canopycms 0.0.67 → 0.0.68-int.100

package/dist/context.d.ts

@@ -15,6 +15,10 @@
  * Only request-time reads on a server deployment resolve a branch workspace —
  * in dev, the clone under `.canopy-dev/content-branches/`.
  *
+ * A `branch` arrives from the request (a page passing `?branch=`), so only the
+ * active branch is ever provisioned here; any other name must already exist and
+ * pass the user's branch access before its files are read (`resolveBranch`).
+ *
  * The Next.js adapter wraps this in React `cache()` for per-request memoization
  * (`canopycms-next/src/context-wrapper.ts`).
  *
@@ -58,8 +62,12 @@ export interface CanopyBuildContext {
      * `meta.indexEntry` handed to `extract`, and a collection whose children are
      * all filtered out is pruned. On the build context and on static deployments
      * nothing is filtered — the synthetic admin sees everything.
+     *
+     * Branch: the `branch` option behaves as on `listEntries`.
      */
-    buildContentTree: <T = unknown, TEntryTypes = DefaultEntryTypes>(options?: BuildContentTreeOptions<T, TEntryTypes>) => Promise<ContentTreeNode<T>[]>;
+    buildContentTree: <T = unknown, TEntryTypes = DefaultEntryTypes>(options?: BuildContentTreeOptions<T, TEntryTypes> & {
+        branch?: string;
+    }) => Promise<ContentTreeNode<T>[]>;
     /**
      * Every content entry as a flat array.
      *
@@ -67,13 +75,18 @@ export interface CanopyBuildContext {
      * cannot `read` are omitted before `extract` runs; on the build context and
      * static deployments nothing is filtered.
      *
-     * Branch: unlike `read`/`readByUrlPath` this takes no `branch` option, always
-     * listing `defaultActiveBranch ?? defaultBaseBranch ?? 'main'`. In `dev` that
-     * tracks git HEAD via `refreshActiveBranch()`; in `prod` the refresh is a
-     * no-op, so it always reads the base branch. See
-     * `.claude/future-tasks/context-listing-branch-pinning.md`.
+     * Branch: with no `branch` it lists the active branch
+     * (`defaultActiveBranch ?? defaultBaseBranch`): git HEAD in `dev` when that is
+     * unset, otherwise usually the base branch in `prod`. Pass the preview
+     * iframe's `?branch=` as `branch`, as for `read`, so an index page previewed
+     * on a content branch lists that branch. Any other branch must already exist
+     * and, on the request-scoped context, be readable by the user; otherwise, or
+     * for an array, the result is empty. It selects nothing at build
+     * time or on static deployments.
      */
-    listEntries: <T = Record<string, unknown>>(options?: ListEntriesOptions<T>) => Promise<ListEntriesItem<T>[]>;
+    listEntries: <T = Record<string, unknown>>(options?: ListEntriesOptions<T> & {
+        branch?: string;
+    }) => Promise<ListEntriesItem<T>[]>;
     /**
      * Content reader, with the auth context applied automatically (admin at build
      * time).
@@ -83,6 +96,11 @@ export interface CanopyBuildContext {
      * output, since it reveals the deployment's filesystem layout (home dir, EFS
      * mount, branch name). It is for build-time reads of colocated artifacts, e.g.
      * `fs.readFile(path.join(path.dirname(result.meta.physicalPath), 'profile.json'))`.
+     *
+     * Branch: with no `branch` it reads the active branch, provisioning its workspace if missing.
+     * Any other branch must already exist and, on the request-scoped context, be readable by the
+     * user; otherwise, or for an array, it throws NOT_FOUND, so a hidden branch reads as a missing
+     * one. It selects nothing at build time or on static deployments.
      */
     read: <T = unknown>(input: {
         entryPath: string;
@@ -109,8 +127,8 @@ export interface CanopyBuildContext {
      *
      * Null when nothing matches — a collection URL with no index entry (use
      * buildContentTree), a non-entry path like `/favicon.ico` the slug validator
-     * rejects, or a path the user may not read, so a FORBIDDEN denial renders as
-     * a 404 via `notFound()` rather than a 500. Strict `read()` still throws.
