canopycms 0.0.67-int.90 → 0.0.67

package/dist/editor/components/EditorHeader.d.ts

@@ -2,9 +2,6 @@ import type { OperatingMode } from '../../operating-mode/index.js';
 import type { BranchStatus } from '../../types.js';
 import type { EditorEntry } from '../Editor.js';
 import type { LogicalPath } from '../../paths/types.js';
-/**
- * Props for the EditorHeader component.
- */
 export interface EditorHeaderProps {
     /**
      * Site title displayed in the top-left.
@@ -150,33 +147,5 @@ export interface EditorHeaderProps {
 /**
  * Header component for the Editor.
  * Contains site info, file navigation, breadcrumbs, branch selector, comments button, and action buttons.
- *
- * @example
- * ```tsx
- * <EditorHeader
- *   siteTitle="My Site"
- *   siteSubtitle="CMS"
- *   headerTitle="Edit Content"
- *   currentEntry={currentEntry}
- *   branchName="main"
- *   operatingMode="collaboration"
- *   busy={false}
- *   breadcrumbSegments={['Posts', 'My Post']}
- *   editedFiles={[]}
- *   modifiedCount={0}
- *   unresolvedCommentCount={0}
- *   comments={[]}
- *   onNavigatorOpen={() => setNavigatorOpen(true)}
- *   onFileReload={handleReload}
- *   onFileDiscardDraft={handleDiscardFileDraft}
- *   onEntrySelect={setSelectedId}
- *   onBranchReloadData={handleReloadBranchData}
- *   onBranchDiscardDrafts={handleDiscardDrafts}
- *   onBranchManagerOpen={() => setBranchManagerOpen(true)}
- *   onCommentsPanelOpen={() => setCommentsPanelOpen(true)}
- *   onSave={handleSave}
- *   onSubmit={() => handleSubmit(branchName)}
- * />
- * ```
  */
 export declare const EditorHeader: import("react").ForwardRefExoticComponent<EditorHeaderProps & import("react").RefAttributes<HTMLDivElement>>;

