canopycms 0.0.66-int.85 → 0.0.66

package/dist/cli/cli.js

@@ -93,6 +93,7 @@ import { isAbsolute } from "pathe";
 import { z as z3 } from "zod";
 import { z as z4 } from "zod";
 import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 import { join, normalize } from "pathe";
 import fs2 from "node:fs/promises";
 import fs22 from "node:fs/promises";
@@ -115,6 +116,47 @@ import path8 from "node:path";
 function canopyLogWarn(...args) {
   active.warn(...args);
 }
+function declaresScheme(url) {
+  return /^[a-z][a-z0-9+.-]*:/i.test(url.trim());
+}
+function isImplicitlyOffOrigin(url) {
+  if (declaresScheme(url))
+    return false;
+  try {
+    return new URL(url, SENTINEL_BASE).origin !== SENTINEL_BASE;
+  } catch {
+    return false;
+  }
+}
+function isHttpUrlOrSameOriginPath(value, opts = {}) {
+  if (value === "")
+    return false;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 32 || code === 127)
+      return false;
+  }
+  if (value.includes("?") || value.includes("#"))
+    return false;
+  if (value.includes("\\"))
+    return false;
+  if (DOT_SEGMENT.test(value))
+    return false;
+  if (declaresScheme(value)) {
+    if (!/^https?:\/\//i.test(value))
+      return false;
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (isImplicitlyOffOrigin(value)) {
+    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
+  }
+  return value.startsWith("/") && value[1] !== "/";
+}
 function getErrorMessage2(err) {
   if (err instanceof Error) {
     return err.message;
@@ -1074,7 +1116,7 @@ CanopyCMS worker run-once (mode: ${mode}, auth: ${authMode})
   }
   console.log("\nDone");
 }
-var __defProp2, __getOwnPropNames2, __esm2, __export2, active, init_logger, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_mode_env, init_validation, init_helpers, init_config2, init_error2, init_fs2, templates_exports, __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME, init_templates, project_detect_exports, COMMANDS, MAX_WORKSPACE_DEPTH, CDK_DEPENDENCIES, init_project_detect, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName, ProdStrategy, DevStrategy, strategyCache;
+var __defProp2, __getOwnPropNames2, __esm2, __export2, active, init_logger, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, SENTINEL_BASE, DOT_SEGMENT, init_sanitize_href, uploadTargetUrlSchema, assetMountUrlSchema, init_url, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_mode_env, init_validation, init_helpers, init_config2, init_error2, init_fs2, templates_exports, __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME, init_templates, project_detect_exports, COMMANDS, MAX_WORKSPACE_DEPTH, CDK_DEPENDENCIES, init_project_detect, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName, ProdStrategy, DevStrategy, strategyCache;
 var init_init = __esm({
   "dist/cli/init.js"() {
     "use strict";
@@ -1238,29 +1280,64 @@ var init_init = __esm({
         }));
       }
     });
+    init_sanitize_href = __esm2({
+      "dist/utils/sanitize-href.js"() {
+        "use strict";
+        SENTINEL_BASE = "https://relative.invalid";
+        DOT_SEGMENT = /(^|\/)(\.|%2e){1,2}(\/|$)/i;
+      }
+    });
+    init_url = __esm2({
+      "dist/config/schemas/url.js"() {
+        "use strict";
+        init_sanitize_href();
+        uploadTargetUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+          message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+        });
+        assetMountUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
+          message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
+        });
+      }
+    });
     init_media = __esm2({
       "dist/config/schemas/media.js"() {
         "use strict";
         init_collection();
-        mediaSchema = z3.discriminatedUnion("adapter", [
-          z3.object({
-            adapter: z3.literal("local"),
-            publicBaseUrl: z3.string().url().optional(),
+        init_url();
+        mediaSchema = z4.discriminatedUnion("adapter", [
+          z4.object({
+            adapter: z4.literal("local"),
+            publicBaseUrl: assetMountUrlSchema.optional(),
             /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
             directory: relativePathSchema.optional()
-          }),
-          z3.object({
-            adapter: z3.literal("s3"),
-            bucket: z3.string().min(1),
-            region: z3.string().min(1),
-            publicBaseUrl: z3.string().url().optional(),
+          }).strict(),
+          z4.object({
+            adapter: z4.literal("s3"),
+            bucket: z4.string().min(1),
+            region: z4.string().min(1),
+            publicBaseUrl: assetMountUrlSchema.optional(),
+            /**
+             * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
+             * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
+             *
+             * Set this to route uploads through your own CDN so they are same-origin with the
+             * editor, which removes the need for a bucket CORS rule naming an exact origin. The
+             * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
+             * alone, so the host never enters it (pinned by store-s3.test.ts).
+             *
+             * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
+             * the POST target outright and is passed through byte-for-byte. Do not route it through
+             * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
+             * stop a CDN path pattern like `/asset-upload/*` from matching.
