canopycms 0.0.67 → 0.0.68-int.101

package/dist/cli/github-app-manifest.d.ts

@@ -24,9 +24,10 @@ export type PermissionSet = Readonly<Record<string, PermissionLevel>>;
  * - `metadata: read` — implied by any repository permission; declared so
  *   this object states the whole surface, not just the non-automatic part.
  * Nothing else: no `issues`, `administration`, `actions`, or organisation
- * permissions. No `workflows` either, though GitHub may refuse to push
- * rebased history touching `.github/workflows/` — see
- * .claude/future-tasks/worker-push-refused-when-base-changes-workflows.md.
+ * permissions. No `workflows` either: GitHub refuses only workflow content it
+ * does not already hold, so rebasing onto a base that changed a workflow is
+ * accepted. Content that is new to GitHub fails the push task with the file
+ * named (`throwIfWorkflowRefusal` in worker/task-runner.ts).
  */
 export declare const CANOPY_APP_PERMISSIONS: PermissionSet;
 /**

package/dist/cli/github-app-manifest.js

@@ -22,9 +22,10 @@ const PERMISSION_LEVELS = ['read', 'write', 'admin'];
  * - `metadata: read` — implied by any repository permission; declared so
  *   this object states the whole surface, not just the non-automatic part.
  * Nothing else: no `issues`, `administration`, `actions`, or organisation
- * permissions. No `workflows` either, though GitHub may refuse to push
- * rebased history touching `.github/workflows/` — see
- * .claude/future-tasks/worker-push-refused-when-base-changes-workflows.md.
+ * permissions. No `workflows` either: GitHub refuses only workflow content it
+ * does not already hold, so rebasing onto a base that changed a workflow is
+ * accepted. Content that is new to GitHub fails the push task with the file
+ * named (`throwIfWorkflowRefusal` in worker/task-runner.ts).
  */
 export const CANOPY_APP_PERMISSIONS = {
     contents: 'write',

package/dist/cli/init.js

@@ -115,7 +115,8 @@ var init_field = __esm({
     });
     objectFieldSchema = fieldBaseSchema.extend({
       type: z.literal("object"),
-      fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+      fields: z.array(z.lazy(() => fieldHolder[0])).min(1),
+      itemTitleField: z.string().min(1).optional()
     });
     inlineGroupFieldSchema = z.object({
       type: z.literal("group"),
@@ -191,7 +192,7 @@ function isImplicitlyOffOrigin(url) {
     return false;
   }
 }
-function isHttpUrlOrSameOriginPath(value, opts = {}) {
+function isHttpUrlOrSameOriginPath(value) {
   if (value === "")
     return false;
   for (let index = 0; index < value.length; index++) {
@@ -215,9 +216,8 @@ function isHttpUrlOrSameOriginPath(value, opts = {}) {
       return false;
     }
   }
-  if (isImplicitlyOffOrigin(value)) {
-    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
-  }
+  if (isImplicitlyOffOrigin(value))
+    return false;
   return value.startsWith("/") && value[1] !== "/";
 }
 var SENTINEL_BASE, DOT_SEGMENT;
@@ -231,7 +231,7 @@ var init_sanitize_href = __esm({
 