package/dist/editor/components/EditorHeader.js

@@ -20,60 +20,20 @@ const getStatusColor = (status) => {
 /**
  * Header component for the Editor.
  * Contains site info, file navigation, breadcrumbs, branch selector, comments button, and action buttons.
- *
- * @example
- * ```tsx
- * <EditorHeader
- *   siteTitle="My Site"
- *   siteSubtitle="CMS"
- *   headerTitle="Edit Content"
- *   currentEntry={currentEntry}
- *   branchName="main"
- *   operatingMode="collaboration"
- *   busy={false}
- *   breadcrumbSegments={['Posts', 'My Post']}
- *   editedFiles={[]}
- *   modifiedCount={0}
- *   unresolvedCommentCount={0}
- *   comments={[]}
- *   onNavigatorOpen={() => setNavigatorOpen(true)}
- *   onFileReload={handleReload}
- *   onFileDiscardDraft={handleDiscardFileDraft}
- *   onEntrySelect={setSelectedId}
- *   onBranchReloadData={handleReloadBranchData}
- *   onBranchDiscardDrafts={handleDiscardDrafts}
- *   onBranchManagerOpen={() => setBranchManagerOpen(true)}
- *   onCommentsPanelOpen={() => setCommentsPanelOpen(true)}
- *   onSave={handleSave}
- *   onSubmit={() => handleSubmit(branchName)}
- * />
- * ```
  */
 export const EditorHeader = forwardRef(function EditorHeader({ siteTitle, siteSubtitle, headerTitle, currentEntry, branchName, operatingMode, busy, breadcrumbSegments, editedFiles, modifiedCount, unresolvedCommentCount: _, comments, onNavigatorOpen, onFileReload, onFileDiscardDraft, onEntrySelect, onBranchReloadData, onBranchDiscardDrafts, onBranchManagerOpen, onCommentsPanelOpen, onSave, onSubmit, hasUnsavedChanges, branchStatus, onWithdraw, userContext, branchCreatedBy, branchAccess, branchIsProtected = false, branchReadOnly = false, branchWriteBlocked = false, }, ref) {
-    // `branchWriteBlocked` is the server's own answer (getBranchProtection, the
-    // same call the writableBranch guard makes), so Save can never be enabled for
-    // a write the API would reject. `branchReadOnly` only picks WHICH banner: the
-    // base branch's is a structural property and takes precedence over a workflow
-    // status lock.
+    // `branchWriteBlocked` is the server's own answer (getBranchProtection), so
+    // Save is never enabled for a write the API would reject; a client-side
+    // derivation could drift from it. `branchReadOnly` only picks which banner
+    // to show -- base-branch read-only takes precedence over a workflow status
+    // lock.
     const statusLocked = branchWriteBlocked && !branchReadOnly;
-    // The lock now fails CLOSED while the branch list is unresolved (Editor.tsx's
-    // `branchContentLocked` is `?? true`), which is right -- but `branchStatus` is
-    // `currentBranch?.status`, i.e. undefined in that same window. Without this
-    // distinction every banner and tooltip below interpolated it directly and read
-    // `Branch "main" is undefined - content is read-only`, on ordinary initial load
-    // and permanently after a failed branches fetch. Worse under version skew,
-    // where the status IS known ('editing') and the copy would assert a status
-    // lock the status plainly contradicts. So: locked, but say why honestly.
-    //
-    // Provably behavior-neutral for supported deployments: writeBlocked =
-    // readOnly || status !== 'editing', so when status === 'editing' that
-    // reduces to writeBlocked === readOnly. statusLocked = branchWriteBlocked
-    // && !branchReadOnly, so the new 'editing' arm below would require
-    // readOnly && !readOnly -- impossible. It is unreachable against any
-    // current server and only changes what renders under version skew (an old
-    // server that omits writeBlocked while still sending status: 'editing'),
-    // where it replaces the self-contradicting "Branch is editing — content is
-    // read-only" with the honest data-unavailable copy.
+    // Covers two cases where `branchStatus` can't be trusted to describe the lock
+    // honestly: branch data still loading (`branchStatus` is undefined, so the
+    // banner would otherwise interpolate "Branch is undefined...") and version
+    // skew (an old server omits `branchWriteBlocked` while still reporting
+    // status: 'editing', which would otherwise assert a lock the status
+    // contradicts). In both cases the banner says data is unavailable instead.
     const branchDataUnavailable = statusLocked && (branchStatus === undefined || branchStatus === 'editing');
     return (_jsx(Paper, { ref: ref, shadow: "md", withBorder: true, radius: 0, px: 0, py: 0, style: {
             position: 'fixed',
@@ -134,11 +94,11 @@ export const EditorHeader = forwardRef(function EditorHeader({ siteTitle, siteSu
                                     // wrongly stuck in 'submitted'.
                                     if (branchIsProtected && !isWithdrawable)
                                         return null;
-                                    // Check if user can perform workflow actions (creator OR ACL access OR system
-                                    // branch OR privileged). Admins/Reviewers must be able to withdraw a protected
-                                    // base branch wrongly stuck in 'submitted' -- the documented recovery flow --
-                                    // even when they're neither its creator nor in its ACL; this mirrors the
-                                    // server's canPerformWorkflowAction and BranchManager.tsx.
+                                    // Who may submit/withdraw: creator, ACL access, the system branch, or an
+                                    // admin/reviewer -- Admins/Reviewers must be able to withdraw a protected
+                                    // base branch stuck in 'submitted' even without ACL access. Mirrors the
+                                    // server's canPerformWorkflowAction (BranchManager.tsx), which is the
+                                    // actual enforcer; this only decides whether to show the control disabled.
                                     const userIsCreator = userContext?.userId === branchCreatedBy;
                                     const isSystemBranch = branchCreatedBy === 'canopycms-system' && !branchIsProtected;
                                     const userInACL = userContext &&
@@ -154,21 +114,11 @@ export const EditorHeader = forwardRef(function EditorHeader({ siteTitle, siteSu
                                     const statusHasAction = isEditing || isWithdrawable;
                                     const canPerformAction = userHasPermission && statusHasAction;
                                     return (_jsx(Tooltip, { label: 
-                                        // The unknown-status arm mirrors the banner's: with no
-                                        // branch data, `statusHasAction` is false (undefined is
-                                        // neither 'editing' nor withdrawable) and this label used
-                                        // to interpolate it as "This branch is undefined and has
-                                        // no submit or withdraw action available".
-                                        //
-                                        // Latent rather than live TODAY, and only by accident:
-                                        // Editor.tsx passes `branchIsProtected={... ?? true}` since
-                                        // the fail-closed change, so in that same window the early
-                                        // return above (`branchIsProtected && !isWithdrawable`)
-                                        // unmounts this button before the tooltip can render. That
-                                        // is one guard away from being user-visible -- relax the
-                                        // `?? true`, or pass `branchIsProtected={false}` from
-                                        // anywhere, and the copy is live. Guarding it here rather
-                                        // than relying on an unrelated condition to keep hiding it.
+                                        // No branch data (`branchStatus === undefined`) must not be
+                                        // interpolated raw into this label. Guarded explicitly here rather
+                                        // than left to the early return above, which hides this button
+                                        // today only as a side effect of `branchIsProtected`'s `?? true`
+                                        // default -- not a guarantee this arm stays unreachable.
                                         branchStatus === undefined
                                             ? 'Branch data could not be loaded, so no submit or withdraw action is available'
                                             : !statusHasAction

