canopycms 0.0.67-int.90 → 0.0.67

package/dist/api/request-body-hash.d.ts

@@ -1,32 +1,21 @@
 /**
- * Computes the `x-amz-content-sha256` header value required by CloudFront's
- * Origin Access Control (OAC) SigV4 signing when a request carries a body.
+ * Computes the `x-amz-content-sha256` header CloudFront's Origin Access Control (OAC) requires
+ * for SigV4-signed origin requests that carry a body: OAC signs the request but never hashes the
+ * payload itself, so the viewer request must carry this header or the Function URL returns 403.
+ * See docs/deploying-to-aws.md for the deployment topology.
  *
- * Documented AWS behavior: CloudFront signs origin requests to OAC-protected
- * Lambda Function URLs, but it never hashes the payload itself - it forwards
- * whatever `x-amz-content-sha256` header value the viewer request already
- * has. If a request has a body and this header is missing, Lambda's
- * signature verification fails and the origin responds 403. See
- * docs/deploying-to-aws.md for the full explanation.
- *
- * Uses WebCrypto (available in secure-context browsers and in Node >= 18) to
- * compute the lowercase-hex SHA-256 digest of the exact bytes sent as the
- * request body.
+ * Uses WebCrypto (secure-context browsers, Node >= 18) to hash the exact bytes sent.
  */
 /**
- * Hash a string request body (e.g. a JSON-serialized payload).
- *
- * Returns `undefined` if WebCrypto is unavailable (for example a dev server
- * running over plain http, which is not a secure context) so callers can
- * skip the header rather than throw - production deployments are always
- * https.
+ * Hash a string request body (e.g. a JSON-serialized payload). Returns `undefined` when
+ * WebCrypto is unavailable (a dev server over plain http, not a secure context) so callers can
+ * skip the header instead of throwing — production is always https.
  */
 export declare function computeContentSha256Hex(body: string): Promise<string | undefined>;
 /**
- * Hash a raw-bytes request body (e.g. an ArrayBuffer or Blob upload).
- *
- * Note: this cannot be used for `FormData` bodies - the multipart boundary
- * is generated by the runtime at send time, so the final byte stream isn't
- * known until after the request would already need to be signed.
+ * Hash a raw-bytes request body (e.g. an ArrayBuffer or Blob upload). Not usable for `FormData`
+ * bodies — the multipart boundary is generated at send time, after the request would already
+ * need to be signed.
+ * @internal Exported for tests.
  */
 export declare function computeContentSha256HexFromBytes(bytes: BufferSource): Promise<string | undefined>;

package/dist/api/request-body-hash.js

@@ -1,35 +1,24 @@
 /**
- * Computes the `x-amz-content-sha256` header value required by CloudFront's
- * Origin Access Control (OAC) SigV4 signing when a request carries a body.
+ * Computes the `x-amz-content-sha256` header CloudFront's Origin Access Control (OAC) requires
+ * for SigV4-signed origin requests that carry a body: OAC signs the request but never hashes the
+ * payload itself, so the viewer request must carry this header or the Function URL returns 403.
+ * See docs/deploying-to-aws.md for the deployment topology.
  *
- * Documented AWS behavior: CloudFront signs origin requests to OAC-protected
- * Lambda Function URLs, but it never hashes the payload itself - it forwards
- * whatever `x-amz-content-sha256` header value the viewer request already
- * has. If a request has a body and this header is missing, Lambda's
- * signature verification fails and the origin responds 403. See
- * docs/deploying-to-aws.md for the full explanation.
- *
- * Uses WebCrypto (available in secure-context browsers and in Node >= 18) to
- * compute the lowercase-hex SHA-256 digest of the exact bytes sent as the
- * request body.
+ * Uses WebCrypto (secure-context browsers, Node >= 18) to hash the exact bytes sent.
  */
 /**
- * Hash a string request body (e.g. a JSON-serialized payload).
- *
- * Returns `undefined` if WebCrypto is unavailable (for example a dev server
- * running over plain http, which is not a secure context) so callers can
- * skip the header rather than throw - production deployments are always
- * https.
+ * Hash a string request body (e.g. a JSON-serialized payload). Returns `undefined` when
+ * WebCrypto is unavailable (a dev server over plain http, not a secure context) so callers can
+ * skip the header instead of throwing — production is always https.
  */
 export async function computeContentSha256Hex(body) {
     return computeContentSha256HexFromBytes(new TextEncoder().encode(body));
 }
 /**
- * Hash a raw-bytes request body (e.g. an ArrayBuffer or Blob upload).
- *
- * Note: this cannot be used for `FormData` bodies - the multipart boundary
- * is generated by the runtime at send time, so the final byte stream isn't
- * known until after the request would already need to be signed.
+ * Hash a raw-bytes request body (e.g. an ArrayBuffer or Blob upload). Not usable for `FormData`
+ * bodies — the multipart boundary is generated at send time, after the request would already
+ * need to be signed.
+ * @internal Exported for tests.
  */
 export async function computeContentSha256HexFromBytes(bytes) {
     const subtle = globalThis.crypto?.subtle;