+     * rejects, a missing branch, or a path or branch the user may not read, so a
+     * denial renders as a 404 via `notFound()`, not a 500. Strict `read()` throws.
      *
      * `meta.physicalPath` is **server-only**, for the reason given on `read`.
      * `meta.entryType`/`entryId` come free with path resolution, so one catch-all

package/dist/context.js

@@ -1,9 +1,9 @@
-import { isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER } from './build-mode.js';
+import { isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER } from './build-mode.js';
 import { createContentReader } from './content-reader.js';
 import { ContentStoreError } from './content-store.js';
-import { createLogicalPath, parseSlug, resolveBranchPaths } from './paths/index.js';
+import { createLogicalPath, namesNoWorkspace, parseSlug, resolveBranchPaths, } from './paths/index.js';
 import { resolveUrlPathCandidates } from './url-path-resolver.js';
-import { loadOrCreateBranchContext } from './branch-workspace.js';
+import { loadBranchContext, loadOrCreateBranchContext } from './branch-workspace.js';
 import { buildContentTree as buildContentTreeImpl, } from './content-tree.js';
 import { listEntries as listEntriesImpl, } from './content-listing.js';
 import { createDebugLogger } from './utils/debug.js';
@@ -22,6 +22,30 @@ function isLookupFailure(err) {
 function isPageSwallowable(err) {
     return isLookupFailure(err) || err.code === 'FORBIDDEN';
 }
+/**
+ * A `branch` option is typed `string` but usually handed over from untyped
+ * request input: a repeated `?branch=` arrives as an array, which names no
+ * branch, and `URLSearchParams.get` gives null for an absent one, which is no
+ * `branch` at all.
+ */
+function isBranchOption(branch) {
+    return branch == null || typeof branch === 'string';
+}
+/**
+ * A branch that already has a workspace, or null. A name that cannot name one
+ * is null too (`namesNoWorkspace`): it arrives from the request, so it reads as
+ * not-found rather than failing the page.
+ */
+async function loadExistingBranch(branchName, mode) {
+    try {
+        return await loadBranchContext({ branchName, mode });
+    }
+    catch (err) {
+        if (namesNoWorkspace(err))
+            return null;
+        throw err;
+    }
+}
 /**
  * Create a Canopy context managing auth + content reading. Framework-agnostic:
  * the adapter supplies extractUser.
@@ -46,7 +70,66 @@ export function createCanopyContext(options) {
         // switching branches mid-session updates what getCanopy() serves.
         await services.refreshActiveBranch();
         const user = await getUser();
-        const baseReader = createContentReader({ services });
+        // Read once, so every read and listing in this request agrees on it even if
+        // a concurrent request's refreshActiveBranch() replaces services.config.
+        const activeBranch = services.config.defaultActiveBranch ?? services.config.defaultBaseBranch ?? 'main';
+        // No ACL enforcement at build time, on static deployments, or for the
+        // synthetic admin. For the last this is load-bearing, not an optimization:
+        // that user has unconditional access anyway (path checks bypass entirely for
+        // an Admins-group user — authorization/path.ts), but BUILDING a path checker
+        // costs a getSettingsBranchRoot() call, which in modes with a separate
+        // settings branch provisions that branch's git workspace: an EFS round trip
+        // in prod. `createBuildCanopy` (build-canopy.ts) runs outside a request or
+        // Next.js build phase, so neither other guard fires for it, and without this
+        // one every such script pays for a settings-workspace clone it never needed —
+        // and hard-fails where that workspace cannot be provisioned. Compared by
+        // reference to the STATIC_DEPLOY_USER singleton, not by group membership, so
+        // a real authenticated admin at request time still goes through the real
+        // check.
