canopycms 0.0.67 → 0.0.68-int.93

package/dist/context.js

@@ -1,9 +1,9 @@
-import { isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER } from './build-mode.js';
+import { isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER } from './build-mode.js';
 import { createContentReader } from './content-reader.js';
 import { ContentStoreError } from './content-store.js';
-import { createLogicalPath, parseSlug, resolveBranchPaths } from './paths/index.js';
+import { BranchPathError, createLogicalPath, parseSlug, resolveBranchPaths, } from './paths/index.js';
 import { resolveUrlPathCandidates } from './url-path-resolver.js';
-import { loadOrCreateBranchContext } from './branch-workspace.js';
+import { loadBranchContext, loadOrCreateBranchContext } from './branch-workspace.js';
 import { buildContentTree as buildContentTreeImpl, } from './content-tree.js';
 import { listEntries as listEntriesImpl, } from './content-listing.js';
 import { createDebugLogger } from './utils/debug.js';
@@ -22,6 +22,21 @@ function isLookupFailure(err) {
 function isPageSwallowable(err) {
     return isLookupFailure(err) || err.code === 'FORBIDDEN';
 }
+/**
+ * A branch that already has a workspace, or null. A name the path layer
+ * rejects (a traversal segment) is null too: it arrives from the request, so it
+ * lists nothing rather than failing the page.
+ */
+async function loadExistingBranch(branchName, mode) {
+    try {
+        return await loadBranchContext({ branchName, mode });
+    }
+    catch (err) {
+        if (err instanceof BranchPathError)
+            return null;
+        throw err;
+    }
+}
 /**
  * Create a Canopy context managing auth + content reading. Framework-agnostic:
  * the adapter supplies extractUser.
@@ -119,80 +134,114 @@ export function createCanopyContext(options) {
             }
             return null;
         };
-        /** Resolve branch workspace and schema — shared by buildContentTree and listEntries. Memoized per getContext call. */
-        let schemaContextPromise = null;
-        const resolveSchemaContextImpl = async () => {
-            const operatingMode = services.config.mode;
-            const defaultBranch = services.config.defaultActiveBranch ?? services.config.defaultBaseBranch ?? 'main';
-            const branchContext = await loadOrCreateBranchContext({
-                config: services.config,
-                branchName: defaultBranch,
-                mode: operatingMode,
-                createdBy: 'canopycms-context',
-                remoteUrl: services.config.defaultRemoteUrl,
-            });
-            const { branchRoot } = resolveBranchPaths(branchContext, operatingMode);
-            const contentRootName = services.config.contentRoot || 'content';
-            const { flatSchema } = await services.branchSchemaCache.getSchema(branchRoot, services.entrySchemaRegistry, contentRootName);
-            return { branchContext, branchRoot, flatSchema, contentRootName };
-        };
-        const resolveSchemaContext = () => {
-            if (!schemaContextPromise) {
-                schemaContextPromise = resolveSchemaContextImpl();
-            }
-            return schemaContextPromise;
-        };
         /**
-         * Path-ACL predicate for the batch reads (listEntries / buildContentTree),
-         * memoized per getContext call like the schema context above. Without it an
-         * unfiltered listing on this request-scoped, ACL-enforcing context would
-         * disclose full entry `data` for paths the user cannot `read()` directly.
-         *
-         * `services.createContentAccessChecker` is the shared batch primitive
-         * (api/entries.ts uses it too): it resolves the request-constant work —
-         * branch access, the settings/permissions root, the rule set — once, and
-         * returns a synchronous per-path check, so the per-entry cost is an admin
-         * short-circuit or one minimatch per configured rule, with no extra I/O.
+         * What a batch read (listEntries / buildContentTree) lists from: the branch's
+         * schema plus its path-ACL predicate, or null when the branch yields nothing
+         * this user may see.
          *
-         * The empty object (no predicate → unfiltered) at build time, on static
-         * deployments, and for the synthetic admin is load-bearing, not an
-         * optimization. That user has unconditional access anyway (path checks
-         * bypass entirely for an Admins-group user — authorization/path.ts), but
-         * BUILDING the checker costs a getSettingsBranchRoot() call, which in modes
-         * with a separate settings branch provisions that branch's git workspace: an
-         * EFS round trip in prod. `createBuildCanopy` (build-canopy.ts) runs outside
-         * a request or Next.js build phase, so neither other guard fires for it, and
-         * without this one every such script pays for a settings-workspace clone it
-         * never needed — and hard-fails where that workspace cannot be provisioned.
+         * With no `branch`, or the active branch named explicitly, it is the active
+         * branch, provisioned if missing. Any other name arrives from the request
+         * (an index page passing the preview iframe's `?branch=`), so it is
+         * load-only, never provisioned — a missing, non-string or traversal name
+         * lists nothing — and its branch access, held in its own metadata, is
+         * checked before its schema or content files are read. At
+         * build time and on static deployments `branch` selects nothing, as for
+         * `read` (see the module doc).
          *
-         * Compared by reference to the STATIC_DEPLOY_USER singleton, not by group
-         * membership, so it stays scoped to the synthetic build identity: a real
-         * authenticated admin at request time still goes through the real check.
-         *
-         * Deliberately NOT wrapped in try/catch — createContentAccessChecker is
-         * fail-loud by contract, and swallowing would serve an unfiltered listing.
+         * Memoized per getContext call and per branch name, on the in-flight
+         * promise; a null result is memoized too, so one request answers a given
+         * name consistently. The memo is request-scoped, so it carries no
+         * generation protocol (docs/concurrency.md, "Adding a call-scoped memo").
          */
-        let visibilityPromise = null;
-        const resolveVisibilityImpl = async () => {
