canopycms 0.0.67 → 0.0.68-int.93

package/dist/api/request-url.js

@@ -0,0 +1,15 @@
+/**
+ * Whether the API client ends request paths with `/`: on a `trailingSlash: true` Next host every
+ * unslashed call draws a 308 first. `withCanopy` sets `CANOPY_API_TRAILING_SLASH` in Next's `env`
+ * config, which Next substitutes for this literal member expression in server and browser bundles
+ * (`getNextConfigEnv`, `next/dist/build/define-env.js:54`). The try/catch covers a host whose
+ * bundler neither substitutes it nor shims `process` in the browser.
+ */
+export function readApiTrailingSlashEnv() {
+    try {
+        return process.env.CANOPY_API_TRAILING_SLASH === 'true';
+    }
+    catch {
+        return false;
+    }
+}

package/dist/api/resolve-references.js

@@ -4,6 +4,7 @@ import { defineEndpoint } from './route-builder.js';
 import { ReferenceResolver } from '../reference-resolver.js';
 import { buildResolvedReference } from '../entry-schema.js';
 import { computeEntryUrl } from '../utils/entry-url.js';
+import { entryLogicalPath } from '../paths/index.js';
 import { branchNameSchema, contentIdSchema } from './validators.js';
 /**
  * Resolution does sequential per-ID file I/O, so the request body caps how much filesystem work
@@ -39,8 +40,7 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
             const result = await resolver.resolve(id);
             if (result && result.exists && result.collection && result.slug) {
                 // Check path-level read permission before returning content
-                const resolvedPath = await store.resolveDocumentPath(result.collection, result.slug);
-                const access = checkAccess(resolvedPath.relativePath, 'read');
+                const access = checkAccess(entryLogicalPath(result.collection, result.slug), 'read');
                 if (!access.allowed)
                     continue;
                 // `resolveReferences: false` matches the server-side resolver (content-store.ts's

package/dist/api/settings-helpers.d.ts

@@ -30,7 +30,7 @@ export interface CommitSettingsResult {
 /**
  * Commit and push settings changes based on the mode.
  * Both prod and dev use commitToSettingsBranch.
- * In dev mode, commits to the settings branch but does not create a PR.
+ * Settings changes are never reviewed through a PR (see commitToSettingsBranch).
  */
 export declare function commitSettings(ctx: ApiContext, options: {
     context: {

package/dist/api/settings-helpers.js

@@ -23,7 +23,7 @@ export async function getSettingsBranchContext(ctx) {
 /**
  * Commit and push settings changes based on the mode.
  * Both prod and dev use commitToSettingsBranch.
- * In dev mode, commits to the settings branch but does not create a PR.
+ * Settings changes are never reviewed through a PR (see commitToSettingsBranch).
  */
 export async function commitSettings(ctx, options) {
     const strategy = operatingStrategy(options.mode);
@@ -38,9 +38,6 @@ export async function commitSettings(ctx, options) {
             branchRoot: options.branchRoot,
             files: options.fileName,
             message: options.message,
-            createPR: strategy.shouldCreateSettingsPR({
-                autoCreateSettingsPR: ctx.services.config.autoCreateSettingsPR,
-            }),
         });
         if (!result.pushed) {
             console.warn(`${options.message} committed but not pushed:`, result.error);

