canopycms 0.0.67 → 0.0.68-int.93

package/dist/ai/handler.js

@@ -13,6 +13,7 @@
 import { ContentStore } from '../content-store.js';
 import { BranchSchemaCache } from '../branch-schema-cache.js';
 import { getErrorMessage } from '../utils/error.js';
+import { workerNotReadyResponse } from '../http/worker-not-ready.js';
 import { generateAIContent } from './generate.js';
 import { resolveBranchRoot } from './resolve-branch.js';
 /**
@@ -76,6 +77,13 @@ export function createAIContentHandler(options) {
         catch (error) {
             // Log the real error server-side; don't leak internals to unauthenticated callers
             console.error('AI content handler error:', getErrorMessage(error));
+            const notReady = workerNotReadyResponse(error);
+            if (notReady) {
+                return new Response(JSON.stringify({ error: notReady.body.error }), {
+                    status: notReady.status,
+                    headers: { 'Content-Type': 'application/json', ...notReady.headers },
+                });
+            }
             return new Response(JSON.stringify({ error: 'Internal server error' }), {
                 status: 500,
                 headers: { 'Content-Type': 'application/json' },

package/dist/api/admin-branch-health.js

@@ -22,7 +22,7 @@ import { ContentIdIndex } from '../content-id-index.js';
 import { invalidateContentIndexesDurable } from '../content-index-generation.js';
 import { getDefaultBranchBase, sanitizeBranchName } from '../paths/index.js';
 import { withOccFileLock } from '../utils/occ-json-write.js';
-import { tryAcquireProvisioningLock } from '../utils/provisioning-lock.js';
+import { branchProvisioningLockName, tryAcquireProvisioningLock } from '../utils/provisioning-lock.js';
 import { withContentWriteLock, ContentWriteLockBusyError, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, } from '../utils/content-write-lock.js';
 import { getErrorMessage, isNodeError, isNotFoundError } from '../utils/error.js';
 import { defineEndpoint } from './route-builder.js';
@@ -147,12 +147,17 @@ const purgeBranchDirHandler = async (_gc, ctx, _req, params) => {
     // True orphan (no branch.json, no load error) vs. corrupt-metadata
     // (loadOnly threw). Only true orphans are subject to the youth rail below.
     const isTrueOrphan = !hadLoadError;
-    // [H1] freshness rail: a fresh init lock means provisioning may genuinely
-    // be in progress; a stale one is just crash debris and does not block.
-    const lockPath = path.join(baseRoot, `.${params.dirName}.init.lock`);
+    // [H1] freshness rail: a fresh init lock means provisioning, or the worker's
+    // sync of this branch, may genuinely be in progress; a stale one is just
+    // crash debris and does not block.
+    const lockPath = path.join(baseRoot, branchProvisioningLockName(params.dirName));
     const lockStat = await fs.stat(lockPath).catch(() => null);
     if (lockStat && Date.now() - lockStat.mtimeMs < PROVISIONING_LOCK_FRESH_MS) {
-        return { ok: false, status: 409, error: 'Provisioning may be in progress' };
+        return {
+            ok: false,
+            status: 409,
+            error: 'Provisioning, or the worker syncing this branch, may be in progress',
+        };
     }
     // Youth rail: a brand-new orphan dir may be a clone that just hasn't
     // written branch.json yet. Corrupt-metadata dirs are exempt -- a
@@ -171,7 +176,7 @@ const purgeBranchDirHandler = async (_gc, ctx, _req, params) => {
     // contention instead of hanging the request for ~5 minutes.
     let releaseProvisioningLock;
     try {
-        releaseProvisioningLock = await tryAcquireProvisioningLock(baseRoot, `.${params.dirName}.init.lock`);
+        releaseProvisioningLock = await tryAcquireProvisioningLock(baseRoot, branchProvisioningLockName(params.dirName));
     }
     catch (err) {
         if (isNodeError(err) && err.code === 'ELOCKED') {
@@ -279,7 +284,7 @@ const repairBranchDirHandler = async (_gc, ctx, req, params) => {
     // Held until the `finally` below, AFTER save() completes.
     let releaseProvisioningLock;
     try {
-        releaseProvisioningLock = await tryAcquireProvisioningLock(baseRoot, `.${params.dirName}.init.lock`);
+        releaseProvisioningLock = await tryAcquireProvisioningLock(baseRoot, branchProvisioningLockName(params.dirName));
     }
     catch (err) {
         if (isNodeError(err) && err.code === 'ELOCKED') {