 // dist/config/schemas/url.js
 import { z as z3 } from "zod";
-var uploadTargetUrlSchema, assetMountUrlSchema;
+var uploadTargetUrlSchema, previewPrefixSchema;
 var init_url = __esm({
   "dist/config/schemas/url.js"() {
     "use strict";
@@ -239,8 +239,8 @@ var init_url = __esm({
     uploadTargetUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
       message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
     });
-    assetMountUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
-      message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
+    previewPrefixSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+      message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
     });
   }
 });
@@ -256,7 +256,6 @@ var init_media = __esm({
     mediaSchema = z4.discriminatedUnion("adapter", [
       z4.object({
         adapter: z4.literal("local"),
-        publicBaseUrl: assetMountUrlSchema.optional(),
         /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
         directory: relativePathSchema.optional()
       }).strict(),
@@ -264,7 +263,6 @@ var init_media = __esm({
         adapter: z4.literal("s3"),
         bucket: z4.string().min(1),
         region: z4.string().min(1),
-        publicBaseUrl: assetMountUrlSchema.optional(),
         /**
          * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
          * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
@@ -274,18 +272,17 @@ var init_media = __esm({
          * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
          * alone, so the host never enters it (pinned by store-s3.test.ts).
          *
-         * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
-         * the POST target outright and is passed through byte-for-byte. Do not route it through
-         * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
-         * stop a CDN path pattern like `/asset-upload/*` from matching.
+         * NOT a prefix: nothing is joined onto this value; it replaces the POST target outright
+         * and is passed through byte-for-byte. Do not route it through `joinUrlPrefix` "for
+         * consistency" — that would strip the trailing slash and silently stop a CDN path
+         * pattern like `/asset-upload/*` from matching.
          */
         uploadUrl: uploadTargetUrlSchema.optional(),
         /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
         maxUploadBytes: z4.number().int().positive().optional()
       }).strict(),
       z4.object({
-        adapter: z4.literal("lfs"),
-        publicBaseUrl: assetMountUrlSchema.optional()
+        adapter: z4.literal("lfs")
       }).strict()
     ]);
   }
@@ -299,6 +296,7 @@ var init_config = __esm({
     "use strict";
     init_collection();
     init_media();
+    init_url();
     defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
     defaultPathAccessLevelSchema = z5.enum(["allow", "deny"]);
     defaultPathAccessLevelsSchema = z5.object({
@@ -329,7 +327,8 @@ var init_config = __esm({
       title: z5.string().optional(),
       subtitle: z5.string().optional(),
       theme: z5.unknown().optional(),
-      previewBase: z5.record(z5.string()).optional(),
+      previewBase: z5.record(z5.union([z5.string(), z5.literal(false)])).optional(),
+      previewPrefix: previewPrefixSchema.optional(),
       // UI handler functions (runtime only, don't serialize)
       onAccountClick: z5.function().returns(z5.void()).optional(),
       onLogoutClick: z5.function().returns(z5.void()).optional(),
@@ -357,6 +356,9 @@ var init_config = __esm({
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
       gitBotAuthorEmail: gitBotAuthorEmailSchema,
+      // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+      gitEditedByTrailers: z5.boolean().optional(),
+      gitCoAuthoredByTrailers: z5.boolean().optional(),
       githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
       // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
       // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -368,7 +370,6 @@ var init_config = __esm({
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
       allowNetworkRemoteInProd: z5.boolean().optional(),
       settingsBranch: z5.string().optional(),
-      autoCreateSettingsPR: z5.boolean().optional(),
       // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
       // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
       // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -384,7 +385,7 @@ var init_config = __esm({
       validateEntry: z5.custom().optional(),
       dev: devConfigSchema.optional()
     }).strict();
-    DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
+    DEFAULT_PROD_WORKSPACE = "/mnt/efs";
   }
 });
 
@@ -889,6 +890,10 @@ var init_debug = __esm({
           throw new Error(errorMsg);
         }
       }
+      /**
+       * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+       * anything that can run concurrently uses {@link timed}.
+       */
       time(label) {
         this.timers.set(label, Date.now());
       }
@@ -903,12 +908,16 @@ var init_debug = __esm({
         this.debug(category, `${label} completed`, { durationMs: duration });
         return duration;
       }
+      /**
+       * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+       * call, so concurrent spans with the same label on one logger never overwrite each other.
+       */
       async timed(category, label, fn) {
-        this.time(label);
+        const start = Date.now();
         try {
           return await fn();
         } finally {
-          this.timeEnd(category, label);
+          this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
         }
       }
     };
@@ -1525,9 +1534,6 @@ var ProdStrategy = class extends ProdClientSafeStrategy {
       throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
     }
   }
-  shouldCreateSettingsPR(config) {
-    return config.autoCreateSettingsPR ?? true;
-  }
 };
 var DevStrategy = class extends DevClientSafeStrategy {
   getWorkspaceRoot(sourceRoot) {
@@ -1574,9 +1580,6 @@ var DevStrategy = class extends DevClientSafeStrategy {
   }
   validateConfig(_config) {
   }
-  shouldCreateSettingsPR(_config) {
-    return false;
-  }
 };
 var strategyCache = /* @__PURE__ */ new Map();
 function operatingStrategy(mode) {