package/dist/authorization/content.d.ts

@@ -6,12 +6,13 @@ import type { BranchContext } from '../types.js';
 import type { PermissionLevel } from '../config/index.js';
 import type { CanopyUser } from '../user.js';
 import type { ContentAccessResult, ContentAccessDeps } from './types.js';
-import type { PhysicalPath } from '../paths/types.js';
+import type { LogicalPath } from '../paths/types.js';
 /**
  * A bound content-access checker: evaluates a single path/level synchronously
  * against permissions that were already loaded when the checker was created.
+ * The path is the entry's logical path (see `checkPathAccess`).
  */
-export type ContentAccessChecker = (relativePath: PhysicalPath, level: PermissionLevel) => ContentAccessResult;
+export type ContentAccessChecker = (logicalPath: LogicalPath, level: PermissionLevel) => ContentAccessResult;
 /**
  * Resolve the request-constant work once -- branch access, the
  * settings/permissions root and the path-permission rules, all identical for a
@@ -26,5 +27,5 @@ export declare function createContentAccessChecker(deps: ContentAccessDeps, cont
  * Single-path check; loads the path permissions from the branch root per call.
  * @internal Exported for tests.
  */
-export declare function checkContentAccess(deps: ContentAccessDeps, context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel): Promise<ContentAccessResult>;
-export declare function createCheckContentAccess(deps: ContentAccessDeps): (context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel) => Promise<ContentAccessResult>;
+export declare function checkContentAccess(deps: ContentAccessDeps, context: BranchContext, branchRoot: string, logicalPath: LogicalPath, user: CanopyUser, level: PermissionLevel): Promise<ContentAccessResult>;
+export declare function createCheckContentAccess(deps: ContentAccessDeps): (context: BranchContext, branchRoot: string, logicalPath: LogicalPath, user: CanopyUser, level: PermissionLevel) => Promise<ContentAccessResult>;

package/dist/authorization/content.js

@@ -28,9 +28,9 @@ export async function createContentAccessChecker(deps, context, branchRoot, user
     }
     const rules = await deps.loadPathPermissions(permissionsRoot, deps.mode);
     const pathChecker = createCheckPathAccess(rules, deps.defaultPathAccess);
-    return (relativePath, level) => {
+    return (logicalPath, level) => {
         const path = pathChecker({
-            relativePath,
+            logicalPath,
             user,
             level,
         });
@@ -45,10 +45,10 @@ export async function createContentAccessChecker(deps, context, branchRoot, user
  * Single-path check; loads the path permissions from the branch root per call.
  * @internal Exported for tests.
  */
-export async function checkContentAccess(deps, context, branchRoot, relativePath, user, level) {
+export async function checkContentAccess(deps, context, branchRoot, logicalPath, user, level) {
     const check = await createContentAccessChecker(deps, context, branchRoot, user);
-    return check(relativePath, level);
+    return check(logicalPath, level);
 }
 export function createCheckContentAccess(deps) {
-    return (context, branchRoot, relativePath, user, level) => checkContentAccess(deps, context, branchRoot, relativePath, user, level);
+    return (context, branchRoot, logicalPath, user, level) => checkContentAccess(deps, context, branchRoot, logicalPath, user, level);
 }

package/dist/authorization/path.d.ts

@@ -1,7 +1,7 @@
 import type { PathPermission, DefaultPathAccess, PermissionLevel } from '../config/index.js';
 import type { CanopyUser } from '../user.js';
 import type { PathPermissionResult } from './types.js';
-import type { PhysicalPath } from '../paths/types.js';
+import type { LogicalPath } from '../paths/types.js';
 /**
  * Resolve `defaultPathAccess` to an 'allow'/'deny' verdict for one permission
  * level. String form applies to every level; object form looks up the level,
@@ -11,19 +11,24 @@ import type { PhysicalPath } from '../paths/types.js';
  */
 export declare function resolveDefaultPathAccess(defaultAccess: DefaultPathAccess, level: PermissionLevel): 'allow' | 'deny';
 /**
- * Evaluate access for a relative path against config-defined rules.
- * Uses defaultAccess when no rule matches. First matching rule wins.
+ * Evaluate access for a path against config-defined rules. First matching rule wins;
+ * defaultAccess applies when none matches.
+ *
+ * Rule globs and the checked path are both LOGICAL paths: content-root-prefixed and
+ * id-free, the space the Permission Manager writes rules in. An entry's logical path is
+ * `<collection logical path>/<slug>` (`entryLogicalPath`), e.g. `content/blog/my-post`, never
+ * its on-disk `content/blog.<id>/post.my-post.<id>.json`.
  * @internal Exported for tests.
  */
-export declare function checkPathAccess({ rules, relativePath, user, defaultAccess, level, }: {
+export declare function checkPathAccess({ rules, logicalPath, user, defaultAccess, level, }: {
     rules: PathPermission[];
-    relativePath: PhysicalPath;
+    logicalPath: LogicalPath;
     user: CanopyUser;
     defaultAccess: DefaultPathAccess;
     level: PermissionLevel;
 }): PathPermissionResult;
 export declare function createCheckPathAccess(rules: PathPermission[], defaultAccess: DefaultPathAccess): (input: {
-    relativePath: PhysicalPath;
+    logicalPath: LogicalPath;
     user: CanopyUser;
     level: PermissionLevel;
 }) => PathPermissionResult;