package/dist/editor/components/EditorSidebar.d.ts

@@ -1,7 +1,4 @@
 import type { PaneLayout } from '../EditorPanes.js';
-/**
- * Props for the EditorSidebar component.
- */
 export interface EditorSidebarProps {
     /**
      * Current layout mode (side or stacked).
@@ -66,21 +63,5 @@ export interface EditorSidebarProps {
 /**
  * Sidebar component for the Editor.
  * Contains layout toggle, highlight toggle, settings menu, account button, and logout button.
- *
- * @example
- * ```tsx
- * <EditorSidebar
- *   layout={layout}
- *   highlightEnabled={highlightEnabled}
- *   sidebarWidth={60}
- *   headerHeight={60}
- *   footerHeight={40}
- *   onLayoutChange={setLayout}
- *   onHighlightToggle={() => setHighlightEnabled(!highlightEnabled)}
- *   onPermissionManagerOpen={() => setPermissionManagerOpen(true)}
- *   onGroupManagerOpen={() => setGroupManagerOpen(true)}
- *   onMediaLibraryOpen={() => setMediaLibraryOpen(true)}
- * />
- * ```
  */
 export declare function EditorSidebar({ layout, highlightEnabled, sidebarWidth, headerHeight, footerHeight, onLayoutChange, onHighlightToggle, onPermissionManagerOpen, onGroupManagerOpen, onMediaLibraryOpen, onSystemHealthOpen, AccountComponent, onAccountClick, onLogoutClick, }: EditorSidebarProps): import("react/jsx-runtime").JSX.Element;

package/dist/editor/components/EditorSidebar.js

@@ -4,22 +4,6 @@ import { IconUserCircle, IconLogout, IconPhoto, IconSettings, IconLayoutColumns,
 /**
  * Sidebar component for the Editor.
  * Contains layout toggle, highlight toggle, settings menu, account button, and logout button.
- *
- * @example
- * ```tsx
- * <EditorSidebar
- *   layout={layout}
- *   highlightEnabled={highlightEnabled}
- *   sidebarWidth={60}
- *   headerHeight={60}
- *   footerHeight={40}
- *   onLayoutChange={setLayout}
- *   onHighlightToggle={() => setHighlightEnabled(!highlightEnabled)}
- *   onPermissionManagerOpen={() => setPermissionManagerOpen(true)}
- *   onGroupManagerOpen={() => setGroupManagerOpen(true)}
- *   onMediaLibraryOpen={() => setMediaLibraryOpen(true)}
- * />
- * ```
  */
 export function EditorSidebar({ layout, highlightEnabled, sidebarWidth, headerHeight, footerHeight, onLayoutChange, onHighlightToggle, onPermissionManagerOpen, onGroupManagerOpen, onMediaLibraryOpen, onSystemHealthOpen, AccountComponent, onAccountClick, onLogoutClick, }) {
     return (_jsxs(Paper, { withBorder: true, shadow: "sm", radius: 0, style: {

