canopycms 0.0.63 → 0.0.64

package/dist/api/resolve-references.js

@@ -2,6 +2,8 @@ import { z } from 'zod';
 import { ContentStore } from '../content-store.js';
 import { defineEndpoint } from './route-builder.js';
 import { ReferenceResolver } from '../reference-resolver.js';
+import { buildResolvedReference } from '../entry-schema.js';
+import { computeEntryUrl } from '../utils/entry-url.js';
 import { branchNameSchema, contentIdSchema } from './validators.js';
 // ============================================================================
 // Zod Schemas for Validation
@@ -23,8 +25,9 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
     const { branchContext } = gc;
     const { ids } = body;
     const flatSchema = branchContext.flatSchema;
+    const contentRootName = ctx.services.config.contentRoot || 'content';
     const store = new ContentStore(branchContext.branchRoot, flatSchema, {
-        contentRootName: ctx.services.config.contentRoot || 'content',
+        contentRootName,
     });
     // Get ID index (automatically loads if needed)
     const idIndex = await store.idIndex();
@@ -45,12 +48,28 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
                 const access = checkAccess(resolvedPath.relativePath, 'read');
                 if (!access.allowed)
                     continue;
-                const doc = await store.read(result.collection, result.slug);
+                // `resolveReferences: false` matches what the server-side resolver does
+                // (content-store.ts's resolveSingleReferenceOnce reads its targets the same way).
+                // Without it this endpoint resolved one level DEEPER than production, so a nested
+                // reference inside a target rendered as an object in live preview and as a bare ID
+                // string on the published site.
+                const doc = await store.read(result.collection, result.slug, { resolveReferences: false });
                 if (doc && doc.data) {
-                    resolved[id] = {
+                    // Same shape the server-side resolver produces (content-store.ts's
+                    // resolveSingleReferenceOnce): the target's data first, then the reserved keys.
+                    //
+                    // Both halves matter. The ORDER is the corruption guard -- a target modelling `id`
+                    // as content must not shadow the real content ID. The extra KEYS are what stops the
+                    // editor's live preview disagreeing with production: this endpoint feeds
+                    // client-reference-resolver.ts, so without `urlPath` a component rendering
+                    // `<a href={ref.urlPath}>` showed `undefined` while previewing and a real URL once
+                    // published -- exactly the class of divergence live preview exists to rule out.
+                    resolved[id] = buildResolvedReference(doc.data, {
                         id,
-                        ...doc.data,
-                    };
+                        slug: result.slug,
+                        collection: result.collection,
+                        urlPath: computeEntryUrl(result.collection, result.slug, contentRootName),
+                    });
                 }
             }
         }
@@ -93,4 +112,3 @@ const resolveReferences = defineEndpoint({
 export const RESOLVE_REFERENCES_ROUTES = {
     post: resolveReferences,
 };
-//# sourceMappingURL=resolve-references.js.map

package/dist/api/route-builder.d.ts

@@ -9,8 +9,8 @@
  * - Self-documents the API surface
  */
 import type { z } from 'zod';
-import type { ApiContext, ApiRequest } from './types';
-import { type GuardId, type ComputeGuardContext } from './guards';
+import type { ApiContext, ApiRequest } from './types.js';
+import { type GuardId, type ComputeGuardContext } from './guards.js';
 /**
  * Cast specification for branded types in mock data.
  * Maps field paths to cast function names.
@@ -126,4 +126,3 @@ export declare function defineEndpoint<TGuards extends readonly [GuardId, ...Gua
  */
 export declare function getAllRoutes(): RouteMetadata[];
 export {};
-//# sourceMappingURL=route-builder.d.ts.map

package/dist/api/route-builder.js

@@ -106,4 +106,3 @@ export function defineEndpoint(config) {
 export function getAllRoutes() {
     return ROUTE_REGISTRY;
 }
-//# sourceMappingURL=route-builder.js.map