package/dist/api/admin.d.ts

@@ -54,10 +54,10 @@ declare const listAdminTasksParamsSchema: z.ZodObject<{
     status: z.ZodEnum<["pending", "processing", "completed", "failed", "corrupt"]>;
     limit: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
-    status: "pending" | "processing" | "completed" | "failed" | "corrupt";
+    status: "failed" | "pending" | "processing" | "completed" | "corrupt";
     limit?: number | undefined;
 }, {
-    status: "pending" | "processing" | "completed" | "failed" | "corrupt";
+    status: "failed" | "pending" | "processing" | "completed" | "corrupt";
     limit?: number | undefined;
 }>;
 export type ListAdminTasksParams = z.infer<typeof listAdminTasksParamsSchema>;
@@ -65,10 +65,10 @@ declare const deleteTaskParamsSchema: z.ZodObject<{
     status: z.ZodEnum<["pending", "failed", "corrupt"]>;
     fileName: z.ZodEffects<z.ZodString, string, string>;
 }, "strip", z.ZodTypeAny, {
-    status: "pending" | "failed" | "corrupt";
+    status: "failed" | "pending" | "corrupt";
     fileName: string;
 }, {
-    status: "pending" | "failed" | "corrupt";
+    status: "failed" | "pending" | "corrupt";
     fileName: string;
 }>;
 export type DeleteTaskParams = z.infer<typeof deleteTaskParamsSchema>;
@@ -108,10 +108,10 @@ export declare const ADMIN_ROUTES: {
         status: z.ZodEnum<["pending", "processing", "completed", "failed", "corrupt"]>;
         limit: z.ZodOptional<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        status: "pending" | "processing" | "completed" | "failed" | "corrupt";
+        status: "failed" | "pending" | "processing" | "completed" | "corrupt";
         limit?: number | undefined;
     }, {
-        status: "pending" | "processing" | "completed" | "failed" | "corrupt";
+        status: "failed" | "pending" | "processing" | "completed" | "corrupt";
         limit?: number | undefined;
     }>, undefined, AdminTasksResponse>;
     readonly retryTask: import("./route-builder.js").RouteDefinition<z.ZodObject<{
@@ -125,10 +125,10 @@ export declare const ADMIN_ROUTES: {
         status: z.ZodEnum<["pending", "failed", "corrupt"]>;
         fileName: z.ZodEffects<z.ZodString, string, string>;
     }, "strip", z.ZodTypeAny, {
-        status: "pending" | "failed" | "corrupt";
+        status: "failed" | "pending" | "corrupt";
         fileName: string;
     }, {
-        status: "pending" | "failed" | "corrupt";
+        status: "failed" | "pending" | "corrupt";
         fileName: string;
     }>, undefined, AdminDeleteTaskResponse>;
 };

package/dist/api/branch-status.js

@@ -8,6 +8,7 @@ import { canPerformWorkflowAction, getBranchProtection } from '../authorization/
 import { syncSubmitPr } from './github-sync.js';
 import { getErrorMessage, redactCredentials, sanitizeErrorMessage } from '../utils/error.js';
 import { isNonFastForwardRejection } from '../utils/git.js';
+import { submissionEditorFromUser } from '../submission-attribution.js';
 const getBranchStatusHandler = async (gc, _ctx, _req, _params) => {
     const { branchContext } = gc;
     return { ok: true, status: 200, data: { branch: branchContext.branch } };
@@ -49,8 +50,11 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
         };
     }
     // Commit and push changes
+    const submitter = submissionEditorFromUser(req.user);
+    let changedPaths;
     try {
-        await ctx.services.submitBranch({ context: branchContext });
+        ;
+        ({ changedPaths } = await ctx.services.submitBranch({ context: branchContext, submitter }));
     }
     catch (err) {
         const message = getErrorMessage(err);
@@ -91,7 +95,7 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
         };
     }
     // Create or update PR (sync via githubService, or async via task queue)
-    const prResult = await syncSubmitPr(ctx, branchContext);
+    const prResult = await syncSubmitPr(ctx, branchContext, { submitter, changedPaths });
     // Update metadata with status and PR info
     const meta = getBranchMetadataFileManager(branchContext.branchRoot, branchContext.baseRoot);
     const updated = await meta.save({

