Collect static paths for `generateStaticParams` / sitemap emission. */
-export { collectStaticPaths } from './static';
-export type { StaticPathEntry, CollectStaticPathsOptions } from './static';
+export { collectStaticPaths } from './static/index.js';
+export type { StaticPathEntry, CollectStaticPathsOptions } from './static/index.js';
+/** Enumerate routable entries WITH their data — the input to sitemaps, feeds and search indexes. */
+export { collectRoutableEntries } from './static/index.js';
+export type { RoutableEntry, CollectRoutableEntriesOptions } from './static/index.js';
+/**
+ * Find every URL claimed by more than one entry — the check a production build already runs
+ * (and fails on). Exported so a content-integrity test can assert it directly rather than
+ * hand-rolling the same scan over `listEntries`.
+ */
+export { findDuplicateUrlPaths } from './static/index.js';
+export type { DuplicateUrlPath } from './static/index.js';
+/**
+ * SEO field extraction and URL shaping (framework-agnostic). `isNoindexEntry` is the single
+ * predicate behind both `robots: noindex` and sitemap exclusion.
+ */
+export { DEFAULT_SEO_FIELD_NAMES, extractSeoFields, isNoindexEntry, isAbsoluteUrl, withTrailingSlash, resolveSeoUrl, stripTrailingSlashes, } from './static/index.js';
+export type { SeoFields, SeoFieldNames, SeoFieldLocation, SeoOgType, SeoTwitterCard, ExtractSeoFieldsOptions, ResolveSeoUrlOptions, } from './static/index.js';
 /**
  * Start a chokidar-backed watcher that detects divergence between the dev
  * working tree and the resolved branch clone. Dev mode only.
  */
-export { startDevContentWatcher } from './dev-content-watcher';
-export type { StartDevContentWatcherOptions } from './dev-content-watcher';
+export { startDevContentWatcher } from './dev-content-watcher.js';
+export type { StartDevContentWatcherOptions } from './dev-content-watcher.js';
 /**
  * Instantiate the AssetStore configured by a site's `media` config
  * (`config.media`). Returns undefined when no store applies: `media` is
@@ -87,7 +148,7 @@ export type { StartDevContentWatcherOptions } from './dev-content-watcher';
  * `directory` with no fallback, or `adapter: 'lfs'` (config literal kept,
  * not yet implemented).
  */
-export { createAssetStore } from './assets/factory';
+export { createAssetStore } from './assets/factory.js';
 /**
  * The five S3/local bucket-prefix strings (`asset-originals/`, `asset-staging/`,
  * `asset-meta/`, `assets/`, `assets/t/`). Re-exported so server-only consumers
@@ -96,9 +157,9 @@ export { createAssetStore } from './assets/factory';
  * keys through the same constants `S3AssetStore` uses, rather than
  * duplicating the literal prefix strings.
  */
-export { ASSET_PREFIXES, type AssetPrefixes } from './assets/keys';
+export { ASSET_PREFIXES, type AssetPrefixes } from './assets/keys.js';
 /** Asset metadata sidecar shape (`asset-meta/{hash32}.json`), written by the finalize pipeline and read by the transform layer (dev-mode emulation and the prod transform Lambda). */
-export type { AssetMeta } from './assets/types';
+export type { AssetMeta } from './assets/types.js';
 /**
  * Parse the three path segments after `assets/t/` (`{directives}/{hash32}/{slug}.{ext}`)
  * into a validated `TransformDirectives` set, or a structured parse error.
@@ -106,8 +167,8 @@ export type { AssetMeta } from './assets/types';
  * and the prod transform Lambda (`packages/canopycms-cdk/lambda/asset-transform`)
  * so the URL grammar is defined in exactly one place.
  */
-export { parseTransformPath } from './assets/transform-directives';
-export type { ParsedTransformPath, ParseTransformPathResult } from './assets/transform-directives';
+export { parseTransformPath } from './assets/transform-directives.js';
+export type { ParsedTransformPath, ParseTransformPathResult } from './assets/transform-directives.js';
 /**
  * Canonical string form of a `TransformDirectives` set - the cache key every
  * transform output is stored under (`assets/t/{formatDirectives(...)}/{hash32}/{slug}.{ext}`).
@@ -115,7 +176,7 @@ export type { ParsedTransformPath, ParseTransformPathResult } from './assets/tra
  * format to the same string. Reused by the prod transform Lambda so its
  * canonical writes agree with the dev-mode emulation and `assetUrl()`.
  */
-export { formatDirectives } from './assets/transform-directives';
+export { formatDirectives } from './assets/transform-directives.js';
 /**
  * Apply a parsed `TransformDirectives` set to source image bytes with sharp:
  * resize/format/quality/crop, with EXIF stripped on every re-encode (even
@@ -123,6 +184,5 @@ export { formatDirectives } from './assets/transform-directives';
  * `/assets/t/*` emulation and the prod transform Lambda
  * (`packages/canopycms-cdk/lambda/asset-transform`).
  */
-export { applyTransform } from './assets/transform';
-export type { ApplyTransformInput, TransformResult } from './assets/transform';
-//# sourceMappingURL=server.d.ts.map
+export { applyTransform } from './assets/transform.js';
+export type { ApplyTransformInput, TransformResult } from './assets/transform.js';

