canopycms 0.0.68-int.107 → 0.0.68-int.108

package/dist/api/branch-status.js

@@ -11,6 +11,7 @@ import { getErrorMessage, redactCredentials, sanitizeErrorMessage } from '../uti
 import { isNonFastForwardRejection } from '../utils/git.js';
 import { ContentWriteLockBusyError } from '../utils/content-write-lock.js';
 import { submissionEditorFromUser } from '../submission-attribution.js';
+import { NothingToSubmitError } from '../services.js';
 const getBranchStatusHandler = async (gc, _ctx, _req, _params) => {
     const { branchContext } = gc;
     return { ok: true, status: 200, data: { branch: branchContext.branch } };
@@ -59,6 +60,9 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
         ({ changedPaths } = await ctx.services.submitBranch({ context: branchContext, submitter }));
     }
     catch (err) {
+        if (err instanceof NothingToSubmitError) {
+            return { ok: false, status: 400, error: err.message };
+        }
         // Retriable either way: a resubmit commits nothing new and pushes only
         // what has not reached the remote.
         if (err instanceof ContentWriteLockBusyError) {
@@ -107,13 +111,33 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
         };
     }
     // Create or update PR (sync via githubService, or async via task queue)
-    const prResult = await syncSubmitPr(ctx, branchContext, { submitter, changedPaths });
-    // Update metadata with status and PR info
+    const submittedAt = new Date().toISOString();
+    const prResult = await syncSubmitPr(ctx, branchContext, {
+        submitter,
+        changedPaths,
+        submittedAt,
+    });
     const meta = getBranchMetadataFileManager(branchContext.branchRoot, branchContext.baseRoot);
+    const pushed = prResult.pushedToGitHub ? { pushedToGitHubAt: submittedAt } : {};
+    // GitHub found nothing between the pushed branch and its base, though the diff above found
+    // changes: GitHub's base can already hold them, or the diff could not be computed. The branch
+    // stays editable; the stamp records that it is now on GitHub, for delete.
+    if (prResult.nothingToSubmit) {
+        await meta.save({ branch: { name: branchContext.branch.name, ...pushed } });
+        const base = branchContext.branch.baseBranch ?? ctx.services.config.defaultBaseBranch ?? 'main';
+        return {
+            ok: false,
+            status: 400,
+            error: new NothingToSubmitError(branchContext.branch.name, base).message,
+        };
+    }
     const updated = await meta.save({
         branch: {
             name: branchContext.branch.name,
             status: 'submitted',
+            submittedAt,
+            ...pushed,
+            syncFailureReason: prResult.syncFailureReason,
             pullRequestUrl: prResult.prUrl ?? branchContext.branch.pullRequestUrl,
             pullRequestNumber: prResult.prNumber ?? branchContext.branch.pullRequestNumber,
             ...(prResult.syncStatus !== undefined ? { syncStatus: prResult.syncStatus } : {}),