package/dist/api/client.d.ts

@@ -25,6 +25,12 @@ export interface ApiClientOptions {
     baseUrl?: string;
     /** Custom fetch implementation, e.g. a mock in tests. */
     fetch?: typeof fetch;
+    /**
+     * End request paths with `/` (by `withTrailingSlash`'s rule), matching a Next host built with
+     * `trailingSlash: true`. Defaults to the value `withCanopy` inlines at build time (see
+     * `request-url.ts`), else false.
+     */
+    trailingSlash?: boolean;
     /**
      * Called whenever a response comes back 401: the credential is no longer accepted. A
      * notification, not a retry; the editor's auth gate uses it to show sign-in.
@@ -44,6 +50,7 @@ export interface ApiClientOptions {
 export declare class CanopyApiClient {
     private baseUrl;
     private fetchFn;
+    private trailingSlash;
     private onUnauthorized;
     readonly branches: {
         /** GET /branches */
@@ -179,5 +186,10 @@ export declare class CanopyApiClient {
     private buildPath;
     private request;
 }
+/**
+ * Whether `result` was converted from a body no CanopyCMS handler wrote (a proxy or CDN
+ * error page), so its status says nothing about the API itself.
+ */
+export declare function isNonApiResponse(result: object): boolean;
 /** Create a {@link CanopyApiClient}; pass a custom fetch for tests. */
 export declare function createApiClient(options?: ApiClientOptions): CanopyApiClient;

package/dist/api/client.js

@@ -6,6 +6,8 @@
  * (changes will be overwritten), edit the generator's templates instead.
  */
 import { computeContentSha256Hex } from './request-body-hash.js';
+import { readApiTrailingSlashEnv } from './request-url.js';
+import { withTrailingSlash } from '../utils/url-prefix.js';
 /**
  * Typed client for the CanopyCMS API: one method per endpoint, grouped by namespace, each
  * returning that endpoint's ApiResponse.
@@ -260,6 +262,7 @@ export class CanopyApiClient {
         this.baseUrl = options.baseUrl ?? '/api/canopycms';
         // An unbound fetch throws "Illegal invocation" in browsers; Node has no window.
         this.fetchFn = options.fetch ?? (typeof window !== 'undefined' ? fetch.bind(window) : fetch);
+        this.trailingSlash = options.trailingSlash ?? readApiTrailingSlashEnv();
         this.onUnauthorized = options.onUnauthorized;
     }
     buildPath(template, params) {
@@ -292,7 +295,7 @@ export class CanopyApiClient {
         return result;
     }
     async request(method, path, body, headers = {}) {
-        const url = `${this.baseUrl}${path}`;
+        const url = `${this.baseUrl}${this.trailingSlash ? withTrailingSlash(path) : path}`;
         const requestHeaders = {
             ...headers,
         };
@@ -325,21 +328,42 @@ export class CanopyApiClient {
             init.body = requestBody;
         }
         const response = await this.fetchFn(url, init);
+        // A body from in front of the API (a proxy or CDN error page) may be empty, not JSON, or
+        // not an ApiResponse; every such body becomes an `ok: false` ApiResponse, never a throw.
+        const parsed = await response.json().catch(() => undefined);
         if (response.status === 401) {
             this.onUnauthorized?.();
-            // A 401 is an auth answer whatever its body: one from in front of the API (a proxy) may
-            // not be an ApiResponse, or not JSON. Always return it as one rather than throwing.
-            const body = await response.json().catch(() => undefined);
-            const error = typeof body === 'object' && body !== null && 'error' in body && typeof body.error === 'string'
-                ? body.error
-                : 'Unauthorized';
-            return { ok: false, status: 401, error };
+            return { ok: false, status: 401, error: errorFromBody(parsed) ?? 'Unauthorized' };
         }
-        const payload = await response.json();
-        // All responses use ApiResponse format: { ok, status, data?, error? }
-        return payload;
+        if (isApiResponseBody(parsed))
+            return parsed;
+        const converted = {
+            ok: false,
+            status: response.status,
+            error: errorFromBody(parsed) ?? `Unexpected response from server (HTTP ${response.status})`,
+        };
+        convertedResponses.add(converted);
+        return converted;
     }
 }
+const convertedResponses = new WeakSet();
+/**
+ * Whether `result` was converted from a body no CanopyCMS handler wrote (a proxy or CDN
+ * error page), so its status says nothing about the API itself.
+ */
+export function isNonApiResponse(result) {
+    return convertedResponses.has(result);
+}
+/** The `error` string of a JSON body, when it has one. */
+function errorFromBody(body) {
+    return typeof body === 'object' && body !== null && 'error' in body && typeof body.error === 'string'
+        ? body.error
+        : undefined;
+}
+/** Whether a parsed body has the `{ ok, status, ... }` shape every handler returns. */
+function isApiResponseBody(body) {
+    return typeof body === 'object' && body !== null && 'ok' in body && typeof body.ok === 'boolean';
+}
 /** Create a {@link CanopyApiClient}; pass a custom fetch for tests. */
 export function createApiClient(options) {
     return new CanopyApiClient(options);

