canopycms 0.0.67 → 0.0.68-int.94

package/dist/content-tree.js

@@ -70,11 +70,11 @@ export async function buildContentTree(branchRoot, flatSchema, contentRootName,
     // read once for the entire tree rather than once per collection. Null unless opted in —
     // see the `resolveReferences` option above.
     const resolver = options?.resolveReferences
-        ? createReferenceResolver(branchRoot, flatSchema, contentRootName)
+        ? createReferenceResolver(branchRoot, flatSchema, contentRootName, visibility)
         : null;
     const listVisibleEntries = async (collection) => {
         const entries = await listCollectionEntries(branchRoot, collection);
-        const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.physicalPath)) : entries;
+        const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.logicalPath)) : entries;
         // Resolved here rather than at the two node-building sites so BOTH inherit it — the same
         // reason the ACL filter lives here. A denied entry is filtered above and never resolved.
         return resolver ? resolveCollectionItemReferences(visible, collection, resolver) : visible;

package/dist/context.d.ts

@@ -15,6 +15,10 @@
  * Only request-time reads on a server deployment resolve a branch workspace —
  * in dev, the clone under `.canopy-dev/content-branches/`.
  *
+ * A `branch` arrives from the request (a page passing `?branch=`), so only the
+ * active branch is ever provisioned here; any other name must already exist and
+ * pass the user's branch access before its files are read (`resolveBranch`).
+ *
  * The Next.js adapter wraps this in React `cache()` for per-request memoization
  * (`canopycms-next/src/context-wrapper.ts`).
  *
@@ -58,8 +62,12 @@ export interface CanopyBuildContext {
      * `meta.indexEntry` handed to `extract`, and a collection whose children are
      * all filtered out is pruned. On the build context and on static deployments
      * nothing is filtered — the synthetic admin sees everything.
+     *
+     * Branch: the `branch` option behaves as on `listEntries`.
      */
-    buildContentTree: <T = unknown, TEntryTypes = DefaultEntryTypes>(options?: BuildContentTreeOptions<T, TEntryTypes>) => Promise<ContentTreeNode<T>[]>;
+    buildContentTree: <T = unknown, TEntryTypes = DefaultEntryTypes>(options?: BuildContentTreeOptions<T, TEntryTypes> & {
+        branch?: string;
+    }) => Promise<ContentTreeNode<T>[]>;
     /**
      * Every content entry as a flat array.
      *
@@ -67,13 +75,18 @@ export interface CanopyBuildContext {
      * cannot `read` are omitted before `extract` runs; on the build context and
      * static deployments nothing is filtered.
      *
-     * Branch: unlike `read`/`readByUrlPath` this takes no `branch` option, always
-     * listing `defaultActiveBranch ?? defaultBaseBranch ?? 'main'`. In `dev` that
-     * tracks git HEAD via `refreshActiveBranch()`; in `prod` the refresh is a
-     * no-op, so it always reads the base branch. See
-     * `.claude/future-tasks/context-listing-branch-pinning.md`.
+     * Branch: with no `branch` it lists the active branch
+     * (`defaultActiveBranch ?? defaultBaseBranch`): git HEAD in `dev` when that is
+     * unset, otherwise usually the base branch in `prod`. Pass the preview
+     * iframe's `?branch=` as `branch`, as for `read`, so an index page previewed
+     * on a content branch lists that branch. Any other branch must already exist
+     * and, on the request-scoped context, be readable by the user; otherwise, or
+     * for an array, the result is empty. It selects nothing at build
+     * time or on static deployments.
      */
-    listEntries: <T = Record<string, unknown>>(options?: ListEntriesOptions<T>) => Promise<ListEntriesItem<T>[]>;
+    listEntries: <T = Record<string, unknown>>(options?: ListEntriesOptions<T> & {
+        branch?: string;
+    }) => Promise<ListEntriesItem<T>[]>;
     /**
      * Content reader, with the auth context applied automatically (admin at build
      * time).
@@ -83,6 +96,11 @@ export interface CanopyBuildContext {
      * output, since it reveals the deployment's filesystem layout (home dir, EFS
      * mount, branch name). It is for build-time reads of colocated artifacts, e.g.
      * `fs.readFile(path.join(path.dirname(result.meta.physicalPath), 'profile.json'))`.
+     *
+     * Branch: with no `branch` it reads the active branch, provisioning its workspace if missing.
+     * Any other branch must already exist and, on the request-scoped context, be readable by the
+     * user; otherwise, or for an array, it throws NOT_FOUND, so a hidden branch reads as a missing
+     * one. It selects nothing at build time or on static deployments.
      */
     read: <T = unknown>(input: {
         entryPath: string;
@@ -109,8 +127,8 @@ export interface CanopyBuildContext {
      *
      * Null when nothing matches — a collection URL with no index entry (use
      * buildContentTree), a non-entry path like `/favicon.ico` the slug validator
-     * rejects, or a path the user may not read, so a FORBIDDEN denial renders as
-     * a 404 via `notFound()` rather than a 500. Strict `read()` still throws.
+     * rejects, a missing branch, or a path or branch the user may not read, so a
+     * denial renders as a 404 via `notFound()`, not a 500. Strict `read()` throws.
      *
      * `meta.physicalPath` is **server-only**, for the reason given on `read`.
      * `meta.entryType`/`entryId` come free with path resolution, so one catch-all