package/dist/api/content.js

@@ -5,11 +5,13 @@ import { SchemaUnavailableError } from '../schema/schema-unavailable-error.js';
 import { ReferenceValidator } from '../validation/reference-validator.js';
 import { findUnknownKeys, mergeBodyIntoData, normalizeReferenceValues, validateEntryData, } from '../validation/entry-validator.js';
 import { validateEntryLinks } from '../validation/entry-link-validator.js';
+import { findMarkdownSafetyIssues, splitByStored } from '../validation/markdown-safety.js';
 import { collectReferenceIds } from '../validation/field-traversal.js';
 import { branchNameSchema, logicalPathSchema, slugSchema } from './validators.js';
 import { entryLogicalPath, parseSlug } from '../paths/index.js';
 import { getErrorMessage, isNotFoundError, sanitizeErrorMessage } from '../utils/error.js';
 import { isDataOnlyFormat } from '../utils/format.js';
+import { findBodyFieldName } from '../utils/body-field.js';
 /**
  * Parse an API path into logical path segments, prepending the content root if needed.
  * Shared by all content API handlers.
@@ -123,6 +125,23 @@ const storedReferenceSites = async (store, collectionPath, slug, fields) => {
     const doc = await store.read(collectionPath, slug, { resolveReferences: false });
     return new Set(collectReferenceIds(fields, doc.data).map((ref) => referenceSite(ref.path, ref.id)));
 };
+function withoutKey(record, key) {
+    if (!(key in record))
+        return record;
+    const { [key]: _dropped, ...rest } = record;
+    return rest;
+}
+/** The policy's issues in the stored entry, which a save may keep. */
+const storedMarkdownSafetyIssues = async (store, collectionPath, slug, fields) => {
+    // A stored file that does not read keeps nothing, so the save's code is refused, not a 500.
+    const doc = await store
+        .read(collectionPath, slug, { resolveReferences: false })
+        .catch(() => undefined);
+    if (doc === undefined)
+        return [];
+    const data = 'body' in doc ? mergeBodyIntoData(fields, doc.data, doc.body) : doc.data;
+    return findMarkdownSafetyIssues(fields, doc.format, data);
+};
 const writeContentHandler = async (gc, ctx, req, params, body) => {
     const { branchContext } = gc;
     const flatSchema = branchContext.flatSchema;
@@ -216,15 +235,20 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     if (resolvedEntryType?.unavailable) {
         throw new SchemaUnavailableError(resolvedEntryType.name, resolvedEntryType.unavailable);
     }
-    const data = body.data ?? {};
     const isDataOnly = isDataOnlyFormat(body.format);
+    // An md/mdx file's body field is its body, so a frontmatter key of that name is dropped: no
+    // check would see it, and a read or a resolved reference would serve it as the body.
+    const requestData = isDataOnly || body.data === undefined
+        ? body.data
+        : withoutKey(body.data, findBodyFieldName(fields));
+    const data = requestData ?? {};
     // The store's own `undefined` (blind write) is never reachable from here: an omitted token is
     // a create, so an update that lost its token 409s instead of overwriting unchecked.
     const expectedVersion = body.expectedVersion ?? null;
     const createConflictError = body.expectedVersion === null
         ? `An entry with slug "${slug}" already exists`
         : `An entry with slug "${slug}" already exists; an update must send the expectedVersion from its last read`;
-    const danglingWarnings = [];
+    const keptWarnings = [];
     try {
         const exists = await store.documentExists(schemaItem.logicalPath, slug);
         // Create guard: a create against a slug that already has content must never silently
@@ -276,6 +300,23 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             // as the schema's isBody field.
             const dataForValidation = isDataOnly ? data : mergeBodyIntoData(fields, data, body.body ?? '');
             const fieldErrors = validateEntryData(fields, dataForValidation);
+            // Code in markdown or MDX (validation/markdown-safety.ts). A field the stored entry held
+            // with code is kept, with a warning, when saved unchanged; any other code is refused.
+            const unsafe = findMarkdownSafetyIssues(fields, body.format, dataForValidation);
+            if (unsafe.length > 0) {
+                const stored = exists
+                    ? await storedMarkdownSafetyIssues(store, schemaItem.logicalPath, slug, fields)
+                    : [];
+                const { refused, kept } = splitByStored(unsafe, stored);
+                fieldErrors.push(...refused);
+                for (const e of kept) {
+                    keptWarnings.push({
+                        level: 'warning',
+                        fieldPath: e.fieldPath,
+                        message: `holds code that runs when the page renders, kept because the saved entry already had it: ${e.message}. Ask a developer to move it into a component.`,
+                    });
+                }
+            }
             // Reference existence (server-only: reads the content ID index). Editor
             // payloads may still carry resolved `{ id, ... }` objects from a prior
             // read, so collapse them to id strings before checking.
@@ -292,7 +333,7 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
                     : new Set();
                 for (const e of refResult.errors) {
                     if (e.dangling && storedSites.has(referenceSite(e.fieldPath, e.id))) {
-                        danglingWarnings.push({
+                        keptWarnings.push({
                             level: 'warning',
                             fieldPath: e.fieldPath,
                             message: `references a missing entry (${e.id}). It is kept as it was; repoint or clear it.`,
@@ -323,7 +364,7 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     // Adopter save-time validation, run BEFORE the file is written: 'error' issues
     // refuse the save (e.g. a body that would break the site's production build),
     // 'warning' issues are returned alongside the successful write.
-    let validationWarnings = danglingWarnings.length > 0 ? danglingWarnings : undefined;
+    let validationWarnings = keptWarnings.length > 0 ? keptWarnings : undefined;
     const validateEntry = ctx.services.config.validateEntry;
     // Collapse resolved reference objects back to bare ID strings before persisting (the reference
     // validator above gets its own copy). The editor's GET resolves references by default, so form
@@ -331,7 +372,7 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
     // left unnormalized, a save would freeze that snapshot into the file (resolution only
     // re-resolves plain ID strings), permanently severing the reference from its target. Idempotent:
     // a payload that already holds ID strings is unchanged.
-    const normalizedData = body.data === undefined ? undefined : normalizeReferenceValues(fields, body.data);
+    const normalizedData = requestData === undefined ? undefined : normalizeReferenceValues(fields, requestData);
     // Computed before the validateEntry hook and the entry-link scan too, not just the write, so
     // every consumer agrees on the same bytes — otherwise an adopter's hook could see a resolved
     // object while the file got an ID string, depending on whether the post came from the editor.
@@ -366,7 +407,9 @@ const writeContentHandler = async (gc, ctx, req, params, body) => {
             issues = await validateEntry({
                 entryPath: logicalPathSegments.join('/'),
                 branch: params.branch,
-                ...(params.entryType ? { entryType: params.entryType } : {}),
+                // The type the store writes with, so a request that omits `entryType` can't skip a
+                // type-gated rule.
+                ...(entryTypeName ? { entryType: entryTypeName } : {}),
                 format: body.format,
                 data: normalizedData ?? {},
                 body: body.body,