+        const enforceAcls = !(isDeployedStatic(services.config) ||
+            isBuildMode() ||
+            user === STATIC_DEPLOY_USER);
+        /**
+         * `branch` when it names a branch other than the active one, else undefined:
+         * no `branch`, an empty one, the active one named explicitly, or any name
+         * when reading from the checkout, where it selects nothing.
+         */
+        const otherBranch = (branch) => branch && branch !== activeBranch && !readsFromCheckout(services.config) ? branch : undefined;
+        /**
+         * The workspace for the active branch (undefined) or another named one, or
+         * null when it yields nothing this user may see.
+         *
+         * The active branch is provisioned if missing. Any other name is load-only,
+         * never provisioned — a name with no workspace is null (`loadExistingBranch`) — and its branch
+         * access, held in its own metadata, is checked here, before its schema or
+         * content files are read, so a denied branch is indistinguishable from a
+         * missing one. The active branch's access is left to the caller: a listing
+         * of it lists nothing, and a strict `read` of it throws FORBIDDEN.
+         */
+        const resolveBranch = async (requested) => {
+            if (requested === undefined) {
+                return loadOrCreateBranchContext({
+                    config: services.config,
+                    branchName: activeBranch,
+                    mode: services.config.mode,
+                    createdBy: 'canopycms-context',
+                    remoteUrl: services.config.defaultRemoteUrl,
+                });
+            }
+            const context = await loadExistingBranch(requested, services.config.mode);
+            if (!context)
+                return null;
+            if (enforceAcls && !services.checkBranchAccess(context, user).allowed)
+                return null;
+            return context;
+        };
+        // The reader resolves every branch through resolveBranch; a null reads as
+        // NOT_FOUND. Reads from the checkout bypass the resolver inside the reader.
+        const baseReader = createContentReader({
+            services,
+            defaultBranch: activeBranch,
+            getBranchContext: (branchName) => resolveBranch(otherBranch(branchName)),
+        });
         // Injects the user and validates strings → branded types at this boundary.
         // `extra` carries options that are NOT part of the public `read` surface —
         // today just readByUrlPath's URL-addressability gate. A separate inner
@@ -63,10 +146,13 @@ export function createCanopyContext(options) {
                 }
                 slug = slugResult.slug;
             }
+            if (!isBranchOption(input.branch)) {
+                throw new ContentStoreError(`Branch not found: ${String(input.branch)}`, 'NOT_FOUND');
+            }
             const readInput = {
                 entryPath,
                 slug,
-                branch: input.branch,
+                branch: input.branch ?? undefined,
                 user,
                 resolveReferences: input.resolveReferences ?? true,
                 ...extra,
@@ -119,80 +205,78 @@ export function createCanopyContext(options) {
             }
             return null;
         };
-        /** Resolve branch workspace and schema — shared by buildContentTree and listEntries. Memoized per getContext call. */
-        let schemaContextPromise = null;
-        const resolveSchemaContextImpl = async () => {
-            const operatingMode = services.config.mode;
-            const defaultBranch = services.config.defaultActiveBranch ?? services.config.defaultBaseBranch ?? 'main';
-            const branchContext = await loadOrCreateBranchContext({
-                config: services.config,
-                branchName: defaultBranch,
-                mode: operatingMode,
-                createdBy: 'canopycms-context',
-                remoteUrl: services.config.defaultRemoteUrl,
-            });
-            const { branchRoot } = resolveBranchPaths(branchContext, operatingMode);
-            const contentRootName = services.config.contentRoot || 'content';
-            const { flatSchema } = await services.branchSchemaCache.getSchema(branchRoot, services.entrySchemaRegistry, contentRootName);
-            return { branchContext, branchRoot, flatSchema, contentRootName };
-        };
-        const resolveSchemaContext = () => {
-            if (!schemaContextPromise) {
-                schemaContextPromise = resolveSchemaContextImpl();
-            }
-            return schemaContextPromise;
-        };
         /**
-         * Path-ACL predicate for the batch reads (listEntries / buildContentTree),
-         * memoized per getContext call like the schema context above. Without it an
-         * unfiltered listing on this request-scoped, ACL-enforcing context would
-         * disclose full entry `data` for paths the user cannot `read()` directly.