package/dist/context.js

@@ -1,9 +1,9 @@
-import { isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER } from './build-mode.js';
+import { isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER } from './build-mode.js';
 import { createContentReader } from './content-reader.js';
 import { ContentStoreError } from './content-store.js';
-import { createLogicalPath, parseSlug, resolveBranchPaths } from './paths/index.js';
+import { createLogicalPath, namesNoWorkspace, parseSlug, resolveBranchPaths, } from './paths/index.js';
 import { resolveUrlPathCandidates } from './url-path-resolver.js';
-import { loadOrCreateBranchContext } from './branch-workspace.js';
+import { loadBranchContext, loadOrCreateBranchContext } from './branch-workspace.js';
 import { buildContentTree as buildContentTreeImpl, } from './content-tree.js';
 import { listEntries as listEntriesImpl, } from './content-listing.js';
 import { createDebugLogger } from './utils/debug.js';
@@ -22,6 +22,30 @@ function isLookupFailure(err) {
 function isPageSwallowable(err) {
     return isLookupFailure(err) || err.code === 'FORBIDDEN';
 }
+/**
+ * A `branch` option is typed `string` but usually handed over from untyped
+ * request input: a repeated `?branch=` arrives as an array, which names no
+ * branch, and `URLSearchParams.get` gives null for an absent one, which is no
+ * `branch` at all.
+ */
+function isBranchOption(branch) {
+    return branch == null || typeof branch === 'string';
+}
+/**
+ * A branch that already has a workspace, or null. A name that cannot name one
+ * is null too (`namesNoWorkspace`): it arrives from the request, so it reads as
+ * not-found rather than failing the page.
+ */
+async function loadExistingBranch(branchName, mode) {
+    try {
+        return await loadBranchContext({ branchName, mode });
+    }
+    catch (err) {
+        if (namesNoWorkspace(err))
+            return null;
+        throw err;
+    }
+}
 /**
  * Create a Canopy context managing auth + content reading. Framework-agnostic:
  * the adapter supplies extractUser.
@@ -46,7 +70,66 @@ export function createCanopyContext(options) {
         // switching branches mid-session updates what getCanopy() serves.
         await services.refreshActiveBranch();
         const user = await getUser();
-        const baseReader = createContentReader({ services });
+        // Read once, so every read and listing in this request agrees on it even if
+        // a concurrent request's refreshActiveBranch() replaces services.config.
+        const activeBranch = services.config.defaultActiveBranch ?? services.config.defaultBaseBranch ?? 'main';
+        // No ACL enforcement at build time, on static deployments, or for the
+        // synthetic admin. For the last this is load-bearing, not an optimization:
+        // that user has unconditional access anyway (path checks bypass entirely for
+        // an Admins-group user — authorization/path.ts), but BUILDING a path checker
+        // costs a getSettingsBranchRoot() call, which in modes with a separate
+        // settings branch provisions that branch's git workspace: an EFS round trip
+        // in prod. `createBuildCanopy` (build-canopy.ts) runs outside a request or
+        // Next.js build phase, so neither other guard fires for it, and without this
+        // one every such script pays for a settings-workspace clone it never needed —
+        // and hard-fails where that workspace cannot be provisioned. Compared by
+        // reference to the STATIC_DEPLOY_USER singleton, not by group membership, so
+        // a real authenticated admin at request time still goes through the real
+        // check.
+        const enforceAcls = !(isDeployedStatic(services.config) ||
+            isBuildMode() ||
+            user === STATIC_DEPLOY_USER);
+        /**
+         * `branch` when it names a branch other than the active one, else undefined:
+         * no `branch`, an empty one, the active one named explicitly, or any name
+         * when reading from the checkout, where it selects nothing.
+         */
+        const otherBranch = (branch) => branch && branch !== activeBranch && !readsFromCheckout(services.config) ? branch : undefined;
+        /**
+         * The workspace for the active branch (undefined) or another named one, or
+         * null when it yields nothing this user may see.
+         *
+         * The active branch is provisioned if missing. Any other name is load-only,
+         * never provisioned — a name with no workspace is null (`loadExistingBranch`) — and its branch
+         * access, held in its own metadata, is checked here, before its schema or
+         * content files are read, so a denied branch is indistinguishable from a
+         * missing one. The active branch's access is left to the caller: a listing
+         * of it lists nothing, and a strict `read` of it throws FORBIDDEN.
+         */
+        const resolveBranch = async (requested) => {
+            if (requested === undefined) {
+                return loadOrCreateBranchContext({
+                    config: services.config,
+                    branchName: activeBranch,
+                    mode: services.config.mode,
+                    createdBy: 'canopycms-context',
+                    remoteUrl: services.config.defaultRemoteUrl,
+                });
+            }
+            const context = await loadExistingBranch(requested, services.config.mode);
+            if (!context)
+                return null;
+            if (enforceAcls && !services.checkBranchAccess(context, user).allowed)
+                return null;
+            return context;
+        };
+        // The reader resolves every branch through resolveBranch; a null reads as
+        // NOT_FOUND. Reads from the checkout bypass the resolver inside the reader.
+        const baseReader = createContentReader({
+            services,
+            defaultBranch: activeBranch,
+            getBranchContext: (branchName) => resolveBranch(otherBranch(branchName)),
+        });
         // Injects the user and validates strings → branded types at this boundary.
         // `extra` carries options that are NOT part of the public `read` surface —
         // today just readByUrlPath's URL-addressability gate. A separate inner
@@ -63,10 +146,13 @@ export function createCanopyContext(options) {
                 }
                 slug = slugResult.slug;
             }
+            if (!isBranchOption(input.branch)) {
+                throw new ContentStoreError(`Branch not found: ${String(input.branch)}`, 'NOT_FOUND');
+            }
             const readInput = {
                 entryPath,
                 slug,
-                branch: input.branch,
+                branch: input.branch ?? undefined,
                 user,
                 resolveReferences: input.resolveReferences ?? true,
                 ...extra,
@@ -119,80 +205,78 @@ export function createCanopyContext(options) {
             }
             return null;
         };
-        /** Resolve branch workspace and schema — shared by buildContentTree and listEntries. Memoized per getContext call. */
-        let schemaContextPromise = null;
-        const resolveSchemaContextImpl = async () => {
-            const operatingMode = services.config.mode;
-            const defaultBranch = services.config.defaultActiveBranch ?? services.config.defaultBaseBranch ?? 'main';
-            const branchContext = await loadOrCreateBranchContext({
-                config: services.config,
-                branchName: defaultBranch,
-                mode: operatingMode,
-                createdBy: 'canopycms-context',
-                remoteUrl: services.config.defaultRemoteUrl,
-            });
-            const { branchRoot } = resolveBranchPaths(branchContext, operatingMode);