package/dist/api/schema.d.ts

@@ -10,9 +10,9 @@
  * Schema changes are branch-specific (like content edits).
  */
 import { z } from 'zod';
-import type { ApiResponse } from './types';
-import type { ContentFormat, EntrySchema } from '../config';
-import { type LogicalPath, type ContentId } from '../paths';
+import type { ApiResponse } from './types.js';
+import type { ContentFormat, EntrySchema } from '../config/index.js';
+import { type LogicalPath, type ContentId } from '../paths/index.js';
 /** Entry type in wire format: schemaRef instead of resolved schema */
 export interface WireEntryType {
     readonly name: string;
@@ -126,8 +126,8 @@ declare const updateOrderBodySchema: z.ZodObject<{
 /**
  * GET /:branch/schema - Get full schema
  */
-export declare const getSchema: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const getSchema: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
         readonly __brand: "BranchName";
@@ -141,8 +141,8 @@ export declare const getSchema: import("./route-builder").RouteDefinition<z.ZodO
  * GET /:branch/schema/collection/...collectionPath - Get single collection
  * Note: Uses 'collection' (singular) with catch-all to support paths with slashes
  */
-export declare const getCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const getCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
@@ -162,8 +162,8 @@ export declare const getCollection: import("./route-builder").RouteDefinition<z.
 /**
  * POST /:branch/schema/collections - Create collection
  */
-export declare const createCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const createCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
         readonly __brand: "BranchName";
@@ -227,8 +227,8 @@ export declare const createCollection: import("./route-builder").RouteDefinition
  * PATCH /:branch/schema/collection/...collectionPath - Update collection
  * Note: Uses 'collection' (singular) with catch-all to support paths with slashes
  */
-export declare const updateCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const updateCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
@@ -264,8 +264,8 @@ export declare const updateCollection: import("./route-builder").RouteDefinition
  * DELETE /:branch/schema/collection/...collectionPath - Delete collection
  * Note: Uses 'collection' (singular) with catch-all to support paths with slashes
  */
-export declare const deleteCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const deleteCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
@@ -286,8 +286,8 @@ export declare const deleteCollection: import("./route-builder").RouteDefinition
  * POST /:branch/schema/entry-types/...collectionPath - Add entry type
  * Note: Restructured URL with catch-all at end to support paths with slashes
  */
-export declare const addEntryType: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const addEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
@@ -329,8 +329,8 @@ export declare const addEntryType: import("./route-builder").RouteDefinition<z.Z
  * PATCH /:branch/schema/entry-types/:entryTypeName/...collectionPath - Update entry type
  * Note: Restructured URL with entry type name before catch-all path
  */
-export declare const updateEntryType: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const updateEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     entryTypeName: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -372,8 +372,8 @@ export declare const updateEntryType: import("./route-builder").RouteDefinition<
  * DELETE /:branch/schema/entry-types/:entryTypeName/...collectionPath - Remove entry type
  * Note: Restructured URL with entry type name before catch-all path
  */
-export declare const removeEntryType: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const removeEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     entryTypeName: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -397,8 +397,8 @@ export declare const removeEntryType: import("./route-builder").RouteDefinition<
  * PATCH /:branch/schema/order/...collectionPath - Update item order
  * Note: Restructured URL with catch-all at end to support paths with slashes
  */
-export declare const updateOrder: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const updateOrder: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
@@ -424,8 +424,8 @@ export declare const updateOrder: import("./route-builder").RouteDefinition<z.Zo
 /**
  * POST /:branch/schema/invalidate-cache - Invalidate schema cache
  */
-export declare const invalidateSchemaCache: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const invalidateSchemaCache: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
         readonly __brand: "BranchName";
@@ -438,8 +438,8 @@ export declare const invalidateSchemaCache: import("./route-builder").RouteDefin
 /** Body type for updateOrder endpoint */
 export type UpdateOrderBody = z.infer<typeof updateOrderBodySchema>;
 export declare const SCHEMA_ROUTES: {
-    readonly get: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly get: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
             readonly __brand: "BranchName";
@@ -449,8 +449,8 @@ export declare const SCHEMA_ROUTES: {
             readonly __brand: "BranchName";
         };
     }>, undefined, GetSchemaApiResponse>;
-    readonly getCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly getCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
@@ -467,8 +467,8 @@ export declare const SCHEMA_ROUTES: {
             readonly __brand: "LogicalPath";
         };
     }>, undefined, GetCollectionApiResponse>;
-    readonly createCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly createCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
             readonly __brand: "BranchName";
@@ -528,8 +528,8 @@ export declare const SCHEMA_ROUTES: {
         label?: string | undefined;
         parentPath?: string | undefined;
     }>, CreateCollectionApiResponse>;
-    readonly updateCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly updateCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
@@ -561,8 +561,8 @@ export declare const SCHEMA_ROUTES: {
         label?: string | undefined;
         order?: string[] | undefined;
     }>, UpdateCollectionApiResponse>;
-    readonly deleteCollection: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly deleteCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
@@ -579,8 +579,8 @@ export declare const SCHEMA_ROUTES: {
             readonly __brand: "LogicalPath";
         };
     }>, undefined, DeleteCollectionApiResponse>;
-    readonly addEntryType: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly addEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
@@ -618,8 +618,8 @@ export declare const SCHEMA_ROUTES: {
         label?: string | undefined;
         maxItems?: number | undefined;
     }>, AddEntryTypeApiResponse>;
-    readonly updateEntryType: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly updateEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
         entryTypeName: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -657,8 +657,8 @@ export declare const SCHEMA_ROUTES: {
         schema?: string | undefined;
         maxItems?: number | undefined;
     }>, UpdateEntryTypeApiResponse>;
-    readonly removeEntryType: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly removeEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
         entryTypeName: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -678,8 +678,8 @@ export declare const SCHEMA_ROUTES: {
             readonly __brand: "LogicalPath";
         };
     }>, undefined, RemoveEntryTypeApiResponse>;
-    readonly updateOrder: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly updateOrder: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collectionPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
@@ -702,8 +702,8 @@ export declare const SCHEMA_ROUTES: {
     }, {
         order: string[];
     }>, UpdateOrderApiResponse>;
-    readonly invalidateSchemaCache: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly invalidateSchemaCache: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
             readonly __brand: "BranchName";
@@ -715,4 +715,3 @@ export declare const SCHEMA_ROUTES: {
     }>, undefined, InvalidateSchemaCacheApiResponse>;
 };
 export {};
-//# sourceMappingURL=schema.d.ts.map

