canopycms 0.0.67 → 0.0.68-int.94

package/dist/api/content.js

@@ -5,7 +5,7 @@ import { ReferenceValidator } from '../validation/reference-validator.js';
 import { findUnknownKeys, mergeBodyIntoData, normalizeReferenceValues, validateEntryData, } from '../validation/entry-validator.js';
 import { validateEntryLinks } from '../validation/entry-link-validator.js';
 import { branchNameSchema, logicalPathSchema, slugSchema } from './validators.js';
-import { parseSlug } from '../paths/index.js';
+import { entryLogicalPath, parseSlug } from '../paths/index.js';
 import { getErrorMessage, isNotFoundError, sanitizeErrorMessage } from '../utils/error.js';
 import { isDataOnlyFormat } from '../utils/format.js';
 /**
@@ -52,7 +52,7 @@ const writeContentBodySchema = z.object({
     format: z.enum(['json', 'md', 'mdx', 'yaml']),
     data: boundedContentDataSchema.optional(),
     body: z.string().max(MAX_CONTENT_BODY_CHARS).optional(),
-    // null = create-intent ("must not already exist"); see WriteContentBody.
+    // null or omitted = create ("must not already exist"); see WriteContentBody.
     expectedVersion: z.number().nullish(),
 });
 const validateReferencesParamsSchema = z.object({
@@ -80,24 +80,27 @@ const readContentHandler = async (gc, ctx, req, params) => {
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
     let slug;
-    let relativePath;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
         slug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, slug);
-        relativePath = pathResult.relativePath;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, slug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'read');
-    if (!access.allowed) {
+    // One checker for the entry and every reference target it resolves, so a reference cannot
+    // carry a target's data past the rules that would refuse a direct read of it.
+    const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
+    if (!checkAccess(entryLogicalPath(schemaItem.logicalPath, slug), 'read').allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
     try {
-        const doc = await store.read(schemaItem.logicalPath, slug);
+        const doc = await store.read(schemaItem.logicalPath, slug, {
+            referenceAccess: (targetPath) => checkAccess(targetPath, 'read').allowed,
+        });
         return { ok: true, status: 200, data: doc };
     }
     catch (err) {
@@ -117,19 +120,18 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
     let slug;
-    let relativePath;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
         slug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, slug);
-        relativePath = pathResult.relativePath;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, slug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'edit');
+    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, slug), req.user, 'edit');
     if (!access.allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
@@ -198,20 +200,21 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     }
     const data = body.data ?? {};
     const isDataOnly = isDataOnlyFormat(body.format);
+    // The store's own `undefined` (blind write) is never reachable from here: an omitted token is
+    // a create, so an update that lost its token 409s instead of overwriting unchecked.
+    const expectedVersion = body.expectedVersion ?? null;
+    const createConflictError = body.expectedVersion === null
+        ? `An entry with slug "${slug}" already exists`
+        : `An entry with slug "${slug}" already exists; an update must send the expectedVersion from its last read`;
     try {
         const exists = await store.documentExists(schemaItem.logicalPath, slug);
-        // Create-intent guard: a create request (expectedVersion === null) against a slug that
-        // already has content must never silently overwrite it — short-circuit with 409 before field
-        // validation runs, so the error names the real problem instead of "field is required" or a
-        // bare conflict. store.write() re-enforces this itself inside its per-entry lock against a
-        // fresh stat (the race-safe authoritative check); this is just a cheaper fast path for the
-        // common case.
-        if (body.expectedVersion === null && exists) {
-            return {
-                ok: false,
-                status: 409,
-                error: `An entry with slug "${slug}" already exists`,
-            };
+        // Create guard: a create against a slug that already has content must never silently