-            const contentRootName = services.config.contentRoot || 'content';
-            const { flatSchema } = await services.branchSchemaCache.getSchema(branchRoot, services.entrySchemaRegistry, contentRootName);
-            return { branchContext, branchRoot, flatSchema, contentRootName };
-        };
-        const resolveSchemaContext = () => {
-            if (!schemaContextPromise) {
-                schemaContextPromise = resolveSchemaContextImpl();
-            }
-            return schemaContextPromise;
-        };
         /**
-         * Path-ACL predicate for the batch reads (listEntries / buildContentTree),
-         * memoized per getContext call like the schema context above. Without it an
-         * unfiltered listing on this request-scoped, ACL-enforcing context would
-         * disclose full entry `data` for paths the user cannot `read()` directly.
-         *
-         * `services.createContentAccessChecker` is the shared batch primitive
-         * (api/entries.ts uses it too): it resolves the request-constant work —
-         * branch access, the settings/permissions root, the rule set — once, and
-         * returns a synchronous per-path check, so the per-entry cost is an admin
-         * short-circuit or one minimatch per configured rule, with no extra I/O.
-         *
-         * The empty object (no predicate → unfiltered) at build time, on static
-         * deployments, and for the synthetic admin is load-bearing, not an
-         * optimization. That user has unconditional access anyway (path checks
-         * bypass entirely for an Admins-group user — authorization/path.ts), but
-         * BUILDING the checker costs a getSettingsBranchRoot() call, which in modes
-         * with a separate settings branch provisions that branch's git workspace: an
-         * EFS round trip in prod. `createBuildCanopy` (build-canopy.ts) runs outside
-         * a request or Next.js build phase, so neither other guard fires for it, and
-         * without this one every such script pays for a settings-workspace clone it
-         * never needed — and hard-fails where that workspace cannot be provisioned.
+         * What a batch read (listEntries / buildContentTree) lists from: the branch's
+         * schema plus its path-ACL predicate, or null when the branch yields nothing
+         * this user may see. The branch resolves as for `read` (`resolveBranch`). At
+         * build time and on static deployments `branch` selects nothing, as for
+         * `read` (see the module doc).
          *
-         * Compared by reference to the STATIC_DEPLOY_USER singleton, not by group
-         * membership, so it stays scoped to the synthetic build identity: a real
-         * authenticated admin at request time still goes through the real check.
-         *
-         * Deliberately NOT wrapped in try/catch — createContentAccessChecker is
-         * fail-loud by contract, and swallowing would serve an unfiltered listing.
+         * Memoized per getContext call and per branch name, on the in-flight
+         * promise; a null result is memoized too, so one request answers a given
+         * name consistently. The memo is request-scoped, so it carries no
+         * generation protocol (docs/concurrency.md, "Adding a call-scoped memo").
          */
-        let visibilityPromise = null;
-        const resolveVisibilityImpl = async () => {
-            if (isDeployedStatic(services.config) || isBuildMode() || user === STATIC_DEPLOY_USER)
-                return {};
-            const { branchContext, branchRoot } = await resolveSchemaContext();
-            const checkAccess = await services.createContentAccessChecker(branchContext, branchRoot, user);
-            return { shouldInclude: (physicalPath) => checkAccess(physicalPath, 'read').allowed };
+        const listingSources = new Map();
+        const resolveListingSource = (branch) => {
+            if (!isBranchOption(branch))
+                return Promise.resolve(null);
+            const requested = otherBranch(branch);
+            const key = requested ?? activeBranch;
+            let source = listingSources.get(key);
+            if (!source) {
+                source = resolveListingSourceImpl(requested);
+                listingSources.set(key, source);
+            }
+            return source;
         };
-        const resolveVisibility = () => {
-            if (!visibilityPromise) {
-                visibilityPromise = resolveVisibilityImpl();
+        const resolveListingSourceImpl = async (requested) => {
+            const operatingMode = services.config.mode;
+            const branchContext = await resolveBranch(requested);
+            if (!branchContext)
+                return null;
+            // resolveBranch has already checked any other branch.
+            if (requested === undefined &&
+                enforceAcls &&
+                !services.checkBranchAccess(branchContext, user).allowed) {
+                return null;
             }
-            return visibilityPromise;
+            const { branchRoot } = resolveBranchPaths(branchContext, operatingMode);
+            const contentRootName = services.config.contentRoot || 'content';
+            const { flatSchema } = await services.branchSchemaCache.getSchema(branchRoot, services.entrySchemaRegistry, contentRootName);
+            if (!enforceAcls)
+                return { branchRoot, flatSchema, contentRootName, visibility: {} };
+            // The path-ACL predicate keeps an unfiltered listing on this ACL-enforcing
+            // context from disclosing entry `data` for paths the user cannot `read()`.
+            // `services.createContentAccessChecker` is the shared batch primitive
+            // (api/entries.ts uses it too): it resolves the request-constant work —
+            // branch access, the settings/permissions root, the rule set — once, and
+            // returns a synchronous per-path check, so the per-entry cost is an admin
+            // short-circuit or one minimatch per configured rule, with no extra I/O.
+            //
+            // Deliberately NOT wrapped in try/catch — createContentAccessChecker is
+            // fail-loud by contract, and swallowing would serve an unfiltered listing.
+            const checkAccess = await services.createContentAccessChecker(branchContext, branchRoot, user);
+            return {
+                branchRoot,
+                flatSchema,
+                contentRootName,
+                visibility: { shouldInclude: (logicalPath) => checkAccess(logicalPath, 'read').allowed },
+            };
         };
         const buildContentTree = async (options) => {
-            const { branchRoot, flatSchema, contentRootName } = await resolveSchemaContext();
-            return buildContentTreeImpl(branchRoot, flatSchema, contentRootName, options, await resolveVisibility());
+            const { branch, ...treeOptions } = options ?? {};
+            const source = await resolveListingSource(branch);
+            if (!source)
+                return [];
+            return buildContentTreeImpl(source.branchRoot, source.flatSchema, source.contentRootName, treeOptions, source.visibility);
         };
         const listEntries = async (options) => {
-            const { branchRoot, flatSchema, contentRootName } = await resolveSchemaContext();
-            return listEntriesImpl(branchRoot, flatSchema, contentRootName, options, await resolveVisibility());
+            const { branch, ...listOptions } = options ?? {};
+            const source = await resolveListingSource(branch);
+            if (!source)
+                return [];
+            return listEntriesImpl(source.branchRoot, source.flatSchema, source.contentRootName, listOptions, source.visibility);
         };
         return {
             read,

