canopycms 0.0.63 → 0.0.65

package/dist/assets/factory.d.ts

@@ -5,8 +5,8 @@
  * into a real store — see .claude/future-tasks/assets-media-system.md for why
  * this was previously dead configuration.
  */
-import type { MediaConfig } from '../config/types';
-import type { AssetStore } from './types';
+import type { MediaConfig } from '../config/types.js';
+import type { AssetStore } from './types.js';
 /**
  * @param media - The site's `media` config (`config.media`), or undefined if unset.
  * @param opts.devAssetsDir - Root directory for the implicit local fallback store used
@@ -15,4 +15,3 @@ import type { AssetStore } from './types';
 export declare function createAssetStore(media: MediaConfig | undefined, opts?: {
     devAssetsDir?: string;
 }): AssetStore | undefined;
-//# sourceMappingURL=factory.d.ts.map

package/dist/assets/factory.js

@@ -21,7 +21,6 @@ export function createAssetStore(media, opts = {}) {
             return new S3AssetStore({
                 bucket: media.bucket,
                 region: media.region,
-                publicBaseUrl: media.publicBaseUrl,
                 maxUploadBytes: media.maxUploadBytes,
             });
         case 'local': {
@@ -39,4 +38,3 @@ export function createAssetStore(media, opts = {}) {
             return undefined;
     }
 }
-//# sourceMappingURL=factory.js.map

package/dist/assets/finalize.d.ts

@@ -3,8 +3,8 @@
  * best-effort staging cleanup. Split from pipeline.ts so the pipeline itself
  * stays store-agnostic and trivially unit-testable with plain byte fixtures.
  */
-import { type FinalizeInput, type FinalizeRejection } from './pipeline';
-import type { AssetMeta, AssetStore } from './types';
+import { type FinalizeInput, type FinalizeRejection } from './pipeline.js';
+import type { AssetMeta, AssetStore } from './types.js';
 export declare function isValidStagingKey(key: string): boolean;
 export type FinalizeAssetResult = {
     ok: true;
@@ -33,4 +33,3 @@ export declare function finalizeStagedUpload(store: AssetStore, stagingKey: stri
     status: 400 | 404;
     error: string;
 }>;
-//# sourceMappingURL=finalize.d.ts.map

package/dist/assets/finalize.js

@@ -69,4 +69,3 @@ export async function finalizeStagedUpload(store, stagingKey, filename, uploaded
     await store.deleteStaging(stagingKey).catch(() => { });
     return result;
 }
-//# sourceMappingURL=finalize.js.map

package/dist/assets/index.d.ts

@@ -5,16 +5,15 @@
  * ./types directly instead, so node:fs/S3-SDK imports never reach a browser
  * bundle.
  */
-export type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget, } from './types';
-export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, type AssetPrefixes, } from './keys';
-export { LocalAssetStore, type LocalAssetStoreOptions } from './store-local';
-export { S3AssetStore, type S3AssetStoreOptions } from './store-s3';
-export { createAssetStore } from './factory';
-export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizePublicObject, type FinalizeResult, type FinalizeRejection, type FinalizeSuccess, } from './pipeline';
-export { finalizeAsset, finalizeStagedUpload, type FinalizeAssetResult } from './finalize';
-export { sanitizeSvg } from './svg-sanitizer';
-export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src';
-export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type IdentityDirectives, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type ResizeDirectives, type TransformDirectives, } from './transform-directives';
-export { applyTransform, type ApplyTransformInput, type TransformResult } from './transform';
-export { assetUrl, assetSrcSet, type AssetRef, type AssetUrlOptions } from './asset-url';
-//# sourceMappingURL=index.d.ts.map
+export type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget, } from './types.js';
+export { ASSET_PREFIXES, createKeyBuilders, hashBytes, metaKey, metaPrefix, originalKey, originalPrefix, publicKey, slugifyFilename, stagingKey, type AssetPrefixes, } from './keys.js';
+export { LocalAssetStore, type LocalAssetStoreOptions } from './store-local.js';
+export { S3AssetStore, type S3AssetStoreOptions } from './store-s3.js';
+export { createAssetStore } from './factory.js';
+export { ALLOWED_UPLOAD_CONTENT_TYPES, runFinalizePipeline, type FinalizeInput, type FinalizePublicObject, type FinalizeResult, type FinalizeRejection, type FinalizeSuccess, } from './pipeline.js';
+export { finalizeAsset, finalizeStagedUpload, type FinalizeAssetResult } from './finalize.js';
+export { sanitizeSvg } from './svg-sanitizer.js';
+export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
+export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, type CropRect, type IdentityDirectives, type OutputFormat, type ParsedTransformPath, type ParseTransformPathResult, type ResizeDirectives, type TransformDirectives, } from './transform-directives.js';
+export { applyTransform, type ApplyTransformInput, type TransformResult } from './transform.js';
+export { assetUrl, assetSrcSet, type AssetRef, type AssetUrlOptions } from './asset-url.js';

