canopycms 0.0.63 → 0.0.65

package/dist/editor/client-reference-resolver.d.ts

@@ -1,8 +1,18 @@
-import type { EntrySchema, FieldConfig } from '../config';
-import type { FormValue } from './FormRenderer';
+import type { EntrySchema, FieldConfig } from '../config/index.js';
+import type { FormValue } from './FormRenderer.js';
+import type { ApiClient } from './context/index.js';
 /**
  * Client-side utility for incrementally resolving reference fields in form data.
  * Used by FormRenderer to transform draft data before sending to preview.
+ *
+ * This module is a plain function file, not a hook/component -- it's invoked from inside a
+ * `setTimeout` callback in `useReferenceResolution`'s effect, well after that render has
+ * finished, where calling a React hook would violate the rules of hooks. So the API client
+ * can't be sourced here via `useApiClient()`/`useOptionalApiClient()` directly; instead every
+ * entry point takes an optional `apiClient`, which the caller (a hook, which CAN call
+ * `useOptionalApiClient()` during render) resolves and passes down. Falls back to a
+ * default-configured `createApiClient()` when no client is supplied, so direct callers/tests
+ * that predate this DI path keep working unchanged.
  */
 /**
  * Find which fields changed between two form values.
@@ -14,5 +24,4 @@ export declare function findChangedFields(prevValue: FormValue, currentValue: Fo
  * Only resolves reference fields that have changed.
  * Uses cache to avoid duplicate API calls.
  */
-export declare function resolveChangedReferences(prevValue: FormValue, currentValue: FormValue, schema: EntrySchema, branch: string, cache: Map<string, unknown>): Promise<Partial<FormValue>>;
-//# sourceMappingURL=client-reference-resolver.d.ts.map
+export declare function resolveChangedReferences(prevValue: FormValue, currentValue: FormValue, schema: EntrySchema, branch: string, cache: Map<string, unknown>, apiClient?: ApiClient): Promise<Partial<FormValue>>;

package/dist/editor/client-reference-resolver.js

@@ -3,6 +3,15 @@ import { flattenGroupFields } from '../utils/flatten-group-fields.js';
 /**
  * Client-side utility for incrementally resolving reference fields in form data.
  * Used by FormRenderer to transform draft data before sending to preview.
+ *
+ * This module is a plain function file, not a hook/component -- it's invoked from inside a
+ * `setTimeout` callback in `useReferenceResolution`'s effect, well after that render has
+ * finished, where calling a React hook would violate the rules of hooks. So the API client
+ * can't be sourced here via `useApiClient()`/`useOptionalApiClient()` directly; instead every
+ * entry point takes an optional `apiClient`, which the caller (a hook, which CAN call
+ * `useOptionalApiClient()` during render) resolves and passes down. Falls back to a
+ * default-configured `createApiClient()` when no client is supplied, so direct callers/tests
+ * that predate this DI path keep working unchanged.
  */
 /**
  * Find which fields changed between two form values.
@@ -25,7 +34,7 @@ export function findChangedFields(prevValue, currentValue, schema) {
  * Only resolves reference fields that have changed.
  * Uses cache to avoid duplicate API calls.
  */
-export async function resolveChangedReferences(prevValue, currentValue, schema, branch, cache) {
+export async function resolveChangedReferences(prevValue, currentValue, schema, branch, cache, apiClient) {
     const changedFields = findChangedFields(prevValue, currentValue, schema);
     const updates = {};
     for (const field of changedFields) {
@@ -35,12 +44,12 @@ export async function resolveChangedReferences(prevValue, currentValue, schema,
             // Resolve this field's value
             if (refField.list && Array.isArray(fieldValue)) {
                 // List of references
-                const resolved = await Promise.all(fieldValue.map((id) => resolveReferenceId(id, branch, cache)));
+                const resolved = await Promise.all(fieldValue.map((id) => resolveReferenceId(id, branch, cache, apiClient)));
                 updates[field.name] = resolved;
             }
             else if (fieldValue) {
                 // Single reference
-                const resolved = await resolveReferenceId(fieldValue, branch, cache);
+                const resolved = await resolveReferenceId(fieldValue, branch, cache, apiClient);
                 updates[field.name] = resolved;
             }
         }
@@ -52,7 +61,7 @@ export async function resolveChangedReferences(prevValue, currentValue, schema,
  * Checks cache first, then makes API call if needed.
  * Returns original ID if resolution fails.
  */
-async function resolveReferenceId(id, branch, cache) {
+async function resolveReferenceId(id, branch, cache, apiClient) {
     // Only resolve string IDs
     if (typeof id !== 'string') {
         return id;
@@ -67,9 +76,11 @@ async function resolveReferenceId(id, branch, cache) {
         return cache.get(cacheKey);
     }
     try {
-        // Fetch from API (single ID)
-        const apiClient = createApiClient();
-        const result = await apiClient.content.resolveReferences({ branch }, { ids: [id] });
+        // Fetch from API (single ID) -- use the caller-supplied (context-sourced) client when
+        // available, so requests carry the deployment's configured basePath; fall back to a
+        // default-configured client for direct callers that don't have one to hand.
+        const client = apiClient ?? createApiClient();
+        const result = await client.content.resolveReferences({ branch }, { ids: [id] });
         if (result.ok && result.data && result.data.resolved[id]) {
             // Cache and return resolved object
             const resolved = result.data.resolved[id];
@@ -85,4 +96,3 @@ async function resolveReferenceId(id, branch, cache) {
         return id;
     }
 }
-//# sourceMappingURL=client-reference-resolver.js.map

