canopycms 0.0.68-int.98 → 0.1.0

package/dist/cli/template-files/cms-stack.ts.template

@@ -151,8 +151,9 @@ export class CmsStack extends Stack {
       githubRepo: props.githubRepo,
       deploymentName: props.deploymentName,
 
-      // Derived from canopycms.config.ts (imported above), not hardcoded or
-      // left to CanopyCmsService's own 'main' default. A wrong baseBranch
+      // Derived from canopycms.config.ts (imported above), not hardcoded, so the
+      // worker and the Lambda agree. Unset in both, the worker detects the base
+      // branch and the Lambda reads what it chose. A wrong baseBranch
       // crash-loops the worker forever: verifyBaseBranchExists throws when the
       // named branch doesn't exist in the cloned remote, and systemd restarts
       // into the same failure indefinitely. See CanopyCmsServiceProps.baseBranch's
@@ -198,19 +199,15 @@ export class CmsStack extends Stack {
       reservedConcurrency: 50,
     })
 
-    // Media support (uploads, on-demand image transforms). To enable it:
+    // Media support (uploads and image derivatives). To enable it:
     //
     //   1. add `AssetSupport` to the `canopycms-cdk` import at the top;
     //   2. uncomment the block below, moving it ABOVE `cmsService` (it has to
     //      exist before you can pass its bucket);
     //   3. pass `assetBucket: assetSupport.bucket` to CanopyCmsService;
     //   4. pass `assetSupport` to CanopyCmsDistribution below - it attaches
-    //      both CloudFront behaviors in the only order that is safe
-    //      (`/assets/t/*` before `/assets/*`; CloudFront matches path
-    //      patterns in order, so the general pattern would otherwise
-    //      swallow the transform one). `cdk synth` fails loudly if a
-    //      hand-written `additionalBehaviors` ever gets that order wrong
-    //      instead.
+    //      `/assets/t/*` before `/assets/*`, the order CloudFront needs, and
+    //      `cdk synth` fails if a hand-written `additionalBehaviors` does not.
     //
     // `editorOrigins` is the S3 CORS allowlist for the editor's presigned
     // uploads, so it must list the origin the editor is served from. Include
@@ -220,11 +217,17 @@ export class CmsStack extends Stack {
     // CloudFront edge instead); with neither, a construct-created bucket
     // refuses to synth.
     //
-    // Run `pnpm --filter canopycms-cdk run build:lambda` before deploying --
-    // the transform Lambda needs its native sharp binary, and the construct
-    // refuses to synth without it.
+    // `/assets/*` and `/assets/t/*` serve only what is in the bucket and
+    // compute nothing: an image derivative no one wrote is a 403. Write every
+    // derivative a site build references before releasing that build, with
+    // `canopycms collect-asset-refs <outDir>` after the build and then
+    // `canopycms materialize-assets --refs <outDir>/canopy-asset-refs.json`.
+    // To compute missing derivatives on request instead, pass
+    // `lazyPublicTransforms: true`; that deploys a transform Lambda, so inside
+    // this monorepo run `pnpm --filter canopycms-cdk run build:lambda` first
+    // (the published package ships it built).
     //
-    // See the assets section of docs/deploying-to-aws.md.
+    // See "Media: the public image path" in docs/deploying-to-aws.md.
     //
     // const assetSupport = new AssetSupport(this, 'Assets', {
     //   editorOrigins: [`https://${props.domainName}`],

package/dist/client.d.ts

@@ -1,9 +1,8 @@
 export type { CanopyClientConfig, EditorSignInProps } from './config/index.js';
 export type { CustomFieldRenderers, CustomFieldRenderProps } from './editor/FormRenderer.js';
-export * from './editor/EditorPanes.js';
 export * from './editor/EntryNavigator.js';
 export * from './editor/Editor.js';
-export * from './editor/preview-bridge.js';
+export { PreviewFrame } from './editor/PreviewFrame.js';
 export * from './editor/canopy-path.js';
 export * from './editor/theme.js';
 export * from './editor/editor-config.js';

