canopycms 0.0.68-int.101 → 0.0.68-int.102

package/dist/api/client.d.ts

@@ -32,7 +32,8 @@ export interface ApiClientOptions {
      */
     trailingSlash?: boolean;
     /**
-     * Called whenever a response comes back 401: the credential is no longer accepted. A
+     * Called whenever a response says the credential is no longer accepted: HTTP 401, or a
+     * handler's body with `status: 401` under the HTTP status `unauthenticatedStatus` chose. A
      * notification, not a retry; the editor's auth gate uses it to show sign-in.
      */
     onUnauthorized?: () => void;

package/dist/api/client.js

@@ -341,7 +341,8 @@ export class CanopyApiClient {
             response = await this.fetchFn(url, init);
             parsed = await response.json().catch(() => undefined);
         }
-        if (response.status === 401) {
+        // The body's status is the signal: `unauthenticatedStatus` may send it under HTTP 419.
+        if (response.status === 401 || (isApiResponseBody(parsed) && parsed.status === 401)) {
             this.onUnauthorized?.();
             return { ok: false, status: 401, error: errorFromBody(parsed) ?? 'Unauthorized' };
         }

package/dist/auth/plugin.d.ts

@@ -14,7 +14,7 @@ export interface AuthPlugin {
      * groups; core applies bootstrap admins.
      *
      * CREDENTIAL failures (missing, invalid or expired token) RESOLVE to
-     * `{ success: false }` and map to a 401. CONFIGURATION errors (an absent
+     * `{ success: false }` and map to `unauthenticatedStatus` (default 401). CONFIGURATION errors (an absent
      * CLERK_SECRET_KEY, say) may THROW instead: they are operator mistakes, and
      * belong in a loud 500 rather than a quiet auth denial. A custom adapter
      * calling this directly must be ready for that rejection.

package/dist/cli/cli.js

@@ -1488,6 +1488,7 @@ var init_init = __esm({
           contentRoot: contentRootSchema.default("content"),
           sourceRoot: sourceRootSchema.optional(),
           basePath: basePathSchema,
+          unauthenticatedStatus: z5.union([z5.literal(401), z5.literal(419)]).optional(),
           editor: editorConfigSchema.optional(),
           authPlugin: z5.custom().optional(),
           entryLinkUrl: z5.custom().optional(),
@@ -6901,6 +6902,7 @@ var init_generate_ai_content = __esm({
           contentRoot: contentRootSchema2.default("content"),
           sourceRoot: sourceRootSchema2.optional(),
           basePath: basePathSchema2,
+          unauthenticatedStatus: z62.union([z62.literal(401), z62.literal(419)]).optional(),
           editor: editorConfigSchema2.optional(),
           authPlugin: z62.custom().optional(),
           entryLinkUrl: z62.custom().optional(),
@@ -8713,6 +8715,8 @@ var init_generate_ai_content = __esm({
             absolutePath: resolved,
             relativePath: path11.relative(this.root, resolved),
             logicalPath: entryLogicalPath(schemaItem.logicalPath, safeSlug),
+            collectionPath: schemaItem.logicalPath,
+            slug: safeSlug,
             id,
             entryTypeName: finalEntryTypeName,
             existed
@@ -13318,6 +13322,7 @@ var init_config4 = __esm({
       contentRoot: contentRootSchema3.default("content"),
       sourceRoot: sourceRootSchema3.optional(),
       basePath: basePathSchema3,
+      unauthenticatedStatus: z14.union([z14.literal(401), z14.literal(419)]).optional(),
       editor: editorConfigSchema3.optional(),
       authPlugin: z14.custom().optional(),
       entryLinkUrl: z14.custom().optional(),