package/dist/api/resolve-references.d.ts

@@ -3,7 +3,6 @@ import type { ApiResponse } from './types.js';
 export interface ResolveReferencesBody {
     ids: string[];
 }
-/** Response type for resolved references */
 export type ResolveReferencesResponse = ApiResponse<{
     resolved: Record<string, unknown>;
 }>;

package/dist/api/resolve-references.js

@@ -5,14 +5,10 @@ import { ReferenceResolver } from '../reference-resolver.js';
 import { buildResolvedReference } from '../entry-schema.js';
 import { computeEntryUrl } from '../utils/entry-url.js';
 import { branchNameSchema, contentIdSchema } from './validators.js';
-// ============================================================================
-// Zod Schemas for Validation
-// ============================================================================
 /**
- * Resolution does sequential per-ID file I/O (see the loop below), so the
- * request body caps how much filesystem work a single authenticated caller
- * can force. 100 is a generous bound for real UI usage (a page's worth of
- * reference fields) while keeping worst-case latency/IO bounded (API-M1).
+ * Resolution does sequential per-ID file I/O, so the request body caps how much filesystem work
+ * a single caller can force. 100 is generous for real UI usage (a page's worth of reference
+ * fields) while keeping worst-case latency/IO bounded (API-M1).
  */
 const MAX_RESOLVE_REFERENCE_IDS = 100;
 const resolveReferencesParamsSchema = z.object({
@@ -33,10 +29,9 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
     const idIndex = await store.idIndex();
     // Resolve each ID to full document
     const resolver = new ReferenceResolver(store, idIndex);
-    // Build the access checker once: permissions are loaded a single time and reused
-    // for every id, instead of re-loading per id inside the loop. A failure here
-    // (e.g. settings workspace unavailable) surfaces as a handler error rather than
-    // being silently swallowed per id.
+    // Build the access checker once, reused for every id instead of re-loading per id in the loop.
+    // A failure here (e.g. settings workspace unavailable) surfaces as a handler error, not
+    // swallowed silently per id.
     const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
     const resolved = {};
     for (const id of ids) {
@@ -48,22 +43,15 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
                 const access = checkAccess(resolvedPath.relativePath, 'read');
                 if (!access.allowed)
                     continue;
-                // `resolveReferences: false` matches what the server-side resolver does
-                // (content-store.ts's resolveSingleReferenceOnce reads its targets the same way).
-                // Without it this endpoint resolved one level DEEPER than production, so a nested
-                // reference inside a target rendered as an object in live preview and as a bare ID
-                // string on the published site.
+                // `resolveReferences: false` matches the server-side resolver (content-store.ts's
+                // resolveSingleReferenceOnce), so a nested reference inside a target renders the same way
+                // in live preview as on the published site, instead of resolving one level deeper.
                 const doc = await store.read(result.collection, result.slug, { resolveReferences: false });
                 if (doc && doc.data) {
-                    // Same shape the server-side resolver produces (content-store.ts's
-                    // resolveSingleReferenceOnce): the target's data first, then the reserved keys.
-                    //
-                    // Both halves matter. The ORDER is the corruption guard -- a target modelling `id`
-                    // as content must not shadow the real content ID. The extra KEYS are what stops the
-                    // editor's live preview disagreeing with production: this endpoint feeds
-                    // client-reference-resolver.ts, so without `urlPath` a component rendering
-                    // `<a href={ref.urlPath}>` showed `undefined` while previewing and a real URL once
-                    // published -- exactly the class of divergence live preview exists to rule out.
+                    // Same shape as the server-side resolver: target data first, then the reserved keys.
+                    // Order is the corruption guard (a target modelling `id` as content must not shadow the
+                    // real content ID); the extra keys (incl. `urlPath`) keep live preview and production
+                    // in sync for consumers like client-reference-resolver.ts.
                     resolved[id] = buildResolvedReference(doc.data, {
                         id,
                         slug: result.slug,
@@ -84,9 +72,6 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
         data: { resolved },
     };
 };
-// ============================================================================
-// Route Definitions
-// ============================================================================
 /**
  * Resolve reference IDs to full document objects
  * POST /:branch/resolve-references