package/dist/client.js

@@ -1,8 +1,7 @@
 'use client';
-export * from './editor/EditorPanes.js';
 export * from './editor/EntryNavigator.js';
 export * from './editor/Editor.js';
-export * from './editor/preview-bridge.js';
+export { PreviewFrame } from './editor/PreviewFrame.js';
 export * from './editor/canopy-path.js';
 export * from './editor/theme.js';
 export * from './editor/editor-config.js';

package/dist/comment-store.d.ts

@@ -17,6 +17,17 @@ export interface CommentThread {
     authorId: string;
     entryPath?: string;
     canopyPath?: string;
+    /**
+     * For a field thread inside list items or blocks: the key (`item-keys.ts`) of each item on
+     * `canopyPath`, outermost first. The thread follows those items wherever they move; the
+     * indexes in `canopyPath` are only where they were when it was made.
+     */
+    itemKeys?: string[];
+    /**
+     * Set by the editor, never stored: an item named by `itemKeys` is gone from the value it shows,
+     * so the thread stays on the entry rather than on whichever item holds its old index.
+     */
+    onRemovedItem?: boolean;
 }
 export interface CommentsFile {
     schemaVersion: number;
@@ -82,10 +93,24 @@ export declare class CommentStore {
         type: CommentType;
         entryPath?: string;
         canopyPath?: string;
+        itemKeys?: string[];
     }): Promise<{
         threadId: string;
         commentId: string;
     }>;
+    /**
+     * Append a comment to an existing thread, or return null when `threadId` names none at write
+     * time. Unlike {@link addComment}, a missing thread is never created, so a reply cannot plant
+     * a thread under an id or entry path nobody checked.
+     */
+    addReply(options: {
+        userId: string;
+        text: string;
+        threadId: string;
+    }): Promise<{
+        threadId: string;
+        commentId: string;
+    } | null>;
     resolveThread(threadId: string, userId: string): Promise<boolean>;
     listThreads(options?: {
         includeResolved?: boolean;

package/dist/comment-store.js

@@ -10,6 +10,15 @@ class CommentStoreConflictError extends Error {
         this.name = 'CommentStoreConflictError';
     }
 }
+/**
+ * A thread by id, own properties only: `threads` is a JSON-parsed plain object, so an id such
+ * as `__proto__` or `constructor` would otherwise reach `Object.prototype` or `Object`.
+ */
+function ownThread(data, threadId) {
+    return Object.prototype.hasOwnProperty.call(data.threads, threadId)
+        ? data.threads[threadId]
+        : undefined;
+}
 /**
  * Comment storage for a branch workspace, in .canopy-meta/comments.json and
  * never committed to git.
@@ -115,7 +124,8 @@ export class CommentStore {
                 timestamp,
                 text: options.text,
             };
-            if (!data.threads[threadId]) {
+            const existing = ownThread(data, threadId);
+            if (!existing) {
                 data.threads[threadId] = {
                     id: threadId,
                     comments: [comment],
@@ -125,23 +135,48 @@ export class CommentStore {
                     authorId: options.userId,
                     entryPath: options.entryPath,
                     canopyPath: options.canopyPath,
+                    ...(options.itemKeys?.length ? { itemKeys: options.itemKeys } : {}),
                 };
             }
             else {
-                data.threads[threadId].comments.push(comment);
+                existing.comments.push(comment);
             }
             await this.writeData(data, version);
             return { threadId, commentId };
         });
     }
+    /**
+     * Append a comment to an existing thread, or return null when `threadId` names none at write
+     * time. Unlike {@link addComment}, a missing thread is never created, so a reply cannot plant
+     * a thread under an id or entry path nobody checked.
+     */
+    async addReply(options) {
+        const commentId = randomUUID();
+        return this.withMutation(async (data, version) => {
+            const thread = ownThread(data, options.threadId);
+            if (!thread) {
+                return null;
+            }
+            thread.comments.push({
+                id: commentId,
+                threadId: options.threadId,
+                userId: options.userId,
+                timestamp: new Date().toISOString(),
+                text: options.text,
+            });
+            await this.writeData(data, version);
+            return { threadId: options.threadId, commentId };
+        });
+    }
     async resolveThread(threadId, userId) {
         return this.withMutation(async (data, version) => {
-            if (!data.threads[threadId]) {
+            const thread = ownThread(data, threadId);
+            if (!thread) {
                 return false;
             }
-            data.threads[threadId].resolved = true;
-            data.threads[threadId].resolvedBy = userId;
-            data.threads[threadId].resolvedAt = new Date().toISOString();
+            thread.resolved = true;
+            thread.resolvedBy = userId;
+            thread.resolvedAt = new Date().toISOString();
             await this.writeData(data, version);
             return true;
         });
@@ -156,11 +191,11 @@ export class CommentStore {
     }
     async getThread(threadId) {
         const data = await this.load();
-        return data.threads[threadId] || null;
+        return ownThread(data, threadId) ?? null;
     }
     async deleteThread(threadId) {
         return this.withMutation(async (data, version) => {
-            if (!data.threads[threadId]) {
+            if (!ownThread(data, threadId)) {
                 return false;
             }
             delete data.threads[threadId];

