canopycms 0.0.67 → 0.0.68-int.93

package/dist/git-manager.js

@@ -20,7 +20,7 @@ import { invalidateContentIndexesForRoot } from './content-index-registry.js';
 import { invalidateBranchContentCaches } from './content-index-generation.js';
 import { createDebugLogger } from './utils/debug.js';
 import { getErrorMessage, isNotFoundError } from './utils/error.js';
-import { isMissingRemoteRefFailure, isNetworkRemoteUrl, resolveBaseBranch } from './utils/git.js';
+import { isMissingRemoteRefFailure, isNetworkRemoteUrl, resolveBaseBranch, stageAllExceptCanopyState, } from './utils/git.js';
 import { acquireProvisioningLock } from './utils/provisioning-lock.js';
 const log = createDebugLogger({ prefix: 'GitManager' });
 /**
@@ -166,6 +166,21 @@ export class GitRemoteRefMissingError extends Error {
         this.name = 'GitRemoteRefMissingError';
     }
 }
+/**
+ * No git remote is configured and the one the strategy auto-detects does not
+ * exist yet: in prod, the EC2 worker creates `{workspaceRoot}/remote.git` on
+ * its first boot, so until then every request that needs a workspace fails
+ * here. Usually transient, unlike a missing remote in a mode with nothing to wait for.
+ * The HTTP layer maps it to a 503 (`http/worker-not-ready.ts`).
+ */
+export class RemoteNotReadyError extends Error {
+    constructor(expectedRemotePath) {
+        super(`CanopyCMS: no git remote is available yet. defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is ` +
+            `not set and the CMS worker has not created ${expectedRemotePath}; the worker may still be starting.`);
+        this.expectedRemotePath = expectedRemotePath;
+        this.name = 'RemoteNotReadyError';
+    }
+}
 export class GitManager {
     constructor(options, gitOptions) {
         this.repoPath = path.resolve(options.repoPath);
@@ -696,6 +711,10 @@ export class GitManager {
                 allowNetworkRemoteInProd: options.allowNetworkRemoteInProd,
             });
             if (!remoteUrl) {
+                const { operatingStrategy } = await import('./operating-mode/index.js');
+                const { autoDetectRemotePath } = operatingStrategy(options.mode).getRemoteUrlConfig();
+                if (autoDetectRemotePath)
+                    throw new RemoteNotReadyError(autoDetectRemotePath);
                 throw new Error('CanopyCMS: defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is required to initialize workspace');
             }
             try {
@@ -970,6 +989,10 @@ export class GitManager {
         const fileArray = Array.isArray(files) ? files : [files];
         await this.git.add(fileArray);
     }
+    /** Stage every working-tree change except canopycms's own state. See {@link stageAllExceptCanopyState}. */
+    async addAllExceptCanopyState() {
+        await stageAllExceptCanopyState(this.git);
+    }
     async commit(message) {
         await this.git.commit(message);
     }
@@ -1010,12 +1033,14 @@ export class GitManager {
         // `--end-of-options` before every caller-influenced ref name, as in push()
         // above: names are sanitized upstream, but this file's rule is that a
         // positional is guarded where it is passed, not where it was validated.
-        const target = branch ?? (await this.git.revparse(['--abbrev-ref', '--end-of-options', 'HEAD']));
-        const localSha = (await this.git.revparse(['--end-of-options', target])).trim();
+        // Each rev-parse needs `--verify`: without it, rev-parse echoes
+        // `--end-of-options` as its own output line ahead of the result.
+        const target = branch ?? (await this.git.revparse(['--verify', '--abbrev-ref', '--end-of-options', 'HEAD']));
+        const localSha = (await this.git.revparse(['--verify', '--end-of-options', target])).trim();
         let fetchedTip;
         try {
             await this.git.raw(['fetch', '--end-of-options', this.remote, target]);
-            fetchedTip = (await this.git.revparse(['--end-of-options', 'FETCH_HEAD'])).trim();
+            fetchedTip = (await this.git.revparse(['--verify', '--end-of-options', 'FETCH_HEAD'])).trim();
         }
         catch {
             // No ref on the remote yet -- the branch has never been pushed.
@@ -1028,6 +1053,27 @@ export class GitManager {
         const aheadCount = (await this.git.raw(['rev-list', '--count', `${fetchedTip}..${localSha}`])).trim();
         return aheadCount !== '0';
     }
+    /**
+     * Repo-relative paths that differ between HEAD and its merge base with the
+     * base branch: everything the branch changes, across all of its commits.
+     * Diffs against the just-fetched base tip pinned to a SHA — the pullBaseInner
+     * constraint.
+     */
+    async listChangedPathsSinceBase() {
+        await this.git.raw(['fetch', '--end-of-options', this.remote, this.baseBranch]);
+        // `--verify`: without it rev-parse echoes `--end-of-options` back as output.
+        const baseTip = (await this.git.revparse(['--verify', '--end-of-options', 'FETCH_HEAD'])).trim();
+        // -z: NUL-separated and unquoted, so no path needs unescaping.
+        const output = await this.git.raw([
+            'diff',
+            '--name-only',
+            '-z',
+            '--no-renames',
+            `${baseTip}...HEAD`,
+            '--',
+        ]);
+        return output.split('\0').filter((p) => p.length > 0);
+    }
     async ensureAuthor(author) {
         const config = (await this.git.listConfig());
         // Verify this is a CanopyCMS-managed workspace before setting author