package/dist/api/schema.js

@@ -688,4 +688,3 @@ export const SCHEMA_ROUTES = {
     updateOrder,
     invalidateSchemaCache,
 };
-//# sourceMappingURL=schema.js.map

package/dist/api/settings-helpers.d.ts

@@ -1,5 +1,5 @@
-import type { ApiContext } from './types';
-import type { OperatingMode } from '../operating-mode';
+import type { ApiContext } from './types.js';
+import type { OperatingMode } from '../operating-mode/index.js';
 /**
  * Get the appropriate root path for settings (permissions/groups).
  * Returns the settings root managed by the settings workspace.
@@ -41,4 +41,3 @@ export declare function commitSettings(ctx: ApiContext, options: {
     message: string;
     mode: OperatingMode;
 }): Promise<CommitSettingsResult>;
-//# sourceMappingURL=settings-helpers.d.ts.map

package/dist/api/settings-helpers.js

@@ -55,4 +55,3 @@ export async function commitSettings(ctx, options) {
     }
     return { pushed: true };
 }
-//# sourceMappingURL=settings-helpers.js.map

package/dist/api/types.d.ts

@@ -1,9 +1,9 @@
-import type { BranchContext } from '../types';
-import type { AuthPlugin } from '../auth/plugin';
-import type { CanopyServices } from '../services';
-import type { CanopyUser } from '../user';
-import type { AssetStore } from '../assets/types';
-import type { CanopyRequest } from '../http/types';
+import type { BranchContext } from '../types.js';
+import type { AuthPlugin } from '../auth/plugin.js';
+import type { CanopyServices } from '../services.js';
+import type { CanopyUser } from '../user.js';
+import type { AssetStore } from '../assets/types.js';
+import type { CanopyRequest } from '../http/types.js';
 export interface ApiContext {
     services: CanopyServices;
     assetStore?: AssetStore;
@@ -54,4 +54,3 @@ export interface ApiResponse<TData = unknown> {
         message: string;
     }>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/api/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/api/user.d.ts

@@ -1,9 +1,8 @@
-import type { ApiResponse } from './types';
+import type { ApiResponse } from './types.js';
 export type UserInfoResponse = ApiResponse<{
     userId: string;
     groups: string[];
 }>;
 export declare const USER_ROUTES: {
-    readonly whoami: import("./route-builder").RouteDefinition<undefined, undefined, UserInfoResponse>;
+    readonly whoami: import("./route-builder.js").RouteDefinition<undefined, undefined, UserInfoResponse>;
 };
-//# sourceMappingURL=user.d.ts.map

package/dist/api/user.js

@@ -31,4 +31,3 @@ const getUserInfo = defineEndpoint({
 export const USER_ROUTES = {
     whoami: getUserInfo,
 };
-//# sourceMappingURL=user.js.map