+             */
+            uploadUrl: uploadTargetUrlSchema.optional(),
             /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
-            maxUploadBytes: z3.number().int().positive().optional()
-          }),
-          z3.object({
-            adapter: z3.literal("lfs"),
-            publicBaseUrl: z3.string().url().optional()
-          })
+            maxUploadBytes: z4.number().int().positive().optional()
+          }).strict(),
+          z4.object({
+            adapter: z4.literal("lfs"),
+            publicBaseUrl: assetMountUrlSchema.optional()
+          }).strict()
         ]);
       }
     });
@@ -1269,44 +1346,44 @@ var init_init = __esm({
         "use strict";
         init_collection();
         init_media();
-        defaultBranchAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-        defaultPathAccessLevelSchema = z4.enum(["allow", "deny"]);
-        defaultPathAccessLevelsSchema = z4.object({
+        defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
+        defaultPathAccessLevelSchema = z5.enum(["allow", "deny"]);
+        defaultPathAccessLevelsSchema = z5.object({
           read: defaultPathAccessLevelSchema.optional(),
           edit: defaultPathAccessLevelSchema.optional(),
           review: defaultPathAccessLevelSchema.optional()
         }).strict();
-        defaultPathAccessSchema = z4.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
-        defaultBaseBranchSchema = z4.string().default("main");
-        defaultRemoteNameSchema = z4.string().default("origin");
-        defaultRemoteUrlSchema = z4.string().min(1);
-        gitBotAuthorNameSchema = z4.string().min(1);
-        gitBotAuthorEmailSchema = z4.string().email();
-        githubTokenEnvVarSchema = z4.string().default("GITHUB_BOT_TOKEN");
-        operatingModeSchema = z4.enum(["prod", "dev"]);
-        deployedAsSchema = z4.enum(["static", "server"]).default("server");
+        defaultPathAccessSchema = z5.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
+        defaultBaseBranchSchema = z5.string().default("main");
+        defaultRemoteNameSchema = z5.string().default("origin");
+        defaultRemoteUrlSchema = z5.string().min(1);
+        gitBotAuthorNameSchema = z5.string().min(1);
+        gitBotAuthorEmailSchema = z5.string().email();
+        githubTokenEnvVarSchema = z5.string().default("GITHUB_BOT_TOKEN");
+        operatingModeSchema = z5.enum(["prod", "dev"]);
+        deployedAsSchema = z5.enum(["static", "server"]).default("server");
         contentRootSchema = relativePathSchema.default("content");
-        sourceRootSchema = z4.string().min(1).optional();
-        basePathSchema = z4.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
+        sourceRootSchema = z5.string().min(1).optional();
+        basePathSchema = z5.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
           message: "basePath must not be empty or only whitespace"
         }).optional();
-        deploymentNameSchema = z4.string().default("prod");
-        devContentSyncSchema = z4.enum(["off", "warn"]).default("warn");
-        devConfigSchema = z4.object({
+        deploymentNameSchema = z5.string().default("prod");
+        devContentSyncSchema = z5.enum(["off", "warn"]).default("warn");
+        devConfigSchema = z5.object({
           contentSync: devContentSyncSchema.optional()
         });
-        editorConfigSchema = z4.object({
-          title: z4.string().optional(),
-          subtitle: z4.string().optional(),
-          theme: z4.unknown().optional(),
-          previewBase: z4.record(z4.string()).optional(),
+        editorConfigSchema = z5.object({
+          title: z5.string().optional(),
+          subtitle: z5.string().optional(),
+          theme: z5.unknown().optional(),
+          previewBase: z5.record(z5.string()).optional(),
           // UI handler functions (runtime only, don't serialize)
-          onAccountClick: z4.function().returns(z4.void()).optional(),
-          onLogoutClick: z4.function().returns(z4.void()).optional(),
+          onAccountClick: z5.function().returns(z5.void()).optional(),
+          onLogoutClick: z5.function().returns(z5.void()).optional(),
           // Optional: custom account component (e.g., Clerk's UserButton)
-          AccountComponent: z4.custom().optional()
+          AccountComponent: z5.custom().optional()
         });
-        CanopyConfigSchema = z4.object({
+        CanopyConfigSchema = z5.object({
           media: mediaSchema.optional(),
           // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
           // have .default('deny'), so the field is optional on input but always resolves to
@@ -1322,7 +1399,7 @@ var init_init = __esm({
           // unset must stay undefined after parsing so dev mode can detect the fork
           // point from git HEAD (see resolveBaseBranch in utils/git.ts).
           defaultBaseBranch: defaultBaseBranchSchema.optional(),
-          defaultActiveBranch: z4.string().min(1).optional(),
+          defaultActiveBranch: z5.string().min(1).optional(),
           defaultRemoteName: defaultRemoteNameSchema.optional(),
           defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
           gitBotAuthorName: gitBotAuthorNameSchema,
@@ -1336,9 +1413,9 @@ var init_init = __esm({
           // Escape hatch for prod hosts that genuinely have internet access and intentionally
           // run git against a network remote (see GitManager.resolveRemoteUrl's prod-mode guard).
           // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
-          allowNetworkRemoteInProd: z4.boolean().optional(),
-          settingsBranch: z4.string().optional(),
-          autoCreateSettingsPR: z4.boolean().optional(),
+          allowNetworkRemoteInProd: z5.boolean().optional(),
+          settingsBranch: z5.string().optional(),
+          autoCreateSettingsPR: z5.boolean().optional(),
           // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
           // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
           // the literal 'prod' instead of staying `undefined` — collapsing the
@@ -1354,9 +1431,9 @@ var init_init = __esm({
           sourceRoot: sourceRootSchema.optional(),
           basePath: basePathSchema,
           editor: editorConfigSchema.optional(),
-          authPlugin: z4.custom().optional(),
-          entryLinkUrl: z4.custom().optional(),
-          validateEntry: z4.custom().optional(),
+          authPlugin: z5.custom().optional(),
+          entryLinkUrl: z5.custom().optional(),
+          validateEntry: z5.custom().optional(),