+        // overwrite it — short-circuit with 409 before field validation runs, so the error names the
+        // real problem instead of "field is required" or a bare conflict. store.write() re-enforces
+        // this itself inside its per-entry lock against a fresh stat (the race-safe authoritative
+        // check); this is just a cheaper fast path for the common case.
+        if (expectedVersion === null && exists) {
+            return { ok: false, status: 409, error: createConflictError };
         }
         // [SLUG] Create-only routability check: `writeContentParamsSchema.path`'s `parseLogicalPath`
         // has no charset rule, and `ContentStore.resolvePath` only lowercases the slug — so this is
@@ -360,13 +363,13 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             ? {
                 format: body.format,
                 data: normalizedData ?? {},
-                expectedVersion: body.expectedVersion,
+                expectedVersion,
             }
             : {
                 format: body.format,
                 data: normalizedData,
                 body: body.body ?? '',
-                expectedVersion: body.expectedVersion,
+                expectedVersion,
             };
         // Pass the resolved entryTypeName (not the raw, possibly-omitted
         // params.entryType) so the store's own format check agrees with the type
@@ -412,12 +415,8 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             }
             // Race-safe fallback: the early `exists` check above catches the common case; this covers a
             // collision that lands between that check and store.write()'s in-lock stat.
-            if (body.expectedVersion === null) {
-                return {
-                    ok: false,
-                    status: 409,
-                    error: `An entry with slug "${slug}" already exists`,
-                };
+            if (expectedVersion === null) {
+                return { ok: false, status: 409, error: createConflictError };
             }
             return {
                 ok: false,
@@ -443,19 +442,19 @@ const validateReferencesHandler = async (gc, ctx, req, params, body) => {
     const contentRoot = ctx.services.config.contentRoot || 'content';
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
-    let relativePath;
+    let slug;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
-        const slug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, slug);
-        relativePath = pathResult.relativePath;
+        slug = resolved.slug;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, slug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'read');
+    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, slug), req.user, 'read');
     if (!access.allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
@@ -510,22 +509,26 @@ const renameEntryHandler = async (gc, ctx, req, params, body) => {
     const logicalPathSegments = parseApiPath(params.path, contentRoot);
     let schemaItem;
     let currentSlug;
-    let relativePath;
     try {
         const resolved = store.resolvePath(logicalPathSegments);
         schemaItem = resolved.schemaItem;
         currentSlug = resolved.slug;
-        const pathResult = await store.resolveDocumentPath(schemaItem.logicalPath, currentSlug);
-        relativePath = pathResult.relativePath;
+        // Runs the store's slug and traversal checks before the permission check.
+        await store.resolveDocumentPath(schemaItem.logicalPath, currentSlug);
     }
     catch (err) {
         const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
         return { ok: false, status: 400, error: sanitizeErrorMessage(message) };
     }
-    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, relativePath, req.user, 'edit');
+    const access = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, currentSlug), req.user, 'edit');
     if (!access.allowed) {
         return { ok: false, status: 403, error: 'Forbidden' };
     }
+    // A rename creates the entry at its new path, so that path needs edit access too.
+    const destinationAccess = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(schemaItem.logicalPath, body.newSlug), req.user, 'edit');
+    if (!destinationAccess.allowed) {
+        return { ok: false, status: 403, error: 'Forbidden' };
+    }
     try {
         const result = await store.renameEntry(schemaItem.logicalPath, currentSlug, body.newSlug);
         return { ok: true, status: 200, data: { newPath: result.newPath } };