package/dist/cli/migrate.js

@@ -21,8 +21,9 @@ import { parseSlug } from '../paths/index.js';
 import { filePathExists } from '../utils/fs.js';
 import { loadCollectionMetaFiles } from '../schema/index.js';
 import { getErrorMessage } from '../utils/error.js';
-import { withLock } from '../utils/async-mutex.js';
-import { withOccFileLock, OccWriteConflictError } from '../utils/occ-json-write.js';
+import { ContentWriteLockBusyError } from '../utils/content-write-lock.js';
+import { OccWriteConflictError } from '../utils/occ-json-write.js';
+import { withBranchSchemaLock } from '../schema/schema-store.js';
 import { BranchMetadataFileManager } from '../branch-metadata.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
 const MIGRATE_FORMATS = ['md', 'mdx', 'json', 'yaml'];
@@ -245,18 +246,21 @@ export async function migrate(options) {
     };
     if (isBranchClone) {
         // projectDir IS the branch root in this case (see the invariant note
-        // above) — the same surrogate lock path SchemaOps uses for its own
-        // schema mutations (schema-store.ts's withSchemaLock), so a migrate run
-        // racing a live schema-editing request on this same branch clone
-        // serializes against it instead of silently interleaving writes.
-        const lockPath = path.join(projectDir, '.canopy-meta', 'schema');
+        // above). The renames rewrite the working tree the worker rebases, so this
+        // takes the same locks SchemaOps does for its own schema mutations: the
+        // content-write lock, then the schema surrogate.
         try {
-            await withLock(lockPath, () => withOccFileLock(lockPath, applyOps));
+            await withBranchSchemaLock(projectDir, applyOps);
         }
         catch (err) {
             if (err instanceof OccWriteConflictError) {
                 throw new MigrateError('Another process is modifying the schema, try again.');
             }
+            if (err instanceof ContentWriteLockBusyError) {
+                throw new MigrateError(err.outcome === 'unknown'
+                    ? 'The branch was being synced while migrate ran, so it may be partly applied. Check its state before running migrate again.'
+                    : err.message);
+            }
             throw err;
         }
     }