package/dist/cli/generate-ai-content.js

@@ -529,6 +529,7 @@ var init_config = __esm({
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
       basePath: basePathSchema,
+      unauthenticatedStatus: z6.union([z6.literal(401), z6.literal(419)]).optional(),
       editor: editorConfigSchema.optional(),
       authPlugin: z6.custom().optional(),
       entryLinkUrl: z6.custom().optional(),
@@ -3761,6 +3762,8 @@ var ContentStore = class {
         absolutePath: resolved,
         relativePath: path11.relative(this.root, resolved),
         logicalPath: entryLogicalPath(schemaItem.logicalPath, safeSlug),
+        collectionPath: schemaItem.logicalPath,
+        slug: safeSlug,
         id,
         entryTypeName: finalEntryTypeName,
         existed

package/dist/cli/init.js

@@ -379,6 +379,7 @@ var init_config = __esm({
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
       basePath: basePathSchema,
+      unauthenticatedStatus: z5.union([z5.literal(401), z5.literal(419)]).optional(),
       editor: editorConfigSchema.optional(),
       authPlugin: z5.custom().optional(),
       entryLinkUrl: z5.custom().optional(),

package/dist/config/schemas/config.d.ts

@@ -71,6 +71,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     contentRoot: z.ZodDefault<z.ZodDefault<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>>;
     sourceRoot: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     basePath: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
+    unauthenticatedStatus: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<401>, z.ZodLiteral<419>]>>;
     editor: z.ZodOptional<z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
         subtitle: z.ZodOptional<z.ZodString>;
@@ -151,6 +152,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     deploymentName?: string | undefined;
     sourceRoot?: string | undefined;
     basePath?: string | undefined;
+    unauthenticatedStatus?: 401 | 419 | undefined;
     editor?: {
         title?: string | undefined;
         subtitle?: string | undefined;
@@ -204,6 +206,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     contentRoot?: string | undefined;
     sourceRoot?: string | undefined;
     basePath?: string | undefined;
+    unauthenticatedStatus?: 401 | 419 | undefined;
     editor?: {
         title?: string | undefined;
         subtitle?: string | undefined;

package/dist/config/schemas/config.js

@@ -103,6 +103,7 @@ export const CanopyConfigSchema = z
     contentRoot: contentRootSchema.default('content'),
     sourceRoot: sourceRootSchema.optional(),
     basePath: basePathSchema,
+    unauthenticatedStatus: z.union([z.literal(401), z.literal(419)]).optional(),
     editor: editorConfigSchema.optional(),
     authPlugin: z.custom().optional(),
     entryLinkUrl: z.custom().optional(),

package/dist/config/types.d.ts

@@ -374,6 +374,8 @@ export interface CanopyConfig {
     sourceRoot?: SourceRoot;
     /** Deployment prefix the host app is served under — see {@link CanopyConfigInput.basePath}. */
     basePath?: string;
+    /** HTTP status of an unauthenticated API response — see {@link CanopyConfigInput.unauthenticatedStatus}. */
+    unauthenticatedStatus?: 401 | 419;
     editor?: CanopyEditorConfig;
     authPlugin?: AuthPlugin;
     /** Custom URL resolver for entry links — see {@link CanopyConfigInput.entryLinkUrl}. */
@@ -439,6 +441,19 @@ export interface CanopyConfigInput {
      * silently filter out every entry (zero static params, a build that goes green with no pages).
      */
     basePath?: string;
+    /**
+     * HTTP status of an API response to a request with no accepted session. Default 401.
+     *
+     * Set 419 when the site's own pages sit behind HTTP Basic auth on the same origin as the
+     * editor. Chrome, holding a Basic credential entered at the site root, sends it with the
+     * editor's API requests and drops it when one answers 401; the next gated request, such as a
+     * preview image, then waits on a Basic prompt. 419 rather than 403
+     * because a CloudFront custom error response cannot match 419, and one mapping 403 to an error
+     * page would replace the body below.
+     *
+     * The body says `status: 401` either way, and that is what the editor detects sign-out from.
+     */
+    unauthenticatedStatus?: 401 | 419;
     editor?: CanopyEditorConfig;
     authPlugin?: AuthPlugin;
     /** Custom URL resolver for entry links. Overrides the default URL computation. */

