canopycms 0.0.66-int.85 → 0.0.66

package/dist/config/schemas/media.d.ts

@@ -4,10 +4,10 @@
 import { z } from 'zod';
 export declare const mediaSchema: z.ZodDiscriminatedUnion<"adapter", [z.ZodObject<{
     adapter: z.ZodLiteral<"local">;
-    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
     directory: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>;
-}, "strip", z.ZodTypeAny, {
+}, "strict", z.ZodTypeAny, {
     adapter: "local";
     publicBaseUrl?: string | undefined;
     directory?: string | undefined;
@@ -19,25 +19,42 @@ export declare const mediaSchema: z.ZodDiscriminatedUnion<"adapter", [z.ZodObjec
     adapter: z.ZodLiteral<"s3">;
     bucket: z.ZodString;
     region: z.ZodString;
-    publicBaseUrl: z.ZodOptional<z.ZodString>;
+    publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /**
+     * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
+     * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
+     *
+     * Set this to route uploads through your own CDN so they are same-origin with the
+     * editor, which removes the need for a bucket CORS rule naming an exact origin. The
+     * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
+     * alone, so the host never enters it (pinned by store-s3.test.ts).
+     *
+     * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
+     * the POST target outright and is passed through byte-for-byte. Do not route it through
+     * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
+     * stop a CDN path pattern like `/asset-upload/*` from matching.
+     */
+    uploadUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
     maxUploadBytes: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
+}, "strict", z.ZodTypeAny, {
     adapter: "s3";
     bucket: string;
     region: string;
     publicBaseUrl?: string | undefined;
+    uploadUrl?: string | undefined;
     maxUploadBytes?: number | undefined;
 }, {
     adapter: "s3";
     bucket: string;
     region: string;
     publicBaseUrl?: string | undefined;
+    uploadUrl?: string | undefined;
     maxUploadBytes?: number | undefined;
 }>, z.ZodObject<{
     adapter: z.ZodLiteral<"lfs">;
-    publicBaseUrl: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
+    publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strict", z.ZodTypeAny, {
     adapter: "lfs";
     publicBaseUrl?: string | undefined;
 }, {

package/dist/config/schemas/media.js

@@ -3,6 +3,7 @@
  */
 import { z } from 'zod';
 import { relativePathSchema } from './collection.js';
+import { assetMountUrlSchema, uploadTargetUrlSchema } from './url.js';
 // Media adapter configuration schema.
 // Keyed as a discriminated union on `adapter` so each adapter's required fields are
 // enforced at parse time. With a plain z.union, a malformed s3 config (e.g. missing
@@ -14,23 +15,51 @@ import { relativePathSchema } from './collection.js';
 // Bucket-prefix layout (asset-originals/, asset-staging/, asset-meta/, assets/) is
 // intentionally NOT configurable here — those are constants in assets/keys.ts, not
 // per-site config (see .claude/future-tasks/assets-media-system.md).
+//
+// Every branch is .strict(). This is load-bearing, not tidiness: CanopyConfigSchema's own
+// .strict() does NOT recurse into nested schemas, so until these branches carried their own,
+// `media: { adapter: 's3', …, uploadURL: '/x' }` parsed successfully with the misspelled key
+// silently stripped — and the adopter got the raw S3 endpoint back with no diagnostic
+// anywhere. A config field whose whole purpose is to fail loudly at parse time cannot sit in
+// a container that swallows typos.
 export const mediaSchema = z.discriminatedUnion('adapter', [
-    z.object({
+    z
+        .object({
         adapter: z.literal('local'),
-        publicBaseUrl: z.string().url().optional(),
+        publicBaseUrl: assetMountUrlSchema.optional(),
         /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
         directory: relativePathSchema.optional(),
-    }),
-    z.object({
+    })
+        .strict(),
+    z
+        .object({
         adapter: z.literal('s3'),
         bucket: z.string().min(1),
         region: z.string().min(1),
-        publicBaseUrl: z.string().url().optional(),
+        publicBaseUrl: assetMountUrlSchema.optional(),
+        /**
+         * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
+         * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
+         *
+         * Set this to route uploads through your own CDN so they are same-origin with the
+         * editor, which removes the need for a bucket CORS rule naming an exact origin. The
+         * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
+         * alone, so the host never enters it (pinned by store-s3.test.ts).
+         *
+         * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
+         * the POST target outright and is passed through byte-for-byte. Do not route it through
+         * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
+         * stop a CDN path pattern like `/asset-upload/*` from matching.
+         */
+        uploadUrl: uploadTargetUrlSchema.optional(),
         /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
         maxUploadBytes: z.number().int().positive().optional(),
-    }),
-    z.object({
+    })
+        .strict(),
+    z
+        .object({
         adapter: z.literal('lfs'),
-        publicBaseUrl: z.string().url().optional(),
-    }),
+        publicBaseUrl: assetMountUrlSchema.optional(),
+    })
+        .strict(),
 ]);