package/dist/github-service.d.ts

@@ -76,6 +76,7 @@ export interface PullRequestDetails {
     state: 'open' | 'closed';
     merged: boolean;
     draft: boolean;
+    body: string;
 }
 export interface CreateOrUpdatePullRequestParams {
     octokit: Octokit;
@@ -87,6 +88,11 @@ export interface CreateOrUpdatePullRequestParams {
     body: string;
     /** Convert a pre-existing draft PR to ready-for-review after updating it. */
     markReadyIfDraft?: boolean;
+    /**
+     * `body` is the canopycms PR section: an existing PR keeps the text outside
+     * its section (see mergePrSection) instead of having its body replaced.
+     */
+    mergeSectionIntoBody?: boolean;
     /** Forwarded to all GitHub requests (worker task-timeout abort). */
     signal?: AbortSignal;
 }
@@ -128,6 +134,8 @@ export declare class GitHubService {
         body: string;
         /** Convert a pre-existing draft PR to ready-for-review after updating it. */
         markReadyIfDraft?: boolean;
+        /** See {@link CreateOrUpdatePullRequestParams.mergeSectionIntoBody}. */
+        mergeSectionIntoBody?: boolean;
     }): Promise<{
         number: number;
         url: string;

package/dist/github-service.js

@@ -7,6 +7,7 @@ import { getErrorMessage } from './utils/error.js';
 // or CloudWatch folds it into the previous event. Under Lambda/dev the helper
 // is plain console. See utils/logger.ts.
 import { canopyLogWarn } from './utils/logger.js';
+import { mergePrSection } from './submission-attribution.js';
 const ThrottledOctokit = Octokit.plugin(throttling);
 /**
  * Retry primary rate limits at most twice and only for short waits; beyond
@@ -67,6 +68,7 @@ export function createCanopyOctokit(options) {
  */
 export async function createOrUpdatePullRequest(params) {
     const { octokit, owner, repo, head, base, title, body, markReadyIfDraft, signal } = params;
+    const mergeSection = params.mergeSectionIntoBody === true;
     // CONDITIONAL spread: with no signal, the request objects below carry no
     // `request` key at all (github-service.test.ts asserts on their exact shape).
     const requestOption = signal ? { request: { signal } } : {};
@@ -92,7 +94,7 @@ export async function createOrUpdatePullRequest(params) {
             repo,
             pull_number: existing.number,
             title,
-            body,
+            body: mergeSection ? mergePrSection(existing.body, body) : body,
             ...requestOption,
         });
         // Only a pre-existing PR can be a draft on this path — pulls.create
@@ -185,6 +187,7 @@ export class GitHubService {
             title: options.title,
             body: options.body,
             markReadyIfDraft: options.markReadyIfDraft,
+            mergeSectionIntoBody: options.mergeSectionIntoBody,
         });
         return { number: result.number, url: result.url };
     }
@@ -200,6 +203,7 @@ export class GitHubService {
             state: response.data.state,
             merged: response.data.merged ?? false,
             draft: response.data.draft ?? false,
+            body: response.data.body ?? '',
         };
     }
     async convertToDraft(prNumber) {

