canopycms 0.0.67 → 0.0.68-int.94

package/dist/authorization/path.js

@@ -5,8 +5,8 @@ function normalize(p) {
     const normalized = p.split(path.sep).join('/');
     return normalized.replace(/^\.?\/*/, '');
 }
-function matchesRule(rule, relativePath) {
-    return minimatch(relativePath, rule.path, { dot: true });
+function matchesRule(rule, logicalPath) {
+    return minimatch(logicalPath, rule.path, { dot: true });
 }
 function isAllowedByTarget(target, user) {
     const hasUserConstraint = !!target.allowedUsers?.length;
@@ -32,12 +32,17 @@ export function resolveDefaultPathAccess(defaultAccess, level) {
     return defaultAccess[level] ?? 'deny';
 }
 /**
- * Evaluate access for a relative path against config-defined rules.
- * Uses defaultAccess when no rule matches. First matching rule wins.
+ * Evaluate access for a path against config-defined rules. First matching rule wins;
+ * defaultAccess applies when none matches.
+ *
+ * Rule globs and the checked path are both LOGICAL paths: content-root-prefixed and
+ * id-free, the space the Permission Manager writes rules in. An entry's logical path is
+ * `<collection logical path>/<slug>` (`entryLogicalPath`), e.g. `content/blog/my-post`, never
+ * its on-disk `content/blog.<id>/post.my-post.<id>.json`.
  * @internal Exported for tests.
  */
-export function checkPathAccess({ rules, relativePath, user, defaultAccess, level, }) {
-    const normalizedPath = normalize(relativePath);
+export function checkPathAccess({ rules, logicalPath, user, defaultAccess, level, }) {
+    const normalizedPath = normalize(logicalPath);
     // Only Admins bypass all path permissions
     if (isAdmin(user.groups)) {
         return { allowed: true, reason: 'admin' };

package/dist/authorization/types.d.ts

@@ -1,6 +1,6 @@
 /**
- * A path used in permission rules, e.g. "content/posts".
- * SECURITY CRITICAL: always validated to prevent path traversal.
+ * A logical-path glob used in permission rules, e.g. "content/posts/**" (see
+ * `PathPermission.path`). SECURITY CRITICAL: always validated to prevent path traversal.
  */
 export type PermissionPath = string & {
     readonly __brand: 'PermissionPath';

package/dist/branch-health.js

@@ -5,16 +5,16 @@ import { ContentIdIndex } from './content-id-index.js';
 import { sanitizeBranchName } from './paths/branch-name.js';
 import { getErrorMessage, isNodeError, isNotFoundError } from './utils/error.js';
 import { isRebaseInProgress } from './utils/git.js';
+import { branchProvisioningLockName } from './utils/provisioning-lock.js';
 /**
- * The provisioning lock marker's path for a branch directory, matching what
- * `branch-workspace.ts`'s `ensureGitWorkspace()` passes exactly.
+ * The provisioning lock marker's path for a branch directory.
  *
  * `acquireProvisioningLock` passes the name as `lockfilePath`, overriding
  * proper-lockfile's default `${target}.lock`, so the marker (a mkdir-based
  * directory) sits at exactly this path — no extra `.lock` suffix.
  */
 function provisioningLockPath(baseRoot, dirName) {
-    return path.join(baseRoot, `.${dirName}.init.lock`);
+    return path.join(baseRoot, branchProvisioningLockName(dirName));
 }
 /** Stat the provisioning lock marker, if present. Never throws. */
 async function readProvisioningLock(baseRoot, dirName) {

package/dist/branch-schema-cache.d.ts

@@ -2,6 +2,8 @@ import type { RootCollectionConfig } from './config/index.js';
 import type { FlatSchemaItem } from './config/types.js';
 import type { OperatingMode } from './operating-mode/index.js';
 import type { EntrySchemaRegistry, SchemaResolutionResult } from './schema/types.js';
+/** File name of the schema cache inside {@link schemaCacheDir}. */
+export declare const SCHEMA_CACHE_FILE = "schema-cache.json";
 /** resource-generation.ts resource key for the schema cache's marker. */
 export declare const SCHEMA_GENERATION_RESOURCE = "schema";
 /** @internal Exported for tests. */
@@ -18,8 +20,8 @@ export interface BranchSchemaCacheEntry {
     generation: string | null;
 }
 /**
- * Per-branch schema cache: a file at {branchRoot}/.canopy-meta/schema-cache.json
- * with no in-memory layer, so it stays coherent across Lambda invocations.
+ * Per-branch schema cache: one file in {@link schemaCacheDir} with no in-memory
+ * layer, so it stays coherent across Lambda invocations.
  *
  * Freshness follows the generation-marker protocol owned by
  * resource-generation.ts, and this is one of that protocol's durable-snapshot
@@ -39,7 +41,7 @@ export declare class BranchSchemaCache {
     /**
      * Whether to skip the on-disk cache for this branchRoot.
      *
-     * Never write `.canopy-meta/` at the project root, whichever entrypoint
+     * Never write a schema cache at the project root, whichever entrypoint
      * produced the cwd branchRoot. branchRoot equals process.cwd() only in the
      * synthetic contexts static deployments and build phases use; a real branch
      * root is always nested under the workspace.

