canopycms 0.0.66-int.85 → 0.0.66

package/dist/cli/generate-ai-content.js

@@ -23,6 +23,57 @@ var init_logger = __esm({
   }
 });
 
+// dist/utils/sanitize-href.js
+function declaresScheme(url) {
+  return /^[a-z][a-z0-9+.-]*:/i.test(url.trim());
+}
+function isImplicitlyOffOrigin(url) {
+  if (declaresScheme(url))
+    return false;
+  try {
+    return new URL(url, SENTINEL_BASE).origin !== SENTINEL_BASE;
+  } catch {
+    return false;
+  }
+}
+function isHttpUrlOrSameOriginPath(value, opts = {}) {
+  if (value === "")
+    return false;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 32 || code === 127)
+      return false;
+  }
+  if (value.includes("?") || value.includes("#"))
+    return false;
+  if (value.includes("\\"))
+    return false;
+  if (DOT_SEGMENT.test(value))
+    return false;
+  if (declaresScheme(value)) {
+    if (!/^https?:\/\//i.test(value))
+      return false;
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (isImplicitlyOffOrigin(value)) {
+    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
+  }
+  return value.startsWith("/") && value[1] !== "/";
+}
+var SENTINEL_BASE, DOT_SEGMENT;
+var init_sanitize_href = __esm({
+  "dist/utils/sanitize-href.js"() {
+    "use strict";
+    SENTINEL_BASE = "https://relative.invalid";
+    DOT_SEGMENT = /(^|\/)(\.|%2e){1,2}(\/|$)/i;
+  }
+});
+
 // dist/paths/normalize.js
 function normalizeFilesystemPath(path22) {
   return path22.split(/[\\/]+/).filter(Boolean).join("/");
@@ -322,82 +373,114 @@ var init_collection = __esm({
   }
 });
 
-// dist/config/schemas/media.js
+// dist/config/schemas/url.js
 import { z as z4 } from "zod";
+var uploadTargetUrlSchema, assetMountUrlSchema;
+var init_url = __esm({
+  "dist/config/schemas/url.js"() {
+    "use strict";
+    init_sanitize_href();
+    uploadTargetUrlSchema = z4.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+      message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+    });
+    assetMountUrlSchema = z4.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
+      message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
+    });
+  }
+});
+
+// dist/config/schemas/media.js
+import { z as z5 } from "zod";
 var mediaSchema;
 var init_media = __esm({
   "dist/config/schemas/media.js"() {
     "use strict";
     init_collection();
-    mediaSchema = z4.discriminatedUnion("adapter", [
-      z4.object({
-        adapter: z4.literal("local"),
-        publicBaseUrl: z4.string().url().optional(),
+    init_url();
+    mediaSchema = z5.discriminatedUnion("adapter", [
+      z5.object({
+        adapter: z5.literal("local"),
+        publicBaseUrl: assetMountUrlSchema.optional(),
         /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
         directory: relativePathSchema.optional()
-      }),
-      z4.object({
-        adapter: z4.literal("s3"),
-        bucket: z4.string().min(1),
-        region: z4.string().min(1),
-        publicBaseUrl: z4.string().url().optional(),
+      }).strict(),
+      z5.object({
+        adapter: z5.literal("s3"),
+        bucket: z5.string().min(1),
+        region: z5.string().min(1),
+        publicBaseUrl: assetMountUrlSchema.optional(),
+        /**
+         * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
+         * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
+         *
+         * Set this to route uploads through your own CDN so they are same-origin with the
+         * editor, which removes the need for a bucket CORS rule naming an exact origin. The
+         * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
+         * alone, so the host never enters it (pinned by store-s3.test.ts).
+         *
+         * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
+         * the POST target outright and is passed through byte-for-byte. Do not route it through
+         * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
+         * stop a CDN path pattern like `/asset-upload/*` from matching.
+         */
+        uploadUrl: uploadTargetUrlSchema.optional(),
         /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
-        maxUploadBytes: z4.number().int().positive().optional()
-      }),
-      z4.object({
-        adapter: z4.literal("lfs"),
-        publicBaseUrl: z4.string().url().optional()
-      })
+        maxUploadBytes: z5.number().int().positive().optional()
+      }).strict(),
+      z5.object({
+        adapter: z5.literal("lfs"),
+        publicBaseUrl: assetMountUrlSchema.optional()
+      }).strict()
     ]);
   }
 });
 