package/dist/cli/sync.js

@@ -17,8 +17,10 @@ import path from 'node:path';
 import { simpleGit } from 'simple-git';
 import * as p from '@clack/prompts';
 import { filePathExists } from '../utils/fs.js';
+import { isCanopyInternalPath, stageAllExceptCanopyState } from '../utils/git.js';
 import { assertWithinDir, copyDir, listFilesRecursive, pushContentToWorkspace, safeReplaceDir, SYNC_BASE_TAG, } from '../sync-core.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
+import { ContentWriteLockBusyError, withContentWriteLock } from '../utils/content-write-lock.js';
 import { ensureGitExcludePattern } from '../git-manager.js';
 import { operatingStrategy } from '../operating-mode/index.js';
 /**
@@ -32,6 +34,42 @@ class SyncError extends Error {
         this.name = 'SyncError';
     }
 }
+/**
+ * [SYNC-C1] Every sync step that rewrites a branch workspace (content replace, checkout, merge,
+ * merge abort) runs under the workspace's content-write lock, which the dev server's saves and
+ * the worker's rebase also take. Contention becomes a `SyncError`, so the CLI exits non-zero.
+ */
+function lockBusyAsSyncError(err, branchName) {
+    if (!(err instanceof ContentWriteLockBusyError))
+        return err;
+    return new SyncError(err.outcome === 'not-run'
+        ? `Branch workspace "${branchName}" is busy (the worker is syncing it, or an editor save is in flight); nothing was changed. Try again in a moment.`
+        : `Branch workspace "${branchName}" was being synced during this run, so it may be partly updated. Check its state before running sync again.`);
+}
+async function withWorkspaceLock(branchPath, branchName, fn) {
+    try {
+        return await withContentWriteLock(branchPath, fn);
+    }
+    catch (err) {
+        throw lockBusyAsSyncError(err, branchName);
+    }
+}
+/**
+ * `git merge --abort` in a workspace left mid-merge, re-checking under the lock that it still is.
+ * Returns whether a merge was aborted.
+ */
+async function abortWorkspaceMerge(branchPath, branchName) {
+    return withWorkspaceLock(branchPath, branchName, async () => {
+        const wsGit = simpleGit({ baseDir: branchPath });
+        if ((await wsGit.status()).conflicted.length === 0)
+            return false;
+        await wsGit.merge(['--abort']);
+        // The abort rewrote the clone's working tree — tell ContentStore ID
+        // indexes (the dev server is a separate process; on-disk marker).
+        await invalidateBranchContentCaches(branchPath);
+        return true;
+    });
+}
 /** Detect the current git branch name from the working tree. */
 async function detectCurrentBranch(projectDir) {
     const git = simpleGit({ baseDir: projectDir });
@@ -140,22 +178,21 @@ async function syncPush(options) {
                 initialValue: false,
             });
             if (!p.isCancel(shouldAbort) && shouldAbort) {
-                await wsGit.merge(['--abort']);
-                // The abort rewrote the clone's working tree — tell ContentStore ID
-                // indexes (the dev server is a separate process; on-disk marker).
-                await invalidateBranchContentCaches(branchPath);
-                p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                if (await abortWorkspaceMerge(branchPath, branchName)) {
+                    p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                }
             }
         }
         return { fileCount: 0 };
     }
-    if (status.files.length > 0 && !options.force) {
-        p.log.warn(`Branch workspace has ${status.files.length} uncommitted change(s) that will be committed to history then overwritten:`);
-        for (const file of status.files.slice(0, 10)) {
+    const editorChanges = status.files.filter((f) => !isCanopyInternalPath(f.path));
+    if (editorChanges.length > 0 && !options.force) {
+        p.log.warn(`Branch workspace has ${editorChanges.length} uncommitted change(s) that will be committed to history then overwritten:`);
+        for (const file of editorChanges.slice(0, 10)) {
             p.log.warn(`  ${file.path}`);
         }
-        if (status.files.length > 10) {
-            p.log.warn(`  ... and ${status.files.length - 10} more`);
+        if (editorChanges.length > 10) {
+            p.log.warn(`  ... and ${editorChanges.length - 10} more`);
         }
         const confirm = await p.confirm({
             message: 'Continue? Editor changes will be preserved in git history.',
@@ -166,20 +203,26 @@ async function syncPush(options) {
             return { fileCount: 0 };
         }
     }
-    // Auto-commit uncommitted workspace changes to preserve in history
-    if (status.files.length > 0) {
-        await wsGit.add('-A');