package/dist/api/github-sync.d.ts

@@ -8,11 +8,19 @@ export interface GitHubSyncResult {
     prUrl?: string;
     prNumber?: number;
     syncStatus?: SyncStatus;
+    /** Client-safe reason a direct GitHub call failed, recorded as the branch's syncFailureReason. */
+    syncFailureReason?: string;
+    /** GitHub refused the PR because the pushed branch has no commits its base lacks. */
+    nothingToSubmit?: boolean;
+    /** The direct path, whose submit pushes to GitHub itself: the branch is there whatever the PR call did. */
+    pushedToGitHub?: boolean;
 }
 /** What the PR body records about a submit. */
 export interface SubmissionRecord {
     submitter?: SubmissionEditor;
     changedPaths: readonly string[];
+    /** The submit's `submittedAt`, carried to the worker so its failure handling targets this submit. */
+    submittedAt?: string;
 }
 /**
  * Uses githubService directly if available, otherwise queues a task for the worker.
@@ -28,9 +36,9 @@ export declare function syncSubmitPr(ctx: ApiContext, context: BranchContext, su
 export declare function syncConvertToDraft(ctx: ApiContext, context: BranchContext): Promise<void>;
 /**
  * Used by delete, after the local delete succeeded. Deletes the branch on GitHub when the CMS
- * put it there: a content branch reaches GitHub only through submit, which always opens a PR,
- * so a recorded PR number is the proof. Without one, a same-named GitHub branch is someone
- * else's (the create-time collision check is best-effort) and is never touched.
+ * put it there: a recorded PR number or `pushedToGitHubAt` stamp is the proof (a submit whose PR
+ * GitHub refused pushed the branch but has no PR number). Without either, a same-named GitHub
+ * branch is someone else's (the create-time collision check is best-effort) and is never touched.
  *
  * Returns a client-facing warning when the delete could not be done or queued; never throws.
  */