package/dist/branch-schema-cache.js

@@ -5,10 +5,14 @@ import { flattenSchema } from './config/flatten.js';
 import { validateReferenceEntryTypes } from './validation/entry-type-reference-validator.js';
 import { isBuildMode } from './build-mode.js';
 import { bumpResourceGeneration, readResourceGeneration, isGenerationCurrent, } from './resource-generation.js';
+import { timeRequestPhase } from './utils/request-timing.js';
+import { CANOPY_META_DIR } from './utils/git.js';
 /** Bump when BranchSchemaCacheEntry shape changes to auto-invalidate stale caches */
 const SCHEMA_CACHE_VERSION = 3;
 /** Minimum interval between mtime staleness checks (ms) */
 const MTIME_CHECK_DEBOUNCE_MS = 1000;
+/** File name of the schema cache inside {@link schemaCacheDir}. */
+export const SCHEMA_CACHE_FILE = 'schema-cache.json';
 /** resource-generation.ts resource key for the schema cache's marker. */
 export const SCHEMA_GENERATION_RESOURCE = 'schema';
 /**
@@ -43,8 +47,22 @@ async function isStaleByMtime(dir, cachedAt) {
     return false;
 }
 /**
- * Per-branch schema cache: a file at {branchRoot}/.canopy-meta/schema-cache.json
- * with no in-memory layer, so it stays coherent across Lambda invocations.
+ * Directory holding a branch's schema cache: `{branchRoot}/.git/canopycms` when
+ * the branch root is a full clone (every canopycms branch workspace is), else
+ * `{branchRoot}/.canopy-meta`. Under `.git/` because nothing there is ever
+ * tracked or reported by `git status`, so the cache can neither dirty the
+ * workspace nor enter a commit, even where an adopter has committed
+ * `.canopy-meta/`. It also lives and dies with the clone, so a re-clone never
+ * reads its predecessor's snapshot.
+ */
+async function schemaCacheDir(branchRoot) {
+    const gitDir = path.join(branchRoot, '.git');
+    const isClone = await fs.stat(gitDir).then((stat) => stat.isDirectory(), () => false);
+    return isClone ? path.join(gitDir, 'canopycms') : path.join(branchRoot, CANOPY_META_DIR);
+}
+/**
+ * Per-branch schema cache: one file in {@link schemaCacheDir} with no in-memory
+ * layer, so it stays coherent across Lambda invocations.
  *
  * Freshness follows the generation-marker protocol owned by
  * resource-generation.ts, and this is one of that protocol's durable-snapshot
@@ -65,7 +83,7 @@ export class BranchSchemaCache {
     /**
      * Whether to skip the on-disk cache for this branchRoot.
      *
-     * Never write `.canopy-meta/` at the project root, whichever entrypoint
+     * Never write a schema cache at the project root, whichever entrypoint
      * produced the cwd branchRoot. branchRoot equals process.cwd() only in the
      * synthetic contexts static deployments and build phases use; a real branch
      * root is always nested under the workspace.
@@ -75,7 +93,7 @@ export class BranchSchemaCache {
     }
     /** Get schema for a branch, from the cache when fresh, else resolved fresh. */
     async getSchema(branchRoot, entrySchemaRegistry, contentRootName = 'content') {
-        return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
+        return timeRequestPhase('schema', () => this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName));
     }
     /**
      * Resolve the schema from disk. Protected rather than a direct resolveSchema
@@ -89,8 +107,7 @@ export class BranchSchemaCache {
         const contentRoot = path.join(branchRoot, contentRootName);
         const skipDiskCache = this.skipDiskCache(branchRoot);
         if (!skipDiskCache) {
-            const cacheDir = path.join(branchRoot, '.canopy-meta');
-            const cachePath = path.join(cacheDir, 'schema-cache.json');
+            const cachePath = path.join(await schemaCacheDir(branchRoot), SCHEMA_CACHE_FILE);
             let cacheData = null;
             try {
                 const cacheContent = await fs.readFile(cachePath, 'utf-8');
@@ -149,7 +166,8 @@ export class BranchSchemaCache {
         const read = skipDiskCache
             ? null
             : await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
-        const result = await this.resolveFresh(contentRoot, entrySchemaRegistry);
+        // Nested under `schema`, so a request summary names a cache miss (`…schema>resolve`).
+        const result = await timeRequestPhase('resolve', () => this.resolveFresh(contentRoot, entrySchemaRegistry));
         // Validate schema has content
         if (!isValidSchema(result.schema)) {
             throw new Error(`No schema found in ${contentRoot}. Create .collection.json files ` +
@@ -166,11 +184,11 @@ export class BranchSchemaCache {
         // Use configured contentRoot name as base path for logical paths
         const flatSchema = flattenSchema(result.schema, contentRootName);
         if (!skipDiskCache) {
-            const cacheDir = path.join(branchRoot, '.canopy-meta');
-            const cachePath = path.join(cacheDir, 'schema-cache.json');
+            const cacheDir = await schemaCacheDir(branchRoot);
+            const cachePath = path.join(cacheDir, SCHEMA_CACHE_FILE);
             // Opportunistic cleanup of the retired .stale marker file, which a
             // mid-flight deploy can leave behind. Not load-bearing.
-            await fs.unlink(path.join(cacheDir, 'schema-cache.stale')).catch(() => { });
+            await fs.unlink(path.join(branchRoot, CANOPY_META_DIR, 'schema-cache.stale')).catch(() => { });
             if (read && read.ok) {
                 const newCache = {
                     version: SCHEMA_CACHE_VERSION,
@@ -180,7 +198,7 @@ export class BranchSchemaCache {
                     generation: read.token,
                 };
                 // Temp file then rename, with the temp file unlinked on a failed
-                // rename so a transient error leaves no stray `.tmp` in `.canopy-meta/`.
+                // rename so a transient error leaves no stray `.tmp` beside the cache.
                 await fs.mkdir(cacheDir, { recursive: true });
                 const tmpPath = path.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
                 await fs.writeFile(tmpPath, JSON.stringify(newCache, null, 2), 'utf-8');

