canopycms 0.0.62 → 0.0.64

package/dist/assets/factory.d.ts

@@ -5,8 +5,8 @@
  * into a real store — see .claude/future-tasks/assets-media-system.md for why
  * this was previously dead configuration.
  */
-import type { MediaConfig } from '../config/types';
-import type { AssetStore } from './types';
+import type { MediaConfig } from '../config/types.js';
+import type { AssetStore } from './types.js';
 /**
  * @param media - The site's `media` config (`config.media`), or undefined if unset.
  * @param opts.devAssetsDir - Root directory for the implicit local fallback store used
@@ -15,4 +15,3 @@ import type { AssetStore } from './types';
 export declare function createAssetStore(media: MediaConfig | undefined, opts?: {
     devAssetsDir?: string;
 }): AssetStore | undefined;
-//# sourceMappingURL=factory.d.ts.map

package/dist/assets/factory.js

@@ -21,7 +21,6 @@ export function createAssetStore(media, opts = {}) {
             return new S3AssetStore({
                 bucket: media.bucket,
                 region: media.region,
-                publicBaseUrl: media.publicBaseUrl,
                 maxUploadBytes: media.maxUploadBytes,
             });
         case 'local': {
@@ -39,4 +38,3 @@ export function createAssetStore(media, opts = {}) {
             return undefined;
     }
 }
-//# sourceMappingURL=factory.js.map

package/dist/assets/finalize.d.ts

@@ -3,8 +3,8 @@
  * best-effort staging cleanup. Split from pipeline.ts so the pipeline itself
  * stays store-agnostic and trivially unit-testable with plain byte fixtures.
  */
-import { type FinalizeInput, type FinalizeRejection } from './pipeline';
-import type { AssetMeta, AssetStore } from './types';
+import { type FinalizeInput, type FinalizeRejection } from './pipeline.js';
+import type { AssetMeta, AssetStore } from './types.js';
 export declare function isValidStagingKey(key: string): boolean;
 export type FinalizeAssetResult = {
     ok: true;
@@ -33,4 +33,3 @@ export declare function finalizeStagedUpload(store: AssetStore, stagingKey: stri
     status: 400 | 404;
     error: string;
 }>;
-//# sourceMappingURL=finalize.d.ts.map

package/dist/assets/finalize.js

@@ -69,4 +69,3 @@ export async function finalizeStagedUpload(store, stagingKey, filename, uploaded
     await store.deleteStaging(stagingKey).catch(() => { });
     return result;
 }
-//# sourceMappingURL=finalize.js.map

package/dist/assets/index.d.ts

@@ -5,16 +5,15 @@
  * ./types directly instead, so node:fs/S3-SDK imports never reach a browser
  * bundle.
  */
-export type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget, } from './types';
-export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, type AssetPrefixes, } from './keys';
-export { LocalAssetStore, type LocalAssetStoreOptions } from './store-local';
-export { S3AssetStore, type S3AssetStoreOptions } from './store-s3';
-export { createAssetStore } from './factory';
-export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizePublicObject, type FinalizeResult, type FinalizeRejection, type FinalizeSuccess, } from './pipeline';
-export { finalizeAsset, finalizeStagedUpload, type FinalizeAssetResult } from './finalize';
-export { sanitizeSvg } from './svg-sanitizer';
-export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src';
-export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type IdentityDirectives, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type ResizeDirectives, type TransformDirectives, } from './transform-directives';
-export { applyTransform, type ApplyTransformInput, type TransformResult } from './transform';
-export { assetUrl, assetSrcSet, type AssetRef, type AssetUrlOptions } from './asset-url';
-//# sourceMappingURL=index.d.ts.map
+export type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget, } from './types.js';
+export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, type AssetPrefixes, } from './keys.js';
+export { LocalAssetStore, type LocalAssetStoreOptions } from './store-local.js';
+export { S3AssetStore, type S3AssetStoreOptions } from './store-s3.js';
+export { createAssetStore } from './factory.js';
+export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizePublicObject, type FinalizeResult, type FinalizeRejection, type FinalizeSuccess, } from './pipeline.js';
+export { finalizeAsset, finalizeStagedUpload, type FinalizeAssetResult } from './finalize.js';
+export { sanitizeSvg } from './svg-sanitizer.js';
+export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
+export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type IdentityDirectives, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type ResizeDirectives, type TransformDirectives, } from './transform-directives.js';
+export { applyTransform, type ApplyTransformInput, type TransformResult } from './transform.js';
+export { assetUrl, assetSrcSet, type AssetRef, type AssetUrlOptions } from './asset-url.js';

