canopycms 0.0.63 → 0.0.65

package/dist/api/content.js

@@ -1,10 +1,11 @@
 import { z } from 'zod';
-import { BranchSyncingError, ContentStore, ContentStoreError, ContentConflictError, DuplicateContentIdError, getDefaultEntryType, } from '../content-store.js';
+import { BranchSyncingError, ContentStore, ContentStoreError, ContentConflictError, DuplicateContentIdError, UrlPathConflictError, getDefaultEntryType, } from '../content-store.js';
 import { defineEndpoint } from './route-builder.js';
 import { ReferenceValidator } from '../validation/reference-validator.js';
-import { mergeBodyIntoData, normalizeReferenceValues, validateEntryData, } from '../validation/entry-validator.js';
+import { findUnknownKeys, mergeBodyIntoData, normalizeReferenceValues, validateEntryData, } from '../validation/entry-validator.js';
 import { validateEntryLinks } from '../validation/entry-link-validator.js';
 import { branchNameSchema, logicalPathSchema, slugSchema } from './validators.js';
+import { parseSlug } from '../paths/index.js';
 import { getErrorMessage, isNotFoundError, sanitizeErrorMessage } from '../utils/error.js';
 import { isDataOnlyFormat } from '../utils/format.js';
 /**
@@ -15,6 +16,12 @@ function parseApiPath(apiPath, contentRoot) {
     const segments = apiPath.split('/').filter(Boolean);
     return segments[0] === contentRoot ? segments : [contentRoot, ...segments];
 }
+/**
+ * How many stale field paths the unknown-key warning names before summarising the rest. The
+ * editor shows warnings in one notification, so this bounds a schema-wide rename to a readable
+ * sentence rather than a wall of paths.
+ */
+const UNKNOWN_KEY_WARNING_LIMIT = 10;
 // ============================================================================
 // Zod Schemas for Validation
 // ============================================================================
@@ -225,6 +232,29 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
                 error: `An entry with slug "${slug}" already exists`,
             };
         }
+        // [SLUG] Create-only routability check. `writeContentParamsSchema.path` runs
+        // `parseLogicalPath`, which has no charset rule, and `ContentStore.resolvePath` casts the
+        // last segment to `Slug` with only `.toLowerCase()` — so nothing on the write chain applied
+        // `parseSlug` (only `renameEntry`'s `newSlug` did). A create with, say, `my_post` was
+        // accepted, and `assertRoutableSlugs` then failed the adopter's next production build over
+        // an entry that would 404 anyway. `store.write()` enforces this authoritatively inside its
+        // per-entry lock; this is the cheaper, clearer-messaged fast path — without it a create that
+        // is ALSO missing a required field reports the field, never the slug that is the real
+        // problem (same reasoning as the create-intent guard above).
+        //
+        // Create-only on purpose: an entry that already carries a non-conforming slug must stay
+        // saveable and renameable, since renaming it is the only way to fix the build.
+        if (!exists) {
+            const routable = parseSlug(slug);
+            if (!routable.ok) {
+                return {
+                    ok: false,
+                    status: 400,
+                    error: `Cannot create entry "${slug}": ${routable.error}. An entry whose slug is not ` +
+                        'addressable as a URL segment would build and then 404 on every visit.',
+                };
+            }
+        }
         // SCH-H3: enforce maxItems server-side at the create boundary. The editor
         // only gates its "Add" button; a direct API create could otherwise exceed
         // the cap. Best-effort under concurrency: the count-then-create below is
@@ -278,6 +308,61 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     // 'warning' issues are returned alongside the successful write.
     let validationWarnings;
     const validateEntry = ctx.services.config.validateEntry;
+    // Collapse resolved reference objects back to bare ID strings before PERSISTING, not just
+    // before validating (the reference validator gets its own normalized copy above).
+    //
+    // The editor round-trips whole documents: its GET reads through `store.read()`, whose
+    // `resolveReferences` defaults to TRUE, so form state holds `{...target data, id, slug,
+    // collection, urlPath}` for every reference field, and a save posts that straight back. Left
+    // unnormalized it lands in the content file verbatim — and because resolution only re-resolves
+    // a `typeof value === 'string'`, every later read passes the frozen snapshot through and every
+    // later save rewrites it. The reference is then permanently severed from its target: renaming
+    // or editing the target changes nothing, silently.
+    //
+    // The mechanism predates reference resolution reaching listings, but `includeBody` makes it
+    // materially worse — the snapshot now carries the target's entire prose — and `urlPath` adds a