package/dist/http/handler.js

@@ -1,4 +1,5 @@
 import { jsonResponse, isCanopyBinaryResponse } from './types.js';
+import { workerNotReadyResponse } from './worker-not-ready.js';
 import { createCanopyRouter } from './router.js';
 import { assertAuthPluginAllowedForMode } from '../auth/plugin.js';
 import { createCanopyServices } from '../services.js';
@@ -13,6 +14,7 @@ import { getErrorMessage, redactCredentials, sanitizeErrorMessage } from '../uti
 // stay out of the worker's runtime import closure, so new log lines here go
 // through the indirection (utils/logger.ts).
 import { canopyLogError } from '../utils/logger.js';
+import { runWithRequestTiming, setRequestTimingRoute, timeRequestPhase, } from '../utils/request-timing.js';
 const buildContext = async (options) => {
     const services = options.services ?? (options.config ? await createCanopyServices(options.config) : undefined);
     if (!services) {
@@ -62,7 +64,7 @@ const buildContext = async (options) => {
     return {
         services,
         assetStore: options.assetStore,
-        getBranchContext,
+        getBranchContext: (branch, opts) => timeRequestPhase('branchContext', () => getBranchContext(branch, opts)),
         authPlugin: options.authPlugin,
     };
 };
@@ -109,10 +111,11 @@ export function createCanopyRequestHandler(options) {
         if (!match) {
             return jsonResponse({ ok: false, status: 404, error: 'Not found' }, 404);
         }
-        const apiCtx = await getContext();
+        setRequestTimingRoute(match.pattern.join('/') || '(malformed path)');
+        const apiCtx = await timeRequestPhase('context', getContext);
         // In dev mode, re-check if the developer switched git branches
-        await apiCtx.services.refreshActiveBranch();
-        const authResult = await options.authPlugin.authenticate(req);
+        await timeRequestPhase('refreshBranch', () => apiCtx.services.refreshActiveBranch());
+        const authResult = await timeRequestPhase('auth', () => options.authPlugin.authenticate(req));
         // API routes require authentication. Anonymous callers are rejected BEFORE
         // any workspace provisioning below, so they can neither trigger expensive
         // git operations nor read provisioning error details.
@@ -141,6 +144,9 @@ export function createCanopyRequestHandler(options) {
                 // (authenticated) client. Credentials, which git errors can embed, are
                 // redacted even from the server logs.
                 console.error(`CanopyCMS: Failed to provision workspace for base branch '${baseBranch}': ${redactCredentials(message)}`);
+                const notReady = workerNotReadyResponse(err);
+                if (notReady)
+                    return notReady;
                 return jsonResponse({
                     ok: false,
                     status: 503,
@@ -157,15 +163,21 @@ export function createCanopyRequestHandler(options) {
         // a silent authorization change.
         let user;
         try {
-            user = await resolveCanopyUser(authResult, {
+            user = await timeRequestPhase('user', () => resolveCanopyUser(authResult, {
                 getSettingsBranchRoot: apiCtx.services.getSettingsBranchRoot,
                 mode: apiCtx.services.config.mode,
                 bootstrapAdminIds: apiCtx.services.bootstrapAdminIds,
-            });
+            }));
         }
         catch (err) {
             const message = getErrorMessage(err);
             canopyLogError(`CanopyCMS: Failed to resolve internal groups from the settings workspace: ${redactCredentials(message)}`);
+            // No remote means no settings workspace, so /admin cannot load either:
+            // the worker has not created the remote yet, so every caller gets the
+            // not-ready 503, bootstrap admins included.
+            const notReady = workerNotReadyResponse(err);
+            if (notReady)
+                return notReady;
             // Same trade as the base-branch degradation above: /admin is the recovery
             // surface for exactly this failure (a renamed settings branch trips
             // assertSettingsWorkspaceIdentity until a human intervenes), so 503ing it
@@ -231,7 +243,7 @@ export function createCanopyRequestHandler(options) {
             if (validationResult.body !== undefined) {
                 handlerArgs.push(validationResult.body);
             }
-            const result = await match.handler(...handlerArgs);
+            const result = await timeRequestPhase('route', () => match.handler(...handlerArgs));
             // Binary routes carry their own status and headers and MUST reach the
             // adapter untouched: jsonResponse would serialize raw bytes and drop
             // contentType/contentDisposition.
@@ -242,7 +254,7 @@ export function createCanopyRequestHandler(options) {
         else {
             // Every route should use defineEndpoint; this is the safety net for one
             // that carries no validate function.
-            const result = await match.handler(apiCtx, apiReq, mergedParams);
+            const result = await timeRequestPhase('route', () => match.handler(apiCtx, apiReq, mergedParams));
             if (isCanopyBinaryResponse(result))
                 return result;
             return jsonResponse(result, result.status);
@@ -250,12 +262,15 @@ export function createCanopyRequestHandler(options) {
     };
     return async (req, pathSegments) => {
         try {
-            return await handleRequest(req, pathSegments);
+            return await runWithRequestTiming(req.method, () => handleRequest(req, pathSegments), (response) => response.status);
         }
         catch (err) {
             // Last-resort boundary (API-C1): see handleRequest's doc comment above.
             const message = getErrorMessage(err);
             console.error('CanopyCMS: Unhandled error in API request handler:', message);
+            const notReady = workerNotReadyResponse(err);
+            if (notReady)
+                return notReady;
             return jsonResponse({ ok: false, status: 500, error: sanitizeErrorMessage(message) }, 500);
         }
     };