-            if (isDeployedStatic(services.config) || isBuildMode() || user === STATIC_DEPLOY_USER)
-                return {};
-            const { branchContext, branchRoot } = await resolveSchemaContext();
-            const checkAccess = await services.createContentAccessChecker(branchContext, branchRoot, user);
-            return { shouldInclude: (physicalPath) => checkAccess(physicalPath, 'read').allowed };
+        const listingSources = new Map();
+        // Read once, so every listing in this request agrees on it even if a
+        // concurrent request's refreshActiveBranch() replaces services.config.
+        const activeBranch = services.config.defaultActiveBranch ?? services.config.defaultBaseBranch ?? 'main';
+        const resolveListingSource = (branch) => {
+            // Typed `string`, but usually handed over from untyped `searchParams`,
+            // where a repeated `?branch=` arrives as an array.
+            if (branch !== undefined && typeof branch !== 'string')
+                return Promise.resolve(null);
+            const requested = branch && branch !== activeBranch && !readsFromCheckout(services.config)
+                ? branch
+                : undefined;
+            const key = requested ?? activeBranch;
+            let source = listingSources.get(key);
+            if (!source) {
+                source = resolveListingSourceImpl(requested);
+                listingSources.set(key, source);
+            }
+            return source;
         };
-        const resolveVisibility = () => {
-            if (!visibilityPromise) {
-                visibilityPromise = resolveVisibilityImpl();
+        const resolveListingSourceImpl = async (requested) => {
+            const operatingMode = services.config.mode;
+            const branchContext = requested === undefined
+                ? await loadOrCreateBranchContext({
+                    config: services.config,
+                    branchName: activeBranch,
+                    mode: operatingMode,
+                    createdBy: 'canopycms-context',
+                    remoteUrl: services.config.defaultRemoteUrl,
+                })
+                : await loadExistingBranch(requested, operatingMode);
+            if (!branchContext)
+                return null;
+            // The path-ACL predicate keeps an unfiltered listing on this ACL-enforcing
+            // context from disclosing entry `data` for paths the user cannot `read()`.
+            // `services.createContentAccessChecker` is the shared batch primitive
+            // (api/entries.ts uses it too): it resolves the request-constant work —
+            // branch access, the settings/permissions root, the rule set — once, and
+            // returns a synchronous per-path check, so the per-entry cost is an admin
+            // short-circuit or one minimatch per configured rule, with no extra I/O.
+            //
+            // No predicate (unfiltered) at build time, on static deployments, and for
+            // the synthetic admin is load-bearing, not an optimization. That user has
+            // unconditional access anyway (path checks bypass entirely for an
+            // Admins-group user — authorization/path.ts), but BUILDING the checker costs
+            // a getSettingsBranchRoot() call, which in modes with a separate settings
+            // branch provisions that branch's git workspace: an EFS round trip in prod.
+            // `createBuildCanopy` (build-canopy.ts) runs outside a request or Next.js
+            // build phase, so neither other guard fires for it, and without this one
+            // every such script pays for a settings-workspace clone it never needed —
+            // and hard-fails where that workspace cannot be provisioned. Compared by
+            // reference to the STATIC_DEPLOY_USER singleton, not by group membership,
+            // so a real authenticated admin at request time still goes through the
+            // real check.
+            //
+            // Deliberately NOT wrapped in try/catch — createContentAccessChecker is
+            // fail-loud by contract, and swallowing would serve an unfiltered listing.
+            const enforceAcls = !(isDeployedStatic(services.config) ||
+                isBuildMode() ||
+                user === STATIC_DEPLOY_USER);
+            if (enforceAcls && !services.checkBranchAccess(branchContext, user).allowed) {
+                return null;
             }
-            return visibilityPromise;
+            const { branchRoot } = resolveBranchPaths(branchContext, operatingMode);
+            const contentRootName = services.config.contentRoot || 'content';
+            const { flatSchema } = await services.branchSchemaCache.getSchema(branchRoot, services.entrySchemaRegistry, contentRootName);
+            if (!enforceAcls)
+                return { branchRoot, flatSchema, contentRootName, visibility: {} };
+            const checkAccess = await services.createContentAccessChecker(branchContext, branchRoot, user);
+            return {
+                branchRoot,
+                flatSchema,
+                contentRootName,
+                visibility: { shouldInclude: (logicalPath) => checkAccess(logicalPath, 'read').allowed },
+            };
         };
         const buildContentTree = async (options) => {
-            const { branchRoot, flatSchema, contentRootName } = await resolveSchemaContext();
-            return buildContentTreeImpl(branchRoot, flatSchema, contentRootName, options, await resolveVisibility());
+            const { branch, ...treeOptions } = options ?? {};
+            const source = await resolveListingSource(branch);
+            if (!source)
+                return [];
+            return buildContentTreeImpl(source.branchRoot, source.flatSchema, source.contentRootName, treeOptions, source.visibility);
         };
         const listEntries = async (options) => {
-            const { branchRoot, flatSchema, contentRootName } = await resolveSchemaContext();
-            return listEntriesImpl(branchRoot, flatSchema, contentRootName, options, await resolveVisibility());
+            const { branch, ...listOptions } = options ?? {};
+            const source = await resolveListingSource(branch);
+            if (!source)
+                return [];
+            return listEntriesImpl(source.branchRoot, source.flatSchema, source.contentRootName, listOptions, source.visibility);
         };
         return {
             read,