package/dist/editor/comments/BranchComments.d.ts

@@ -1,6 +1,6 @@
 import React from 'react';
-import type { CommentThread } from '../../comment-store';
-import type { UserSearchResult } from '../../auth/types';
+import type { CommentThread } from '../../comment-store.js';
+import type { UserSearchResult } from '../../auth/types.js';
 export interface BranchCommentsProps {
     /** All comments (will be filtered for branch-level) */
     comments: CommentThread[];
@@ -24,4 +24,3 @@ export interface BranchCommentsProps {
  * Uses ThreadCarousel for navigation.
  */
 export declare const BranchComments: React.FC<BranchCommentsProps>;
-//# sourceMappingURL=BranchComments.d.ts.map

package/dist/editor/comments/BranchComments.js

@@ -23,4 +23,3 @@ export const BranchComments = ({ comments, currentUserId, canResolve, onAddComme
     }
     return (_jsx(ThreadCarousel, { threads: branchThreads, label: "Branch Discussion", contextType: "branch", currentUserId: currentUserId, canResolve: canResolve, onAddComment: handleAddComment, onResolveThread: onResolveThread, autoFocus: autoFocus, autoOpenNewThread: showCarousel && branchThreads.length === 0, highlightThreadId: highlightThreadId, onGetUserMetadata: onGetUserMetadata }));
 };
-//# sourceMappingURL=BranchComments.js.map

package/dist/editor/comments/EntryComments.d.ts

@@ -1,5 +1,5 @@
 import React from 'react';
-import type { CommentThread } from '../../comment-store';
+import type { CommentThread } from '../../comment-store.js';
 export interface EntryCommentsProps {
     /** All comments (will be filtered for entry-level) */
     comments: CommentThread[];
@@ -23,4 +23,3 @@ export interface EntryCommentsProps {
  * Uses ThreadCarousel for navigation.
  */
 export declare const EntryComments: React.FC<EntryCommentsProps>;
-//# sourceMappingURL=EntryComments.d.ts.map

package/dist/editor/comments/EntryComments.js

@@ -23,4 +23,3 @@ export const EntryComments = ({ comments, entryPath, currentUserId, canResolve,
     }
     return (_jsx(ThreadCarousel, { threads: entryThreads, label: "Entry Comments", contextType: "entry", currentUserId: currentUserId, canResolve: canResolve, onAddComment: handleAddComment, onResolveThread: onResolveThread, autoFocus: autoFocus, autoOpenNewThread: showCarousel && entryThreads.length === 0, highlightThreadId: highlightThreadId }));
 };
-//# sourceMappingURL=EntryComments.js.map

package/dist/editor/comments/FieldWrapper.d.ts

@@ -1,5 +1,5 @@
 import React from 'react';
-import type { CommentThread } from '../../comment-store';
+import type { CommentThread } from '../../comment-store.js';
 export interface FieldWrapperProps {
     /** Child form field element */
     children: React.ReactNode;
@@ -29,4 +29,3 @@ export interface FieldWrapperProps {
  * Shows ThreadCarousel when comments exist or when user clicks "New comment".
  */
 export declare const FieldWrapper: React.FC<FieldWrapperProps>;
-//# sourceMappingURL=FieldWrapper.d.ts.map

package/dist/editor/comments/FieldWrapper.js

@@ -38,4 +38,3 @@ export const FieldWrapper = ({ children, canopyPath, entryPath, threads, autoFoc
                     zIndex: 1,
                 }, children: _jsx(Button, { size: "xs", variant: "subtle", color: "gray", onClick: () => setShowCarousel(true), style: { fontSize: '0.75rem', height: '1.5rem' }, "data-testid": `field-new-comment-${canopyPath}`, children: "New comment" }) })), shouldShowCarousel && (_jsx(ThreadCarousel, { threads: threads, contextType: "field", currentUserId: currentUserId, canResolve: canResolve, onAddComment: handleAddComment, onResolveThread: onResolveThread, autoFocus: autoFocus, autoOpenNewThread: showCarousel && threads.length === 0, highlightThreadId: highlightThreadId, onCancelNewThread: () => setShowCarousel(false) }))] }));
 };
-//# sourceMappingURL=FieldWrapper.js.map

package/dist/editor/comments/InlineCommentThread.d.ts

@@ -1,6 +1,6 @@
 import React from 'react';
-import type { CommentThread } from '../../comment-store';
-import type { UserSearchResult } from '../../auth/types';
+import type { CommentThread } from '../../comment-store.js';
+import type { UserSearchResult } from '../../auth/types.js';
 export interface InlineCommentThreadProps {
     /** The thread to display */
     thread: CommentThread;
@@ -20,4 +20,3 @@ export interface InlineCommentThreadProps {
  * Always shows full thread view with per-thread scrolling.
  */
 export declare const InlineCommentThread: React.FC<InlineCommentThreadProps>;
-//# sourceMappingURL=InlineCommentThread.d.ts.map