package/dist/editor/CanopyEditor.d.ts

@@ -1,7 +1,7 @@
 import React from 'react';
 import type { CanopyClientConfig } from '../config/index.js';
 import type { EditorProps } from './Editor.js';
-export interface CanopyEditorProps extends Omit<EditorProps, 'collections' | 'previewBaseByCollection' | 'title' | 'subtitle' | 'themeOptions' | 'entries' | 'contentRoot' | 'operatingMode'> {
+export interface CanopyEditorProps extends Omit<EditorProps, 'collections' | 'previewBaseByCollection' | 'previewPrefix' | 'title' | 'subtitle' | 'themeOptions' | 'entries' | 'contentRoot' | 'operatingMode'> {
     config: CanopyClientConfig;
     entries?: EditorProps['entries'];
 }

package/dist/editor/CanopyEditor.js

@@ -19,6 +19,6 @@ export const CanopyEditor = ({ config, entries = [], initialSelectedId, initialV
     const resolvedTheme = config.editor?.theme ?? undefined;
     // The gate owns the SWRProvider (keyed by user id), so it sits between the API client and the
     // editor: see EditorAuthGate for what a signed-out or lapsed session renders.
-    return (_jsx(ApiClientProvider, { basePath: config.basePath, children: _jsx(EditorAuthGate, { SignInComponent: config.editor?.SignInComponent, themeOptions: resolvedTheme, children: _jsx(Editor, { entries: entries, title: resolvedTitle, subtitle: resolvedSubtitle, branchName: resolvedBranchName, operatingMode: config.mode, initialSelectedId: initialSelectedId, initialValues: initialValues, renderPreview: renderPreview, onCreateEntry: onCreateEntry, customRenderers: customRenderers, collections: collections, contentRoot: config.contentRoot, entryLinkUrl: config.entryLinkUrl, previewBaseByCollection: previewBase, assetBaseUrl: config.assetBaseUrl, basePath: config.basePath, themeOptions: resolvedTheme, AccountComponent: config.editor?.AccountComponent, onAccountClick: config.editor?.onAccountClick, onLogoutClick: config.editor?.onLogoutClick }) }) }));
+    return (_jsx(ApiClientProvider, { basePath: config.basePath, children: _jsx(EditorAuthGate, { SignInComponent: config.editor?.SignInComponent, themeOptions: resolvedTheme, children: _jsx(Editor, { entries: entries, title: resolvedTitle, subtitle: resolvedSubtitle, branchName: resolvedBranchName, operatingMode: config.mode, initialSelectedId: initialSelectedId, initialValues: initialValues, renderPreview: renderPreview, onCreateEntry: onCreateEntry, customRenderers: customRenderers, collections: collections, contentRoot: config.contentRoot, entryLinkUrl: config.entryLinkUrl, previewBaseByCollection: previewBase, previewPrefix: config.editor?.previewPrefix, assetBaseUrl: config.assetBaseUrl, basePath: config.basePath, themeOptions: resolvedTheme, AccountComponent: config.editor?.AccountComponent, onAccountClick: config.editor?.onAccountClick, onLogoutClick: config.editor?.onLogoutClick }) }) }));
 };
 export default CanopyEditor;

package/dist/editor/Editor.d.ts

@@ -58,6 +58,8 @@ export interface EditorProps {
     onCreateEntry?: (collectionPath: LogicalPath) => Promise<void> | void;
     themeOptions?: CanopyThemeOptions;
     previewBaseByCollection?: Record<string, string>;
+    /** `editor.previewPrefix` from config: put in front of every preview iframe `src` (see `buildPreviewSrc`). */
+    previewPrefix?: string;
     currentUser?: string;
     canResolveComments?: boolean;
     /** `media.publicBaseUrl` from config - prefixed onto asset URLs the editor builds (MediaLibrary/ImageField/MDX image dialog). Undefined means root-relative (editor and site share an origin). */

package/dist/editor/Editor.js

@@ -24,6 +24,7 @@ import { EditorFooter, EditorHeader, EditorSidebar } from './components/index.js
 import { RenameEntryModal } from './components/RenameEntryModal.js';
 import { EntryCreateModal } from './components/EntryCreateModal.js';
 import { ConfirmDeleteModal } from './components/ConfirmDeleteModal.js';
+import { NoEditPermissionNotice } from './components/NoEditPermissionNotice.js';
 import { CollectionEditor } from './schema-editor/index.js';
 import { AssetContextProvider, useApiClient } from './context/index.js';
 import { EntryLinkContext } from './fields/entry-link/index.js';
@@ -32,7 +33,7 @@ import { MediaLibrary } from './media/MediaLibrary.js';
  * High-level editor wrapper that wires entry navigation, form rendering,
  * saving/loading, and preview rendering using entry definitions.
  */
-export const Editor = ({ entries, title, subtitle, siteTitle = title, siteSubtitle = subtitle, branchName = '', collections, contentRoot, entryLinkUrl, initialSelectedId, initialValues, renderPreview, onCreateEntry, themeOptions, operatingMode, previewBaseByCollection, currentUser = 'current-user', canResolveComments = true, assetBaseUrl, basePath, AccountComponent, onAccountClick, onLogoutClick, customRenderers, }) => {
+export const Editor = ({ entries, title, subtitle, siteTitle = title, siteSubtitle = subtitle, branchName = '', collections, contentRoot, entryLinkUrl, initialSelectedId, initialValues, renderPreview, onCreateEntry, themeOptions, operatingMode, previewBaseByCollection, previewPrefix, currentUser = 'current-user', canResolveComments = true, assetBaseUrl, basePath, AccountComponent, onAccountClick, onLogoutClick, customRenderers, }) => {
     const [branchesLoading, setBranchesLoading] = useState(false);
     const [entriesLoading, setEntriesLoading] = useState(false);
     const [commentsLoading] = useState(false);
@@ -98,6 +99,7 @@ export const Editor = ({ entries, title, subtitle, siteTitle = title, siteSubtit
         resolvePreviewSrc: (entry) => buildPreviewSrc(entry, {
             branchName: branchNameState,
             previewBaseByCollection,
+            previewPrefix,
             contentRoot,
             basePath,
         }),
@@ -224,9 +226,8 @@ export const Editor = ({ entries, title, subtitle, siteTitle = title, siteSubtit
                 // branch's content. Writing it would (a) show it as the new branch's
                 // content and (b) satisfy the skip gate above, permanently suppressing
                 // the new branch's own load -- which also leaves the new branch's OCC
-                // token unset, turning the next save into a blind overwrite that can
-                // never 409. Drop it instead; the new branch has its own load running
-                // under its own key.
+                // token unset, so saveEntry refuses every save of the entry. Drop it
+                // instead; the new branch has its own load running under its own key.
                 if (currentBranchRef.current !== requestBranch)
                     return;
                 setLoadedValues((prev) => ({ ...prev, [contentId]: loaded }));
@@ -644,7 +645,7 @@ export const Editor = ({ entries, title, subtitle, siteTitle = title, siteSubtit
                                                 ? 'Setting up your branch workspace…'
                                                 : entriesInitializing
                                                     ? 'Loading content…'
-                                                    : 'Select an item to start editing.' })) : currentEntry.canEdit === false ? (_jsx(CenteredMessage, { children: "You don't have permission to edit this content." })) : schema.length > 0 && effectiveValue ? (_jsx(EntryLinkContext.Provider, { value: entryLinkContextValue, children: _jsx(FormRenderer, { fields: schema, value: effectiveValue, onChange: (next) => {
+                                                    : 'Select an item to start editing.' })) : currentEntry.canEdit === false ? (_jsx(NoEditPermissionNotice, { entryPath: currentEntry.path })) : schema.length > 0 && effectiveValue ? (_jsx(EntryLinkContext.Provider, { value: entryLinkContextValue, children: _jsx(FormRenderer, { fields: schema, value: effectiveValue, onChange: (next) => {
                                                     const contentId = currentEntry?.contentId;
                                                     if (contentId) {
                                                         setDrafts((prev) => ({ ...prev, [contentId]: next }));