package/dist/api/route-builder.d.ts

@@ -18,7 +18,7 @@ import { type GuardId, type ComputeGuardContext } from './guards.js';
  * @example
  * { 'collectionPath': 'createLogicalPath', 'items.*.path': 'createPhysicalPath' }
  */
-export type MockDataCasts = Record<string, 'createLogicalPath' | 'createPhysicalPath' | 'as ContentId'>;
+type MockDataCasts = Record<string, 'createLogicalPath' | 'createPhysicalPath' | 'as ContentId'>;
 /**
  * Metadata for code generation
  */
@@ -35,10 +35,6 @@ export interface RouteMetadata {
     /** Casts to apply to mock data fields for branded types */
     mockDataCasts?: MockDataCasts;
 }
-/**
- * Global registry - generator reads this
- */
-export declare const ROUTE_REGISTRY: RouteMetadata[];
 /**
  * Route definition created by defineEndpoint.
  * Contains all metadata needed for:
@@ -77,7 +73,7 @@ export interface RouteDefinition<TParams extends z.ZodType | undefined = undefin
 /**
  * Handler function signature with validated params and body (no guards)
  */
-export type RouteHandler<TParams extends z.ZodType | undefined, TBody extends z.ZodType | undefined, TResponse> = (ctx: ApiContext, req: ApiRequest, ...args: [
+type RouteHandler<TParams extends z.ZodType | undefined, TBody extends z.ZodType | undefined, TResponse> = (ctx: ApiContext, req: ApiRequest, ...args: [
     ...(TParams extends z.ZodType ? [params: z.infer<TParams>] : []),
     ...(TBody extends z.ZodType ? [body: z.infer<TBody>] : [])
 ]) => Promise<TResponse>;
@@ -85,7 +81,7 @@ export type RouteHandler<TParams extends z.ZodType | undefined, TBody extends z.
  * Guarded handler: receives guard context as first argument.
  * The guard context shape is computed from the declared guards.
  */
-export type GuardedRouteHandler<TGuards extends readonly GuardId[], TParams extends z.ZodType | undefined, TBody extends z.ZodType | undefined, TResponse> = (gc: ComputeGuardContext<TGuards>, ctx: ApiContext, req: ApiRequest, ...args: [
+type GuardedRouteHandler<TGuards extends readonly GuardId[], TParams extends z.ZodType | undefined, TBody extends z.ZodType | undefined, TResponse> = (gc: ComputeGuardContext<TGuards>, ctx: ApiContext, req: ApiRequest, ...args: [
     ...(TParams extends z.ZodType ? [params: z.infer<TParams>] : []),
     ...(TBody extends z.ZodType ? [body: z.infer<TBody>] : [])
 ]) => Promise<TResponse>;

package/dist/api/route-builder.js

@@ -12,7 +12,7 @@ import { executeGuards } from './guards.js';
 /**
  * Global registry - generator reads this
  */
-export const ROUTE_REGISTRY = [];
+const ROUTE_REGISTRY = [];
 /** Implementation — uses `any` for the union of overloaded config types */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function defineEndpoint(config) {

package/dist/api/routes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Every route table, assembled for http/router.ts. Server-only: the tables
+ * pull in node built-ins, so api/index.ts (reachable from client.ts) never
+ * re-exports this module. `pnpm lint:bundle` holds that edge and the
+ * `http-reaches-api-only-via-routes` dependency-cruiser rule holds this one.
+ */
+import type { RouteDefinition } from '../http/router.js';
+/**
+ * A function, not a top-level constant, so every route module is fully
+ * initialized before its exports are read.
+ */
+export declare function buildCanopyRoutes(): RouteDefinition[];