+    // value that goes stale the moment the target is renamed. Normalizing here is schema-driven and
+    // idempotent: a payload that already holds ID strings is unchanged.
+    const normalizedData = body.data === undefined ? undefined : normalizeReferenceValues(fields, body.data);
+    //
+    // Computed BEFORE the validateEntry hook and the entry-link scan, not just before the write,
+    // so every consumer of the payload agrees with the bytes that land on disk. Otherwise an
+    // adopter's hook inspecting a reference field saw a resolved object while the file got an ID
+    // string -- and saw it only when the post came from the editor, since a client posting bare
+    // IDs already gave the hook bare IDs. Normalizing first makes the hook's input deterministic
+    // regardless of caller.
+    // Keys with no counterpart in the schema. validateEntryData iterates the SCHEMA, so nothing
+    // reported the inverse: a renamed or reshaped field left its old key on disk forever (the
+    // editor round-trips the whole record, so every save rewrote it) and the only symptom was a
+    // component receiving `undefined`. Adopter request log item 29.
+    //
+    // Run against normalizedData -- the shape that will actually be persisted -- so the report
+    // matches the bytes, and so a resolved reference collapsed back to an ID string cannot be
+    // mistaken for anything. A warning, never a rejection: the key is still written (with its
+    // comments, see utils/content-serialize.ts), it is just not editable and nothing reads it.
+    //
+    // ONE issue, not one per key. The editor joins every warning into a single non-auto-closing
+    // notification (useEntryManager.ts), so one-per-key repeated the same explanatory sentence
+    // once per stale key, on every save, for a condition that is permanent until someone edits the
+    // schema. The keys are listed in the message instead, capped so a schema-wide rename cannot
+    // produce an unreadable wall of text. Worded for who can actually act: an editor cannot remove
+    // a key the form does not render, and cannot change the schema.
+    if (normalizedData !== undefined) {
+        const unknownKeys = findUnknownKeys(fields, normalizedData);
+        if (unknownKeys.length > 0) {
+            const shown = unknownKeys.slice(0, UNKNOWN_KEY_WARNING_LIMIT);
+            const overflow = unknownKeys.length - shown.length;
+            const list = overflow > 0 ? `${shown.join(', ')} (and ${overflow} more)` : shown.join(', ');
+            validationWarnings = [
+                {
+                    level: 'warning',
+                    message: `Saved. ${unknownKeys.length === 1 ? 'One field is' : `${unknownKeys.length} fields are`} ` +
+                        `not part of this entry type’s schema: ${list}. They are kept in the file, but nothing ` +
+                        `reads them — ask a developer to add them to the schema or remove them from the content.`,
+                },
+            ];
+        }
+    }
     if (validateEntry) {
         let issues;
         try {
@@ -286,7 +371,7 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
                 branch: params.branch,
                 ...(params.entryType ? { entryType: params.entryType } : {}),
                 format: body.format,
-                data: body.data ?? {},
+                data: normalizedData ?? {},
                 body: body.body,
             });
         }
@@ -308,20 +393,22 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
                     .join('; '),
             };
         }
+        // Appended, not assigned: the unknown-key scan above may already have found some, and the
+        // editor shows the channel as one notification.
         const warnings = issues.filter((issue) => issue.level === 'warning');
         if (warnings.length > 0)
-            validationWarnings = warnings;
+            validationWarnings = [...(validationWarnings ?? []), ...warnings];
     }
     try {
         const writeInput = isDataOnlyFormat(body.format)
             ? {
                 format: body.format,
-                data: body.data ?? {},
+                data: normalizedData ?? {},
                 expectedVersion: body.expectedVersion,
             }
             : {
                 format: body.format,
-                data: body.data,
+                data: normalizedData,
                 body: body.body ?? '',
                 expectedVersion: body.expectedVersion,
             };
@@ -330,19 +417,32 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
         // we just validated against.
         const result = await store.write(schemaItem.logicalPath, slug, writeInput, entryTypeName);
         // Validate entry links in body content (warnings only, don't block save).
-        // Reuses the entry-type fields resolved above for schema validation.
+        // Reuses the entry-type fields resolved above for schema validation. Folded into