-        await wsGit.commit('sync: save editor state before push');
-        p.log.info('Committed editor changes to history before push');
-    }
     p.log.step(`Pushing content to branch workspace: ${branchName}`);
-    // Copy working-tree content → workspace content dir, commit, and tag the sync base.
-    const { fileCount } = await pushContentToWorkspace({
-        srcContentDir,
-        branchPath,
-        contentRoot,
-        baseTag: SYNC_BASE_TAG,
-    });
+    // Commit any editor changes (re-read under the lock, so a save landing after
+    // the listing above is preserved too), copy working-tree content → workspace
+    // content dir, commit, and tag the sync base.
+    let fileCount;
+    try {
+        const result = await pushContentToWorkspace({
+            srcContentDir,
+            branchPath,
+            contentRoot,
+            baseTag: SYNC_BASE_TAG,
+            saveEditorStateMessage: 'sync: save editor state before push',
+        });
+        fileCount = result.fileCount;
+        if (result.savedEditorState)
+            p.log.info('Committed editor changes to history before push');
+    }
+    catch (err) {
+        throw lockBusyAsSyncError(err, branchName);
+    }
     if (fileCount === 0) {
         p.log.info('Content is already up to date — nothing to push');
     }
@@ -321,16 +364,23 @@ async function syncBoth(options) {
                 initialValue: false,
             });
             if (!p.isCancel(shouldAbort) && shouldAbort) {
-                await wsGit.merge(['--abort']);
-                await invalidateBranchContentCaches(branchPath);
-                p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                if (await abortWorkspaceMerge(branchPath, branchName)) {
+                    p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                }
             }
         }
         return { pushed: 0, pulled: 0 };
     }
+    return withWorkspaceLock(branchPath, branchName, () => mergeIntoWorkspace(options, { branchName, branchPath, srcContentDir, contentRoot }));
+}
+/** The locked body of {@link syncBoth}: everything that rewrites the workspace. */
+async function mergeIntoWorkspace(options, ws) {
+    const { branchName, branchPath, srcContentDir, contentRoot } = ws;
+    const wsGit = simpleGit({ baseDir: branchPath });
+    const status = await wsGit.status();
     // Auto-commit uncommitted workspace changes (preserves editor work for the merge)
-    if (status.files.length > 0) {
-        await wsGit.add('-A');
+    if (status.files.some((f) => !isCanopyInternalPath(f.path))) {
+        await stageAllExceptCanopyState(wsGit);
         await wsGit.commit('sync: save editor state before merge');
         p.log.info('Committed editor changes before merge');
     }
@@ -365,9 +415,9 @@ async function syncBoth(options) {
             await wsGit.raw(['branch', '-D', incomingBranch]).catch(() => { });
             throw err;
         }
-        await wsGit.add('-A');
-        const incomingStatus = await wsGit.status();
-        if (incomingStatus.files.length === 0) {
+        await stageAllExceptCanopyState(wsGit);
+        const incomingFiles = (await wsGit.status()).files.filter((f) => !isCanopyInternalPath(f.path));
+        if (incomingFiles.length === 0) {
             await wsGit.checkout(currentBranch);
             await wsGit.raw(['branch', '-D', incomingBranch]);
             p.log.info('No working-tree changes to merge — pulling editor changes only');
@@ -410,7 +460,7 @@ async function syncBoth(options) {
         await wsGit.tag(['-f', SYNC_BASE_TAG]);
         p.log.success('Merged working-tree changes with editor changes');
         const pullResult = await syncPull({ ...options, branch: branchName, force: true });
-        return { pushed: incomingStatus.files.length, pulled: pullResult.fileCount };
+        return { pushed: incomingFiles.length, pulled: pullResult.fileCount };
     }
     finally {
         await invalidateBranchContentCaches(branchPath);
@@ -428,14 +478,10 @@ async function syncAbort(options) {
         return;
     const branchPath = path.join(branchesDir, branchName);
     assertWithinDir(branchPath, branchesDir, '--branch');
-    const wsGit = simpleGit({ baseDir: branchPath });
-    const status = await wsGit.status();
-    if (status.conflicted.length === 0) {
+    if (!(await abortWorkspaceMerge(branchPath, branchName))) {
         p.log.info(`Branch workspace "${branchName}" is not in a merge state — nothing to abort.`);
         return;
     }
-    await wsGit.merge(['--abort']);
-    await invalidateBranchContentCaches(branchPath);
     p.log.success(`Merge aborted in branch workspace "${branchName}". Workspace restored to pre-merge state.`);
 }
 /**