package/dist/assets/index.js

@@ -16,4 +16,3 @@ export { assetSrc, IDENTITY_TRANSFORM_DIRECTIVE } from './asset-src.js';
 export { formatDirectives, isAllowedTransformWidth, isValidCropRect, parseTransformPath, } from './transform-directives.js';
 export { applyTransform } from './transform.js';
 export { assetUrl, assetSrcSet } from './asset-url.js';
-//# sourceMappingURL=index.js.map

package/dist/assets/keys.d.ts

@@ -13,7 +13,7 @@
  * Stores must build keys through these helpers rather than hand-rolling prefix
  * strings, so the layout stays defined in exactly one place.
  */
-import { ASSET_PREFIXES, type AssetPrefixes } from './asset-prefixes';
+import { ASSET_PREFIXES, type AssetPrefixes } from './asset-prefixes.js';
 export { ASSET_PREFIXES, type AssetPrefixes };
 /** sha-256 of the given bytes, truncated to 32 hex chars (128 bits). */
 export declare function hashBytes(data: Uint8Array): string;
@@ -53,4 +53,3 @@ export declare function createKeyBuilders(prefixes?: AssetPrefixes): {
     publicKey: (hash32: string, slug: string, ext: string) => string;
 };
 export declare const originalKey: (hash32: string, ext: string) => string, originalPrefix: (hash32: string) => string, stagingKey: (uuid: string) => string, metaKey: (hash32: string) => string, metaPrefix: () => string, publicKey: (hash32: string, slug: string, ext: string) => string;
-//# sourceMappingURL=keys.d.ts.map

package/dist/assets/keys.js

@@ -85,4 +85,3 @@ export function createKeyBuilders(prefixes = ASSET_PREFIXES) {
     };
 }
 export const { originalKey, originalPrefix, stagingKey, metaKey, metaPrefix, publicKey } = createKeyBuilders();
-//# sourceMappingURL=keys.js.map

package/dist/assets/pipeline.d.ts

@@ -10,7 +10,7 @@
  * `rasterIsDecodable` below) rather than statically imported, but is just as
  * server-only - it is never reachable from a browser bundle either way.
  */
-import type { AssetMeta } from './types';
+import type { AssetMeta } from './types.js';
 /** Client-declared content types accepted at presign time (UX only - never trusted at finalize). */
 export declare const ALLOWED_UPLOAD_CONTENT_TYPES: Set<string>;
 export interface FinalizeInput {
@@ -56,4 +56,3 @@ export type FinalizeResult = FinalizeSuccess | FinalizeRejection;
  * stricter sanitizer version) cannot desync a stored hash from its content.
  */
 export declare function runFinalizePipeline(input: FinalizeInput): Promise<FinalizeResult>;
-//# sourceMappingURL=pipeline.d.ts.map

package/dist/assets/pipeline.js

@@ -311,4 +311,3 @@ export async function runFinalizePipeline(input) {
     }
     return { ok: true, meta, data: canonicalData, publicObject };
 }
-//# sourceMappingURL=pipeline.js.map

