canopycms 0.0.67 → 0.0.68-int.94

package/dist/cli/github-app-manifest.d.ts

@@ -24,9 +24,10 @@ export type PermissionSet = Readonly<Record<string, PermissionLevel>>;
  * - `metadata: read` — implied by any repository permission; declared so
  *   this object states the whole surface, not just the non-automatic part.
  * Nothing else: no `issues`, `administration`, `actions`, or organisation
- * permissions. No `workflows` either, though GitHub may refuse to push
- * rebased history touching `.github/workflows/` — see
- * .claude/future-tasks/worker-push-refused-when-base-changes-workflows.md.
+ * permissions. No `workflows` either: GitHub refuses only workflow content it
+ * does not already hold, so rebasing onto a base that changed a workflow is
+ * accepted. Content that is new to GitHub fails the push task with the file
+ * named (`throwIfWorkflowRefusal` in worker/task-runner.ts).
  */
 export declare const CANOPY_APP_PERMISSIONS: PermissionSet;
 /**

package/dist/cli/github-app-manifest.js

@@ -22,9 +22,10 @@ const PERMISSION_LEVELS = ['read', 'write', 'admin'];
  * - `metadata: read` — implied by any repository permission; declared so
  *   this object states the whole surface, not just the non-automatic part.
  * Nothing else: no `issues`, `administration`, `actions`, or organisation
- * permissions. No `workflows` either, though GitHub may refuse to push
- * rebased history touching `.github/workflows/` — see
- * .claude/future-tasks/worker-push-refused-when-base-changes-workflows.md.
+ * permissions. No `workflows` either: GitHub refuses only workflow content it
+ * does not already hold, so rebasing onto a base that changed a workflow is
+ * accepted. Content that is new to GitHub fails the push task with the file
+ * named (`throwIfWorkflowRefusal` in worker/task-runner.ts).
  */
 export const CANOPY_APP_PERMISSIONS = {
     contents: 'write',

package/dist/cli/init.js

@@ -115,7 +115,8 @@ var init_field = __esm({
     });
     objectFieldSchema = fieldBaseSchema.extend({
       type: z.literal("object"),
-      fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+      fields: z.array(z.lazy(() => fieldHolder[0])).min(1),
+      itemTitleField: z.string().min(1).optional()
     });
     inlineGroupFieldSchema = z.object({
       type: z.literal("group"),
@@ -231,7 +232,7 @@ var init_sanitize_href = __esm({
 
 // dist/config/schemas/url.js
 import { z as z3 } from "zod";
-var uploadTargetUrlSchema, assetMountUrlSchema;
+var uploadTargetUrlSchema, assetMountUrlSchema, previewPrefixSchema;
 var init_url = __esm({
   "dist/config/schemas/url.js"() {
     "use strict";
@@ -242,6 +243,9 @@ var init_url = __esm({
     assetMountUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
       message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
     });
+    previewPrefixSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+      message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+    });
   }
 });
 