           dev: devConfigSchema.optional()
         }).strict();
         DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
@@ -1365,12 +1442,12 @@ var init_init = __esm({
     init_permissions = __esm2({
       "dist/config/schemas/permissions.js"() {
         "use strict";
-        permissionTargetSchema = z5.object({
-          allowedUsers: z5.array(z5.string()).optional(),
-          allowedGroups: z5.array(z5.string()).optional()
+        permissionTargetSchema = z6.object({
+          allowedUsers: z6.array(z6.string()).optional(),
+          allowedGroups: z6.array(z6.string()).optional()
         });
-        pathPermissionSchema = z5.object({
-          path: z5.string().min(1),
+        pathPermissionSchema = z6.object({
+          path: z6.string().min(1),
           read: permissionTargetSchema.optional(),
           edit: permissionTargetSchema.optional(),
           review: permissionTargetSchema.optional()
@@ -1880,7 +1957,8 @@ import { z as z32 } from "zod";
 import { isAbsolute as isAbsolute2 } from "pathe";
 import { z as z42 } from "zod";
 import { z as z52 } from "zod";
-import { z as z6 } from "zod";
+import { z as z62 } from "zod";
+import { z as z7 } from "zod";
 import path9 from "node:path";
 import path21 from "node:path";
 import { createJiti as createJiti2 } from "jiti";
@@ -1911,7 +1989,7 @@ import fs72 from "node:fs/promises";
 import path82 from "node:path";
 import { promises as fs62 } from "fs";
 import { join as join3 } from "pathe";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 import chokidar from "chokidar";
 import fs8 from "node:fs/promises";
 import { sep, resolve, relative } from "node:path";
@@ -1945,6 +2023,47 @@ function canopyLogWarn2(...args) {
 function canopyLogError(...args) {
   active2.error(...args);
 }
+function declaresScheme2(url) {
+  return /^[a-z][a-z0-9+.-]*:/i.test(url.trim());
+}
+function isImplicitlyOffOrigin2(url) {
+  if (declaresScheme2(url))
+    return false;
+  try {
+    return new URL(url, SENTINEL_BASE2).origin !== SENTINEL_BASE2;
+  } catch {
+    return false;
+  }
+}
+function isHttpUrlOrSameOriginPath2(value, opts = {}) {
+  if (value === "")
+    return false;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 32 || code === 127)
+      return false;
+  }
+  if (value.includes("?") || value.includes("#"))
+    return false;
+  if (value.includes("\\"))
+    return false;
+  if (DOT_SEGMENT2.test(value))
+    return false;
+  if (declaresScheme2(value)) {
+    if (!/^https?:\/\//i.test(value))
+      return false;
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (isImplicitlyOffOrigin2(value)) {
+    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
+  }
+  return value.startsWith("/") && value[1] !== "/";
+}
 function normalizeFilesystemPath(path222) {
   return path222.split(/[\\/]+/).filter(Boolean).join("/");
 }
@@ -4567,7 +4686,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, DEFAULT_SEO_FIELD_NAMES, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, BRANCH_META_DIR, BRANCH_META_FILE, BranchMetadataCorruptError, branchMetadataFilePath, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, SENTINEL_BASE2, DOT_SEGMENT2, init_sanitize_href2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, uploadTargetUrlSchema2, assetMountUrlSchema2, init_url2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, DEFAULT_SEO_FIELD_NAMES, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, BRANCH_META_DIR, BRANCH_META_FILE, BranchMetadataCorruptError, branchMetadataFilePath, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -4586,6 +4705,13 @@ var init_generate_ai_content = __esm({
         active2 = console;
       }
     });
+    init_sanitize_href2 = __esm3({
+      "dist/utils/sanitize-href.js"() {
+        "use strict";
+        SENTINEL_BASE2 = "https://relative.invalid";
+        DOT_SEGMENT2 = /(^|\/)(\.|%2e){1,2}(\/|$)/i;
+      }
+    });
     init_normalize2 = __esm3({
       "dist/paths/normalize.js"() {
         "use strict";
@@ -4841,29 +4967,57 @@ var init_generate_ai_content = __esm({
         }));
       }
     });
+    init_url2 = __esm3({
+      "dist/config/schemas/url.js"() {
+        "use strict";
+        init_sanitize_href2();
+        uploadTargetUrlSchema2 = z42.string().trim().refine((value) => isHttpUrlOrSameOriginPath2(value), {
+          message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+        });
+        assetMountUrlSchema2 = z42.string().trim().refine((value) => isHttpUrlOrSameOriginPath2(value, { allowProtocolRelative: true }), {
+          message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
+        });
+      }
+    });
     init_media2 = __esm3({
       "dist/config/schemas/media.js"() {
         "use strict";
         init_collection2();
-        mediaSchema2 = z42.discriminatedUnion("adapter", [
-          z42.object({
-            adapter: z42.literal("local"),
-            publicBaseUrl: z42.string().url().optional(),
+        init_url2();
+        mediaSchema2 = z52.discriminatedUnion("adapter", [
+          z52.object({
+            adapter: z52.literal("local"),
+            publicBaseUrl: assetMountUrlSchema2.optional(),
             /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
             directory: relativePathSchema2.optional()
-          }),
-          z42.object({
-            adapter: z42.literal("s3"),
-            bucket: z42.string().min(1),
-            region: z42.string().min(1),
-            publicBaseUrl: z42.string().url().optional(),
+          }).strict(),
+          z52.object({
+            adapter: z52.literal("s3"),
+            bucket: z52.string().min(1),
+            region: z52.string().min(1),
+            publicBaseUrl: assetMountUrlSchema2.optional(),
+            /**
+             * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
+             * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
+             *
+             * Set this to route uploads through your own CDN so they are same-origin with the
+             * editor, which removes the need for a bucket CORS rule naming an exact origin. The
+             * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
+             * alone, so the host never enters it (pinned by store-s3.test.ts).
+             *
+             * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
+             * the POST target outright and is passed through byte-for-byte. Do not route it through
+             * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
+             * stop a CDN path pattern like `/asset-upload/*` from matching.
