canopycms 0.0.68-int.98 → 0.1.0

package/dist/cli/init.js

@@ -22,19 +22,13 @@ var init_logger = __esm({
 });
 
 // dist/config/types.js
-var primitiveFieldTypes, fieldTypes;
+var scalarFieldTypes, markdownFieldTypes, primitiveFieldTypes, fieldTypes;
 var init_types = __esm({
   "dist/config/types.js"() {
     "use strict";
-    primitiveFieldTypes = [
-      "string",
-      "number",
-      "boolean",
-      "datetime",
-      "markdown",
-      "mdx",
-      "code"
-    ];
+    scalarFieldTypes = ["string", "number", "boolean", "datetime", "code"];
+    markdownFieldTypes = ["markdown", "mdx"];
+    primitiveFieldTypes = [...scalarFieldTypes, ...markdownFieldTypes];
     fieldTypes = [
       ...primitiveFieldTypes,
       "image",
@@ -47,13 +41,131 @@ var init_types = __esm({
   }
 });
 
+// dist/validation/mdx-allowlist.js
+function isComponentName(name) {
+  return COMPONENT_NAME.test(name) && !MDX_BINDINGS.has(name);
+}
+function isRefusedComponentProp(name) {
+  return /^on[A-Z]/.test(name) || FORBIDDEN_ATTRIBUTES.has(name.toLowerCase());
+}
+function markdownFieldOptionsError(field) {
+  const renderAs = field.renderAs;
+  if (renderAs !== void 0 && renderAs !== "mdx") {
+    return `Field "${field.name}": renderAs must be 'mdx'`;
+  }
+  if (renderAs !== void 0 && field.type === "mdx") {
+    return `Field "${field.name}": renderAs applies only to markdown fields`;
+  }
+  if (field.mdxAllow === void 0)
+    return void 0;
+  if (field.executable === true) {
+    return `Field "${field.name}": mdxAllow has no effect with executable: true, which turns the check off`;
+  }
+  if (field.type === "markdown" && field.renderAs !== "mdx") {
+    return `Field "${field.name}": mdxAllow applies to MDX; set renderAs: 'mdx' on a markdown field the site renders as MDX`;
+  }
+  return void 0;
+}
+var SAFE_HTML_TAGS, COMPONENT_NAME, MDX_BINDINGS, FORBIDDEN_ATTRIBUTES;
+var init_mdx_allowlist = __esm({
+  "dist/validation/mdx-allowlist.js"() {
+    "use strict";
+    SAFE_HTML_TAGS = /* @__PURE__ */ new Set([
+      "a",
+      "abbr",
+      "address",
+      "article",
+      "aside",
+      "audio",
+      "b",
+      "bdi",
+      "bdo",
+      "blockquote",
+      "br",
+      "caption",
+      "cite",
+      "code",
+      "col",
+      "colgroup",
+      "data",
+      "dd",
+      "del",
+      "details",
+      "dfn",
+      "div",
+      "dl",
+      "dt",
+      "em",
+      "figcaption",
+      "figure",
+      "footer",
+      "h1",
+      "h2",
+      "h3",
+      "h4",
+      "h5",
+      "h6",
+      "header",
+      "hgroup",
+      "hr",
+      "i",
+      "img",
+      "ins",
+      "kbd",
+      "li",
+      "main",
+      "mark",
+      "nav",
+      "ol",
+      "p",
+      "picture",
+      "pre",
+      "q",
+      "rp",
+      "rt",
+      "ruby",
+      "s",
+      "samp",
+      "section",
+      "small",
+      "source",
+      "span",
+      "strong",
+      "sub",
+      "summary",
+      "sup",
+      "table",
+      "tbody",
+      "td",
+      "tfoot",
+      "th",
+      "thead",
+      "time",
+      "tr",
+      "track",
+      "u",
+      "ul",
+      "var",
+      "video",
+      "wbr"
+    ]);
+    COMPONENT_NAME = /^[A-Z][\w$]*$/;
+    MDX_BINDINGS = /* @__PURE__ */ new Set(["MDXContent", "MDXLayout"]);
+    FORBIDDEN_ATTRIBUTES = /* @__PURE__ */ new Set([
+      "dangerouslysetinnerhtml",
+      "srcdoc"
+    ]);
+  }
+});
+
 // dist/config/schemas/field.js
 import { z } from "zod";
-var fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema;
+var fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, mdxPropAllowSchema, mdxAllowlistSchema, markdownFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema;
 var init_field = __esm({
   "dist/config/schemas/field.js"() {
     "use strict";
     init_types();