@@ -299,6 +303,7 @@ var init_config = __esm({
     "use strict";
     init_collection();
     init_media();
+    init_url();
     defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
     defaultPathAccessLevelSchema = z5.enum(["allow", "deny"]);
     defaultPathAccessLevelsSchema = z5.object({
@@ -330,6 +335,7 @@ var init_config = __esm({
       subtitle: z5.string().optional(),
       theme: z5.unknown().optional(),
       previewBase: z5.record(z5.string()).optional(),
+      previewPrefix: previewPrefixSchema.optional(),
       // UI handler functions (runtime only, don't serialize)
       onAccountClick: z5.function().returns(z5.void()).optional(),
       onLogoutClick: z5.function().returns(z5.void()).optional(),
@@ -357,6 +363,9 @@ var init_config = __esm({
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
       gitBotAuthorEmail: gitBotAuthorEmailSchema,
+      // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+      gitEditedByTrailers: z5.boolean().optional(),
+      gitCoAuthoredByTrailers: z5.boolean().optional(),
       githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
       // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
       // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -368,7 +377,6 @@ var init_config = __esm({
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
       allowNetworkRemoteInProd: z5.boolean().optional(),
       settingsBranch: z5.string().optional(),
-      autoCreateSettingsPR: z5.boolean().optional(),
       // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
       // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
       // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -889,6 +897,10 @@ var init_debug = __esm({
           throw new Error(errorMsg);
         }
       }
+      /**
+       * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+       * anything that can run concurrently uses {@link timed}.
+       */
       time(label) {
         this.timers.set(label, Date.now());
       }
@@ -903,12 +915,16 @@ var init_debug = __esm({
         this.debug(category, `${label} completed`, { durationMs: duration });
         return duration;
       }
+      /**
+       * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+       * call, so concurrent spans with the same label on one logger never overwrite each other.
+       */
       async timed(category, label, fn) {
-        this.time(label);
+        const start = Date.now();
         try {
           return await fn();
         } finally {
-          this.timeEnd(category, label);
+          this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
         }
       }
     };
@@ -1525,9 +1541,6 @@ var ProdStrategy = class extends ProdClientSafeStrategy {
       throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
     }
   }
-  shouldCreateSettingsPR(config) {
-    return config.autoCreateSettingsPR ?? true;
-  }
 };
 var DevStrategy = class extends DevClientSafeStrategy {
   getWorkspaceRoot(sourceRoot) {
@@ -1574,9 +1587,6 @@ var DevStrategy = class extends DevClientSafeStrategy {
   }
   validateConfig(_config) {
   }
-  shouldCreateSettingsPR(_config) {
-    return false;
-  }
 };
 var strategyCache = /* @__PURE__ */ new Map();
 function operatingStrategy(mode) {

package/dist/cli/migrate.js

@@ -21,8 +21,9 @@ import { parseSlug } from '../paths/index.js';
 import { filePathExists } from '../utils/fs.js';
 import { loadCollectionMetaFiles } from '../schema/index.js';
 import { getErrorMessage } from '../utils/error.js';
-import { withLock } from '../utils/async-mutex.js';
-import { withOccFileLock, OccWriteConflictError } from '../utils/occ-json-write.js';
+import { ContentWriteLockBusyError } from '../utils/content-write-lock.js';
+import { OccWriteConflictError } from '../utils/occ-json-write.js';
+import { withBranchSchemaLock } from '../schema/schema-store.js';
 import { BranchMetadataFileManager } from '../branch-metadata.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
 const MIGRATE_FORMATS = ['md', 'mdx', 'json', 'yaml'];
@@ -245,18 +246,21 @@ export async function migrate(options) {
     };
     if (isBranchClone) {
         // projectDir IS the branch root in this case (see the invariant note
-        // above) — the same surrogate lock path SchemaOps uses for its own
-        // schema mutations (schema-store.ts's withSchemaLock), so a migrate run
-        // racing a live schema-editing request on this same branch clone
-        // serializes against it instead of silently interleaving writes.
-        const lockPath = path.join(projectDir, '.canopy-meta', 'schema');
+        // above). The renames rewrite the working tree the worker rebases, so this
+        // takes the same locks SchemaOps does for its own schema mutations: the
+        // content-write lock, then the schema surrogate.
         try {
-            await withLock(lockPath, () => withOccFileLock(lockPath, applyOps));
+            await withBranchSchemaLock(projectDir, applyOps);
         }
         catch (err) {
             if (err instanceof OccWriteConflictError) {
                 throw new MigrateError('Another process is modifying the schema, try again.');
             }
+            if (err instanceof ContentWriteLockBusyError) {
+                throw new MigrateError(err.outcome === 'unknown'
+                    ? 'The branch was being synced while migrate ran, so it may be partly applied. Check its state before running migrate again.'
+                    : err.message);
+            }
             throw err;
         }
     }