+        // `validationWarnings` (not a separate `entryLinkWarnings` field) so the editor's one
+        // save-warnings notification (useEntryManager.ts) is the single place any save-time
+        // warning surfaces -- a broken `entry:ID` link used to be computed and returned here
+        // with no consumer anywhere in the editor, so it was silently discarded.
         const idIndex = await store.idIndex();
-        const linkValidation = validateEntryLinks(body.data ?? {}, fields, idIndex, body.body);
-        const entryLinkWarnings = linkValidation.warnings.length > 0 ? linkValidation.warnings : undefined;
-        return { ok: true, status: 200, data: { ...result, entryLinkWarnings, validationWarnings } };
+        const linkValidation = validateEntryLinks(normalizedData ?? {}, fields, idIndex, body.body);
+        if (linkValidation.warnings.length > 0) {
+            const linkWarnings = linkValidation.warnings.map((warning) => ({
+                level: 'warning',
+                message: warning.message,
+                fieldPath: warning.fieldPath,
+            }));
+            validationWarnings = [...(validationWarnings ?? []), ...linkWarnings];
+        }
+        return { ok: true, status: 200, data: { ...result, validationWarnings } };
     }
     catch (err) {
         if (err instanceof ContentConflictError) {
             // [SYNC-C1] Not an editor-vs-editor collision at all: the branch's
-            // working tree is being rebased right now, so the write was refused
-            // rather than acknowledged and then rolled back. Its own message says
-            // that and says to retry -- checked first, since the generic branches
-            // below would otherwise blame another editor.
+            // working tree is being rebased. Usually the write was refused outright
+            // rather than acknowledged and then rolled back; the one exception is a
+            // lock compromised mid-write, where the write DID land but we can no
+            // longer prove it was exclusive. Each case carries its own message
+            // (retry vs. reload-then-decide), so pass it through -- checked first,
+            // since the generic branches below would otherwise blame another editor.
             if (err instanceof BranchSyncingError) {
                 return { ok: false, status: 409, error: err.message };
             }
@@ -355,6 +455,17 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             if (err instanceof DuplicateContentIdError) {
                 return { ok: false, status: 409, error: err.message };
             }
+            // [URL] Also not an editor-vs-editor collision, and critically NOT the
+            // same-slug case the branch below reports: no entry with this slug
+            // exists in this collection (the early `exists` check passed). What
+            // exists is a DIFFERENT entry claiming the same URL -- a sibling
+            // collection's index entry, or the parent entry this index entry would
+            // collide with. Falling through would tell the editor to look for an
+            // entry that is not there, and discard the one message that names the
+            // actual offender and what to do about it.
+            if (err instanceof UrlPathConflictError) {
+                return { ok: false, status: 409, error: err.message };
+            }
             // The early `exists` short-circuit above catches this in the common
             // case; this is the race-safe fallback for a collision that landed
             // between that check and store.write()'s in-lock stat.
@@ -490,12 +601,16 @@ const renameEntryHandler = async (gc, ctx, req, params, body) => {
         // [SYNC-C1] The rename was refused because the branch is mid-rebase, not
         // because the request was bad -- 409 + retry, never a 400.
         if (err instanceof ContentConflictError) {
+            // [URL] A contested-URL refusal must carry its own message. The generic
+            // one below tells the editor to reload and retry, which cannot succeed
+            // here -- the rename stays refused until they pick a different slug or
+            // remove the other claimant -- which is exactly the loop
+            // UrlPathConflictError's doc comment exists to prevent.
+            const passThrough = err instanceof BranchSyncingError || err instanceof UrlPathConflictError;
             return {
                 ok: false,
                 status: 409,
-                error: err instanceof BranchSyncingError
-                    ? err.message
-                    : 'Content conflict: entry was modified by another editor',
+                error: passThrough ? err.message : 'Content conflict: entry was modified by another editor',
             };
         }
         // C2: same distinction as writeContentHandler above - a ContentStoreError
@@ -594,4 +709,3 @@ export const CONTENT_ROUTES = {
     validateReferences,
     renameEntry,
 };
-//# sourceMappingURL=content.js.map