package/dist/assets/index.js

@@ -16,4 +16,3 @@ export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
 export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, } from './transform-directives.js';
 export { applyTransform } from './transform.js';
 export { assetUrl, assetSrcSet } from './asset-url.js';
-//# sourceMappingURL=index.js.map

package/dist/assets/keys.d.ts

@@ -13,7 +13,7 @@
  * Stores must build keys through these helpers rather than hand-rolling prefix
  * strings, so the layout stays defined in exactly one place.
  */
-import { ASSET_PREFIXES, type AssetPrefixes } from './asset-prefixes';
+import { ASSET_PREFIXES, type AssetPrefixes } from './asset-prefixes.js';
 export { ASSET_PREFIXES, type AssetPrefixes };
 /** sha-256 of the given bytes, truncated to 32 hex chars (128 bits). */
 export declare function hashBytes(data: Uint8Array): string;
@@ -53,4 +53,3 @@ export declare function createKeyBuilders(prefixes?: AssetPrefixes): {
     publicKey: (hash32: string, slug: string, ext: string) => string;
 };
 export declare const originalKey: (hash32: string, ext: string) => string, originalPrefix: (hash32: string) => string, stagingKey: (uuid: string) => string, metaKey: (hash32: string) => string, metaPrefix: () => string, publicKey: (hash32: string, slug: string, ext: string) => string;
-//# sourceMappingURL=keys.d.ts.map

package/dist/assets/keys.js

@@ -85,4 +85,3 @@ export function createKeyBuilders(prefixes = ASSET_PREFIXES) {
     };
 }
 export const { originalKey, originalPrefix, stagingKey, metaKey, metaPrefix, publicKey } = createKeyBuilders();
-//# sourceMappingURL=keys.js.map

package/dist/assets/pipeline.d.ts

@@ -10,7 +10,7 @@
  * `rasterIsDecodable` below) rather than statically imported, but is just as
  * server-only - it is never reachable from a browser bundle either way.
  */
-import type { AssetMeta } from './types';
+import type { AssetMeta } from './types.js';
 /** Client-declared content types accepted at presign time (UX only - never trusted at finalize). */
 export declare const ALLOWED_UPLOAD_CONTENT_TYPES: Set<string>;
 export interface FinalizeInput {
@@ -56,4 +56,3 @@ export type FinalizeResult = FinalizeSuccess | FinalizeRejection;
  * stricter sanitizer version) cannot desync a stored hash from its content.
  */
 export declare function runFinalizePipeline(input: FinalizeInput): Promise<FinalizeResult>;
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/assets/pipeline.js

@@ -311,4 +311,3 @@ export async function runFinalizePipeline(input) {
     }
     return { ok: true, meta, data: canonicalData, publicObject };
 }
-//# sourceMappingURL=pipeline.js.map

package/dist/assets/store-local.d.ts

@@ -3,7 +3,7 @@
  * bucket-prefix layout as S3AssetStore (see keys.ts) so content behaves
  * identically across adapters.
  */
-import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types';
+import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types.js';
 export interface LocalAssetStoreOptions {
     /** Root directory. The five bucket prefixes are created as subdirectories under it. */
     root: string;
@@ -81,4 +81,3 @@ export declare class LocalAssetStore implements AssetStore {
     }>;
     deleteMeta(hash32: string): Promise<void>;
 }
-//# sourceMappingURL=store-local.d.ts.map