package/dist/editor/comments/InlineCommentThread.js

@@ -60,4 +60,3 @@ export const InlineCommentThread = ({ thread, onAddReply, onResolve, currentUser
                                     marginBottom: 8,
                                 } })), _jsxs(Stack, { gap: 4, children: [_jsxs(Group, { gap: "xs", justify: "space-between", children: [onGetUserMetadata ? (_jsx(UserBadge, { userId: comment.userId, getUserMetadata: onGetUserMetadata, variant: "avatar-name", size: "xs", showEmailTooltip: true, showBadge: true, badgeVariant: "light", color: "gray" })) : (_jsx(Text, { size: "xs", fw: 600, children: comment.userId })), _jsx(Text, { size: "xs", c: "dimmed", children: formatRelativeTime(comment.timestamp) })] }), _jsx(Text, { size: "sm", style: { whiteSpace: 'pre-wrap' }, children: comment.text })] })] }, comment.id))) }), error && (_jsx(Alert, { icon: _jsx(IconAlertCircle, { size: 16 }), color: "red", variant: "light", onClose: () => setError(null), withCloseButton: true, children: error })), !thread.resolved && (_jsxs(Stack, { gap: "xs", children: [_jsx(Textarea, { placeholder: "Write a reply...", value: replyText, onChange: (e) => setReplyText(e.target.value), minRows: 2, disabled: isSubmitting }), _jsxs(Group, { gap: "xs", children: [_jsx(Button, { size: "xs", onClick: handleReply, loading: isSubmitting, disabled: !replyText.trim(), children: "Reply" }), canUserResolve() && (_jsx(Button, { size: "xs", variant: "light", color: "green", onClick: handleResolve, loading: isSubmitting, "data-testid": "resolve-thread-button", children: "Resolve" }))] })] })), thread.resolved && thread.resolvedBy && (_jsxs(Group, { gap: 4, children: [_jsx(Text, { size: "xs", c: "dimmed", fs: "italic", children: "Resolved by" }), onGetUserMetadata ? (_jsx(UserBadge, { userId: thread.resolvedBy, getUserMetadata: onGetUserMetadata, variant: "avatar-name", size: "xs", showEmailTooltip: true, showBadge: true, badgeVariant: "light", color: "gray" })) : (_jsx(Text, { size: "xs", c: "dimmed", fs: "italic", children: thread.resolvedBy })), thread.resolvedAt && (_jsx(Text, { size: "xs", c: "dimmed", fs: "italic", children: formatRelativeTime(thread.resolvedAt) }))] }))] }) }));
 };
-//# sourceMappingURL=InlineCommentThread.js.map

package/dist/editor/comments/ThreadCarousel.d.ts

@@ -1,6 +1,6 @@
 import React from 'react';
-import type { CommentThread } from '../../comment-store';
-import type { UserSearchResult } from '../../auth/types';
+import type { CommentThread } from '../../comment-store.js';
+import type { UserSearchResult } from '../../auth/types.js';
 /**
  * ThreadCarousel - Horizontal comment thread navigation component
  *
@@ -109,4 +109,3 @@ export interface ThreadCarouselProps {
     onCancelNewThread?: () => void;
 }
 export declare const ThreadCarousel: React.FC<ThreadCarouselProps>;
-//# sourceMappingURL=ThreadCarousel.d.ts.map

package/dist/editor/comments/ThreadCarousel.js

@@ -223,4 +223,3 @@ export const ThreadCarousel = ({ threads, label = 'Comments', contextType: _, cu
                                     background: 'var(--mantine-color-gray-5)',
                                 } }) })] })), sortedThreads.length === 0 && !showNewThreadBox && (_jsx(Text, { size: "xs", c: "dimmed", ta: "center", py: "xs", children: "No comments yet. Click \"+ New\" to start a thread." }))] }) }));
 };
-//# sourceMappingURL=ThreadCarousel.js.map

package/dist/editor/components/ConfirmDeleteModal.d.ts

@@ -12,4 +12,3 @@ export interface ConfirmDeleteModalProps {
  * Provides a clear warning UI with red/danger theme.
  */
 export declare function ConfirmDeleteModal({ isOpen, title, message, confirmLabel, onConfirm, onClose, loading, }: ConfirmDeleteModalProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=ConfirmDeleteModal.d.ts.map

package/dist/editor/components/ConfirmDeleteModal.js

@@ -8,4 +8,3 @@ import { Modal, Button, Text, Group, Stack } from '@mantine/core';
 export function ConfirmDeleteModal({ isOpen, title, message, confirmLabel = 'Delete', onConfirm, onClose, loading = false, }) {
     return (_jsx(Modal, { opened: isOpen, onClose: onClose, title: title, centered: true, size: "md", children: _jsxs(Stack, { gap: "md", "data-testid": "confirm-delete-modal", children: [_jsx(Text, { size: "sm", children: message }), _jsxs(Group, { justify: "flex-end", gap: "sm", children: [_jsx(Button, { variant: "default", onClick: onClose, disabled: loading, children: "Cancel" }), _jsx(Button, { color: "red", onClick: onConfirm, loading: loading, "data-testid": "confirm-delete-submit", children: confirmLabel })] })] }) }));
 }
-//# sourceMappingURL=ConfirmDeleteModal.js.map