-         *
-         * `services.createContentAccessChecker` is the shared batch primitive
-         * (api/entries.ts uses it too): it resolves the request-constant work —
-         * branch access, the settings/permissions root, the rule set — once, and
-         * returns a synchronous per-path check, so the per-entry cost is an admin
-         * short-circuit or one minimatch per configured rule, with no extra I/O.
-         *
-         * The empty object (no predicate → unfiltered) at build time, on static
-         * deployments, and for the synthetic admin is load-bearing, not an
-         * optimization. That user has unconditional access anyway (path checks
-         * bypass entirely for an Admins-group user — authorization/path.ts), but
-         * BUILDING the checker costs a getSettingsBranchRoot() call, which in modes
-         * with a separate settings branch provisions that branch's git workspace: an
-         * EFS round trip in prod. `createBuildCanopy` (build-canopy.ts) runs outside
-         * a request or Next.js build phase, so neither other guard fires for it, and
-         * without this one every such script pays for a settings-workspace clone it
-         * never needed — and hard-fails where that workspace cannot be provisioned.
+         * What a batch read (listEntries / buildContentTree) lists from: the branch's
+         * schema plus its path-ACL predicate, or null when the branch yields nothing
+         * this user may see. The branch resolves as for `read` (`resolveBranch`). At
+         * build time and on static deployments `branch` selects nothing, as for
+         * `read` (see the module doc).
          *
-         * Compared by reference to the STATIC_DEPLOY_USER singleton, not by group
-         * membership, so it stays scoped to the synthetic build identity: a real
-         * authenticated admin at request time still goes through the real check.
-         *
-         * Deliberately NOT wrapped in try/catch — createContentAccessChecker is
-         * fail-loud by contract, and swallowing would serve an unfiltered listing.
+         * Memoized per getContext call and per branch name, on the in-flight
+         * promise; a null result is memoized too, so one request answers a given
+         * name consistently. The memo is request-scoped, so it carries no
+         * generation protocol (docs/concurrency.md, "Adding a call-scoped memo").
          */
-        let visibilityPromise = null;
-        const resolveVisibilityImpl = async () => {
-            if (isDeployedStatic(services.config) || isBuildMode() || user === STATIC_DEPLOY_USER)
-                return {};
-            const { branchContext, branchRoot } = await resolveSchemaContext();
-            const checkAccess = await services.createContentAccessChecker(branchContext, branchRoot, user);
-            return { shouldInclude: (physicalPath) => checkAccess(physicalPath, 'read').allowed };
+        const listingSources = new Map();
+        const resolveListingSource = (branch) => {
+            if (!isBranchOption(branch))
+                return Promise.resolve(null);
+            const requested = otherBranch(branch);
+            const key = requested ?? activeBranch;
+            let source = listingSources.get(key);
+            if (!source) {
+                source = resolveListingSourceImpl(requested);
+                listingSources.set(key, source);
+            }
+            return source;
         };
-        const resolveVisibility = () => {
-            if (!visibilityPromise) {
-                visibilityPromise = resolveVisibilityImpl();
+        const resolveListingSourceImpl = async (requested) => {
+            const operatingMode = services.config.mode;
+            const branchContext = await resolveBranch(requested);
+            if (!branchContext)
+                return null;
+            // resolveBranch has already checked any other branch.
+            if (requested === undefined &&
+                enforceAcls &&
+                !services.checkBranchAccess(branchContext, user).allowed) {
+                return null;
             }
-            return visibilityPromise;
+            const { branchRoot } = resolveBranchPaths(branchContext, operatingMode);
+            const contentRootName = services.config.contentRoot || 'content';
+            const { flatSchema } = await services.branchSchemaCache.getSchema(branchRoot, services.entrySchemaRegistry, contentRootName);
+            if (!enforceAcls)
+                return { branchRoot, flatSchema, contentRootName, visibility: {} };
+            // The path-ACL predicate keeps an unfiltered listing on this ACL-enforcing
+            // context from disclosing entry `data` for paths the user cannot `read()`.