+    init_mdx_allowlist();
     fieldBaseSchema = z.object({
       name: z.string().min(1),
       label: z.string().optional(),
@@ -78,7 +190,36 @@ var init_field = __esm({
       })
     ]);
     primitiveFieldSchema = fieldBaseSchema.extend({
-      type: z.enum(primitiveFieldTypes)
+      type: z.enum(primitiveFieldTypes).exclude([...markdownFieldTypes]),
+      // Listed so a parse keeps it (zod strips unknown keys); which fields may carry it is
+      // `ensureStampOnPublishPlacement`'s call (config/validation.ts).
+      stampOnPublish: z.boolean().optional()
+    });
+    mdxPropAllowSchema = z.union([
+      z.literal(true),
+      z.literal("string"),
+      z.object({ type: z.literal("string"), maxLength: z.number().int().min(1).optional() }).strict(),
+      z.array(z.union([z.string(), z.number(), z.boolean()])).min(1)
+    ]);
+    mdxAllowlistSchema = z.object({
+      components: z.record(z.string().refine(isComponentName, {
+        message: "must be a component name: capitalised, with no dot, and not MDXContent or MDXLayout"
+      }), z.object({
+        props: z.record(z.string().min(1).refine((name) => !isRefusedComponentProp(name), {
+          message: "event handlers, srcdoc and dangerouslySetInnerHTML are always refused"
+        }), mdxPropAllowSchema).optional()
+      }).strict()).optional(),
+      htmlTags: z.array(z.string().refine((tag) => SAFE_HTML_TAGS.has(tag), {
+        message: "must be one of the HTML tags the base MDX policy accepts"
+      })).optional(),
+      expressions: z.boolean().optional(),
+      fragments: z.boolean().optional()
+    }).strict();
+    markdownFieldSchema = fieldBaseSchema.extend({
+      type: z.enum(markdownFieldTypes),
+      executable: z.boolean().optional(),
+      renderAs: z.literal("mdx").optional(),
+      mdxAllow: mdxAllowlistSchema.optional()
     });
     ASPECT_RATIO_RE = /^[1-9][0-9]*:[1-9][0-9]*$/;
     imageFieldSchema = fieldBaseSchema.extend({
@@ -116,7 +257,8 @@ var init_field = __esm({
     objectFieldSchema = fieldBaseSchema.extend({
       type: z.literal("object"),
       fields: z.array(z.lazy(() => fieldHolder[0])).min(1),
-      itemTitleField: z.string().min(1).optional()
+      itemTitleField: z.string().min(1).optional(),
+      itemLabel: z.string().trim().min(1).optional()
     });
     inlineGroupFieldSchema = z.object({
       type: z.literal("group"),
@@ -132,13 +274,20 @@ var init_field = __esm({
     }).passthrough());
     knownFieldSchema = z.discriminatedUnion("type", [
       primitiveFieldSchema,
+      markdownFieldSchema,
       selectFieldSchema,
       referenceFieldSchema,
       imageFieldSchema,
       objectFieldSchema,
       blockFieldSchema,
       inlineGroupFieldSchema
-    ]);
+    ]).superRefine((field, ctx) => {
+      if (field.type !== "markdown" && field.type !== "mdx")
+        return;
+      const message = markdownFieldOptionsError(field);
+      if (message !== void 0)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message });
+    });
     fieldSchema = z.lazy(() => z.union([knownFieldSchema, customFieldSchema]));
     fieldHolder[0] = fieldSchema;
   }
@@ -192,7 +341,7 @@ function isImplicitlyOffOrigin(url) {
     return false;
   }
 }
-function isHttpUrlOrSameOriginPath(value, opts = {}) {
+function isHttpUrlOrSameOriginPath(value) {
   if (value === "")
     return false;
   for (let index = 0; index < value.length; index++) {
@@ -216,9 +365,8 @@ function isHttpUrlOrSameOriginPath(value, opts = {}) {
       return false;
     }
   }
-  if (isImplicitlyOffOrigin(value)) {
-    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
-  }
+  if (isImplicitlyOffOrigin(value))
+    return false;
   return value.startsWith("/") && value[1] !== "/";
 }
 var SENTINEL_BASE, DOT_SEGMENT;
@@ -232,7 +380,7 @@ var init_sanitize_href = __esm({
 