package/dist/editor/components/EditorFooter.d.ts

@@ -17,4 +17,3 @@ export interface EditorFooterProps {
  * ```
  */
 export declare function EditorFooter({ children }: EditorFooterProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=EditorFooter.d.ts.map

package/dist/editor/components/EditorFooter.js

@@ -12,4 +12,3 @@ import { Group, Paper, Text } from '@mantine/core';
 export function EditorFooter({ children }) {
     return (_jsx(Paper, { withBorder: true, radius: 0, shadow: "sm", px: "md", py: "xs", style: { position: 'fixed', left: 0, right: 0, bottom: 0, zIndex: 40 }, children: children ?? (_jsxs(Group, { gap: "md", justify: "center", children: [_jsx(Text, { size: "xs", c: "dimmed", children: "Terms" }), _jsx(Text, { size: "xs", c: "dimmed", children: "Privacy" }), _jsx(Text, { size: "xs", c: "dimmed", children: "\u00A9 CanopyCMS" })] })) }));
 }
-//# sourceMappingURL=EditorFooter.js.map

package/dist/editor/components/EditorHeader.d.ts

@@ -1,7 +1,7 @@
-import type { OperatingMode } from '../../operating-mode';
-import type { BranchStatus } from '../../types';
-import type { EditorEntry } from '../Editor';
-import type { LogicalPath } from '../../paths/types';
+import type { OperatingMode } from '../../operating-mode/index.js';
+import type { BranchStatus } from '../../types.js';
+import type { EditorEntry } from '../Editor.js';
+import type { LogicalPath } from '../../paths/types.js';
 /**
  * Props for the EditorHeader component.
  */
@@ -180,4 +180,3 @@ export interface EditorHeaderProps {
  * ```
  */
 export declare const EditorHeader: import("react").ForwardRefExoticComponent<EditorHeaderProps & import("react").RefAttributes<HTMLDivElement>>;
-//# sourceMappingURL=EditorHeader.d.ts.map

package/dist/editor/components/EditorHeader.js

@@ -182,4 +182,3 @@ export const EditorHeader = forwardRef(function EditorHeader({ siteTitle, siteSu
                                         ? `Branch "${branchName}" is submitted for review and locked for edits. Use Withdraw Branch above to resume editing.`
                                         : `Branch "${branchName}" is ${branchStatus} — content is read-only.` }), _jsx(Button, { size: "xs", variant: "light", color: "yellow", onClick: onBranchManagerOpen, children: "Manage Branches" })] }) }))] }) }));
 });
-//# sourceMappingURL=EditorHeader.js.map