package/dist/config/schemas/url.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Zod schemas for adopter-configured URL values.
+ *
+ * Deliberately a separate file rather than an addition to `config.ts`: `config.ts` already
+ * imports `media.ts`, and `media.ts` needs these, so defining them there would close a cycle
+ * that `.dependency-cruiser.mjs`'s `no-circular` rule fails the build on.
+ *
+ * These are thin wrappers. The rule itself lives in `utils/sanitize-href.ts` alongside the
+ * package's only other http(s) allowlist, so config validation and content sanitization cannot
+ * drift into disagreeing about which URLs are acceptable.
+ */
+import { z } from 'zod';
+/**
+ * Where the browser POSTs a presigned direct upload (`media.uploadUrl`).
+ *
+ * Stricter than `assetMountUrlSchema` by exactly one case — no protocol-relative `//host` —
+ * because that spelling is ambiguous rather than insecure: it resolves to http or https
+ * depending on the editor page issuing the upload, so the config would not determine where a
+ * live credential is sent. `isHttpUrlOrSameOriginPath`'s doc carries the full reasoning,
+ * including why bare `http://` is nonetheless accepted.
+ *
+ * "Exactly one case" is measured, not asserted: a census over every 4-character string
+ * drawn from an 11-symbol alphabet (slash, backslash, dot, colon, %2e, ?, #, tab, and three
+ * letters), plus hand-written shapes, found 39 values the two schemas treat differently — and
+ * every one is a literal `//host` (three only after `.trim()` strips a leading tab).
+ */
+export declare const uploadTargetUrlSchema: z.ZodEffects<z.ZodString, string, string>;
+/**
+ * Where `/assets/…` is mounted for the editor's own previews (`media.publicBaseUrl`).
+ *
+ * Two changes from the `z.string().url()` this replaced, both deliberate. It now accepts a
+ * site-relative path, which is what `.claude/future-tasks/editor-asset-mount-topology.md`
+ * option 1 asks for — the absolute-only constraint was a validation choice, and the `basePath`
+ * fallback in `editor/context/AssetContext.tsx` exists only to work around it. And it now
+ * rejects non-http(s) schemes, which `z.string().url()` accepted: `publicBaseUrl: 'mailto:a@b.c'`
+ * used to parse and then produce `/mailto:a@b.c/assets/…` at render time.
+ */
+export declare const assetMountUrlSchema: z.ZodEffects<z.ZodString, string, string>;