package/dist/cli/sync.js

@@ -17,8 +17,10 @@ import path from 'node:path';
 import { simpleGit } from 'simple-git';
 import * as p from '@clack/prompts';
 import { filePathExists } from '../utils/fs.js';
+import { isCanopyInternalPath, stageAllExceptCanopyState } from '../utils/git.js';
 import { assertWithinDir, copyDir, listFilesRecursive, pushContentToWorkspace, safeReplaceDir, SYNC_BASE_TAG, } from '../sync-core.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
+import { ContentWriteLockBusyError, withContentWriteLock } from '../utils/content-write-lock.js';
 import { ensureGitExcludePattern } from '../git-manager.js';
 import { operatingStrategy } from '../operating-mode/index.js';
 /**
@@ -32,6 +34,42 @@ class SyncError extends Error {
         this.name = 'SyncError';
     }
 }
+/**
+ * [SYNC-C1] Every sync step that rewrites a branch workspace (content replace, checkout, merge,
+ * merge abort) runs under the workspace's content-write lock, which the dev server's saves and
+ * the worker's rebase also take. Contention becomes a `SyncError`, so the CLI exits non-zero.
+ */
+function lockBusyAsSyncError(err, branchName) {
+    if (!(err instanceof ContentWriteLockBusyError))
+        return err;
+    return new SyncError(err.outcome === 'not-run'
+        ? `Branch workspace "${branchName}" is busy (the worker is syncing it, or an editor save is in flight); nothing was changed. Try again in a moment.`
+        : `Branch workspace "${branchName}" was being synced during this run, so it may be partly updated. Check its state before running sync again.`);
+}
+async function withWorkspaceLock(branchPath, branchName, fn) {
+    try {
+        return await withContentWriteLock(branchPath, fn);
+    }
+    catch (err) {
+        throw lockBusyAsSyncError(err, branchName);
+    }
+}
+/**
+ * `git merge --abort` in a workspace left mid-merge, re-checking under the lock that it still is.
+ * Returns whether a merge was aborted.
+ */
+async function abortWorkspaceMerge(branchPath, branchName) {
+    return withWorkspaceLock(branchPath, branchName, async () => {
+        const wsGit = simpleGit({ baseDir: branchPath });
+        if ((await wsGit.status()).conflicted.length === 0)
+            return false;
+        await wsGit.merge(['--abort']);
+        // The abort rewrote the clone's working tree — tell ContentStore ID
+        // indexes (the dev server is a separate process; on-disk marker).
+        await invalidateBranchContentCaches(branchPath);
+        return true;
+    });
+}
 /** Detect the current git branch name from the working tree. */
 async function detectCurrentBranch(projectDir) {
     const git = simpleGit({ baseDir: projectDir });
@@ -140,22 +178,21 @@ async function syncPush(options) {
                 initialValue: false,
             });
             if (!p.isCancel(shouldAbort) && shouldAbort) {
-                await wsGit.merge(['--abort']);
-                // The abort rewrote the clone's working tree — tell ContentStore ID
-                // indexes (the dev server is a separate process; on-disk marker).
-                await invalidateBranchContentCaches(branchPath);
-                p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                if (await abortWorkspaceMerge(branchPath, branchName)) {
+                    p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                }
             }
         }
         return { fileCount: 0 };
     }
-    if (status.files.length > 0 && !options.force) {
-        p.log.warn(`Branch workspace has ${status.files.length} uncommitted change(s) that will be committed to history then overwritten:`);
-        for (const file of status.files.slice(0, 10)) {
+    const editorChanges = status.files.filter((f) => !isCanopyInternalPath(f.path));
+    if (editorChanges.length > 0 && !options.force) {
+        p.log.warn(`Branch workspace has ${editorChanges.length} uncommitted change(s) that will be committed to history then overwritten:`);
+        for (const file of editorChanges.slice(0, 10)) {
             p.log.warn(`  ${file.path}`);
         }
-        if (status.files.length > 10) {
-            p.log.warn(`  ... and ${status.files.length - 10} more`);
+        if (editorChanges.length > 10) {
+            p.log.warn(`  ... and ${editorChanges.length - 10} more`);
         }
         const confirm = await p.confirm({
             message: 'Continue? Editor changes will be preserved in git history.',
@@ -166,20 +203,26 @@ async function syncPush(options) {
             return { fileCount: 0 };
         }
     }
-    // Auto-commit uncommitted workspace changes to preserve in history
-    if (status.files.length > 0) {
-        await wsGit.add('-A');