package/dist/editor/components/EditorSidebar.d.ts

@@ -1,4 +1,4 @@
-import type { PaneLayout } from '../EditorPanes';
+import type { PaneLayout } from '../EditorPanes.js';
 /**
  * Props for the EditorSidebar component.
  */
@@ -84,4 +84,3 @@ export interface EditorSidebarProps {
  * ```
  */
 export declare function EditorSidebar({ layout, highlightEnabled, sidebarWidth, headerHeight, footerHeight, onLayoutChange, onHighlightToggle, onPermissionManagerOpen, onGroupManagerOpen, onMediaLibraryOpen, onSystemHealthOpen, AccountComponent, onAccountClick, onLogoutClick, }: EditorSidebarProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=EditorSidebar.d.ts.map

package/dist/editor/components/EditorSidebar.js

@@ -36,4 +36,3 @@ export function EditorSidebar({ layout, highlightEnabled, sidebarWidth, headerHe
             gap: 8,
         }, children: [_jsxs(Stack, { gap: "sm", align: "center", style: { width: '100%', paddingTop: 6 }, children: [_jsx(ActionIcon, { variant: "subtle", size: "lg", radius: "md", "aria-label": "Toggle layout", onClick: () => onLayoutChange(layout === 'side' ? 'stacked' : 'side'), children: layout === 'side' ? _jsx(IconLayoutRows, { size: 18 }) : _jsx(IconLayoutColumns, { size: 18 }) }), _jsx(ActionIcon, { variant: highlightEnabled ? 'filled' : 'subtle', color: highlightEnabled ? 'brand' : 'gray', size: "lg", radius: "md", "aria-pressed": highlightEnabled, "aria-label": "Toggle highlights", onClick: onHighlightToggle, children: _jsx(IconSquareDashed, { size: 18 }) })] }), _jsxs(Stack, { gap: "xs", align: "center", children: [_jsxs(Menu, { shadow: "md", width: 200, position: "left", children: [_jsx(Menu.Target, { children: _jsx(ActionIcon, { variant: "subtle", size: "lg", radius: "md", "aria-label": "Settings", children: _jsx(IconSettings, { size: 18 }) }) }), _jsxs(Menu.Dropdown, { children: [_jsx(Menu.Label, { children: "Settings" }), _jsx(Menu.Item, { onClick: onPermissionManagerOpen, children: "Manage Permissions" }), _jsx(Menu.Item, { onClick: onGroupManagerOpen, children: "Manage Groups" }), _jsx(Menu.Item, { leftSection: _jsx(IconPhoto, { size: 14 }), onClick: onMediaLibraryOpen, children: "Media library" }), onSystemHealthOpen && (_jsx(Menu.Item, { leftSection: _jsx(IconActivity, { size: 14 }), onClick: onSystemHealthOpen, children: "System health" }))] })] }), AccountComponent ? (_jsx(AccountComponent, {})) : (_jsxs(_Fragment, { children: [onAccountClick && (_jsx(ActionIcon, { variant: "subtle", size: "lg", radius: "md", "aria-label": "Account", onClick: onAccountClick, children: _jsx(IconUserCircle, { size: 18 }) })), onLogoutClick && (_jsx(ActionIcon, { variant: "subtle", size: "lg", radius: "md", "aria-label": "Sign out", onClick: onLogoutClick, children: _jsx(IconLogout, { size: 18 }) }))] }))] })] }));
 }
-//# sourceMappingURL=EditorSidebar.js.map

package/dist/editor/components/EntryCreateModal.d.ts

@@ -32,4 +32,3 @@ export interface EntryCreateModalProps {
     existingSlugs?: Set<string>;
 }
 export declare function EntryCreateModal({ isOpen, collectionLabel, entryTypes, selectedEntryTypeName, onCreate, onClose, isCreating, error, existingSlugs, }: EntryCreateModalProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=EntryCreateModal.d.ts.map

package/dist/editor/components/EntryCreateModal.js

@@ -11,6 +11,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useState, useEffect, useRef } from 'react';
 import { Modal, Stack, TextInput, Group, Button, Alert, Text, Select } from '@mantine/core';
 import { IconAlertCircle } from '@tabler/icons-react';
+import { parseSlug } from '../../paths/validation.js';
 /** Slug the form is seeded with each time the modal opens. */
 const DEFAULT_SLUG = 'untitled';
 export function EntryCreateModal({ isOpen, collectionLabel, entryTypes, selectedEntryTypeName, onCreate, onClose, isCreating = false, error = null, existingSlugs, }) {
@@ -49,20 +50,31 @@ export function EntryCreateModal({ isOpen, collectionLabel, entryTypes, selected
         wasOpenRef.current = isOpen;
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [isOpen]);
-    // Validate slug format
+    // Validate slug format.
+    //
+    // Delegates to `parseSlug` rather than restating its rule: the server refuses to CREATE an
+    // entry whose slug fails it (api/content.ts and ContentStore.write's [SLUG] guards), and the
+    // static build fails outright on one that slipped through (static/index.ts's
+    // assertRoutableSlugs). A second, hand-maintained copy of the charset/length/separator rules
+    // here could only ever drift out of agreement with the boundary that actually decides.
+    //
+    // Imported from '../../paths/validation.js' directly, NOT the `paths` barrel, which pulls
+    // node:fs into the browser bundle (pnpm lint:bundle enforces this).
     const validateSlug = (value) => {
         if (!value.trim()) {
             return 'Slug cannot be empty';
         }
-        if (value.includes('/')) {
-            return 'Slug cannot contain slashes';
-        }
-        // Simple validation - lowercase, alphanumeric + hyphens
-        if (!/^[a-z0-9][-a-z0-9]*$/.test(value)) {
-            return 'Slug must start with letter/number and contain only lowercase letters, numbers, and hyphens';
+        const parsed = parseSlug(value);
+        if (!parsed.ok) {
+            return parsed.error;
         }
-        if (value.length > 64) {
-            return 'Slug must be 64 characters or less';
+        // `parseSlug` lowercases before testing, so it accepts 'My-Post' and hands back 'my-post'.
+        // Keep the field itself strict: the value typed here is what the duplicate check below and
+        // the create request are keyed on, so silently normalizing would let 'My-Post' sail past a
+        // collision with an existing 'my-post' and land as a 409 from the server instead of an
+        // inline message here.
+        if (parsed.slug !== value) {
+            return 'Slug must be lowercase';
         }
         if (existingSlugs?.has(value)) {
             return 'An entry with this slug already exists';
@@ -93,4 +105,3 @@ export function EntryCreateModal({ isOpen, collectionLabel, entryTypes, selected
                         label: et.label || et.name,
                     })), required: true, disabled: isCreating, searchable: true, placeholder: "Select entry type..." })), entryTypes.length === 1 && (_jsxs(Text, { size: "sm", c: "dimmed", children: ["Entry type: ", _jsx("strong", { children: typeLabel })] })), _jsx(TextInput, { label: "Slug", description: "URL-friendly identifier (lowercase, alphanumeric + hyphens)", value: slug, onChange: (e) => handleSlugChange(e.currentTarget.value), error: validationError, placeholder: "my-entry-slug", required: true, disabled: isCreating, "data-autofocus": true, "data-testid": "entry-slug-input" }), _jsxs(Text, { size: "xs", c: "dimmed", children: ["Preview: ", _jsx("code", { children: slug })] }), _jsxs(Group, { justify: "flex-end", gap: "sm", children: [_jsx(Button, { variant: "subtle", onClick: onClose, disabled: isCreating, children: "Cancel" }), _jsx(Button, { onClick: handleCreate, loading: isCreating, disabled: !canCreate, "data-testid": "create-entry-submit", children: "Create" })] })] }) }));