package/dist/editor/Editor.js

@@ -24,6 +24,7 @@ import { EditorFooter, EditorHeader, EditorSidebar } from './components/index.js
 import { RenameEntryModal } from './components/RenameEntryModal.js';
 import { EntryCreateModal } from './components/EntryCreateModal.js';
 import { ConfirmDeleteModal } from './components/ConfirmDeleteModal.js';
+import { NoEditPermissionNotice } from './components/NoEditPermissionNotice.js';
 import { CollectionEditor } from './schema-editor/index.js';
 import { AssetContextProvider, useApiClient } from './context/index.js';
 import { EntryLinkContext } from './fields/entry-link/index.js';
@@ -224,9 +225,8 @@ export const Editor = ({ entries, title, subtitle, siteTitle = title, siteSubtit
                 // branch's content. Writing it would (a) show it as the new branch's
                 // content and (b) satisfy the skip gate above, permanently suppressing
                 // the new branch's own load -- which also leaves the new branch's OCC
-                // token unset, turning the next save into a blind overwrite that can
-                // never 409. Drop it instead; the new branch has its own load running
-                // under its own key.
+                // token unset, so saveEntry refuses every save of the entry. Drop it
+                // instead; the new branch has its own load running under its own key.
                 if (currentBranchRef.current !== requestBranch)
                     return;
                 setLoadedValues((prev) => ({ ...prev, [contentId]: loaded }));
@@ -644,7 +644,7 @@ export const Editor = ({ entries, title, subtitle, siteTitle = title, siteSubtit
                                                 ? 'Setting up your branch workspace…'
                                                 : entriesInitializing
                                                     ? 'Loading content…'
-                                                    : 'Select an item to start editing.' })) : currentEntry.canEdit === false ? (_jsx(CenteredMessage, { children: "You don't have permission to edit this content." })) : schema.length > 0 && effectiveValue ? (_jsx(EntryLinkContext.Provider, { value: entryLinkContextValue, children: _jsx(FormRenderer, { fields: schema, value: effectiveValue, onChange: (next) => {
+                                                    : 'Select an item to start editing.' })) : currentEntry.canEdit === false ? (_jsx(NoEditPermissionNotice, { entryPath: currentEntry.path })) : schema.length > 0 && effectiveValue ? (_jsx(EntryLinkContext.Provider, { value: entryLinkContextValue, children: _jsx(FormRenderer, { fields: schema, value: effectiveValue, onChange: (next) => {
                                                     const contentId = currentEntry?.contentId;
                                                     if (contentId) {
                                                         setDrafts((prev) => ({ ...prev, [contentId]: next }));

package/dist/editor/FormRenderer.js

@@ -20,6 +20,18 @@ import { formatCanopyPath, normalizeCanopyPath } from './canopy-path.js';
 import { FieldWrapper } from './comments/FieldWrapper.js';
 import { EntryComments } from './comments/EntryComments.js';
 import { useReferenceResolution } from './hooks/useReferenceResolution.js';
+/**
+ * Card heading for an object-list item: the value of its `itemTitleField` when that is a
+ * non-blank string or a number, otherwise `fallback`.
+ */
+const listItemTitle = (item, itemTitleField, fallback) => {
+    const raw = itemTitleField ? item?.[itemTitleField] : undefined;
+    if (typeof raw === 'number' && Number.isFinite(raw))
+        return String(raw);
+    if (typeof raw === 'string' && raw.trim() !== '')
+        return raw.trim();
+    return fallback;
+};
 const normalizeOptions = (options) => {
     if (!options)
         return [];
@@ -135,11 +147,14 @@ export const FormRenderer = ({ fields, value, onChange, customRenderers, branch
                     const items = Array.isArray(currentValue)
                         ? currentValue
                         : [];
-                    return wrapWithComments(_jsx(Paper, { withBorder: true, radius: "md", p: "md", shadow: "xs", children: _jsxs(Stack, { gap: "sm", children: [_jsxs(Group, { justify: "space-between", children: [_jsx(Text, { size: "sm", fw: 600, children: label }), _jsx(Button, { size: "xs", variant: "light", onClick: () => update([...items, {}]), children: "Add item" })] }), _jsxs(Stack, { gap: "sm", children: [items.map((item, idx) => (_jsx(Paper, { withBorder: true, radius: "md", p: "sm", shadow: "xs", children: _jsxs(Stack, { gap: "xs", children: [_jsxs(Group, { justify: "space-between", children: [_jsxs(Text, { size: "xs", fw: 700, children: [label, " #", idx + 1] }), _jsx(Button, { size: "xs", variant: "subtle", color: "red", onClick: () => update(items.filter((_, i) => i !== idx)), children: "Remove" })] }), _jsx(ObjectField, { label: objectField.label, fields: objectField.fields, value: item, onChange: (next) => {
-                                                            const nextItems = [...items];
-                                                            nextItems[idx] = next;
-                                                            update(nextItems);
-                                                        }, renderField: renderField, path: [...path, idx], dataCanopyField: normalizeCanopyPath([...path, idx]) })] }) }, fieldKey([...path, idx])))), items.length === 0 && (_jsx(Text, { size: "xs", c: "dimmed", children: "No items yet. Add one to get started." }))] })] }) }, fieldKey(path)));
+                    return wrapWithComments(_jsx(Paper, { withBorder: true, radius: "md", p: "md", shadow: "xs", children: _jsxs(Stack, { gap: "sm", children: [_jsxs(Group, { justify: "space-between", children: [_jsx(Text, { size: "sm", fw: 600, children: label }), _jsx(Button, { size: "xs", variant: "light", onClick: () => update([...items, {}]), children: "Add item" })] }), _jsxs(Stack, { gap: "sm", children: [items.map((item, idx) => {
+                                            const itemTitle = listItemTitle(item, objectField.itemTitleField, `${label} #${idx + 1}`);
+                                            return (_jsx(Paper, { role: "group", "aria-label": itemTitle, withBorder: true, radius: "md", p: "sm", shadow: "xs", children: _jsxs(Stack, { gap: "xs", children: [_jsxs(Group, { justify: "space-between", children: [_jsx(Text, { size: "xs", fw: 700, children: itemTitle }), _jsx(Button, { size: "xs", variant: "subtle", color: "red", onClick: () => update(items.filter((_, i) => i !== idx)), children: "Remove" })] }), _jsx(ObjectField, { fields: objectField.fields, value: item, onChange: (next) => {
+                                                                const nextItems = [...items];
+                                                                nextItems[idx] = next;
+                                                                update(nextItems);
+                                                            }, renderField: renderField, path: [...path, idx], dataCanopyField: normalizeCanopyPath([...path, idx]) })] }) }, fieldKey([...path, idx])));
+                                        }), items.length === 0 && (_jsx(Text, { size: "xs", c: "dimmed", children: "No items yet. Add one to get started." }))] })] }) }, fieldKey(path)));
                 }
                 // Unlike the list branch above (each item has its own Remove button), a
                 // non-list object has no other way back to `undefined`: a required child