-        await wsGit.commit('sync: save editor state before push');
-        p.log.info('Committed editor changes to history before push');
-    }
     p.log.step(`Pushing content to branch workspace: ${branchName}`);
-    // Copy working-tree content → workspace content dir, commit, and tag the sync base.
-    const { fileCount } = await pushContentToWorkspace({
-        srcContentDir,
-        branchPath,
-        contentRoot,
-        baseTag: SYNC_BASE_TAG,
-    });
+    // Commit any editor changes (re-read under the lock, so a save landing after
+    // the listing above is preserved too), copy working-tree content → workspace
+    // content dir, commit, and tag the sync base.
+    let fileCount;
+    try {
+        const result = await pushContentToWorkspace({
+            srcContentDir,
+            branchPath,
+            contentRoot,
+            baseTag: SYNC_BASE_TAG,
+            saveEditorStateMessage: 'sync: save editor state before push',
+        });
+        fileCount = result.fileCount;
+        if (result.savedEditorState)
+            p.log.info('Committed editor changes to history before push');
+    }
+    catch (err) {
+        throw lockBusyAsSyncError(err, branchName);
+    }
     if (fileCount === 0) {
         p.log.info('Content is already up to date — nothing to push');
     }
@@ -321,16 +364,23 @@ async function syncBoth(options) {
                 initialValue: false,
             });
             if (!p.isCancel(shouldAbort) && shouldAbort) {
-                await wsGit.merge(['--abort']);
-                await invalidateBranchContentCaches(branchPath);
-                p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                if (await abortWorkspaceMerge(branchPath, branchName)) {
+                    p.log.success('Merge aborted. Workspace restored to pre-merge state.');
+                }
             }
         }
         return { pushed: 0, pulled: 0 };
     }
+    return withWorkspaceLock(branchPath, branchName, () => mergeIntoWorkspace(options, { branchName, branchPath, srcContentDir, contentRoot }));
+}
+/** The locked body of {@link syncBoth}: everything that rewrites the workspace. */
+async function mergeIntoWorkspace(options, ws) {
+    const { branchName, branchPath, srcContentDir, contentRoot } = ws;
+    const wsGit = simpleGit({ baseDir: branchPath });
+    const status = await wsGit.status();
     // Auto-commit uncommitted workspace changes (preserves editor work for the merge)
-    if (status.files.length > 0) {
-        await wsGit.add('-A');
+    if (status.files.some((f) => !isCanopyInternalPath(f.path))) {
+        await stageAllExceptCanopyState(wsGit);
         await wsGit.commit('sync: save editor state before merge');
         p.log.info('Committed editor changes before merge');
     }
@@ -365,9 +415,9 @@ async function syncBoth(options) {
             await wsGit.raw(['branch', '-D', incomingBranch]).catch(() => { });
             throw err;
         }
-        await wsGit.add('-A');
-        const incomingStatus = await wsGit.status();
-        if (incomingStatus.files.length === 0) {
+        await stageAllExceptCanopyState(wsGit);
+        const incomingFiles = (await wsGit.status()).files.filter((f) => !isCanopyInternalPath(f.path));
+        if (incomingFiles.length === 0) {
             await wsGit.checkout(currentBranch);
             await wsGit.raw(['branch', '-D', incomingBranch]);
             p.log.info('No working-tree changes to merge — pulling editor changes only');
@@ -410,7 +460,7 @@ async function syncBoth(options) {
         await wsGit.tag(['-f', SYNC_BASE_TAG]);
         p.log.success('Merged working-tree changes with editor changes');
         const pullResult = await syncPull({ ...options, branch: branchName, force: true });
-        return { pushed: incomingStatus.files.length, pulled: pullResult.fileCount };
+        return { pushed: incomingFiles.length, pulled: pullResult.fileCount };
     }
     finally {
         await invalidateBranchContentCaches(branchPath);
@@ -428,14 +478,10 @@ async function syncAbort(options) {
         return;
     const branchPath = path.join(branchesDir, branchName);
     assertWithinDir(branchPath, branchesDir, '--branch');
-    const wsGit = simpleGit({ baseDir: branchPath });
-    const status = await wsGit.status();
-    if (status.conflicted.length === 0) {
+    if (!(await abortWorkspaceMerge(branchPath, branchName))) {
         p.log.info(`Branch workspace "${branchName}" is not in a merge state — nothing to abort.`);
         return;
     }
-    await wsGit.merge(['--abort']);
-    await invalidateBranchContentCaches(branchPath);
     p.log.success(`Merge aborted in branch workspace "${branchName}". Workspace restored to pre-merge state.`);
 }
 /**