+            // `services.createContentAccessChecker` is the shared batch primitive
+            // (api/entries.ts uses it too): it resolves the request-constant work —
+            // branch access, the settings/permissions root, the rule set — once, and
+            // returns a synchronous per-path check, so the per-entry cost is an admin
+            // short-circuit or one minimatch per configured rule, with no extra I/O.
+            //
+            // Deliberately NOT wrapped in try/catch — createContentAccessChecker is
+            // fail-loud by contract, and swallowing would serve an unfiltered listing.
+            const checkAccess = await services.createContentAccessChecker(branchContext, branchRoot, user);
+            return {
+                branchRoot,
+                flatSchema,
+                contentRootName,
+                visibility: { shouldInclude: (logicalPath) => checkAccess(logicalPath, 'read').allowed },
+            };
         };
         const buildContentTree = async (options) => {
-            const { branchRoot, flatSchema, contentRootName } = await resolveSchemaContext();
-            return buildContentTreeImpl(branchRoot, flatSchema, contentRootName, options, await resolveVisibility());
+            const { branch, ...treeOptions } = options ?? {};
+            const source = await resolveListingSource(branch);
+            if (!source)
+                return [];
+            return buildContentTreeImpl(source.branchRoot, source.flatSchema, source.contentRootName, treeOptions, source.visibility);
         };
         const listEntries = async (options) => {
-            const { branchRoot, flatSchema, contentRootName } = await resolveSchemaContext();
-            return listEntriesImpl(branchRoot, flatSchema, contentRootName, options, await resolveVisibility());
+            const { branch, ...listOptions } = options ?? {};
+            const source = await resolveListingSource(branch);
+            if (!source)
+                return [];
+            return listEntriesImpl(source.branchRoot, source.flatSchema, source.contentRootName, listOptions, source.visibility);
         };
         return {
             read,

package/dist/editor/BranchManager.d.ts

@@ -62,11 +62,17 @@ export interface BranchManagerProps {
     /** Current user context for permission checks */
     user?: UserContext;
     onSelect?: (name: string) => void;
+    /** Awaited before the spinner starts, so a confirmation it shows never reads as a hung create. `false` abandons the create. */
+    onBeforeCreate?: () => Promise<boolean>;
+    /**
+     * Resolving `false` means the branch was not created, so the form stays open
+     * with the user's values; any other return (including none) closes it.
+     */
     onCreate?: (branch: {
         name: string;
         title?: string;
         description?: string;
-    }) => void;
+    }) => Promise<boolean> | void;
     onDelete?: (name: string) => void;
     onSubmit?: (name: string) => void;
     onWithdraw?: (name: string) => void;

package/dist/editor/BranchManager.js

@@ -1,6 +1,6 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
-import { useState } from 'react';
+import { useRef, useState } from 'react';
 import { Badge, Button, Group, Paper, ScrollArea, Stack, Text, TextInput, Textarea, Collapse, Tooltip, } from '@mantine/core';
 import { BranchComments } from './comments/BranchComments.js';
 import { UserBadge } from './components/UserBadge.js';
@@ -76,26 +76,41 @@ const statusColorMap = {
     editing: { color: 'brand', variant: 'light' },
     submitted: { color: 'green', variant: 'light' },
 };
-export const BranchManager = ({ branches, mode, user, onSelect, onCreate, onDelete, onSubmit, onWithdraw, onRequestChanges, onClose: _, comments = [], currentUserId, canResolve = false, onAddComment, onResolveThread, highlightThreadId, onGetUserMetadata, }) => {
+export const BranchManager = ({ branches, mode, user, onSelect, onBeforeCreate, onCreate, onDelete, onSubmit, onWithdraw, onRequestChanges, onClose: _, comments = [], currentUserId, canResolve = false, onAddComment, onResolveThread, highlightThreadId, onGetUserMetadata, }) => {
     const supportsBranching = clientOperatingStrategy(mode).supportsBranching();
     const [showCreateForm, setShowCreateForm] = useState(false);
     const [newBranchName, setNewBranchName] = useState('');
     const [newBranchTitle, setNewBranchTitle] = useState('');
     const [newBranchDescription, setNewBranchDescription] = useState('');
-    const handleCreate = () => {
-        if (!newBranchName.trim())
+    const [creating, setCreating] = useState(false);
+    // Read synchronously: state would not yet show a first click to a second one in the same tick.