package/dist/cli/template-files/Dockerfile.cms.template

@@ -73,5 +73,13 @@ COPY --from=builder /app/public ./public
 # Lambda's filesystem is read-only outside /tmp. Next may write to .next/cache
 # at runtime; symlink it to /tmp so those writes succeed instead of failing (EROFS).
 RUN rm -rf .next/cache && ln -s /tmp .next/cache
+# The CMS reports this in System health. A build arg, not a Lambda environment
+# variable: a Lambda variable names the infrastructure's commit and would hide
+# exactly the image/infrastructure skew this exists to reveal. Declared after
+# every build layer, so with a warm layer cache a new revision re-runs only the
+# metadata steps from here down.
+ARG CANOPY_SOURCE_SHA=
+ENV CANOPY_SOURCE_SHA=$CANOPY_SOURCE_SHA
+LABEL org.opencontainers.image.revision=$CANOPY_SOURCE_SHA
 ENV PORT=8080 AWS_LWA_PORT=8080 HOSTNAME=0.0.0.0 NODE_ENV=production
 CMD ["node", "server.js"]

package/dist/cli/template-files/cdk-app.ts.template

@@ -126,4 +126,8 @@ new CmsStack(app, '{{STACK_NAME}}', {
   // point your own existing distribution at it.
   domainName: process.env.CMS_DOMAIN_NAME || undefined,
   hostedZoneDomain: process.env.CMS_HOSTED_ZONE_DOMAIN || undefined,
+
+  // Optional, and NOT `required()`: the commit the CMS image is built from,
+  // shown in System health. Unset, System health reports it as "not set".
+  sourceRevision: process.env.CANOPY_SOURCE_SHA || undefined,
 })

package/dist/cli/template-files/cms-stack.ts.template

@@ -77,6 +77,8 @@ export interface CmsStackProps extends StackProps {
   domainName?: string
   /** Optional Route53 hosted zone domain, e.g. 'example.org'. */
   hostedZoneDomain?: string
+  /** Optional. Commit the CMS image is built from; shown in System health. */
+  sourceRevision?: string
 }
 
 export class CmsStack extends Stack {
@@ -128,6 +130,10 @@ export class CmsStack extends Stack {
           // auth. The image's own `next build` stays in dev mode either way --
           // see Dockerfile.cms.
           NEXT_PUBLIC_CANOPY_MODE: 'prod',
+          // CDK hashes build args into the asset, so every new commit rebuilds
+          // the image, even one changing only the dockerignored infrastructure/
+          // -- that is what keeps the revision the CMS reports honest.
+          ...(props.sourceRevision ? { CANOPY_SOURCE_SHA: props.sourceRevision } : {}),
         },
       }),
       // The one place the CMS image's CPU architecture is decided. CDK derives
@@ -186,22 +192,21 @@ export class CmsStack extends Stack {
       },
 
       memorySize: 2048,
-      reservedConcurrency: 10,
+      // A ceiling, free while idle. The editor's static chunks count against it
+      // until CloudFront caches them, and a cold editor load requests them
+      // together, so synth warns below 20. See the prop's doc comment.
+      reservedConcurrency: 50,
     })
 