package/dist/config/flatten.js

@@ -62,6 +62,7 @@ export const flattenSchema = (root, basePath = '') => {
                     schemaRef: entryType.schemaRef,
                     default: entryType.default,
                     maxItems: entryType.maxItems,
+                    ...(entryType.unavailable && { unavailable: entryType.unavailable }),
                 });
             }
         }
@@ -101,6 +102,7 @@ export const flattenSchema = (root, basePath = '') => {
                 schemaRef: entryType.schemaRef,
                 default: entryType.default,
                 maxItems: entryType.maxItems,
+                ...(entryType.unavailable && { unavailable: entryType.unavailable }),
             });
         }
     }

package/dist/config/helpers.js

@@ -33,7 +33,7 @@ export function defineCanopyConfig(config) {
         server: validated,
         // Client config helper - extracts safe subset and merges overrides
         client: (clientOverrides) => {
-            const { defaultBaseBranch, defaultActiveBranch, contentRoot, editor, mode, entryLinkUrl, media, basePath, } = validated;
+            const { defaultBaseBranch, defaultActiveBranch, contentRoot, editor, mode, entryLinkUrl, basePath, mdxAllow, } = validated;
             // flatSchema is loaded dynamically by the editor via API (from .collection.json files)
             const clientConfig = {
                 defaultBaseBranch,
@@ -42,8 +42,8 @@ export function defineCanopyConfig(config) {
                 editor,
                 mode,
                 entryLinkUrl,
-                assetBaseUrl: media?.publicBaseUrl,
                 basePath,
+                mdxAllow,
                 flatSchema: [],
             };
             // Merge client overrides (e.g., auth handlers from useClerkAuthConfig)