 // dist/config/schemas/config.js
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE;
 var init_config = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection();
     init_media();
-    defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessLevelSchema = z5.enum(["allow", "deny"]);
-    defaultPathAccessLevelsSchema = z5.object({
+    defaultBranchAccessSchema = z6.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema = z6.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema = z6.object({
       read: defaultPathAccessLevelSchema.optional(),
       edit: defaultPathAccessLevelSchema.optional(),
       review: defaultPathAccessLevelSchema.optional()
     }).strict();
-    defaultPathAccessSchema = z5.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
-    defaultBaseBranchSchema = z5.string().default("main");
-    defaultRemoteNameSchema = z5.string().default("origin");
-    defaultRemoteUrlSchema = z5.string().min(1);
-    gitBotAuthorNameSchema = z5.string().min(1);
-    gitBotAuthorEmailSchema = z5.string().email();
-    githubTokenEnvVarSchema = z5.string().default("GITHUB_BOT_TOKEN");
-    operatingModeSchema = z5.enum(["prod", "dev"]);
-    deployedAsSchema = z5.enum(["static", "server"]).default("server");
+    defaultPathAccessSchema = z6.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
+    defaultBaseBranchSchema = z6.string().default("main");
+    defaultRemoteNameSchema = z6.string().default("origin");
+    defaultRemoteUrlSchema = z6.string().min(1);
+    gitBotAuthorNameSchema = z6.string().min(1);
+    gitBotAuthorEmailSchema = z6.string().email();
+    githubTokenEnvVarSchema = z6.string().default("GITHUB_BOT_TOKEN");
+    operatingModeSchema = z6.enum(["prod", "dev"]);
+    deployedAsSchema = z6.enum(["static", "server"]).default("server");
     contentRootSchema = relativePathSchema.default("content");
-    sourceRootSchema = z5.string().min(1).optional();
-    basePathSchema = z5.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
+    sourceRootSchema = z6.string().min(1).optional();
+    basePathSchema = z6.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
       message: "basePath must not be empty or only whitespace"
     }).optional();
-    deploymentNameSchema = z5.string().default("prod");
-    devContentSyncSchema = z5.enum(["off", "warn"]).default("warn");
-    devConfigSchema = z5.object({
+    deploymentNameSchema = z6.string().default("prod");
+    devContentSyncSchema = z6.enum(["off", "warn"]).default("warn");
+    devConfigSchema = z6.object({
       contentSync: devContentSyncSchema.optional()
     });
-    editorConfigSchema = z5.object({
-      title: z5.string().optional(),
-      subtitle: z5.string().optional(),
-      theme: z5.unknown().optional(),
-      previewBase: z5.record(z5.string()).optional(),
+    editorConfigSchema = z6.object({