package/dist/cli/template-files/Dockerfile.cms.template

@@ -73,5 +73,13 @@ COPY --from=builder /app/public ./public
 # Lambda's filesystem is read-only outside /tmp. Next may write to .next/cache
 # at runtime; symlink it to /tmp so those writes succeed instead of failing (EROFS).
 RUN rm -rf .next/cache && ln -s /tmp .next/cache
+# The CMS reports this in System health. A build arg, not a Lambda environment
+# variable: a Lambda variable names the infrastructure's commit and would hide
+# exactly the image/infrastructure skew this exists to reveal. Declared after
+# every build layer, so with a warm layer cache a new revision re-runs only the
+# metadata steps from here down.
+ARG CANOPY_SOURCE_SHA=
+ENV CANOPY_SOURCE_SHA=$CANOPY_SOURCE_SHA
+LABEL org.opencontainers.image.revision=$CANOPY_SOURCE_SHA
 ENV PORT=8080 AWS_LWA_PORT=8080 HOSTNAME=0.0.0.0 NODE_ENV=production
 CMD ["node", "server.js"]

package/dist/cli/template-files/cdk-app.ts.template

@@ -126,4 +126,8 @@ new CmsStack(app, '{{STACK_NAME}}', {
   // point your own existing distribution at it.
   domainName: process.env.CMS_DOMAIN_NAME || undefined,
   hostedZoneDomain: process.env.CMS_HOSTED_ZONE_DOMAIN || undefined,
+
+  // Optional, and NOT `required()`: the commit the CMS image is built from,
+  // shown in System health. Unset, System health reports it as "not set".
+  sourceRevision: process.env.CANOPY_SOURCE_SHA || undefined,
 })

package/dist/cli/template-files/cms-stack.ts.template

@@ -77,6 +77,8 @@ export interface CmsStackProps extends StackProps {
   domainName?: string
   /** Optional Route53 hosted zone domain, e.g. 'example.org'. */
   hostedZoneDomain?: string
+  /** Optional. Commit the CMS image is built from; shown in System health. */
+  sourceRevision?: string
 }
 
 export class CmsStack extends Stack {
@@ -128,6 +130,10 @@ export class CmsStack extends Stack {
           // auth. The image's own `next build` stays in dev mode either way --
           // see Dockerfile.cms.
           NEXT_PUBLIC_CANOPY_MODE: 'prod',
+          // CDK hashes build args into the asset, so every new commit rebuilds
+          // the image, even one changing only the dockerignored infrastructure/
+          // -- that is what keeps the revision the CMS reports honest.
+          ...(props.sourceRevision ? { CANOPY_SOURCE_SHA: props.sourceRevision } : {}),
         },
       }),
       // The one place the CMS image's CPU architecture is decided. CDK derives