package/dist/editor/FormRenderer.js

@@ -20,6 +20,18 @@ import { formatCanopyPath, normalizeCanopyPath } from './canopy-path.js';
 import { FieldWrapper } from './comments/FieldWrapper.js';
 import { EntryComments } from './comments/EntryComments.js';
 import { useReferenceResolution } from './hooks/useReferenceResolution.js';
+/**
+ * Card heading for an object-list item: the value of its `itemTitleField` when that is a
+ * non-blank string or a number, otherwise `fallback`.
+ */
+const listItemTitle = (item, itemTitleField, fallback) => {
+    const raw = itemTitleField ? item?.[itemTitleField] : undefined;
+    if (typeof raw === 'number' && Number.isFinite(raw))
+        return String(raw);
+    if (typeof raw === 'string' && raw.trim() !== '')
+        return raw.trim();
+    return fallback;
+};
 const normalizeOptions = (options) => {
     if (!options)
         return [];
@@ -135,11 +147,14 @@ export const FormRenderer = ({ fields, value, onChange, customRenderers, branch
                     const items = Array.isArray(currentValue)
                         ? currentValue
                         : [];
-                    return wrapWithComments(_jsx(Paper, { withBorder: true, radius: "md", p: "md", shadow: "xs", children: _jsxs(Stack, { gap: "sm", children: [_jsxs(Group, { justify: "space-between", children: [_jsx(Text, { size: "sm", fw: 600, children: label }), _jsx(Button, { size: "xs", variant: "light", onClick: () => update([...items, {}]), children: "Add item" })] }), _jsxs(Stack, { gap: "sm", children: [items.map((item, idx) => (_jsx(Paper, { withBorder: true, radius: "md", p: "sm", shadow: "xs", children: _jsxs(Stack, { gap: "xs", children: [_jsxs(Group, { justify: "space-between", children: [_jsxs(Text, { size: "xs", fw: 700, children: [label, " #", idx + 1] }), _jsx(Button, { size: "xs", variant: "subtle", color: "red", onClick: () => update(items.filter((_, i) => i !== idx)), children: "Remove" })] }), _jsx(ObjectField, { label: objectField.label, fields: objectField.fields, value: item, onChange: (next) => {
-                                                            const nextItems = [...items];
-                                                            nextItems[idx] = next;
-                                                            update(nextItems);
-                                                        }, renderField: renderField, path: [...path, idx], dataCanopyField: normalizeCanopyPath([...path, idx]) })] }) }, fieldKey([...path, idx])))), items.length === 0 && (_jsx(Text, { size: "xs", c: "dimmed", children: "No items yet. Add one to get started." }))] })] }) }, fieldKey(path)));
+                    return wrapWithComments(_jsx(Paper, { withBorder: true, radius: "md", p: "md", shadow: "xs", children: _jsxs(Stack, { gap: "sm", children: [_jsxs(Group, { justify: "space-between", children: [_jsx(Text, { size: "sm", fw: 600, children: label }), _jsx(Button, { size: "xs", variant: "light", onClick: () => update([...items, {}]), children: "Add item" })] }), _jsxs(Stack, { gap: "sm", children: [items.map((item, idx) => {
+                                            const itemTitle = listItemTitle(item, objectField.itemTitleField, `${label} #${idx + 1}`);
+                                            return (_jsx(Paper, { role: "group", "aria-label": itemTitle, withBorder: true, radius: "md", p: "sm", shadow: "xs", children: _jsxs(Stack, { gap: "xs", children: [_jsxs(Group, { justify: "space-between", children: [_jsx(Text, { size: "xs", fw: 700, children: itemTitle }), _jsx(Button, { size: "xs", variant: "subtle", color: "red", onClick: () => update(items.filter((_, i) => i !== idx)), children: "Remove" })] }), _jsx(ObjectField, { fields: objectField.fields, value: item, onChange: (next) => {
+                                                                const nextItems = [...items];
+                                                                nextItems[idx] = next;
+                                                                update(nextItems);
+                                                            }, renderField: renderField, path: [...path, idx], dataCanopyField: normalizeCanopyPath([...path, idx]) })] }) }, fieldKey([...path, idx])));
+                                        }), items.length === 0 && (_jsx(Text, { size: "xs", c: "dimmed", children: "No items yet. Add one to get started." }))] })] }) }, fieldKey(path)));
                 }
                 // Unlike the list branch above (each item has its own Remove button), a
                 // non-list object has no other way back to `undefined`: a required child