package/dist/assets/store-local.js

@@ -251,4 +251,3 @@ export class LocalAssetStore {
         }
     }
 }
-//# sourceMappingURL=store-local.js.map

package/dist/assets/store-s3.d.ts

@@ -4,12 +4,11 @@
  * already configured by the site's CDK stack) — this store only ever reads
  * and writes objects under the five asset prefixes.
  */
-import { type AssetPrefixes } from './keys';
-import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types';
+import { type AssetPrefixes } from './keys.js';
+import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types.js';
 export interface S3AssetStoreOptions {
     bucket: string;
     region: string;
-    publicBaseUrl?: string;
     /** Defaults to 50 MiB. */
     maxUploadBytes?: number;
     /** Override the default bucket-prefix layout (rarely needed). */
@@ -68,4 +67,3 @@ export declare class S3AssetStore implements AssetStore {
     private getObject;
     private getObjectBytes;
 }
-//# sourceMappingURL=store-s3.d.ts.map

package/dist/assets/store-s3.js

@@ -180,4 +180,3 @@ export class S3AssetStore {
         return bytes ?? null;
     }
 }
-//# sourceMappingURL=store-s3.js.map

package/dist/assets/svg-sanitizer.d.ts

@@ -34,4 +34,3 @@
  * pipeline.ts) - this function does not re-validate the root element.
  */
 export declare function sanitizeSvg(svgText: string): string;
-//# sourceMappingURL=svg-sanitizer.d.ts.map

package/dist/assets/svg-sanitizer.js

@@ -219,4 +219,3 @@ export function sanitizeSvg(svgText) {
         },
     });
 }
-//# sourceMappingURL=svg-sanitizer.js.map

package/dist/assets/transform-directives.d.ts

@@ -112,4 +112,3 @@ export declare function parseTransformPath(segments: readonly string[]): ParseTr
  * cache key. Order is fixed alphabetically by key: c, f, q, w.
  */
 export declare function formatDirectives(directives: TransformDirectives): string;
-//# sourceMappingURL=transform-directives.d.ts.map

package/dist/assets/transform-directives.js

@@ -282,4 +282,3 @@ export function formatDirectives(directives) {
     // empty directives segment.
     return parts.length > 0 ? parts.join(',') : IDENTITY_TRANSFORM_DIRECTIVE;
 }
-//# sourceMappingURL=transform-directives.js.map

package/dist/assets/transform.d.ts

@@ -28,7 +28,7 @@
  * path with no extra native dependency) purely for pipeline uniformity, not
  * because GIF needs stripping.
  */
-import { type TransformDirectives } from './transform-directives';
+import { type TransformDirectives } from './transform-directives.js';
 export interface ApplyTransformInput {
     data: Uint8Array;
     /** Source extension (lowercased file-type ext, e.g. 'png' | 'jpg' | 'webp' | 'gif'). */
@@ -48,4 +48,3 @@ export interface TransformRejection {
 }
 export type TransformResult = TransformSuccess | TransformRejection;
 export declare function applyTransform(input: ApplyTransformInput, directives: TransformDirectives): Promise<TransformResult>;
-//# sourceMappingURL=transform.d.ts.map

package/dist/assets/transform.js

@@ -191,4 +191,3 @@ export async function applyTransform(input, directives) {
         return { ok: false, status: 422, error: `Transform failed: ${getErrorMessage(err)}` };
     }
 }
-//# sourceMappingURL=transform.js.map

package/dist/assets/types.d.ts

@@ -79,4 +79,3 @@ export interface AssetStore {
     }>;
     deleteMeta(hash32: string): Promise<void>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/assets/types.js

@@ -7,4 +7,3 @@
  * and the factory are server-only and must never be imported from client code.
  */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/auth/cache.d.ts