package/dist/config/index.d.ts

@@ -8,7 +8,7 @@
  * import { defineCanopyConfig, type FieldConfig } from 'canopycms'
  * ```
  */
-export type { PrimitiveFieldType, FieldType, ContentFormat, MediaAdapterKind, PermissionLevel, PermissionTarget, PathPermission, SelectOption, ReferenceOption, FieldConfig, BlockConfig, BlockFieldConfig, SelectFieldConfig, ReferenceFieldConfig, ImageFieldConfig, ImageFieldValue, ObjectFieldConfig, InlineGroupFieldConfig, CustomFieldConfig, EntrySchema, BranchSchema, EntryTypeConfig, CollectionConfig, RootCollectionConfig, MediaConfig, CanopyEditorConfig, DefaultBranchAccess, DefaultPathAccess, DefaultPathAccessLevel, DefaultPathAccessLevels, DefaultBaseBranch, DefaultRemoteName, DefaultRemoteUrl, GitBotAuthorName, GitBotAuthorEmail, GithubTokenEnvVar, CanopyOperatingMode, ContentRoot, SourceRoot, CanopyConfig, CanopyConfigInput, CanopyConfigFragment, FlatSchemaItem, CanopyClientConfig, ClientOnlyFields, EditorSignInProps, EntryValidationIssue, ValidateEntryInput, ValidateEntryHook, } from './types.js';
+export type { PrimitiveFieldType, FieldType, ContentFormat, MediaAdapterKind, PermissionLevel, PermissionTarget, PathPermission, SelectOption, ReferenceOption, FieldConfig, BlockConfig, BlockFieldConfig, SelectFieldConfig, ReferenceFieldConfig, ImageFieldConfig, MarkdownFieldConfig, MdxAllowlist, MdxComponentAllow, MdxPropAllow, ImageFieldValue, ObjectFieldConfig, InlineGroupFieldConfig, CustomFieldConfig, EntrySchema, BranchSchema, EntryTypeConfig, EntryTypeUnavailable, CollectionConfig, RootCollectionConfig, MediaConfig, CanopyEditorConfig, DefaultBranchAccess, DefaultPathAccess, DefaultPathAccessLevel, DefaultPathAccessLevels, DefaultBaseBranch, DefaultRemoteName, DefaultRemoteUrl, GitBotAuthorName, GitBotAuthorEmail, GithubTokenEnvVar, CanopyOperatingMode, ContentRoot, SourceRoot, CanopyConfig, CanopyConfigInput, CanopyConfigFragment, FlatSchemaItem, CanopyClientConfig, ClientOnlyFields, EditorSignInProps, EntryValidationIssue, ValidateEntryInput, ValidateEntryHook, } from './types.js';
 export { primitiveFieldTypes, fieldTypes } from './types.js';
 export { CanopyConfigSchema, getConfigDefaults, DEFAULT_PROD_WORKSPACE } from './schemas/config.js';
 export { fieldSchema, blockSchema, selectOptionSchema, referenceOptionSchema, imageFieldSchema, } from './schemas/field.js';

package/dist/config/schemas/config.d.ts

@@ -8,46 +8,37 @@ import type { EditorSignInProps, ValidateEntryHook } from '../types.js';
 export declare const CanopyConfigSchema: z.ZodObject<{
     media: z.ZodOptional<z.ZodDiscriminatedUnion<"adapter", [z.ZodObject<{
         adapter: z.ZodLiteral<"local">;
-        publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         directory: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>;
     }, "strict", z.ZodTypeAny, {
         adapter: "local";
-        publicBaseUrl?: string | undefined;
         directory?: string | undefined;
     }, {
         adapter: "local";
-        publicBaseUrl?: string | undefined;
         directory?: string | undefined;
     }>, z.ZodObject<{
         adapter: z.ZodLiteral<"s3">;
         bucket: z.ZodString;
         region: z.ZodString;
-        publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         uploadUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
         maxUploadBytes: z.ZodOptional<z.ZodNumber>;
     }, "strict", z.ZodTypeAny, {
         adapter: "s3";
         bucket: string;
         region: string;
-        publicBaseUrl?: string | undefined;
         uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     }, {
         adapter: "s3";
         bucket: string;
         region: string;
-        publicBaseUrl?: string | undefined;
         uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     }>, z.ZodObject<{
         adapter: z.ZodLiteral<"lfs">;
-        publicBaseUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     }, "strict", z.ZodTypeAny, {
         adapter: "lfs";
-        publicBaseUrl?: string | undefined;
     }, {
         adapter: "lfs";
-        publicBaseUrl?: string | undefined;
     }>]>>;
     defaultBranchAccess: z.ZodDefault<z.ZodEnum<["allow", "deny"]>>;
     defaultPathAccess: z.ZodDefault<z.ZodUnion<[z.ZodEnum<["allow", "deny"]>, z.ZodObject<{