package/dist/http/index.d.ts

@@ -4,3 +4,5 @@ export type { CanopyHandler, RouteDefinition, RouteMatch, CanopyRouter } from '.
 export { createCanopyRouter } from './router.js';
 export type { CanopyHandlerOptions, CanopyRequestHandler } from './handler.js';
 export { createCanopyRequestHandler, createCanopyRequestHandlerFromConfig } from './handler.js';
+export { RemoteNotReadyError } from '../git-manager.js';
+export { workerNotReadyResponse, WORKER_NOT_READY_MESSAGE } from './worker-not-ready.js';

package/dist/http/index.js

@@ -1,3 +1,5 @@
 export { jsonResponse, isCanopyBinaryResponse } from './types.js';
 export { createCanopyRouter } from './router.js';
 export { createCanopyRequestHandler, createCanopyRequestHandlerFromConfig } from './handler.js';
+export { RemoteNotReadyError } from '../git-manager.js';
+export { workerNotReadyResponse, WORKER_NOT_READY_MESSAGE } from './worker-not-ready.js';

package/dist/http/router.d.ts

@@ -32,6 +32,8 @@ export interface RouteDefinition {
 }
 export interface RouteMatch {
     handler: CanopyHandler;
+    /** The matched route's pattern; empty for the synthetic malformed-path match. */
+    pattern: readonly string[];
     params: Record<string, string>;
     validate?: RouteDefinition['validate'];
     bodyFormat?: RouteDefinition['bodyFormat'];

package/dist/http/router.js

@@ -122,10 +122,11 @@ export function matchRoute(routes, method, segments) {
         decodedParams = Object.fromEntries(Object.entries(best.params).map(([key, value]) => [key, decodeURIComponent(value)]));
     }
     catch {
-        return { handler: malformedPathHandler, params: {} };
+        return { handler: malformedPathHandler, pattern: [], params: {} };
     }
     return {
         handler: best.route.handler,
+        pattern: best.route.pattern,
         params: decodedParams,
         validate: best.route.validate, // Include validation function if present
         bodyFormat: best.route.bodyFormat,