package/dist/api/entries-constants.d.ts

@@ -14,4 +14,3 @@
 export declare const MAX_ENTRIES_PER_PAGE = 200;
 /** Default page size when a request omits `limit`. */
 export declare const DEFAULT_ENTRIES_LIMIT = 50;
-//# sourceMappingURL=entries-constants.d.ts.map

package/dist/api/entries-constants.js

@@ -14,4 +14,3 @@
 export const MAX_ENTRIES_PER_PAGE = 200;
 /** Default page size when a request omits `limit`. */
 export const DEFAULT_ENTRIES_LIMIT = 50;
-//# sourceMappingURL=entries-constants.js.map

package/dist/api/entries.d.ts

@@ -1,8 +1,8 @@
 import { z } from 'zod';
-import type { ContentFormat } from '../config';
-import type { ApiResponse } from './types';
-import type { LogicalPath, PhysicalPath, Slug, ContentId } from '../paths/types';
-export { MAX_ENTRIES_PER_PAGE, DEFAULT_ENTRIES_LIMIT } from './entries-constants';
+import type { ContentFormat } from '../config/index.js';
+import type { ApiResponse } from './types.js';
+import type { LogicalPath, PhysicalPath, Slug, ContentId } from '../paths/types.js';
+export { MAX_ENTRIES_PER_PAGE, DEFAULT_ENTRIES_LIMIT } from './entries-constants.js';
 /**
  * Summary of an entry type for client display.
  * Simplified from EntryTypeConfig - doesn't include full field definitions.
@@ -50,8 +50,8 @@ export type EntriesResponse = ApiResponse<ListEntriesResponse>;
  * List entries for a branch
  * GET /:branch/entries
  */
-export declare const listEntries: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const listEntries: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     collection: z.ZodOptional<z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>>;
     limit: z.ZodOptional<z.ZodNumber>;
     cursor: z.ZodOptional<z.ZodString>;
@@ -96,8 +96,8 @@ export type DeleteEntryResponse = ApiResponse<{
  * DELETE /:branch/entries/...entryPath
  * Note: Uses catch-all to support paths with slashes (e.g., content/posts/hello-world)
  */
-export declare const deleteEntry: import("./route-builder").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+export declare const deleteEntry: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     entryPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
 }, "strip", z.ZodTypeAny, {
     branch: string & {
@@ -118,8 +118,8 @@ export declare const deleteEntry: import("./route-builder").RouteDefinition<z.Zo
  * Exported routes for router registration
  */
 export declare const ENTRY_ROUTES: {
-    readonly list: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly list: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         collection: z.ZodOptional<z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>>;
         limit: z.ZodOptional<z.ZodNumber>;
         cursor: z.ZodOptional<z.ZodString>;
@@ -144,8 +144,8 @@ export declare const ENTRY_ROUTES: {
         cursor?: string | undefined;
         limit?: number | undefined;
     }>, undefined, EntriesResponse>;
-    readonly delete: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly delete: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
         entryPath: z.ZodType<LogicalPath, z.ZodTypeDef, LogicalPath>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
@@ -163,4 +163,3 @@ export declare const ENTRY_ROUTES: {
         };
     }>, undefined, DeleteEntryResponse>;
 };
-//# sourceMappingURL=entries.d.ts.map

package/dist/api/entries.js

@@ -51,7 +51,18 @@ const toCollectionItem = (entry, collection) => {
         exists: true,
     };
 };
-/** List entries in a single collection, mapped to API CollectionItem type. */
+/**
+ * List entries in a single collection, mapped to API CollectionItem type.
+ *
+ * Deliberately does NOT resolve `reference` fields, unlike the `resolveReferences` option
+ * that `listEntries`/`buildContentTree` grew for the same underlying primitive. This is a
+ * paginated admin table rendering slug/title/canEdit — it never reads inside a reference —
+ * and resolution here would land in the worst possible place: it runs BEFORE pagination
+ * (`filterWithAccessControl` walks the full collection, `slice` happens at the end), on a
+ * request path, so every keystroke in the admin search box would pay a full ContentId index
+ * scan plus one read per distinct referenced entry. Revisit only if a column ever needs to
+ * display a reference's content.
+ */
 const listCollectionEntries = async (root, collection) => {
     const entries = await listCollectionEntriesShared(root, collection);
     return entries.map((entry) => toCollectionItem(entry, collection));
@@ -379,4 +390,3 @@ export const ENTRY_ROUTES = {
     list: listEntries,
     delete: deleteEntry,
 };
-//# sourceMappingURL=entries.js.map