@@ -80,9 +71,10 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     contentRoot: z.ZodDefault<z.ZodDefault<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>, string, string>>>;
     sourceRoot: z.ZodOptional<z.ZodOptional<z.ZodString>>;
     basePath: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>>;
+    unauthenticatedStatus: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<401>, z.ZodLiteral<419>]>>;
+    danglingReferences: z.ZodOptional<z.ZodEnum<["error", "warn"]>>;
     editor: z.ZodOptional<z.ZodObject<{
         title: z.ZodOptional<z.ZodString>;
-        subtitle: z.ZodOptional<z.ZodString>;
         theme: z.ZodOptional<z.ZodUnknown>;
         previewBase: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodLiteral<false>]>>>;
         previewPrefix: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
@@ -92,7 +84,6 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         SignInComponent: z.ZodOptional<z.ZodType<import("react").ComponentType<EditorSignInProps>, z.ZodTypeDef, import("react").ComponentType<EditorSignInProps>>>;
     }, "strip", z.ZodTypeAny, {
         title?: string | undefined;
-        subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string | false> | undefined;
         previewPrefix?: string | undefined;
@@ -102,7 +93,6 @@ export declare const CanopyConfigSchema: z.ZodObject<{
         SignInComponent?: import("react").ComponentType<EditorSignInProps> | undefined;
     }, {
         title?: string | undefined;
-        subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string | false> | undefined;
         previewPrefix?: string | undefined;
@@ -114,6 +104,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     authPlugin: z.ZodOptional<z.ZodType<AuthPlugin, z.ZodTypeDef, AuthPlugin>>;
     entryLinkUrl: z.ZodOptional<z.ZodType<EntryLinkUrlResolver, z.ZodTypeDef, EntryLinkUrlResolver>>;
     validateEntry: z.ZodOptional<z.ZodType<ValidateEntryHook, z.ZodTypeDef, ValidateEntryHook>>;
+    mdxAllow: z.ZodOptional<z.ZodType<import("../index.js").MdxAllowlist, z.ZodTypeDef, import("../index.js").MdxAllowlist>>;
     dev: z.ZodOptional<z.ZodObject<{
         contentSync: z.ZodOptional<z.ZodDefault<z.ZodEnum<["off", "warn"]>>>;
     }, "strip", z.ZodTypeAny, {
@@ -139,18 +130,15 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     settingsBranch?: string | undefined;
     media?: {
         adapter: "local";
-        publicBaseUrl?: string | undefined;
         directory?: string | undefined;
     } | {
         adapter: "s3";
         bucket: string;
         region: string;
-        publicBaseUrl?: string | undefined;
         uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     } | {
         adapter: "lfs";
-        publicBaseUrl?: string | undefined;
     } | undefined;
     defaultBaseBranch?: string | undefined;
     defaultActiveBranch?: string | undefined;
@@ -163,9 +151,10 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     deploymentName?: string | undefined;
     sourceRoot?: string | undefined;
     basePath?: string | undefined;
+    unauthenticatedStatus?: 401 | 419 | undefined;
+    danglingReferences?: "error" | "warn" | undefined;
     editor?: {
         title?: string | undefined;
-        subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string | false> | undefined;
         previewPrefix?: string | undefined;
@@ -177,6 +166,7 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     authPlugin?: AuthPlugin | undefined;
     entryLinkUrl?: EntryLinkUrlResolver | undefined;
     validateEntry?: ValidateEntryHook | undefined;
+    mdxAllow?: import("../index.js").MdxAllowlist | undefined;
 }, {
     gitBotAuthorName: string;
     gitBotAuthorEmail: string;
@@ -187,18 +177,15 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     settingsBranch?: string | undefined;
     media?: {
         adapter: "local";
-        publicBaseUrl?: string | undefined;
         directory?: string | undefined;
     } | {
         adapter: "s3";
         bucket: string;
         region: string;
-        publicBaseUrl?: string | undefined;
         uploadUrl?: string | undefined;
         maxUploadBytes?: number | undefined;
     } | {
         adapter: "lfs";
-        publicBaseUrl?: string | undefined;
     } | undefined;
     defaultBranchAccess?: "allow" | "deny" | undefined;