+    const creatingRef = useRef(false);
+    const handleCreate = async () => {
+        if (creatingRef.current || !newBranchName.trim())
             return;
-        onCreate?.({
-            name: newBranchName.trim(),
-            title: newBranchTitle.trim() || undefined,
-            description: newBranchDescription.trim() || undefined,
-        });
-        setNewBranchName('');
-        setNewBranchTitle('');
-        setNewBranchDescription('');
-        setShowCreateForm(false);
+        creatingRef.current = true;
+        try {
+            if (onBeforeCreate && !(await onBeforeCreate()))
+                return;
+            setCreating(true);
+            const created = await onCreate?.({
+                name: newBranchName.trim(),
+                title: newBranchTitle.trim() || undefined,
+                description: newBranchDescription.trim() || undefined,
+            });
+            if (created === false)
+                return;
+            setNewBranchName('');
+            setNewBranchTitle('');
+            setNewBranchDescription('');
+            setShowCreateForm(false);
+        }
+        finally {
+            creatingRef.current = false;
+            setCreating(false);
+        }
     };
-    return (_jsxs(Stack, { h: "100%", style: { display: 'flex', flexDirection: 'column' }, gap: 0, "data-testid": "branch-manager", children: [currentUserId && onAddComment && onResolveThread && (_jsx(Stack, { pt: "sm", children: _jsx(BranchComments, { comments: comments, currentUserId: currentUserId, canResolve: canResolve, onAddComment: onAddComment, onResolveThread: onResolveThread, highlightThreadId: highlightThreadId, onGetUserMetadata: onGetUserMetadata }) })), !!supportsBranching && (_jsxs(Stack, { gap: "sm", pt: "sm", children: [_jsx(Button, { variant: "light", size: "sm", fullWidth: true, onClick: () => setShowCreateForm(!showCreateForm), "data-testid": "create-branch-button", children: showCreateForm ? 'Cancel' : 'Create New Branch' }), _jsx(Collapse, { in: showCreateForm, children: _jsx(Paper, { withBorder: true, p: "md", radius: "md", children: _jsxs(Stack, { gap: "sm", children: [_jsx(TextInput, { label: "Branch Name", placeholder: "feature/my-branch", value: newBranchName, onChange: (e) => setNewBranchName(e.target.value), required: true, "data-testid": "branch-name-input" }), _jsx(TextInput, { label: "Title (optional)", placeholder: "Brief description", value: newBranchTitle, onChange: (e) => setNewBranchTitle(e.target.value), "data-testid": "branch-title-input" }), _jsx(Textarea, { label: "Description (optional)", placeholder: "Detailed description of the changes", value: newBranchDescription, onChange: (e) => setNewBranchDescription(e.target.value), minRows: 2, "data-testid": "branch-description-textarea" }), _jsx(Button, { onClick: handleCreate, disabled: !newBranchName.trim(), fullWidth: true, "data-testid": "create-branch-submit", children: "Create Branch" })] }) }) })] })), _jsx(ScrollArea, { style: { flex: 1 }, pb: "md", children: branches.length === 0 ? (_jsx(Text, { size: "sm", c: "dimmed", py: "md", children: !supportsBranching ? 'Branch management is not available.' : 'No branches available.' })) : (_jsx(Stack, { gap: "sm", children: branches.map((b) => {