+             */
+            uploadUrl: uploadTargetUrlSchema2.optional(),
             /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
-            maxUploadBytes: z42.number().int().positive().optional()
-          }),
-          z42.object({
-            adapter: z42.literal("lfs"),
-            publicBaseUrl: z42.string().url().optional()
-          })
+            maxUploadBytes: z52.number().int().positive().optional()
+          }).strict(),
+          z52.object({
+            adapter: z52.literal("lfs"),
+            publicBaseUrl: assetMountUrlSchema2.optional()
+          }).strict()
         ]);
       }
     });
@@ -4872,44 +5026,44 @@ var init_generate_ai_content = __esm({
         "use strict";
         init_collection2();
         init_media2();
-        defaultBranchAccessSchema2 = z52.enum(["allow", "deny"]).default("deny");
-        defaultPathAccessLevelSchema2 = z52.enum(["allow", "deny"]);
-        defaultPathAccessLevelsSchema2 = z52.object({
+        defaultBranchAccessSchema2 = z62.enum(["allow", "deny"]).default("deny");
+        defaultPathAccessLevelSchema2 = z62.enum(["allow", "deny"]);
+        defaultPathAccessLevelsSchema2 = z62.object({
           read: defaultPathAccessLevelSchema2.optional(),
           edit: defaultPathAccessLevelSchema2.optional(),
           review: defaultPathAccessLevelSchema2.optional()
         }).strict();
-        defaultPathAccessSchema2 = z52.union([defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2]).default("deny");
-        defaultBaseBranchSchema2 = z52.string().default("main");
-        defaultRemoteNameSchema2 = z52.string().default("origin");
-        defaultRemoteUrlSchema2 = z52.string().min(1);
-        gitBotAuthorNameSchema2 = z52.string().min(1);
-        gitBotAuthorEmailSchema2 = z52.string().email();
-        githubTokenEnvVarSchema2 = z52.string().default("GITHUB_BOT_TOKEN");
-        operatingModeSchema2 = z52.enum(["prod", "dev"]);
-        deployedAsSchema2 = z52.enum(["static", "server"]).default("server");
+        defaultPathAccessSchema2 = z62.union([defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2]).default("deny");
+        defaultBaseBranchSchema2 = z62.string().default("main");
+        defaultRemoteNameSchema2 = z62.string().default("origin");
+        defaultRemoteUrlSchema2 = z62.string().min(1);
+        gitBotAuthorNameSchema2 = z62.string().min(1);
+        gitBotAuthorEmailSchema2 = z62.string().email();
+        githubTokenEnvVarSchema2 = z62.string().default("GITHUB_BOT_TOKEN");
+        operatingModeSchema2 = z62.enum(["prod", "dev"]);
+        deployedAsSchema2 = z62.enum(["static", "server"]).default("server");
         contentRootSchema2 = relativePathSchema2.default("content");
-        sourceRootSchema2 = z52.string().min(1).optional();
-        basePathSchema2 = z52.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
+        sourceRootSchema2 = z62.string().min(1).optional();
+        basePathSchema2 = z62.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
           message: "basePath must not be empty or only whitespace"
         }).optional();
-        deploymentNameSchema2 = z52.string().default("prod");
-        devContentSyncSchema2 = z52.enum(["off", "warn"]).default("warn");
-        devConfigSchema2 = z52.object({
+        deploymentNameSchema2 = z62.string().default("prod");
+        devContentSyncSchema2 = z62.enum(["off", "warn"]).default("warn");
+        devConfigSchema2 = z62.object({
           contentSync: devContentSyncSchema2.optional()
         });
-        editorConfigSchema2 = z52.object({
-          title: z52.string().optional(),
-          subtitle: z52.string().optional(),
-          theme: z52.unknown().optional(),
-          previewBase: z52.record(z52.string()).optional(),
+        editorConfigSchema2 = z62.object({
+          title: z62.string().optional(),
+          subtitle: z62.string().optional(),
+          theme: z62.unknown().optional(),
+          previewBase: z62.record(z62.string()).optional(),
           // UI handler functions (runtime only, don't serialize)
-          onAccountClick: z52.function().returns(z52.void()).optional(),
-          onLogoutClick: z52.function().returns(z52.void()).optional(),
+          onAccountClick: z62.function().returns(z62.void()).optional(),
+          onLogoutClick: z62.function().returns(z62.void()).optional(),
           // Optional: custom account component (e.g., Clerk's UserButton)
-          AccountComponent: z52.custom().optional()
+          AccountComponent: z62.custom().optional()
         });
-        CanopyConfigSchema2 = z52.object({
+        CanopyConfigSchema2 = z62.object({
           media: mediaSchema2.optional(),
           // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
           // have .default('deny'), so the field is optional on input but always resolves to
@@ -4925,7 +5079,7 @@ var init_generate_ai_content = __esm({
           // unset must stay undefined after parsing so dev mode can detect the fork
           // point from git HEAD (see resolveBaseBranch in utils/git.ts).
           defaultBaseBranch: defaultBaseBranchSchema2.optional(),
-          defaultActiveBranch: z52.string().min(1).optional(),
+          defaultActiveBranch: z62.string().min(1).optional(),
           defaultRemoteName: defaultRemoteNameSchema2.optional(),
           defaultRemoteUrl: defaultRemoteUrlSchema2.optional(),
           gitBotAuthorName: gitBotAuthorNameSchema2,
@@ -4939,9 +5093,9 @@ var init_generate_ai_content = __esm({
           // Escape hatch for prod hosts that genuinely have internet access and intentionally
           // run git against a network remote (see GitManager.resolveRemoteUrl's prod-mode guard).
           // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
-          allowNetworkRemoteInProd: z52.boolean().optional(),
-          settingsBranch: z52.string().optional(),
-          autoCreateSettingsPR: z52.boolean().optional(),
+          allowNetworkRemoteInProd: z62.boolean().optional(),
+          settingsBranch: z62.string().optional(),
+          autoCreateSettingsPR: z62.boolean().optional(),
           // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
           // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
           // the literal 'prod' instead of staying `undefined` — collapsing the
@@ -4957,9 +5111,9 @@ var init_generate_ai_content = __esm({
           sourceRoot: sourceRootSchema2.optional(),
           basePath: basePathSchema2,