     defaultPathAccess?: "allow" | "deny" | {
@@ -219,9 +206,10 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     contentRoot?: string | undefined;
     sourceRoot?: string | undefined;
     basePath?: string | undefined;
+    unauthenticatedStatus?: 401 | 419 | undefined;
+    danglingReferences?: "error" | "warn" | undefined;
     editor?: {
         title?: string | undefined;
-        subtitle?: string | undefined;
         theme?: unknown;
         previewBase?: Record<string, string | false> | undefined;
         previewPrefix?: string | undefined;
@@ -233,18 +221,13 @@ export declare const CanopyConfigSchema: z.ZodObject<{
     authPlugin?: AuthPlugin | undefined;
     entryLinkUrl?: EntryLinkUrlResolver | undefined;
     validateEntry?: ValidateEntryHook | undefined;
+    mdxAllow?: import("../index.js").MdxAllowlist | undefined;
 }>;
 /**
- * Default workspace path for prod mode (used when CANOPYCMS_WORKSPACE_ROOT is not set).
- *
- * WARNING: this fallback assumes a ROOT mount of EFS at /mnt/efs. CanopyCmsService
- * mounts EFS in both the Lambda and the worker THROUGH an access point already
- * rooted at /workspace and therefore sets CANOPYCMS_WORKSPACE_ROOT=/mnt/efs
- * explicitly; if that env were ever unset this default would resolve to
- * /mnt/efs/workspace = EFS:/workspace/workspace (a wrong, nested dir). The CDK
- * always sets the env, so this only bites a hand-rolled misconfiguration.
+ * Default workspace path for prod mode (used when CANOPYCMS_WORKSPACE_ROOT is not set): where
+ * CanopyCmsService mounts the EFS `/workspace` access point in both the Lambda and the worker.
  */
-export declare const DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
+export declare const DEFAULT_PROD_WORKSPACE = "/mnt/efs";
 export declare const getConfigDefaults: () => {
     baseBranch: string;
     remoteName: string;

package/dist/config/schemas/config.js

@@ -3,6 +3,7 @@
  */
 import { z } from 'zod';
 import { relativePathSchema } from './collection.js';
+import { mdxAllowlistSchema } from './field.js';
 import { mediaSchema } from './media.js';
 import { previewPrefixSchema } from './url.js';
 const defaultBranchAccessSchema = z.enum(['allow', 'deny']).default('deny');
@@ -49,7 +50,6 @@ const devConfigSchema = z.object({
 });
 const editorConfigSchema = z.object({
     title: z.string().optional(),
-    subtitle: z.string().optional(),
     theme: z.unknown().optional(),
     previewBase: z.record(z.union([z.string(), z.literal(false)])).optional(),
     previewPrefix: previewPrefixSchema.optional(),
@@ -73,8 +73,8 @@ export const CanopyConfigSchema = z
     defaultBranchAccess: defaultBranchAccessSchema,
     defaultPathAccess: defaultPathAccessSchema,
     // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
-    // unset must stay undefined after parsing so dev mode can detect the fork
-    // point from git HEAD (see resolveBaseBranch in utils/git.ts).
+    // unset must stay undefined after parsing so dev and prod can detect the
+    // fork point (see resolveBaseBranch in utils/git.ts).
     defaultBaseBranch: defaultBaseBranchSchema.optional(),
     defaultActiveBranch: z.string().min(1).optional(),
     defaultRemoteName: defaultRemoteNameSchema.optional(),
@@ -103,24 +103,21 @@ export const CanopyConfigSchema = z
     contentRoot: contentRootSchema.default('content'),
     sourceRoot: sourceRootSchema.optional(),
     basePath: basePathSchema,
+    unauthenticatedStatus: z.union([z.literal(401), z.literal(419)]).optional(),
+    danglingReferences: z.enum(['error', 'warn']).optional(),
     editor: editorConfigSchema.optional(),
     authPlugin: z.custom().optional(),
     entryLinkUrl: z.custom().optional(),
     validateEntry: z.custom().optional(),
+    mdxAllow: mdxAllowlistSchema.optional(),
     dev: devConfigSchema.optional(),
 })
     .strict();
 /**
- * Default workspace path for prod mode (used when CANOPYCMS_WORKSPACE_ROOT is not set).
- *
- * WARNING: this fallback assumes a ROOT mount of EFS at /mnt/efs. CanopyCmsService
- * mounts EFS in both the Lambda and the worker THROUGH an access point already
- * rooted at /workspace and therefore sets CANOPYCMS_WORKSPACE_ROOT=/mnt/efs
- * explicitly; if that env were ever unset this default would resolve to
- * /mnt/efs/workspace = EFS:/workspace/workspace (a wrong, nested dir). The CDK