+    return (_jsxs(Stack, { h: "100%", style: { display: 'flex', flexDirection: 'column' }, gap: 0, "data-testid": "branch-manager", children: [currentUserId && onAddComment && onResolveThread && (_jsx(Stack, { pt: "sm", children: _jsx(BranchComments, { comments: comments, currentUserId: currentUserId, canResolve: canResolve, onAddComment: onAddComment, onResolveThread: onResolveThread, highlightThreadId: highlightThreadId, onGetUserMetadata: onGetUserMetadata }) })), !!supportsBranching && (_jsxs(Stack, { gap: "sm", pt: "sm", children: [_jsx(Button, { variant: "light", size: "sm", fullWidth: true, onClick: () => setShowCreateForm(!showCreateForm), disabled: creating, "data-testid": "create-branch-button", children: showCreateForm ? 'Cancel' : 'Create New Branch' }), _jsx(Collapse, { in: showCreateForm, children: _jsx(Paper, { withBorder: true, p: "md", radius: "md", children: _jsxs(Stack, { gap: "sm", children: [_jsx(TextInput, { label: "Branch Name", placeholder: "feature/my-branch", value: newBranchName, onChange: (e) => setNewBranchName(e.target.value), required: true, disabled: creating, "data-testid": "branch-name-input" }), _jsx(TextInput, { label: "Title (optional)", placeholder: "Brief description", value: newBranchTitle, onChange: (e) => setNewBranchTitle(e.target.value), disabled: creating, "data-testid": "branch-title-input" }), _jsx(Textarea, { label: "Description (optional)", placeholder: "Detailed description of the changes", value: newBranchDescription, onChange: (e) => setNewBranchDescription(e.target.value), minRows: 2, disabled: creating, "data-testid": "branch-description-textarea" }), _jsx(Button, { onClick: handleCreate, disabled: !newBranchName.trim(), loading: creating, fullWidth: true, "data-testid": "create-branch-submit", children: "Create Branch" })] }) }) })] })), _jsx(ScrollArea, { style: { flex: 1 }, pb: "md", children: branches.length === 0 ? (_jsx(Text, { size: "sm", c: "dimmed", py: "md", children: !supportsBranching ? 'Branch management is not available.' : 'No branches available.' })) : (_jsx(Stack, { gap: "sm", children: branches.map((b) => {
                         const statusColor = statusColorMap[b.status] ?? {
                             color: 'neutral',
                             variant: 'light',

package/dist/editor/CanopyEditor.d.ts

@@ -1,7 +1,7 @@
 import React from 'react';
 import type { CanopyClientConfig } from '../config/index.js';
 import type { EditorProps } from './Editor.js';
-export interface CanopyEditorProps extends Omit<EditorProps, 'collections' | 'previewBaseByCollection' | 'title' | 'subtitle' | 'themeOptions' | 'entries' | 'contentRoot' | 'operatingMode'> {
+export interface CanopyEditorProps extends Omit<EditorProps, 'collections' | 'previewBaseByCollection' | 'previewPrefix' | 'title' | 'subtitle' | 'themeOptions' | 'entries' | 'contentRoot' | 'operatingMode'> {
     config: CanopyClientConfig;
     entries?: EditorProps['entries'];
 }

package/dist/editor/CanopyEditor.js

@@ -4,13 +4,9 @@ import { useMemo } from 'react';
 import { Editor } from './Editor.js';
 import { ApiClientProvider } from './context/index.js';
 import { EditorAuthGate } from './EditorAuthGate.js';
-import { buildEditorCollections, buildPreviewBaseByCollection } from './editor-config.js';
+import { buildEditorCollections } from './editor-config.js';
 export const CanopyEditor = ({ config, entries = [], initialSelectedId, initialValues, renderPreview, onCreateEntry, branchName, customRenderers, }) => {
     const collections = useMemo(() => buildEditorCollections(config.flatSchema), [config.flatSchema]);
-    const previewBase = useMemo(() => ({
-        ...buildPreviewBaseByCollection(config, config.flatSchema),
-        ...(config.editor?.previewBase ?? {}),
-    }), [config]);
     // Empty string = branchless start; useBranchManager adopts the server's
     // detected default branch on the first branches.list() load.