package/dist/editor/components/EntryCreateModal.d.ts

@@ -24,10 +24,10 @@ export interface EntryCreateModalProps {
     error?: string | null;
     /**
      * Slugs already taken in the target collection (from the already-loaded
-     * entries list). Used to reject an obvious collision client-side with a
-     * clear message, instead of the server returning a 409 (or, for entry
-     * types with no required fields, silently succeeding via an update path
-     * that never mentions the real problem).
+     * entries list). Lets the client flag an obvious collision early with a
+     * clear message; the server is still the authority, and without this
+     * check an entry type with no required fields would silently succeed via
+     * an update path instead of erroring.
      */
     existingSlugs?: Set<string>;
 }

package/dist/editor/components/EntryCreateModal.js

@@ -1,13 +1,6 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-/**
- * EntryCreateModal - Modal for creating new entries.
- *
- * Replaces window.prompt with a proper UI for:
- * - Selecting entry type (if multiple types available)
- * - Entering slug for new entry
- * - Validation and error handling
- */
+/** Modal for creating a new entry: replaces window.prompt with entry-type selection, slug entry, and validation. */
 import { useState, useEffect, useRef } from 'react';
 import { Modal, Stack, TextInput, Group, Button, Alert, Text, Select } from '@mantine/core';
 import { IconAlertCircle } from '@tabler/icons-react';
@@ -15,31 +8,23 @@ import { parseSlug } from '../../paths/validation.js';
 /** Slug the form is seeded with each time the modal opens. */
 const DEFAULT_SLUG = 'untitled';
 export function EntryCreateModal({ isOpen, collectionLabel, entryTypes, selectedEntryTypeName, onCreate, onClose, isCreating = false, error = null, existingSlugs, }) {
-    // Helper to get default or first entry type
     const getDefaultEntryTypeName = () => {
         if (selectedEntryTypeName)
             return selectedEntryTypeName;
         if (entryTypes.length === 1)
             return entryTypes[0].name;
-        // Find entry type marked as default
         const defaultType = entryTypes.find((et) => et.default);
         return defaultType?.name || entryTypes[0]?.name || '';
     };
     const [slug, setSlug] = useState(DEFAULT_SLUG);
     const [entryTypeName, setEntryTypeName] = useState(getDefaultEntryTypeName());
     const [validationError, setValidationError] = useState(null);
-    // Seed the form once per open, on the closed -> open transition.
-    //
-    // This deliberately keys on `isOpen` alone. It used to key on the prop
-    // *values* (`[isOpen, selectedEntryTypeName, entryTypes]`), but `entryTypes`
-    // is an array that callers build inline - a fresh identity on every parent
-    // render - so any re-render while the modal was open re-ran this block and
-    // silently discarded what the user had typed or selected. The entry was then
-    // written to disk under the default slug with no error surfaced.
-    //
-    // Seeding is a lifecycle event, not a derivation of the current props, so the
-    // narrow dep array is the point. Do not "fix" it by adding the props read
-    // below (`entryTypes`, `selectedEntryTypeName`) back in.
+    // Seeds the form once per open, on the closed -> open transition. Keys on
+    // `isOpen` alone, not on `entryTypes`/`selectedEntryTypeName`: `entryTypes`
+    // is an array callers build inline, a fresh identity on every parent
+    // render, so keying on it would silently reset the form on every
+    // re-render while the modal is open. Do not add those props back to the
+    // dep array below.
     const wasOpenRef = useRef(false);
     useEffect(() => {
         if (isOpen && !wasOpenRef.current) {