package/dist/authorization/path.js

@@ -5,8 +5,8 @@ function normalize(p) {
     const normalized = p.split(path.sep).join('/');
     return normalized.replace(/^\.?\/*/, '');
 }
-function matchesRule(rule, relativePath) {
-    return minimatch(relativePath, rule.path, { dot: true });
+function matchesRule(rule, logicalPath) {
+    return minimatch(logicalPath, rule.path, { dot: true });
 }
 function isAllowedByTarget(target, user) {
     const hasUserConstraint = !!target.allowedUsers?.length;
@@ -32,12 +32,17 @@ export function resolveDefaultPathAccess(defaultAccess, level) {
     return defaultAccess[level] ?? 'deny';
 }
 /**
- * Evaluate access for a relative path against config-defined rules.
- * Uses defaultAccess when no rule matches. First matching rule wins.
+ * Evaluate access for a path against config-defined rules. First matching rule wins;
+ * defaultAccess applies when none matches.
+ *
+ * Rule globs and the checked path are both LOGICAL paths: content-root-prefixed and
+ * id-free, the space the Permission Manager writes rules in. An entry's logical path is
+ * `<collection logical path>/<slug>` (`entryLogicalPath`), e.g. `content/blog/my-post`, never
+ * its on-disk `content/blog.<id>/post.my-post.<id>.json`.
  * @internal Exported for tests.
  */
-export function checkPathAccess({ rules, relativePath, user, defaultAccess, level, }) {
-    const normalizedPath = normalize(relativePath);
+export function checkPathAccess({ rules, logicalPath, user, defaultAccess, level, }) {
+    const normalizedPath = normalize(logicalPath);
     // Only Admins bypass all path permissions
     if (isAdmin(user.groups)) {
         return { allowed: true, reason: 'admin' };

package/dist/authorization/types.d.ts

@@ -1,6 +1,6 @@
 /**
- * A path used in permission rules, e.g. "content/posts".
- * SECURITY CRITICAL: always validated to prevent path traversal.
+ * A logical-path glob used in permission rules, e.g. "content/posts/**" (see
+ * `PathPermission.path`). SECURITY CRITICAL: always validated to prevent path traversal.
  */
 export type PermissionPath = string & {
     readonly __brand: 'PermissionPath';

package/dist/branch-health.js

@@ -5,16 +5,16 @@ import { ContentIdIndex } from './content-id-index.js';
 import { sanitizeBranchName } from './paths/branch-name.js';
 import { getErrorMessage, isNodeError, isNotFoundError } from './utils/error.js';
 import { isRebaseInProgress } from './utils/git.js';
+import { branchProvisioningLockName } from './utils/provisioning-lock.js';
 /**
- * The provisioning lock marker's path for a branch directory, matching what
- * `branch-workspace.ts`'s `ensureGitWorkspace()` passes exactly.
+ * The provisioning lock marker's path for a branch directory.
  *
  * `acquireProvisioningLock` passes the name as `lockfilePath`, overriding
  * proper-lockfile's default `${target}.lock`, so the marker (a mkdir-based
  * directory) sits at exactly this path — no extra `.lock` suffix.
  */
 function provisioningLockPath(baseRoot, dirName) {
-    return path.join(baseRoot, `.${dirName}.init.lock`);
+    return path.join(baseRoot, branchProvisioningLockName(dirName));
 }
 /** Stat the provisioning lock marker, if present. Never throws. */
 async function readProvisioningLock(baseRoot, dirName) {