 // dist/config/schemas/url.js
 import { z as z3 } from "zod";
-var uploadTargetUrlSchema, assetMountUrlSchema, previewPrefixSchema;
+var uploadTargetUrlSchema, previewPrefixSchema;
 var init_url = __esm({
   "dist/config/schemas/url.js"() {
     "use strict";
@@ -240,9 +388,6 @@ var init_url = __esm({
     uploadTargetUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
       message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
     });
-    assetMountUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
-      message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
-    });
     previewPrefixSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
       message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
     });
@@ -260,7 +405,6 @@ var init_media = __esm({
     mediaSchema = z4.discriminatedUnion("adapter", [
       z4.object({
         adapter: z4.literal("local"),
-        publicBaseUrl: assetMountUrlSchema.optional(),
         /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
         directory: relativePathSchema.optional()
       }).strict(),
@@ -268,7 +412,6 @@ var init_media = __esm({
         adapter: z4.literal("s3"),
         bucket: z4.string().min(1),
         region: z4.string().min(1),
-        publicBaseUrl: assetMountUrlSchema.optional(),
         /**
          * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
          * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
@@ -278,18 +421,17 @@ var init_media = __esm({
          * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
          * alone, so the host never enters it (pinned by store-s3.test.ts).
          *
-         * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
-         * the POST target outright and is passed through byte-for-byte. Do not route it through
-         * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
-         * stop a CDN path pattern like `/asset-upload/*` from matching.
+         * NOT a prefix: nothing is joined onto this value; it replaces the POST target outright
+         * and is passed through byte-for-byte. Do not route it through `joinUrlPrefix` "for
+         * consistency" — that would strip the trailing slash and silently stop a CDN path
+         * pattern like `/asset-upload/*` from matching.
          */
         uploadUrl: uploadTargetUrlSchema.optional(),
         /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
         maxUploadBytes: z4.number().int().positive().optional()
       }).strict(),
       z4.object({
-        adapter: z4.literal("lfs"),
-        publicBaseUrl: assetMountUrlSchema.optional()
+        adapter: z4.literal("lfs")
       }).strict()
     ]);
   }
@@ -302,6 +444,7 @@ var init_config = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection();
+    init_field();
     init_media();
     init_url();
     defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
@@ -332,7 +475,6 @@ var init_config = __esm({
     });
     editorConfigSchema = z5.object({
       title: z5.string().optional(),
-      subtitle: z5.string().optional(),
       theme: z5.unknown().optional(),
       previewBase: z5.record(z5.union([z5.string(), z5.literal(false)])).optional(),
       previewPrefix: previewPrefixSchema.optional(),
@@ -355,8 +497,8 @@ var init_config = __esm({
       defaultBranchAccess: defaultBranchAccessSchema,
       defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
-      // unset must stay undefined after parsing so dev mode can detect the fork
-      // point from git HEAD (see resolveBaseBranch in utils/git.ts).
+      // unset must stay undefined after parsing so dev and prod can detect the
+      // fork point (see resolveBaseBranch in utils/git.ts).
       defaultBaseBranch: defaultBaseBranchSchema.optional(),
       defaultActiveBranch: z5.string().min(1).optional(),
       defaultRemoteName: defaultRemoteNameSchema.optional(),
@@ -386,82 +528,16 @@ var init_config = __esm({
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
       basePath: basePathSchema,
+      unauthenticatedStatus: z5.union([z5.literal(401), z5.literal(419)]).optional(),
+      danglingReferences: z5.enum(["error", "warn"]).optional(),
       editor: editorConfigSchema.optional(),
       authPlugin: z5.custom().optional(),
       entryLinkUrl: z5.custom().optional(),
       validateEntry: z5.custom().optional(),
+      mdxAllow: mdxAllowlistSchema.optional(),
       dev: devConfigSchema.optional()
     }).strict();
-    DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
-  }
-});
-
-// dist/config/schemas/permissions.js
-import { z as z6 } from "zod";
-var permissionTargetSchema, pathPermissionSchema;
-var init_permissions = __esm({
-  "dist/config/schemas/permissions.js"() {
-    "use strict";
-    permissionTargetSchema = z6.object({
-      allowedUsers: z6.array(z6.string()).optional(),
-      allowedGroups: z6.array(z6.string()).optional()
-    });
-    pathPermissionSchema = z6.object({
-      path: z6.string().min(1),
-      read: permissionTargetSchema.optional(),
-      edit: permissionTargetSchema.optional(),
-      review: permissionTargetSchema.optional()
-    });
-  }
-});
-
-// dist/paths/normalize.js
-var init_normalize = __esm({
-  "dist/paths/normalize.js"() {
-    "use strict";
-  }
-});
-
-// dist/paths/types.js
-var init_types2 = __esm({
-  "dist/paths/types.js"() {
-    "use strict";
-  }
-});
-
-// dist/config/flatten.js
-import { join, normalize } from "pathe";
-var init_flatten = __esm({
-  "dist/config/flatten.js"() {
-    "use strict";
-    init_normalize();
-    init_types2();
-  }
-});
-
-// dist/operating-mode/mode-env.js
-var init_mode_env = __esm({
-  "dist/operating-mode/mode-env.js"() {
-    "use strict";
-    init_logger();
-  }
-});
-
-// dist/config/validation.js
-var init_validation = __esm({
-  "dist/config/validation.js"() {
-    "use strict";
-    init_config();
-    init_flatten();
-    init_mode_env();
-  }
-});
-
-// dist/config/helpers.js
-var init_helpers = __esm({
-  "dist/config/helpers.js"() {
-    "use strict";
-    init_validation();
+    DEFAULT_PROD_WORKSPACE = "/mnt/efs";
   }
 });
 