package/dist/editor/admin/SystemHealthPanel.js

@@ -59,7 +59,9 @@ function purgeGateFor(entry) {
     }
     return {
         disabled: lockFresh,
-        tooltip: lockFresh ? 'Provisioning may be in progress' : undefined,
+        tooltip: lockFresh
+            ? 'Provisioning, or the worker syncing this branch, may be in progress'
+            : undefined,
     };
 }
 function workerLivenessBadge(worker, mode) {
@@ -76,6 +78,33 @@ function workerLivenessBadge(worker, mode) {
             return { color: 'red', label: 'Worker: absent' };
     }
 }
+const BASE_REFRESH_LABELS = {
+    refreshed: 'fast-forwarded',
+    'up-to-date': 'up to date',
+    'skipped-dirty': 'refresh skipped (uncommitted changes)',
+    'skipped-locked': 'refresh skipped (workspace busy: provisioning or an admin action)',
+    'skipped-not-provisioned': 'not yet provisioned',
+    failed: 'refresh failed',
+};
+/**
+ * Why the base branch needs an operator, or null when its last refresh needs
+ * nothing. Shared by the overview and the base row's warning tooltip.
+ */
+function baseRefreshWarning(report) {
+    if (!report)
+        return null;
+    const lines = [];
+    if (report.outcome === 'skipped-dirty' || report.outcome === 'failed') {
+        lines.push(`Base branch ${BASE_REFRESH_LABELS[report.outcome]}${report.message ? `: ${report.message}` : ''}`);
+        if (report.dirtyFiles?.length)
+            lines.push(`Uncommitted: ${report.dirtyFiles.join(', ')}`);
+    }
+    if (report.trackedCanopyMeta?.length) {
+        lines.push(`The site repo tracks canopycms state (${report.trackedCanopyMeta.join(', ')}). ` +
+            'Untrack it with `git rm -r --cached .canopy-meta`, add `.canopy-meta/` to .gitignore, and commit.');
+    }
+    return lines.length > 0 ? lines.join('\n') : null;
+}
 // Mirrors BranchManager.tsx's statusColorMap -- kept local (not exported
 // there) rather than shared, same tiny lookup either way.
 const branchStatusColorMap = {
@@ -121,9 +150,10 @@ function OverviewTab({ health }) {
     const liveness = workerLivenessBadge(status.worker, status.mode);
     const lastFatalError = status.workerStatus?.lastFatalError;
     const lastGitSync = status.workerStatus?.lastGitSync;
+    const baseWarning = baseRefreshWarning(lastGitSync?.baseRefresh);
     return (_jsxs(Stack, { gap: "md", children: [error && (_jsx(Alert, { color: "red", icon: _jsx(IconAlertCircle, { size: 16 }), variant: "light", children: error })), _jsxs(Group, { gap: "sm", children: [_jsx(Badge, { color: liveness.color, variant: "light", size: "lg", children: liveness.label }), status.mode === 'dev' && (_jsx(Text, { size: "xs", c: "dimmed", children: "No worker runs in dev mode" }))] }), isRecentFatalError && lastFatalError && (_jsxs(Alert, { color: "red", icon: _jsx(IconAlertCircle, { size: 16 }), title: "Worker crash detected", children: [_jsx(Text, { size: "sm", children: lastFatalError.message }), _jsxs(Text, { size: "xs", c: "dimmed", mt: 4, children: ["at ", lastFatalError.at, " (", lastFatalError.phase, ")"] })] })), status.statusReadError && (_jsxs(Text, { size: "xs", c: "orange", children: ["Warning: could not read worker status (", status.statusReadError, ")"] })), status.workerStatus?.lastGitSyncError && (_jsxs(Alert, { color: "orange", icon: _jsx(IconAlertCircle, { size: 16 }), title: "Last git sync failed", children: [_jsx(Text, { size: "sm", children: status.workerStatus.lastGitSyncError.message }), _jsxs(Text, { size: "xs", c: "dimmed", mt: 4, children: ["at ", status.workerStatus.lastGitSyncError.at] })] })), lastGitSync && (_jsxs(Paper, { withBorder: true, p: "sm", radius: "md", children: [_jsx(Text, { size: "sm", fw: 600, children: "Last git sync" }), _jsxs(Text, { size: "xs", c: "dimmed", children: [status.workerStatus?.lastGitSyncAt ?? 'unknown time', " \u00B7 ", lastGitSync.durationMs, "ms \u00B7", ' ', lastGitSync.rebased.length, " rebased \u00B7 ", lastGitSync.skippedDirty.length, " skipped (dirty)", lastGitSync.skippedLocked && lastGitSync.skippedLocked.length > 0
-                                ? ` · ${lastGitSync.skippedLocked.length} skipped (content write in progress)`