package/dist/api/entries.js

@@ -2,7 +2,7 @@ import path from 'node:path';
 import { z } from 'zod';
 import { BranchSyncingError, ContentConflictError, ContentStore, ContentStoreError, } from '../content-store.js';
 import { defineEndpoint } from './route-builder.js';
-import { normalizeFilesystemPath, parseSlug, parseLogicalPath } from '../paths/index.js';
+import { entryLogicalPath, normalizeFilesystemPath, parseSlug, parseLogicalPath } from '../paths/index.js';
 import { getErrorMessage, isNotFoundError, sanitizeErrorMessage } from '../utils/error.js';
 import { createDebugLogger } from '../utils/debug.js';
 import { resolveEntryTitle } from '../utils/title-field.js';
@@ -81,7 +81,7 @@ const listCollectionEntriesRecursive = async (root, targetPath, flatCollections)
 const filterWithAccessControl = (items, checkAccess, search) => {
     const results = [];
     for (const item of items) {
-        const readAccess = checkAccess(item.physicalPath, 'read');
+        const readAccess = checkAccess(item.logicalPath, 'read');
         if (!readAccess.allowed)
             continue;
         if (search) {
@@ -90,7 +90,7 @@ const filterWithAccessControl = (items, checkAccess, search) => {
                 continue;
         }
         // Compute edit access only for items that survive the read + search filters.
-        const editAccess = checkAccess(item.physicalPath, 'edit');
+        const editAccess = checkAccess(item.logicalPath, 'edit');
         results.push({ ...item, canEdit: editAccess.allowed });
     }
     return results;
@@ -255,11 +255,9 @@ const deleteEntryHandler = async (gc, ctx, req, params) => {
         };
     }
     const entrySlug = slugResult.slug;
-    // Resolve the real physical path before checking permissions
-    let physicalPath;
+    // Resolution runs the store's slug and traversal checks before the permission check.
     try {
-        const resolved = await contentStore.resolveDocumentPath(collectionLogicalPath, entrySlug);
-        physicalPath = resolved.relativePath;
+        await contentStore.resolveDocumentPath(collectionLogicalPath, entrySlug);
     }
     catch (err) {
         if (isNotFoundError(err)) {
@@ -272,7 +270,7 @@ const deleteEntryHandler = async (gc, ctx, req, params) => {
         }
         throw err;
     }
-    const editAccess = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, physicalPath, req.user, 'edit');
+    const editAccess = await ctx.services.checkContentAccess(branchContext, branchContext.branchRoot, entryLogicalPath(collection.logicalPath, entrySlug), req.user, 'edit');
     if (!editAccess.allowed) {
         return {
             ok: false,
@@ -301,13 +299,16 @@ const deleteEntryHandler = async (gc, ctx, req, params) => {
                     // C6: order cleanup is best-effort hygiene after the entry is already deleted, so no
                     // failure here may turn an otherwise-successful delete into an error (a retry would
                     // just 404). Surface it as a warning instead (mirrors content.ts's `validationWarnings`).
-                    const reason = err instanceof SchemaStoreBusyError ? 'schema is busy' : getErrorMessage(err);
-                    log.warn('delete-entry', 'Skipped order cleanup', {
-                        collectionPath,
-                        contentId,
-                        error: getErrorMessage(err),
-                    });
-                    orderCleanupWarning = `Entry deleted, but the collection order list could not be updated (${sanitizeErrorMessage(reason)}); it will still list this entry until the next schema change.`;
+                    // An `'unknown'` outcome means the update ran to completion: nothing to warn of.
+                    if (!(err instanceof SchemaStoreBusyError && err.outcome === 'unknown')) {
+                        const reason = err instanceof SchemaStoreBusyError ? 'schema is busy' : getErrorMessage(err);
+                        log.warn('delete-entry', 'Skipped order cleanup', {
+                            collectionPath,
+                            contentId,
+                            error: getErrorMessage(err),
+                        });
+                        orderCleanupWarning = `Entry deleted, but the collection order list could not be updated (${sanitizeErrorMessage(reason)}); it will still list this entry until the next schema change.`;
+                    }
                 }
             }
         }

package/dist/api/github-sync.d.ts

@@ -1,5 +1,6 @@
 import type { ApiContext } from './types.js';
 import type { BranchContext, SyncStatus } from '../types.js';
+import { type SubmissionEditor } from '../submission-attribution.js';
 /**
  * The caller uses this to update branch metadata.
  */
@@ -8,10 +9,18 @@ export interface GitHubSyncResult {
     prNumber?: number;
     syncStatus?: SyncStatus;
 }
+/** What the PR body records about a submit. */
+export interface SubmissionRecord {
+    submitter?: SubmissionEditor;
+    changedPaths: readonly string[];
+}
 /**
  * Uses githubService directly if available, otherwise queues a task for the worker.
+ *
+ * The body is the canopycms PR section (submission-attribution.ts): an existing
+ * PR keeps whatever a human wrote outside it.
  */
-export declare function syncSubmitPr(ctx: ApiContext, context: BranchContext): Promise<GitHubSyncResult>;
+export declare function syncSubmitPr(ctx: ApiContext, context: BranchContext, submission: SubmissionRecord): Promise<GitHubSyncResult>;
 /**
  * Used by withdraw and request-changes. Uses githubService directly if
  * available, otherwise queues a task.