package/dist/http/worker-not-ready.d.ts

@@ -0,0 +1,9 @@
+import type { ApiResponse } from '../api/types.js';
+import { type CanopyResponse } from './types.js';
+export declare const WORKER_NOT_READY_MESSAGE = "CMS worker not ready \u2014 it may still be starting. Try again in a minute; if this persists, ask an admin to check the CMS worker.";
+/**
+ * The 503 for a request that hit {@link RemoteNotReadyError}, or `undefined`
+ * for any other error. The single mapping point for the core handler, the AI route and
+ * every framework adapter's backstop, so the message and `Retry-After` cannot diverge.
+ */
+export declare function workerNotReadyResponse(err: unknown): CanopyResponse<ApiResponse> | undefined;

package/dist/http/worker-not-ready.js

@@ -0,0 +1,17 @@
+import { RemoteNotReadyError } from '../git-manager.js';
+import { jsonResponse } from './types.js';
+/** Seconds a client should wait before retrying while the worker boots. */
+const RETRY_AFTER_SECONDS = '30';
+export const WORKER_NOT_READY_MESSAGE = 'CMS worker not ready — it may still be starting. Try again in a minute; if this persists, ask an admin to check the CMS worker.';
+/**
+ * The 503 for a request that hit {@link RemoteNotReadyError}, or `undefined`
+ * for any other error. The single mapping point for the core handler, the AI route and
+ * every framework adapter's backstop, so the message and `Retry-After` cannot diverge.
+ */
+export function workerNotReadyResponse(err) {
+    if (!(err instanceof RemoteNotReadyError))
+        return undefined;
+    return jsonResponse({ ok: false, status: 503, error: WORKER_NOT_READY_MESSAGE }, 503, {
+        'Retry-After': RETRY_AFTER_SECONDS,
+    });
+}

package/dist/operating-mode/client-unsafe-strategy.js

@@ -57,9 +57,6 @@ class ProdStrategy extends ProdClientSafeStrategy {
             throw new Error('gitBotAuthorName and gitBotAuthorEmail are required in prod mode');
         }
     }
-    shouldCreateSettingsPR(config) {
-        return config.autoCreateSettingsPR ?? true;
-    }
 }
 class DevStrategy extends DevClientSafeStrategy {
     getWorkspaceRoot(sourceRoot) {
@@ -107,9 +104,6 @@ class DevStrategy extends DevClientSafeStrategy {
     validateConfig(_config) {
         // No special validation for dev mode
     }
-    shouldCreateSettingsPR(_config) {
-        return false; // No real GitHub in local dev mode
-    }
 }
 const strategyCache = new Map();
 /**

package/dist/operating-mode/types.d.ts

@@ -89,7 +89,4 @@ export interface ClientUnsafeStrategy extends ClientSafeStrategy {
     getSettingsRoot(sourceRoot?: string): string;
     usesSeparateSettingsBranch(): boolean;
     validateConfig(config: Partial<CanopyConfig>): void;
-    shouldCreateSettingsPR(config: {
-        autoCreateSettingsPR?: boolean;
-    }): boolean;
 }

package/dist/paths/index.d.ts

@@ -3,7 +3,7 @@
  * because this barrel pulls in node:fs; `pnpm lint:bundle` enforces that.
  */
 export type { LogicalPath, PhysicalPath, SanitizedBranchName, BranchName, ContentId, Slug, PathValidationResult, } from './types.js';
-export { normalizeFilesystemPath, normalizeCollectionPath, hasTraversalSequence, createLogicalPath, createPhysicalPath, joinPath, trimSlashes, } from './normalize.js';
+export { normalizeFilesystemPath, normalizeCollectionPath, hasTraversalSequence, createLogicalPath, createPhysicalPath, entryLogicalPath, joinPath, trimSlashes, } from './normalize.js';
 export { validateAndNormalizePath } from './normalize-server.js';
 export { validateContentPath, isValidCollectionPath, sanitizeForPath, hasEmbeddedContentId, looksLikePhysicalPath, looksLikeLogicalPath, parseLogicalPath, parsePhysicalPath, isValidContentId, parseContentId, parseBranchName, parseSlug, } from './validation.js';
 export { resolveLogicalPath } from './resolve.js';