-                                : ''] }), lastGitSync.failed.length > 0 && (_jsx(Spoiler, { maxHeight: 0, showLabel: `${lastGitSync.failed.length} failed — show details`, hideLabel: "Hide", children: _jsx(Stack, { gap: 4, mt: 4, children: lastGitSync.failed.map((f) => (_jsxs(Text, { size: "xs", c: "red", children: [f.branch, ": ", f.error] }, f.branch))) }) }))] })), _jsx(SimpleGrid, { cols: 5, spacing: "xs", children: ['pending', 'processing', 'completed', 'failed', 'corrupt'].map((key) => (_jsxs(Paper, { withBorder: true, p: "xs", radius: "md", ta: "center", children: [_jsx(Text, { size: "xs", c: "dimmed", tt: "capitalize", children: key }), _jsx(Text, { size: "lg", fw: 700, c: (key === 'failed' || key === 'corrupt') && status.queue[key] > 0 ? 'red' : undefined, children: status.queue[key] })] }, key))) }), status.queue.oldestPendingAgeMs !== undefined && (_jsxs(Text, { size: "xs", c: "dimmed", children: ["Oldest pending task: ", formatAgeMs(status.queue.oldestPendingAgeMs), " old"] })), _jsxs(Group, { justify: "space-between", align: "center", children: [_jsxs(Text, { size: "xs", c: "dimmed", children: ["Generated at ", status.generatedAt] }), _jsx(Button, { size: "xs", variant: "light", onClick: () => refresh(), loading: statusLoading, children: "Refresh" })] }), _jsx(Text, { size: "xs", c: "dimmed", children: "Data may lag up to ~60s (shared-filesystem caching)" })] }));
+                                ? ` · ${lastGitSync.skippedLocked.length} skipped (busy: a content write, provisioning or purge)`
+                                : ''] }), lastGitSync.baseRefresh && (_jsxs(Text, { size: "xs", c: "dimmed", "data-testid": "base-refresh-outcome", children: ["Base branch: ", BASE_REFRESH_LABELS[lastGitSync.baseRefresh.outcome]] })), baseWarning && (_jsx(Text, { size: "xs", c: "orange", style: { whiteSpace: 'pre-line' }, "data-testid": "base-refresh-warning", children: baseWarning })), lastGitSync.failed.length > 0 && (_jsx(Spoiler, { maxHeight: 0, showLabel: `${lastGitSync.failed.length} failed — show details`, hideLabel: "Hide", children: _jsx(Stack, { gap: 4, mt: 4, children: lastGitSync.failed.map((f) => (_jsxs(Text, { size: "xs", c: "red", children: [f.branch, ": ", f.error] }, f.branch))) }) }))] })), _jsx(SimpleGrid, { cols: 5, spacing: "xs", children: ['pending', 'processing', 'completed', 'failed', 'corrupt'].map((key) => (_jsxs(Paper, { withBorder: true, p: "xs", radius: "md", ta: "center", children: [_jsx(Text, { size: "xs", c: "dimmed", tt: "capitalize", children: key }), _jsx(Text, { size: "lg", fw: 700, c: (key === 'failed' || key === 'corrupt') && status.queue[key] > 0 ? 'red' : undefined, children: status.queue[key] })] }, key))) }), status.queue.oldestPendingAgeMs !== undefined && (_jsxs(Text, { size: "xs", c: "dimmed", children: ["Oldest pending task: ", formatAgeMs(status.queue.oldestPendingAgeMs), " old"] })), _jsxs(Group, { justify: "space-between", align: "center", children: [_jsxs(Text, { size: "xs", c: "dimmed", children: ["Generated at ", status.generatedAt] }), _jsx(Button, { size: "xs", variant: "light", onClick: () => refresh(), loading: statusLoading, children: "Refresh" })] }), _jsx(Text, { size: "xs", c: "dimmed", children: "Data may lag up to ~60s (shared-filesystem caching)" })] }));
 }
 function TasksTab({ health }) {
     const { taskStatus, setTaskStatus, tasks, tasksLoading } = health;
@@ -160,6 +190,7 @@ function TasksTab({ health }) {
 function BranchesTab({ health }) {
     const { branchHealth, branchHealthLoading } = health;
     const entries = branchHealth?.entries ?? [];
+    const baseWarning = baseRefreshWarning(health.status?.workerStatus?.lastGitSync?.baseRefresh);
     const handleMarkMergedClick = (branchName) => {
         modals.openConfirmModal({
             title: 'Mark branch as merged',
@@ -193,9 +224,9 @@ function BranchesTab({ health }) {
     if (entries.length === 0) {
         return (_jsx(Text, { size: "sm", c: "dimmed", py: "md", children: "No branch directories found." }));
     }
-    return (_jsx(Table.ScrollContainer, { minWidth: 700, children: _jsxs(Table, { children: [_jsx(Table.Thead, { children: _jsxs(Table.Tr, { children: [_jsx(Table.Th, { children: "Name" }), _jsx(Table.Th, { children: "Status" }), _jsx(Table.Th, { children: "PR" }), _jsx(Table.Th, { children: "Sync" }), _jsx(Table.Th, { children: "Warnings" }), _jsx(Table.Th, { children: "Updated" }), _jsx(Table.Th, { children: "Actions" })] }) }), _jsx(Table.Tbody, { children: entries.map((entry) => (_jsx(BranchHealthRow, { entry: entry, onMarkMerged: handleMarkMergedClick, onRepair: handleRepairClick, onPurge: handlePurgeClick }, entry.dirName))) })] }) }));
+    return (_jsx(Table.ScrollContainer, { minWidth: 700, children: _jsxs(Table, { children: [_jsx(Table.Thead, { children: _jsxs(Table.Tr, { children: [_jsx(Table.Th, { children: "Name" }), _jsx(Table.Th, { children: "Status" }), _jsx(Table.Th, { children: "PR" }), _jsx(Table.Th, { children: "Sync" }), _jsx(Table.Th, { children: "Warnings" }), _jsx(Table.Th, { children: "Updated" }), _jsx(Table.Th, { children: "Actions" })] }) }), _jsx(Table.Tbody, { children: entries.map((entry) => (_jsx(BranchHealthRow, { entry: entry, baseWarning: entry.isBaseBranch ? baseWarning : null, onMarkMerged: handleMarkMergedClick, onRepair: handleRepairClick, onPurge: handlePurgeClick }, entry.dirName))) })] }) }));