package/dist/api/routes.js

@@ -0,0 +1,47 @@
+/**
+ * Every route table, assembled for http/router.ts. Server-only: the tables
+ * pull in node built-ins, so api/index.ts (reachable from client.ts) never
+ * re-exports this module. `pnpm lint:bundle` holds that edge and the
+ * `http-reaches-api-only-via-routes` dependency-cruiser rule holds this one.
+ */
+import { BRANCH_ROUTES } from './branch.js';
+import { WORKFLOW_ROUTES } from './branch-status.js';
+import { COMMENT_ROUTES } from './comments.js';
+import { CONTENT_ROUTES } from './content.js';
+import { REFERENCE_OPTIONS_ROUTES } from './reference-options.js';
+import { RESOLVE_REFERENCES_ROUTES } from './resolve-references.js';
+import { ENTRY_ROUTES } from './entries.js';
+import { ASSET_ROUTES, assetRawRoute } from './assets.js';
+import { PERMISSION_ROUTES } from './permissions.js';
+import { GROUP_ROUTES } from './groups.js';
+import { USER_ROUTES } from './user.js';
+import { SCHEMA_ROUTES } from './schema.js';
+import { ADMIN_ROUTES } from './admin.js';
+/**
+ * A function, not a top-level constant, so every route module is fully
+ * initialized before its exports are read.
+ */
+export function buildCanopyRoutes() {
+    return [
+        ...Object.values(BRANCH_ROUTES),
+        ...Object.values(WORKFLOW_ROUTES),
+        ...Object.values(COMMENT_ROUTES),
+        ...Object.values(CONTENT_ROUTES),
+        ...Object.values(REFERENCE_OPTIONS_ROUTES),
+        ...Object.values(RESOLVE_REFERENCES_ROUTES),
+        ...Object.values(ENTRY_ROUTES),
+        ...Object.values(ASSET_ROUTES),
+        assetRawRoute,
+        ...Object.values(PERMISSION_ROUTES),
+        ...Object.values(GROUP_ROUTES),
+        ...Object.values(USER_ROUTES),
+        ...Object.values(SCHEMA_ROUTES),
+        ...Object.values(ADMIN_ROUTES),
+    ].map((route) => ({
+        method: route.method,
+        pattern: route.pattern,
+        handler: route.handler,
+        validate: 'validate' in route ? route.validate : undefined,
+        bodyFormat: 'bodyFormat' in route ? route.bodyFormat : undefined,
+    }));
+}