package/dist/api/validators.d.ts

@@ -6,7 +6,7 @@
  *
  * Usage:
  * ```ts
- * import { branchNameSchema, logicalPathSchema } from './validators'
+ * import { branchNameSchema, logicalPathSchema } from './validators.js'
  *
  * const paramsSchema = z.object({
  *   branch: branchNameSchema,
@@ -20,8 +20,8 @@
  * ```
  */
 import { z } from 'zod';
-import { type BranchName, type LogicalPath, type ContentId, type Slug } from '../paths';
-import { type PermissionPath } from '../authorization';
+import { type BranchName, type LogicalPath, type ContentId, type Slug } from '../paths/index.js';
+import { type PermissionPath } from '../authorization/index.js';
 /**
  * Zod schema for BranchName - validates git branch naming rules and brands.
  *
@@ -93,4 +93,3 @@ export declare const permissionPathSchema: z.ZodType<PermissionPath>;
  * validate() calls). NOT z.coerce.boolean(), which coerces 'false' to true.
  */
 export declare const queryBooleanSchema: z.ZodEffects<z.ZodUnion<[z.ZodBoolean, z.ZodEnum<["true", "false"]>]>, boolean, boolean | "true" | "false">;
-//# sourceMappingURL=validators.d.ts.map

package/dist/api/validators.js

@@ -149,4 +149,3 @@ export const permissionPathSchema = z
 export const queryBooleanSchema = z
     .union([z.boolean(), z.enum(['true', 'false'])])
     .transform((v) => v === true || v === 'true');
-//# sourceMappingURL=validators.js.map

package/dist/assets/asset-prefixes.d.ts

@@ -7,7 +7,7 @@
  * (transform-directives.ts, asset-url.ts) can import the prefix strings
  * directly without pulling keys.ts's `node:crypto` import (used only by
  * `hashBytes`) into a browser bundle. keys.ts re-exports `ASSET_PREFIXES`
- * from here so existing imports of it from './keys' keep working unchanged.
+ * from here so existing imports of it from './keys.js' keep working unchanged.
  */
 export declare const ASSET_PREFIXES: {
     readonly originals: "asset-originals";
@@ -28,4 +28,3 @@ export interface AssetPrefixes {
     public: string;
     transform: string;
 }
-//# sourceMappingURL=asset-prefixes.d.ts.map

package/dist/assets/asset-prefixes.js

@@ -17,4 +17,3 @@ export const ASSET_PREFIXES = {
     /** Transform-output prefix; directive-aware key building lives in transform-directives.ts. */
     transform: 'assets/t',
 };
-//# sourceMappingURL=asset-prefixes.js.map

package/dist/assets/asset-src.d.ts

@@ -12,12 +12,24 @@
  * decided now (rather than switching every raster URL over once transforms
  * ship) so content written by this PR stays valid without a migration.
  *
- * Always root-relative - `media.publicBaseUrl` is editor-display-only (PR 6's
- * concern) and must never be baked into stored/served content URLs.
+ * Always root-relative, and this is the value that gets STORED in content.
+ * Content moves between branches and environments, so a stored src must not
+ * name an origin or a deployment prefix - it names only the asset's position
+ * in the `/assets` URL space.
+ *
+ * Prefixing is a separate, render-time concern: `assetUrl()`'s `baseUrl` option
+ * (assets/asset-url.ts) puts the mount point in front, and is the ONLY place a
+ * prefix is applied. Do not confuse the two:
+ *
+ * - `assetSrc()` (here)        -> stored, always root-relative, no prefix ever.
+ * - `assetUrl(ref, {baseUrl})` -> rendered, prefix applied, never written back.
+ *
+ * `media.publicBaseUrl` is one source of that render-time prefix (the editor's,
+ * for when the editor is served from a different origin) - it is config for
+ * display, not a property of the asset.
  */
-import { IDENTITY_TRANSFORM_DIRECTIVE } from './transform-directives';
-import type { AssetMeta } from './types';
+import { IDENTITY_TRANSFORM_DIRECTIVE } from './transform-directives.js';
+import type { AssetMeta } from './types.js';
 /** Re-exported for existing importers (assets/index.ts barrel) - the value now lives in transform-directives.ts, PR 4's pure directive module, so it's reachable without pulling keys.ts's node:crypto import into client bundles. */
 export { IDENTITY_TRANSFORM_DIRECTIVE };
 export declare function assetSrc(meta: Pick<AssetMeta, 'hash32' | 'slug' | 'ext' | 'kind'>): string;
-//# sourceMappingURL=asset-src.d.ts.map