package/dist/api/github-sync.js

@@ -3,14 +3,22 @@ import { getTaskQueueDir } from '../task-queue/task-queue-config.js';
 import { clientOperatingStrategy } from '../operating-mode/index.js';
 import { getErrorMessage } from '../utils/error.js';
 import { sanitizeBranchName } from '../paths/branch-name.js';
+import { buildPrSection, mergePrSection } from '../submission-attribution.js';
 /**
  * Uses githubService directly if available, otherwise queues a task for the worker.
+ *
+ * The body is the canopycms PR section (submission-attribution.ts): an existing
+ * PR keeps whatever a human wrote outside it.
  */
-export async function syncSubmitPr(ctx, context) {
+export async function syncSubmitPr(ctx, context, submission) {
     const { githubService } = ctx.services;
     const mode = ctx.services.config.mode;
     const prTitle = context.branch.title || `Submit ${context.branch.name}`;
-    const prBody = context.branch.description || '';
+    const prSection = buildPrSection({
+        description: context.branch.description,
+        submitter: submission.submitter,
+        changedPaths: submission.changedPaths,
+    });
     // Target the fork point recorded at branch creation when available.
     const baseBranch = context.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main';
     if (!clientOperatingStrategy(mode).supportsPullRequests()) {
@@ -29,9 +37,12 @@ export async function syncSubmitPr(ctx, context) {
     if (githubService) {
         try {
             if (context.branch.pullRequestNumber) {
+                // Read before writing: the update keeps the human text around the
+                // canopycms section, and the same read says whether the PR is a draft.
+                const pr = await githubService.getPullRequest(context.branch.pullRequestNumber);
                 await githubService.updatePullRequest(context.branch.pullRequestNumber, {
                     title: prTitle,
-                    body: prBody,
+                    body: mergePrSection(pr.body, prSection),
                 });
                 // Best-effort draft->ready conversion. This branch updates a known
                 // PR number directly (not through createOrUpdatePR), so it doesn't
@@ -42,7 +53,6 @@ export async function syncSubmitPr(ctx, context) {
                 // consistent with createOrUpdatePullRequest's best-effort handling
                 // in github-service.ts.
                 try {
-                    const pr = await githubService.getPullRequest(context.branch.pullRequestNumber);
                     if (pr.draft) {
                         await githubService.convertToReady(context.branch.pullRequestNumber);
                     }
@@ -73,8 +83,9 @@ export async function syncSubmitPr(ctx, context) {
                     head: context.branch.name,
                     base: baseBranch,
                     title: prTitle,
-                    body: prBody,
+                    body: prSection,
                     markReadyIfDraft: true,
+                    mergeSectionIntoBody: true,
                 });
                 return {
                     prUrl: result.url,
@@ -105,13 +116,12 @@ export async function syncSubmitPr(ctx, context) {
         payload: {
             branch: context.branch.name,
             title: prTitle,
-            body: prBody,
+            body: prSection,
+            mergeSectionIntoBody: true,
             baseBranch,
             pullRequestNumber: context.branch.pullRequestNumber,
-            // Content submits are an explicit "ready for review" action — convert
-            // a pre-existing draft PR to ready, unlike the settings-branch sync
-            // path (services.ts commitToSettingsBranch), which enqueues the same
-            // action without this flag.
+            // A content submit is an explicit "ready for review" action: convert a
+            // pre-existing draft PR to ready.
             markReadyIfDraft: true,
         },
     });

package/dist/api/reference-options.js

@@ -70,7 +70,7 @@ const getReferenceOptionsHandler = async (gc, ctx, req, _params) => {
     // for an option the caller isn't allowed to see.
     const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
     const resolver = new ReferenceResolver(store, idIndex);
-    const options = await resolver.loadReferenceOptions(collections, displayField, search, entryTypes, (relativePath) => checkAccess(relativePath, 'read').allowed);
+    const options = await resolver.loadReferenceOptions(collections, displayField, search, entryTypes, (logicalPath) => checkAccess(logicalPath, 'read').allowed);
     return {
         ok: true,
         status: 200,