package/dist/branch-workspace.js

@@ -1,12 +1,12 @@
 import path from 'node:path';
-import { ensureBranchRoot } from './paths/index.js';
+import { BranchPathError, ensureBranchRoot, isSettingsBranchName } from './paths/index.js';
 import { getBranchMetadataFileManager, loadBranchContext } from './branch-metadata.js';
 import { readsFromCheckout } from './build-mode.js';
 import { operatingStrategy } from './operating-mode/index.js';
 import { GitManager } from './git-manager.js';
 import { createDebugLogger } from './utils/debug.js';
 import { resolveBaseBranch } from './utils/git.js';
-import { acquireProvisioningLock } from './utils/provisioning-lock.js';
+import { acquireProvisioningLock, branchProvisioningLockName } from './utils/provisioning-lock.js';
 const log = createDebugLogger({ prefix: 'BranchWorkspace' });
 // In-memory lock to prevent concurrent workspace initialization
 const workspaceInitLocks = new Map();
@@ -41,7 +41,7 @@ export class BranchWorkspaceManager {
                         branchName: options.branchName,
                         mode: options.mode,
                     });
-                    releaseLock = await acquireProvisioningLock(path.dirname(options.branchRoot), `.${path.basename(options.branchRoot)}.init.lock`);
+                    releaseLock = await acquireProvisioningLock(path.dirname(options.branchRoot), branchProvisioningLockName(path.basename(options.branchRoot)));
                     await GitManager.initializeWorkspace({
                         workspacePath: options.branchRoot,
                         branchName: options.branchName,
@@ -77,6 +77,11 @@ export class BranchWorkspaceManager {
     }
     async openOrCreateBranch(options) {
         const { branchName, mode, basePathOverride, title, description, access, createdBy, remoteUrl } = options;
+        // resolveBranchPath refuses the reserved prefix; this also refuses an adopter's
+        // configured settings branch name, which only the config knows.
+        if (isSettingsBranchName(branchName, operatingStrategy(mode).getSettingsBranchName(this.config))) {
+            throw new BranchPathError('Settings branches are not content branches');
+        }
         const { branchRoot, baseRoot, branchName: safeName, } = await ensureBranchRoot({
             mode,
             branchName,

package/dist/build-identity.d.ts

@@ -0,0 +1,3 @@
+import type { BuildIdentity } from './types.js';
+export type { BuildIdentity };
+export declare function getBuildIdentity(env?: NodeJS.ProcessEnv): BuildIdentity;

package/dist/build-identity.js

@@ -0,0 +1,13 @@
+import { CANOPYCMS_VERSION } from './version.js';
+/**
+ * Set by the image build (Dockerfile.cms `ARG`), not by the infrastructure: a Lambda env var
+ * would name the infrastructure's commit and hide an image/infrastructure skew.
+ */
+const SOURCE_REVISION_ENV = 'CANOPY_SOURCE_SHA';
+export function getBuildIdentity(env = process.env) {
+    // The Dockerfile sets the variable to the empty string when the build arg is not passed.
+    const sourceRevision = env[SOURCE_REVISION_ENV]?.trim();
+    return sourceRevision
+        ? { canopycmsVersion: CANOPYCMS_VERSION, sourceRevision }
+        : { canopycmsVersion: CANOPYCMS_VERSION };
+}