package/dist/server.js

@@ -9,6 +9,16 @@ export * from './build-mode.js';
 export * from './context.js';
 export { operatingStrategy } from './operating-mode/index.js';
 export * from './authorization/groups/index.js';
+/**
+ * One-call factory for a **build/admin** Canopy context — for standalone
+ * scripts that run entirely outside a Next.js request or build phase (index
+ * builders, content audits, codegen, ad hoc reports). Reads the filesystem
+ * directly as a synthetic admin user and bypasses ALL branch/path ACLs —
+ * never use it in request-handling code. See the source JSDoc for the full
+ * security note and the `createNextCanopyContext().getCanopyForBuild()`
+ * comparison this mirrors.
+ */
+export { createBuildCanopy } from './build-canopy.js';
 /**
  * Resolve a CanopyUser for a request: loads internal groups from the
  * settings workspace (the single source of truth — never a content branch
@@ -40,6 +50,21 @@ export { createEntrySchemaRegistry } from './entry-schema-registry.js';
  * than at request time.
  */
 export { validateEntrySchemaRegistry } from './entry-schema-registry.js';
+/**
+ * Resolve a display title for an entry using the full fallback chain: a
+ * schema-marked `isTitle` field, then `data.title`/`data.name`, then an
+ * entry-type label, then a humanized slug, then `"Untitled"`. Useful
+ * anywhere an entry needs a display title without re-deriving this chain —
+ * search-document/index builders in particular, since a search UI needs a
+ * title for every result regardless of which field the schema uses.
+ *
+ * Client-safe (no dependencies beyond `FieldConfig`/`InlineGroupFieldConfig`
+ * type imports, which are erased at compile time) — also re-exported from
+ * the root `canopycms` entry for that reason. Exported here too because
+ * build/admin scripts (the primary reason this was unreachable before) are
+ * more likely to `import` from `canopycms/server` than the root entry.
+ */
+export { resolveEntryTitle } from './utils/title-field.js';
 /** Generate a Canopy-format 12-character Base58 content ID. */
 export { generateId } from './id.js';
 /** Returns true if a string is a valid 12-character Base58 Canopy ID. */
@@ -55,18 +80,51 @@ export { isValidId } from './id.js';
  * via `getCanopyForBuild()` rather than the bare function.
  */
 export { buildContentTree } from './content-tree.js';
+/**
+ * `buildContentTree`'s default URL path builder: strips the `{contentRootName}/`
+ * prefix, collapses an entry's `index` slug to its parent collection's path, and
+ * lowercases the result. Call it from inside a custom `buildPath` to extend the
+ * default rather than reimplement it — `buildContentTree`'s `buildPath` option
+ * replaces the default outright, it does not compose with it.
+ */
+export { defaultBuildPath } from './content-tree.js';
 /** List all content entries as a flat array. */
 export { listEntries } from './content-listing.js';
+/**
+ * Parse a content filename of the form `{type}.{slug}.{id}.{ext}` into its
+ * `{ type, slug, id }` parts. `id` must be a valid 12-character Base58 content ID
+ * (excludes the ambiguous characters `0`, `O`, `I`, `l`) or the parse fails.
+ * Pass `entryTypes` to also require `type` to match a known entry-type name;
+ * omit it to parse the filename shape without that check. See the source JSDoc
+ * for the full filename grammar.
+ */
+export { parseTypedFilename } from './content-listing.js';
 /**
  * Resolve a canopy entry-link to its URL. Pair with the field-walker variants
  * (`resolveEntryLinksInText`, `resolveEntryLinksInData`) when rendering MDX
  * bodies or arbitrary frontmatter that may contain link tokens.
  */
 export { resolveEntryUrl, resolveEntryLinksInText, resolveEntryLinksInData, extractEntryLinkIds, } from './entry-link-resolver.js';
-/** Compute the canonical URL for an entry given its logical path + slug. */
-export { computeEntryUrl } from './utils/entry-url.js';
+/**
+ * Compute the canonical URL for an entry given its logical path + slug, and the shared
+ * "is this the collection-index slug?" predicate that decides whether it collapses.
+ */
+export { computeEntryUrl, isIndexSlug } from './utils/entry-url.js';
 /** Collect static paths for `generateStaticParams` / sitemap emission. */
 export { collectStaticPaths } from './static/index.js';
+/** Enumerate routable entries WITH their data — the input to sitemaps, feeds and search indexes. */
+export { collectRoutableEntries } from './static/index.js';
+/**
+ * Find every URL claimed by more than one entry — the check a production build already runs
+ * (and fails on). Exported so a content-integrity test can assert it directly rather than
+ * hand-rolling the same scan over `listEntries`.
+ */
+export { findDuplicateUrlPaths } from './static/index.js';
+/**
+ * SEO field extraction and URL shaping (framework-agnostic). `isNoindexEntry` is the single
+ * predicate behind both `robots: noindex` and sitemap exclusion.
+ */
+export { DEFAULT_SEO_FIELD_NAMES, extractSeoFields, isNoindexEntry, isAbsoluteUrl, withTrailingSlash, resolveSeoUrl, stripTrailingSlashes, } from './static/index.js';
 /**
  * Start a chokidar-backed watcher that detects divergence between the dev
  * working tree and the resolved branch clone. Dev mode only.
@@ -113,4 +171,3 @@ export { formatDirectives } from './assets/transform-directives.js';
  * (`packages/canopycms-cdk/lambda/asset-transform`).
  */
 export { applyTransform } from './assets/transform.js';
-//# sourceMappingURL=server.js.map