@@ -469,15 +545,7 @@ var init_helpers = __esm({
 var init_config2 = __esm({
   "dist/config/index.js"() {
     "use strict";
-    init_types();
     init_config();
-    init_field();
-    init_collection();
-    init_permissions();
-    init_media();
-    init_flatten();
-    init_validation();
-    init_helpers();
   }
 });
 
@@ -635,6 +703,7 @@ var init_templates = __esm({
 var project_detect_exports = {};
 __export(project_detect_exports, {
   CDK_DEPENDENCIES: () => CDK_DEPENDENCIES,
+  PLACEHOLDER_GITHUB_REPO: () => PLACEHOLDER_GITHUB_REPO,
   commandsFor: () => commandsFor,
   detectDefaultBranch: () => detectDefaultBranch,
   detectGitHubRepo: () => detectGitHubRepo,
@@ -751,7 +820,7 @@ async function missingCdkDependencies(projectDir) {
   }
   return CDK_DEPENDENCIES.filter((name) => !declared.has(name));
 }
-var COMMANDS, MAX_WORKSPACE_DEPTH, CDK_DEPENDENCIES;
+var COMMANDS, MAX_WORKSPACE_DEPTH, PLACEHOLDER_GITHUB_REPO, CDK_DEPENDENCIES;
 var init_project_detect = __esm({
   "dist/cli/project-detect.js"() {
     "use strict";
@@ -798,6 +867,7 @@ var init_project_detect = __esm({
       }
     };
     MAX_WORKSPACE_DEPTH = 8;
+    PLACEHOLDER_GITHUB_REPO = { owner: "your-org", repo: "your-docs-site" };
     CDK_DEPENDENCIES = [
       "canopycms",
       "canopycms-cdk",
@@ -837,10 +907,11 @@ var init_task_queue_config = __esm({
 function createDebugLogger(options) {
   return new DebugLogger(options);
 }
-var LOG_LEVELS, DebugLogger, testLogger;
+var envFlag, LOG_LEVELS, DebugLogger, testLogger;
 var init_debug = __esm({
   "dist/utils/debug.js"() {
     "use strict";
+    envFlag = (name) => typeof process !== "undefined" && process.env[name] === "true";
     LOG_LEVELS = {
       DEBUG: 0,
       INFO: 1,
@@ -853,7 +924,7 @@ var init_debug = __esm({
         this.options = options;
       }
       shouldLog(level) {
-        const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
+        const enabled = this.options.enabled ?? envFlag("CANOPYCMS_DEBUG");
         if (!enabled)
           return false;
         const minLevel = this.options.minLevel ?? "DEBUG";
@@ -929,7 +1000,7 @@ var init_debug = __esm({
       }
     };
     testLogger = createDebugLogger({
-      enabled: process.env.E2E_DEBUG === "true",
+      enabled: envFlag("E2E_DEBUG"),
       prefix: "E2E",
       throwOnError: false
     });
@@ -943,8 +1014,8 @@ async function atomicWriteFile(filePath, content) {
   const dir = path5.dirname(filePath);
   await fs4.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs4.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
   try {
+    await fs4.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
     await fs4.rename(tempPath, filePath);
   } catch (err) {
     await fs4.unlink(tempPath).catch(() => {
@@ -1127,6 +1198,31 @@ async function retryTask(taskDir, taskId, error, logger = nullLogger) {
   });
   logger.debug("Retrying task", { id: taskId, retryCount, backoffMs });
 }
+async function releaseTask(taskDir, taskId, logger = nullLogger) {
+  const processingPath = path6.join(taskDir, "processing", `${taskId}.json`);
+  const pendingPath = path6.join(taskDir, "pending", `${taskId}.json`);
+  let task;
+  try {
+    const content = await fs5.readFile(processingPath, "utf-8");
+    const parsed = parseTaskJson(content);
+    if (!parsed) {
+      logger.debug("Corrupt task file in processing, removing", { id: taskId });
+      await fs5.unlink(processingPath).catch(() => {
+      });
+      return;
+    }
+    task = parsed;
+  } catch (err) {
+    if (isNotFoundError2(err))
+      return;
+    throw err;
+  }
+  task.status = "pending";
+  await atomicWriteFile(pendingPath, JSON.stringify(task, null, 2));
+  await fs5.unlink(processingPath).catch(() => {
+  });
+  logger.debug("Released task", { id: taskId });
+}
 async function requeueFailedTask(taskDir, taskId, logger = nullLogger) {
   const failedPath = path6.join(taskDir, "failed", `${taskId}.json`);
   let content;
@@ -1383,6 +1479,7 @@ __export(cms_task_queue_exports, {
   listCorruptTaskFiles: () => listCorruptTaskFiles,
   listTasks: () => listTasks,
   recoverOrphanedTasks: () => recoverOrphanedTasks,
+  releaseTask: () => releaseTask,
   requeueFailedTask: () => requeueFailedTask,
   retryTask: () => retryTask
 });
@@ -1610,9 +1707,6 @@ function operatingStrategy(mode) {
   return strategy;
 }
 