package/dist/editor/admin/SystemHealthPanel.js

@@ -59,7 +59,9 @@ function purgeGateFor(entry) {
     }
     return {
         disabled: lockFresh,
-        tooltip: lockFresh ? 'Provisioning may be in progress' : undefined,
+        tooltip: lockFresh
+            ? 'Provisioning, or the worker syncing this branch, may be in progress'
+            : undefined,
     };
 }
 function workerLivenessBadge(worker, mode) {
@@ -76,6 +78,33 @@ function workerLivenessBadge(worker, mode) {
             return { color: 'red', label: 'Worker: absent' };
     }
 }
+const BASE_REFRESH_LABELS = {
+    refreshed: 'fast-forwarded',
+    'up-to-date': 'up to date',
+    'skipped-dirty': 'refresh skipped (uncommitted changes)',
+    'skipped-locked': 'refresh skipped (workspace busy: provisioning or an admin action)',
+    'skipped-not-provisioned': 'not yet provisioned',
+    failed: 'refresh failed',
+};
+/**
+ * Why the base branch needs an operator, or null when its last refresh needs
+ * nothing. Shared by the overview and the base row's warning tooltip.
+ */
+function baseRefreshWarning(report) {
+    if (!report)
+        return null;
+    const lines = [];
+    if (report.outcome === 'skipped-dirty' || report.outcome === 'failed') {
+        lines.push(`Base branch ${BASE_REFRESH_LABELS[report.outcome]}${report.message ? `: ${report.message}` : ''}`);
+        if (report.dirtyFiles?.length)
+            lines.push(`Uncommitted: ${report.dirtyFiles.join(', ')}`);
+    }
+    if (report.trackedCanopyMeta?.length) {
+        lines.push(`The site repo tracks canopycms state (${report.trackedCanopyMeta.join(', ')}). ` +
+            'Untrack it with `git rm -r --cached .canopy-meta`, add `.canopy-meta/` to .gitignore, and commit.');
+    }
+    return lines.length > 0 ? lines.join('\n') : null;
+}
 // Mirrors BranchManager.tsx's statusColorMap -- kept local (not exported
 // there) rather than shared, same tiny lookup either way.
 const branchStatusColorMap = {
@@ -121,9 +150,17 @@ function OverviewTab({ health }) {
     const liveness = workerLivenessBadge(status.worker, status.mode);
     const lastFatalError = status.workerStatus?.lastFatalError;
     const lastGitSync = status.workerStatus?.lastGitSync;
-    return (_jsxs(Stack, { gap: "md", children: [error && (_jsx(Alert, { color: "red", icon: _jsx(IconAlertCircle, { size: 16 }), variant: "light", children: error })), _jsxs(Group, { gap: "sm", children: [_jsx(Badge, { color: liveness.color, variant: "light", size: "lg", children: liveness.label }), status.mode === 'dev' && (_jsx(Text, { size: "xs", c: "dimmed", children: "No worker runs in dev mode" }))] }), isRecentFatalError && lastFatalError && (_jsxs(Alert, { color: "red", icon: _jsx(IconAlertCircle, { size: 16 }), title: "Worker crash detected", children: [_jsx(Text, { size: "sm", children: lastFatalError.message }), _jsxs(Text, { size: "xs", c: "dimmed", mt: 4, children: ["at ", lastFatalError.at, " (", lastFatalError.phase, ")"] })] })), status.statusReadError && (_jsxs(Text, { size: "xs", c: "orange", children: ["Warning: could not read worker status (", status.statusReadError, ")"] })), status.workerStatus?.lastGitSyncError && (_jsxs(Alert, { color: "orange", icon: _jsx(IconAlertCircle, { size: 16 }), title: "Last git sync failed", children: [_jsx(Text, { size: "sm", children: status.workerStatus.lastGitSyncError.message }), _jsxs(Text, { size: "xs", c: "dimmed", mt: 4, children: ["at ", status.workerStatus.lastGitSyncError.at] })] })), lastGitSync && (_jsxs(Paper, { withBorder: true, p: "sm", radius: "md", children: [_jsx(Text, { size: "sm", fw: 600, children: "Last git sync" }), _jsxs(Text, { size: "xs", c: "dimmed", children: [status.workerStatus?.lastGitSyncAt ?? 'unknown time', " \u00B7 ", lastGitSync.durationMs, "ms \u00B7", ' ', lastGitSync.rebased.length, " rebased \u00B7 ", lastGitSync.skippedDirty.length, " skipped (dirty)", lastGitSync.skippedLocked && lastGitSync.skippedLocked.length > 0
-                                ? ` · ${lastGitSync.skippedLocked.length} skipped (content write in progress)`
-                                : ''] }), lastGitSync.failed.length > 0 && (_jsx(Spoiler, { maxHeight: 0, showLabel: `${lastGitSync.failed.length} failed — show details`, hideLabel: "Hide", children: _jsx(Stack, { gap: 4, mt: 4, children: lastGitSync.failed.map((f) => (_jsxs(Text, { size: "xs", c: "red", children: [f.branch, ": ", f.error] }, f.branch))) }) }))] })), _jsx(SimpleGrid, { cols: 5, spacing: "xs", children: ['pending', 'processing', 'completed', 'failed', 'corrupt'].map((key) => (_jsxs(Paper, { withBorder: true, p: "xs", radius: "md", ta: "center", children: [_jsx(Text, { size: "xs", c: "dimmed", tt: "capitalize", children: key }), _jsx(Text, { size: "lg", fw: 700, c: (key === 'failed' || key === 'corrupt') && status.queue[key] > 0 ? 'red' : undefined, children: status.queue[key] })] }, key))) }), status.queue.oldestPendingAgeMs !== undefined && (_jsxs(Text, { size: "xs", c: "dimmed", children: ["Oldest pending task: ", formatAgeMs(status.queue.oldestPendingAgeMs), " old"] })), _jsxs(Group, { justify: "space-between", align: "center", children: [_jsxs(Text, { size: "xs", c: "dimmed", children: ["Generated at ", status.generatedAt] }), _jsx(Button, { size: "xs", variant: "light", onClick: () => refresh(), loading: statusLoading, children: "Refresh" })] }), _jsx(Text, { size: "xs", c: "dimmed", children: "Data may lag up to ~60s (shared-filesystem caching)" })] }));
+    const baseWarning = baseRefreshWarning(lastGitSync?.baseRefresh);
+    const { build } = status;
+    // Absent for a worker that predates the field, which is not evidence of skew;
+    // nor is a stale or absent worker's leftover status file, which names no running build.
+    const workerVersion = status.workerStatus?.workerVersion || undefined;
+    const versionSkew = status.worker.state === 'alive' &&
+        workerVersion !== undefined &&
+        workerVersion !== build.canopycmsVersion;