@@ -3,6 +3,5 @@
  * These use node:fs/promises and must NOT be imported in client bundles.
  * Use 'canopycms/auth/cache' as the import path.
  */
-export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache';
-export { CachingAuthPlugin } from './caching-auth-plugin';
-//# sourceMappingURL=cache.d.ts.map
+export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache.js';
+export { CachingAuthPlugin } from './caching-auth-plugin.js';

package/dist/auth/cache.js

@@ -5,4 +5,3 @@
  */
 export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache.js';
 export { CachingAuthPlugin } from './caching-auth-plugin.js';
-//# sourceMappingURL=cache.js.map

package/dist/auth/caching-auth-plugin.d.ts

@@ -1,6 +1,6 @@
-import type { AuthPlugin } from './plugin';
-import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
-import type { CanopyUserId, CanopyGroupId } from '../types';
+import type { AuthPlugin } from './plugin.js';
+import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types.js';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
 /**
  * Generic cache provider interface for auth metadata.
  * Any auth system can implement its own cache backend
@@ -52,4 +52,3 @@ export declare class CachingAuthPlugin implements AuthPlugin {
     getGroupMetadata(groupId: CanopyGroupId): Promise<GroupMetadata | null>;
     listGroups(limit?: number): Promise<GroupMetadata[]>;
 }
-//# sourceMappingURL=caching-auth-plugin.d.ts.map

package/dist/auth/caching-auth-plugin.js

@@ -108,4 +108,3 @@ export class CachingAuthPlugin {
         }
     }
 }
-//# sourceMappingURL=caching-auth-plugin.js.map

package/dist/auth/context-helpers.d.ts

@@ -1,4 +1,4 @@
-import type { CanopyRequest } from '../http/types';
+import type { CanopyRequest } from '../http/types.js';
 /**
  * Headers-like interface for auth context.
  * Framework-agnostic - matches Web Headers, Next.js Headers, and any similar interface.
@@ -28,4 +28,3 @@ export declare function extractHeaders(context: unknown): HeadersLike | null;
  * Use this in auth plugins to provide clear error messages.
  */
 export declare function validateAuthContext(context: unknown): HeadersLike;
-//# sourceMappingURL=context-helpers.d.ts.map

package/dist/auth/context-helpers.js

@@ -50,4 +50,3 @@ export function validateAuthContext(context) {
     }
     return headers;
 }
-//# sourceMappingURL=context-helpers.js.map

package/dist/auth/file-based-auth-cache.d.ts

@@ -1,6 +1,6 @@
-import type { AuthCacheProvider } from './caching-auth-plugin';
-import type { UserSearchResult, GroupMetadata } from './types';
-import type { CanopyUserId, CanopyGroupId } from '../types';
+import type { AuthCacheProvider } from './caching-auth-plugin.js';
+import type { UserSearchResult, GroupMetadata } from './types.js';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
 /**
  * File-based auth cache provider.
  * Reads JSON files from a directory that is populated externally
@@ -43,4 +43,3 @@ export declare class FileBasedAuthCache implements AuthCacheProvider {
  * either the old snapshot or the new one, never a mix.
  */
 export declare function writeAuthCacheSnapshot(cachePath: string, files: Record<string, unknown>): Promise<string>;
-//# sourceMappingURL=file-based-auth-cache.d.ts.map

package/dist/auth/file-based-auth-cache.js

@@ -223,4 +223,3 @@ async function cleanupOldSnapshots(cachePath, keepCount) {
         }
     }
 }
-//# sourceMappingURL=file-based-auth-cache.js.map