package/dist/api/github-sync.js

@@ -1,10 +1,10 @@
 import { enqueueTask } from '../task-queue/cms-task-queue.js';
 import { getTaskQueueDir } from '../task-queue/task-queue-config.js';
 import { clientOperatingStrategy } from '../operating-mode/index.js';
-import { getErrorMessage } from '../utils/error.js';
+import { getErrorMessage, sanitizeErrorMessage } from '../utils/error.js';
 import { sanitizeBranchName } from '../paths/branch-name.js';
 import { buildPrSection, mergePrSection } from '../submission-attribution.js';
-import { isRefAlreadyGoneError } from '../github-service.js';
+import { isNoCommitsBetweenError, isRefAlreadyGoneError } from '../github-service.js';
 /**
  * Uses githubService directly if available, otherwise queues a task for the worker.
  *
@@ -65,6 +65,7 @@ export async function syncSubmitPr(ctx, context, submission) {
                     prUrl: context.branch.pullRequestUrl,
                     prNumber: context.branch.pullRequestNumber,
                     syncStatus: 'synced',
+                    pushedToGitHub: true,
                 };
             }
             else {
@@ -92,16 +93,21 @@ export async function syncSubmitPr(ctx, context, submission) {
                     prUrl: result.url,
                     prNumber: result.number,
                     syncStatus: 'synced',
+                    pushedToGitHub: true,
                 };
             }
         }
         catch (err) {
-            const message = err instanceof Error ? err.message : 'Unknown error';
+            const message = getErrorMessage(err);
             console.error(`CanopyCMS: Failed to create/update PR for ${context.branch.name}:`, message);
+            if (isNoCommitsBetweenError(err))
+                return { nothingToSubmit: true, pushedToGitHub: true };
             return {
                 prUrl: context.branch.pullRequestUrl,
                 prNumber: context.branch.pullRequestNumber,
                 syncStatus: 'sync-failed',
+                syncFailureReason: sanitizeErrorMessage(message),
+                pushedToGitHub: true,
             };
         }
     }
@@ -124,6 +130,7 @@ export async function syncSubmitPr(ctx, context, submission) {
             // A content submit is an explicit "ready for review" action: convert a
             // pre-existing draft PR to ready.
             markReadyIfDraft: true,
+            submittedAt: submission.submittedAt,
         },
     });
 }
@@ -159,14 +166,15 @@ export async function syncConvertToDraft(ctx, context) {
 }
 /**
  * Used by delete, after the local delete succeeded. Deletes the branch on GitHub when the CMS
- * put it there: a content branch reaches GitHub only through submit, which always opens a PR,
- * so a recorded PR number is the proof. Without one, a same-named GitHub branch is someone
- * else's (the create-time collision check is best-effort) and is never touched.
+ * put it there: a recorded PR number or `pushedToGitHubAt` stamp is the proof (a submit whose PR
+ * GitHub refused pushed the branch but has no PR number). Without either, a same-named GitHub
+ * branch is someone else's (the create-time collision check is best-effort) and is never touched.
  *
  * Returns a client-facing warning when the delete could not be done or queued; never throws.
  */
 export async function syncDeleteRemoteBranch(ctx, context) {
-    if (!context.branch.pullRequestNumber)
+    const { pullRequestNumber, pushedToGitHubAt } = context.branch;
+    if (!pullRequestNumber && !pushedToGitHubAt)
         return undefined;
     const { githubService } = ctx.services;
     const branch = context.branch.name;
@@ -187,7 +195,7 @@ export async function syncDeleteRemoteBranch(ctx, context) {
         return undefined;
     const result = await enqueueGitHubTask(ctx, context, {
         action: 'delete-remote-branch',
-        payload: { branch, pullRequestNumber: context.branch.pullRequestNumber },
+        payload: { branch, pullRequestNumber, pushedToGitHubAt },
     });
     return result.syncStatus === 'sync-failed'
         ? 'Deleting the branch on GitHub could not be queued; delete it there by hand'

package/dist/branch-metadata.d.ts

@@ -68,6 +68,12 @@ export declare class BranchMetadataFileManager {
      * creates only its own directory (`withOccFileLock`), so the save fails there.
      */
     save(incoming: BranchMetadataUpdate): Promise<BranchMetadataFile>;
+    /**
+     * {@link save}, applied only when `onlyIf` accepts the metadata on disk; resolves null when it
+     * does not, having written nothing. `onlyIf` runs inside the lock stack against the version
+     * the write is checked against, so the decision and the write are one compare-and-set.
+     */
+    saveIf(incoming: BranchMetadataUpdate, onlyIf: (existing: BranchMetadataFile | null) => boolean): Promise<BranchMetadataFile | null>;
     /** Invalidate the registry cache so the next list() regenerates. */
     private invalidateRegistry;
 }

package/dist/branch-metadata.js

@@ -106,6 +106,17 @@ export class BranchMetadataFileManager {
      * creates only its own directory (`withOccFileLock`), so the save fails there.
      */
     async save(incoming) {
+        const saved = await this.saveIf(incoming, () => true);
+        if (saved === null)
+            throw new Error('unreachable: an unconditional save was skipped');
+        return saved;
+    }
+    /**
+     * {@link save}, applied only when `onlyIf` accepts the metadata on disk; resolves null when it
+     * does not, having written nothing. `onlyIf` runs inside the lock stack against the version
+     * the write is checked against, so the decision and the write are one compare-and-set.
+     */
+    async saveIf(incoming, onlyIf) {
         try {
             await fs.stat(this.branchRoot);
         }
@@ -119,6 +130,8 @@ export class BranchMetadataFileManager {
         try {
             saved = await withLock(this.filePath, () => withOccFileLock(this.filePath, () => withOccRetry(async () => {
                 const { meta: existing, version } = await this.load();
+                if (!onlyIf(existing))
+                    return null;
                 const merged = mergeBranchMetadata(existing, version, incoming);
                 const written = await this.write(merged, version);
                 merged.version = written.version;
@@ -137,7 +150,8 @@ export class BranchMetadataFileManager {
         // does, and the registry's eager regeneration is O(branch count) fs reads
         // on EFS — holding the lock through it would stretch every save's critical
         // section for no correctness gain.
-        await this.invalidateRegistry();
+        if (saved !== null)
+            await this.invalidateRegistry();
         return saved;
     }
     /** Invalidate the registry cache so the next list() regenerates. */