package/dist/content-reader.d.ts

@@ -84,10 +84,19 @@ export interface ContentReadMeta {
      * `{type}.{slug}.{id}.{ext}`) -- see the `entryType` caveat above for what that implies.
      */
     entryId?: ContentId;
+    /** The entry's slug within its collection, by the rule `listEntries` uses. */
+    slug: Slug;
+    /** The entry's URL path with no query, by the rule `listEntries` uses. */
+    urlPath: string;
 }
 export interface ContentReader {
     read: <T = unknown>(input: ReadContentInput, message?: string) => Promise<{
         data: T;
+        /**
+         * The requested `entryPath` and slug as a percent-encoded URL path, plus `?branch=<name>`.
+         * Through an entry-type `entryPath` it is not the entry's URL. Compare entries by
+         * `meta.urlPath`.
+         */
         path: string;
         meta: ContentReadMeta;
     }>;

package/dist/content-reader.js

@@ -2,7 +2,7 @@ import { loadBranchContext, loadOrCreateBranchContext } from './branch-workspace
 import { ContentStore, ContentStoreError } from './content-store.js';
 import { namesNoWorkspace, resolveBranchPaths, } from './paths/index.js';
 import { trimSlashes } from './paths/normalize.js';
-import { isIndexSlug } from './utils/entry-url.js';
+import { computeEntryUrl, isIndexSlug } from './utils/entry-url.js';
 import { isDeployedStatic, isBuildMode, readsFromCheckout } from './build-mode.js';
 import { isNotFoundError } from './utils/error.js';
 import { resolveEntryLinksInData } from './entry-link-resolver.js';
@@ -141,6 +141,8 @@ export const createContentReader = (options) => {
         // key by them without a separate listEntries lookup or filename parse.
         let entryType;
         let entryId;
+        let urlPath;
+        let resolvedSlug;
         try {
             const resolved = await store.resolveDocumentPath(entryPath, slug ?? '');
             logicalPath = resolved.logicalPath;
@@ -150,6 +152,8 @@ export const createContentReader = (options) => {
             // absent, for legacy entry files without an embedded ID (see ContentReadMeta).
             entryType = resolved.entryTypeName;
             entryId = resolved.id;
+            resolvedSlug = resolved.slug;
+            urlPath = computeEntryUrl(resolved.collectionPath, resolved.slug, contentRoot);
         }
         catch (err) {
             const message = err instanceof ContentStoreError ? err.message : 'Invalid content request';
@@ -196,7 +200,7 @@ export const createContentReader = (options) => {
                 resolveReferences: input.resolveReferences ?? true,
                 referenceAccess,
             });
-            return { doc, store, physicalPath, entryType, entryId };
+            return { doc, store, physicalPath, entryType, entryId, slug: resolvedSlug, urlPath };
         }
         catch (err) {
             if (isNotFoundError(err))
@@ -211,7 +215,7 @@ export const createContentReader = (options) => {
             const defaultMessage = `Content not found for ${entryPath}${slug ? `/${slug}` : ''} on branch ${branchName}`;
             throw new ContentStoreError(message ?? defaultMessage, 'NOT_FOUND');
         }
-        const { doc, store, physicalPath, entryType, entryId } = result;
+        const { doc, store, physicalPath, entryType, entryId, slug: entrySlug, urlPath } = result;
         // For md/mdx format, merge the body into the data so callers get a complete object.
         // The field name comes from the schema's isBody flag (defaults to 'body').
         const docRecord = doc;
@@ -228,7 +232,7 @@ export const createContentReader = (options) => {
             slug,
             branch: branchName,
         });
-        return { data, path, meta: { physicalPath, entryType, entryId } };
+        return { data, path, meta: { physicalPath, entryType, entryId, slug: entrySlug, urlPath } };
     };
     return { read };
 };

