canopycms 0.0.67-int.90 → 0.0.67

package/dist/context.js

@@ -13,58 +13,46 @@ function isLookupFailure(err) {
     return err.code === 'NOT_FOUND' || err.code === 'NO_SCHEMA_ITEM';
 }
 /**
- * True when a ContentStoreError should render as "not found" to page-level callers of
- * readByUrlPath rather than escape as a thrown error. FORBIDDEN is included so a
- * denied/anonymous read produces the adopter's ordinary `if (!result) return notFound()`
- * (404) instead of an unhandled 500 from the server component. The strict `read()` API is
- * unaffected and still throws.
+ * True when a ContentStoreError should render as "not found" to page-level
+ * callers of readByUrlPath rather than escape as a thrown error. FORBIDDEN is
+ * included so a denied or anonymous read reaches the adopter's ordinary
+ * `if (!result) return notFound()` (404) instead of an unhandled 500 from the
+ * server component. The strict `read()` API still throws.
  */
 function isPageSwallowable(err) {
     return isLookupFailure(err) || err.code === 'FORBIDDEN';
 }
 /**
- * Create a Canopy context that manages auth + content reading.
- * Framework-agnostic - the adapter provides the extractUser function.
+ * Create a Canopy context managing auth + content reading. Framework-agnostic:
+ * the adapter supplies extractUser.
  *
- * User extractor should apply bootstrap admin groups (via authResultToCanopyUser).
- *
- * NOTE: This function is synchronous because in practice, services are always
- * provided pre-created (async) by the framework adapter. The fallback path
- * that creates services from config cannot work correctly since createCanopyServices
- * is now async. Always pass services, not config.
+ * Synchronous, and takes pre-created `services` rather than config — building
+ * services is async, so there is no working fallback path from config here.
  */
 export function createCanopyContext(options) {
     const services = options.services;
-    /**
-     * Get the current user.
-     * Returns STATIC_DEPLOY_USER for static deployments or during build, otherwise delegates to adapter.
-     */
+    /** STATIC_DEPLOY_USER on a static deployment or during build, else the adapter's user. */
     const getUser = async () => {
-        // Static deployment or build phase: no request context, use synthetic admin user
+        // No request context in either phase, so use the synthetic admin.
         if (isDeployedStatic(services.config) || isBuildMode()) {
             return STATIC_DEPLOY_USER;
         }
-        // Runtime: delegate to adapter-provided user extractor
-        // (adapter should use authResultToCanopyUser to apply bootstrap admins)
         return await options.extractUser();
     };
-    /**
-     * Get the context for the current request.
-     * Call this in server components/routes to get auth-aware reader.
-     */
+    /** The auth-aware context for this request; call it in server components and routes. */
     const getContext = async () => {
         // Dev mode follows the developer's git HEAD (no-op in prod/static or when
         // defaultActiveBranch is explicit). Same contract as the HTTP API handler —
         // switching branches mid-session updates what getCanopy() serves.
         await services.refreshActiveBranch();
         const user = await getUser();
-        // Create base content reader
         const baseReader = createContentReader({ services });
-        // Wrap reader to inject user automatically, validating strings → branded types at this
-        // boundary. `extra` carries options that are NOT part of the public `read` surface -- today
-        // just readByUrlPath's URL-addressability gate. Kept as a separate inner function rather than
-        // an optional second parameter on the `CanopyContext['read']`-typed closure so the two call
-        // sites stay visible and nobody widens the public API by accident.
+        // Injects the user and validates strings → branded types at this boundary.
+        // `extra` carries options that are NOT part of the public `read` surface —
+        // today just readByUrlPath's URL-addressability gate. A separate inner
+        // function rather than an optional second parameter on the
+        // `CanopyContext['read']`-typed closure, so the two call sites stay visible
+        // and nobody widens the public API by accident.
         const readWithOptions = async (input, extra) => {
             const entryPath = createLogicalPath(input.entryPath);
             let slug;
@@ -93,9 +81,9 @@ export function createCanopyContext(options) {
                 return null;
             const { branch, resolveReferences } = options ?? {};
             for (const candidate of candidates) {
-                // Skip candidates whose slug isn't a valid slug (e.g. URL paths like /favicon.ico or
-                // Next internals that the [...slug] route catches). These can never match an entry, so
-                // treat them as a miss rather than letting read() throw an "Invalid slug" error.
+                // Skip a candidate whose slug isn't valid (/favicon.ico, Next internals
+                // the [...slug] route catches). None can match an entry, so treat it as
+                // a miss rather than let read() throw "Invalid slug".
                 if (!parseSlug(candidate.slug).ok)
                     continue;
                 try {
@@ -105,17 +93,17 @@ export function createCanopyContext(options) {
                         branch,
                         resolveReferences,
                     }, 
-                    // This is a read BY PUBLISHED URL, so it must accept only what listEntries publishes.