package/dist/config/schemas/url.js

@@ -0,0 +1,49 @@
+/**
+ * Zod schemas for adopter-configured URL values.
+ *
+ * Deliberately a separate file rather than an addition to `config.ts`: `config.ts` already
+ * imports `media.ts`, and `media.ts` needs these, so defining them there would close a cycle
+ * that `.dependency-cruiser.mjs`'s `no-circular` rule fails the build on.
+ *
+ * These are thin wrappers. The rule itself lives in `utils/sanitize-href.ts` alongside the
+ * package's only other http(s) allowlist, so config validation and content sanitization cannot
+ * drift into disagreeing about which URLs are acceptable.
+ */
+import { z } from 'zod';
+import { isHttpUrlOrSameOriginPath } from '../../utils/sanitize-href.js';
+/**
+ * Where the browser POSTs a presigned direct upload (`media.uploadUrl`).
+ *
+ * Stricter than `assetMountUrlSchema` by exactly one case — no protocol-relative `//host` —
+ * because that spelling is ambiguous rather than insecure: it resolves to http or https
+ * depending on the editor page issuing the upload, so the config would not determine where a
+ * live credential is sent. `isHttpUrlOrSameOriginPath`'s doc carries the full reasoning,
+ * including why bare `http://` is nonetheless accepted.
+ *
+ * "Exactly one case" is measured, not asserted: a census over every 4-character string
+ * drawn from an 11-symbol alphabet (slash, backslash, dot, colon, %2e, ?, #, tab, and three
+ * letters), plus hand-written shapes, found 39 values the two schemas treat differently — and
+ * every one is a literal `//host` (three only after `.trim()` strips a leading tab).
+ */
+export const uploadTargetUrlSchema = z
+    .string()
+    .trim()
+    .refine((value) => isHttpUrlOrSameOriginPath(value), {
+    message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment',
+});
+/**
+ * Where `/assets/…` is mounted for the editor's own previews (`media.publicBaseUrl`).
+ *
+ * Two changes from the `z.string().url()` this replaced, both deliberate. It now accepts a
+ * site-relative path, which is what `.claude/future-tasks/editor-asset-mount-topology.md`
+ * option 1 asks for — the absolute-only constraint was a validation choice, and the `basePath`
+ * fallback in `editor/context/AssetContext.tsx` exists only to work around it. And it now
+ * rejects non-http(s) schemes, which `z.string().url()` accepted: `publicBaseUrl: 'mailto:a@b.c'`
+ * used to parse and then produce `/mailto:a@b.c/assets/…` at render time.
+ */
+export const assetMountUrlSchema = z
+    .string()
+    .trim()
+    .refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
+    message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment',
+});

package/dist/config/types.d.ts

@@ -164,6 +164,8 @@ export type MediaConfig = {
     bucket: string;
     region: string;
     publicBaseUrl?: string;
+    /** POST target for presigned direct uploads; see mediaSchema's s3 branch. */
+    uploadUrl?: string;
     maxUploadBytes?: number;
 } | {
     adapter: 'lfs';

package/dist/editor/context/AssetContext.d.ts

@@ -27,14 +27,19 @@ export interface AssetContextProviderProps extends AssetContextValue {
 /**
  * `baseUrl` (`media.publicBaseUrl`) wins; `basePath` is the fallback.
  *
- * They are ALTERNATIVES, never composed: `publicBaseUrl` is validated absolute-only, so it names
- * another origin serving `/assets` at THAT origin's root, and a deployment `basePath` cannot apply
- * on top of it. Where the two differ is topology, not precedence - see the asset-mount table in
- * the README.
+ * They are ALTERNATIVES, never composed: whichever is used names where `/assets` is mounted, in
+ * full, and a deployment `basePath` cannot apply on top of it. Where the two differ is topology,
+ * not precedence - see the asset-mount table in the README.
  *
- * The fallback exists because `publicBaseUrl` cannot express a bare path (it is validated
- * absolute-only), so without it the editor's thumbnails, previews and crop images stay
- * root-relative on a basePath deployment where Next serves `/assets` — and 404.
+ * WHY THE FALLBACK EXISTS, AND WHY THAT REASON IS NOW GONE. It was added because
+ * `publicBaseUrl` was validated absolute-only (`z.string().url()`) and so could not express a
+ * bare path, leaving the editor's thumbnails, previews and crop images root-relative — and 404 —
+ * on a basePath deployment where Next serves `/assets`. That constraint was lifted when
+ * `publicBaseUrl` moved to `assetMountUrlSchema`, which accepts a site-relative path: an adopter
+ * can now simply set `publicBaseUrl: '/preview-123'`. The fallback is kept only so that existing
+ * basePath deployments do not break on upgrade, which makes removing it a deliberate decision
+ * rather than a cleanup - it is option 1 of
+ * `.claude/future-tasks/editor-asset-mount-topology.md`, still open.
  *
  * KNOWN LIMITATION: the fallback assumes that topology, and consults none. On a CloudFront/CDK
  * deployment a basePath does NOT move the asset space (behaviors are anchored at the distribution