package/dist/assets/store-local.d.ts

@@ -3,7 +3,7 @@
  * bucket-prefix layout as S3AssetStore (see keys.ts) so content behaves
  * identically across adapters.
  */
-import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types';
+import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types.js';
 export interface LocalAssetStoreOptions {
     /** Root directory. The five bucket prefixes are created as subdirectories under it. */
     root: string;
@@ -81,4 +81,3 @@ export declare class LocalAssetStore implements AssetStore {
     }>;
     deleteMeta(hash32: string): Promise<void>;
 }
-//# sourceMappingURL=store-local.d.ts.map

package/dist/assets/store-local.js

@@ -251,4 +251,3 @@ export class LocalAssetStore {
         }
     }
 }
-//# sourceMappingURL=store-local.js.map

package/dist/assets/store-s3.d.ts

@@ -4,12 +4,11 @@
  * already configured by the site's CDK stack) — this store only ever reads
  * and writes objects under the five asset prefixes.
  */
-import { type AssetPrefixes } from './keys';
-import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types';
+import { type AssetPrefixes } from './keys.js';
+import type { AssetMeta, AssetStore, BeginUploadInput, PublicObject, StagedUploadTarget } from './types.js';
 export interface S3AssetStoreOptions {
     bucket: string;
     region: string;
-    publicBaseUrl?: string;
     /** Defaults to 50 MiB. */
     maxUploadBytes?: number;
     /** Override the default bucket-prefix layout (rarely needed). */
@@ -68,4 +67,3 @@ export declare class S3AssetStore implements AssetStore {
     private getObject;
     private getObjectBytes;
 }
-//# sourceMappingURL=store-s3.d.ts.map

package/dist/assets/store-s3.js

@@ -180,4 +180,3 @@ export class S3AssetStore {
         return bytes ?? null;
     }
 }
-//# sourceMappingURL=store-s3.js.map

package/dist/assets/svg-sanitizer.d.ts

@@ -34,4 +34,3 @@
  * pipeline.ts) - this function does not re-validate the root element.
  */
 export declare function sanitizeSvg(svgText: string): string;
-//# sourceMappingURL=svg-sanitizer.d.ts.map

package/dist/assets/svg-sanitizer.js

@@ -219,4 +219,3 @@ export function sanitizeSvg(svgText) {
         },
     });
 }
-//# sourceMappingURL=svg-sanitizer.js.map

package/dist/assets/transform-directives.d.ts

@@ -112,4 +112,3 @@ export declare function parseTransformPath(segments: readonly string[]): ParseTr
  * cache key. Order is fixed alphabetically by key: c, f, q, w.
  */
 export declare function formatDirectives(directives: TransformDirectives): string;
-//# sourceMappingURL=transform-directives.d.ts.map

package/dist/assets/transform-directives.js

@@ -282,4 +282,3 @@ export function formatDirectives(directives) {
     // empty directives segment.
     return parts.length > 0 ? parts.join(',') : IDENTITY_TRANSFORM_DIRECTIVE;
 }
-//# sourceMappingURL=transform-directives.js.map

package/dist/assets/transform.d.ts

@@ -28,7 +28,7 @@
  * path with no extra native dependency) purely for pipeline uniformity, not
  * because GIF needs stripping.
  */
-import { type TransformDirectives } from './transform-directives';
+import { type TransformDirectives } from './transform-directives.js';
 export interface ApplyTransformInput {
     data: Uint8Array;
     /** Source extension (lowercased file-type ext, e.g. 'png' | 'jpg' | 'webp' | 'gif'). */
@@ -48,4 +48,3 @@ export interface TransformRejection {
 }
 export type TransformResult = TransformSuccess | TransformRejection;
 export declare function applyTransform(input: ApplyTransformInput, directives: TransformDirectives): Promise<TransformResult>;
-//# sourceMappingURL=transform.d.ts.map

package/dist/assets/transform.js

@@ -191,4 +191,3 @@ export async function applyTransform(input, directives) {
         return { ok: false, status: 422, error: `Transform failed: ${getErrorMessage(err)}` };
     }
 }
-//# sourceMappingURL=transform.js.map

package/dist/assets/types.d.ts

@@ -79,4 +79,3 @@ export interface AssetStore {
     }>;
     deleteMeta(hash32: string): Promise<void>;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/assets/types.js