package/dist/api/content.d.ts

@@ -40,11 +40,12 @@ export interface WriteContentBody {
     data?: Record<string, unknown>;
     body?: string;
     /**
-     * OCC / create-intent token. Omit for a blind write (no opinion). A number
-     * from a prior read/write response rejects the write with 409 if the file
-     * has changed since. `null` means "this entry must not already exist" —
-     * the create path uses this so a create against an existing slug is
-     * rejected with 409 instead of silently overwriting it.
+     * OCC token. A number from a prior read/write response makes this an update,
+     * rejected with 409 if the file's mtime no longer matches (a file deleted
+     * since is written anew). `null` or omitted makes it
+     * a create, rejected with 409 if the entry already exists. There is no blind
+     * write: without a token, "no conflict detection" would be indistinguishable
+     * from "lost the token", so an update has to prove which version it read.
      */
     expectedVersion?: number | null;
 }

package/dist/api/content.js

@@ -5,7 +5,7 @@ import { ReferenceValidator } from '../validation/reference-validator.js';
 import { findUnknownKeys, mergeBodyIntoData, normalizeReferenceValues, validateEntryData, } from '../validation/entry-validator.js';
 import { validateEntryLinks } from '../validation/entry-link-validator.js';
 import { branchNameSchema, logicalPathSchema, slugSchema } from './validators.js';
-import { parseSlug } from '../paths/index.js';
+import { entryLogicalPath, parseSlug } from '../paths/index.js';
 import { getErrorMessage, isNotFoundError, sanitizeErrorMessage } from '../utils/error.js';
 import { isDataOnlyFormat } from '../utils/format.js';
 /**
@@ -52,7 +52,7 @@ const writeContentBodySchema = z.object({
     format: z.enum(['json', 'md', 'mdx', 'yaml']),
     data: boundedContentDataSchema.optional(),
     body: z.string().max(MAX_CONTENT_BODY_CHARS).optional(),
-    // null = create-intent ("must not already exist"); see WriteContentBody.
+    // null or omitted = create ("must not already exist"); see WriteContentBody.
     expectedVersion: z.number().nullish(),
 });
 const validateReferencesParamsSchema = z.object({
@@ -80,19 +80,18 @@ const readContentHandler = async (gc, ctx, req, params) => {
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
     let slug;
-    let relativePath;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
         slug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, slug);
-        relativePath = pathResult.relativePath;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, slug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'read');
+    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, slug), req.user, 'read');
     if (!access.allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
@@ -117,19 +116,18 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
     let slug;
-    let relativePath;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
         slug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, slug);
-        relativePath = pathResult.relativePath;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, slug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'edit');
+    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, slug), req.user, 'edit');
     if (!access.allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
@@ -198,20 +196,21 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     }
     const data = body.data ?? {};
     const isDataOnly = isDataOnlyFormat(body.format);
+    // The store's own `undefined` (blind write) is never reachable from here: an omitted token is
+    // a create, so an update that lost its token 409s instead of overwriting unchecked.
+    const expectedVersion = body.expectedVersion ?? null;
+    const createConflictError = body.expectedVersion === null
+        ? `An entry with slug "${slug}" already exists`
+        : `An entry with slug "${slug}" already exists; an update must send the expectedVersion from its last read`;
     try {
         const exists = await store.documentExists(schemaItem.logicalPath, slug);
-        // Create-intent guard: a create request (expectedVersion === null) against a slug that
-        // already has content must never silently overwrite it — short-circuit with 409 before field
-        // validation runs, so the error names the real problem instead of "field is required" or a
-        // bare conflict. store.write() re-enforces this itself inside its per-entry lock against a