package/dist/editor/components/RenameEntryModal.js

@@ -1,8 +1,6 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 /**
- * RenameEntryModal - Modal for renaming entry slugs.
- *
  * Allows changing the slug (middle segment) of an entry filename.
  * The content ID is preserved, so drafts and references remain intact.
  */
@@ -23,7 +21,6 @@ export function RenameEntryModal({ isOpen, entryLabel, currentSlug, onSave, onCl
             setValidationError(null);
         }
     }
-    // Validate slug format
     const validateSlug = (slug) => {
         if (!slug.trim()) {
             return 'Slug cannot be empty';
@@ -31,7 +28,6 @@ export function RenameEntryModal({ isOpen, entryLabel, currentSlug, onSave, onCl
         if (slug.includes('/')) {
             return 'Slug cannot contain slashes';
         }
-        // Simple validation - lowercase, alphanumeric + hyphens
         if (!/^[a-z0-9][-a-z0-9]*$/.test(slug)) {
             return 'Slug must start with letter/number and contain only lowercase letters, numbers, and hyphens';
         }

package/dist/editor/components/UserBadge.js

@@ -5,39 +5,32 @@ import { useUserMetadata } from '../hooks/useUserMetadata.js';
 export const UserBadge = ({ userId, getUserMetadata, variant = 'avatar-name', showEmailTooltip = true, onRemove, color, size = 'sm', badgeVariant = 'filled', showBadge = false, loading: loadingOverride, cachedUser, }) => {
     const { userMetadata, isLoading, error } = useUserMetadata(userId, getUserMetadata, cachedUser);
     const loading = loadingOverride ?? isLoading;
-    // Avatar size mapping
     const avatarSize = {
         xs: 16,
         sm: 20,
         md: 24,
         lg: 32,
     }[size];
-    // Text size mapping
     const textSize = {
         xs: 'xs',
         sm: 'sm',
         md: 'sm',
         lg: 'md',
     }[size];
-    // Loading state
     if (loading) {
         return (_jsxs(Group, { gap: 4, children: [_jsx(Skeleton, { circle: true, height: avatarSize, width: avatarSize }), variant !== 'avatar-only' && _jsx(Skeleton, { height: 12, width: 60 })] }));
     }
-    // Error or missing user - fallback to userId
     if (error || !userMetadata) {
         const content = (_jsxs(Group, { gap: 4, children: [_jsx(Avatar, { size: avatarSize, color: "gray" }), variant !== 'avatar-only' && (_jsx(Text, { size: textSize, c: "dimmed", children: userId }))] }));
         return showEmailTooltip ? (_jsx(Tooltip, { label: error ? 'Error loading user' : 'User not found', children: content })) : (content);
     }
-    // Generate initials from name
     const getInitials = (name) => {
         const parts = name.trim().split(/\s+/);
         if (parts.length === 1)
             return parts[0].charAt(0).toUpperCase();
         return (parts[0].charAt(0) + parts[parts.length - 1].charAt(0)).toUpperCase();
     };
-    // Render avatar
     const renderAvatar = () => {
-        // Special case: anonymous user
         if (userId === 'anonymous') {
             return (_jsx(Avatar, { size: avatarSize, color: "orange", children: _jsx(IconUserOff, { size: avatarSize * 0.6 }) }));
         }
@@ -61,7 +54,6 @@ export const UserBadge = ({ userId, getUserMetadata, variant = 'avatar-name', sh
         }
         return (_jsx(Avatar, { src: userMetadata.avatarUrl, size: avatarSize, color: avatarColor, style: avatarStyles, children: !userMetadata.avatarUrl && getInitials(userMetadata.name) }));
     };
-    // Render content based on variant
     const renderContent = () => {
         const avatar = renderAvatar();
         switch (variant) {
@@ -75,7 +67,6 @@ export const UserBadge = ({ userId, getUserMetadata, variant = 'avatar-name', sh
         }
     };
     const content = renderContent();
-    // If onRemove or showBadge, wrap the content in a Badge
     if (onRemove || showBadge) {
         const badgeContent = (_jsx(Badge, { variant: badgeVariant, color: color, pr: onRemove ? 3 : 8, pl: 4, rightSection: onRemove ? (_jsx(ActionIcon, { size: "xs", radius: "xl", variant: "transparent", onClick: () => onRemove(userId), "aria-label": "Remove user", style: { color: 'white' }, children: _jsx(IconX, { size: 12, stroke: 2.5 }) })) : undefined, styles: {
                 label: {
@@ -87,6 +78,5 @@ export const UserBadge = ({ userId, getUserMetadata, variant = 'avatar-name', sh
             }, children: content }));
         return showEmailTooltip && variant !== 'full' ? (_jsx(Tooltip, { label: userMetadata.email, children: badgeContent })) : (badgeContent);
     }
-    // No badge wrapper - just wrap with tooltip if needed
     return showEmailTooltip && variant !== 'full' ? (_jsx(Tooltip, { label: userMetadata.email, children: content })) : (content);
 };