+      title: z6.string().optional(),
+      subtitle: z6.string().optional(),
+      theme: z6.unknown().optional(),
+      previewBase: z6.record(z6.string()).optional(),
       // UI handler functions (runtime only, don't serialize)
-      onAccountClick: z5.function().returns(z5.void()).optional(),
-      onLogoutClick: z5.function().returns(z5.void()).optional(),
+      onAccountClick: z6.function().returns(z6.void()).optional(),
+      onLogoutClick: z6.function().returns(z6.void()).optional(),
       // Optional: custom account component (e.g., Clerk's UserButton)
-      AccountComponent: z5.custom().optional()
+      AccountComponent: z6.custom().optional()
     });
-    CanopyConfigSchema = z5.object({
+    CanopyConfigSchema = z6.object({
       media: mediaSchema.optional(),
       // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
       // have .default('deny'), so the field is optional on input but always resolves to
@@ -413,7 +496,7 @@ var init_config = __esm({
       // unset must stay undefined after parsing so dev mode can detect the fork
       // point from git HEAD (see resolveBaseBranch in utils/git.ts).
       defaultBaseBranch: defaultBaseBranchSchema.optional(),
-      defaultActiveBranch: z5.string().min(1).optional(),
+      defaultActiveBranch: z6.string().min(1).optional(),
       defaultRemoteName: defaultRemoteNameSchema.optional(),
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
@@ -427,9 +510,9 @@ var init_config = __esm({
       // Escape hatch for prod hosts that genuinely have internet access and intentionally
       // run git against a network remote (see GitManager.resolveRemoteUrl's prod-mode guard).
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
-      allowNetworkRemoteInProd: z5.boolean().optional(),
-      settingsBranch: z5.string().optional(),
-      autoCreateSettingsPR: z5.boolean().optional(),
+      allowNetworkRemoteInProd: z6.boolean().optional(),
+      settingsBranch: z6.string().optional(),
+      autoCreateSettingsPR: z6.boolean().optional(),
       // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
       // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
       // the literal 'prod' instead of staying `undefined` — collapsing the
@@ -445,9 +528,9 @@ var init_config = __esm({
       sourceRoot: sourceRootSchema.optional(),
       basePath: basePathSchema,
       editor: editorConfigSchema.optional(),
-      authPlugin: z5.custom().optional(),
-      entryLinkUrl: z5.custom().optional(),
-      validateEntry: z5.custom().optional(),
+      authPlugin: z6.custom().optional(),
+      entryLinkUrl: z6.custom().optional(),
+      validateEntry: z6.custom().optional(),
       dev: devConfigSchema.optional()
     }).strict();
     DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
@@ -638,17 +721,17 @@ var init_deployment_name = __esm({
 });
 