 }
-function BranchHealthRow({ entry, onMarkMerged, onRepair, onPurge, }) {
+function BranchHealthRow({ entry, baseWarning, onMarkMerged, onRepair, onPurge, }) {
     if (entry.kind === 'healthy' && entry.branch) {
         const b = entry.branch;
         // Mirrors the rebase loop's skip logic (worker/rebase.ts): the worker
@@ -207,7 +238,7 @@ function BranchHealthRow({ entry, onMarkMerged, onRepair, onPurge, }) {
         const canMarkMerged = (b.status === 'submitted' || b.status === 'approved') && !!b.pullRequestNumber;
         return (_jsxs(Table.Tr, { children: [_jsx(Table.Td, { children: _jsxs(Group, { gap: 4, wrap: "nowrap", children: [_jsx(Text, { size: "sm", children: entry.dirName }), entry.isBaseBranch && (_jsx(Badge, { size: "xs", color: "gray", variant: "outline", children: "base" }))] }) }), _jsx(Table.Td, { children: _jsx(Badge, { color: branchStatusColorMap[b.status] ?? 'neutral', variant: "light", children: b.status }) }), _jsx(Table.Td, { children: b.pullRequestNumber ? (_jsxs(Text, { size: "xs", c: "blue", component: "a", href: b.pullRequestUrl, target: "_blank", rel: "noopener noreferrer", style: { textDecoration: 'underline' }, children: ["PR #", b.pullRequestNumber, b.pullRequestState ? ` (${b.pullRequestState})` : ''] })) : (_jsx(Text, { size: "xs", c: "dimmed", children: "\u2014" })) }), _jsx(Table.Td, { children: b.syncStatus === 'sync-failed' ? (_jsx(Tooltip, { label: b.syncFailureReason
                             ? `${b.syncFailureReason} — retry from the Tasks tab`
-                            : 'GitHub sync failed — retry from the Tasks tab', multiline: true, maw: 320, children: _jsx(Badge, { color: "red", variant: "light", children: "sync-failed" }) })) : b.syncStatus === 'pending-sync' ? (_jsx(Badge, { color: "gray", variant: "light", children: "pending-sync" })) : null }), _jsx(Table.Td, { children: _jsxs(Group, { gap: 6, wrap: "nowrap", children: [!!b.conflictFiles?.length && (_jsxs(Badge, { color: "orange", variant: "light", children: [b.conflictFiles.length, " conflict", b.conflictFiles.length === 1 ? '' : 's'] })), showRebaseFailure && b.rebaseFailure && (_jsx(Tooltip, { label: `${b.rebaseFailure.message} (failing since ${b.rebaseFailure.firstAt})`, multiline: true, maw: 320, children: _jsx(ThemeIcon, { color: "yellow", variant: "light", size: "sm", radius: "xl", "data-testid": `rebase-failure-${entry.dirName}`, children: _jsx(IconAlertTriangle, { size: 12 }) }) })), !!entry.duplicateContentIds?.length && (_jsx(Tooltip, { label: entry.duplicateContentIds
+                            : 'GitHub sync failed — retry from the Tasks tab', multiline: true, maw: 320, children: _jsx(Badge, { color: "red", variant: "light", children: "sync-failed" }) })) : b.syncStatus === 'pending-sync' ? (_jsx(Badge, { color: "gray", variant: "light", children: "pending-sync" })) : null }), _jsx(Table.Td, { children: _jsxs(Group, { gap: 6, wrap: "nowrap", children: [!!b.conflictFiles?.length && (_jsxs(Badge, { color: "orange", variant: "light", children: [b.conflictFiles.length, " conflict", b.conflictFiles.length === 1 ? '' : 's'] })), showRebaseFailure && b.rebaseFailure && (_jsx(Tooltip, { label: `${b.rebaseFailure.message} (failing since ${b.rebaseFailure.firstAt})`, multiline: true, maw: 320, children: _jsx(ThemeIcon, { color: "yellow", variant: "light", size: "sm", radius: "xl", "data-testid": `rebase-failure-${entry.dirName}`, children: _jsx(IconAlertTriangle, { size: 12 }) }) })), baseWarning && (_jsx(Tooltip, { label: baseWarning, multiline: true, maw: 420, style: { whiteSpace: 'pre-line' }, children: _jsx(ThemeIcon, { color: "yellow", variant: "light", size: "sm", radius: "xl", "data-testid": `base-refresh-warning-${entry.dirName}`, children: _jsx(IconAlertTriangle, { size: 12 }) }) })), !!entry.duplicateContentIds?.length && (_jsx(Tooltip, { label: entry.duplicateContentIds
                                     .map((d) => `${d.id}: kept ${d.keptPath}; also on ${d.droppedPaths.join(', ')}`)
                                     .join('\n'), multiline: true, maw: 420, style: { whiteSpace: 'pre-line' }, children: _jsxs(Badge, { color: "orange", variant: "light", "data-testid": `duplicate-content-ids-${entry.dirName}`, children: [entry.duplicateContentIds.length, " duplicate ID", entry.duplicateContentIds.length === 1 ? '' : 's'] }) }))] }) }), _jsx(Table.Td, { children: _jsx(Text, { size: "xs", c: "dimmed", children: b.updatedAt }) }), _jsx(Table.Td, { children: canMarkMerged && (_jsx(Button, { size: "xs", variant: "light", "data-testid": `mark-merged-${b.name}`, onClick: () => onMarkMerged(b.name), children: "Mark merged" })) })] }));
     }