package/dist/branch-schema-cache.d.ts

@@ -2,6 +2,8 @@ import type { RootCollectionConfig } from './config/index.js';
 import type { FlatSchemaItem } from './config/types.js';
 import type { OperatingMode } from './operating-mode/index.js';
 import type { EntrySchemaRegistry, SchemaResolutionResult } from './schema/types.js';
+/** File name of the schema cache inside {@link schemaCacheDir}. */
+export declare const SCHEMA_CACHE_FILE = "schema-cache.json";
 /** resource-generation.ts resource key for the schema cache's marker. */
 export declare const SCHEMA_GENERATION_RESOURCE = "schema";
 /** @internal Exported for tests. */
@@ -18,8 +20,8 @@ export interface BranchSchemaCacheEntry {
     generation: string | null;
 }
 /**
- * Per-branch schema cache: a file at {branchRoot}/.canopy-meta/schema-cache.json
- * with no in-memory layer, so it stays coherent across Lambda invocations.
+ * Per-branch schema cache: one file in {@link schemaCacheDir} with no in-memory
+ * layer, so it stays coherent across Lambda invocations.
  *
  * Freshness follows the generation-marker protocol owned by
  * resource-generation.ts, and this is one of that protocol's durable-snapshot
@@ -39,7 +41,7 @@ export declare class BranchSchemaCache {
     /**
      * Whether to skip the on-disk cache for this branchRoot.
      *
-     * Never write `.canopy-meta/` at the project root, whichever entrypoint
+     * Never write a schema cache at the project root, whichever entrypoint
      * produced the cwd branchRoot. branchRoot equals process.cwd() only in the
      * synthetic contexts static deployments and build phases use; a real branch
      * root is always nested under the workspace.

package/dist/branch-schema-cache.js

@@ -5,10 +5,14 @@ import { flattenSchema } from './config/flatten.js';
 import { validateReferenceEntryTypes } from './validation/entry-type-reference-validator.js';
 import { isBuildMode } from './build-mode.js';
 import { bumpResourceGeneration, readResourceGeneration, isGenerationCurrent, } from './resource-generation.js';
+import { timeRequestPhase } from './utils/request-timing.js';
+import { CANOPY_META_DIR } from './utils/git.js';
 /** Bump when BranchSchemaCacheEntry shape changes to auto-invalidate stale caches */
 const SCHEMA_CACHE_VERSION = 3;
 /** Minimum interval between mtime staleness checks (ms) */
 const MTIME_CHECK_DEBOUNCE_MS = 1000;
+/** File name of the schema cache inside {@link schemaCacheDir}. */
+export const SCHEMA_CACHE_FILE = 'schema-cache.json';
 /** resource-generation.ts resource key for the schema cache's marker. */
 export const SCHEMA_GENERATION_RESOURCE = 'schema';
 /**
@@ -43,8 +47,22 @@ async function isStaleByMtime(dir, cachedAt) {
     return false;
 }
 /**
- * Per-branch schema cache: a file at {branchRoot}/.canopy-meta/schema-cache.json
- * with no in-memory layer, so it stays coherent across Lambda invocations.
+ * Directory holding a branch's schema cache: `{branchRoot}/.git/canopycms` when
+ * the branch root is a full clone (every canopycms branch workspace is), else
+ * `{branchRoot}/.canopy-meta`. Under `.git/` because nothing there is ever
+ * tracked or reported by `git status`, so the cache can neither dirty the
+ * workspace nor enter a commit, even where an adopter has committed
+ * `.canopy-meta/`. It also lives and dies with the clone, so a re-clone never
+ * reads its predecessor's snapshot.
+ */
+async function schemaCacheDir(branchRoot) {
+    const gitDir = path.join(branchRoot, '.git');
+    const isClone = await fs.stat(gitDir).then((stat) => stat.isDirectory(), () => false);
+    return isClone ? path.join(gitDir, 'canopycms') : path.join(branchRoot, CANOPY_META_DIR);
+}
+/**
+ * Per-branch schema cache: one file in {@link schemaCacheDir} with no in-memory
+ * layer, so it stays coherent across Lambda invocations.
  *
  * Freshness follows the generation-marker protocol owned by
  * resource-generation.ts, and this is one of that protocol's durable-snapshot
@@ -65,7 +83,7 @@ export class BranchSchemaCache {
     /**
      * Whether to skip the on-disk cache for this branchRoot.
      *
-     * Never write `.canopy-meta/` at the project root, whichever entrypoint
+     * Never write a schema cache at the project root, whichever entrypoint
      * produced the cwd branchRoot. branchRoot equals process.cwd() only in the
      * synthetic contexts static deployments and build phases use; a real branch
      * root is always nested under the workspace.
@@ -75,7 +93,7 @@ export class BranchSchemaCache {
     }