-                    // See ReadContentInput.urlAddressableOnly for the two rules and why they live in the
-                    // reader (which holds the branch-correct schema) rather than in the candidate builder
-                    // (which is pure and schema-free by design).
+                    // A read BY PUBLISHED URL accepts only what listEntries publishes.
+                    // See ReadContentInput.urlAddressableOnly for the two rules, and
+                    // why they live in the reader (which holds the branch-correct
+                    // schema) rather than the candidate builder (pure and schema-free).
                     { urlAddressableOnly: true });
                 }
                 catch (err) {
-                    // Swallow "not found" errors from trying candidate paths, and FORBIDDEN (a denied
-                    // or anonymous read renders as a 404 via the adopter's `if (!result) return
-                    // notFound()` rather than an unhandled 500). Re-throw real errors (validation,
-                    // corruption, non-ContentStoreError).
+                    // Swallow a candidate path's "not found", and FORBIDDEN so a denied
+                    // or anonymous read renders as the adopter's 404 rather than an
+                    // unhandled 500. Real errors (validation, corruption, anything not a
+                    // ContentStoreError) rethrow.
                     if (err instanceof ContentStoreError && isPageSwallowable(err)) {
                         if (err.code === 'FORBIDDEN') {
                             log.debug('readByUrlPath', 'Read denied, treating as not-found: ' + err.message, {
@@ -155,41 +143,34 @@ export function createCanopyContext(options) {
             return schemaContextPromise;
         };
         /**
-         * Path-ACL predicate for the batch reads (listEntries / buildContentTree). Memoized
-         * per getContext call, like the schema context above.
-         *
-         * These two are the only content reads on this context that did NOT enforce path
-         * permissions: `read`/`readByUrlPath` go through the content reader, which checks per
-         * entry, while the listing primitives took no user at all. Since `CanopyContext` is the
-         * request-scoped, ACL-enforcing context that page code is told to use, an unfiltered
-         * listing there disclosed full entry `data` for paths the user cannot `read()` directly.
+         * Path-ACL predicate for the batch reads (listEntries / buildContentTree),
+         * memoized per getContext call like the schema context above. Without it an
+         * unfiltered listing on this request-scoped, ACL-enforcing context would
+         * disclose full entry `data` for paths the user cannot `read()` directly.
          *
-         * `services.createContentAccessChecker` is the existing batch primitive (api/entries.ts
-         * uses the same one): it resolves the request-constant work — branch access, the
-         * settings/permissions root, and the rule set — exactly once, and returns a synchronous
-         * per-path check. So the per-entry cost here is an admin short-circuit or a minimatch
-         * per configured rule, with no additional I/O.
+         * `services.createContentAccessChecker` is the shared batch primitive
+         * (api/entries.ts uses it too): it resolves the request-constant work —
+         * branch access, the settings/permissions root, the rule set — once, and
+         * returns a synchronous per-path check, so the per-entry cost is an admin
+         * short-circuit or one minimatch per configured rule, with no extra I/O.
          *
-         * Returns an empty object (no predicate → unfiltered, today's behavior) at build time,
-         * on static deployments, and for the synthetic admin user. All three short-circuits are
-         * load-bearing, not just an optimization: `createContentAccessChecker` grants that user
-         * unconditional access (path checks bypass entirely for an Admins-group user, see
-         * authorization/path.ts), so the predicate would always be a no-op — but building it
-         * still costs a getSettingsBranchRoot() call, which in modes with a separate settings
-         * branch (prod and dev) means provisioning/cloning that branch's git workspace. That is
-         * an EFS round trip in prod, and it is exactly the unwanted cost for `createBuildCanopy`
-         * (see build-canopy.ts): a standalone script's whole point is running outside a request
-         * or Next.js build phase, so neither of the other two guards fires for it, and without
-         * this one every such script paid for a settings-workspace clone it never needed and,
-         * in an environment where that workspace cannot be provisioned, would hard-fail on.
+         * The empty object (no predicate → unfiltered) at build time, on static
+         * deployments, and for the synthetic admin is load-bearing, not an
+         * optimization. That user has unconditional access anyway (path checks
+         * bypass entirely for an Admins-group user — authorization/path.ts), but
+         * BUILDING the checker costs a getSettingsBranchRoot() call, which in modes
+         * with a separate settings branch provisions that branch's git workspace: an
+         * EFS round trip in prod. `createBuildCanopy` (build-canopy.ts) runs outside
+         * a request or Next.js build phase, so neither other guard fires for it, and
+         * without this one every such script pays for a settings-workspace clone it
+         * never needed — and hard-fails where that workspace cannot be provisioned.