package/dist/editor/components/NoEditPermissionNotice.d.ts

@@ -0,0 +1,10 @@
+export interface NoEditPermissionNoticeProps {
+    /** Logical path of the entry the user cannot edit. */
+    entryPath: string;
+}
+/**
+ * Explains why an entry cannot be edited and whom to ask. An entry's `canEdit` is false only
+ * when a path rule (or `defaultPathAccess`) denies edit, so that is the reason it gives; a
+ * locked or protected branch shows its own banner in the header and a read-only form instead.
+ */
+export declare function NoEditPermissionNotice({ entryPath }: NoEditPermissionNoticeProps): import("react/jsx-runtime").JSX.Element;

package/dist/editor/components/NoEditPermissionNotice.js

@@ -0,0 +1,17 @@
+import { jsxs as _jsxs, jsx as _jsx } from "react/jsx-runtime";
+import { Text } from '@mantine/core';
+/**
+ * Explains why an entry cannot be edited and whom to ask. An entry's `canEdit` is false only
+ * when a path rule (or `defaultPathAccess`) denies edit, so that is the reason it gives; a
+ * locked or protected branch shows its own banner in the header and a read-only form instead.
+ */
+export function NoEditPermissionNotice({ entryPath }) {
+    return (_jsx("div", { role: "status", "data-testid": "no-edit-permission-notice", style: {
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'center',
+            height: '100%',
+            padding: '0 var(--mantine-spacing-md)',
+            textAlign: 'center',
+        }, children: _jsxs(Text, { size: "sm", c: "dimmed", children: ["You don't have edit access to \"", entryPath, "\". Ask a CanopyCMS admin to grant it in Manage Permissions."] }) }));
+}

package/dist/editor/hooks/useBranchesData.js

@@ -13,6 +13,7 @@
  * `mutate()` to revalidate.
  */
 import useSWR from 'swr';
+import { isNonApiResponse } from '../../api/client.js';
 /** Cache key for the branches list. */
 export const BRANCHES_KEY = 'canopy:branches';
 /**
@@ -21,9 +22,10 @@ export const BRANCHES_KEY = 'canopy:branches';
  */
 export async function fetchBranches(apiClient) {
     const result = await apiClient.branches.list();
-    if (result.status === 404) {
+    if (result.status === 404 && !isNonApiResponse(result)) {
         // No branch endpoint available; stay branchless rather than erroring --
         // the branch dropdown stays clickable so the user can retry from there.
+        // A proxy's 404 page means the API was not reached, so it is an error.
         return { branches: [] };
     }
     if (!result.ok) {

package/dist/editor/hooks/useDraftManager.d.ts

@@ -14,7 +14,7 @@ export interface UseDraftManagerOptions {
      * shown (useEntryManager's `getEntryVersion`). Stamps each draft with the
      * version it was based on, and detects at save time that the token has
      * since moved on. Optional: without it no base versions are recorded and
-     * conflict detection falls back entirely to the server's 409.
+     * conflict detection falls back entirely to saveEntry's token check.
      */
     getEntryVersion?: (contentId: string) => number | undefined;
     setBusy: (busy: boolean) => void;

package/dist/editor/hooks/useDraftManager.js

@@ -316,7 +316,8 @@ export function useDraftManager(options) {
             return 'ok';
         const currentVersion = options.getEntryVersion?.(currentId);
         // No server version known for this entry at all -- nothing to compare
-        // against, so this check has no opinion (the server's 409 still applies).
+        // against, so this check has no opinion: saveEntry refuses a save without
+        // a token, and the server refuses a version-less update.
         if (currentVersion === undefined)
             return 'ok';
         const base = draftBaseVersionsRef.current[currentId];

package/dist/editor/hooks/useEntriesData.js

@@ -40,7 +40,7 @@ export async function listAllEntries(apiClient, branch) {
             ...(cursor !== undefined ? { cursor } : {}),
         });
         if (!result.ok || !result.data)
-            throw new Error(`Refresh failed: ${result.status}`);
+            throw new Error(`Refresh failed: ${result.status}${result.error ? ` — ${result.error}` : ''}`);
         const data = result.data;
         for (const entry of data.entries)
             byPath.set(entry.logicalPath, entry);
@@ -60,7 +60,7 @@ export async function fetchEntriesAndSchema(apiClient, branch, params) {
     // Fetch schema from schema API
     const schemaResult = await apiClient.schema.get({ branch });
     if (!schemaResult.ok || !schemaResult.data) {
-        throw new Error(`Schema fetch failed: ${schemaResult.status}`);
+        throw new Error(`Schema fetch failed: ${schemaResult.status}${schemaResult.error ? ` — ${schemaResult.error}` : ''}`);
     }
     // Hydrate wire flatSchema: resolve schemaRef -> schema from entrySchemas dict
     const { entrySchemas } = schemaResult.data;