package/dist/api/github-sync.d.ts

@@ -1,5 +1,5 @@
-import type { ApiContext } from './types';
-import type { BranchContext, SyncStatus } from '../types';
+import type { ApiContext } from './types.js';
+import type { BranchContext, SyncStatus } from '../types.js';
 /**
  * Result of a GitHub sync operation.
  * The caller uses this to update branch metadata.
@@ -19,4 +19,3 @@ export declare function syncSubmitPr(ctx: ApiContext, context: BranchContext): P
  * Uses githubService directly if available, otherwise queues a task.
  */
 export declare function syncConvertToDraft(ctx: ApiContext, context: BranchContext): Promise<void>;
-//# sourceMappingURL=github-sync.d.ts.map

package/dist/api/github-sync.js

@@ -166,4 +166,3 @@ async function enqueueGitHubTask(ctx, context, task) {
         return { syncStatus: 'sync-failed' };
     }
 }
-//# sourceMappingURL=github-sync.js.map

package/dist/api/groups.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
-import type { ApiResponse } from './types';
-import type { CanopyGroupId } from '../types';
-import { type InternalGroup } from '../authorization';
+import type { ApiResponse } from './types.js';
+import type { CanopyGroupId } from '../types.js';
+import { type InternalGroup } from '../authorization/index.js';
 /** Response type for getting internal groups */
 export type InternalGroupsResponse = ApiResponse<{
     groups: InternalGroup[];
@@ -47,8 +47,8 @@ export interface ExternalGroup {
  * Exported routes for router registration
  */
 export declare const GROUP_ROUTES: {
-    readonly getInternal: import("./route-builder").RouteDefinition<undefined, undefined, InternalGroupsResponse>;
-    readonly updateInternal: import("./route-builder").RouteDefinition<undefined, z.ZodObject<{
+    readonly getInternal: import("./route-builder.js").RouteDefinition<undefined, undefined, InternalGroupsResponse>;
+    readonly updateInternal: import("./route-builder.js").RouteDefinition<undefined, z.ZodObject<{
         groups: z.ZodArray<z.ZodObject<{
             id: z.ZodString;
             name: z.ZodString;
@@ -83,7 +83,7 @@ export declare const GROUP_ROUTES: {
         }[];
         expectedContentVersion?: number | undefined;
     }>, UpdateInternalGroupsResponse>;
-    readonly searchExternal: import("./route-builder").RouteDefinition<z.ZodObject<{
+    readonly searchExternal: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         query: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         query: string;
@@ -91,4 +91,3 @@ export declare const GROUP_ROUTES: {
         query: string;
     }>, undefined, ExternalGroupsResponse>;
 };
-//# sourceMappingURL=groups.d.ts.map

package/dist/api/groups.js

@@ -298,4 +298,3 @@ export const GROUP_ROUTES = {
     updateInternal,
     searchExternal,
 };
-//# sourceMappingURL=groups.js.map