package/dist/editor/context/AssetContext.js

@@ -18,14 +18,19 @@ const AssetContext = createContext({});
 /**
  * `baseUrl` (`media.publicBaseUrl`) wins; `basePath` is the fallback.
  *
- * They are ALTERNATIVES, never composed: `publicBaseUrl` is validated absolute-only, so it names
- * another origin serving `/assets` at THAT origin's root, and a deployment `basePath` cannot apply
- * on top of it. Where the two differ is topology, not precedence - see the asset-mount table in
- * the README.
+ * They are ALTERNATIVES, never composed: whichever is used names where `/assets` is mounted, in
+ * full, and a deployment `basePath` cannot apply on top of it. Where the two differ is topology,
+ * not precedence - see the asset-mount table in the README.
  *
- * The fallback exists because `publicBaseUrl` cannot express a bare path (it is validated
- * absolute-only), so without it the editor's thumbnails, previews and crop images stay
- * root-relative on a basePath deployment where Next serves `/assets` — and 404.
+ * WHY THE FALLBACK EXISTS, AND WHY THAT REASON IS NOW GONE. It was added because
+ * `publicBaseUrl` was validated absolute-only (`z.string().url()`) and so could not express a
+ * bare path, leaving the editor's thumbnails, previews and crop images root-relative — and 404 —
+ * on a basePath deployment where Next serves `/assets`. That constraint was lifted when
+ * `publicBaseUrl` moved to `assetMountUrlSchema`, which accepts a site-relative path: an adopter
+ * can now simply set `publicBaseUrl: '/preview-123'`. The fallback is kept only so that existing
+ * basePath deployments do not break on upgrade, which makes removing it a deliberate decision
+ * rather than a cleanup - it is option 1 of
+ * `.claude/future-tasks/editor-asset-mount-topology.md`, still open.
  *
  * KNOWN LIMITATION: the fallback assumes that topology, and consults none. On a CloudFront/CDK
  * deployment a basePath does NOT move the asset space (behaviors are anchored at the distribution

package/dist/utils/sanitize-href.d.ts

@@ -44,6 +44,47 @@ export declare function isImplicitlyOffOrigin(url: string): boolean;
  * same-origin string).
  */
 export declare function neutralizeImplicitOffOrigin(url: string): string;
+/**
+ * Whether `value` is usable as an adopter-CONFIGURED URL base or endpoint: an absolute
+ * `http(s)` URL, or a site-relative path with exactly one leading slash.
+ *
+ * This is the config-validation counterpart to `sanitizeHref`, which does the same job for
+ * untrusted CONTENT. The difference is what happens to a bad value: content is coerced to a
+ * fallback so a page still renders, whereas config should fail loudly at parse time — nobody
+ * is served by a silently-rewritten deployment setting. The http(s) allowlist itself lives in
+ * this file either way, so the two surfaces cannot drift into disagreeing about which schemes
+ * are acceptable (that drift is exactly why `utils/url-prefix.ts` exists — see its header).
+ *
+ * `allowProtocolRelative` exists because the two callers genuinely differ, and the difference
+ * is blast radius rather than taste:
+ *
+ * - A READ-side prefix (`media.publicBaseUrl`, joined onto `/assets/…`) may legitimately be
+ *   `//cdn.example.com`. `utils/url-prefix.ts`'s `isAbsoluteUrl` documents that literal
+ *   spelling as an intentionally-supported off-site pointer, so rejecting it here would break
+ *   a working configuration. A bad value costs a broken `<img>`.
+ * - A WRITE-side endpoint (`media.uploadUrl`, where the browser POSTs a presigned upload) must
+ *   not be protocol-relative even when spelled literally, because such a URL is AMBIGUOUS: it
+ *   resolves to http or https depending on the scheme of whichever editor page happens to
+ *   issue the upload, so the stored config does not determine where a live presigned credential
+ *   and the user's file bytes are sent. That is the same principle every other rule here
+ *   enforces — a config value must describe what actually happens.
+ *
+ *   Note this is NOT an argument that http is forbidden on the write side; bare `http://` is
+ *   accepted, because a loopback or in-cluster S3-compatible endpoint is a real need and a
+ *   browser on an https editor blocks the mixed-content request anyway, so it fails closed. The
+ *   objection to `//host` is that it is undetermined, not that it might be insecure.
+ *
+ * Every spelling that READS as site-relative while redefining the authority — `/\host`,
+ * `\\host`, `\/host`, `///host` — is rejected for both, in both modes. Those look site-relative
+ * to a human and to a naive `startsWith('/')` check, but WHATWG URL resolves each to a
+ * different authority (measured: `///x` resolves to host `x`, not to pathname `/x`), so they
+ * are never what an adopter meant. A scheme-qualified absolute URL is a separate case and is
+ * accepted — `https:///cdn.example.com/` is unusual but unambiguous, resolving identically
+ * standalone and against any base.
+ */
+export declare function isHttpUrlOrSameOriginPath(value: string, opts?: {
+    allowProtocolRelative?: boolean;
+}): boolean;
 /**
  * Sanitize an untrusted URL for use in `href` attributes.
  *