package/dist/api/schema.d.ts

@@ -1,11 +1,6 @@
 /**
  * Schema API - endpoints for managing collection structure.
  *
- * Provides CRUD operations for:
- * - Collections (create, read, update, delete)
- * - Entry types (add, update, remove)
- * - Ordering (update item order within collections)
- *
  * All mutations require Admin group membership.
  * Schema changes are branch-specific (like content edits).
  */
@@ -14,7 +9,7 @@ import type { ApiResponse } from './types.js';
 import type { ContentFormat, EntrySchema } from '../config/index.js';
 import { type LogicalPath, type ContentId } from '../paths/index.js';
 /** Entry type in wire format: schemaRef instead of resolved schema */
-export interface WireEntryType {
+interface WireEntryType {
     readonly name: string;
     readonly format: ContentFormat;
     readonly schemaRef: string;
@@ -23,7 +18,7 @@ export interface WireEntryType {
     readonly maxItems?: number;
 }
 /** Collection in wire format (entry types carry schemaRef, not resolved schema) */
-export interface WireCollectionConfig {
+interface WireCollectionConfig {
     readonly name: string;
     readonly path: string;
     readonly label?: string;
@@ -38,7 +33,7 @@ export interface WireCollectionConfig {
  * collections appear as their own flat items, linked via `parentPath`.
  * Embedding subtrees would re-serialize every collection once per ancestor.
  */
-export type WireFlatSchemaItem = {
+type WireFlatSchemaItem = {
     type: 'collection';
     logicalPath: LogicalPath;
     name: string;
@@ -58,12 +53,12 @@ export type WireFlatSchemaItem = {
     default?: boolean;
     maxItems?: number;
 };
-export interface SchemaResponse {
+interface SchemaResponse {
     flatSchema: WireFlatSchemaItem[];
     /** Entry schema definitions keyed by registry name */
     entrySchemas: Record<string, EntrySchema>;
 }
-export interface EntryTypeWithUsage {
+interface EntryTypeWithUsage {
     name: string;
     label?: string;
     format: ContentFormat;
@@ -73,36 +68,36 @@ export interface EntryTypeWithUsage {
     /** Number of entries using this entry type (for locking validation) */
     usageCount: number;
 }
-export interface CollectionResponse {
+interface CollectionResponse {
     collection: WireCollectionConfig | null;
     /** Entry types with usage counts (only present when collection exists) */
     entryTypesWithUsage?: EntryTypeWithUsage[];
 }
-export interface CreateCollectionResponse {
+interface CreateCollectionResponse {
     /** The logical path to the created collection (e.g., "posts" or "blog/posts") */
     collectionPath: LogicalPath;
     /** The unique 12-character content ID for the collection */
     contentId: ContentId;
 }
-export interface UpdateCollectionResponse {
+interface UpdateCollectionResponse {
     success: boolean;
 }
-export interface DeleteCollectionResponse {
+interface DeleteCollectionResponse {
     success: boolean;
 }
-export interface AddEntryTypeResponse {
+interface AddEntryTypeResponse {
     success: boolean;
 }
-export interface UpdateEntryTypeResponse {
+interface UpdateEntryTypeResponse {
     success: boolean;
 }
-export interface RemoveEntryTypeResponse {
+interface RemoveEntryTypeResponse {
     success: boolean;
 }
-export interface UpdateOrderResponse {
+interface UpdateOrderResponse {
     success: boolean;
 }
-export interface InvalidateSchemaCacheResponse {
+interface InvalidateSchemaCacheResponse {
     success: boolean;
     message: string;
 }
@@ -125,6 +120,7 @@ declare const updateOrderBodySchema: z.ZodObject<{
 }>;
 /**
  * GET /:branch/schema - Get full schema
+ * @internal Exported for tests.
  */
 export declare const getSchema: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -140,6 +136,7 @@ export declare const getSchema: import("./route-builder.js").RouteDefinition<z.Z
 /**
  * GET /:branch/schema/collection/...collectionPath - Get single collection
  * Note: Uses 'collection' (singular) with catch-all to support paths with slashes
+ * @internal Exported for tests.
  */
 export declare const getCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -161,6 +158,7 @@ export declare const getCollection: import("./route-builder.js").RouteDefinition
 }>, undefined, GetCollectionApiResponse>;
 /**
  * POST /:branch/schema/collections - Create collection
+ * @internal Exported for tests.
  */
 export declare const createCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -226,6 +224,7 @@ export declare const createCollection: import("./route-builder.js").RouteDefinit
 /**
  * PATCH /:branch/schema/collection/...collectionPath - Update collection
  * Note: Uses 'collection' (singular) with catch-all to support paths with slashes
+ * @internal Exported for tests.
  */
 export declare const updateCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -263,6 +262,7 @@ export declare const updateCollection: import("./route-builder.js").RouteDefinit
 /**
  * DELETE /:branch/schema/collection/...collectionPath - Delete collection
  * Note: Uses 'collection' (singular) with catch-all to support paths with slashes
+ * @internal Exported for tests.
  */
 export declare const deleteCollection: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -285,6 +285,7 @@ export declare const deleteCollection: import("./route-builder.js").RouteDefinit
 /**
  * POST /:branch/schema/entry-types/...collectionPath - Add entry type
  * Note: Restructured URL with catch-all at end to support paths with slashes
+ * @internal Exported for tests.
  */
 export declare const addEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -328,6 +329,7 @@ export declare const addEntryType: import("./route-builder.js").RouteDefinition<
 /**
  * PATCH /:branch/schema/entry-types/:entryTypeName/...collectionPath - Update entry type
  * Note: Restructured URL with entry type name before catch-all path
+ * @internal Exported for tests.
  */
 export declare const updateEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -371,6 +373,7 @@ export declare const updateEntryType: import("./route-builder.js").RouteDefiniti
 /**
  * DELETE /:branch/schema/entry-types/:entryTypeName/...collectionPath - Remove entry type
  * Note: Restructured URL with entry type name before catch-all path
+ * @internal Exported for tests.
  */
 export declare const removeEntryType: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -396,6 +399,7 @@ export declare const removeEntryType: import("./route-builder.js").RouteDefiniti
 /**
  * PATCH /:branch/schema/order/...collectionPath - Update item order
  * Note: Restructured URL with catch-all at end to support paths with slashes
+ * @internal Exported for tests.
  */
 export declare const updateOrder: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -421,20 +425,6 @@ export declare const updateOrder: import("./route-builder.js").RouteDefinition<z
 }, {
     order: string[];
 }>, UpdateOrderApiResponse>;
-/**
- * POST /:branch/schema/invalidate-cache - Invalidate schema cache
- */
-export declare const invalidateSchemaCache: import("./route-builder.js").RouteDefinition<z.ZodObject<{
-    branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
-}, "strip", z.ZodTypeAny, {
-    branch: string & {
-        readonly __brand: "BranchName";
-    };
-}, {
-    branch: string & {
-        readonly __brand: "BranchName";
-    };
-}>, undefined, InvalidateSchemaCacheApiResponse>;
 /** Body type for updateOrder endpoint */
 export type UpdateOrderBody = z.infer<typeof updateOrderBodySchema>;
 export declare const SCHEMA_ROUTES: {