package/dist/content-store.d.ts

@@ -365,6 +365,10 @@ export declare class ContentStore {
         relativePath: PhysicalPath;
         /** The entry's logical path, the form path-permission rules match (`entryLogicalPath`). */
         logicalPath: LogicalPath;
+        /** The collection the entry file lives in: the parent, when an entry-type item delegated. */
+        collectionPath: LogicalPath;
+        /** The entry's slug within that collection, lowercased as listings report it. */
+        slug: Slug;
         id?: string;
         /**
          * Always populated for a valid schema item: the collection branch below resolves a name

package/dist/content-store.js

@@ -604,6 +604,8 @@ export class ContentStore {
                 absolutePath: resolved,
                 relativePath: path.relative(this.root, resolved),
                 logicalPath: entryLogicalPath(schemaItem.logicalPath, safeSlug),
+                collectionPath: schemaItem.logicalPath,
+                slug: safeSlug,
                 id,
                 entryTypeName: finalEntryTypeName,
                 existed,

package/dist/editor/context/ApiClientContext.d.ts

@@ -24,7 +24,8 @@ export interface ApiClientProviderProps {
  */
 export declare function ApiClientProvider({ children, client, basePath }: ApiClientProviderProps): import("react/jsx-runtime").JSX.Element;
 /**
- * Subscribe to every 401 the provider's client receives, from any request. `listener` should be
+ * Subscribe to every unauthenticated response (`ApiClientOptions.onUnauthorized`) the provider's
+ * client receives, from any request. `listener` should be
  * stable (e.g. from `useCallback`): a new function re-subscribes. No-op outside a provider.
  */
 export declare function useOnUnauthorized(listener: () => void): void;

package/dist/editor/context/ApiClientContext.js

@@ -48,7 +48,8 @@ export function ApiClientProvider({ children, client, basePath }) {
     return (_jsx(UnauthorizedSignalContext.Provider, { value: unauthorized, children: _jsx(ApiClientContext.Provider, { value: apiClient, children: children }) }));
 }
 /**
- * Subscribe to every 401 the provider's client receives, from any request. `listener` should be
+ * Subscribe to every unauthenticated response (`ApiClientOptions.onUnauthorized`) the provider's
+ * client receives, from any request. `listener` should be
  * stable (e.g. from `useCallback`): a new function re-subscribes. No-op outside a provider.
  */
 export function useOnUnauthorized(listener) {

package/dist/editor/fields/MarkdownField.js

@@ -4,15 +4,19 @@ import React, { Suspense, useId, useRef, useCallback, useEffect, useState } from
 import { Alert, Button, Group, Text, Textarea } from '@mantine/core';
 import { InsertEntryLink } from './entry-link/index.js';
 import { MdxImageDialog } from './MdxImageDialog.js';
+import { createMdxJsxPlugins } from './mdx-jsx-support.js';
 import { useApiClient, useAssetContext } from '../context/index.js';
 import { editorImageSrc } from '../media/editor-image-src.js';
 import { uploadAsset } from '../media/upload-asset.js';
 import { FieldDescription, groupDescriptionProps } from './FieldDescription.js';
 const MDXEditorLazy = React.lazy(async () => {
-    const [{ MDXEditor, headingsPlugin, listsPlugin, quotePlugin, thematicBreakPlugin, markdownShortcutPlugin, linkPlugin, linkDialogPlugin, imagePlugin, tablePlugin, toolbarPlugin, codeBlockPlugin, codeMirrorPlugin, BoldItalicUnderlineToggles, BlockTypeSelect, ListsToggle, CreateLink, InsertImage, InsertTable, InsertThematicBreak, CodeToggle, InsertCodeBlock, UndoRedo, Separator, insertMarkdown$, usePublisher, useCellValues, saveImage$, closeImageDialog$, imageDialogState$, activeEditor$, $isImageNode, 
+    // MDXEditor's only code import (theme.tsx loads its CSS); see mdx-jsx-support for why.
+    const mdx = await import('@mdxeditor/editor');
+    const { MDXEditor, headingsPlugin, listsPlugin, quotePlugin, thematicBreakPlugin, markdownShortcutPlugin, linkPlugin, linkDialogPlugin, imagePlugin, tablePlugin, toolbarPlugin, codeBlockPlugin, codeMirrorPlugin, BoldItalicUnderlineToggles, BlockTypeSelect, ListsToggle, CreateLink, InsertImage, InsertTable, InsertThematicBreak, CodeToggle, InsertCodeBlock, UndoRedo, Separator, insertMarkdown$, usePublisher, useCellValues, saveImage$, closeImageDialog$, imageDialogState$, activeEditor$, $isImageNode, 
     // MDXEditor's own lexical instance: lexical keeps the active editor state per module, so
     // a separately resolved copy would throw inside this editor's `read()`.
-    lexical: { $getNodeByKey }, }, { mdxJsxPlugins },] = await Promise.all([import('@mdxeditor/editor'), import('./mdx-jsx-support.js')]);
+    lexical: { $getNodeByKey }, } = mdx;
+    const mdxJsxPlugins = createMdxJsxPlugins(mdx);
     const EntryLinkToolbarButton = ({ onInsert }) => {
         const insertMarkdown = usePublisher(insertMarkdown$);
         return (_jsx(InsertEntryLink, { onInsert: (markdown) => onInsert(() => insertMarkdown(markdown), markdown) }));