-    // Media support (uploads, on-demand image transforms). To enable it:
+    // Media support (uploads and image derivatives). To enable it:
     //
     //   1. add `AssetSupport` to the `canopycms-cdk` import at the top;
     //   2. uncomment the block below, moving it ABOVE `cmsService` (it has to
     //      exist before you can pass its bucket);
     //   3. pass `assetBucket: assetSupport.bucket` to CanopyCmsService;
     //   4. pass `assetSupport` to CanopyCmsDistribution below - it attaches
-    //      both CloudFront behaviors in the only order that is safe
-    //      (`/assets/t/*` before `/assets/*`; CloudFront matches path
-    //      patterns in order, so the general pattern would otherwise
-    //      swallow the transform one). `cdk synth` fails loudly if a
-    //      hand-written `additionalBehaviors` ever gets that order wrong
-    //      instead.
+    //      `/assets/t/*` before `/assets/*`, the order CloudFront needs, and
+    //      `cdk synth` fails if a hand-written `additionalBehaviors` does not.
     //
     // `editorOrigins` is the S3 CORS allowlist for the editor's presigned
     // uploads, so it must list the origin the editor is served from. Include
@@ -211,11 +216,17 @@ export class CmsStack extends Stack {
     // CloudFront edge instead); with neither, a construct-created bucket
     // refuses to synth.
     //
-    // Run `pnpm --filter canopycms-cdk run build:lambda` before deploying --
-    // the transform Lambda needs its native sharp binary, and the construct
-    // refuses to synth without it.
+    // `/assets/*` and `/assets/t/*` serve only what is in the bucket and
+    // compute nothing: an image derivative no one wrote is a 403. Write every
+    // derivative a site build references before releasing that build, with
+    // `canopycms collect-asset-refs <outDir>` after the build and then
+    // `canopycms materialize-assets --refs <outDir>/canopy-asset-refs.json`.
+    // To compute missing derivatives on request instead, pass
+    // `lazyPublicTransforms: true`; that deploys a transform Lambda, so inside
+    // this monorepo run `pnpm --filter canopycms-cdk run build:lambda` first
+    // (the published package ships it built).
     //
-    // See the assets section of docs/deploying-to-aws.md.
+    // See "Media: the public image path" in docs/deploying-to-aws.md.
     //
     // const assetSupport = new AssetSupport(this, 'Assets', {
     //   editorOrigins: [`https://${props.domainName}`],

package/dist/cli/template-files/deploy-cms.yml.template

@@ -241,4 +241,6 @@ jobs:
           CANOPYCMS_DEPLOYMENT_NAME: ${{ vars.CANOPYCMS_DEPLOYMENT_NAME }}
           CMS_DOMAIN_NAME: ${{ vars.CMS_DOMAIN_NAME }}
           CMS_HOSTED_ZONE_DOMAIN: ${{ vars.CMS_HOSTED_ZONE_DOMAIN }}
+          # The commit the CMS image is built from, reported in System health.
+          CANOPY_SOURCE_SHA: ${{ github.sha }}
         run: npx cdk deploy {{STACK_NAME}} --require-approval never

package/dist/client.d.ts

@@ -3,7 +3,7 @@ export type { CustomFieldRenderers, CustomFieldRenderProps } from './editor/Form
 export * from './editor/EditorPanes.js';
 export * from './editor/EntryNavigator.js';
 export * from './editor/Editor.js';
-export * from './editor/preview-bridge.js';
+export { PreviewFrame } from './editor/PreviewFrame.js';
 export * from './editor/canopy-path.js';
 export * from './editor/theme.js';
 export * from './editor/editor-config.js';

package/dist/client.js

@@ -2,7 +2,7 @@
 export * from './editor/EditorPanes.js';
 export * from './editor/EntryNavigator.js';
 export * from './editor/Editor.js';
-export * from './editor/preview-bridge.js';
+export { PreviewFrame } from './editor/PreviewFrame.js';
 export * from './editor/canopy-path.js';
 export * from './editor/theme.js';
 export * from './editor/editor-config.js';

package/dist/config/helpers.js

@@ -33,7 +33,7 @@ export function defineCanopyConfig(config) {
         server: validated,
         // Client config helper - extracts safe subset and merges overrides
         client: (clientOverrides) => {
-            const { defaultBaseBranch, defaultActiveBranch, contentRoot, editor, mode, entryLinkUrl, media, basePath, } = validated;
+            const { defaultBaseBranch, defaultActiveBranch, contentRoot, editor, mode, entryLinkUrl, basePath, } = validated;
             // flatSchema is loaded dynamically by the editor via API (from .collection.json files)
             const clientConfig = {
                 defaultBaseBranch,
@@ -42,7 +42,6 @@ export function defineCanopyConfig(config) {
                 editor,
                 mode,
                 entryLinkUrl,
-                assetBaseUrl: media?.publicBaseUrl,
                 basePath,
                 flatSchema: [],
             };