-// dist/operating-mode/index.js
-init_mode_env();
-
 // dist/auth/plugin.js
 function assertAuthPluginAllowedForMode(plugin, mode) {
   if (mode === "prod" && plugin.verifiesCredentials !== true) {
@@ -1764,12 +1858,12 @@ async function initDeployAws(options) {
   const { projectDir, force, nonInteractive } = options;
   const writeOpts = { force, nonInteractive };
   const { dockerfileCms: dockerfileCms2, dockerignore: dockerignore2, githubWorkflowCms: githubWorkflowCms2, cdkJson: cdkJson2, cdkApp: cdkApp2, cmsStack: cmsStack2, cdkTsconfig: cdkTsconfig2 } = await Promise.resolve().then(() => (init_templates(), templates_exports));
-  const { detectPackageManager: detectPackageManager2, detectDefaultBranch: detectDefaultBranch2, detectGitHubRepo: detectGitHubRepo2, commandsFor: commandsFor2, missingCdkDependencies: missingCdkDependencies2, CDK_DEPENDENCIES: CDK_DEPENDENCIES2 } = await Promise.resolve().then(() => (init_project_detect(), project_detect_exports));
+  const { detectPackageManager: detectPackageManager2, detectDefaultBranch: detectDefaultBranch2, detectGitHubRepo: detectGitHubRepo2, commandsFor: commandsFor2, missingCdkDependencies: missingCdkDependencies2, CDK_DEPENDENCIES: CDK_DEPENDENCIES2, PLACEHOLDER_GITHUB_REPO: PLACEHOLDER_GITHUB_REPO2 } = await Promise.resolve().then(() => (init_project_detect(), project_detect_exports));
   p.intro("CanopyCMS init-deploy aws");
   const packageManager = await detectPackageManager2(projectDir);
   const pm = commandsFor2(packageManager);
   const defaultBranch = await detectDefaultBranch2(projectDir);
-  const repo = await detectGitHubRepo2(projectDir);
+  const repo = await detectGitHubRepo2(projectDir) ?? PLACEHOLDER_GITHUB_REPO2;
   await writeFile(path7.join(projectDir, "Dockerfile.cms"), await dockerfileCms2({ copy: pm.dockerCopy, install: pm.dockerInstall, build: pm.build }), writeOpts);
   const dockerignoreWritten = await writeFile(path7.join(projectDir, ".dockerignore"), await dockerignore2(), writeOpts);
   if (!dockerignoreWritten) {
@@ -1784,10 +1878,7 @@ async function initDeployAws(options) {
   const cdkJsonPath = path7.join(projectDir, "cdk.json");
   const existingCdkJson = await filePathExists(cdkJsonPath) ? await fs6.readFile(cdkJsonPath, "utf-8") : null;
   const cdkJsonWritten = await writeFile(cdkJsonPath, await cdkJson2(), writeOpts);
-  await writeFile(path7.join(projectDir, "infrastructure/bin/app.ts"), await cdkApp2({
-    githubOwner: repo?.owner ?? "your-org",
-    githubRepo: repo?.repo ?? "your-docs-site"
-  }), writeOpts);
+  await writeFile(path7.join(projectDir, "infrastructure/bin/app.ts"), await cdkApp2({ githubOwner: repo.owner, githubRepo: repo.repo }), writeOpts);
   await writeFile(path7.join(projectDir, "infrastructure/lib/cms-stack.ts"), await cmsStack2(), writeOpts);
   await writeFile(path7.join(projectDir, "infrastructure/tsconfig.json"), await cdkTsconfig2(), writeOpts);
   const tsconfigResult = await excludeFromTsconfig(projectDir, "infrastructure");
@@ -1830,7 +1921,7 @@ async function initDeployAws(options) {
     `   ${pm.addDev} ${CDK_DEPENDENCIES2.join(" ")}`,
     "",
     "2. Fill in infrastructure/lib/cms-stack.ts and infrastructure/bin/app.ts",
-    `   (worker repo currently set to ${repo ? `${repo.owner}/${repo.repo}` : "your-org/your-docs-site"})`,
+    `   (worker repo currently set to ${repo.owner}/${repo.repo})`,
     "",
     "3. Bootstrap CDK in the target account/region: cdk bootstrap",
     "",