package/dist/services.d.ts

@@ -1,12 +1,12 @@
-import type { CanopyConfig } from './config';
-import type { EntrySchemaRegistry } from './schema/types';
-import type { BranchContext } from './types';
-import type { CanopyUser } from './user';
-import { createCheckPathAccess, createCheckBranchAccess, createCheckContentAccess, type ContentAccessChecker } from './authorization';
-import { GitManager } from './git-manager';
-import { BranchRegistry } from './branch-registry';
-import { type GitHubService } from './github-service';
-import { BranchSchemaCache } from './branch-schema-cache';
+import type { CanopyConfig } from './config/index.js';
+import type { EntrySchemaRegistry } from './schema/types.js';
+import type { BranchContext } from './types.js';
+import type { CanopyUser } from './user.js';
+import { createCheckBranchAccess, createCheckContentAccess, type ContentAccessChecker } from './authorization/index.js';
+import { GitManager } from './git-manager.js';
+import { BranchRegistry } from './branch-registry.js';
+import { type GitHubService } from './github-service.js';
+import { BranchSchemaCache } from './branch-schema-cache.js';
 /**
  * Parse bootstrap admin IDs from environment variable.
  * These users are always treated as Admins regardless of group membership.
@@ -23,9 +23,8 @@ export interface CanopyServices {
     /** Entry schema registry mapping entry schema names to field definitions */
     entrySchemaRegistry: EntrySchemaRegistry;
     /** Per-branch schema cache */
-    branchSchemaCache: import('./branch-schema-cache').BranchSchemaCache;
+    branchSchemaCache: import('./branch-schema-cache.js').BranchSchemaCache;
     checkBranchAccess: (context: BranchContext, user: CanopyUser) => ReturnType<ReturnType<typeof createCheckBranchAccess>>;
-    checkPathAccess: ReturnType<typeof createCheckPathAccess>;
     checkContentAccess: ReturnType<typeof createCheckContentAccess>;
     /**
      * Build a batch content-access checker that loads permissions once and returns
@@ -110,4 +109,3 @@ export declare const createCanopyServices: (config: CanopyConfig, options?: Crea
  * @param options - Optional settings including entry schema registry
  */
 export declare const createTestCanopyServices: (config: CanopyConfig, options?: CreateCanopyServicesOptions) => Promise<CanopyServices>;
-//# sourceMappingURL=services.d.ts.map