 }
-//# sourceMappingURL=EntryCreateModal.js.map

package/dist/editor/components/RenameEntryModal.d.ts

@@ -15,4 +15,3 @@ export interface RenameEntryModalProps {
     error?: string | null;
 }
 export declare function RenameEntryModal({ isOpen, entryLabel, currentSlug, onSave, onClose, isSaving, error, }: RenameEntryModalProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=RenameEntryModal.d.ts.map

package/dist/editor/components/RenameEntryModal.js

@@ -59,4 +59,3 @@ export function RenameEntryModal({ isOpen, entryLabel, currentSlug, onSave, onCl
     const canSave = !validationError && newSlug.trim() !== '' && newSlug !== currentSlug && !isSaving;
     return (_jsx(Modal, { opened: isOpen, onClose: onClose, title: _jsx(Text, { fw: 600, children: "Rename Entry" }), size: "md", closeOnClickOutside: !isSaving, closeOnEscape: !isSaving, children: _jsxs(Stack, { gap: "md", "data-testid": "rename-entry-modal", children: [error && (_jsx(Alert, { icon: _jsx(IconAlertCircle, { size: 16 }), color: "red", variant: "light", children: error })), _jsxs(Text, { size: "sm", c: "dimmed", children: ["Renaming \"", entryLabel, "\""] }), _jsx(TextInput, { label: "Slug", description: "URL-friendly identifier (lowercase, alphanumeric + hyphens)", value: newSlug, onChange: (e) => handleSlugChange(e.currentTarget.value), error: validationError, placeholder: "my-entry-slug", required: true, disabled: isSaving, "data-autofocus": true, "data-testid": "rename-slug-input" }), _jsxs(Text, { size: "xs", c: "dimmed", children: ["Current: ", _jsx("code", { children: currentSlug }), newSlug !== currentSlug && (_jsxs(_Fragment, { children: [' → ', "New: ", _jsx("code", { children: newSlug })] }))] }), _jsxs(Group, { justify: "flex-end", gap: "sm", children: [_jsx(Button, { variant: "subtle", onClick: onClose, disabled: isSaving, children: "Cancel" }), _jsx(Button, { onClick: handleSave, loading: isSaving, disabled: !canSave, "data-testid": "rename-entry-submit", children: "Rename" })] })] }) }));
 }
-//# sourceMappingURL=RenameEntryModal.js.map

package/dist/editor/components/UserBadge.d.ts

@@ -1,5 +1,5 @@
-import type { UserSearchResult } from '../../auth/types';
-import type { CanopyUserId } from '../../types';
+import type { UserSearchResult } from '../../auth/types.js';
+import type { CanopyUserId } from '../../types.js';
 export interface UserBadgeProps {
     /** User ID to display */
     userId: CanopyUserId;
@@ -25,4 +25,3 @@ export interface UserBadgeProps {
     cachedUser?: UserSearchResult;
 }
 export declare const UserBadge: React.FC<UserBadgeProps>;
-//# sourceMappingURL=UserBadge.d.ts.map

package/dist/editor/components/UserBadge.js

@@ -90,4 +90,3 @@ export const UserBadge = ({ userId, getUserMetadata, variant = 'avatar-name', sh
     // No badge wrapper - just wrap with tooltip if needed
     return showEmailTooltip && variant !== 'full' ? (_jsx(Tooltip, { label: userMetadata.email, children: content })) : (content);
 };
-//# sourceMappingURL=UserBadge.js.map

package/dist/editor/components/index.d.ts

@@ -1,4 +1,3 @@
-export * from './EditorFooter';
-export * from './EditorHeader';
-export * from './EditorSidebar';
-//# sourceMappingURL=index.d.ts.map
+export * from './EditorFooter.js';
+export * from './EditorHeader.js';
+export * from './EditorSidebar.js';

package/dist/editor/components/index.js

@@ -3,4 +3,3 @@
 export * from './EditorFooter.js';
 export * from './EditorHeader.js';
 export * from './EditorSidebar.js';
-//# sourceMappingURL=index.js.map

package/dist/editor/context/ApiClientContext.d.ts

@@ -8,18 +8,25 @@
  * - No global mutable state
  */
 import React from 'react';
-import { createApiClient } from '../../api';
+import { createApiClient } from '../../api/index.js';
 export type ApiClient = ReturnType<typeof createApiClient>;
 export interface ApiClientProviderProps {
     children: React.ReactNode;
     /** Optional custom client for testing */
     client?: ApiClient;
+    /**
+     * Deployment prefix the host app is served under (`CanopyClientConfig.basePath`, e.g.
+     * `/preview-123`). Joined onto the default `/api/canopycms` base via `joinUrlPrefix` so every
+     * request the editor makes lands on the actual route instead of the un-prefixed root. Ignored
+     * when `client` is supplied directly. Unset/empty is a no-op (same as today).
+     */
+    basePath?: string;
 }
 /**
  * Provider that creates and provides the API client.
  * Use the client prop to inject a mock client for testing.
  */
-export declare function ApiClientProvider({ children, client }: ApiClientProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function ApiClientProvider({ children, client, basePath }: ApiClientProviderProps): import("react/jsx-runtime").JSX.Element;
 /**
  * Hook to access the API client.
  * Must be used within an ApiClientProvider.
@@ -30,4 +37,3 @@ export declare function useApiClient(): ApiClient;
  * Useful for conditional usage or graceful degradation.
  */
 export declare function useOptionalApiClient(): ApiClient | null;
-//# sourceMappingURL=ApiClientContext.d.ts.map

package/dist/editor/context/ApiClientContext.js

@@ -11,15 +11,20 @@ import { jsx as _jsx } from "react/jsx-runtime";
  */
 import { createContext, useContext, useMemo } from 'react';
 import { createApiClient } from '../../api/index.js';
+import { joinUrlPrefix } from '../../utils/url-prefix.js';
 const ApiClientContext = createContext(null);
 /**
  * Provider that creates and provides the API client.
  * Use the client prop to inject a mock client for testing.
  */
-export function ApiClientProvider({ children, client }) {
+export function ApiClientProvider({ children, client, basePath }) {
+    // Memoized on identity, not just for cost: several consumers now list the client in their
+    // effect deps (useUserContext, useReferenceResolution, ReferenceField), so a fresh client each
+    // render would turn those one-shot fetches into a loop. A caller injecting an inline
+    // `client={createApiClient()}` would reintroduce exactly that.
     const apiClient = useMemo(() => {
-        return client ?? createApiClient();
-    }, [client]);
+        return client ?? createApiClient({ baseUrl: joinUrlPrefix(basePath, '/api/canopycms') });
+    }, [client, basePath]);
     return _jsx(ApiClientContext.Provider, { value: apiClient, children: children });
 }
 /**
@@ -40,4 +45,3 @@ export function useApiClient() {
 export function useOptionalApiClient() {
     return useContext(ApiClientContext);
 }
-//# sourceMappingURL=ApiClientContext.js.map

package/dist/editor/context/AssetContext.d.ts