 // dist/config/schemas/permissions.js
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var permissionTargetSchema, pathPermissionSchema;
 var init_permissions = __esm({
   "dist/config/schemas/permissions.js"() {
     "use strict";
-    permissionTargetSchema = z6.object({
-      allowedUsers: z6.array(z6.string()).optional(),
-      allowedGroups: z6.array(z6.string()).optional()
+    permissionTargetSchema = z7.object({
+      allowedUsers: z7.array(z7.string()).optional(),
+      allowedGroups: z7.array(z7.string()).optional()
     });
-    pathPermissionSchema = z6.object({
-      path: z6.string().min(1),
+    pathPermissionSchema = z7.object({
+      path: z7.string().min(1),
       read: permissionTargetSchema.optional(),
       edit: permissionTargetSchema.optional(),
       review: permissionTargetSchema.optional()
@@ -1257,6 +1340,9 @@ function findBodyFieldName(fields) {
   return "body";
 }
 
+// dist/utils/url-prefix.js
+init_sanitize_href();
+
 // dist/static/seo.js
 var DEFAULT_SEO_FIELD_NAMES = {
   title: "metaTitle",

package/dist/cli/init.js

@@ -178,82 +178,165 @@ var init_collection = __esm({
   }
 });
 
-// dist/config/schemas/media.js
+// dist/utils/sanitize-href.js
+function declaresScheme(url) {
+  return /^[a-z][a-z0-9+.-]*:/i.test(url.trim());
+}
+function isImplicitlyOffOrigin(url) {
+  if (declaresScheme(url))
+    return false;
+  try {
+    return new URL(url, SENTINEL_BASE).origin !== SENTINEL_BASE;
+  } catch {
+    return false;
+  }
+}
+function isHttpUrlOrSameOriginPath(value, opts = {}) {
+  if (value === "")
+    return false;
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code <= 32 || code === 127)
+      return false;
+  }
+  if (value.includes("?") || value.includes("#"))
+    return false;
+  if (value.includes("\\"))
+    return false;
+  if (DOT_SEGMENT.test(value))
+    return false;
+  if (declaresScheme(value)) {
+    if (!/^https?:\/\//i.test(value))
+      return false;
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (isImplicitlyOffOrigin(value)) {
+    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
+  }
+  return value.startsWith("/") && value[1] !== "/";
+}
+var SENTINEL_BASE, DOT_SEGMENT;
+var init_sanitize_href = __esm({
+  "dist/utils/sanitize-href.js"() {
+    "use strict";
+    SENTINEL_BASE = "https://relative.invalid";
+    DOT_SEGMENT = /(^|\/)(\.|%2e){1,2}(\/|$)/i;
+  }
+});
+
+// dist/config/schemas/url.js
 import { z as z3 } from "zod";
+var uploadTargetUrlSchema, assetMountUrlSchema;
+var init_url = __esm({
+  "dist/config/schemas/url.js"() {
+    "use strict";
+    init_sanitize_href();
+    uploadTargetUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+      message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+    });
+    assetMountUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
+      message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
+    });
+  }
+});
+
+// dist/config/schemas/media.js
+import { z as z4 } from "zod";
 var mediaSchema;
 var init_media = __esm({
   "dist/config/schemas/media.js"() {
     "use strict";
     init_collection();
-    mediaSchema = z3.discriminatedUnion("adapter", [
-      z3.object({
-        adapter: z3.literal("local"),
-        publicBaseUrl: z3.string().url().optional(),
+    init_url();
+    mediaSchema = z4.discriminatedUnion("adapter", [
+      z4.object({
+        adapter: z4.literal("local"),
+        publicBaseUrl: assetMountUrlSchema.optional(),
         /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
         directory: relativePathSchema.optional()
-      }),
-      z3.object({
-        adapter: z3.literal("s3"),
-        bucket: z3.string().min(1),
-        region: z3.string().min(1),
-        publicBaseUrl: z3.string().url().optional(),
+      }).strict(),
+      z4.object({
+        adapter: z4.literal("s3"),
+        bucket: z4.string().min(1),
+        region: z4.string().min(1),
+        publicBaseUrl: assetMountUrlSchema.optional(),
+        /**
+         * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
+         * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
+         *
+         * Set this to route uploads through your own CDN so they are same-origin with the
+         * editor, which removes the need for a bucket CORS rule naming an exact origin. The
+         * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
+         * alone, so the host never enters it (pinned by store-s3.test.ts).
+         *
+         * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
+         * the POST target outright and is passed through byte-for-byte. Do not route it through
+         * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
+         * stop a CDN path pattern like `/asset-upload/*` from matching.
+         */
+        uploadUrl: uploadTargetUrlSchema.optional(),
         /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
-        maxUploadBytes: z3.number().int().positive().optional()
-      }),
-      z3.object({
-        adapter: z3.literal("lfs"),
-        publicBaseUrl: z3.string().url().optional()
-      })
+        maxUploadBytes: z4.number().int().positive().optional()
+      }).strict(),
+      z4.object({
+        adapter: z4.literal("lfs"),
+        publicBaseUrl: assetMountUrlSchema.optional()
+      }).strict()
     ]);
   }
 });
 