package/dist/editor/fields/mdx-jsx-support.d.ts

@@ -1 +1,5 @@
-export declare function mdxJsxPlugins(): import("@mdxeditor/editor").RealmPlugin[];
+import type * as MdxEditor from '@mdxeditor/editor';
+type MdxEditorModule = typeof MdxEditor;
+/** Creates the JSX plugins from MDXEditor's exports; call once per load of MDXEditor. */
+export declare function createMdxJsxPlugins(mdx: MdxEditorModule): () => MdxEditor.RealmPlugin[];
+export {};

package/dist/editor/fields/mdx-jsx-support.js

@@ -1,6 +1,5 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { NestedLexicalEditor, UnrecognizedMarkdownConstructError, addImportVisitor$, importVisitors$, isMdastHTMLNode, isMdastJsxNode, jsxPlugin, realmPlugin, } from '@mdxeditor/editor';
 function childrenOf(node) {
     return 'children' in node && Array.isArray(node.children) ? node.children : [];
 }
@@ -13,26 +12,6 @@ function describeAttribute(attribute) {
         return `${attribute.name}="${attribute.value}"`;
     return `${attribute.name}={…}`;
 }
-/**
- * Shows an element's tag and attributes read-only (they are edited as source)
- * and edits its children, inline or block per the parsed node: one `*`
- * descriptor serves both, and a block editor rejects inline children.
- */
-const CatchAllJsxEditor = ({ mdastNode }) => {
-    const inline = mdastNode.type === 'mdxJsxTextElement';
-    const tag = [mdastNode.name ?? '', ...mdastNode.attributes.map(describeAttribute)]
-        .join(' ')
-        .trim();
-    const Wrapper = inline ? 'span' : 'div';
-    return (_jsxs(Wrapper, { className: inline ? 'canopy-mdx-jsx canopy-mdx-jsx-inline' : 'canopy-mdx-jsx', children: [_jsx("span", { className: "canopy-mdx-jsx-tag", "data-testid": "mdx-jsx-tag", title: tag, children: `<${tag}>` }), mdastNode.children.length > 0 ? (_jsx(NestedLexicalEditor, { block: !inline, getContent: (node) => node.children, getUpdatedMdastNode: (node, children) => ({ ...node, children }) })) : null] }));
-};
-const catchAllJsxDescriptor = {
-    name: '*',
-    kind: 'flow',
-    props: [],
-    hasChildren: true,
-    Editor: CatchAllJsxEditor,
-};
 const isStringAttribute = (attribute, name) => attribute.type === 'mdxJsxAttribute' &&
     attribute.name === name &&
     typeof attribute.value === 'string';
@@ -70,68 +49,93 @@ function roundTripsImage(node) {
 }
 // Why MDXEditor cannot round-trip this JSX element, or null if it can. A
 // fragment has no name, which MDXEditor's HTML handling throws on.
-function unsupportedJsx(node) {
-    if (!isMdastJsxNode(node))
+function unsupportedJsx(mdx, node) {
+    if (!mdx.isMdastJsxNode(node))
         return null;
     if (node.name === null)
         return 'fragments (<>…</>)';
     // `img` is the image plugin's, not in MDXEditor's HTML tag list.
     if (node.name === 'img')
         return roundTripsImage(node) ? null : 'this <img>';
-    if (isMdastHTMLNode(node) && breaksSpanCollapse(node)) {
+    if (mdx.isMdastHTMLNode(node) && breaksSpanCollapse(node)) {
         return `<${node.name}> wrapping a <span>, with an {expression} class or style`;
     }
     return null;
 }
 /** Typed `string` because the mdast node union this package resolves omits the ESM node. */
 const ESM_NODE_TYPE = 'mdxjsEsm';
-/** Node types the table visitor imports itself, so they have no visitor of their own. */
+/** Node types inside a table, imported by its cell editors rather than by visitors. */