package/dist/assets/asset-src.js

@@ -12,8 +12,21 @@
  * decided now (rather than switching every raster URL over once transforms
  * ship) so content written by this PR stays valid without a migration.
  *
- * Always root-relative - `media.publicBaseUrl` is editor-display-only (PR 6's
- * concern) and must never be baked into stored/served content URLs.
+ * Always root-relative, and this is the value that gets STORED in content.
+ * Content moves between branches and environments, so a stored src must not
+ * name an origin or a deployment prefix - it names only the asset's position
+ * in the `/assets` URL space.
+ *
+ * Prefixing is a separate, render-time concern: `assetUrl()`'s `baseUrl` option
+ * (assets/asset-url.ts) puts the mount point in front, and is the ONLY place a
+ * prefix is applied. Do not confuse the two:
+ *
+ * - `assetSrc()` (here)        -> stored, always root-relative, no prefix ever.
+ * - `assetUrl(ref, {baseUrl})` -> rendered, prefix applied, never written back.
+ *
+ * `media.publicBaseUrl` is one source of that render-time prefix (the editor's,
+ * for when the editor is served from a different origin) - it is config for
+ * display, not a property of the asset.
  */
 import { ASSET_PREFIXES } from './asset-prefixes.js';
 import { IDENTITY_TRANSFORM_DIRECTIVE } from './transform-directives.js';
@@ -25,4 +38,3 @@ export function assetSrc(meta) {
     }
     return `/${ASSET_PREFIXES.transform}/${IDENTITY_TRANSFORM_DIRECTIVE}/${meta.hash32}/${meta.slug}.${meta.ext}`;
 }
-//# sourceMappingURL=asset-src.js.map

package/dist/assets/asset-url.d.ts

@@ -1,11 +1,11 @@
 /**
  * Build/adjust transform URLs for `<img>`/srcset without pulling in the
- * server-only transform engine. Isomorphic - only depends on
- * transform-directives.ts and the plain `ASSET_PREFIXES` constant, neither
- * of which import node builtins, so this is safe to import from client
- * (editor) code as well as during static builds.
+ * server-only transform engine. Isomorphic - depends only on
+ * transform-directives.ts, the plain `ASSET_PREFIXES` constant, and
+ * utils/url-prefix.ts, none of which import node builtins, so this is safe to
+ * import from client (editor) code as well as during static builds.
  */
-import { type CropRect, type OutputFormat } from './transform-directives';
+import { type CropRect, type OutputFormat } from './transform-directives.js';
 /** The minimal shape `assetUrl`/`assetSrcSet` need from a stored asset reference. */
 export interface AssetRef {
     src: string;
@@ -15,7 +15,29 @@ export interface AssetUrlOptions {
     format?: OutputFormat;
     quality?: number;
     crop?: CropRect;
-    /** Prefixed onto the result, e.g. `media.publicBaseUrl` when the editor is served from a different origin than the site. */
+    /**
+     * Where the `/assets` URL space is mounted **as seen by this renderer**. Prefixed onto the
+     * result at render time.
+     *
+     * This is the ONE prefix concept for asset URLs; there is deliberately no second "basePath"
+     * option beside it. Two shapes are legitimate, and they are alternatives, never composed:
+     *
+     * - An absolute origin (`https://assets.example.com`) — assets served from another origin.
+     *   `media.publicBaseUrl` is one source of this, and is the source the editor uses; it is
+     *   validated as an absolute URL, so it structurally cannot carry the second shape.
+     * - A same-origin path prefix (`/preview-123`) — the site is deployed under a Next `basePath`
+     *   AND its assets are served by Next (`withCanopy`'s `/assets/:path*` rewrite, which Next
+     *   auto-prefixes). NOT the right value on a CloudFront/CDK deployment, where the asset
+     *   behaviors are anchored at the distribution root and a `basePath` does not move them —
+     *   there the correct value is none at all. See the README's asset-mount table.
+     *
+     * It is a per-render option rather than a config field precisely because the editor and the
+     * public site can legitimately have different answers.
+     *
+     * **Render-time only — never stored.** A stored `src` is always root-relative (see
+     * `assets/asset-src.ts`), because content moves between branches and environments. Nothing
+     * that writes content may bake this prefix in.
+     */
     baseUrl?: string;
 }
 /**
@@ -32,4 +54,3 @@ export declare function assetUrl(ref: AssetRef, opts?: AssetUrlOptions): string;
  * invalid width throws rather than silently dropping it.
  */
 export declare function assetSrcSet(ref: AssetRef, widths: readonly number[], opts?: Omit<AssetUrlOptions, 'width'>): string;
-//# sourceMappingURL=asset-url.d.ts.map