package/dist/auth/index.d.ts

@@ -1,7 +1,6 @@
-export type { AuthPlugin, AuthPluginFactory } from './plugin';
-export { assertAuthPluginAllowedForMode } from './plugin';
-export type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
-export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers';
-export type { HeadersLike } from './context-helpers';
-export type { AuthCacheProvider, TokenVerifier } from './caching-auth-plugin';
-//# sourceMappingURL=index.d.ts.map
+export type { AuthPlugin, AuthPluginFactory } from './plugin.js';
+export { assertAuthPluginAllowedForMode } from './plugin.js';
+export type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types.js';
+export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers.js';
+export type { HeadersLike } from './context-helpers.js';
+export type { AuthCacheProvider, TokenVerifier } from './caching-auth-plugin.js';

package/dist/auth/index.js

@@ -1,3 +1,2 @@
 export { assertAuthPluginAllowedForMode } from './plugin.js';
 export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/plugin.d.ts

@@ -1,6 +1,6 @@
-import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
-import type { CanopyUserId, CanopyGroupId } from '../types';
-import type { OperatingMode } from '../operating-mode/types';
+import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types.js';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
+import type { OperatingMode } from '../operating-mode/types.js';
 /**
  * Abstract auth provider interface.
  * Implement this to integrate different auth systems (Clerk, Auth0, NextAuth, etc.)
@@ -97,4 +97,3 @@ export type AuthPluginFactory<TConfig = unknown> = (config: TConfig) => AuthPlug
  * @throws Error when mode is 'prod' and the plugin does not set `verifiesCredentials: true`
  */
 export declare function assertAuthPluginAllowedForMode(plugin: AuthPlugin, mode: OperatingMode | undefined): void;
-//# sourceMappingURL=plugin.d.ts.map

package/dist/auth/plugin.js

@@ -25,4 +25,3 @@ export function assertAuthPluginAllowedForMode(plugin, mode) {
             "CLERK_SECRET_KEY set), or run with mode: 'dev' for local development.");
     }
 }
-//# sourceMappingURL=plugin.js.map

package/dist/auth/types.d.ts

@@ -1,4 +1,4 @@
-import type { CanopyUserId, CanopyGroupId } from '../types';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
 /**
  * User search result for permission UI
  */
@@ -62,4 +62,3 @@ export interface AuthenticationResult {
     };
     error?: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/authorization/branch.d.ts