 const CONSUMED_BY_PARENT_VISITOR = new Set(['tableRow', 'tableCell']);
-/**
- * Reports through `onError`, at import, what MDXEditor would otherwise lose
- * silently: `import`/`export` lines (its visitor for them is a no-op), elements
- * `unsupportedJsx` rejects, and content with no visitor inside a JSX element or
- * table, whose children nested editors import later, only logging a failure and
- * writing partial children back on edit. It throws an error class MDXEditor's
- * import reports; any other error would crash the editor.
- */
-const roundTripGuardPlugin = realmPlugin({
-    init(realm) {
-        const guard = {
-            priority: 100,
-            testNode: (node) => node.type === ESM_NODE_TYPE || node.type === 'table' || isMdastJsxNode(node),
-            visitNode({ mdastNode, descriptors, actions }) {
-                if (mdastNode.type === ESM_NODE_TYPE) {
-                    throw new UnrecognizedMarkdownConstructError('import/export statements cannot be edited in the rich-text editor');
-                }
-                const reject = (node) => {
-                    const reason = unsupportedJsx(node);
-                    if (reason !== null) {
-                        throw new UnrecognizedMarkdownConstructError(`${reason} cannot be edited in the rich-text editor`);
+/** Creates the JSX plugins from MDXEditor's exports; call once per load of MDXEditor. */
+export function createMdxJsxPlugins(mdx) {
+    const { NestedLexicalEditor, UnrecognizedMarkdownConstructError, addImportVisitor$, importVisitors$, isMdastJsxNode, jsxPlugin, realmPlugin, } = mdx;
+    /**
+     * Shows an element's tag and attributes read-only (they are edited as source)
+     * and edits its children, inline or block per the parsed node: one `*`
+     * descriptor serves both, and a block editor rejects inline children.
+     */
+    const CatchAllJsxEditor = ({ mdastNode }) => {
+        const inline = mdastNode.type === 'mdxJsxTextElement';
+        const tag = [mdastNode.name ?? '', ...mdastNode.attributes.map(describeAttribute)]
+            .join(' ')
+            .trim();
+        const Wrapper = inline ? 'span' : 'div';
+        return (_jsxs(Wrapper, { className: inline ? 'canopy-mdx-jsx canopy-mdx-jsx-inline' : 'canopy-mdx-jsx', children: [_jsx("span", { className: "canopy-mdx-jsx-tag", "data-testid": "mdx-jsx-tag", title: tag, children: `<${tag}>` }), mdastNode.children.length > 0 ? (_jsx(NestedLexicalEditor, { block: !inline, getContent: (node) => node.children, getUpdatedMdastNode: (node, children) => ({ ...node, children }) })) : null] }));
+    };
+    const catchAllJsxDescriptor = {
+        name: '*',
+        kind: 'flow',
+        props: [],
+        hasChildren: true,
+        Editor: CatchAllJsxEditor,
+    };
+    /**
+     * Reports through `onError`, at import, what MDXEditor would otherwise lose or
+     * break on without reporting it: `import`/`export` lines (its visitor for them
+     * is a no-op), elements `unsupportedJsx` rejects, and content with no visitor
+     * inside a JSX element or table, whose children nested editors import later,
+     * only logging a failure and writing partial children back on edit. It throws
+     * an error class MDXEditor's import reports; any other error crashes the editor.
+     */
+    const roundTripGuardPlugin = realmPlugin({
+        init(realm) {
+            const guard = {