     const resolvedBranchName = branchName ?? config.defaultActiveBranch ?? config.defaultBaseBranch ?? '';
@@ -19,6 +15,6 @@ export const CanopyEditor = ({ config, entries = [], initialSelectedId, initialV
     const resolvedTheme = config.editor?.theme ?? undefined;
     // The gate owns the SWRProvider (keyed by user id), so it sits between the API client and the
     // editor: see EditorAuthGate for what a signed-out or lapsed session renders.
-    return (_jsx(ApiClientProvider, { basePath: config.basePath, children: _jsx(EditorAuthGate, { SignInComponent: config.editor?.SignInComponent, themeOptions: resolvedTheme, children: _jsx(Editor, { entries: entries, title: resolvedTitle, subtitle: resolvedSubtitle, branchName: resolvedBranchName, operatingMode: config.mode, initialSelectedId: initialSelectedId, initialValues: initialValues, renderPreview: renderPreview, onCreateEntry: onCreateEntry, customRenderers: customRenderers, collections: collections, contentRoot: config.contentRoot, entryLinkUrl: config.entryLinkUrl, previewBaseByCollection: previewBase, assetBaseUrl: config.assetBaseUrl, basePath: config.basePath, themeOptions: resolvedTheme, AccountComponent: config.editor?.AccountComponent, onAccountClick: config.editor?.onAccountClick, onLogoutClick: config.editor?.onLogoutClick }) }) }));
+    return (_jsx(ApiClientProvider, { basePath: config.basePath, children: _jsx(EditorAuthGate, { SignInComponent: config.editor?.SignInComponent, themeOptions: resolvedTheme, children: _jsx(Editor, { entries: entries, title: resolvedTitle, subtitle: resolvedSubtitle, branchName: resolvedBranchName, operatingMode: config.mode, initialSelectedId: initialSelectedId, initialValues: initialValues, renderPreview: renderPreview, onCreateEntry: onCreateEntry, customRenderers: customRenderers, collections: collections, contentRoot: config.contentRoot, entryLinkUrl: config.entryLinkUrl, previewBaseByCollection: config.editor?.previewBase, previewPrefix: config.editor?.previewPrefix, basePath: config.basePath, themeOptions: resolvedTheme, AccountComponent: config.editor?.AccountComponent, onAccountClick: config.editor?.onAccountClick, onLogoutClick: config.editor?.onLogoutClick }) }) }));
 };
 export default CanopyEditor;

package/dist/editor/Editor.d.ts

@@ -57,11 +57,12 @@ export interface EditorProps {
     renderPreview?: (entry: EditorEntry, value: FormValue | undefined) => React.ReactNode;
     onCreateEntry?: (collectionPath: LogicalPath) => Promise<void> | void;
     themeOptions?: CanopyThemeOptions;
-    previewBaseByCollection?: Record<string, string>;
+    /** `editor.previewBase` from config (see `buildPreviewSrc`); `false` marks entries with no page. */
+    previewBaseByCollection?: Record<string, string | false>;
+    /** `editor.previewPrefix` from config: put in front of every preview iframe `src` (see `buildPreviewSrc`). */
+    previewPrefix?: string;
     currentUser?: string;
     canResolveComments?: boolean;
-    /** `media.publicBaseUrl` from config - prefixed onto asset URLs the editor builds (MediaLibrary/ImageField/MDX image dialog). Undefined means root-relative (editor and site share an origin). */
-    assetBaseUrl?: string;
     /**
      * `CanopyClientConfig.basePath` - the deployment prefix the host Next.js app is served under
      * (e.g. `/preview-123`). Prefixed onto every preview iframe `src` this component builds via