package/dist/editor/components/index.js

@@ -1,5 +1,3 @@
-// Barrel export for all Editor UI components
-// Export components as they are created
 export * from './EditorFooter.js';
 export * from './EditorHeader.js';
 export * from './EditorSidebar.js';

package/dist/editor/context/ApiClientContext.d.ts

@@ -1,11 +1,7 @@
 /**
- * API Client Context
- *
- * Provides dependency injection for the API client via context-based pattern
- * pattern that was duplicated across 6 hooks. This enables:
- * - Clean testing via provider (no more resetApiClient() hacks)
- * - Explicit dependency
- * - No global mutable state
+ * Provides the API client via context-based dependency injection rather than
+ * a module-global singleton, so tests can inject a mock client through the
+ * provider instead of resetting global state between tests.
  */
 import React from 'react';
 import { createApiClient } from '../../api/index.js';
@@ -27,6 +23,11 @@ export interface ApiClientProviderProps {
  * Use the client prop to inject a mock client for testing.
  */
 export declare function ApiClientProvider({ children, client, basePath }: ApiClientProviderProps): import("react/jsx-runtime").JSX.Element;
+/**
+ * Subscribe to every 401 the provider's client receives, from any request. `listener` should be
+ * stable (e.g. from `useCallback`): a new function re-subscribes. No-op outside a provider.
+ */
+export declare function useOnUnauthorized(listener: () => void): void;
 /**
  * Hook to access the API client.
  * Must be used within an ApiClientProvider.

package/dist/editor/context/ApiClientContext.js

@@ -1,31 +1,59 @@
 'use client';
 import { jsx as _jsx } from "react/jsx-runtime";
 /**
- * API Client Context
- *
- * Provides dependency injection for the API client via context-based pattern
- * pattern that was duplicated across 6 hooks. This enables:
- * - Clean testing via provider (no more resetApiClient() hacks)
- * - Explicit dependency
- * - No global mutable state
+ * Provides the API client via context-based dependency injection rather than
+ * a module-global singleton, so tests can inject a mock client through the
+ * provider instead of resetting global state between tests.
  */
-import { createContext, useContext, useMemo } from 'react';
+import { createContext, useContext, useEffect, useMemo, useState } from 'react';
 import { createApiClient } from '../../api/index.js';
 import { joinUrlPrefix } from '../../utils/url-prefix.js';
 const ApiClientContext = createContext(null);
+function createUnauthorizedSignal() {
+    const listeners = new Set();
+    return {
+        emit: () => {
+            for (const listener of [...listeners])
+                listener();
+        },
+        subscribe: (listener) => {
+            listeners.add(listener);
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+    };
+}
+const UnauthorizedSignalContext = createContext(null);
 /**
  * Provider that creates and provides the API client.
  * Use the client prop to inject a mock client for testing.
  */
 export function ApiClientProvider({ children, client, basePath }) {
+    const [unauthorized] = useState(createUnauthorizedSignal);
     // Memoized on identity, not just for cost: several consumers now list the client in their
     // effect deps (useUserContext, useReferenceResolution, ReferenceField), so a fresh client each
     // render would turn those one-shot fetches into a loop. A caller injecting an inline
     // `client={createApiClient()}` would reintroduce exactly that.
+    //
+    // Only a client built HERE reports 401s to `useOnUnauthorized`; an injected `client` is used
+    // as-is, so its 401s reach the auth gate only through the gate's own whoami result.
     const apiClient = useMemo(() => {
-        return client ?? createApiClient({ baseUrl: joinUrlPrefix(basePath, '/api/canopycms') });
-    }, [client, basePath]);
-    return _jsx(ApiClientContext.Provider, { value: apiClient, children: children });
+        return (client ??
+            createApiClient({
+                baseUrl: joinUrlPrefix(basePath, '/api/canopycms'),
+                onUnauthorized: unauthorized.emit,
+            }));
+    }, [client, basePath, unauthorized]);
+    return (_jsx(UnauthorizedSignalContext.Provider, { value: unauthorized, children: _jsx(ApiClientContext.Provider, { value: apiClient, children: children }) }));
+}
+/**
+ * Subscribe to every 401 the provider's client receives, from any request. `listener` should be
+ * stable (e.g. from `useCallback`): a new function re-subscribes. No-op outside a provider.
+ */
+export function useOnUnauthorized(listener) {
+    const signal = useContext(UnauthorizedSignalContext);
+    useEffect(() => signal?.subscribe(listener), [signal, listener]);
 }
 /**
  * Hook to access the API client.