          *
-         * Compared by reference to the exported STATIC_DEPLOY_USER singleton (not by group
-         * membership) so this stays scoped to the synthetic build/admin identity specifically —
-         * a real authenticated admin hitting `getCanopy()` at request time still goes through
-         * the real check, same as any other user.
+         * Compared by reference to the STATIC_DEPLOY_USER singleton, not by group
+         * membership, so it stays scoped to the synthetic build identity: a real
+         * authenticated admin at request time still goes through the real check.
          *
-         * Deliberately NOT wrapped in a try/catch: createContentAccessChecker is fail-loud by
-         * contract, and swallowing here would silently serve an unfiltered listing.
+         * Deliberately NOT wrapped in try/catch — createContentAccessChecker is
+         * fail-loud by contract, and swallowing would serve an unfiltered listing.
          */
         let visibilityPromise = null;
         const resolveVisibilityImpl = async () => {

package/dist/dev-content-watcher.d.ts

@@ -3,26 +3,23 @@
  *
  * In dev, the editor and dev server read content from a branch clone under
  * `.canopy-dev/content-branches/<branch>/`, while the static build reads the working tree directly.
- * When a developer edits working-tree `content/**` outside the editor, the dev server silently serves
- * stale content until `canopycms sync push` runs. This watcher surfaces that divergence:
+ * A developer editing working-tree `content/**` outside the editor therefore gets stale content
+ * from the dev server until `canopycms sync push` runs. This watcher reports that divergence
+ * ('warn', the default: a warning naming the diverged files, at startup and on content changes) or
+ * does nothing ('off').
  *
- * - 'warn' (default): log a warning naming the diverged files (on startup and on content changes).
- * - 'off': do nothing.
+ * There is intentionally NO auto-push mode: overwriting the branch clone from the working tree
+ * would clobber uncommitted editor "Save" state with no Canopy-level recovery. Reconciliation goes
+ * through the interactive, conflict-aware `canopycms sync push` instead.
  *
- * There is intentionally NO auto-push mode: overwriting the branch clone from the working tree would
- * silently clobber uncommitted editor "Save" state with no Canopy-level recovery for the editor.
- * Reconciliation goes through the interactive `canopycms sync push` (conflict-aware) instead.
+ * Divergence is a CONDITION, not an event: it holds until someone runs `sync push`, so the report
+ * must not repeat into a scrolling request log (`reportOnce`) yet must be hard to scroll past (the
+ * gutter block). A log cannot hold a condition; see
+ * `.claude/future-tasks/dev-divergence-in-app-surface.md` for the in-app surface that would
+ * replace the terminal as its primary home.
  *
- * All logic lives here in the core package; framework adapters just call startDevContentWatcher() once
- * at dev startup. See packages/canopycms-next/src/context-wrapper.ts for the Next wiring.
- *
- * ## Divergence is a CONDITION, not an event
- *
- * It stays true until someone runs `sync push`, so the two things this module has to get right are
- * (a) not re-printing the same condition into a scrolling request log, and (b) making the one printing
- * of it hard to scroll past. Both are handled below by `reportOnce` + the gutter formatting; see
- * `.claude/future-tasks/dev-divergence-in-app-surface.md` for the in-app surface that would replace
- * the terminal as the primary home for this.
+ * All logic lives here; framework adapters call startDevContentWatcher() once at dev startup (see
+ * packages/canopycms-next/src/context-wrapper.ts for the Next wiring).
  */
 import type { CanopyServices } from './services.js';
 import type { DevContentSyncMode } from './config/types.js';
@@ -36,7 +33,10 @@ export interface StartDevContentWatcherOptions {
     /** Warning sink. Defaults to console.warn. */
     warn?: (message: string) => void;
 }
-/** Test-only: dispose every armed watcher and drop all cross-module dedupe state. */
+/**
+ * Test-only: dispose every armed watcher and drop all cross-module dedupe state.
+ * @internal Exported for tests.
+ */
 export declare function resetDevContentWatchersForTests(): void;
 /**
  * Start watching the working-tree content directory for divergence from the served dev branch clone.

package/dist/dev-content-watcher.js

@@ -3,26 +3,23 @@
  *
  * In dev, the editor and dev server read content from a branch clone under
  * `.canopy-dev/content-branches/<branch>/`, while the static build reads the working tree directly.