@@ -7,4 +7,3 @@
  * and the factory are server-only and must never be imported from client code.
  */
 export {};
-//# sourceMappingURL=types.js.map

package/dist/auth/cache.d.ts

@@ -3,6 +3,5 @@
  * These use node:fs/promises and must NOT be imported in client bundles.
  * Use 'canopycms/auth/cache' as the import path.
  */
-export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache';
-export { CachingAuthPlugin } from './caching-auth-plugin';
-//# sourceMappingURL=cache.d.ts.map
+export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache.js';
+export { CachingAuthPlugin } from './caching-auth-plugin.js';

package/dist/auth/cache.js

@@ -5,4 +5,3 @@
  */
 export { FileBasedAuthCache, writeAuthCacheSnapshot } from './file-based-auth-cache.js';
 export { CachingAuthPlugin } from './caching-auth-plugin.js';
-//# sourceMappingURL=cache.js.map

package/dist/auth/caching-auth-plugin.d.ts

@@ -1,6 +1,6 @@
-import type { AuthPlugin } from './plugin';
-import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
-import type { CanopyUserId, CanopyGroupId } from '../types';
+import type { AuthPlugin } from './plugin.js';
+import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types.js';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
 /**
  * Generic cache provider interface for auth metadata.
  * Any auth system can implement its own cache backend
@@ -52,4 +52,3 @@ export declare class CachingAuthPlugin implements AuthPlugin {
     getGroupMetadata(groupId: CanopyGroupId): Promise<GroupMetadata | null>;
     listGroups(limit?: number): Promise<GroupMetadata[]>;
 }
-//# sourceMappingURL=caching-auth-plugin.d.ts.map

package/dist/auth/caching-auth-plugin.js

@@ -108,4 +108,3 @@ export class CachingAuthPlugin {
         }
     }
 }
-//# sourceMappingURL=caching-auth-plugin.js.map

package/dist/auth/context-helpers.d.ts

@@ -1,4 +1,4 @@
-import type { CanopyRequest } from '../http/types';
+import type { CanopyRequest } from '../http/types.js';
 /**
  * Headers-like interface for auth context.
  * Framework-agnostic - matches Web Headers, Next.js Headers, and any similar interface.
@@ -28,4 +28,3 @@ export declare function extractHeaders(context: unknown): HeadersLike | null;
  * Use this in auth plugins to provide clear error messages.
  */
 export declare function validateAuthContext(context: unknown): HeadersLike;
-//# sourceMappingURL=context-helpers.d.ts.map

package/dist/auth/context-helpers.js

@@ -50,4 +50,3 @@ export function validateAuthContext(context) {
     }
     return headers;
 }
-//# sourceMappingURL=context-helpers.js.map

package/dist/auth/file-based-auth-cache.d.ts

@@ -1,6 +1,6 @@
-import type { AuthCacheProvider } from './caching-auth-plugin';
-import type { UserSearchResult, GroupMetadata } from './types';
-import type { CanopyUserId, CanopyGroupId } from '../types';
+import type { AuthCacheProvider } from './caching-auth-plugin.js';
+import type { UserSearchResult, GroupMetadata } from './types.js';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
 /**
  * File-based auth cache provider.
  * Reads JSON files from a directory that is populated externally
@@ -43,4 +43,3 @@ export declare class FileBasedAuthCache implements AuthCacheProvider {
  * either the old snapshot or the new one, never a mix.
  */
 export declare function writeAuthCacheSnapshot(cachePath: string, files: Record<string, unknown>): Promise<string>;
-//# sourceMappingURL=file-based-auth-cache.d.ts.map