package/dist/editor/context/AssetContext.d.ts

@@ -1,6 +1,4 @@
 /**
- * Asset Context
- *
  * Carries `media.publicBaseUrl` (see CanopyClientConfig.assetBaseUrl) down to
  * every asset-URL-building component - MediaLibrary, ImageField, and the MDX
  * image dialog. A context (rather than a prop) because the MDX dialog is
@@ -31,23 +29,15 @@ export interface AssetContextProviderProps extends AssetContextValue {
  * full, and a deployment `basePath` cannot apply on top of it. Where the two differ is topology,
  * not precedence - see the asset-mount table in the README.
  *
- * WHY THE FALLBACK EXISTS, AND WHY THAT REASON IS NOW GONE. It was added because
- * `publicBaseUrl` was validated absolute-only (`z.string().url()`) and so could not express a
- * bare path, leaving the editor's thumbnails, previews and crop images root-relative — and 404 —
- * on a basePath deployment where Next serves `/assets`. That constraint was lifted when
- * `publicBaseUrl` moved to `assetMountUrlSchema`, which accepts a site-relative path: an adopter
- * can now simply set `publicBaseUrl: '/preview-123'`. The fallback is kept only so that existing
- * basePath deployments do not break on upgrade, which makes removing it a deliberate decision
- * rather than a cleanup - it is option 1 of
+ * The fallback is kept only so that existing basePath deployments do not break on upgrade,
+ * which makes removing it a deliberate decision rather than a cleanup - it is option 1 of
  * `.claude/future-tasks/editor-asset-mount-topology.md`, still open.
  *
- * KNOWN LIMITATION: the fallback assumes that topology, and consults none. On a CloudFront/CDK
- * deployment a basePath does NOT move the asset space (behaviors are anchored at the distribution
- * root), so prefixing is wrong there — the requests still resolve, because `withCanopy`'s
- * auto-prefixed `/assets/:path*` rewrite catches them and serves through the CMS Lambda, but they
- * bypass the CDN cache and the dedicated transform Lambda. The workaround is real though not
- * obvious: set `media.publicBaseUrl` to the distribution origin, which takes precedence here.
- * Tracked in `.claude/future-tasks/editor-asset-mount-topology.md`.
+ * KNOWN LIMITATION: on a CloudFront/CDK deployment, a basePath does NOT move the asset
+ * space (behaviors are anchored at the distribution root), so this fallback prefixes
+ * wrongly — requests still resolve, via `withCanopy`'s auto-prefixed `/assets/:path*`
+ * rewrite, but bypass the CDN cache and the dedicated transform Lambda. Workaround: set
+ * `media.publicBaseUrl` to the distribution origin instead, which takes precedence here.
  */
 export declare function AssetContextProvider({ baseUrl, basePath, children }: AssetContextProviderProps): import("react/jsx-runtime").JSX.Element;
 /** Safe to call outside a provider - returns `{ baseUrl: undefined }` (root-relative URLs). */