- * When a developer edits working-tree `content/**` outside the editor, the dev server silently serves
- * stale content until `canopycms sync push` runs. This watcher surfaces that divergence:
+ * A developer editing working-tree `content/**` outside the editor therefore gets stale content
+ * from the dev server until `canopycms sync push` runs. This watcher reports that divergence
+ * ('warn', the default: a warning naming the diverged files, at startup and on content changes) or
+ * does nothing ('off').
  *
- * - 'warn' (default): log a warning naming the diverged files (on startup and on content changes).
- * - 'off': do nothing.
+ * There is intentionally NO auto-push mode: overwriting the branch clone from the working tree
+ * would clobber uncommitted editor "Save" state with no Canopy-level recovery. Reconciliation goes
+ * through the interactive, conflict-aware `canopycms sync push` instead.
  *
- * There is intentionally NO auto-push mode: overwriting the branch clone from the working tree would
- * silently clobber uncommitted editor "Save" state with no Canopy-level recovery for the editor.
- * Reconciliation goes through the interactive `canopycms sync push` (conflict-aware) instead.
+ * Divergence is a CONDITION, not an event: it holds until someone runs `sync push`, so the report
+ * must not repeat into a scrolling request log (`reportOnce`) yet must be hard to scroll past (the
+ * gutter block). A log cannot hold a condition; see
+ * `.claude/future-tasks/dev-divergence-in-app-surface.md` for the in-app surface that would
+ * replace the terminal as its primary home.
  *
- * All logic lives here in the core package; framework adapters just call startDevContentWatcher() once
- * at dev startup. See packages/canopycms-next/src/context-wrapper.ts for the Next wiring.
- *
- * ## Divergence is a CONDITION, not an event
- *
- * It stays true until someone runs `sync push`, so the two things this module has to get right are
- * (a) not re-printing the same condition into a scrolling request log, and (b) making the one printing
- * of it hard to scroll past. Both are handled below by `reportOnce` + the gutter formatting; see
- * `.claude/future-tasks/dev-divergence-in-app-surface.md` for the in-app surface that would replace
- * the terminal as the primary home for this.
+ * All logic lives here; framework adapters call startDevContentWatcher() once at dev startup (see
+ * packages/canopycms-next/src/context-wrapper.ts for the Next wiring).
  */
 import fsSync from 'node:fs';
 import path from 'node:path';
@@ -33,18 +30,16 @@ import { getErrorMessage } from './utils/error.js';
 import { diffContentTrees, isContentTreeDiffEmpty } from './sync-core.js';
 /**
  * Per-category cap on listed files. Deliberately small: the block is a prompt to run `sync push`,
- * not a diff viewer, and a 30-line wall of paths is exactly as easy to scroll past as a 1-line
- * warning. Each list carries its true count, so nothing is hidden -- only elided.
+ * not a diff viewer, and a wall of paths is as easy to scroll past as a one-line warning. Each
+ * list carries its true count, so nothing is hidden -- only elided.
  */
 const MAX_LISTED_FILES = 5;
 /**
- * The registry lives on `globalThis`, NOT in module scope.
- *
- * Next's dev server compiles the server graph per route bundle and evaluates each copy in its own
- * module scope, so a module-level `Map` is re-created empty per bundle -- every copy then believes it
- * is the first watcher, arms its own, and re-prints the startup warning. (The duplicated
- * "CanopyCMS dev-auth: Auto-configured ..." line in a dev log is the same effect on a different
- * module-level latch.) A `globalThis` property is the one thing shared across those evaluations.
+ * The registry lives on `globalThis`, NOT in module scope: Next's dev server compiles the server
+ * graph per route bundle and evaluates each copy in its own module scope, so a module-level `Map`
+ * is re-created empty per bundle -- every copy then believes it is the first watcher, arms its own,
+ * and re-prints the startup warning. A `globalThis` property is the one thing shared across those
+ * evaluations.
  */
 const REGISTRY_KEY = '__canopycmsDevContentWatchers__';
 function watcherRegistry() {
@@ -56,7 +51,10 @@ function watcherRegistry() {
     host[REGISTRY_KEY] = created;
     return created;
 }
-/** Test-only: dispose every armed watcher and drop all cross-module dedupe state. */
+/**
+ * Test-only: dispose every armed watcher and drop all cross-module dedupe state.
+ * @internal Exported for tests.
+ */
 export function resetDevContentWatchersForTests() {
     const registry = watcherRegistry();
     for (const state of registry.values())
@@ -64,9 +62,9 @@ export function resetDevContentWatchersForTests() {
     registry.clear();
 }
 /**
- * One body line of the notice block. The left gutter (rather than a full box) is deliberate: content
- * paths are long and unpredictable, and a right border would force either wrapping math or truncation
- * of the very filenames the block exists to name.