package/dist/api/resolve-references.js

@@ -1,9 +1,6 @@
 import { z } from 'zod';
 import { ContentStore } from '../content-store.js';
 import { defineEndpoint } from './route-builder.js';
-import { ReferenceResolver } from '../reference-resolver.js';
-import { buildResolvedReference } from '../entry-schema.js';
-import { computeEntryUrl } from '../utils/entry-url.js';
 import { branchNameSchema, contentIdSchema } from './validators.js';
 /**
  * Resolution does sequential per-ID file I/O, so the request body caps how much filesystem work
@@ -20,49 +17,25 @@ const resolveReferencesBodySchema = z.object({
 const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
     const { branchContext } = gc;
     const { ids } = body;
-    const flatSchema = branchContext.flatSchema;
-    const contentRootName = ctx.services.config.contentRoot || 'content';
-    const store = new ContentStore(branchContext.branchRoot, flatSchema, {
-        contentRootName,
+    const store = new ContentStore(branchContext.branchRoot, branchContext.flatSchema, {
+        contentRootName: ctx.services.config.contentRoot || 'content',
     });
-    // Get ID index (automatically loads if needed)
-    const idIndex = await store.idIndex();
-    // Resolve each ID to full document
-    const resolver = new ReferenceResolver(store, idIndex);
-    // Build the access checker once, reused for every id instead of re-loading per id in the loop.
-    // A failure here (e.g. settings workspace unavailable) surfaces as a handler error, not
-    // swallowed silently per id.
+    // Built once for every id. A failure here (e.g. settings workspace unavailable) surfaces as a
+    // handler error rather than being swallowed per id.
     const checkAccess = await ctx.services.createContentAccessChecker(branchContext, branchContext.branchRoot, req.user);
+    const access = (logicalPath) => checkAccess(logicalPath, 'read').allowed;
+    // The resolution `read()` applies to a reference field, so live preview shows this user what
+    // `read()` would: the target's data, or a `RestrictedReference` for a target they may not
+    // read. The target's own references stay ids, as in `read()`.
     const resolved = {};
     for (const id of ids) {
         try {
-            const result = await resolver.resolve(id);
-            if (result && result.exists && result.collection && result.slug) {
-                // Check path-level read permission before returning content
-                const resolvedPath = await store.resolveDocumentPath(result.collection, result.slug);
-                const access = checkAccess(resolvedPath.relativePath, 'read');
-                if (!access.allowed)
-                    continue;
-                // `resolveReferences: false` matches the server-side resolver (content-store.ts's
-                // resolveSingleReferenceOnce), so a nested reference inside a target renders the same way
-                // in live preview as on the published site, instead of resolving one level deeper.
-                const doc = await store.read(result.collection, result.slug, { resolveReferences: false });
-                if (doc && doc.data) {
-                    // Same shape as the server-side resolver: target data first, then the reserved keys.
-                    // Order is the corruption guard (a target modelling `id` as content must not shadow the
-                    // real content ID); the extra keys (incl. `urlPath`) keep live preview and production
-                    // in sync for consumers like client-reference-resolver.ts.
-                    resolved[id] = buildResolvedReference(doc.data, {
-                        id,
-                        slug: result.slug,
-                        collection: result.collection,
-                        urlPath: computeEntryUrl(result.collection, result.slug, contentRootName),
-                    });
-                }
-            }
+            const value = await store.resolveReferenceTarget(id, access);
+            if (value)
+                resolved[id] = value;
         }
         catch (error) {
-            // Skip failed resolutions, don't block entire request
+            // An id that fails to resolve is omitted rather than failing the whole request.
             console.error(`Failed to resolve reference ID ${id}:`, error);
         }
     }
@@ -73,7 +46,8 @@ const resolveReferencesHandler = async (gc, ctx, req, params, body) => {
     };
 };
 /**
- * Resolve reference IDs to full document objects
+ * Resolve reference IDs as a reference field would: full target data, or title + URL tagged
+ * `unavailable` for a target the user may not read. An id naming no entry is omitted.
  * POST /:branch/resolve-references
  * Body: { ids: string[] }
  */

package/dist/api/settings-helpers.d.ts

@@ -30,7 +30,7 @@ export interface CommitSettingsResult {
 /**
  * Commit and push settings changes based on the mode.
  * Both prod and dev use commitToSettingsBranch.
- * In dev mode, commits to the settings branch but does not create a PR.
+ * Settings changes are never reviewed through a PR (see commitToSettingsBranch).
  */
 export declare function commitSettings(ctx: ApiContext, options: {
     context: {