package/dist/utils/sanitize-href.js

@@ -2,6 +2,21 @@
 // fragment-only, query-only) resolve instead of throwing under `new URL()`.
 // Never exposed in output - see the relative-reference branch below.
 const SENTINEL_BASE = 'https://relative.invalid';
+/**
+ * A path segment that is exactly `.` or `..`, in any spelling a URL parser collapses.
+ *
+ * `%2e` must be covered, not just the literal dot: WHATWG's single-dot and double-dot path
+ * segment definitions are case-insensitively percent-decoded, so `/upload/%2e%2e/` collapses in
+ * a browser exactly as `/upload/../` does. A literal-only guard reads as complete and is one
+ * encoding away from useless — measured before this was widened.
+ *
+ * Bounded repetition over an alternation of two literals, so no nested quantifier and no
+ * backtracking blowup — see `utils/url-prefix.ts`'s `stripTrailingSlashes` for why regex shape
+ * is watched in this area. Measured under 2ms across five ~400KB adversarial inputs, the slowest
+ * consistently being a string of 400k slashes. Stated as a bound rather than a range because
+ * the figures move run to run.
+ */
+const DOT_SEGMENT = /(^|\/)(\.|%2e){1,2}(\/|$)/i;
 /**
  * Whether `url` declares an explicit scheme (`https:`, `mailto:`, `javascript:`, ...).
  *
@@ -64,6 +79,107 @@ export function neutralizeImplicitOffOrigin(url) {
     const parsed = new URL(url, SENTINEL_BASE);
     return parsed.pathname + parsed.search + parsed.hash;
 }
+/**
+ * Whether `value` is usable as an adopter-CONFIGURED URL base or endpoint: an absolute
+ * `http(s)` URL, or a site-relative path with exactly one leading slash.
+ *
+ * This is the config-validation counterpart to `sanitizeHref`, which does the same job for
+ * untrusted CONTENT. The difference is what happens to a bad value: content is coerced to a
+ * fallback so a page still renders, whereas config should fail loudly at parse time — nobody
+ * is served by a silently-rewritten deployment setting. The http(s) allowlist itself lives in
+ * this file either way, so the two surfaces cannot drift into disagreeing about which schemes
+ * are acceptable (that drift is exactly why `utils/url-prefix.ts` exists — see its header).
+ *
+ * `allowProtocolRelative` exists because the two callers genuinely differ, and the difference
+ * is blast radius rather than taste:
+ *
+ * - A READ-side prefix (`media.publicBaseUrl`, joined onto `/assets/…`) may legitimately be
+ *   `//cdn.example.com`. `utils/url-prefix.ts`'s `isAbsoluteUrl` documents that literal
+ *   spelling as an intentionally-supported off-site pointer, so rejecting it here would break
+ *   a working configuration. A bad value costs a broken `<img>`.
+ * - A WRITE-side endpoint (`media.uploadUrl`, where the browser POSTs a presigned upload) must
+ *   not be protocol-relative even when spelled literally, because such a URL is AMBIGUOUS: it
+ *   resolves to http or https depending on the scheme of whichever editor page happens to
+ *   issue the upload, so the stored config does not determine where a live presigned credential
+ *   and the user's file bytes are sent. That is the same principle every other rule here
+ *   enforces — a config value must describe what actually happens.
+ *
+ *   Note this is NOT an argument that http is forbidden on the write side; bare `http://` is
+ *   accepted, because a loopback or in-cluster S3-compatible endpoint is a real need and a
+ *   browser on an https editor blocks the mixed-content request anyway, so it fails closed. The
+ *   objection to `//host` is that it is undetermined, not that it might be insecure.
+ *
+ * Every spelling that READS as site-relative while redefining the authority — `/\host`,
+ * `\\host`, `\/host`, `///host` — is rejected for both, in both modes. Those look site-relative
+ * to a human and to a naive `startsWith('/')` check, but WHATWG URL resolves each to a
+ * different authority (measured: `///x` resolves to host `x`, not to pathname `/x`), so they
+ * are never what an adopter meant. A scheme-qualified absolute URL is a separate case and is