     /** Get schema for a branch, from the cache when fresh, else resolved fresh. */
     async getSchema(branchRoot, entrySchemaRegistry, contentRootName = 'content') {
-        return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
+        return timeRequestPhase('schema', () => this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName));
     }
     /**
      * Resolve the schema from disk. Protected rather than a direct resolveSchema
@@ -89,8 +107,7 @@ export class BranchSchemaCache {
         const contentRoot = path.join(branchRoot, contentRootName);
         const skipDiskCache = this.skipDiskCache(branchRoot);
         if (!skipDiskCache) {
-            const cacheDir = path.join(branchRoot, '.canopy-meta');
-            const cachePath = path.join(cacheDir, 'schema-cache.json');
+            const cachePath = path.join(await schemaCacheDir(branchRoot), SCHEMA_CACHE_FILE);
             let cacheData = null;
             try {
                 const cacheContent = await fs.readFile(cachePath, 'utf-8');
@@ -149,7 +166,8 @@ export class BranchSchemaCache {
         const read = skipDiskCache
             ? null
             : await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
-        const result = await this.resolveFresh(contentRoot, entrySchemaRegistry);
+        // Nested under `schema`, so a request summary names a cache miss (`…schema>resolve`).
+        const result = await timeRequestPhase('resolve', () => this.resolveFresh(contentRoot, entrySchemaRegistry));
         // Validate schema has content
         if (!isValidSchema(result.schema)) {
             throw new Error(`No schema found in ${contentRoot}. Create .collection.json files ` +
@@ -166,11 +184,11 @@ export class BranchSchemaCache {
         // Use configured contentRoot name as base path for logical paths
         const flatSchema = flattenSchema(result.schema, contentRootName);
         if (!skipDiskCache) {
-            const cacheDir = path.join(branchRoot, '.canopy-meta');
-            const cachePath = path.join(cacheDir, 'schema-cache.json');
+            const cacheDir = await schemaCacheDir(branchRoot);
+            const cachePath = path.join(cacheDir, SCHEMA_CACHE_FILE);
             // Opportunistic cleanup of the retired .stale marker file, which a
             // mid-flight deploy can leave behind. Not load-bearing.
-            await fs.unlink(path.join(cacheDir, 'schema-cache.stale')).catch(() => { });
+            await fs.unlink(path.join(branchRoot, CANOPY_META_DIR, 'schema-cache.stale')).catch(() => { });
             if (read && read.ok) {
                 const newCache = {
                     version: SCHEMA_CACHE_VERSION,
@@ -180,7 +198,7 @@ export class BranchSchemaCache {
                     generation: read.token,
                 };
                 // Temp file then rename, with the temp file unlinked on a failed
-                // rename so a transient error leaves no stray `.tmp` in `.canopy-meta/`.
+                // rename so a transient error leaves no stray `.tmp` beside the cache.
                 await fs.mkdir(cacheDir, { recursive: true });
                 const tmpPath = path.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
                 await fs.writeFile(tmpPath, JSON.stringify(newCache, null, 2), 'utf-8');

package/dist/branch-workspace.js

@@ -6,7 +6,7 @@ import { operatingStrategy } from './operating-mode/index.js';
 import { GitManager } from './git-manager.js';
 import { createDebugLogger } from './utils/debug.js';
 import { resolveBaseBranch } from './utils/git.js';
-import { acquireProvisioningLock } from './utils/provisioning-lock.js';
+import { acquireProvisioningLock, branchProvisioningLockName } from './utils/provisioning-lock.js';
 const log = createDebugLogger({ prefix: 'BranchWorkspace' });
 // In-memory lock to prevent concurrent workspace initialization
 const workspaceInitLocks = new Map();
@@ -41,7 +41,7 @@ export class BranchWorkspaceManager {
                         branchName: options.branchName,
                         mode: options.mode,
                     });
-                    releaseLock = await acquireProvisioningLock(path.dirname(options.branchRoot), `.${path.basename(options.branchRoot)}.init.lock`);
+                    releaseLock = await acquireProvisioningLock(path.dirname(options.branchRoot), branchProvisioningLockName(path.basename(options.branchRoot)));
                     await GitManager.initializeWorkspace({
                         workspacePath: options.branchRoot,
                         branchName: options.branchName,