package/dist/api/settings-helpers.js

@@ -23,7 +23,7 @@ export async function getSettingsBranchContext(ctx) {
 /**
  * Commit and push settings changes based on the mode.
  * Both prod and dev use commitToSettingsBranch.
- * In dev mode, commits to the settings branch but does not create a PR.
+ * Settings changes are never reviewed through a PR (see commitToSettingsBranch).
  */
 export async function commitSettings(ctx, options) {
     const strategy = operatingStrategy(options.mode);
@@ -38,9 +38,6 @@ export async function commitSettings(ctx, options) {
             branchRoot: options.branchRoot,
             files: options.fileName,
             message: options.message,
-            createPR: strategy.shouldCreateSettingsPR({
-                autoCreateSettingsPR: ctx.services.config.autoCreateSettingsPR,
-            }),
         });
         if (!result.pushed) {
             console.warn(`${options.message} committed but not pushed:`, result.error);

package/dist/api/user.d.ts

@@ -1,7 +1,10 @@
 import type { ApiResponse } from './types.js';
+import type { BuildIdentity } from '../types.js';
 export type UserInfoResponse = ApiResponse<{
     userId: string;
     groups: string[];
+    /** Admins only: the deployed version is reconnaissance for anyone else. */
+    build?: BuildIdentity;
 }>;
 export declare const USER_ROUTES: {
     readonly whoami: import("./route-builder.js").RouteDefinition<undefined, undefined, UserInfoResponse>;

package/dist/api/user.js

@@ -1,4 +1,6 @@
 import { defineEndpoint } from './route-builder.js';
+import { isAdmin } from '../authorization/helpers.js';
+import { getBuildIdentity } from '../build-identity.js';
 /**
  * This is a PUBLIC endpoint - no special permissions required
  */
@@ -10,6 +12,7 @@ const getUserInfoHandler = async (ctx, req) => {
         data: {
             userId: req.user.userId,
             groups: req.user.groups,
+            ...(isAdmin(req.user.groups) ? { build: getBuildIdentity() } : {}),
         },
     };
 };

package/dist/assets/factory.d.ts

@@ -3,6 +3,11 @@
  *
  * This is the one place that turns the (currently-unconsumed) `media` config
  * into a real store — see .claude/future-tasks/resolved/assets-media-system.md.
+ *
+ * The store is branch-agnostic: a local one is rooted at the dev workspace's
+ * `assets/` or at `media.directory` resolved against the process's working
+ * directory, never inside a branch clone. So asset writes take no [SYNC-C1]
+ * content-write lock — the worker's rebase never touches them.
  */
 import type { MediaConfig } from '../config/types.js';
 import type { AssetStore } from './types.js';

package/dist/assets/factory.js

@@ -3,6 +3,11 @@
  *
  * This is the one place that turns the (currently-unconsumed) `media` config
  * into a real store — see .claude/future-tasks/resolved/assets-media-system.md.
+ *
+ * The store is branch-agnostic: a local one is rooted at the dev workspace's
+ * `assets/` or at `media.directory` resolved against the process's working
+ * directory, never inside a branch clone. So asset writes take no [SYNC-C1]
+ * content-write lock — the worker's rebase never touches them.
  */
 import { LocalAssetStore } from './store-local.js';
 import { S3AssetStore } from './store-s3.js';

package/dist/authorization/content.d.ts

@@ -6,12 +6,13 @@ import type { BranchContext } from '../types.js';
 import type { PermissionLevel } from '../config/index.js';
 import type { CanopyUser } from '../user.js';
 import type { ContentAccessResult, ContentAccessDeps } from './types.js';
-import type { PhysicalPath } from '../paths/types.js';
+import type { LogicalPath } from '../paths/types.js';
 /**
  * A bound content-access checker: evaluates a single path/level synchronously
  * against permissions that were already loaded when the checker was created.
+ * The path is the entry's logical path (see `checkPathAccess`).
  */
-export type ContentAccessChecker = (relativePath: PhysicalPath, level: PermissionLevel) => ContentAccessResult;
+export type ContentAccessChecker = (logicalPath: LogicalPath, level: PermissionLevel) => ContentAccessResult;
 /**
  * Resolve the request-constant work once -- branch access, the
  * settings/permissions root and the path-permission rules, all identical for a
@@ -26,5 +27,5 @@ export declare function createContentAccessChecker(deps: ContentAccessDeps, cont
  * Single-path check; loads the path permissions from the branch root per call.
  * @internal Exported for tests.
  */
-export declare function checkContentAccess(deps: ContentAccessDeps, context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel): Promise<ContentAccessResult>;
-export declare function createCheckContentAccess(deps: ContentAccessDeps): (context: BranchContext, branchRoot: string, relativePath: PhysicalPath, user: CanopyUser, level: PermissionLevel) => Promise<ContentAccessResult>;
+export declare function checkContentAccess(deps: ContentAccessDeps, context: BranchContext, branchRoot: string, logicalPath: LogicalPath, user: CanopyUser, level: PermissionLevel): Promise<ContentAccessResult>;
+export declare function createCheckContentAccess(deps: ContentAccessDeps): (context: BranchContext, branchRoot: string, logicalPath: LogicalPath, user: CanopyUser, level: PermissionLevel) => Promise<ContentAccessResult>;