+                priority: 100,
+                testNode: (node) => node.type === ESM_NODE_TYPE || node.type === 'table' || isMdastJsxNode(node),
+                visitNode({ mdastNode, descriptors, actions }) {
+                    if (mdastNode.type === ESM_NODE_TYPE) {
+                        throw new UnrecognizedMarkdownConstructError('import/export statements cannot be edited in the rich-text editor');
                     }
-                };
-                reject(mdastNode);
-                const visitors = realm.getValue(importVisitors$).filter((visitor) => visitor !== guard);
-                const hasVisitor = (node) => visitors.some((visitor) => typeof visitor.testNode === 'string'
-                    ? visitor.testNode === node.type
-                    : visitor.testNode(node, descriptors));
-                const check = (node) => {
-                    for (const child of childrenOf(node)) {
-                        reject(child);
-                        if (!CONSUMED_BY_PARENT_VISITOR.has(child.type) && !hasVisitor(child)) {
-                            const where = isMdastJsxNode(mdastNode) ? `<${mdastNode.name ?? ''}>` : 'A table';
-                            throw new UnrecognizedMarkdownConstructError(`${where} contains ${child.type} content the rich-text editor cannot edit`);
+                    const reject = (node) => {
+                        const reason = unsupportedJsx(mdx, node);
+                        if (reason !== null) {
+                            throw new UnrecognizedMarkdownConstructError(`${reason} cannot be edited in the rich-text editor`);
                         }
-                        check(child);
-                    }
-                };
-                check(mdastNode);
-                actions.nextVisitor();
-            },
-        };
-        realm.pub(addImportVisitor$, guard);
-    },
-});
-export function mdxJsxPlugins() {
-    return [jsxPlugin({ jsxComponentDescriptors: [catchAllJsxDescriptor] }), roundTripGuardPlugin()];
+                    };
+                    reject(mdastNode);
+                    const visitors = realm.getValue(importVisitors$).filter((visitor) => visitor !== guard);
+                    const hasVisitor = (node) => visitors.some((visitor) => typeof visitor.testNode === 'string'
+                        ? visitor.testNode === node.type
+                        : visitor.testNode(node, descriptors));
+                    const check = (node) => {
+                        for (const child of childrenOf(node)) {
+                            reject(child);
+                            if (!CONSUMED_BY_PARENT_VISITOR.has(child.type) && !hasVisitor(child)) {
+                                const where = isMdastJsxNode(mdastNode) ? `<${mdastNode.name ?? ''}>` : 'A table';
+                                throw new UnrecognizedMarkdownConstructError(`${where} contains ${child.type} content the rich-text editor cannot edit`);
+                            }
+                            check(child);
+                        }
+                    };
+                    check(mdastNode);
+                    actions.nextVisitor();
+                },
+            };
+            realm.pub(addImportVisitor$, guard);
+        },
+    });
+    return () => [
+        jsxPlugin({ jsxComponentDescriptors: [catchAllJsxDescriptor] }),
+        roundTripGuardPlugin(),
+    ];
 }