+ * One body line of the notice block. A left gutter rather than a full box: content paths are long
+ * and unpredictable, and a right border would force either wrapping math or truncation of the very
+ * filenames the block exists to name.
  */
 function body(line) {
     const gutter = pc.yellow('|');
@@ -84,8 +82,8 @@ function formatList(label, files) {
 }
 function formatDivergenceWarning(branch, diff) {
     const total = diff.changed.length + diff.added.length + diff.removed.length;
-    // Blank lines top and bottom: the block's job is to be findable in a scrolling request log, and
-    // whitespace separation does more for that than any amount of in-block decoration.
+    // Blank lines top and bottom: whitespace separation does more to make this block findable in a
+    // scrolling request log than any amount of in-block decoration.
     return [
         '',
         `${pc.bgYellow(pc.black(' CanopyCMS '))} ${pc.bold(pc.yellow('working-tree content has diverged'))}`,
@@ -121,17 +119,16 @@ export function startDevContentWatcher(services, options = {}) {
     const sourceRoot = options.sourceRoot ?? services.config.sourceRoot ?? process.cwd();
     const contentRoot = services.config.contentRoot || 'content';
     const strategy = operatingStrategy('dev');
-    // Must pass the resolved contentRoot local above -- getContentRoot has no
-    // default of its own (by design: a default here is what let this watcher
-    // silently no-op for a non-default contentRoot before this fix).
+    // Pass the resolved contentRoot local above: getContentRoot has no default of its own, by
+    // design -- a default here silently no-ops this watcher for a non-default contentRoot.
     const workingTreeContentDir = strategy.getContentRoot(contentRoot, sourceRoot);
     const warn = options.warn ?? ((message) => console.warn(message));
     // Nothing to watch if the working tree has no content directory (e.g. unit-test configs).
     if (!fsSync.existsSync(workingTreeContentDir))
         return noop;
-    // Resolve the branch fresh each check: the dev server silently follows git-HEAD switches
+    // Resolve the branch fresh each check: the dev server follows git-HEAD switches
     // (services.refreshActiveBranch reassigns config.defaultActiveBranch), so the comparison target
-    // must track whatever branch is currently being served. An explicit options.branch pins it.
+    // must track whatever branch is currently served. An explicit options.branch pins it.
     const resolveBranch = () => options.branch ??
         services.config.defaultActiveBranch ??
         services.config.defaultBaseBranch ??
@@ -147,9 +144,9 @@ export function startDevContentWatcher(services, options = {}) {
     // ENTRY deliberately survives, carrying lastMessage/reportedDivergence into the new watcher.
     watcherState.dispose?.();
     /**
-     * Emit `message` unless it is verbatim what was emitted last for this directory. Covers the
-     * divergence block, the resolved notice and the error paths alike: in every case a repeat means
-     * "the condition is unchanged", which the reader already knows.
+     * Emit `message` unless it is verbatim what was emitted last for this directory -- divergence
+     * block, resolved notice and error paths alike, since in every case a repeat means "the
+     * condition is unchanged", which the reader already knows.
      */
     const reportOnce = (message) => {
         if (watcherState.lastMessage === message)
@@ -174,8 +171,8 @@ export function startDevContentWatcher(services, options = {}) {
                 return;
             const diff = await diffContentTrees(workingTreeContentDir, branchContentDir);
             if (isContentTreeDiffEmpty(diff)) {
-                // Close the loop: a condition that was announced needs its retraction announced too, or the
-                // reader is left believing the dev server is still serving stale content.
+                // An announced condition needs its retraction announced too, or the reader is left
+                // believing the dev server is still serving stale content.
                 if (watcherState.reportedDivergence) {
                     watcherState.reportedDivergence = false;
                     reportOnce(formatResolvedNotice(branch));
@@ -201,9 +198,9 @@ export function startDevContentWatcher(services, options = {}) {
     watcher.on('add', () => void check());
     watcher.on('change', () => void check());
     watcher.on('unlink', () => void check());
-    // Handle watcher errors (e.g. inotify ENOSPC/EMFILE) so an unhandled 'error' event can't crash dev.