@@ -3,18 +3,59 @@
  *
  * Handles checking if a user can access a branch based on ACLs.
  */
-import type { BranchContext } from '../types';
-import type { DefaultBranchAccess } from '../config';
-import type { CanopyUser } from '../user';
-import type { BranchAccessResult } from './types';
+import type { BranchContext } from '../types.js';
+import type { CanopyConfig, DefaultBranchAccess } from '../config/index.js';
+import type { CanopyUser } from '../user.js';
+import type { BranchAccessResult } from './types.js';
+/** Options narrowing {@link checkBranchAccessWithDefault} to a specific branch's nature. */
+export interface BranchAccessOptions {
+    /**
+     * Whether this is the protected base branch -- pass
+     * `getBranchProtection(...).isProtected`. When true, the branch passes this
+     * layer wherever no explicit ACL decided the question, and the PATH layer alone
+     * decides what is readable. Explicit ACL verdicts still win in both directions
+     * (see the comment at the fallback site).
+     *
+     * This grant is load-bearing, not a convenience. The base branch takes no ACL
+     * (`updateBranchAccessHandler` rejects one outright, because an entry there
+     * would feed `allowed_by_acl` and confer Withdraw rights) and its `createdBy`
+     * is `canopycms-system`, so nobody is its creator. Without this, the branch
+     * every user lands on is unreachable under `defaultBranchAccess: 'deny'` with
+     * no way to configure around it -- which is what made 'deny' unusable for any
+     * site with non-admin editors.
+     *
+     * It cannot widen anything dangerous: workflow actions stay blocked because
+     * {@link canPerformWorkflowAction} disables its system-branch grant on the
+     * same flag, prod writes stay blocked by `getBranchWriteProtection().readOnly`,
+     * and the editor API 401s anonymous callers before authorization runs. What it
+     * buys is that a public-read `deployedAs: 'server'` site can run 'deny' with
+     * `defaultPathAccess: { read: 'allow' }` and still keep un-ACL'd work branches
+     * private -- previously that required the blunt `defaultBranchAccess: 'allow'`,
+     * which opened every work branch too.
+     */
+    isProtectedBranch?: boolean;
+}
 /**
  * Check if user has access to a branch with explicit default behavior.
+ *
+ * Precedence, highest first:
+ * 1. Admins and Reviewers
+ * 2. `managerOrAdminAllowed` lockdown
+ * 3. An explicit user/group ACL -- an allowlist omitting the creator still
+ *    denies them, so an admin can lock down a branch someone else created
+ * 4. With no ACL: the branch creator, then `defaultAccess`, and only where that
+ *    would deny, the protected base branch grant
+ *    (see {@link BranchAccessOptions.isProtectedBranch})
  */
-export declare function checkBranchAccessWithDefault(context: BranchContext, user: CanopyUser, defaultAccess?: DefaultBranchAccess): BranchAccessResult;
+export declare function checkBranchAccessWithDefault(context: BranchContext, user: CanopyUser, defaultAccess?: DefaultBranchAccess, options?: BranchAccessOptions): BranchAccessResult;
 /**
  * Create a branch access checker with bound default access.
+ *
+ * `config` is needed to resolve whether a branch is the protected base branch;
+ * it routes through `getBranchProtection`, the single source of truth for that
+ * question, rather than repeating the base-branch test here.
  */
-export declare function createCheckBranchAccess(defaultAccess?: DefaultBranchAccess): (context: BranchContext, user: CanopyUser) => BranchAccessResult;
+export declare function createCheckBranchAccess(defaultAccess?: DefaultBranchAccess, config?: Pick<CanopyConfig, 'mode' | 'defaultBaseBranch'>): (context: BranchContext, user: CanopyUser) => BranchAccessResult;
 /** Options tightening {@link canPerformWorkflowAction} beyond the default hybrid model. */
 export interface WorkflowActionOptions {
     /**
@@ -23,6 +64,13 @@ export interface WorkflowActionOptions {
      * would otherwise let anyone with general branch access submit/withdraw it
      * -- pass `getBranchProtection(...).isProtected` here so only
      * admins/reviewers/explicit-ACL users retain workflow rights on it.
+     *
+     * It is also forwarded to {@link checkBranchAccessWithDefault}, where the same
+     * flag GRANTS access (see {@link BranchAccessOptions.isProtectedBranch}). The
+     * two pull in opposite directions on purpose, and that is exactly the intended
+     * base-branch posture: readable by anyone the path layer permits, submittable
+     * by no one. The access layer says yes, then `isSystemBranch` below is false,
+     * so a non-creator/non-ACL/non-privileged user still gets `false` here.
      */
     isProtectedBranch?: boolean;
 }
@@ -37,6 +85,9 @@ export interface WorkflowActionOptions {
  * - Admins and Reviewers always have access (via checkBranchAccess)
  * - Unless `options.isProtectedBranch` is set, in which case the system-branch
  *   grant above is disabled (see {@link WorkflowActionOptions})
+ *
+ * The creator grant is enforced twice over: `checkBranchAccessWithDefault` now
+ * admits the creator (so the gate below no longer swallows them under
+ * `defaultBranchAccess: 'deny'`), and `userIsCreator` still decides the result.
  */
 export declare function canPerformWorkflowAction(context: BranchContext, user: CanopyUser, defaultAccess?: DefaultBranchAccess, options?: WorkflowActionOptions): boolean;
-//# sourceMappingURL=branch.d.ts.map