package/dist/paths/index.js

@@ -3,7 +3,7 @@
  * because this barrel pulls in node:fs; `pnpm lint:bundle` enforces that.
  */
 // Normalization utilities (client-safe)
-export { normalizeFilesystemPath, normalizeCollectionPath, hasTraversalSequence, createLogicalPath, createPhysicalPath, joinPath, trimSlashes, } from './normalize.js';
+export { normalizeFilesystemPath, normalizeCollectionPath, hasTraversalSequence, createLogicalPath, createPhysicalPath, entryLogicalPath, joinPath, trimSlashes, } from './normalize.js';
 // Normalization utilities (server-only, requires Node.js path module)
 export { validateAndNormalizePath } from './normalize-server.js';
 export { validateContentPath, isValidCollectionPath, sanitizeForPath, hasEmbeddedContentId, looksLikePhysicalPath, looksLikeLogicalPath, parseLogicalPath, parsePhysicalPath, isValidContentId, parseContentId, parseBranchName, parseSlug, } from './validation.js';

package/dist/paths/normalize.d.ts

@@ -25,6 +25,13 @@ export declare function normalizeCollectionPath(collectionPath: string, contentR
 export declare function hasTraversalSequence(path: string): boolean;
 /** Join segments into a LogicalPath, throwing on a traversal sequence. */
 export declare function createLogicalPath(...segments: string[]): LogicalPath;
+/**
+ * An entry's logical path: `<collection logical path>/<slug>`, e.g. `content/blog/my-post`,
+ * or `content/about` for an entry of the root collection. Path-permission rules match this
+ * form. No traversal check, unlike `createLogicalPath`: a slug read off disk may contain
+ * `..`, and listing must not throw on one.
+ */
+export declare function entryLogicalPath(collectionLogicalPath: LogicalPath | string, slug: string): LogicalPath;
 /**
  * Join segments into a PhysicalPath (segments may carry embedded content IDs,
  * e.g. `my-post.ABC123.mdx`), throwing on a traversal sequence.

package/dist/paths/normalize.js

@@ -48,6 +48,15 @@ export function createLogicalPath(...segments) {
     }
     return normalized;
 }
+/**
+ * An entry's logical path: `<collection logical path>/<slug>`, e.g. `content/blog/my-post`,
+ * or `content/about` for an entry of the root collection. Path-permission rules match this
+ * form. No traversal check, unlike `createLogicalPath`: a slug read off disk may contain
+ * `..`, and listing must not throw on one.
+ */
+export function entryLogicalPath(collectionLogicalPath, slug) {
+    return (collectionLogicalPath ? `${collectionLogicalPath}/${slug}` : slug);
+}
 /**
  * Join segments into a PhysicalPath (segments may carry embedded content IDs,
  * e.g. `my-post.ABC123.mdx`), throwing on a traversal sequence.

package/dist/reference-resolver.d.ts

@@ -1,6 +1,6 @@
 import type { ContentStore } from './content-store.js';
 import type { ContentIdIndex } from './content-id-index.js';
-import type { LogicalPath, PhysicalPath, Slug } from './paths/index.js';
+import { type LogicalPath, type Slug } from './paths/index.js';
 export interface ResolvedReference {
     id: string;
     exists: boolean;
@@ -32,11 +32,11 @@ export declare class ReferenceResolver {
      * At least one of `collections` or `entryTypes` should be provided.
      *
      * @param canAccess - Optional permission predicate, called with each candidate's
-     *   relative path before it is read. Returning false skips the entry entirely --
+     *   logical path (`entryLogicalPath`) before it is read. Returning false skips the entry entirely --
      *   no file I/O, no label, no option -- so a caller who can't read a path never
      *   triggers a read for content they won't be allowed to see anyway.
      */
-    loadReferenceOptions(collections?: LogicalPath[], displayField?: string, search?: string, entryTypes?: string[], canAccess?: (relativePath: PhysicalPath) => boolean): Promise<ReferenceOption[]>;
+    loadReferenceOptions(collections?: LogicalPath[], displayField?: string, search?: string, entryTypes?: string[], canAccess?: (logicalPath: LogicalPath) => boolean): Promise<ReferenceOption[]>;
     /**
      * Resolve multiple IDs at once.
      * Useful for displaying lists of referenced items.