package/dist/cli/project-detect.d.ts

@@ -51,6 +51,8 @@ export interface GitHubRepo {
     owner: string;
     repo: string;
 }
+/** Written into the generated CDK app when `detectGitHubRepo` finds no GitHub remote. */
+export declare const PLACEHOLDER_GITHUB_REPO: GitHubRepo;
 /**
  * Owner/repo from the `origin` remote, for the generated stack's worker
  * config. Supports both SSH (`git@github.com:owner/repo.git`) and HTTPS

package/dist/cli/project-detect.js

@@ -160,6 +160,8 @@ export async function detectDefaultBranch(projectDir) {
     const branch = slash === -1 ? head : head.slice(slash + 1);
     return branch || 'main';
 }
+/** Written into the generated CDK app when `detectGitHubRepo` finds no GitHub remote. */
+export const PLACEHOLDER_GITHUB_REPO = { owner: 'your-org', repo: 'your-docs-site' };
 /**
  * Owner/repo from the `origin` remote, for the generated stack's worker
  * config. Supports both SSH (`git@github.com:owner/repo.git`) and HTTPS

package/dist/cli/template-files/Dockerfile.cms.template

@@ -48,12 +48,20 @@ ENV NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=$NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY
 # The browser needs the operating mode too: the editor page is a client
 # component that imports canopycms.config.ts, so its copy of `mode` is whatever
 # was inlined at build time -- a runtime Lambda variable can never reach it.
-# Left as dev by default (the default target of a plain `docker build`); the
-# generated CDK stack passes `prod` as a build arg. Distinct from CANOPY_MODE
-# above on purpose: this one is read only in the browser, so setting it here
-# does NOT put the build's own server-side content reads into prod mode.
-ARG NEXT_PUBLIC_CANOPY_MODE=dev
+# Defaults to prod because this image only ever runs as the deployed CMS, whose
+# server is prod; a dev editor bundle there selects dev auth against a server
+# that accepts only Clerk tokens. Anything but exactly prod or dev fails the
+# build: an empty value would fall back to the config's `dev` literal in the
+# browser, and a typo would only throw once an editor page loads. Distinct
+# from CANOPY_MODE above on purpose: this one is read only in the browser, so
+# setting it here does NOT put the build's own server-side content reads into
+# prod mode.
+ARG NEXT_PUBLIC_CANOPY_MODE=prod
 ENV NEXT_PUBLIC_CANOPY_MODE=$NEXT_PUBLIC_CANOPY_MODE
+RUN case "$NEXT_PUBLIC_CANOPY_MODE" in \
+      prod|dev) ;; \
+      *) echo "NEXT_PUBLIC_CANOPY_MODE must be exactly \"prod\" or \"dev\", got \"$NEXT_PUBLIC_CANOPY_MODE\"" >&2; exit 1 ;; \
+    esac
 RUN {{DOCKER_BUILD}}
 
 FROM public.ecr.aws/docker/library/node:22-slim AS runner