package/dist/services.js

@@ -1,5 +1,5 @@
 import { getConfigDefaults } from './config/index.js';
-import { createCheckPathAccess, createCheckBranchAccess, createCheckContentAccess, createContentAccessChecker, loadPathPermissions, } from './authorization/index.js';
+import { createCheckBranchAccess, createCheckContentAccess, createContentAccessChecker, loadPathPermissions, } from './authorization/index.js';
 import { GitManager, GitRemoteRefMissingError } from './git-manager.js';
 import { BranchRegistry } from './branch-registry.js';
 import { SettingsWorkspaceManager } from './settings-workspace.js';
@@ -116,10 +116,7 @@ async function _createCanopyServicesInternal(config, options) {
     const bootstrapAdminIds = getBootstrapAdminIds();
     // Create per-branch schema cache (or use provided one for testing)
     const branchSchemaCache = options.branchSchemaCache ?? new BranchSchemaCache(config.mode);
-    const checkBranchAccess = createCheckBranchAccess(config.defaultBranchAccess ?? 'deny');
-    // Path permissions are loaded dynamically from the settings branch at request time.
-    // At the service level, we bind with empty rules for direct path checks.
-    const checkPathAccess = createCheckPathAccess([], config.defaultPathAccess ?? 'deny');
+    const checkBranchAccess = createCheckBranchAccess(config.defaultBranchAccess ?? 'deny', config);
     // Content access loads permissions dynamically from the settings branch (orphan git branch)
     const getSettingsBranchRoot = options.getSettingsBranchRoot ??
         (async () => {
@@ -347,7 +344,6 @@ async function _createCanopyServicesInternal(config, options) {
         entrySchemaRegistry: options.entrySchemaRegistry ?? {},
         branchSchemaCache,
         checkBranchAccess,
-        checkPathAccess,
         checkContentAccess,
         createContentAccessChecker: createContentAccessCheckerBound,
         createGitManagerFor,
@@ -400,4 +396,3 @@ async function _createCanopyServicesInternal(config, options) {
     };
     return services;
 }
-//# sourceMappingURL=services.js.map