+ * accepted — `https:///cdn.example.com/` is unusual but unambiguous, resolving identically
+ * standalone and against any base.
+ */
+export function isHttpUrlOrSameOriginPath(value, opts = {}) {
+    if (value === '')
+        return false;
+    // Reject ASCII control characters and spaces ANYWHERE in the value, not only at the edges.
+    // WHATWG URL strips tab/CR/LF during parsing wherever they occur, so `/\tx` parses as a
+    // perfectly ordinary same-origin path and would satisfy every check below — while the
+    // browser actually requests `/x`. A stored config value that does not describe what is sent
+    // is a defect even when it happens to work, so reject it rather than normalize it away.
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x20 || code === 0x7f)
+            return false;
+    }
+    // A query or fragment is meaningless on both sides this predicate serves. S3's POST Object
+    // takes no query parameters and a browser never transmits a fragment; and on the read side a
+    // prefix carrying either produces `https://cdn.example.com/?x=1/assets/…` once joined.
+    if (value.includes('?') || value.includes('#'))
+        return false;
+    // A backslash is never legitimate in a configured URL, and it is not merely cosmetic: WHATWG
+    // treats it as a path separator for special schemes, so `/asset\upload/` is SENT as
+    // `/asset/upload/`. Worse on the read side, where the value becomes a prefix — `/\` is a
+    // string `new URL()` REJECTS, so it slips past the off-origin check below and joins into
+    // `/\/assets/a.png`, which a browser then resolves to `https://assets/a.png` — a request to a
+    // host literally named `assets` (measured). Anyone
+    // wanting a literal backslash in a path must percent-encode it.
+    if (value.includes('\\'))
+        return false;
+    // Dot segments resolve away before the request is sent — `/asset-upload/..` is SENT as `/`
+    // and `/./x` as `/x` — so the stored value again fails to describe what happens.
+    if (DOT_SEGMENT.test(value))
+        return false;
+    if (declaresScheme(value)) {
+        // The scheme must be followed by a literal `//`. Parsing to an http(s) URL is NOT enough:
+        // WHATWG resolves a same-scheme reference carrying no authority as RELATIVE, so a browser
+        // on `https://editor.example.com/admin/media` sends `https:cdn.example.com` to
+        // `https://editor.example.com/admin/cdn.example.com` — while `new URL()` here would report
+        // `https://cdn.example.com/`. Accepting it would post the presigned credential and the
+        // user's bytes to a page-dependent path on the editor's own origin, surfacing only as a
+        // 404 with nothing pointing at the config. Dropping the `//` is an ordinary typo.
+        if (!/^https?:\/\//i.test(value))
+            return false;
+        // `http:` is deliberately allowed alongside `https:`: a local S3-compatible endpoint
+        // (MinIO, LocalStack) is `http://localhost:9000`, and that is the one setup in which an
+        // adopter would most want to exercise this path before deploying.
+        try {
+            new URL(value);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    // A LITERAL `//host` is the only off-origin spelling that can be intentional, and only for
+    // callers that opt in. `value[2] !== '/'` matters: `///x` and `////x` are also "implicitly
+    // off-origin" and also start with `//`, but resolve to a host named `x` rather than to a
+    // path — so they must not ride in on the opt-in.
+    if (isImplicitlyOffOrigin(value)) {
+        return opts.allowProtocolRelative === true && value.startsWith('//') && value[2] !== '/';
+    }
+    // Site-relative, with exactly one leading slash. The second clause also covers `//`, which
+    // `isImplicitlyOffOrigin` reports as false only because `new URL('//', base)` throws.
+    return value.startsWith('/') && value[1] !== '/';
+}
 /**
  * Sanitize an untrusted URL for use in `href` attributes.
  *