package/dist/editor/context/AssetContext.js

@@ -1,8 +1,6 @@
 'use client';
 import { jsx as _jsx } from "react/jsx-runtime";
 /**
- * Asset Context
- *
  * Carries `media.publicBaseUrl` (see CanopyClientConfig.assetBaseUrl) down to
  * every asset-URL-building component - MediaLibrary, ImageField, and the MDX
  * image dialog. A context (rather than a prop) because the MDX dialog is
@@ -22,23 +20,15 @@ const AssetContext = createContext({});
  * full, and a deployment `basePath` cannot apply on top of it. Where the two differ is topology,
  * not precedence - see the asset-mount table in the README.
  *
- * WHY THE FALLBACK EXISTS, AND WHY THAT REASON IS NOW GONE. It was added because
- * `publicBaseUrl` was validated absolute-only (`z.string().url()`) and so could not express a
- * bare path, leaving the editor's thumbnails, previews and crop images root-relative — and 404 —
- * on a basePath deployment where Next serves `/assets`. That constraint was lifted when
- * `publicBaseUrl` moved to `assetMountUrlSchema`, which accepts a site-relative path: an adopter
- * can now simply set `publicBaseUrl: '/preview-123'`. The fallback is kept only so that existing
- * basePath deployments do not break on upgrade, which makes removing it a deliberate decision
- * rather than a cleanup - it is option 1 of
+ * The fallback is kept only so that existing basePath deployments do not break on upgrade,
+ * which makes removing it a deliberate decision rather than a cleanup - it is option 1 of
  * `.claude/future-tasks/editor-asset-mount-topology.md`, still open.
  *
- * KNOWN LIMITATION: the fallback assumes that topology, and consults none. On a CloudFront/CDK
- * deployment a basePath does NOT move the asset space (behaviors are anchored at the distribution
- * root), so prefixing is wrong there — the requests still resolve, because `withCanopy`'s
- * auto-prefixed `/assets/:path*` rewrite catches them and serves through the CMS Lambda, but they
- * bypass the CDN cache and the dedicated transform Lambda. The workaround is real though not
- * obvious: set `media.publicBaseUrl` to the distribution origin, which takes precedence here.
- * Tracked in `.claude/future-tasks/editor-asset-mount-topology.md`.
+ * KNOWN LIMITATION: on a CloudFront/CDK deployment, a basePath does NOT move the asset
+ * space (behaviors are anchored at the distribution root), so this fallback prefixes
+ * wrongly — requests still resolve, via `withCanopy`'s auto-prefixed `/assets/:path*`
+ * rewrite, but bypass the CDN cache and the dedicated transform Lambda. Workaround: set
+ * `media.publicBaseUrl` to the distribution origin instead, which takes precedence here.
  */
 export function AssetContextProvider({ baseUrl, basePath, children }) {
     const resolved = baseUrl ?? basePath;

package/dist/editor/context/EditorIdentityContext.d.ts

@@ -0,0 +1,13 @@
+import type { UserContext } from '../BranchManager.js';
+/**
+ * The identity `EditorAuthGate` resolved for the editor below it. Present only inside the gate;
+ * `useUserContext` reads it so the editor shares the gate's one `whoami` instead of issuing its
+ * own.
+ */
+export interface EditorIdentity {
+    /** The server-accepted identity; the gate mounts the editor only once it has one. */
+    user: UserContext;
+}
+export declare const EditorIdentityContext: import("react").Context<EditorIdentity | null>;
+/** The gate's resolved identity, or null outside an `EditorAuthGate`. */
+export declare function useEditorIdentity(): EditorIdentity | null;

package/dist/editor/context/EditorIdentityContext.js

@@ -0,0 +1,7 @@
+'use client';
+import { createContext, useContext } from 'react';
+export const EditorIdentityContext = createContext(null);
+/** The gate's resolved identity, or null outside an `EditorAuthGate`. */
+export function useEditorIdentity() {
+    return useContext(EditorIdentityContext);
+}