-        // fresh stat (the race-safe authoritative check); this is just a cheaper fast path for the
-        // common case.
-        if (body.expectedVersion === null && exists) {
-            return {
-                ok: false,
-                status: 409,
-                error: `An entry with slug "${slug}" already exists`,
-            };
+        // Create guard: a create against a slug that already has content must never silently
+        // overwrite it — short-circuit with 409 before field validation runs, so the error names the
+        // real problem instead of "field is required" or a bare conflict. store.write() re-enforces
+        // this itself inside its per-entry lock against a fresh stat (the race-safe authoritative
+        // check); this is just a cheaper fast path for the common case.
+        if (expectedVersion === null && exists) {
+            return { ok: false, status: 409, error: createConflictError };
         }
         // [SLUG] Create-only routability check: `writeContentParamsSchema.path`'s `parseLogicalPath`
         // has no charset rule, and `ContentStore.resolvePath` only lowercases the slug — so this is
@@ -360,13 +359,13 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             ? {
                 format: body.format,
                 data: normalizedData ?? {},
-                expectedVersion: body.expectedVersion,
+                expectedVersion,
             }
             : {
                 format: body.format,
                 data: normalizedData,
                 body: body.body ?? '',
-                expectedVersion: body.expectedVersion,
+                expectedVersion,
             };
         // Pass the resolved entryTypeName (not the raw, possibly-omitted
         // params.entryType) so the store's own format check agrees with the type
@@ -412,12 +411,8 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             }
             // Race-safe fallback: the early `exists` check above catches the common case; this covers a
             // collision that lands between that check and store.write()'s in-lock stat.
-            if (body.expectedVersion === null) {
-                return {
-                    ok: false,
-                    status: 409,
-                    error: `An entry with slug "${slug}" already exists`,
-                };
+            if (expectedVersion === null) {
+                return { ok: false, status: 409, error: createConflictError };
             }
             return {
                 ok: false,
@@ -443,19 +438,19 @@ const validateReferencesHandler = async (gc, ctx, req, params, body) => {
     const contentRoot = ctx.services.config.contentRoot || 'content';
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
-    let relativePath;
+    let slug;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
-        const slug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, slug);
-        relativePath = pathResult.relativePath;
+        slug = resolved.slug;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, slug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'read');
+    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, slug), req.user, 'read');
     if (!access.allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
@@ -510,22 +505,26 @@ const renameEntryHandler = async (gc, ctx, req, params, body) => {
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
     let currentSlug;
-    let relativePath;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
         currentSlug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, currentSlug);
-        relativePath = pathResult.relativePath;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, currentSlug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'edit');
+    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, currentSlug), req.user, 'edit');
     if (!access.allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
+    // A rename creates the entry at its new path, so that path needs edit access too.
+    const destinationAccess = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, body.newSlug), req.user, 'edit');
+    if (!destinationAccess.allowed) {
+        return { ok: false, status: 403, error: 'Forbidden' };
+    }
     try {
         const result = await store.renameEntry(schemaItem.logicalPath, currentSlug, body.newSlug);
         return { ok: true, status: 200, data: { newPath: result.newPath } };