package/dist/api/guards.d.ts

@@ -15,8 +15,8 @@
  * })
  * ```
  */
-import type { BranchContext, BranchContextWithSchema } from '../types';
-import type { ApiContext, ApiRequest, ApiResponse } from './types';
+import type { BranchContext, BranchContextWithSchema } from '../types.js';
+import type { ApiContext, ApiRequest, ApiResponse } from './types.js';
 /** All available guard identifiers */
 export type GuardId = 'branch' | 'branchAccess' | 'schema' | 'branchAccessWithSchema' | 'admin' | 'reviewer' | 'privileged' | 'writableBranch' | 'submittableBranch';
 /** Maps each guard ID to the context it contributes */
@@ -61,4 +61,3 @@ export type ExecuteGuardsResult<T extends readonly GuardId[]> = {
  */
 export declare function executeGuards<T extends readonly GuardId[]>(guards: T, ctx: ApiContext, req: ApiRequest, params: Record<string, unknown>): Promise<ExecuteGuardsResult<T>>;
 export {};
-//# sourceMappingURL=guards.d.ts.map

package/dist/api/guards.js

@@ -224,4 +224,3 @@ export async function executeGuards(guards, ctx, req, params) {
     }
     return { ok: true, guardContext: accumulated };
 }
-//# sourceMappingURL=guards.js.map

package/dist/api/index.d.ts

@@ -1,19 +1,18 @@
-export type { ApiResponse, ApiRequest, ApiContext } from './types';
-export type { BranchResponse, BranchListResponse, BranchDeleteResponse, CreateBranchBody, UpdateBranchAccessBody, } from './branch';
-export type { BranchMergeResponse } from './branch-merge';
-export type { CommentsResponse, AddCommentResponse, ResolveCommentResponse, ListCommentsResponse, } from './comments';
-export type { EntriesResponse, ListEntriesResponse, CollectionItem, ListEntriesParams, DeleteEntryResponse, } from './entries';
-export type { PermissionsResponse, UpdatePermissionsBody, SearchUsersParams, GetUserMetadataResponse, GetUserMetadataParams, } from './permissions';
-export type { UserInfoResponse } from './user';
-export type { AssetRecord, AssetsListResponse, PresignAssetResponse, PresignAssetBody, FinalizeAssetResponse, FinalizeAssetBody, AssetDeleteResponse, ListAssetsParams, DeleteAssetParams, } from './assets';
-export type { InternalGroupsResponse, ExternalGroupsResponse, UpdateInternalGroupsBody, SearchExternalGroupsParams, ExternalGroup, } from './groups';
-export type { ReferenceOptionsResponse } from './reference-options';
-export type { ResolveReferencesResponse } from './resolve-references';
-export type { SchemaResponse, WireEntryType, WireCollectionConfig, WireFlatSchemaItem, CollectionResponse, CreateCollectionResponse, UpdateCollectionResponse, DeleteCollectionResponse, AddEntryTypeResponse, UpdateEntryTypeResponse, RemoveEntryTypeResponse, UpdateOrderResponse, GetSchemaApiResponse, GetCollectionApiResponse, CreateCollectionApiResponse, UpdateCollectionApiResponse, DeleteCollectionApiResponse, AddEntryTypeApiResponse, UpdateEntryTypeApiResponse, RemoveEntryTypeApiResponse, UpdateOrderApiResponse, } from './schema';
-export type { CreateCollectionInput, UpdateCollectionInput, CreateEntryTypeInput, UpdateEntryTypeInput, } from '../schema/schema-store-types';
-export type { EntryTypeSummary } from './entries';
-export type { AdminStatusResponse, AdminStatusData, AdminTasksResponse, AdminTasksData, ListAdminTasksParams, AdminRetryTaskResponse, AdminRetryTaskData, RetryTaskParams, AdminDeleteTaskResponse, AdminDeleteTaskData, DeleteTaskParams, WorkerLiveness, WorkerLivenessState, } from './admin';
-export { USER_ROUTES } from './user';
-export { CanopyApiClient, createApiClient } from './client';
-export type { ApiClientOptions } from './client';
-//# sourceMappingURL=index.d.ts.map
+export type { ApiResponse, ApiRequest, ApiContext } from './types.js';
+export type { BranchResponse, BranchListResponse, BranchDeleteResponse, CreateBranchBody, UpdateBranchAccessBody, } from './branch.js';
+export type { BranchMergeResponse } from './branch-merge.js';
+export type { CommentsResponse, AddCommentResponse, ResolveCommentResponse, ListCommentsResponse, } from './comments.js';
+export type { EntriesResponse, ListEntriesResponse, CollectionItem, ListEntriesParams, DeleteEntryResponse, } from './entries.js';
+export type { PermissionsResponse, UpdatePermissionsBody, SearchUsersParams, GetUserMetadataResponse, GetUserMetadataParams, } from './permissions.js';
+export type { UserInfoResponse } from './user.js';