package/dist/assets/asset-url.js

@@ -1,20 +1,14 @@
 /**
  * Build/adjust transform URLs for `<img>`/srcset without pulling in the
- * server-only transform engine. Isomorphic - only depends on
- * transform-directives.ts and the plain `ASSET_PREFIXES` constant, neither
- * of which import node builtins, so this is safe to import from client
- * (editor) code as well as during static builds.
+ * server-only transform engine. Isomorphic - depends only on
+ * transform-directives.ts, the plain `ASSET_PREFIXES` constant, and
+ * utils/url-prefix.ts, none of which import node builtins, so this is safe to
+ * import from client (editor) code as well as during static builds.
  */
+import { isUnprefixablePath, joinUrlPrefix, sanitizeUnprefixedPath, stripTrailingSlashes, } from '../utils/url-prefix.js';
 import { ASSET_PREFIXES } from './asset-prefixes.js';
 import { formatDirectives, isAllowedTransformWidth, parseTransformPath, } from './transform-directives.js';
 const TRANSFORM_URL_PREFIX = `/${ASSET_PREFIXES.transform}/`;
-function joinBaseUrl(baseUrl, urlPath) {
-    if (!baseUrl)
-        return urlPath;
-    const trimmedBase = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;
-    const trimmedPath = urlPath.startsWith('/') ? urlPath : `/${urlPath}`;
-    return `${trimmedBase}${trimmedPath}`;
-}
 /**
  * Merge `opts` over an already-parsed directive set - opts win when given,
  * otherwise the existing value (if any) carries over. Returns `undefined`
@@ -41,14 +35,26 @@ function mergeDirectives(current, opts) {
 export function assetUrl(ref, opts = {}) {
     const { src } = ref;
     if (!src.startsWith(TRANSFORM_URL_PREFIX)) {
-        return joinBaseUrl(opts.baseUrl, src);
+        // A src canopycms doesn't own comes back byte-identical wherever it legitimately can. The
+        // README routes every markdown/MDX body image through here so a basePath deployment can prefix
+        // them, and bodies carry srcs we never wrote: `data:` URIs and off-site URLs, which no mount
+        // point applies to. `sanitizeUnprefixedPath` still neutralizes a value that a browser would
+        // read as off-origin, so "leave it alone" never means "emit `/\evil.com`".
+        //
+        // The mount test is `stripTrailingSlashes`, not just truthiness, so every spelling of "no
+        // mount point" behaves the same: '', '/', '///' and '//' all mean root, matching
+        // `joinUrlPrefix`'s own contract. Plain `!opts.baseUrl` made '' and '/' disagree.
+        const mount = opts.baseUrl ? stripTrailingSlashes(opts.baseUrl) : '';
+        if (!mount || isUnprefixablePath(src))
+            return sanitizeUnprefixedPath(src);
+        return joinUrlPrefix(opts.baseUrl, src);
     }
     const rest = src.slice(TRANSFORM_URL_PREFIX.length);
     const parsed = parseTransformPath(rest.split('/'));
     if (!parsed.ok) {
         // Malformed src (shouldn't happen for a src canopycms itself wrote) -
         // nothing sensible to merge onto, so return it unchanged rather than throw.
-        return joinBaseUrl(opts.baseUrl, src);
+        return joinUrlPrefix(opts.baseUrl, src);
     }
     const merged = mergeDirectives(parsed.directives, opts);
     // Ext follows the format: an explicit format (new or carried over) always
@@ -56,7 +62,7 @@ export function assetUrl(ref, opts = {}) {
     // real extension, which is exactly what `parsed.ext` already is here.
     const ext = !merged.identity && merged.format !== undefined ? merged.format : parsed.ext;
     const newSrc = `${TRANSFORM_URL_PREFIX}${formatDirectives(merged)}/${parsed.hash32}/${parsed.slug}.${ext}`;
-    return joinBaseUrl(opts.baseUrl, newSrc);
+    return joinUrlPrefix(opts.baseUrl, newSrc);
 }
 /**
  * Build a comma-joined `url w` srcset descriptor list. `widths` must all be
@@ -74,4 +80,3 @@ export function assetSrcSet(ref, widths, opts = {}) {
     })
         .join(', ');
 }
-//# sourceMappingURL=asset-url.js.map