package/dist/reference-resolver.js

@@ -1,5 +1,6 @@
 import nodePath from 'node:path';
 import { extractSlugFromFilename, extractEntryTypeFromFilename } from './content-id-index.js';
+import { entryLogicalPath } from './paths/index.js';
 /**
  * ReferenceResolver resolves content IDs to display values for reference fields.
  */
@@ -48,7 +49,7 @@ export class ReferenceResolver {
      * At least one of `collections` or `entryTypes` should be provided.
      *
      * @param canAccess - Optional permission predicate, called with each candidate's
-     *   relative path before it is read. Returning false skips the entry entirely --
+     *   logical path (`entryLogicalPath`) before it is read. Returning false skips the entry entirely --
      *   no file I/O, no label, no option -- so a caller who can't read a path never
      *   triggers a read for content they won't be allowed to see anyway.
      */
@@ -74,7 +75,7 @@ export class ReferenceResolver {
             if (!location.collection || !location.slug)
                 continue;
             // Skip denied paths before any file I/O.
-            if (canAccess && !canAccess(location.relativePath))
+            if (canAccess && !canAccess(entryLogicalPath(location.collection, location.slug)))
                 continue;
             const id = this.idIndex.findByPath(location.relativePath);
             if (!id)

package/dist/resolve-canopy-user.js

@@ -12,6 +12,7 @@
 import { canopyLogWarn } from './utils/logger.js';
 import { authResultToCanopyUser } from './user.js';
 import { loadInternalGroups, RESERVED_GROUPS } from './authorization/index.js';
+import { timeRequestPhase } from './utils/request-timing.js';
 /** Module-level: warn at most once per process. */
 let warnedNoAdmins = false;
 /**
@@ -39,7 +40,7 @@ function warnIfNoAdmins(internalGroups, bootstrapAdminIds) {
  */
 export async function resolveCanopyUser(authResult, deps) {
     const settingsRoot = await deps.getSettingsBranchRoot();
-    const internalGroups = await loadInternalGroups(settingsRoot, deps.mode, deps.bootstrapAdminIds);
+    const internalGroups = await timeRequestPhase('groups', () => loadInternalGroups(settingsRoot, deps.mode, deps.bootstrapAdminIds));
     warnIfNoAdmins(internalGroups, deps.bootstrapAdminIds);
     return authResultToCanopyUser(authResult, deps.bootstrapAdminIds, internalGroups);
 }

package/dist/services.d.ts

@@ -24,11 +24,16 @@ import { GitManager } from './git-manager.js';
 import { BranchRegistry } from './branch-registry.js';
 import { type GitHubService } from './github-service.js';
 import { BranchSchemaCache } from './branch-schema-cache.js';
+import { type SubmissionEditor } from './submission-attribution.js';
 /**
  * Bootstrap admin IDs from the environment. These users are treated as Admins
  * whatever their group membership.
  */
 export declare const getBootstrapAdminIds: () => Set<string>;
+export interface SubmitBranchResult {
+    /** Repo-relative paths the branch changes, excluding canopycms runtime metadata. */
+    changedPaths: string[];
+}
 export interface CanopyServices {
     config: CanopyConfig;
     /**
@@ -64,21 +69,23 @@ export interface CanopyServices {
         files: string | string[];
         message: string;
     }) => Promise<void>;
-    /** Submit branch: commit all changes and push to remote */
+    /**
+     * Submit branch: commit all changes (with the submitter's trailers) and push
+     * to remote. Resolves with every path the branch changes against its base.
+     */
     submitBranch: (options: {
         context: BranchContext;
+        submitter?: SubmissionEditor;
         message?: string;
-    }) => Promise<void>;
-    /** Commit to settings branch (for permissions/groups), with optional PR creation */
+    }) => Promise<SubmitBranchResult>;
+    /** Commit to the settings branch (for permissions/groups) and push it; never opens a PR */
     commitToSettingsBranch: (options: {
         branchRoot: string;
         files: string | string[];
         message: string;
-        createPR?: boolean;
     }) => Promise<{
         committed: boolean;
         pushed: boolean;
-        prUrl?: string;
         error?: string;
         syncStatus?: 'pending-sync' | 'synced' | 'sync-failed';
     }>;