+export type { AssetRecord, AssetsListResponse, PresignAssetResponse, PresignAssetBody, FinalizeAssetResponse, FinalizeAssetBody, AssetDeleteResponse, ListAssetsParams, DeleteAssetParams, } from './assets.js';
+export type { InternalGroupsResponse, ExternalGroupsResponse, UpdateInternalGroupsBody, SearchExternalGroupsParams, ExternalGroup, } from './groups.js';
+export type { ReferenceOptionsResponse } from './reference-options.js';
+export type { ResolveReferencesResponse } from './resolve-references.js';
+export type { SchemaResponse, WireEntryType, WireCollectionConfig, WireFlatSchemaItem, CollectionResponse, CreateCollectionResponse, UpdateCollectionResponse, DeleteCollectionResponse, AddEntryTypeResponse, UpdateEntryTypeResponse, RemoveEntryTypeResponse, UpdateOrderResponse, GetSchemaApiResponse, GetCollectionApiResponse, CreateCollectionApiResponse, UpdateCollectionApiResponse, DeleteCollectionApiResponse, AddEntryTypeApiResponse, UpdateEntryTypeApiResponse, RemoveEntryTypeApiResponse, UpdateOrderApiResponse, } from './schema.js';
+export type { CreateCollectionInput, UpdateCollectionInput, CreateEntryTypeInput, UpdateEntryTypeInput, } from '../schema/schema-store-types.js';
+export type { EntryTypeSummary } from './entries.js';
+export type { AdminStatusResponse, AdminStatusData, AdminTasksResponse, AdminTasksData, ListAdminTasksParams, AdminRetryTaskResponse, AdminRetryTaskData, RetryTaskParams, AdminDeleteTaskResponse, AdminDeleteTaskData, DeleteTaskParams, WorkerLiveness, WorkerLivenessState, } from './admin.js';
+export { USER_ROUTES } from './user.js';
+export { CanopyApiClient, createApiClient } from './client.js';
+export type { ApiClientOptions } from './client.js';

package/dist/api/index.js

@@ -4,4 +4,3 @@ export { USER_ROUTES } from './user.js';
 // Import it directly from './schema.js' in server-side code when needed.
 // Export client
 export { CanopyApiClient, createApiClient } from './client.js';
-//# sourceMappingURL=index.js.map

package/dist/api/permissions.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
-import type { ApiResponse } from './types';
-import type { PathPermission } from '../config';
-import type { UserSearchResult, PermissionGroupOption } from '../auth/types';
+import type { ApiResponse } from './types.js';
+import type { PathPermission } from '../config/index.js';
+import type { UserSearchResult, PermissionGroupOption } from '../auth/types.js';
 /** Response type for getting permissions */
 export type PermissionsResponse = ApiResponse<{
     permissions: PathPermission[];
@@ -21,7 +21,7 @@ export type GetUserMetadataResponse = ApiResponse<{
 }>;
 declare const updatePermissionsBodySchema: z.ZodObject<{
     permissions: z.ZodArray<z.ZodObject<{
-        path: z.ZodType<import("../authorization").PermissionPath, z.ZodTypeDef, import("../authorization").PermissionPath>;
+        path: z.ZodType<import("../authorization/index.js").PermissionPath, z.ZodTypeDef, import("../authorization/index.js").PermissionPath>;
         read: z.ZodOptional<z.ZodObject<{
             allowedUsers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
             allowedGroups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -149,10 +149,10 @@ export type GetUserMetadataParams = z.infer<typeof getUserMetadataParamsSchema>;
  * Exported routes for router registration
  */
 export declare const PERMISSION_ROUTES: {
-    readonly get: import("./route-builder").RouteDefinition<undefined, undefined, PermissionsResponse>;
-    readonly update: import("./route-builder").RouteDefinition<undefined, z.ZodObject<{
+    readonly get: import("./route-builder.js").RouteDefinition<undefined, undefined, PermissionsResponse>;
+    readonly update: import("./route-builder.js").RouteDefinition<undefined, z.ZodObject<{
         permissions: z.ZodArray<z.ZodObject<{
-            path: z.ZodType<import("../authorization").PermissionPath, z.ZodTypeDef, import("../authorization").PermissionPath>;
+            path: z.ZodType<import("../authorization/index.js").PermissionPath, z.ZodTypeDef, import("../authorization/index.js").PermissionPath>;
             read: z.ZodOptional<z.ZodObject<{
                 allowedUsers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
                 allowedGroups: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -256,7 +256,7 @@ export declare const PERMISSION_ROUTES: {
         }[];
         expectedContentVersion?: number | undefined;
     }>, ApiResponse<unknown>>;
-    readonly searchUsers: import("./route-builder").RouteDefinition<z.ZodObject<{