package/dist/api/entries.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { z } from 'zod';
 import { BranchSyncingError, ContentConflictError, ContentStore, ContentStoreError, } from '../content-store.js';
 import { defineEndpoint } from './route-builder.js';
-import { normalizeFilesystemPath, parseSlug, parseLogicalPath } from '../paths/index.js';
+import { entryLogicalPath, normalizeFilesystemPath, parseSlug, parseLogicalPath } from '../paths/index.js';
 import { getErrorMessage, isNotFoundError, sanitizeErrorMessage } from '../utils/error.js';
 import { createDebugLogger } from '../utils/debug.js';
 import { resolveEntryTitle } from '../utils/title-field.js';
@@ -81,7 +81,7 @@ const listCollectionEntriesRecursive = async (root, targetPath, flatCollections)
 const filterWithAccessControl = (items, checkAccess, search) => {
     const results = [];
     for (const item of items) {
-        const readAccess = checkAccess(item.physicalPath, 'read');
+        const readAccess = checkAccess(item.logicalPath, 'read');
         if (!readAccess.allowed)
             continue;
         if (search) {
@@ -90,7 +90,7 @@ const filterWithAccessControl = (items, checkAccess, search) => {
                 continue;
         }
         // Compute edit access only for items that survive the read + search filters.
-        const editAccess = checkAccess(item.physicalPath, 'edit');
+        const editAccess = checkAccess(item.logicalPath, 'edit');
         results.push({ ...item, canEdit: editAccess.allowed });
     }
     return results;
@@ -255,11 +255,9 @@ const deleteEntryHandler = async (gc, ctx, req, params) => {
         };
     }
     const entrySlug = slugResult.slug;
-    // Resolve the real physical path before checking permissions
-    let physicalPath;
+    // Resolution runs the store's slug and traversal checks before the permission check.
     try {
-        const resolved = await contentStore.resolveDocumentPath(collectionLogicalPath, entrySlug);
-        physicalPath = resolved.relativePath;
+        await contentStore.resolveDocumentPath(collectionLogicalPath, entrySlug);
     }
     catch (err) {
         if (isNotFoundError(err)) {
@@ -272,7 +270,7 @@ const deleteEntryHandler = async (gc, ctx, req, params) => {
         }
         throw err;
     }
-    const editAccess = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, physicalPath, req.user, 'edit');
+    const editAccess = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(collection.logicalPath, entrySlug), req.user, 'edit');
     if (!editAccess.allowed) {
         return {
             ok: false,

package/dist/api/github-sync.d.ts

@@ -1,5 +1,6 @@
 import type { ApiContext } from './types.js';
 import type { BranchContext, SyncStatus } from '../types.js';
+import { type SubmissionEditor } from '../submission-attribution.js';
 /**
  * The caller uses this to update branch metadata.
  */
@@ -8,10 +9,18 @@ export interface GitHubSyncResult {
     prNumber?: number;
     syncStatus?: SyncStatus;
 }
+/** What the PR body records about a submit. */
+export interface SubmissionRecord {
+    submitter?: SubmissionEditor;
+    changedPaths: readonly string[];
+}
 /**
  * Uses githubService directly if available, otherwise queues a task for the worker.
+ *
+ * The body is the canopycms PR section (submission-attribution.ts): an existing
+ * PR keeps whatever a human wrote outside it.
  */
-export declare function syncSubmitPr(ctx: ApiContext, context: BranchContext): Promise<GitHubSyncResult>;
+export declare function syncSubmitPr(ctx: ApiContext, context: BranchContext, submission: SubmissionRecord): Promise<GitHubSyncResult>;
 /**
  * Used by withdraw and request-changes. Uses githubService directly if
  * available, otherwise queues a task.