+    return (_jsxs(Stack, { gap: "md", children: [error && (_jsx(Alert, { color: "red", icon: _jsx(IconAlertCircle, { size: 16 }), variant: "light", children: error })), _jsxs(Group, { gap: "sm", children: [_jsx(Badge, { color: liveness.color, variant: "light", size: "lg", children: liveness.label }), status.mode === 'dev' && (_jsx(Text, { size: "xs", c: "dimmed", children: "No worker runs in dev mode" }))] }), isRecentFatalError && lastFatalError && (_jsxs(Alert, { color: "red", icon: _jsx(IconAlertCircle, { size: 16 }), title: "Worker crash detected", children: [_jsx(Text, { size: "sm", children: lastFatalError.message }), _jsxs(Text, { size: "xs", c: "dimmed", mt: 4, children: ["at ", lastFatalError.at, " (", lastFatalError.phase, ")"] })] })), status.settingsWorkspaceError && (_jsx(Alert, { color: "red", icon: _jsx(IconAlertCircle, { size: 16 }), title: "Settings workspace unavailable: groups and path rules are not loading", children: _jsx(Text, { size: "sm", children: status.settingsWorkspaceError }) })), status.statusReadError && (_jsxs(Text, { size: "xs", c: "orange", children: ["Warning: could not read worker status (", status.statusReadError, ")"] })), status.workerStatus?.lastGitSyncError && (_jsxs(Alert, { color: "orange", icon: _jsx(IconAlertCircle, { size: 16 }), title: "Last git sync failed", children: [_jsx(Text, { size: "sm", children: status.workerStatus.lastGitSyncError.message }), _jsxs(Text, { size: "xs", c: "dimmed", mt: 4, children: ["at ", status.workerStatus.lastGitSyncError.at] })] })), versionSkew && (_jsx(Alert, { color: "orange", icon: _jsx(IconAlertCircle, { size: 16 }), title: "API and worker versions differ", "data-testid": "version-skew-warning", children: _jsxs(Text, { size: "sm", children: ["The API runs canopycms ", build.canopycmsVersion, " but the worker runs canopycms", ' ', workerVersion, ". They were deployed from different builds."] }) })), _jsxs(Paper, { withBorder: true, p: "sm", radius: "md", children: [_jsx(Text, { size: "sm", fw: 600, children: "Build" }), _jsxs(Text, { size: "xs", c: "dimmed", "data-testid": "build-api-version", children: ["API: canopycms ", build.canopycmsVersion] }), _jsxs(Text, { size: "xs", c: "dimmed", "data-testid": "build-source-revision", children: ["Source revision:", ' ', build.sourceRevision ? (_jsx(Tooltip, { label: build.sourceRevision, children: _jsx(Code, { children: build.sourceRevision.slice(0, 12) }) })) : ('not set (pass the CANOPY_SOURCE_SHA build arg to the image build)')] }), _jsxs(Text, { size: "xs", c: "dimmed", "data-testid": "build-worker-version", children: ["Worker version: ", workerVersion ? `canopycms ${workerVersion}` : 'unknown'] }), _jsxs(Text, { size: "xs", c: "dimmed", "data-testid": "build-media", children: ["Media storage:", ' ', status.assetStore.configured ? 'configured' : 'not configured — uploads are disabled'] })] }), lastGitSync && (_jsxs(Paper, { withBorder: true, p: "sm", radius: "md", children: [_jsx(Text, { size: "sm", fw: 600, children: "Last git sync" }), _jsxs(Text, { size: "xs", c: "dimmed", children: [status.workerStatus?.lastGitSyncAt ?? 'unknown time', " \u00B7 ", lastGitSync.durationMs, "ms \u00B7", ' ', lastGitSync.rebased.length, " rebased \u00B7 ", lastGitSync.skippedDirty.length, " skipped (dirty)", lastGitSync.skippedLocked && lastGitSync.skippedLocked.length > 0
+                                ? ` · ${lastGitSync.skippedLocked.length} skipped (busy: a content write, provisioning or purge)`
+                                : ''] }), lastGitSync.baseRefresh && (_jsxs(Text, { size: "xs", c: "dimmed", "data-testid": "base-refresh-outcome", children: ["Base branch: ", BASE_REFRESH_LABELS[lastGitSync.baseRefresh.outcome]] })), baseWarning && (_jsx(Text, { size: "xs", c: "orange", style: { whiteSpace: 'pre-line' }, "data-testid": "base-refresh-warning", children: baseWarning })), lastGitSync.failed.length > 0 && (_jsx(Spoiler, { maxHeight: 0, showLabel: `${lastGitSync.failed.length} failed — show details`, hideLabel: "Hide", children: _jsx(Stack, { gap: 4, mt: 4, children: lastGitSync.failed.map((f) => (_jsxs(Text, { size: "xs", c: "red", children: [f.branch, ": ", f.error] }, f.branch))) }) }))] })), _jsx(SimpleGrid, { cols: 5, spacing: "xs", children: ['pending', 'processing', 'completed', 'failed', 'corrupt'].map((key) => (_jsxs(Paper, { withBorder: true, p: "xs", radius: "md", ta: "center", children: [_jsx(Text, { size: "xs", c: "dimmed", tt: "capitalize", children: key }), _jsx(Text, { size: "lg", fw: 700, c: (key === 'failed' || key === 'corrupt') && status.queue[key] > 0 ? 'red' : undefined, children: status.queue[key] })] }, key))) }), status.queue.oldestPendingAgeMs !== undefined && (_jsxs(Text, { size: "xs", c: "dimmed", children: ["Oldest pending task: ", formatAgeMs(status.queue.oldestPendingAgeMs), " old"] })), _jsxs(Group, { justify: "space-between", align: "center", children: [_jsxs(Text, { size: "xs", c: "dimmed", children: ["Generated at ", status.generatedAt] }), _jsx(Button, { size: "xs", variant: "light", onClick: () => refresh(), loading: statusLoading, children: "Refresh" })] }), _jsx(Text, { size: "xs", c: "dimmed", children: "Data may lag up to ~60s (shared-filesystem caching)" })] }));
 }
 function TasksTab({ health }) {
     const { taskStatus, setTaskStatus, tasks, tasksLoading } = health;
@@ -160,6 +197,7 @@ function TasksTab({ health }) {
 function BranchesTab({ health }) {
     const { branchHealth, branchHealthLoading } = health;
     const entries = branchHealth?.entries ?? [];
+    const baseWarning = baseRefreshWarning(health.status?.workerStatus?.lastGitSync?.baseRefresh);
     const handleMarkMergedClick = (branchName) => {
         modals.openConfirmModal({
             title: 'Mark branch as merged',
@@ -193,9 +231,9 @@ function BranchesTab({ health }) {
     if (entries.length === 0) {
         return (_jsx(Text, { size: "sm", c: "dimmed", py: "md", children: "No branch directories found." }));
     }
-    return (_jsx(Table.ScrollContainer, { minWidth: 700, children: _jsxs(Table, { children: [_jsx(Table.Thead, { children: _jsxs(Table.Tr, { children: [_jsx(Table.Th, { children: "Name" }), _jsx(Table.Th, { children: "Status" }), _jsx(Table.Th, { children: "PR" }), _jsx(Table.Th, { children: "Sync" }), _jsx(Table.Th, { children: "Warnings" }), _jsx(Table.Th, { children: "Updated" }), _jsx(Table.Th, { children: "Actions" })] }) }), _jsx(Table.Tbody, { children: entries.map((entry) => (_jsx(BranchHealthRow, { entry: entry, onMarkMerged: handleMarkMergedClick, onRepair: handleRepairClick, onPurge: handlePurgeClick }, entry.dirName))) })] }) }));