package/dist/cli/template-files/deploy-cms.yml.template

@@ -241,4 +241,6 @@ jobs:
           CANOPYCMS_DEPLOYMENT_NAME: ${{ vars.CANOPYCMS_DEPLOYMENT_NAME }}
           CMS_DOMAIN_NAME: ${{ vars.CMS_DOMAIN_NAME }}
           CMS_HOSTED_ZONE_DOMAIN: ${{ vars.CMS_HOSTED_ZONE_DOMAIN }}
+          # The commit the CMS image is built from, reported in System health.
+          CANOPY_SOURCE_SHA: ${{ github.sha }}
         run: npx cdk deploy {{STACK_NAME}} --require-approval never

package/dist/config/schemas/config.d.ts

@@ -69,12 +69,13 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     defaultRemoteUrl: z.ZodOptional<z.ZodString>;
     gitBotAuthorName: z.ZodString;
     gitBotAuthorEmail: z.ZodString;
+    gitEditedByTrailers: z.ZodOptional<z.ZodBoolean>;
+    gitCoAuthoredByTrailers: z.ZodOptional<z.ZodBoolean>;
     githubTokenEnvVar: z.ZodOptional<z.ZodDefault<z.ZodString>>;
     mode: z.ZodEnum<["prod", "dev"]>;
     deployedAs: z.ZodDefault<z.ZodEnum<["static", "server"]>>;
     allowNetworkRemoteInProd: z.ZodOptional<z.ZodBoolean>;
     settingsBranch: z.ZodOptional<z.ZodString>;
-    autoCreateSettingsPR: z.ZodOptional<z.ZodBoolean>;
     deploymentName: z.ZodOptional<z.ZodDefault<z.ZodString>>;
     contentRoot: z.ZodDefault<z.ZodDefault<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>>;
     sourceRoot: z.ZodOptional<z.ZodOptional<z.ZodString>>;
@@ -84,6 +85,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         subtitle: z.ZodOptional<z.ZodString>;
         theme: z.ZodOptional<z.ZodUnknown>;
         previewBase: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        previewPrefix: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         onAccountClick: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodVoid>>;
         onLogoutClick: z.ZodOptional<z.ZodFunction<z.ZodTuple<[], z.ZodUnknown>, z.ZodVoid>>;
         AccountComponent: z.ZodOptional<z.ZodType<import("react").ComponentType<{}>, z.ZodTypeDef, import("react").ComponentType<{}>>>;
@@ -93,6 +95,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string> | undefined;
+        previewPrefix?: string | undefined;
         onAccountClick?: ((...args: unknown[]) => void) | undefined;
         onLogoutClick?: ((...args: unknown[]) => void) | undefined;
         AccountComponent?: import("react").ComponentType<{}> | undefined;
@@ -102,6 +105,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string> | undefined;
+        previewPrefix?: string | undefined;
         onAccountClick?: ((...args: unknown[]) => void) | undefined;
         onLogoutClick?: ((...args: unknown[]) => void) | undefined;
         AccountComponent?: import("react").ComponentType<{}> | undefined;
@@ -152,9 +156,10 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     defaultActiveBranch?: string | undefined;
     defaultRemoteName?: string | undefined;
     defaultRemoteUrl?: string | undefined;
+    gitEditedByTrailers?: boolean | undefined;
+    gitCoAuthoredByTrailers?: boolean | undefined;
     githubTokenEnvVar?: string | undefined;
     allowNetworkRemoteInProd?: boolean | undefined;
-    autoCreateSettingsPR?: boolean | undefined;
     deploymentName?: string | undefined;
     sourceRoot?: string | undefined;
     basePath?: string | undefined;
@@ -163,6 +168,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string> | undefined;
+        previewPrefix?: string | undefined;
         onAccountClick?: ((...args: unknown[]) => void) | undefined;
         onLogoutClick?: ((...args: unknown[]) => void) | undefined;
         AccountComponent?: import("react").ComponentType<{}> | undefined;
@@ -204,10 +210,11 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     defaultActiveBranch?: string | undefined;
     defaultRemoteName?: string | undefined;
     defaultRemoteUrl?: string | undefined;
+    gitEditedByTrailers?: boolean | undefined;
+    gitCoAuthoredByTrailers?: boolean | undefined;
     githubTokenEnvVar?: string | undefined;
     deployedAs?: "static" | "server" | undefined;
     allowNetworkRemoteInProd?: boolean | undefined;
-    autoCreateSettingsPR?: boolean | undefined;
     deploymentName?: string | undefined;
     contentRoot?: string | undefined;
     sourceRoot?: string | undefined;
@@ -217,6 +224,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string> | undefined;
+        previewPrefix?: string | undefined;
         onAccountClick?: ((...args: unknown[]) => void) | undefined;
         onLogoutClick?: ((...args: unknown[]) => void) | undefined;
         AccountComponent?: import("react").ComponentType<{}> | undefined;