           editor: editorConfigSchema2.optional(),
-          authPlugin: z52.custom().optional(),
-          entryLinkUrl: z52.custom().optional(),
-          validateEntry: z52.custom().optional(),
+          authPlugin: z62.custom().optional(),
+          entryLinkUrl: z62.custom().optional(),
+          validateEntry: z62.custom().optional(),
           dev: devConfigSchema2.optional()
         }).strict();
         DEFAULT_PROD_WORKSPACE2 = "/mnt/efs/workspace";
@@ -5080,12 +5234,12 @@ var init_generate_ai_content = __esm({
     init_permissions2 = __esm3({
       "dist/config/schemas/permissions.js"() {
         "use strict";
-        permissionTargetSchema2 = z6.object({
-          allowedUsers: z6.array(z6.string()).optional(),
-          allowedGroups: z6.array(z6.string()).optional()
+        permissionTargetSchema2 = z7.object({
+          allowedUsers: z7.array(z7.string()).optional(),
+          allowedGroups: z7.array(z7.string()).optional()
         });
-        pathPermissionSchema2 = z6.object({
-          path: z6.string().min(1),
+        pathPermissionSchema2 = z7.object({
+          path: z7.string().min(1),
           read: permissionTargetSchema2.optional(),
           edit: permissionTargetSchema2.optional(),
           review: permissionTargetSchema2.optional()
@@ -5268,6 +5422,7 @@ var init_generate_ai_content = __esm({
     sleep = (ms) => new Promise((resolve2) => {
       setTimeout(resolve2, ms);
     });
+    init_sanitize_href2();
     DEFAULT_SEO_FIELD_NAMES = {
       title: "metaTitle",
       description: "metaDescription",
@@ -5780,30 +5935,30 @@ var init_generate_ai_content = __esm({
     log2 = createDebugLogger2({ prefix: "ResourceGeneration" });
     META_DIR2 = ".canopy-meta";
     init_logger2();
-    entryTypeMetaSchema = z7.object({
-      name: z7.string().min(1),
-      format: z7.enum(["md", "mdx", "json", "yaml"]),
-      schema: z7.string().min(1),
+    entryTypeMetaSchema = z8.object({
+      name: z8.string().min(1),
+      format: z8.enum(["md", "mdx", "json", "yaml"]),
+      schema: z8.string().min(1),
       // Entry schema registry key (validated at resolution time)
-      label: z7.string().optional(),
-      description: z7.string().optional(),
-      default: z7.boolean().optional(),
-      maxItems: z7.number().int().positive().optional()
+      label: z8.string().optional(),
+      description: z8.string().optional(),
+      default: z8.boolean().optional(),
+      maxItems: z8.number().int().positive().optional()
     });
-    collectionMetaSchema = z7.object({
-      name: z7.string().min(1),
-      label: z7.string().optional(),
-      description: z7.string().optional(),
-      entries: z7.array(entryTypeMetaSchema).optional(),
-      order: z7.array(z7.string()).default([])
+    collectionMetaSchema = z8.object({
+      name: z8.string().min(1),
+      label: z8.string().optional(),
+      description: z8.string().optional(),
+      entries: z8.array(entryTypeMetaSchema).optional(),
+      order: z8.array(z8.string()).default([])
       // Embedded IDs for ordering; optional in the file, [] = alphabetical
     }).refine((data) => data.entries && data.entries.length > 0, {
       message: "Collection must have at least one entry type"
     });
-    rootCollectionMetaSchema = z7.object({
-      label: z7.string().optional(),
-      entries: z7.array(entryTypeMetaSchema).optional(),
-      order: z7.array(z7.string()).optional()
+    rootCollectionMetaSchema = z8.object({
+      label: z8.string().optional(),
+      entries: z8.array(entryTypeMetaSchema).optional(),
+      order: z8.array(z8.string()).optional()
       // Embedded IDs for ordering items
     });
     init_flatten2();
@@ -9102,7 +9257,7 @@ var init_content_id_index = __esm({
 // dist/schema/meta-loader.js
 import { promises as fs21 } from "fs";
 import { join as join4 } from "pathe";
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 import chokidar2 from "chokidar";
 function stripEmbeddedIdFromName2(name) {
   return extractSlugFromFilename2(name);
@@ -9181,30 +9336,30 @@ var init_meta_loader = __esm({
     init_error();
     init_logger3();
     init_content_id_index();
-    entryTypeMetaSchema2 = z8.object({
-      name: z8.string().min(1),
-      format: z8.enum(["md", "mdx", "json", "yaml"]),
-      schema: z8.string().min(1),
+    entryTypeMetaSchema2 = z9.object({
+      name: z9.string().min(1),
+      format: z9.enum(["md", "mdx", "json", "yaml"]),
+      schema: z9.string().min(1),
       // Entry schema registry key (validated at resolution time)
-      label: z8.string().optional(),
-      description: z8.string().optional(),
-      default: z8.boolean().optional(),
-      maxItems: z8.number().int().positive().optional()
+      label: z9.string().optional(),
+      description: z9.string().optional(),
+      default: z9.boolean().optional(),
+      maxItems: z9.number().int().positive().optional()
     });
-    collectionMetaSchema2 = z8.object({
-      name: z8.string().min(1),
-      label: z8.string().optional(),
-      description: z8.string().optional(),
-      entries: z8.array(entryTypeMetaSchema2).optional(),
-      order: z8.array(z8.string()).default([])
+    collectionMetaSchema2 = z9.object({
+      name: z9.string().min(1),
+      label: z9.string().optional(),
+      description: z9.string().optional(),
+      entries: z9.array(entryTypeMetaSchema2).optional(),
+      order: z9.array(z9.string()).default([])
       // Embedded IDs for ordering; optional in the file, [] = alphabetical
     }).refine((data) => data.entries && data.entries.length > 0, {
       message: "Collection must have at least one entry type"
     });
-    rootCollectionMetaSchema2 = z8.object({
-      label: z8.string().optional(),
-      entries: z8.array(entryTypeMetaSchema2).optional(),
-      order: z8.array(z8.string()).optional()
+    rootCollectionMetaSchema2 = z9.object({
+      label: z9.string().optional(),
+      entries: z9.array(entryTypeMetaSchema2).optional(),
+      order: z9.array(z9.string()).optional()
       // Embedded IDs for ordering items
     });
   }
@@ -9262,88 +9417,88 @@ var init_types5 = __esm({
 });
 
 // dist/config/schemas/field.js
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var fieldBaseSchema3, selectOptionSchema3, referenceOptionSchema3, primitiveFieldSchema3, ASPECT_RATIO_RE3, imageFieldSchema3, selectFieldSchema3, referenceFieldSchema3, fieldHolder3, blockSchema3, blockFieldSchema3, objectFieldSchema3, inlineGroupFieldSchema3, customFieldSchema3, knownFieldSchema3, fieldSchema3;