+    // Watcher errors (e.g. inotify ENOSPC/EMFILE) must be handled, or an unhandled 'error' event
+    // crashes dev.
     watcher.on('error', (err) => reportOnce(`CanopyCMS: dev content-sync watcher error: ${getErrorMessage(err)}`));
-    // Initial divergence check at startup.
     void check();
     const dispose = () => {
         void watcher.close();

package/dist/editor/BranchManager.d.ts

@@ -3,6 +3,7 @@ import type { OperatingMode } from '../operating-mode/index.js';
 import type { ConflictStatus, PullRequestState, SyncStatus } from '../types.js';
 import type { CommentThread } from '../comment-store.js';
 import type { UserSearchResult } from '../auth/types.js';
+/** @internal Exported for tests. */
 export interface BranchSummary {
     name: string;
     status: string;
@@ -32,12 +33,7 @@ export interface BranchSummary {
      * status) -- see `useBranchManager.tsx`'s `BranchSummary.submitBlocked` and
      * `BranchWriteProtection.submitBlockedIncludingStatus` for the full
      * rationale. `getBranchPermissions`'s `canSubmit` consumes this directly
-     * instead of re-deriving `status === 'editing' && !isProtected` --
-     * PR #189's stated invariant is "consume the server flag, don't
-     * re-derive", and shipping only the base-branch-only `submitBlocked` flag
-     * (rejected in #205, since that's the same value as `isProtected` and
-     * would still have left the status half re-derived here) would not have
-     * removed the re-derivation this replaces.
+     * instead of re-deriving `status === 'editing' && !isProtected`.
      */
     submitBlocked?: boolean;
 }
@@ -52,6 +48,7 @@ export interface UserContext {
  * - Users in branch ACL can submit/withdraw
  * - System branches can be submitted/withdrawn by anyone with access
  * - Admins/Reviewers always have access
+ * @internal Exported for tests.
  */
 export declare const getBranchPermissions: (branch: BranchSummary, user: UserContext | undefined) => {
     canSubmit: boolean;

package/dist/editor/BranchManager.js

@@ -15,6 +15,7 @@ import { formatRelativeTime } from './relative-time.js';
  * - Users in branch ACL can submit/withdraw
  * - System branches can be submitted/withdrawn by anyone with access
  * - Admins/Reviewers always have access
+ * @internal Exported for tests.
  */
 export const getBranchPermissions = (branch, user) => {
     if (!user) {
@@ -32,44 +33,30 @@ export const getBranchPermissions = (branch, user) => {
     // auto-provision marker (createdBy: 'canopycms-system') would otherwise let
     // anyone with general access submit/withdraw/delete it.
     const isSystemBranch = branch.createdBy === 'canopycms-system' && !branch.isProtected;
-    // Check if user is in branch ACL
     const userInACL = (branch.access?.users?.includes(user.userId) ||
         user.groups?.some((g) => branch.access?.groups?.includes(g))) ??
         false;
-    // Can perform workflow actions if: creator OR in ACL OR (system branch AND has basic access) OR privileged
     const canPerformWorkflowActions = userIsCreator || userInACL || isSystemBranch || userIsAdmin || userIsReviewer;
     // Submit: can perform workflow actions AND the server says submit isn't
     // blocked. `submitBlocked` is the server's own compound answer -- status
     // past 'editing' OR the protected base branch -- computed once in
     // `getBranchWriteProtection` (protected-branch.ts) and threaded through
-    // unchanged; this used to re-derive the same conjunction locally
-    // (`branch.status === 'editing' && !branch.isProtected`), which is exactly
-    // the drift hazard PR #189's "consume the server flag, don't re-derive"
-    // invariant exists to prevent. See `BranchSummary.submitBlocked`'s doc
-    // comment above for why a bare `submitBlocked` flag (the base-branch-only
-    // meaning, as rejected in #205) would not have been enough on its own.
+    // unchanged.
     //
-    // `?? true` and not a bare `!branch.submitBlocked`: the field is optional on
-    // this type (as `isProtected`/`readOnly` beside it are), so a missing value
-    // must mean BLOCKED, not allowed. Dropping the default would reintroduce, one
-    // layer below, exactly the fail-open shape this change set exists to remove --
-    // `useBranchManager.tsx` already defaults the same flag to `true` when the
-    // wire omits it, and a second, contradictory default here would quietly undo
-    // that for anything constructing a BranchSummary directly.
+    // `?? true`, not a bare `!branch.submitBlocked`: the field is optional (like
+    // `isProtected`/`readOnly` beside it), so a missing value must mean BLOCKED,
+    // not allowed -- matching the `?? true` default `useBranchManager.tsx`
+    // already applies to the same flag. A `?? false` default here would
+    // fail-open for anything constructing a BranchSummary directly.
     const canSubmit = canPerformWorkflowActions && !(branch.submitBlocked ?? true);
-    // Withdraw: Can perform workflow actions AND branch is submitted or approved.
-    // Allowed even when the PR was closed without merging -- that's the
-    // deliberate recovery path for a closed-unmerged PR (a later resubmit
-    // opens a fresh PR). The server skips the now-impossible draft conversion
-    // in that case; see api/branch-withdraw.ts. Not additionally gated on
-    // !branch.isProtected: withdraw is the recovery path for a protected branch
-    // wrongly stuck in 'submitted' -- creator/ACL/privileged users can still
-    // reach it (the system-branch grant above already excludes them).