package/dist/editor/hooks/useEntryManager.js

@@ -50,11 +50,9 @@ export function useEntryManager(options) {
     // case -- any first visit to a branch, for the whole duration of its fetch),
     // or a stale SWR slot. The editor then auto-selected one of those stale
     // entries (see the selection effect below), and a save could file its OCC
-    // token under one contentId and look it up under another, silently skipping
-    // conflict detection -- `content-store.ts` only compares mtimes when
-    // `expectedVersion !== undefined`, so the write became a blind overwrite.
-    // Deriving from a stamped record fixes that structurally instead of relying
-    // on every code path remembering to clear.
+    // token under one contentId and look it up under another. Deriving from a
+    // stamped record fixes that structurally instead of relying on every code
+    // path remembering to clear.
     const [view, setView] = useState(() => ({
         branch: options.branchName,
         entries: options.initialEntries,
@@ -86,6 +84,9 @@ export function useEntryManager(options) {
     // branch can repopulate the map after the branch-change clear() below and
     // poison the next save with the old branch's mtime — a deterministic 409
     // ("modified by another editor") on save-after-switch, proven by e2e trace.
+    // The contentId half matches how useDraftManager keys drafts and loaded
+    // values, so a form value and its token always belong to the same file even
+    // when a path is deleted and recreated; it also survives a rename.
     const entryVersionsRef = useRef(new Map());
     const versionKey = (branch, contentId) => `${branch}:${contentId}`;
     // PER-BRANCH monotonic tokens guarding every commit of the fetched
@@ -192,7 +193,7 @@ export function useEntryManager(options) {
             path,
         });
         if (!result.ok)
-            throw new Error(`Load failed: ${result.status}`);
+            throw new Error(`Load failed: ${result.status}${result.error ? ` — ${result.error}` : ''}`);
         // Capture OCC version token for next save
         if (entry.contentId && typeof result.data?.version === 'number') {
             entryVersionsRef.current.set(versionKey(requestBranch, entry.contentId), result.data.version);
@@ -220,18 +221,23 @@ export function useEntryManager(options) {
         };
         if (entry.entryType)
             writeParams.entryType = entry.entryType;
-        const expectedVersion = entry.contentId
-            ? entryVersionsRef.current.get(versionKey(requestBranch, entry.contentId))
-            : undefined;
+        const expectedVersion = entryVersionsRef.current.get(versionKey(requestBranch, entry.contentId));
+        // Every entry saved here already exists (creates go through handleCreateModalSubmit), so
+        // no token means this entry was never successfully read on this branch and nothing could check the save
+        // against other editors' work. Refused as a conflict; the server refuses it too.
+        if (expectedVersion === undefined) {
+            throw new SaveApiError(409, 'This entry has not been loaded from the server, so the save cannot be checked ' +
+                "against other editors' changes. Reload it and try again.");
+        }
         const writeBody = {
             ...payload,
-            ...(expectedVersion !== undefined ? { expectedVersion } : {}),
+            expectedVersion,
         };
         const result = await apiClient.content.write(writeParams, writeBody);
         if (!result.ok)
             throw new SaveApiError(result.status, result.error, result.fieldErrors);
         // Update stored version token from write response
-        if (entry.contentId && typeof result.data?.version === 'number') {
+        if (typeof result.data?.version === 'number') {
             entryVersionsRef.current.set(versionKey(requestBranch, entry.contentId), result.data.version);
         }
         // Warning-level issues from the adopter's validateEntry hook: saved, but surface them

package/dist/entry-schema-registry.js

@@ -2,7 +2,7 @@ import { countTitleFields, findInvalidTitleFields, findTitleFieldsInLists, } fro
 import { countBodyFields, findInvalidBodyFields, findReservedBodyFieldName, } from './utils/body-field.js';
 import { RESOLVED_REFERENCE_KEYS } from './entry-schema.js';
 import { flattenGroupFields } from './utils/flatten-group-fields.js';
-import { ensureSelectFieldsHaveOptions, ensureReferenceFieldsHaveScope, ensureNoFlattenedFieldNameCollisions, ensureNoGroupsInsideComplexFields, } from './config/validation.js';
+import { ensureSelectFieldsHaveOptions, ensureReferenceFieldsHaveScope, ensureItemTitleFieldsExist, ensureNoFlattenedFieldNameCollisions, ensureNoGroupsInsideComplexFields, } from './config/validation.js';
 /** Look up a field's type by dotted path (e.g., "meta.order").
  * Groups are transparent — their children are searched at the same path level. */
 function findFieldType(fields, dottedPath) {
@@ -94,6 +94,7 @@ export function createEntrySchemaRegistry(registry) {
         }
         ensureSelectFieldsHaveOptions(schema);
         ensureReferenceFieldsHaveScope(schema);
+        ensureItemTitleFieldsExist(schema);
         ensureNoGroupsInsideComplexFields(schema);
         ensureNoFlattenedFieldNameCollisions(schema, `entry schema "${key}"`);
     }

package/dist/git-manager.d.ts

@@ -69,6 +69,17 @@ export declare class GitRemoteRefMissingError extends Error {
      */
     gitError?: unknown | undefined);
 }
+/**
+ * No git remote is configured and the one the strategy auto-detects does not
+ * exist yet: in prod, the EC2 worker creates `{workspaceRoot}/remote.git` on
+ * its first boot, so until then every request that needs a workspace fails
+ * here. Usually transient, unlike a missing remote in a mode with nothing to wait for.
+ * The HTTP layer maps it to a 503 (`http/worker-not-ready.ts`).
+ */
+export declare class RemoteNotReadyError extends Error {
+    readonly expectedRemotePath: string;
+    constructor(expectedRemotePath: string);
+}
 export interface ResolveRemoteUrlOptions {
     mode: OperatingMode;
     remoteUrl?: string;
@@ -283,6 +294,8 @@ export declare class GitManager {
     rebaseOntoBase(): Promise<void>;
     private rebaseOntoBaseInner;
     add(files: string | string[]): Promise<void>;
+    /** Stage every working-tree change except canopycms's own state. See {@link stageAllExceptCanopyState}. */
+    addAllExceptCanopyState(): Promise<void>;
     commit(message: string): Promise<void>;
     push(branch?: string): Promise<void>;
     /**
@@ -303,6 +316,13 @@ export declare class GitManager {
      * ("couldn't find remote ref"); that counts as "ahead", not an error.
      */
     hasUnpushedCommits(branch?: string): Promise<boolean>;
+    /**
+     * Repo-relative paths that differ between HEAD and its merge base with the
+     * base branch: everything the branch changes, across all of its commits.
+     * Diffs against the just-fetched base tip pinned to a SHA — the pullBaseInner
+     * constraint.
+     */
+    listChangedPathsSinceBase(): Promise<string[]>;
     ensureAuthor(author: {
         name: string;
         email: string;