 // dist/config/schemas/config.js
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE;
 var init_config = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection();
     init_media();
-    defaultBranchAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessLevelSchema = z4.enum(["allow", "deny"]);
-    defaultPathAccessLevelsSchema = z4.object({
+    defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema = z5.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema = z5.object({
       read: defaultPathAccessLevelSchema.optional(),
       edit: defaultPathAccessLevelSchema.optional(),
       review: defaultPathAccessLevelSchema.optional()
     }).strict();
-    defaultPathAccessSchema = z4.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
-    defaultBaseBranchSchema = z4.string().default("main");
-    defaultRemoteNameSchema = z4.string().default("origin");
-    defaultRemoteUrlSchema = z4.string().min(1);
-    gitBotAuthorNameSchema = z4.string().min(1);
-    gitBotAuthorEmailSchema = z4.string().email();
-    githubTokenEnvVarSchema = z4.string().default("GITHUB_BOT_TOKEN");
-    operatingModeSchema = z4.enum(["prod", "dev"]);
-    deployedAsSchema = z4.enum(["static", "server"]).default("server");
+    defaultPathAccessSchema = z5.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
+    defaultBaseBranchSchema = z5.string().default("main");
+    defaultRemoteNameSchema = z5.string().default("origin");
+    defaultRemoteUrlSchema = z5.string().min(1);
+    gitBotAuthorNameSchema = z5.string().min(1);
+    gitBotAuthorEmailSchema = z5.string().email();
+    githubTokenEnvVarSchema = z5.string().default("GITHUB_BOT_TOKEN");
+    operatingModeSchema = z5.enum(["prod", "dev"]);
+    deployedAsSchema = z5.enum(["static", "server"]).default("server");
     contentRootSchema = relativePathSchema.default("content");
-    sourceRootSchema = z4.string().min(1).optional();
-    basePathSchema = z4.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
+    sourceRootSchema = z5.string().min(1).optional();
+    basePathSchema = z5.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
       message: "basePath must not be empty or only whitespace"
     }).optional();
-    deploymentNameSchema = z4.string().default("prod");
-    devContentSyncSchema = z4.enum(["off", "warn"]).default("warn");
-    devConfigSchema = z4.object({
+    deploymentNameSchema = z5.string().default("prod");
+    devContentSyncSchema = z5.enum(["off", "warn"]).default("warn");
+    devConfigSchema = z5.object({
       contentSync: devContentSyncSchema.optional()
     });
-    editorConfigSchema = z4.object({
-      title: z4.string().optional(),
-      subtitle: z4.string().optional(),
-      theme: z4.unknown().optional(),
-      previewBase: z4.record(z4.string()).optional(),
+    editorConfigSchema = z5.object({
+      title: z5.string().optional(),
+      subtitle: z5.string().optional(),
+      theme: z5.unknown().optional(),
+      previewBase: z5.record(z5.string()).optional(),
       // UI handler functions (runtime only, don't serialize)
-      onAccountClick: z4.function().returns(z4.void()).optional(),
-      onLogoutClick: z4.function().returns(z4.void()).optional(),
+      onAccountClick: z5.function().returns(z5.void()).optional(),
+      onLogoutClick: z5.function().returns(z5.void()).optional(),
       // Optional: custom account component (e.g., Clerk's UserButton)
-      AccountComponent: z4.custom().optional()
+      AccountComponent: z5.custom().optional()
     });
-    CanopyConfigSchema = z4.object({
+    CanopyConfigSchema = z5.object({
       media: mediaSchema.optional(),
       // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
       // have .default('deny'), so the field is optional on input but always resolves to
@@ -269,7 +352,7 @@ var init_config = __esm({
       // unset must stay undefined after parsing so dev mode can detect the fork
       // point from git HEAD (see resolveBaseBranch in utils/git.ts).
       defaultBaseBranch: defaultBaseBranchSchema.optional(),
-      defaultActiveBranch: z4.string().min(1).optional(),
+      defaultActiveBranch: z5.string().min(1).optional(),
       defaultRemoteName: defaultRemoteNameSchema.optional(),
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
@@ -283,9 +366,9 @@ var init_config = __esm({
       // Escape hatch for prod hosts that genuinely have internet access and intentionally
       // run git against a network remote (see GitManager.resolveRemoteUrl's prod-mode guard).
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
-      allowNetworkRemoteInProd: z4.boolean().optional(),
-      settingsBranch: z4.string().optional(),
-      autoCreateSettingsPR: z4.boolean().optional(),
+      allowNetworkRemoteInProd: z5.boolean().optional(),
+      settingsBranch: z5.string().optional(),
+      autoCreateSettingsPR: z5.boolean().optional(),
       // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
       // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
       // the literal 'prod' instead of staying `undefined` — collapsing the
@@ -301,9 +384,9 @@ var init_config = __esm({
       sourceRoot: sourceRootSchema.optional(),
       basePath: basePathSchema,
       editor: editorConfigSchema.optional(),
-      authPlugin: z4.custom().optional(),
-      entryLinkUrl: z4.custom().optional(),
-      validateEntry: z4.custom().optional(),
+      authPlugin: z5.custom().optional(),
+      entryLinkUrl: z5.custom().optional(),
+      validateEntry: z5.custom().optional(),
       dev: devConfigSchema.optional()
     }).strict();
     DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
@@ -311,17 +394,17 @@ var init_config = __esm({
 });
 