@@ -18,8 +18,32 @@ export interface AssetContextValue {
 }
 export interface AssetContextProviderProps extends AssetContextValue {
     children: React.ReactNode;
+    /**
+     * `CanopyClientConfig.basePath` - the deployment prefix the host app is served under. Used only
+     * when `baseUrl` is unset.
+     */
+    basePath?: string;
 }
-export declare function AssetContextProvider({ baseUrl, children }: AssetContextProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * `baseUrl` (`media.publicBaseUrl`) wins; `basePath` is the fallback.
+ *
+ * They are ALTERNATIVES, never composed: `publicBaseUrl` is validated absolute-only, so it names
+ * another origin serving `/assets` at THAT origin's root, and a deployment `basePath` cannot apply
+ * on top of it. Where the two differ is topology, not precedence - see the asset-mount table in
+ * the README.
+ *
+ * The fallback exists because `publicBaseUrl` cannot express a bare path (it is validated
+ * absolute-only), so without it the editor's thumbnails, previews and crop images stay
+ * root-relative on a basePath deployment where Next serves `/assets` — and 404.
+ *
+ * KNOWN LIMITATION: the fallback assumes that topology, and consults none. On a CloudFront/CDK
+ * deployment a basePath does NOT move the asset space (behaviors are anchored at the distribution
+ * root), so prefixing is wrong there — the requests still resolve, because `withCanopy`'s
+ * auto-prefixed `/assets/:path*` rewrite catches them and serves through the CMS Lambda, but they
+ * bypass the CDN cache and the dedicated transform Lambda. The workaround is real though not
+ * obvious: set `media.publicBaseUrl` to the distribution origin, which takes precedence here.
+ * Tracked in `.claude/future-tasks/editor-asset-mount-topology.md`.
+ */
+export declare function AssetContextProvider({ baseUrl, basePath, children }: AssetContextProviderProps): import("react/jsx-runtime").JSX.Element;
 /** Safe to call outside a provider - returns `{ baseUrl: undefined }` (root-relative URLs). */
 export declare function useAssetContext(): AssetContextValue;
-//# sourceMappingURL=AssetContext.d.ts.map

package/dist/editor/context/AssetContext.js

@@ -15,12 +15,32 @@ import { jsx as _jsx } from "react/jsx-runtime";
  */
 import { createContext, useContext, useMemo } from 'react';
 const AssetContext = createContext({});
-export function AssetContextProvider({ baseUrl, children }) {
-    const value = useMemo(() => ({ baseUrl }), [baseUrl]);
+/**
+ * `baseUrl` (`media.publicBaseUrl`) wins; `basePath` is the fallback.
+ *
+ * They are ALTERNATIVES, never composed: `publicBaseUrl` is validated absolute-only, so it names
+ * another origin serving `/assets` at THAT origin's root, and a deployment `basePath` cannot apply
+ * on top of it. Where the two differ is topology, not precedence - see the asset-mount table in
+ * the README.
+ *
+ * The fallback exists because `publicBaseUrl` cannot express a bare path (it is validated
+ * absolute-only), so without it the editor's thumbnails, previews and crop images stay
+ * root-relative on a basePath deployment where Next serves `/assets` — and 404.
+ *
+ * KNOWN LIMITATION: the fallback assumes that topology, and consults none. On a CloudFront/CDK
+ * deployment a basePath does NOT move the asset space (behaviors are anchored at the distribution
+ * root), so prefixing is wrong there — the requests still resolve, because `withCanopy`'s
+ * auto-prefixed `/assets/:path*` rewrite catches them and serves through the CMS Lambda, but they
+ * bypass the CDN cache and the dedicated transform Lambda. The workaround is real though not
+ * obvious: set `media.publicBaseUrl` to the distribution origin, which takes precedence here.
+ * Tracked in `.claude/future-tasks/editor-asset-mount-topology.md`.
+ */
+export function AssetContextProvider({ baseUrl, basePath, children }) {
+    const resolved = baseUrl ?? basePath;
+    const value = useMemo(() => ({ baseUrl: resolved }), [resolved]);
     return _jsx(AssetContext.Provider, { value: value, children: children });
 }
 /** Safe to call outside a provider - returns `{ baseUrl: undefined }` (root-relative URLs). */
 export function useAssetContext() {
     return useContext(AssetContext);
 }
-//# sourceMappingURL=AssetContext.js.map

package/dist/editor/context/EditorStateContext.d.ts

@@ -11,7 +11,7 @@
  * - Preview data and loading state
  */
 import React from 'react';
-import type { FormValue } from '../FormRenderer';
+import type { FormValue } from '../FormRenderer.js';
 export interface LoadingState {
     branches: boolean;
     entries: boolean;
@@ -90,4 +90,3 @@ export declare function useEditorPreview(): {
     setData: (data: FormValue) => void;
     setLoading: (loading: FormValue) => void;
 };
-//# sourceMappingURL=EditorStateContext.d.ts.map

package/dist/editor/context/EditorStateContext.js

@@ -140,4 +140,3 @@ export function useEditorPreview() {
         setLoading: actions.setPreviewLoading,
     };
 }
-//# sourceMappingURL=EditorStateContext.js.map

package/dist/editor/context/SWRProvider.d.ts

@@ -28,4 +28,3 @@ export interface SWRProviderProps {
     children: React.ReactNode;
 }
 export declare function SWRProvider({ children }: SWRProviderProps): import("react/jsx-runtime").JSX.Element;
-//# sourceMappingURL=SWRProvider.d.ts.map

package/dist/editor/context/SWRProvider.js

@@ -9,4 +9,3 @@ export function SWRProvider({ children }) {
             dedupingInterval: 2000,
         }, children: children }));
 }
-//# sourceMappingURL=SWRProvider.js.map

package/dist/editor/context/index.d.ts

@@ -17,8 +17,7 @@
  * </ApiClientProvider>
  * ```
  */
-export { ApiClientProvider, useApiClient, useOptionalApiClient, type ApiClient, type ApiClientProviderProps, } from './ApiClientContext';
-export { AssetContextProvider, useAssetContext, type AssetContextValue, type AssetContextProviderProps, } from './AssetContext';
-export { SWRProvider, type SWRProviderProps } from './SWRProvider';
-export { EditorStateProvider, useEditorState, useEditorLoading, useEditorModals, useEditorPreview, type EditorState, type EditorStateActions, type EditorStateContextValue, type EditorStateProviderProps, type LoadingState, type ModalState, type PreviewState, } from './EditorStateContext';
-//# sourceMappingURL=index.d.ts.map
+export { ApiClientProvider, useApiClient, useOptionalApiClient, type ApiClient, type ApiClientProviderProps, } from './ApiClientContext.js';
+export { AssetContextProvider, useAssetContext, type AssetContextValue, type AssetContextProviderProps, } from './AssetContext.js';
+export { SWRProvider, type SWRProviderProps } from './SWRProvider.js';
+export { EditorStateProvider, useEditorState, useEditorLoading, useEditorModals, useEditorPreview, type EditorState, type EditorStateActions, type EditorStateContextValue, type EditorStateProviderProps, type LoadingState, type ModalState, type PreviewState, } from './EditorStateContext.js';

