canopycms 0.0.68-int.101 → 0.0.68-int.103

package/README.md

@@ -637,7 +637,9 @@ media: { adapter: 's3', bucket: 'my-site-assets', region: 'us-east-1' }
 
   Passing an `image` field value applies its stored crop (`opts.crop` overrides it). Its `width`
   and `height` are the uncropped original's, so scale them by `crop.w` and `crop.h` for a cropped
-  value. SVGs and PDFs are served statically, with no transform.
+  value. SVGs and PDFs are served statically, with no transform. The package declares
+  `sideEffects`, so this import adds under 7 KB minified to a client bundle and none of the
+  config schemas.
 
 - **Where `/assets` is mounted** — the URLs above are root-relative, because that is what gets
   stored in content and content moves between branches and environments. If your renderer sees

package/dist/api/client.d.ts

@@ -32,7 +32,8 @@ export interface ApiClientOptions {
      */
     trailingSlash?: boolean;
     /**
-     * Called whenever a response comes back 401: the credential is no longer accepted. A
+     * Called whenever a response says the credential is no longer accepted: HTTP 401, or a
+     * handler's body with `status: 401` under the HTTP status `unauthenticatedStatus` chose. A
      * notification, not a retry; the editor's auth gate uses it to show sign-in.
      */
     onUnauthorized?: () => void;

package/dist/api/client.js

@@ -341,7 +341,8 @@ export class CanopyApiClient {
             response = await this.fetchFn(url, init);
             parsed = await response.json().catch(() => undefined);
         }
-        if (response.status === 401) {
+        // The body's status is the signal: `unauthenticatedStatus` may send it under HTTP 419.
+        if (response.status === 401 || (isApiResponseBody(parsed) && parsed.status === 401)) {
             this.onUnauthorized?.();
             return { ok: false, status: 401, error: errorFromBody(parsed) ?? 'Unauthorized' };
         }

package/dist/assets/asset-url.d.ts

@@ -41,6 +41,12 @@ export interface AssetUrlOptions {
      */
     baseUrl?: string;
 }
+/**
+ * Whether `src` is in canopycms's own `/assets` URL space - a transform or static asset src the
+ * asset store serves. Every other src (a site's own static file, an off-site URL, a `data:` URI)
+ * is the host's, and the asset store never serves it.
+ */
+export declare function isAssetStoreSrc(src: string): boolean;
 /**
  * Build a transform URL, merging `opts` and `ref.crop` over the directives already present
  * in `ref.src` (see `mergeDirectives` for precedence). For static srcs (svg/pdf under

package/dist/assets/asset-url.js

@@ -9,6 +9,15 @@ import { getPreviewAssetBase } from '../editor/preview-asset-base.js';
 import { ASSET_PREFIXES } from './asset-prefixes.js';
 import { formatDirectives, isAllowedTransformWidth, parseTransformPath, } from './transform-directives.js';
 const TRANSFORM_URL_PREFIX = `/${ASSET_PREFIXES.transform}/`;
+const ASSET_SPACE_PREFIX = `/${ASSET_PREFIXES.public}/`;
+/**
+ * Whether `src` is in canopycms's own `/assets` URL space - a transform or static asset src the
+ * asset store serves. Every other src (a site's own static file, an off-site URL, a `data:` URI)
+ * is the host's, and the asset store never serves it.
+ */
+export function isAssetStoreSrc(src) {
+    return src.startsWith(ASSET_SPACE_PREFIX);
+}
 /**
  * Test-only. A function stored on `globalThis` under this symbol is called with every URL
  * `assetUrl` returns; the dual-build fixture installs one during a static export to prove

package/dist/auth/plugin.d.ts

@@ -14,7 +14,7 @@ export interface AuthPlugin {
      * groups; core applies bootstrap admins.
      *
      * CREDENTIAL failures (missing, invalid or expired token) RESOLVE to
-     * `{ success: false }` and map to a 401. CONFIGURATION errors (an absent
+     * `{ success: false }` and map to `unauthenticatedStatus` (default 401). CONFIGURATION errors (an absent
      * CLERK_SECRET_KEY, say) may THROW instead: they are operator mistakes, and
      * belong in a loud 500 rather than a quiet auth denial. A custom adapter
      * calling this directly must be ready for that rejection.