package/dist/settings-workspace.d.ts

@@ -1,5 +1,5 @@
-import type { CanopyConfig } from './config';
-import type { OperatingMode } from './operating-mode';
+import type { CanopyConfig } from './config/index.js';
+import type { OperatingMode } from './operating-mode/index.js';
 /**
  * Directory the cross-process init lock is anchored on — a dedicated sibling of
  * the settings root, and NOT the settings root itself.
@@ -10,18 +10,16 @@ import type { OperatingMode } from './operating-mode';
  *    mkdir's its target, and `GitManager.initializeWorkspace` clones INTO the
  *    settings root — `git clone` refuses a destination that already has content
  *    in it. So the lock lives beside the settings root, never inside it.
- * 2. **It must not alias any other proper-lockfile target.** proper-lockfile
- *    keys its module-level bookkeeping (refresh timer + release function) by the
- *    TARGET path passed to `lock()`, not by `lockfilePath`, so two live locks in
- *    one process that share a target clobber each other's registry entry (see
- *    `.claude/future-tasks/proper-lockfile-hazards.md`). This target is a
- *    dedicated dot-directory, so it collides with none of the existing targets:
- *    the content-branches root and the bare remote's parent (provisioning locks
- *    — note the latter IS `path.dirname(settingsRoot)`, which is precisely why
- *    this cannot be anchored there: settings init calls into
- *    `ensureLocalSimulatedRemote` while holding this lock), `<branchRoot>/.canopy-meta`
- *    (content-write lock), `<workspaceRoot>/.tasks` (worker task lock), and the
- *    individual JSON file paths used by `withOccFileLock`.
+ * 2. **Its marker must not collide with another lock's marker.** Since
+ *    2026-08-20 `acquireProvisioningLock` anchors proper-lockfile on the lock
+ *    MARKER's own path rather than on the directory holding it, so its
+ *    in-process registry key is the on-disk lock identity and two live locks
+ *    can no longer clobber each other's bookkeeping (see docs/concurrency.md,
+ *    "Anchor path matters"). A dedicated dot-directory is still the right home
+ *    for this marker: `path.dirname(settingsRoot)` is where
+ *    `ensureLocalSimulatedRemote` puts `.remote-init.lock`, and settings init
+ *    calls into it while holding this lock, so keeping the two markers in
+ *    separate directories keeps that nesting obvious rather than incidental.
  */
 export declare function settingsInitLockTarget(settingsRoot: string): string;
 export interface EnsureSettingsWorkspaceOptions {
@@ -51,4 +49,3 @@ export declare class SettingsWorkspaceManager {
     constructor(config: CanopyConfig);
     ensureGitWorkspace(options: EnsureSettingsWorkspaceOptions): Promise<void>;
 }
-//# sourceMappingURL=settings-workspace.d.ts.map

package/dist/settings-workspace.js

@@ -21,18 +21,16 @@ const SETTINGS_INIT_LOCK_NAME = 'lock';
  *    mkdir's its target, and `GitManager.initializeWorkspace` clones INTO the
  *    settings root — `git clone` refuses a destination that already has content
  *    in it. So the lock lives beside the settings root, never inside it.
- * 2. **It must not alias any other proper-lockfile target.** proper-lockfile
- *    keys its module-level bookkeeping (refresh timer + release function) by the
- *    TARGET path passed to `lock()`, not by `lockfilePath`, so two live locks in
- *    one process that share a target clobber each other's registry entry (see
- *    `.claude/future-tasks/proper-lockfile-hazards.md`). This target is a
- *    dedicated dot-directory, so it collides with none of the existing targets:
- *    the content-branches root and the bare remote's parent (provisioning locks
- *    — note the latter IS `path.dirname(settingsRoot)`, which is precisely why
- *    this cannot be anchored there: settings init calls into
- *    `ensureLocalSimulatedRemote` while holding this lock), `<branchRoot>/.canopy-meta`
- *    (content-write lock), `<workspaceRoot>/.tasks` (worker task lock), and the
- *    individual JSON file paths used by `withOccFileLock`.
+ * 2. **Its marker must not collide with another lock's marker.** Since
+ *    2026-08-20 `acquireProvisioningLock` anchors proper-lockfile on the lock
+ *    MARKER's own path rather than on the directory holding it, so its
+ *    in-process registry key is the on-disk lock identity and two live locks
+ *    can no longer clobber each other's bookkeeping (see docs/concurrency.md,
+ *    "Anchor path matters"). A dedicated dot-directory is still the right home
+ *    for this marker: `path.dirname(settingsRoot)` is where
+ *    `ensureLocalSimulatedRemote` puts `.remote-init.lock`, and settings init
+ *    calls into it while holding this lock, so keeping the two markers in
+ *    separate directories keeps that nesting obvious rather than incidental.
  */
 export function settingsInitLockTarget(settingsRoot) {
     return path.join(path.dirname(path.resolve(settingsRoot)), SETTINGS_INIT_LOCK_DIR);
@@ -220,4 +218,3 @@ export class SettingsWorkspaceManager {
         });
     }
 }
-//# sourceMappingURL=settings-workspace.js.map