package/dist/auth/file-based-auth-cache.js

@@ -189,10 +189,22 @@ export async function writeAuthCacheSnapshot(cachePath, files) {
         await fs.writeFile(tmpPath, JSON.stringify(data, null, 2), 'utf-8');
         await fs.rename(tmpPath, finalPath);
     }
-    // Atomic symlink swap: create temp symlink, rename over current
+    // Atomic symlink swap: create temp symlink, rename over current.
+    //
+    // The target MUST be relative (the bare `snapshot-<ts>` basename), because
+    // writer and reader do not always share a mount namespace. In prod the EC2
+    // worker mounts the EFS filesystem root and writes through
+    // CANOPYCMS_WORKSPACE_ROOT=/mnt/efs/workspace (cachePath
+    // /mnt/efs/workspace/.cache), while the CMS Lambda mounts the /workspace
+    // access point at /mnt/efs and reads the SAME directory as /mnt/efs/.cache.
+    // An absolute target recorded by one is a nonexistent path to the other -
+    // `resolveActiveCacheDir`'s escape guard then correctly rejects it and falls
+    // back to the flat layout, where the worker never writes, leaving the Lambda
+    // with a permanently empty cache. A relative target resolves against
+    // whichever cachePath the reader was given, so it is correct from both.
     const currentLink = path.join(cachePath, 'current');
     const tmpLink = path.join(cachePath, `current-${timestamp}`);
-    await fs.symlink(snapshotDir, tmpLink);
+    await fs.symlink(path.basename(snapshotDir), tmpLink);
     await fs.rename(tmpLink, currentLink);
     // Clean up old snapshots (keep the 2 most recent)
     await cleanupOldSnapshots(cachePath, 2);
@@ -223,4 +235,3 @@ async function cleanupOldSnapshots(cachePath, keepCount) {
         }
     }
 }
-//# sourceMappingURL=file-based-auth-cache.js.map

package/dist/auth/index.d.ts

@@ -1,7 +1,6 @@
-export type { AuthPlugin, AuthPluginFactory } from './plugin';
-export { assertAuthPluginAllowedForMode } from './plugin';
-export type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
-export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers';
-export type { HeadersLike } from './context-helpers';
-export type { AuthCacheProvider, TokenVerifier } from './caching-auth-plugin';
-//# sourceMappingURL=index.d.ts.map
+export type { AuthPlugin, AuthPluginFactory } from './plugin.js';
+export { assertAuthPluginAllowedForMode } from './plugin.js';
+export type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types.js';
+export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers.js';
+export type { HeadersLike } from './context-helpers.js';
+export type { AuthCacheProvider, TokenVerifier } from './caching-auth-plugin.js';

package/dist/auth/index.js

@@ -1,3 +1,2 @@
 export { assertAuthPluginAllowedForMode } from './plugin.js';
 export { isCanopyRequest, isHeadersLike, extractHeaders, validateAuthContext, } from './context-helpers.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/plugin.d.ts

@@ -1,6 +1,6 @@
-import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types';
-import type { CanopyUserId, CanopyGroupId } from '../types';
-import type { OperatingMode } from '../operating-mode/types';
+import type { UserSearchResult, GroupMetadata, AuthenticationResult } from './types.js';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
+import type { OperatingMode } from '../operating-mode/types.js';
 /**
  * Abstract auth provider interface.
  * Implement this to integrate different auth systems (Clerk, Auth0, NextAuth, etc.)
@@ -97,4 +97,3 @@ export type AuthPluginFactory<TConfig = unknown> = (config: TConfig) => AuthPlug
  * @throws Error when mode is 'prod' and the plugin does not set `verifiesCredentials: true`
  */
 export declare function assertAuthPluginAllowedForMode(plugin: AuthPlugin, mode: OperatingMode | undefined): void;
-//# sourceMappingURL=plugin.d.ts.map