 var init_field3 = __esm({
   "dist/config/schemas/field.js"() {
     "use strict";
     init_types5();
-    fieldBaseSchema3 = z9.object({
-      name: z9.string().min(1),
-      label: z9.string().optional(),
-      description: z9.string().optional(),
-      required: z9.boolean().optional(),
-      list: z9.boolean().optional(),
-      isTitle: z9.boolean().optional(),
-      isBody: z9.boolean().optional()
+    fieldBaseSchema3 = z10.object({
+      name: z10.string().min(1),
+      label: z10.string().optional(),
+      description: z10.string().optional(),
+      required: z10.boolean().optional(),
+      list: z10.boolean().optional(),
+      isTitle: z10.boolean().optional(),
+      isBody: z10.boolean().optional()
     });
-    selectOptionSchema3 = z9.union([
-      z9.string(),
-      z9.object({
-        label: z9.string().min(1),
-        value: z9.string().min(1)
+    selectOptionSchema3 = z10.union([
+      z10.string(),
+      z10.object({
+        label: z10.string().min(1),
+        value: z10.string().min(1)
       })
     ]);
-    referenceOptionSchema3 = z9.union([
-      z9.string(),
-      z9.object({
-        label: z9.string().min(1),
-        value: z9.string().min(1)
+    referenceOptionSchema3 = z10.union([
+      z10.string(),
+      z10.object({
+        label: z10.string().min(1),
+        value: z10.string().min(1)
       })
     ]);
     primitiveFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.enum(primitiveFieldTypes3)
+      type: z10.enum(primitiveFieldTypes3)
     });
     ASPECT_RATIO_RE3 = /^[1-9][0-9]*:[1-9][0-9]*$/;
     imageFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("image"),
-      aspect: z9.string().regex(ASPECT_RATIO_RE3, 'aspect must be "W:H" with positive integers (e.g. "16:9")').optional(),
-      altOptional: z9.boolean().optional()
+      type: z10.literal("image"),
+      aspect: z10.string().regex(ASPECT_RATIO_RE3, 'aspect must be "W:H" with positive integers (e.g. "16:9")').optional(),
+      altOptional: z10.boolean().optional()
     });
     selectFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("select"),
-      options: z9.array(selectOptionSchema3).min(1)
+      type: z10.literal("select"),
+      options: z10.array(selectOptionSchema3).min(1)
     });
     referenceFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("reference"),
-      collections: z9.array(z9.string().min(1)).min(1).optional(),
-      entryTypes: z9.array(z9.string().min(1)).min(1).optional(),
-      displayField: z9.string().min(1).optional(),
-      options: z9.array(referenceOptionSchema3).optional(),
+      type: z10.literal("reference"),
+      collections: z10.array(z10.string().min(1)).min(1).optional(),
+      entryTypes: z10.array(z10.string().min(1)).min(1).optional(),
+      displayField: z10.string().min(1).optional(),
+      options: z10.array(referenceOptionSchema3).optional(),
       // Must be listed here, not just on ReferenceFieldConfig: zod strips unknown keys by
       // default, so a consumer that adopts this schema's parse output would silently delete a
       // runtime-consumed flag and the feature would no-op with no error. (`resolvedSchema` is
       // absent on purpose — it is type-inference-only and stripping it changes no behavior.)
-      includeBody: z9.boolean().optional()
+      includeBody: z10.boolean().optional()
     });
-    fieldHolder3 = [z9.never()];
-    blockSchema3 = z9.object({
-      name: z9.string().min(1),
-      label: z9.string().optional(),
-      description: z9.string().optional(),
-      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
+    fieldHolder3 = [z10.never()];
+    blockSchema3 = z10.object({
+      name: z10.string().min(1),
+      label: z10.string().optional(),
+      description: z10.string().optional(),
+      fields: z10.array(z10.lazy(() => fieldHolder3[0])).min(1)
     });
     blockFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("block"),
-      templates: z9.array(blockSchema3).min(1)
+      type: z10.literal("block"),
+      templates: z10.array(blockSchema3).min(1)
     });
     objectFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("object"),
-      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
+      type: z10.literal("object"),
+      fields: z10.array(z10.lazy(() => fieldHolder3[0])).min(1)
     });
-    inlineGroupFieldSchema3 = z9.object({
-      type: z9.literal("group"),
-      name: z9.string().min(1),
-      label: z9.string().optional(),
-      description: z9.string().optional(),
-      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
+    inlineGroupFieldSchema3 = z10.object({
+      type: z10.literal("group"),
+      name: z10.string().min(1),
+      label: z10.string().optional(),
+      description: z10.string().optional(),
+      fields: z10.array(z10.lazy(() => fieldHolder3[0])).min(1)
     });
-    customFieldSchema3 = z9.lazy(() => fieldBaseSchema3.extend({
-      type: z9.string().min(1).refine((val) => !fieldTypes3.includes(val), {
+    customFieldSchema3 = z10.lazy(() => fieldBaseSchema3.extend({
+      type: z10.string().min(1).refine((val) => !fieldTypes3.includes(val), {
         message: "Custom field types must not conflict with built-in types"
       })
     }).passthrough());
-    knownFieldSchema3 = z9.discriminatedUnion("type", [
+    knownFieldSchema3 = z10.discriminatedUnion("type", [
       primitiveFieldSchema3,
       selectFieldSchema3,
       referenceFieldSchema3,
@@ -9352,39 +9507,39 @@ var init_field3 = __esm({
       blockFieldSchema3,
       inlineGroupFieldSchema3
     ]);
-    fieldSchema3 = z9.lazy(() => z9.union([knownFieldSchema3, customFieldSchema3]));
+    fieldSchema3 = z10.lazy(() => z10.union([knownFieldSchema3, customFieldSchema3]));
     fieldHolder3[0] = fieldSchema3;
   }
 });
 
 // dist/config/schemas/collection.js
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 import { isAbsolute as isAbsolute3 } from "pathe";
 var relativePathSchema3, entryTypeSchema3, collectionSchema3;
 var init_collection3 = __esm({
   "dist/config/schemas/collection.js"() {
     "use strict";
     init_field3();
-    relativePathSchema3 = z10.string().min(1).refine((val) => !isAbsolute3(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
+    relativePathSchema3 = z11.string().min(1).refine((val) => !isAbsolute3(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
       message: 'Path must not contain ".."'