-    //
-    // 'approved' is included because withdraw is that status's ONLY
-    // non-destructive exit (request-changes still requires 'submitted', and the
-    // submit status gate now refuses a non-editing branch). Surfacing it here is
-    // what makes the exit reachable -- the server accepting it is not enough.
+    // Withdraw: can perform workflow actions AND branch is submitted or
+    // approved -- 'approved' is included because withdraw is that status's only
+    // non-destructive exit, and getBranchPermissions must grant canWithdraw for
+    // it to be reachable. Allowed even when the PR was closed without merging:
+    // that's the deliberate recovery path for a closed-unmerged PR (server-side
+    // skip in api/branch-withdraw.ts). Not additionally gated on
+    // !branch.isProtected either: withdraw is also how a creator/ACL/privileged
+    // user recovers a protected branch wrongly stuck in 'submitted'.
     const canWithdraw = canPerformWorkflowActions && (branch.status === 'submitted' || branch.status === 'approved');
     // Delete: Admin or creator (but not if submitted or approved -- both mean
     // an open PR, the latter already reviewed and awaiting merge -- and never
@@ -125,28 +112,21 @@ export const BranchManager = ({ branches, mode, user, onSelect, onCreate, onDele
                                                                     cursor: 'pointer',
                                                                 }, children: "View PR" })] }))] }), b.access && (_jsxs(Group, { gap: 6, children: [b.access.users?.map((u) => onGetUserMetadata ? (_jsx(UserBadge, { userId: u, getUserMetadata: onGetUserMetadata, variant: "avatar-only", size: "xs", showEmailTooltip: true }, u)) : (_jsx(Badge, { variant: "outline", color: "neutral", children: u }, u))), b.access.groups?.map((g) => (_jsx(Badge, { variant: "outline", color: "neutral", children: g }, g)))] }))] }), _jsxs(Group, { gap: 8, children: [_jsx(Button, { size: "xs", variant: "light", onClick: () => onSelect?.(b.name), "data-testid": `switch-to-branch-button-${b.name}`, children: "Open" }), b.status === 'submitted' || b.status === 'approved' ? (_jsx(Tooltip, { label: "Only the branch creator can withdraw", disabled: perms.canWithdraw, children: _jsx(Button, { size: "xs", variant: "light", color: "orange", onClick: () => onWithdraw?.(b.name), disabled: !perms.canWithdraw, "data-testid": `withdraw-branch-button-${b.name}`, children: "Withdraw" }) })) : (_jsx(Tooltip, { label: b.isProtected
                                                     ? 'The base branch cannot be submitted'
-                                                    : // A status arm, because canSubmit now folds in
-                                                        // the server's status rule as well as the
-                                                        // base-branch one. Without it, an archived (or
-                                                        // any non-editing) branch showed a disabled
-                                                        // Submit reading "Only the branch creator can
-                                                        // submit" -- to the creator. That is precisely
-                                                        // the permission-vs-no-available-transition
-                                                        // confusion #205 removed from EditorHeader, and
-                                                        // folding status into canSubmit reintroduced it
-                                                        // one component over.
+                                                    : // A status arm: canSubmit folds in the server's status rule as
+                                                        // well as the base-branch one, so an archived (or any
+                                                        // non-editing) branch reads its own reason instead of the
+                                                        // generic "Only the branch creator can submit".
                                                         b.status !== 'editing'
                                                             ? `A branch with status "${b.status}" cannot be submitted`
                                                             : 'Only the branch creator can submit', disabled: perms.canSubmit, children: _jsx(Button, { size: "xs", variant: "light", color: "green", onClick: () => onSubmit?.(b.name), disabled: !perms.canSubmit, "data-testid": `submit-branch-button-${b.name}`, children: "Submit" }) })), _jsx(Tooltip, { label: b.pullRequestState === 'closed'
                                                     ? 'PR was closed on GitHub without merging'
                                                     : 'Only Reviewers or Admins can request changes', disabled: perms.canRequestChanges, children: _jsx(Button, { size: "xs", variant: "outline", color: "neutral", onClick: () => onRequestChanges?.(b.name), disabled: !perms.canRequestChanges, "data-testid": `request-changes-branch-button-${b.name}`, children: "Request changes" }) }), _jsx(Tooltip, { label: b.isProtected
                                                     ? 'The base branch cannot be deleted'
-                                                    : // A status arm, mirroring the Submit tooltip below: without
-                                                        // it, a branch blocked by its own status (open PR, reviewed
-                                                        // or not) showed "Only Admin or branch creator can delete" --
-                                                        // to the very admin/creator being blamed for a permission they
-                                                        // do have. 'approved' is included alongside 'submitted' since
-                                                        // both mean an open PR is blocking deletion.