 // dist/config/schemas/permissions.js
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var permissionTargetSchema, pathPermissionSchema;
 var init_permissions = __esm({
   "dist/config/schemas/permissions.js"() {
     "use strict";
-    permissionTargetSchema = z5.object({
-      allowedUsers: z5.array(z5.string()).optional(),
-      allowedGroups: z5.array(z5.string()).optional()
+    permissionTargetSchema = z6.object({
+      allowedUsers: z6.array(z6.string()).optional(),
+      allowedGroups: z6.array(z6.string()).optional()
     });
-    pathPermissionSchema = z5.object({
-      path: z5.string().min(1),
+    pathPermissionSchema = z6.object({
+      path: z6.string().min(1),
       read: permissionTargetSchema.optional(),
       edit: permissionTargetSchema.optional(),
       review: permissionTargetSchema.optional()

package/dist/cli/template-files/cms-stack.ts.template

@@ -140,10 +140,13 @@ export class CmsStack extends Stack {
     //      hand-written `additionalBehaviors` ever gets that order wrong
     //      instead.
     //
-    // `editorOrigins` is REQUIRED: it is the S3 CORS allowlist for the
-    // editor's presigned uploads, so it must list the origin the editor is
-    // served from. Include http://localhost:3000 only if you upload from a
-    // local dev editor against this bucket.
+    // `editorOrigins` is the S3 CORS allowlist for the editor's presigned
+    // uploads, so it must list the origin the editor is served from. Include
+    // http://localhost:3000 only if you upload from a local dev editor
+    // against this bucket. It is optional only because `uploadBehavior` is
+    // the other way to satisfy the same requirement (CORS supplied at the
+    // CloudFront edge instead); with neither, a construct-created bucket
+    // refuses to synth.
     //
     // Run `pnpm --filter canopycms-cdk run build:lambda` before deploying --
     // the transform Lambda needs its native sharp binary, and the construct

package/dist/config/schemas/config.d.ts

@@ -81,9 +81,9 @@ export declare const editorConfigSchema: z.ZodObject<{
 export declare const CanopyConfigSchema: z.ZodObject<{
     media: z.ZodOptional<z.ZodDiscriminatedUnion<"adapter", [z.ZodObject<{
         adapter: z.ZodLiteral<"local">;
-        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         directory: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>;
-    }, "strip", z.ZodTypeAny, {
+    }, "strict", z.ZodTypeAny, {
         adapter: "local";
         publicBaseUrl?: string | undefined;
         directory?: string | undefined;
@@ -95,24 +95,27 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         adapter: z.ZodLiteral<"s3">;
         bucket: z.ZodString;
         region: z.ZodString;
-        publicBaseUrl: z.ZodOptional<z.ZodString>;
+        publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        uploadUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         maxUploadBytes: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
+    }, "strict", z.ZodTypeAny, {
         adapter: "s3";
         bucket: string;
         region: string;
         publicBaseUrl?: string | undefined;
+        uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     }, {
         adapter: "s3";
         bucket: string;
         region: string;
         publicBaseUrl?: string | undefined;
+        uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     }>, z.ZodObject<{
         adapter: z.ZodLiteral<"lfs">;
-        publicBaseUrl: z.ZodOptional<z.ZodString>;
-    }, "strip", z.ZodTypeAny, {
+        publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    }, "strict", z.ZodTypeAny, {
         adapter: "lfs";
         publicBaseUrl?: string | undefined;
     }, {
@@ -209,6 +212,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         bucket: string;
         region: string;
         publicBaseUrl?: string | undefined;
+        uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     } | {
         adapter: "lfs";
@@ -253,6 +257,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         bucket: string;
         region: string;
         publicBaseUrl?: string | undefined;
+        uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     } | {
         adapter: "lfs";