     }).transform((val) => val.split(/[\\/]+/).filter(Boolean).join("/"));
-    entryTypeSchema3 = z10.object({
-      name: z10.string().min(1),
-      format: z10.enum(["md", "mdx", "json", "yaml"]),
-      schema: z10.array(z10.lazy(() => fieldSchema3)).min(1),
-      label: z10.string().optional(),
-      description: z10.string().optional(),
-      default: z10.boolean().optional(),
-      maxItems: z10.number().int().positive().optional()
+    entryTypeSchema3 = z11.object({
+      name: z11.string().min(1),
+      format: z11.enum(["md", "mdx", "json", "yaml"]),
+      schema: z11.array(z11.lazy(() => fieldSchema3)).min(1),
+      label: z11.string().optional(),
+      description: z11.string().optional(),
+      default: z11.boolean().optional(),
+      maxItems: z11.number().int().positive().optional()
     });
-    collectionSchema3 = z10.lazy(() => z10.object({
-      name: z10.string().min(1),
+    collectionSchema3 = z11.lazy(() => z11.object({
+      name: z11.string().min(1),
       path: relativePathSchema3,
-      label: z10.string().optional(),
-      description: z10.string().optional(),
-      entries: z10.array(entryTypeSchema3).optional(),
-      collections: z10.array(collectionSchema3).optional(),
-      order: z10.array(z10.string()).optional()
+      label: z11.string().optional(),
+      description: z11.string().optional(),
+      entries: z11.array(entryTypeSchema3).optional(),
+      collections: z11.array(collectionSchema3).optional(),
+      order: z11.array(z11.string()).optional()
       // Embedded IDs for ordering items
     }).refine((data) => data.entries || data.collections, {
       message: "Collection must have entries or collections"
@@ -9392,82 +9547,165 @@ var init_collection3 = __esm({
   }
 });
 
+// dist/utils/sanitize-href.js
+function declaresScheme3(url) {
+  return /^[a-z][a-z0-9+.-]*:/i.test(url.trim());
+}
+function isImplicitlyOffOrigin3(url) {
+  if (declaresScheme3(url))
+    return false;
+  try {
+    return new URL(url, SENTINEL_BASE3).origin !== SENTINEL_BASE3;
+  } catch {
+    return false;
+  }
+}
+function isHttpUrlOrSameOriginPath3(value, opts = {}) {
+  if (value === "")
+    return false;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 32 || code === 127)
+      return false;
+  }
+  if (value.includes("?") || value.includes("#"))
+    return false;
+  if (value.includes("\\"))
+    return false;
+  if (DOT_SEGMENT3.test(value))
+    return false;
+  if (declaresScheme3(value)) {
+    if (!/^https?:\/\//i.test(value))
+      return false;
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (isImplicitlyOffOrigin3(value)) {
+    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
+  }
+  return value.startsWith("/") && value[1] !== "/";
+}
+var SENTINEL_BASE3, DOT_SEGMENT3;
+var init_sanitize_href3 = __esm({
+  "dist/utils/sanitize-href.js"() {
+    "use strict";
+    SENTINEL_BASE3 = "https://relative.invalid";
+    DOT_SEGMENT3 = /(^|\/)(\.|%2e){1,2}(\/|$)/i;
+  }
+});
+
+// dist/config/schemas/url.js
+import { z as z12 } from "zod";
+var uploadTargetUrlSchema3, assetMountUrlSchema3;
+var init_url3 = __esm({
+  "dist/config/schemas/url.js"() {
+    "use strict";
+    init_sanitize_href3();
+    uploadTargetUrlSchema3 = z12.string().trim().refine((value) => isHttpUrlOrSameOriginPath3(value), {
+      message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+    });
+    assetMountUrlSchema3 = z12.string().trim().refine((value) => isHttpUrlOrSameOriginPath3(value, { allowProtocolRelative: true }), {
+      message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
+    });
+  }
+});
+
 // dist/config/schemas/media.js
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 var mediaSchema3;
 var init_media3 = __esm({
   "dist/config/schemas/media.js"() {
     "use strict";
     init_collection3();
-    mediaSchema3 = z11.discriminatedUnion("adapter", [
-      z11.object({
-        adapter: z11.literal("local"),
-        publicBaseUrl: z11.string().url().optional(),
+    init_url3();
+    mediaSchema3 = z13.discriminatedUnion("adapter", [
+      z13.object({
+        adapter: z13.literal("local"),
+        publicBaseUrl: assetMountUrlSchema3.optional(),
         /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
         directory: relativePathSchema3.optional()
-      }),
-      z11.object({
-        adapter: z11.literal("s3"),
-        bucket: z11.string().min(1),
-        region: z11.string().min(1),
-        publicBaseUrl: z11.string().url().optional(),
+      }).strict(),
+      z13.object({
+        adapter: z13.literal("s3"),
+        bucket: z13.string().min(1),
+        region: z13.string().min(1),
+        publicBaseUrl: assetMountUrlSchema3.optional(),
+        /**
+         * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
+         * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
+         *
+         * Set this to route uploads through your own CDN so they are same-origin with the
+         * editor, which removes the need for a bucket CORS rule naming an exact origin. The
+         * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
+         * alone, so the host never enters it (pinned by store-s3.test.ts).
+         *
+         * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
+         * the POST target outright and is passed through byte-for-byte. Do not route it through
+         * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
+         * stop a CDN path pattern like `/asset-upload/*` from matching.