package/dist/api/github-sync.js

@@ -3,14 +3,22 @@ import { getTaskQueueDir } from '../task-queue/task-queue-config.js';
 import { clientOperatingStrategy } from '../operating-mode/index.js';
 import { getErrorMessage } from '../utils/error.js';
 import { sanitizeBranchName } from '../paths/branch-name.js';
+import { buildPrSection, mergePrSection } from '../submission-attribution.js';
 /**
  * Uses githubService directly if available, otherwise queues a task for the worker.
+ *
+ * The body is the canopycms PR section (submission-attribution.ts): an existing
+ * PR keeps whatever a human wrote outside it.
  */
-export async function syncSubmitPr(ctx, context) {
+export async function syncSubmitPr(ctx, context, submission) {
     const { githubService } = ctx.services;
     const mode = ctx.services.config.mode;
     const prTitle = context.branch.title || `Submit ${context.branch.name}`;
-    const prBody = context.branch.description || '';
+    const prSection = buildPrSection({
+        description: context.branch.description,
+        submitter: submission.submitter,
+        changedPaths: submission.changedPaths,
+    });
     // Target the fork point recorded at branch creation when available.
     const baseBranch = context.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main';
     if (!clientOperatingStrategy(mode).supportsPullRequests()) {
@@ -29,9 +37,12 @@ export async function syncSubmitPr(ctx, context) {
     if (githubService) {
         try {
             if (context.branch.pullRequestNumber) {
+                // Read before writing: the update keeps the human text around the
+                // canopycms section, and the same read says whether the PR is a draft.
+                const pr = await githubService.getPullRequest(context.branch.pullRequestNumber);
                 await githubService.updatePullRequest(context.branch.pullRequestNumber, {
                     title: prTitle,
-                    body: prBody,
+                    body: mergePrSection(pr.body, prSection),
                 });
                 // Best-effort draft->ready conversion. This branch updates a known
                 // PR number directly (not through createOrUpdatePR), so it doesn't
@@ -42,7 +53,6 @@ export async function syncSubmitPr(ctx, context) {
                 // consistent with createOrUpdatePullRequest's best-effort handling
                 // in github-service.ts.
                 try {
-                    const pr = await githubService.getPullRequest(context.branch.pullRequestNumber);
                     if (pr.draft) {
                         await githubService.convertToReady(context.branch.pullRequestNumber);
                     }
@@ -73,8 +83,9 @@ export async function syncSubmitPr(ctx, context) {
                     head: context.branch.name,
                     base: baseBranch,
                     title: prTitle,
-                    body: prBody,
+                    body: prSection,
                     markReadyIfDraft: true,
+                    mergeSectionIntoBody: true,
                 });
                 return {
                     prUrl: result.url,
@@ -105,13 +116,12 @@ export async function syncSubmitPr(ctx, context) {
         payload: {
             branch: context.branch.name,
             title: prTitle,
-            body: prBody,
+            body: prSection,
+            mergeSectionIntoBody: true,
             baseBranch,
             pullRequestNumber: context.branch.pullRequestNumber,
-            // Content submits are an explicit "ready for review" action — convert
-            // a pre-existing draft PR to ready, unlike the settings-branch sync
-            // path (services.ts commitToSettingsBranch), which enqueues the same
-            // action without this flag.
+            // A content submit is an explicit "ready for review" action: convert a
+            // pre-existing draft PR to ready.
             markReadyIfDraft: true,
         },
     });

package/dist/api/reference-options.js

@@ -70,7 +70,7 @@ const getReferenceOptionsHandler = async (gc, ctx, req, _params) => {
     // for an option the caller isn't allowed to see.
     const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
     const resolver = new ReferenceResolver(store, idIndex);
-    const options = await resolver.loadReferenceOptions(collections, displayField, search, entryTypes, (relativePath) => checkAccess(relativePath, 'read').allowed);
+    const options = await resolver.loadReferenceOptions(collections, displayField, search, entryTypes, (logicalPath) => checkAccess(logicalPath, 'read').allowed);
     return {
         ok: true,
         status: 200,

package/dist/api/request-url.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether the API client ends request paths with `/`: on a `trailingSlash: true` Next host every
+ * unslashed call draws a 308 first. `withCanopy` sets `CANOPY_API_TRAILING_SLASH` in Next's `env`
+ * config, which Next substitutes for this literal member expression in server and browser bundles
+ * (`getNextConfigEnv`, `next/dist/build/define-env.js:54`). The try/catch covers a host whose
+ * bundler neither substitutes it nor shims `process` in the browser.
+ */
+export declare function readApiTrailingSlashEnv(): boolean;