package/dist/config/schemas/config.js

@@ -4,6 +4,7 @@
 import { z } from 'zod';
 import { relativePathSchema } from './collection.js';
 import { mediaSchema } from './media.js';
+import { previewPrefixSchema } from './url.js';
 const defaultBranchAccessSchema = z.enum(['allow', 'deny']).default('deny');
 const defaultPathAccessLevelSchema = z.enum(['allow', 'deny']);
 // Per-level object form: an omitted level stays undefined after parse (no per-field
@@ -51,6 +52,7 @@ const editorConfigSchema = z.object({
     subtitle: z.string().optional(),
     theme: z.unknown().optional(),
     previewBase: z.record(z.string()).optional(),
+    previewPrefix: previewPrefixSchema.optional(),
     // UI handler functions (runtime only, don't serialize)
     onAccountClick: z.function().returns(z.void()).optional(),
     onLogoutClick: z.function().returns(z.void()).optional(),
@@ -79,6 +81,9 @@ export const CanopyConfigSchema = z
     defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
     gitBotAuthorName: gitBotAuthorNameSchema,
     gitBotAuthorEmail: gitBotAuthorEmailSchema,
+    // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+    gitEditedByTrailers: z.boolean().optional(),
+    gitCoAuthoredByTrailers: z.boolean().optional(),
     githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
     // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
     // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -89,7 +94,6 @@ export const CanopyConfigSchema = z
     // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
     allowNetworkRemoteInProd: z.boolean().optional(),
     settingsBranch: z.string().optional(),
-    autoCreateSettingsPR: z.boolean().optional(),
     // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
     // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
     // env > config > modeDefault precedence chain `resolveDeploymentName`

package/dist/config/schemas/field.js

@@ -81,6 +81,7 @@ const blockFieldSchema = fieldBaseSchema.extend({
 const objectFieldSchema = fieldBaseSchema.extend({
     type: z.literal('object'),
     fields: z.array(z.lazy(() => fieldHolder[0])).min(1),
+    itemTitleField: z.string().min(1).optional(),
 });
 // Inline group field: visual grouping only, no data nesting
 const inlineGroupFieldSchema = z.object({

package/dist/config/schemas/url.d.ts

@@ -35,3 +35,5 @@ export declare const uploadTargetUrlSchema: z.ZodEffects<z.ZodString, string, st
  * `publicBaseUrl: 'mailto:a@b.c'` and produce `/mailto:a@b.c/assets/…` at render time.
  */
 export declare const assetMountUrlSchema: z.ZodEffects<z.ZodString, string, string>;
+/** `editor.previewPrefix`, by `uploadTargetUrlSchema`'s rule: `//host` leaves the scheme open. */
+export declare const previewPrefixSchema: z.ZodEffects<z.ZodString, string, string>;

package/dist/config/schemas/url.js

@@ -46,3 +46,10 @@ export const assetMountUrlSchema = z
     .refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
     message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment',
 });
+/** `editor.previewPrefix`, by `uploadTargetUrlSchema`'s rule: `//host` leaves the scheme open. */
+export const previewPrefixSchema = z
+    .string()
+    .trim()
+    .refine((value) => isHttpUrlOrSameOriginPath(value), {
+    message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment',
+});