package/dist/auth/plugin.js

@@ -25,4 +25,3 @@ export function assertAuthPluginAllowedForMode(plugin, mode) {
             "CLERK_SECRET_KEY set), or run with mode: 'dev' for local development.");
     }
 }
-//# sourceMappingURL=plugin.js.map

package/dist/auth/types.d.ts

@@ -1,4 +1,4 @@
-import type { CanopyUserId, CanopyGroupId } from '../types';
+import type { CanopyUserId, CanopyGroupId } from '../types.js';
 /**
  * User search result for permission UI
  */
@@ -62,4 +62,3 @@ export interface AuthenticationResult {
     };
     error?: string;
 }
-//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=types.js.map

package/dist/authorization/branch.d.ts

@@ -3,10 +3,10 @@
  *
  * Handles checking if a user can access a branch based on ACLs.
  */
-import type { BranchContext } from '../types';
-import type { CanopyConfig, DefaultBranchAccess } from '../config';
-import type { CanopyUser } from '../user';
-import type { BranchAccessResult } from './types';
+import type { BranchContext } from '../types.js';
+import type { CanopyConfig, DefaultBranchAccess } from '../config/index.js';
+import type { CanopyUser } from '../user.js';
+import type { BranchAccessResult } from './types.js';
 /** Options narrowing {@link checkBranchAccessWithDefault} to a specific branch's nature. */
 export interface BranchAccessOptions {
     /**
@@ -91,4 +91,3 @@ export interface WorkflowActionOptions {
  * `defaultBranchAccess: 'deny'`), and `userIsCreator` still decides the result.
  */
 export declare function canPerformWorkflowAction(context: BranchContext, user: CanopyUser, defaultAccess?: DefaultBranchAccess, options?: WorkflowActionOptions): boolean;
-//# sourceMappingURL=branch.d.ts.map

package/dist/authorization/branch.js

@@ -112,4 +112,3 @@ export function canPerformWorkflowAction(context, user, defaultAccess = 'deny',
         accessResult.reason === 'allowed_by_acl' ||
         (isSystemBranch && accessResult.allowed));
 }
-//# sourceMappingURL=branch.js.map

package/dist/authorization/content.d.ts

@@ -6,7 +6,7 @@
  *
  * Usage:
  * ```ts
- * import { checkContentAccess } from './authorization'
+ * import { checkContentAccess } from './authorization.js'
  *
  * const result = await checkContentAccess(deps, context, branchRoot, 'content/posts/my-post.mdx', user, 'edit')
  * if (result.allowed) {
@@ -14,11 +14,11 @@
  * }
  * ```
  */
-import type { BranchContext } from '../types';
-import type { PermissionLevel } from '../config';
-import type { CanopyUser } from '../user';
-import type { ContentAccessResult, ContentAccessDeps } from './types';
-import type { PhysicalPath } from '../paths/types';
+import type { BranchContext } from '../types.js';
+import type { PermissionLevel } from '../config/index.js';
+import type { CanopyUser } from '../user.js';
+import type { ContentAccessResult, ContentAccessDeps } from './types.js';
+import type { PhysicalPath } from '../paths/types.js';
 /**
  * A bound content-access checker: evaluates a single path/level synchronously
  * against permissions that were already loaded when the checker was created.
@@ -57,4 +57,3 @@ export declare function checkContentAccess(deps: ContentAccessDeps, context: Bra
  * Create a content access checker with bound dependencies.
  */
 export declare function createCheckContentAccess(deps: ContentAccessDeps): (context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel) => Promise<ContentAccessResult>;
-//# sourceMappingURL=content.d.ts.map

package/dist/authorization/content.js

@@ -84,4 +84,3 @@ export async function checkContentAccess(deps, context, branchRoot, relativePath
 export function createCheckContentAccess(deps) {
     return (context, branchRoot, relativePath, user, level) => checkContentAccess(deps, context, branchRoot, relativePath, user, level);
 }
-//# sourceMappingURL=content.js.map

package/dist/authorization/groups/index.d.ts

@@ -1,6 +1,5 @@
 /**
  * Groups module exports
  */
-export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, } from './schema';
-export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader';
-//# sourceMappingURL=index.d.ts.map
+export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, } from './schema.js';
+export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader.js';