+    readonly searchUsers: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         q: z.ZodString;
         limit: z.ZodOptional<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
@@ -266,8 +266,8 @@ export declare const PERMISSION_ROUTES: {
         q: string;
         limit?: number | undefined;
     }>, undefined, SearchUsersResponse>;
-    readonly listGroups: import("./route-builder").RouteDefinition<undefined, undefined, ListGroupsResponse>;
-    readonly getUserMetadata: import("./route-builder").RouteDefinition<z.ZodObject<{
+    readonly listGroups: import("./route-builder.js").RouteDefinition<undefined, undefined, ListGroupsResponse>;
+    readonly getUserMetadata: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         userId: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         userId: string;
@@ -276,4 +276,3 @@ export declare const PERMISSION_ROUTES: {
     }>, undefined, GetUserMetadataResponse>;
 };
 export {};
-//# sourceMappingURL=permissions.d.ts.map

package/dist/api/permissions.js

@@ -320,4 +320,3 @@ export const PERMISSION_ROUTES = {
     listGroups: listGroups,
     getUserMetadata: getUserMetadata,
 };
-//# sourceMappingURL=permissions.js.map

package/dist/api/reference-options.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { ApiResponse } from './types';
+import type { ApiResponse } from './types.js';
 /** Response type for reference options */
 export type ReferenceOptionsResponse = ApiResponse<{
     options: Array<{
@@ -12,8 +12,8 @@ export type ReferenceOptionsResponse = ApiResponse<{
  * Exported routes for router registration
  */
 export declare const REFERENCE_OPTIONS_ROUTES: {
-    readonly get: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly get: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
             readonly __brand: "BranchName";
@@ -24,4 +24,3 @@ export declare const REFERENCE_OPTIONS_ROUTES: {
         };
     }>, undefined, ReferenceOptionsResponse>;
 };
-//# sourceMappingURL=reference-options.d.ts.map

package/dist/api/reference-options.js

@@ -109,4 +109,3 @@ const getReferenceOptions = defineEndpoint({
 export const REFERENCE_OPTIONS_ROUTES = {
     get: getReferenceOptions,
 };
-//# sourceMappingURL=reference-options.js.map

package/dist/api/request-body-hash.d.ts

@@ -30,4 +30,3 @@ export declare function computeContentSha256Hex(body: string): Promise<string |
  * known until after the request would already need to be signed.
  */
 export declare function computeContentSha256HexFromBytes(bytes: BufferSource): Promise<string | undefined>;
-//# sourceMappingURL=request-body-hash.d.ts.map

package/dist/api/request-body-hash.js

@@ -40,4 +40,3 @@ export async function computeContentSha256HexFromBytes(bytes) {
         .map((byte) => byte.toString(16).padStart(2, '0'))
         .join('');
 }
-//# sourceMappingURL=request-body-hash.js.map

package/dist/api/resolve-references.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { ApiResponse } from './types';
+import type { ApiResponse } from './types.js';
 export interface ResolveReferencesBody {
     ids: string[];
 }
@@ -11,8 +11,8 @@ export type ResolveReferencesResponse = ApiResponse<{
  * Exported routes for router registration
  */
 export declare const RESOLVE_REFERENCES_ROUTES: {
-    readonly post: import("./route-builder").RouteDefinition<z.ZodObject<{
-        branch: z.ZodType<import("../paths").BranchName, z.ZodTypeDef, import("../paths").BranchName>;
+    readonly post: import("./route-builder.js").RouteDefinition<z.ZodObject<{
+        branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
         branch: string & {
             readonly __brand: "BranchName";
@@ -22,11 +22,10 @@ export declare const RESOLVE_REFERENCES_ROUTES: {
             readonly __brand: "BranchName";
         };
     }>, z.ZodObject<{
-        ids: z.ZodArray<z.ZodType<import("../paths").ContentId, z.ZodTypeDef, import("../paths").ContentId>, "many">;
+        ids: z.ZodArray<z.ZodType<import("../paths/index.js").ContentId, z.ZodTypeDef, import("../paths/index.js").ContentId>, "many">;
     }, "strip", z.ZodTypeAny, {
-        ids: import("../paths").ContentId[];
+        ids: import("../paths/index.js").ContentId[];
     }, {
-        ids: import("../paths").ContentId[];
+        ids: import("../paths/index.js").ContentId[];
     }>, ResolveReferencesResponse>;
 };
-//# sourceMappingURL=resolve-references.d.ts.map