package/dist/authorization/content.js

@@ -28,9 +28,9 @@ export async function createContentAccessChecker(deps, context, branchRoot, user
     }
     const rules = await deps.loadPathPermissions(permissionsRoot, deps.mode);
     const pathChecker = createCheckPathAccess(rules, deps.defaultPathAccess);
-    return (relativePath, level) => {
+    return (logicalPath, level) => {
         const path = pathChecker({
-            relativePath,
+            logicalPath,
             user,
             level,
         });
@@ -45,10 +45,10 @@ export async function createContentAccessChecker(deps, context, branchRoot, user
  * Single-path check; loads the path permissions from the branch root per call.
  * @internal Exported for tests.
  */
-export async function checkContentAccess(deps, context, branchRoot, relativePath, user, level) {
+export async function checkContentAccess(deps, context, branchRoot, logicalPath, user, level) {
     const check = await createContentAccessChecker(deps, context, branchRoot, user);
-    return check(relativePath, level);
+    return check(logicalPath, level);
 }
 export function createCheckContentAccess(deps) {
-    return (context, branchRoot, relativePath, user, level) => checkContentAccess(deps, context, branchRoot, relativePath, user, level);
+    return (context, branchRoot, logicalPath, user, level) => checkContentAccess(deps, context, branchRoot, logicalPath, user, level);
 }

package/dist/authorization/path.d.ts

@@ -1,7 +1,7 @@
 import type { PathPermission, DefaultPathAccess, PermissionLevel } from '../config/index.js';
 import type { CanopyUser } from '../user.js';
 import type { PathPermissionResult } from './types.js';
-import type { PhysicalPath } from '../paths/types.js';
+import type { LogicalPath } from '../paths/types.js';
 /**
  * Resolve `defaultPathAccess` to an 'allow'/'deny' verdict for one permission
  * level. String form applies to every level; object form looks up the level,
@@ -11,19 +11,24 @@ import type { PhysicalPath } from '../paths/types.js';
  */
 export declare function resolveDefaultPathAccess(defaultAccess: DefaultPathAccess, level: PermissionLevel): 'allow' | 'deny';
 /**
- * Evaluate access for a relative path against config-defined rules.
- * Uses defaultAccess when no rule matches. First matching rule wins.
+ * Evaluate access for a path against config-defined rules. First matching rule wins;
+ * defaultAccess applies when none matches.
+ *
+ * Rule globs and the checked path are both LOGICAL paths: content-root-prefixed and
+ * id-free, the space the Permission Manager writes rules in. An entry's logical path is
+ * `<collection logical path>/<slug>` (`entryLogicalPath`), e.g. `content/blog/my-post`, never
+ * its on-disk `content/blog.<id>/post.my-post.<id>.json`.
  * @internal Exported for tests.
  */
-export declare function checkPathAccess({ rules, relativePath, user, defaultAccess, level, }: {
+export declare function checkPathAccess({ rules, logicalPath, user, defaultAccess, level, }: {
     rules: PathPermission[];
-    relativePath: PhysicalPath;
+    logicalPath: LogicalPath;
     user: CanopyUser;
     defaultAccess: DefaultPathAccess;
     level: PermissionLevel;
 }): PathPermissionResult;
 export declare function createCheckPathAccess(rules: PathPermission[], defaultAccess: DefaultPathAccess): (input: {
-    relativePath: PhysicalPath;
+    logicalPath: LogicalPath;
     user: CanopyUser;
     level: PermissionLevel;
 }) => PathPermissionResult;