package/dist/authorization/groups/index.js

@@ -3,4 +3,3 @@
  */
 export { GroupsFileSchema, createDefaultGroupsFile, } from './schema.js';
 export { loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './loader.js';
-//# sourceMappingURL=index.js.map

package/dist/authorization/groups/loader.d.ts

@@ -5,9 +5,9 @@
  * groups.json under the cross-host layered lock in
  * authorization/settings-file-store.ts.
  */
-import { type InternalGroup, type GroupsFile } from './schema';
-import type { OperatingMode } from '../../operating-mode';
-import type { OccWriteResult } from '../../utils/occ-json-write';
+import { type InternalGroup, type GroupsFile } from './schema.js';
+import type { OperatingMode } from '../../operating-mode/index.js';
+import type { OccWriteResult } from '../../utils/occ-json-write.js';
 /**
  * Load full groups file (for version checking)
  * Returns null if file doesn't exist.
@@ -42,4 +42,3 @@ export declare function mutateGroupsFile(branchRoot: string, mode: OperatingMode
     settleMs?: number;
     maxAttempts?: number;
 }): Promise<OccWriteResult | null>;
-//# sourceMappingURL=loader.d.ts.map

package/dist/authorization/groups/loader.js

@@ -111,4 +111,3 @@ export async function mutateGroupsFile(branchRoot, mode, mutate, options) {
         maxAttempts: options?.maxAttempts,
     });
 }
-//# sourceMappingURL=loader.js.map

package/dist/authorization/groups/schema.d.ts

@@ -2,7 +2,7 @@
  * Schema for groups.json file
  */
 import { z } from 'zod';
-import type { CanopyUserId, CanopyGroupId } from '../../types';
+import type { CanopyUserId, CanopyGroupId } from '../../types.js';
 /**
  * Schema for .canopycms/groups.json
  */
@@ -65,4 +65,3 @@ export interface InternalGroup {
  * (mutateSettingsJsonFile via writeOccJsonFile) manages those.
  */
 export declare function createDefaultGroupsFile(userId: CanopyUserId): GroupsFile;
-//# sourceMappingURL=schema.d.ts.map

package/dist/authorization/groups/schema.js

@@ -32,4 +32,3 @@ export function createDefaultGroupsFile(userId) {
         groups: [],
     };
 }
-//# sourceMappingURL=schema.js.map

package/dist/authorization/helpers.d.ts

@@ -48,4 +48,3 @@ export declare function isReviewer(groups: readonly string[] | undefined): boole
  * Used for operations that require elevated permissions but not full admin
  */
 export declare function isPrivileged(groups: readonly string[] | undefined): boolean;
-//# sourceMappingURL=helpers.d.ts.map

package/dist/authorization/helpers.js

@@ -57,4 +57,3 @@ export function isReviewer(groups) {
 export function isPrivileged(groups) {
     return isReviewer(groups);
 }
-//# sourceMappingURL=helpers.js.map