+                                                    : // A status arm, mirroring the Submit tooltip above: without it,
+                                                        // a branch blocked by its own status reads the generic "Only
+                                                        // Admin or branch creator can delete" instead of naming the open
+                                                        // PR. 'approved' is included alongside 'submitted' since both
+                                                        // mean an open PR is blocking deletion.
                                                         b.status === 'submitted' || b.status === 'approved'
                                                             ? `Cannot delete branch with open PR (status "${b.status}")`
                                                             : 'Only Admin or branch creator can delete', disabled: perms.canDelete, children: _jsx(Button, { size: "xs", variant: "outline", color: "red", onClick: () => onDelete?.(b.name), disabled: !perms.canDelete, "data-testid": `delete-branch-button-${b.name}`, children: "Delete" }) })] })] }) }, b.name));

package/dist/editor/CanopyEditor.js

@@ -2,7 +2,8 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { useMemo } from 'react';
 import { Editor } from './Editor.js';
-import { ApiClientProvider, SWRProvider } from './context/index.js';
+import { ApiClientProvider } from './context/index.js';
+import { EditorAuthGate } from './EditorAuthGate.js';
 import { buildEditorCollections, buildPreviewBaseByCollection } from './editor-config.js';
 export const CanopyEditor = ({ config, entries = [], initialSelectedId, initialValues, renderPreview, onCreateEntry, branchName, customRenderers, }) => {
     const collections = useMemo(() => buildEditorCollections(config.flatSchema), [config.flatSchema]);
@@ -16,6 +17,8 @@ export const CanopyEditor = ({ config, entries = [], initialSelectedId, initialV
     const resolvedTitle = config.editor?.title ?? 'CanopyCMS Editor';
     const resolvedSubtitle = config.editor?.subtitle;
     const resolvedTheme = config.editor?.theme ?? undefined;
-    return (_jsx(SWRProvider, { children: _jsx(ApiClientProvider, { basePath: config.basePath, children: _jsx(Editor, { entries: entries, title: resolvedTitle, subtitle: resolvedSubtitle, branchName: resolvedBranchName, operatingMode: config.mode, initialSelectedId: initialSelectedId, initialValues: initialValues, renderPreview: renderPreview, onCreateEntry: onCreateEntry, customRenderers: customRenderers, collections: collections, contentRoot: config.contentRoot, entryLinkUrl: config.entryLinkUrl, previewBaseByCollection: previewBase, assetBaseUrl: config.assetBaseUrl, basePath: config.basePath, themeOptions: resolvedTheme, AccountComponent: config.editor?.AccountComponent, onAccountClick: config.editor?.onAccountClick, onLogoutClick: config.editor?.onLogoutClick }) }) }));
+    // The gate owns the SWRProvider (keyed by user id), so it sits between the API client and the
+    // editor: see EditorAuthGate for what a signed-out or lapsed session renders.
+    return (_jsx(ApiClientProvider, { basePath: config.basePath, children: _jsx(EditorAuthGate, { SignInComponent: config.editor?.SignInComponent, themeOptions: resolvedTheme, children: _jsx(Editor, { entries: entries, title: resolvedTitle, subtitle: resolvedSubtitle, branchName: resolvedBranchName, operatingMode: config.mode, initialSelectedId: initialSelectedId, initialValues: initialValues, renderPreview: renderPreview, onCreateEntry: onCreateEntry, customRenderers: customRenderers, collections: collections, contentRoot: config.contentRoot, entryLinkUrl: config.entryLinkUrl, previewBaseByCollection: previewBase, assetBaseUrl: config.assetBaseUrl, basePath: config.basePath, themeOptions: resolvedTheme, AccountComponent: config.editor?.AccountComponent, onAccountClick: config.editor?.onAccountClick, onLogoutClick: config.editor?.onLogoutClick }) }) }));
 };
 export default CanopyEditor;

package/dist/editor/CommentsPanel.js

@@ -16,14 +16,12 @@ export const CommentsPanel = ({ branchName, comments, canResolve, onAddComment,
         setIsSubmitting(true);
         try {
             if (replyTo) {
-                // Reply to existing thread - get context from the thread
                 const thread = comments.find((t) => t.id === replyTo);
                 if (thread) {
                     await onAddComment(newCommentText, thread.type, thread.entryPath, thread.canopyPath, replyTo);
                 }
             }
             else {
-                // New branch-level comment (default for panel)
                 await onAddComment(newCommentText, 'branch', undefined, undefined, undefined);
             }
             setNewCommentText('');