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.66-int.85",
+  "version": "0.0.66",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {
@@ -18,59 +18,71 @@
   },
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "require": "./dist/index.js"
     },
     "./client": {
+      "types": "./dist/client.d.ts",
       "import": "./dist/client.js",
-      "types": "./dist/client.d.ts"
+      "require": "./dist/client.js"
     },
     "./server": {
+      "types": "./dist/server.d.ts",
       "import": "./dist/server.js",
-      "types": "./dist/server.d.ts"
+      "require": "./dist/server.js"
     },
     "./auth": {
+      "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth/index.js",
-      "types": "./dist/auth/index.d.ts"
+      "require": "./dist/auth/index.js"
     },
     "./auth/cache": {
+      "types": "./dist/auth/cache.d.ts",
       "import": "./dist/auth/cache.js",
-      "types": "./dist/auth/cache.d.ts"
+      "require": "./dist/auth/cache.js"
     },
     "./http": {
+      "types": "./dist/http/index.d.ts",
       "import": "./dist/http/index.js",
-      "types": "./dist/http/index.d.ts"
+      "require": "./dist/http/index.js"
     },
     "./task-queue": {
+      "types": "./dist/task-queue/index.d.ts",
       "import": "./dist/task-queue/index.js",
-      "types": "./dist/task-queue/index.d.ts"
+      "require": "./dist/task-queue/index.js"
     },
     "./worker/task-queue": {
+      "types": "./dist/worker/task-queue.d.ts",
       "import": "./dist/worker/task-queue.js",
-      "types": "./dist/worker/task-queue.d.ts"
+      "require": "./dist/worker/task-queue.js"
     },
     "./worker/cms-worker": {
+      "types": "./dist/worker/cms-worker.d.ts",
       "import": "./dist/worker/cms-worker.js",
-      "types": "./dist/worker/cms-worker.d.ts"
+      "require": "./dist/worker/cms-worker.js"
     },
     "./ai": {
+      "types": "./dist/ai/index.d.ts",
       "import": "./dist/ai/index.js",
-      "types": "./dist/ai/index.d.ts"
+      "require": "./dist/ai/index.js"
     },
     "./build": {
+      "types": "./dist/build/index.d.ts",
       "import": "./dist/build/index.js",
-      "types": "./dist/build/index.d.ts"
+      "require": "./dist/build/index.js"
     },
     "./utils/error": {
+      "types": "./dist/utils/error.d.ts",
       "import": "./dist/utils/error.js",
-      "types": "./dist/utils/error.d.ts"
+      "require": "./dist/utils/error.js"
     }
   },
   "files": [
     "dist"
   ],
   "engines": {
-    "node": ">=18"
+    "node": ">=22.12.0"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.600.0",