package/dist/config/types.d.ts

@@ -132,6 +132,11 @@ export interface BlockFieldConfig extends BaseFieldConfig {
 export interface ObjectFieldConfig extends BaseFieldConfig {
     type: 'object';
     fields: FieldConfig[];
+    /**
+     * On a `list: true` object, a direct `string` or `number` child whose value titles each
+     * item's card; a blank or non-finite value falls back to "<label> #N".
+     */
+    itemTitleField?: string;
 }
 /**
  * Inline group field config: visually groups fields in the editor without creating
@@ -257,10 +262,25 @@ export interface CanopyEditorConfig {
      *
      * Values are **site-relative** and must NOT include the deployment `basePath` — that is applied
      * on top of whatever this yields (see `CanopyConfig.basePath`), so including it here would
-     * prefix it twice. An absolute value (`https://…`) is passed through untouched instead, which
-     * is the escape hatch for previewing against a different origin entirely.
+     * prefix it twice. An absolute value (`https://…`) gets only the slug and `?branch=`, with no
+     * `basePath`, `previewPrefix` or trailing-slash change: the escape hatch for previewing against a
+     * different origin entirely.
+     *
+     * A site-relative value is a route on the host site, so `previewPrefix` is applied to it too.
      */
     previewBase?: Record<string, string>;
+    /**
+     * Where the host mounts the pages the preview pane loads, put in front of every entry's preview
+     * URL (`'/preview'` makes `/blog/hello` load `/preview/blog/hello`). Set it when the site's
+     * public pages are a static export, which cannot render a requested branch, so the preview
+     * must load a route the CMS server renders.
+     *
+     * A path starting with `/`, without the deployment `basePath` (applied on top, as for
+     * `previewBase`), or an absolute `http(s)://` URL, which skips the `basePath`. Pages on another
+     * origin accept drafts only with `useCanopyPreview({ editorOrigin })`. An absolute `previewBase`
+     * value skips this prefix.
+     */
+    previewPrefix?: string;
     onAccountClick?: () => void;
     onLogoutClick?: () => void;
     AccountComponent?: React.ComponentType;
@@ -346,6 +366,8 @@ export interface CanopyConfig {
     defaultRemoteUrl?: DefaultRemoteUrl;
     gitBotAuthorName: GitBotAuthorName;
     gitBotAuthorEmail: GitBotAuthorEmail;
+    gitEditedByTrailers?: boolean;
+    gitCoAuthoredByTrailers?: boolean;
     githubTokenEnvVar?: GithubTokenEnvVar;
     mode: CanopyOperatingMode;
     /** How this build is deployed — see {@link CanopyConfigInput.deployedAs}. */
@@ -353,7 +375,6 @@ export interface CanopyConfig {
     /** Escape hatch for a prod host with real internet access — see {@link CanopyConfigInput.allowNetworkRemoteInProd}. */
     allowNetworkRemoteInProd?: boolean;
     settingsBranch?: string;
-    autoCreateSettingsPR?: boolean;
     deploymentName?: string;
     contentRoot: ContentRoot;
     sourceRoot?: SourceRoot;
@@ -382,6 +403,10 @@ export interface CanopyConfigInput {
     defaultRemoteUrl?: string;
     gitBotAuthorName: string;
     gitBotAuthorEmail: string;
+    /** Add `Edited-by: Name (user id)` for the submitter to submit commits. Default true. */
+    gitEditedByTrailers?: boolean;
+    /** Also add `Co-authored-by: Name <email>`. Default false: emails in public history are public. */
+    gitCoAuthoredByTrailers?: boolean;
     githubTokenEnvVar?: string;
     /**
      * Operating mode: 'prod' or 'dev'. Required — no default (SEC-C1). A prod deploy that
@@ -402,7 +427,6 @@ export interface CanopyConfigInput {
      */
     allowNetworkRemoteInProd?: boolean;
     settingsBranch?: string;
-    autoCreateSettingsPR?: boolean;
     deploymentName?: string;
     contentRoot?: string;
     sourceRoot?: string;