package/dist/authorization/index.d.ts

@@ -8,7 +8,7 @@
  * For most use cases, use `checkContentAccess` which handles both branch and path permissions:
  *
  * ```ts
- * import { checkContentAccess } from './authorization'
+ * import { checkContentAccess } from './authorization.js'
  *
  * const result = await checkContentAccess(deps, context, branchRoot, 'content/posts/post.mdx', user, 'edit')
  * if (result.allowed) {
@@ -25,14 +25,13 @@
  * - `permissions/` - Permissions file schema and loader
  * - `groups/` - Groups file schema and loader
  */
-export type { BranchAccessResult, PathPermissionResult, ContentAccessResult, ContentAccessDeps, PermissionPath, } from './types';
-export { parsePermissionPath } from './validation';
-export { checkContentAccess, createCheckContentAccess, createContentAccessChecker, type ContentAccessChecker, } from './content';
-export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch';
-export { getBranchProtection, getBranchWriteProtection, type BranchProtection, type BranchWriteProtection, } from './protected-branch';
-export { checkPathAccess, createCheckPathAccess, resolveDefaultPathAccess } from './path';
-export { RESERVED_GROUPS, type ReservedGroupId, isReservedGroup, stripReservedGroups, isAdmin, isReviewer, isPrivileged, } from './helpers';
-export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile, loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './permissions';
-export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './groups';
-export { mutateSettingsJsonFile, SettingsFileConflictError, SettingsVersionConflictError, type MutateSettingsFileOptions, } from './settings-file-store';
-//# sourceMappingURL=index.d.ts.map
+export type { BranchAccessResult, PathPermissionResult, ContentAccessResult, ContentAccessDeps, PermissionPath, } from './types.js';
+export { parsePermissionPath } from './validation.js';
+export { checkContentAccess, createCheckContentAccess, createContentAccessChecker, type ContentAccessChecker, } from './content.js';
+export { checkBranchAccessWithDefault, createCheckBranchAccess, canPerformWorkflowAction, } from './branch.js';
+export { getBranchProtection, getBranchWriteProtection, type BranchProtection, type BranchWriteProtection, } from './protected-branch.js';
+export { checkPathAccess, createCheckPathAccess, resolveDefaultPathAccess } from './path.js';
+export { RESERVED_GROUPS, type ReservedGroupId, isReservedGroup, stripReservedGroups, isAdmin, isReviewer, isPrivileged, } from './helpers.js';
+export { PermissionsFileSchema, createDefaultPermissionsFile, type PermissionsFile, loadPermissionsFile, loadPathPermissions, mutatePermissionsFile, ensurePermissionsFile, } from './permissions/index.js';
+export { GroupsFileSchema, createDefaultGroupsFile, type GroupsFile, type InternalGroup, loadGroupsFile, loadInternalGroups, deriveInternalGroups, mutateGroupsFile, } from './groups/index.js';
+export { mutateSettingsJsonFile, SettingsFileConflictError, SettingsVersionConflictError, type MutateSettingsFileOptions, } from './settings-file-store.js';

package/dist/authorization/index.js

@@ -44,4 +44,3 @@ export { GroupsFileSchema, createDefaultGroupsFile, loadGroupsFile, loadInternal
 // Settings file store — cross-host layered locking shared by
 // permissions.json and groups.json (see authorization/settings-file-store.ts)
 export { mutateSettingsJsonFile, SettingsFileConflictError, SettingsVersionConflictError, } from './settings-file-store.js';
-//# sourceMappingURL=index.js.map

package/dist/authorization/path.d.ts

@@ -3,10 +3,10 @@
  *
  * Handles checking if a user can access a specific path based on permission rules.
  */
-import type { PathPermission, DefaultPathAccess, PermissionLevel } from '../config';
-import type { CanopyUser } from '../user';
-import type { PathPermissionResult } from './types';
-import type { PhysicalPath } from '../paths/types';
+import type { PathPermission, DefaultPathAccess, PermissionLevel } from '../config/index.js';
+import type { CanopyUser } from '../user.js';
+import type { PathPermissionResult } from './types.js';
+import type { PhysicalPath } from '../paths/types.js';
 /**
  * Resolve a `defaultPathAccess` config value to an 'allow'/'deny' verdict for one
  * permission level. String form applies the same value to every level (unchanged
@@ -34,4 +34,3 @@ export declare function createCheckPathAccess(rules: PathPermission[], defaultAc
     user: CanopyUser;
     level: PermissionLevel;
 }) => PathPermissionResult;
-//# sourceMappingURL=path.d.ts.map

package/dist/authorization/path.js

@@ -83,4 +83,3 @@ export function checkPathAccess({ rules, relativePath, user, defaultAccess, leve
 export function createCheckPathAccess(rules, defaultAccess) {
     return (input) => checkPathAccess({ ...input, rules, defaultAccess });
 }
-//# sourceMappingURL=path.js.map