package/dist/authorization/branch.js

@@ -4,10 +4,20 @@
  * Handles checking if a user can access a branch based on ACLs.
  */
 import { isAdmin, isReviewer } from './helpers.js';
+import { getBranchProtection } from './protected-branch.js';
 /**
  * Check if user has access to a branch with explicit default behavior.
+ *
+ * Precedence, highest first:
+ * 1. Admins and Reviewers
+ * 2. `managerOrAdminAllowed` lockdown
+ * 3. An explicit user/group ACL -- an allowlist omitting the creator still
+ *    denies them, so an admin can lock down a branch someone else created
+ * 4. With no ACL: the branch creator, then `defaultAccess`, and only where that
+ *    would deny, the protected base branch grant
+ *    (see {@link BranchAccessOptions.isProtectedBranch})
  */
-export function checkBranchAccessWithDefault(context, user, defaultAccess = 'deny') {
+export function checkBranchAccessWithDefault(context, user, defaultAccess = 'deny', options) {
     // Admins and Reviewers have full branch access
     if (isAdmin(user.groups) || isReviewer(user.groups)) {
         return { allowed: true, reason: 'privileged' };
@@ -16,12 +26,34 @@ export function checkBranchAccessWithDefault(context, user, defaultAccess = 'den
     const hasUserConstraint = !!access.allowedUsers?.length;
     const hasGroupConstraint = !!access.allowedGroups?.length;
     const managerOrAdminAllowed = access.managerOrAdminAllowed ?? false;
+    if (!hasUserConstraint && !hasGroupConstraint && managerOrAdminAllowed) {
+        return { allowed: false, reason: 'denied_by_acl' };
+    }
     if (!hasUserConstraint && !hasGroupConstraint) {
-        if (managerOrAdminAllowed) {
-            return { allowed: false, reason: 'denied_by_acl' };
+        // The branch creator owns their own un-ACL'd branch. This matches the three
+        // places the server already grants on creator-ownership independently of
+        // branch access (listBranchesHandler, canDeleteBranch, canModifyBranchAccess)
+        // -- without it, under 'deny' a creator could delete their branch and rewrite
+        // its ACL but not read a single file on it.
+        //
+        // Deliberately scoped to the no-ACL case: an EXPLICIT allowlist that omits
+        // the creator still denies them, because that is how an admin locks down a
+        // branch someone else created. Granting creator ahead of the ACL would make
+        // that lockdown silently ineffective.
+        if (context.branch.createdBy === user.userId) {
+            return { allowed: true, reason: 'creator' };
+        }
+        if (defaultAccess === 'allow') {
+            return { allowed: true, reason: 'no_acl' };
         }
-        const allowed = defaultAccess === 'allow';
-        return { allowed, reason: 'no_acl' };
+        // Same scoping rationale for the base branch: only where the bare default
+        // would otherwise decide. A short-circuit higher up would replace
+        // 'allowed_by_acl' with 'base_branch' and silently strip Withdraw rights
+        // from ACL-listed users, and would override an explicit 'denied_by_acl'.
+        if (options?.isProtectedBranch) {
+            return { allowed: true, reason: 'base_branch' };
+        }
+        return { allowed: false, reason: 'no_acl' };
     }
     const userAllowed = hasUserConstraint && access.allowedUsers?.includes(user.userId);
     const groupAllowed = hasGroupConstraint && user.groups?.some((g) => access.allowedGroups?.includes(g));
@@ -30,9 +62,17 @@ export function checkBranchAccessWithDefault(context, user, defaultAccess = 'den
 }
 /**
  * Create a branch access checker with bound default access.
+ *
+ * `config` is needed to resolve whether a branch is the protected base branch;
+ * it routes through `getBranchProtection`, the single source of truth for that
+ * question, rather than repeating the base-branch test here.
  */
-export function createCheckBranchAccess(defaultAccess = 'deny') {
-    return (context, user) => checkBranchAccessWithDefault(context, user, defaultAccess);
+export function createCheckBranchAccess(defaultAccess = 'deny', config) {
+    return (context, user) => checkBranchAccessWithDefault(context, user, defaultAccess, {
+        isProtectedBranch: config
+            ? getBranchProtection(config, context.branch.name, context.branch.baseBranch).isProtected
+            : false,
+    });
 }
 /**
  * Check if user can perform workflow actions (submit/withdraw) on a branch.
@@ -45,10 +85,16 @@ export function createCheckBranchAccess(defaultAccess = 'deny') {
  * - Admins and Reviewers always have access (via checkBranchAccess)
  * - Unless `options.isProtectedBranch` is set, in which case the system-branch
  *   grant above is disabled (see {@link WorkflowActionOptions})
+ *
+ * The creator grant is enforced twice over: `checkBranchAccessWithDefault` now
+ * admits the creator (so the gate below no longer swallows them under
+ * `defaultBranchAccess: 'deny'`), and `userIsCreator` still decides the result.
  */
 export function canPerformWorkflowAction(context, user, defaultAccess = 'deny', options) {
-    // Check if user has general branch access (handles admins, reviewers, ACLs)
-    const accessResult = checkBranchAccessWithDefault(context, user, defaultAccess);
+    // Check if user has general branch access (handles admins, reviewers, creator, ACLs)
+    const accessResult = checkBranchAccessWithDefault(context, user, defaultAccess, {
+        isProtectedBranch: options?.isProtectedBranch,
+    });
     // If user doesn't have basic branch access, deny immediately
     if (!accessResult.allowed) {
         return false;
@@ -66,4 +112,3 @@ export function canPerformWorkflowAction(context, user, defaultAccess = 'deny',
         accessResult.reason === 'allowed_by_acl' ||
         (isSystemBranch && accessResult.allowed));
 }
-//# sourceMappingURL=branch.js.map