package/dist/http/handler.js

@@ -86,6 +86,11 @@ const parseQueryParams = (url) => {
         return {};
     }
 };
+/**
+ * The answer to a request with no accepted session. The body's `status: 401` is what the client
+ * detects sign-out from, so it stays 401 whatever HTTP status `unauthenticatedStatus` picks.
+ */
+const unauthenticatedResponse = (config, error) => jsonResponse({ ok: false, status: 401, error: error ?? 'Unauthorized' }, config.unauthenticatedStatus ?? 401);
 /**
  * The core handler behind every Canopy API request. A framework adapter
  * (Next.js, Express, Hono) converts its request to a CanopyRequest, extracts
@@ -129,7 +134,7 @@ export function createCanopyRequestHandler(options) {
         // any workspace provisioning below, so they can neither trigger expensive
         // git operations nor read provisioning error details.
         if (!authResult.success || !authResult.user) {
-            return jsonResponse({ ok: false, status: 401, error: authResult.error ?? 'Unauthorized' }, 401);
+            return unauthenticatedResponse(apiCtx.services.config, authResult.error);
         }
         // Provision the base/active branch workspace on first request, so the many
         // endpoints that assume it exists (registry reads and the like) don't return
@@ -222,7 +227,7 @@ export function createCanopyRequestHandler(options) {
             }
         }
         if (user.type === 'anonymous') {
-            return jsonResponse({ ok: false, status: 401, error: authResult.error ?? 'Unauthorized' }, 401);
+            return unauthenticatedResponse(apiCtx.services.config, authResult.error);
         }
         const queryParams = parseQueryParams(req.url);
         const mergedParams = { ...queryParams, ...match.params };

package/dist/url-exclusivity-fixtures.d.ts

@@ -54,6 +54,13 @@ export interface UrlExclusivityReport {
         expectedEntryId?: string;
         actualEntryId?: string;
     }>;
+    /** Published URLs whose read reports a `meta.slug` or `meta.urlPath` other than the listing's. */
+    misreported: Array<{
+        urlPath: string;
+        slug: string;
+        readSlug: string;
+        readUrlPath: string;
+    }>;
     /** Every adjacent URL probed, sorted. */
     probes: string[];
     /** Probes that resolved despite not being published -- the phantom URLs. Must be empty. */

package/dist/url-exclusivity-fixtures.js

@@ -80,12 +80,21 @@ export const collectUrlExclusivityReport = async (ctx, schema, contentRoot = 'co
     const items = await ctx.listEntries();
     const unresolved = [];
     const mismatched = [];
+    const misreported = [];
     for (const item of items) {
         const result = await ctx.readByUrlPath(item.urlPath);
         if (!result) {
             unresolved.push(item.urlPath);
             continue;
         }
+        if (result.meta.slug !== item.slug || result.meta.urlPath !== item.urlPath) {
+            misreported.push({
+                urlPath: item.urlPath,
+                slug: item.slug,
+                readSlug: result.meta.slug,
+                readUrlPath: result.meta.urlPath,
+            });
+        }
         if (result.meta.entryId !== item.entryId) {
             mismatched.push({
                 urlPath: item.urlPath,
@@ -108,6 +117,7 @@ export const collectUrlExclusivityReport = async (ctx, schema, contentRoot = 'co
         duplicates: findDuplicateUrlPaths(items),
         unresolved: unresolved.sort(),
         mismatched,
+        misreported,
         probes: [...probes].sort(),
         phantoms: phantoms.sort(),
     };

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CANOPYCMS_VERSION = "0.0.68-int.101";
+export declare const CANOPYCMS_VERSION = "0.0.68-int.102";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated by scripts/bump-version.mjs, its only writer. The package builds with plain
 // tsc (rootDir: src), so src/ cannot import ../package.json; version.test.ts keeps the two equal.
-export const CANOPYCMS_VERSION = '0.0.68-int.101';
+export const CANOPYCMS_VERSION = '0.0.68-int.102';

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "@codemirror/language, @lezer/highlight: workaround — @mdxeditor/editor uses cm6-theme-basic-light which peer-requires these but mdxeditor doesn't declare them as dependencies",
   "name": "canopycms",
-  "version": "0.0.68-int.101",
+  "version": "0.0.68-int.102",
   "description": "CanopyCMS core package: schema-driven content, branch-aware editing, and editor UI for Next.js.",
   "license": "MIT",
   "repository": {