+         */
+        uploadUrl: uploadTargetUrlSchema3.optional(),
         /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
-        maxUploadBytes: z11.number().int().positive().optional()
-      }),
-      z11.object({
-        adapter: z11.literal("lfs"),
-        publicBaseUrl: z11.string().url().optional()
-      })
+        maxUploadBytes: z13.number().int().positive().optional()
+      }).strict(),
+      z13.object({
+        adapter: z13.literal("lfs"),
+        publicBaseUrl: assetMountUrlSchema3.optional()
+      }).strict()
     ]);
   }
 });
 
 // dist/config/schemas/config.js
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 var defaultBranchAccessSchema3, defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, basePathSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
 var init_config4 = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection3();
     init_media3();
-    defaultBranchAccessSchema3 = z12.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessLevelSchema3 = z12.enum(["allow", "deny"]);
-    defaultPathAccessLevelsSchema3 = z12.object({
+    defaultBranchAccessSchema3 = z14.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema3 = z14.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema3 = z14.object({
       read: defaultPathAccessLevelSchema3.optional(),
       edit: defaultPathAccessLevelSchema3.optional(),
       review: defaultPathAccessLevelSchema3.optional()
     }).strict();
-    defaultPathAccessSchema3 = z12.union([defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3]).default("deny");
-    defaultBaseBranchSchema3 = z12.string().default("main");
-    defaultRemoteNameSchema3 = z12.string().default("origin");
-    defaultRemoteUrlSchema3 = z12.string().min(1);
-    gitBotAuthorNameSchema3 = z12.string().min(1);
-    gitBotAuthorEmailSchema3 = z12.string().email();
-    githubTokenEnvVarSchema3 = z12.string().default("GITHUB_BOT_TOKEN");
-    operatingModeSchema3 = z12.enum(["prod", "dev"]);
-    deployedAsSchema3 = z12.enum(["static", "server"]).default("server");
+    defaultPathAccessSchema3 = z14.union([defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3]).default("deny");
+    defaultBaseBranchSchema3 = z14.string().default("main");
+    defaultRemoteNameSchema3 = z14.string().default("origin");
+    defaultRemoteUrlSchema3 = z14.string().min(1);
+    gitBotAuthorNameSchema3 = z14.string().min(1);
+    gitBotAuthorEmailSchema3 = z14.string().email();
+    githubTokenEnvVarSchema3 = z14.string().default("GITHUB_BOT_TOKEN");
+    operatingModeSchema3 = z14.enum(["prod", "dev"]);
+    deployedAsSchema3 = z14.enum(["static", "server"]).default("server");
     contentRootSchema3 = relativePathSchema3.default("content");
-    sourceRootSchema3 = z12.string().min(1).optional();
-    basePathSchema3 = z12.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
+    sourceRootSchema3 = z14.string().min(1).optional();
+    basePathSchema3 = z14.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
       message: "basePath must not be empty or only whitespace"
     }).optional();
-    deploymentNameSchema3 = z12.string().default("prod");
-    devContentSyncSchema3 = z12.enum(["off", "warn"]).default("warn");
-    devConfigSchema3 = z12.object({
+    deploymentNameSchema3 = z14.string().default("prod");
+    devContentSyncSchema3 = z14.enum(["off", "warn"]).default("warn");
+    devConfigSchema3 = z14.object({
       contentSync: devContentSyncSchema3.optional()
     });
-    editorConfigSchema3 = z12.object({
-      title: z12.string().optional(),
-      subtitle: z12.string().optional(),
-      theme: z12.unknown().optional(),
-      previewBase: z12.record(z12.string()).optional(),
+    editorConfigSchema3 = z14.object({
+      title: z14.string().optional(),
+      subtitle: z14.string().optional(),
+      theme: z14.unknown().optional(),
+      previewBase: z14.record(z14.string()).optional(),
       // UI handler functions (runtime only, don't serialize)
-      onAccountClick: z12.function().returns(z12.void()).optional(),
-      onLogoutClick: z12.function().returns(z12.void()).optional(),
+      onAccountClick: z14.function().returns(z14.void()).optional(),
+      onLogoutClick: z14.function().returns(z14.void()).optional(),
       // Optional: custom account component (e.g., Clerk's UserButton)
-      AccountComponent: z12.custom().optional()
+      AccountComponent: z14.custom().optional()
     });
-    CanopyConfigSchema3 = z12.object({
+    CanopyConfigSchema3 = z14.object({
       media: mediaSchema3.optional(),
       // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
       // have .default('deny'), so the field is optional on input but always resolves to
@@ -9483,7 +9721,7 @@ var init_config4 = __esm({
       // unset must stay undefined after parsing so dev mode can detect the fork
       // point from git HEAD (see resolveBaseBranch in utils/git.ts).
       defaultBaseBranch: defaultBaseBranchSchema3.optional(),
-      defaultActiveBranch: z12.string().min(1).optional(),
+      defaultActiveBranch: z14.string().min(1).optional(),
       defaultRemoteName: defaultRemoteNameSchema3.optional(),
       defaultRemoteUrl: defaultRemoteUrlSchema3.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema3,
@@ -9497,9 +9735,9 @@ var init_config4 = __esm({
       // Escape hatch for prod hosts that genuinely have internet access and intentionally
       // run git against a network remote (see GitManager.resolveRemoteUrl's prod-mode guard).
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
-      allowNetworkRemoteInProd: z12.boolean().optional(),
-      settingsBranch: z12.string().optional(),
-      autoCreateSettingsPR: z12.boolean().optional(),
+      allowNetworkRemoteInProd: z14.boolean().optional(),
+      settingsBranch: z14.string().optional(),
+      autoCreateSettingsPR: z14.boolean().optional(),
       // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
       // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
       // the literal 'prod' instead of staying `undefined` — collapsing the
@@ -9515,9 +9753,9 @@ var init_config4 = __esm({
       sourceRoot: sourceRootSchema3.optional(),
       basePath: basePathSchema3,
       editor: editorConfigSchema3.optional(),
-      authPlugin: z12.custom().optional(),
-      entryLinkUrl: z12.custom().optional(),
-      validateEntry: z12.custom().optional(),
+      authPlugin: z14.custom().optional(),
+      entryLinkUrl: z14.custom().optional(),
+      validateEntry: z14.custom().optional(),
       dev: devConfigSchema3.optional()
     }).strict();
     DEFAULT_PROD_WORKSPACE3 = "/mnt/efs/workspace";
@@ -9865,17 +10103,17 @@ var init_deployment_name2 = __esm({
 });
 
 // dist/config/schemas/permissions.js
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var permissionTargetSchema3, pathPermissionSchema3;
 var init_permissions3 = __esm({
   "dist/config/schemas/permissions.js"() {
     "use strict";
-    permissionTargetSchema3 = z13.object({
-      allowedUsers: z13.array(z13.string()).optional(),
-      allowedGroups: z13.array(z13.string()).optional()
+    permissionTargetSchema3 = z15.object({
+      allowedUsers: z15.array(z15.string()).optional(),
+      allowedGroups: z15.array(z15.string()).optional()
     });
-    pathPermissionSchema3 = z13.object({
-      path: z13.string().min(1),
+    pathPermissionSchema3 = z15.object({
+      path: z15.string().min(1),
       read: permissionTargetSchema3.optional(),
       edit: permissionTargetSchema3.optional(),
       review: permissionTargetSchema3.optional()