package/dist/editor/context/index.js

@@ -21,4 +21,3 @@ export { ApiClientProvider, useApiClient, useOptionalApiClient, } from './ApiCli
 export { AssetContextProvider, useAssetContext, } from './AssetContext.js';
 export { SWRProvider } from './SWRProvider.js';
 export { EditorStateProvider, useEditorState, useEditorLoading, useEditorModals, useEditorPreview, } from './EditorStateContext.js';
-//# sourceMappingURL=index.js.map

package/dist/editor/editor-config.d.ts

@@ -1,5 +1,5 @@
-import type { CanopyConfig, FlatSchemaItem } from '../config';
-import type { EditorCollection } from './Editor';
+import type { CanopyConfig, FlatSchemaItem } from '../config/index.js';
+import type { EditorCollection } from './Editor.js';
 /**
  * Build hierarchical editor collections from the flattened schema.
  * Uses logicalPath as IDs to match API responses.
@@ -11,4 +11,3 @@ import type { EditorCollection } from './Editor';
  */
 export declare const buildEditorCollections: (flatSchema: FlatSchemaItem[]) => EditorCollection[];
 export declare const buildPreviewBaseByCollection: (config: Pick<CanopyConfig, "contentRoot">, flatSchema: FlatSchemaItem[]) => Record<string, string>;
-//# sourceMappingURL=editor-config.d.ts.map

package/dist/editor/editor-config.js

@@ -76,4 +76,3 @@ export const buildPreviewBaseByCollection = (config, flatSchema) => {
     }
     return map;
 };
-//# sourceMappingURL=editor-config.js.map