package/dist/authorization/content.d.ts

@@ -6,7 +6,7 @@
  *
  * Usage:
  * ```ts
- * import { checkContentAccess } from './authorization'
+ * import { checkContentAccess } from './authorization.js'
  *
  * const result = await checkContentAccess(deps, context, branchRoot, 'content/posts/my-post.mdx', user, 'edit')
  * if (result.allowed) {
@@ -14,11 +14,11 @@
  * }
  * ```
  */
-import type { BranchContext } from '../types';
-import type { PermissionLevel } from '../config';
-import type { CanopyUser } from '../user';
-import type { ContentAccessResult, ContentAccessDeps } from './types';
-import type { PhysicalPath } from '../paths/types';
+import type { BranchContext } from '../types.js';
+import type { PermissionLevel } from '../config/index.js';
+import type { CanopyUser } from '../user.js';
+import type { ContentAccessResult, ContentAccessDeps } from './types.js';
+import type { PhysicalPath } from '../paths/types.js';
 /**
  * A bound content-access checker: evaluates a single path/level synchronously
  * against permissions that were already loaded when the checker was created.
@@ -57,4 +57,3 @@ export declare function checkContentAccess(deps: ContentAccessDeps, context: Bra
  * Create a content access checker with bound dependencies.
  */
 export declare function createCheckContentAccess(deps: ContentAccessDeps): (context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel) => Promise<ContentAccessResult>;
-//# sourceMappingURL=content.d.ts.map

package/dist/authorization/content.js

@@ -84,4 +84,3 @@ export async function checkContentAccess(deps, context, branchRoot, relativePath
 export function createCheckContentAccess(deps) {
     return (context, branchRoot, relativePath, user, level) => checkContentAccess(deps, context, branchRoot, relativePath, user, level);
 }
-//# sourceMappingURL=content.js.map

package/dist/authorization/groups/index.d.ts

@@ -1,6 +1,5 @@
 /**
  * Groups module exports
  */
-export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, } from './schema';
-export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader';
-//# sourceMappingURL=index.d.ts.map
+export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, } from './schema.js';
+export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader.js';

package/dist/authorization/groups/index.js

@@ -3,4 +3,3 @@
  */
 export { GroupsFileSchema, createDefaultGroupsFile, } from './schema.js';
 export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader.js';
-//# sourceMappingURL=index.js.map