+    return (_jsx(Table.ScrollContainer, { minWidth: 700, children: _jsxs(Table, { children: [_jsx(Table.Thead, { children: _jsxs(Table.Tr, { children: [_jsx(Table.Th, { children: "Name" }), _jsx(Table.Th, { children: "Status" }), _jsx(Table.Th, { children: "PR" }), _jsx(Table.Th, { children: "Sync" }), _jsx(Table.Th, { children: "Warnings" }), _jsx(Table.Th, { children: "Updated" }), _jsx(Table.Th, { children: "Actions" })] }) }), _jsx(Table.Tbody, { children: entries.map((entry) => (_jsx(BranchHealthRow, { entry: entry, baseWarning: entry.isBaseBranch ? baseWarning : null, onMarkMerged: handleMarkMergedClick, onRepair: handleRepairClick, onPurge: handlePurgeClick }, entry.dirName))) })] }) }));
 }
-function BranchHealthRow({ entry, onMarkMerged, onRepair, onPurge, }) {
+function BranchHealthRow({ entry, baseWarning, onMarkMerged, onRepair, onPurge, }) {
     if (entry.kind === 'healthy' && entry.branch) {
         const b = entry.branch;
         // Mirrors the rebase loop's skip logic (worker/rebase.ts): the worker
@@ -207,7 +245,7 @@ function BranchHealthRow({ entry, onMarkMerged, onRepair, onPurge, }) {
         const canMarkMerged = (b.status === 'submitted' || b.status === 'approved') && !!b.pullRequestNumber;
         return (_jsxs(Table.Tr, { children: [_jsx(Table.Td, { children: _jsxs(Group, { gap: 4, wrap: "nowrap", children: [_jsx(Text, { size: "sm", children: entry.dirName }), entry.isBaseBranch && (_jsx(Badge, { size: "xs", color: "gray", variant: "outline", children: "base" }))] }) }), _jsx(Table.Td, { children: _jsx(Badge, { color: branchStatusColorMap[b.status] ?? 'neutral', variant: "light", children: b.status }) }), _jsx(Table.Td, { children: b.pullRequestNumber ? (_jsxs(Text, { size: "xs", c: "blue", component: "a", href: b.pullRequestUrl, target: "_blank", rel: "noopener noreferrer", style: { textDecoration: 'underline' }, children: ["PR #", b.pullRequestNumber, b.pullRequestState ? ` (${b.pullRequestState})` : ''] })) : (_jsx(Text, { size: "xs", c: "dimmed", children: "\u2014" })) }), _jsx(Table.Td, { children: b.syncStatus === 'sync-failed' ? (_jsx(Tooltip, { label: b.syncFailureReason
                             ? `${b.syncFailureReason} — retry from the Tasks tab`
-                            : 'GitHub sync failed — retry from the Tasks tab', multiline: true, maw: 320, children: _jsx(Badge, { color: "red", variant: "light", children: "sync-failed" }) })) : b.syncStatus === 'pending-sync' ? (_jsx(Badge, { color: "gray", variant: "light", children: "pending-sync" })) : null }), _jsx(Table.Td, { children: _jsxs(Group, { gap: 6, wrap: "nowrap", children: [!!b.conflictFiles?.length && (_jsxs(Badge, { color: "orange", variant: "light", children: [b.conflictFiles.length, " conflict", b.conflictFiles.length === 1 ? '' : 's'] })), showRebaseFailure && b.rebaseFailure && (_jsx(Tooltip, { label: `${b.rebaseFailure.message} (failing since ${b.rebaseFailure.firstAt})`, multiline: true, maw: 320, children: _jsx(ThemeIcon, { color: "yellow", variant: "light", size: "sm", radius: "xl", "data-testid": `rebase-failure-${entry.dirName}`, children: _jsx(IconAlertTriangle, { size: 12 }) }) })), !!entry.duplicateContentIds?.length && (_jsx(Tooltip, { label: entry.duplicateContentIds
+                            : 'GitHub sync failed — retry from the Tasks tab', multiline: true, maw: 320, children: _jsx(Badge, { color: "red", variant: "light", children: "sync-failed" }) })) : b.syncStatus === 'pending-sync' ? (_jsx(Badge, { color: "gray", variant: "light", children: "pending-sync" })) : null }), _jsx(Table.Td, { children: _jsxs(Group, { gap: 6, wrap: "nowrap", children: [!!b.conflictFiles?.length && (_jsxs(Badge, { color: "orange", variant: "light", children: [b.conflictFiles.length, " conflict", b.conflictFiles.length === 1 ? '' : 's'] })), showRebaseFailure && b.rebaseFailure && (_jsx(Tooltip, { label: `${b.rebaseFailure.message} (failing since ${b.rebaseFailure.firstAt})`, multiline: true, maw: 320, children: _jsx(ThemeIcon, { color: "yellow", variant: "light", size: "sm", radius: "xl", "data-testid": `rebase-failure-${entry.dirName}`, children: _jsx(IconAlertTriangle, { size: 12 }) }) })), baseWarning && (_jsx(Tooltip, { label: baseWarning, multiline: true, maw: 420, style: { whiteSpace: 'pre-line' }, children: _jsx(ThemeIcon, { color: "yellow", variant: "light", size: "sm", radius: "xl", "data-testid": `base-refresh-warning-${entry.dirName}`, children: _jsx(IconAlertTriangle, { size: 12 }) }) })), !!entry.duplicateContentIds?.length && (_jsx(Tooltip, { label: entry.duplicateContentIds
                                     .map((d) => `${d.id}: kept ${d.keptPath}; also on ${d.droppedPaths.join(', ')}`)
                                     .join('\n'), multiline: true, maw: 420, style: { whiteSpace: 'pre-line' }, children: _jsxs(Badge, { color: "orange", variant: "light", "data-testid": `duplicate-content-ids-${entry.dirName}`, children: [entry.duplicateContentIds.length, " duplicate ID", entry.duplicateContentIds.length === 1 ? '' : 's'] }) }))] }) }), _jsx(Table.Td, { children: _jsx(Text, { size: "xs", c: "dimmed", children: b.updatedAt }) }), _jsx(Table.Td, { children: canMarkMerged && (_jsx(Button, { size: "xs", variant: "light", "data-testid": `mark-merged-${b.name}`, onClick: () => onMarkMerged(b.name), children: "Mark merged" })) })] }));
     }

package/dist/editor/components/NoEditPermissionNotice.d.ts

@@ -0,0 +1,10 @@
+export interface NoEditPermissionNoticeProps {
+    /** Logical path of the entry the user cannot edit. */
+    entryPath: string;
+}
+/**
+ * Explains why an entry cannot be edited and whom to ask. An entry's `canEdit` is false only
+ * when a path rule (or `defaultPathAccess`) denies edit, so that is the reason it gives; a
+ * locked or protected branch shows its own banner in the header and a read-only form instead.
+ */
+export declare function NoEditPermissionNotice({ entryPath }: NoEditPermissionNoticeProps): import("react/jsx-runtime").JSX.Element;