- * always sets the env, so this only bites a hand-rolled misconfiguration.
+ * Default workspace path for prod mode (used when CANOPYCMS_WORKSPACE_ROOT is not set): where
+ * CanopyCmsService mounts the EFS `/workspace` access point in both the Lambda and the worker.
  */
-export const DEFAULT_PROD_WORKSPACE = '/mnt/efs/workspace';
+export const DEFAULT_PROD_WORKSPACE = '/mnt/efs';
 // Note: `mode` has no default by design (SEC-C1) and is intentionally omitted here —
 // operatingModeSchema.parse(undefined) would throw.
 //

package/dist/config/schemas/field.d.ts

@@ -2,6 +2,7 @@
  * Zod schemas for field configuration validation.
  */
 import { z } from 'zod';
+import type { MdxAllowlist } from '../types.js';
 export declare const selectOptionSchema: z.ZodUnion<[z.ZodString, z.ZodObject<{
     label: z.ZodString;
     value: z.ZodString;
@@ -22,6 +23,8 @@ export declare const referenceOptionSchema: z.ZodUnion<[z.ZodString, z.ZodObject
     value: string;
     label: string;
 }>]>;
+/** Strict, so a misspelt key is an error rather than a silently wider policy. */
+export declare const mdxAllowlistSchema: z.ZodType<MdxAllowlist>;
 export declare const imageFieldSchema: z.ZodObject<{
     name: z.ZodString;
     label: z.ZodOptional<z.ZodString>;

package/dist/config/schemas/field.js

@@ -2,7 +2,8 @@
  * Zod schemas for field configuration validation.
  */
 import { z } from 'zod';
-import { primitiveFieldTypes, fieldTypes } from '../types.js';
+import { fieldTypes, markdownFieldTypes, primitiveFieldTypes } from '../types.js';
+import { SAFE_HTML_TAGS, isComponentName, isRefusedComponentProp, markdownFieldOptionsError, } from '../../validation/mdx-allowlist.js';
 const fieldBaseSchema = z.object({
     name: z.string().min(1),
     label: z.string().optional(),
@@ -27,7 +28,50 @@ export const referenceOptionSchema = z.union([
     }),
 ]);
 const primitiveFieldSchema = fieldBaseSchema.extend({
-    type: z.enum(primitiveFieldTypes),
+    type: z.enum(primitiveFieldTypes).exclude([...markdownFieldTypes]),
+    // Listed so a parse keeps it (zod strips unknown keys); which fields may carry it is
+    // `ensureStampOnPublishPlacement`'s call (config/validation.ts).
+    stampOnPublish: z.boolean().optional(),
+});
+const mdxPropAllowSchema = z.union([
+    z.literal(true),
+    z.literal('string'),
+    z.object({ type: z.literal('string'), maxLength: z.number().int().min(1).optional() }).strict(),
+    z.array(z.union([z.string(), z.number(), z.boolean()])).min(1),
+]);
+/** Strict, so a misspelt key is an error rather than a silently wider policy. */
+export const mdxAllowlistSchema = z
+    .object({
+    components: z
+        .record(z.string().refine(isComponentName, {
+        message: 'must be a component name: capitalised, with no dot, and not MDXContent or MDXLayout',
+    }), z
+        .object({
+        props: z
+            .record(z
+            .string()
+            .min(1)
+            .refine((name) => !isRefusedComponentProp(name), {
+            message: 'event handlers, srcdoc and dangerouslySetInnerHTML are always refused',
+        }), mdxPropAllowSchema)
+            .optional(),
+    })
+        .strict())
+        .optional(),
+    htmlTags: z
+        .array(z.string().refine((tag) => SAFE_HTML_TAGS.has(tag), {
+        message: 'must be one of the HTML tags the base MDX policy accepts',
+    }))
+        .optional(),
+    expressions: z.boolean().optional(),
+    fragments: z.boolean().optional(),
+})
+    .strict();
+const markdownFieldSchema = fieldBaseSchema.extend({
+    type: z.enum(markdownFieldTypes),
+    executable: z.boolean().optional(),
+    renderAs: z.literal('mdx').optional(),
+    mdxAllow: mdxAllowlistSchema.optional(),
 });
 // "W:H" aspect ratio, e.g. "16:9" or "1:1" — positive integers on both sides,
 // no leading zeros (leading zero would parse as `0` via Number(), which the
@@ -82,6 +126,7 @@ const objectFieldSchema = fieldBaseSchema.extend({
     type: z.literal('object'),
     fields: z.array(z.lazy(() => fieldHolder[0])).min(1),
     itemTitleField: z.string().min(1).optional(),
+    itemLabel: z.string().trim().min(1).optional(),
 });
 // Inline group field: visual grouping only, no data nesting
 const inlineGroupFieldSchema = z.object({
@@ -101,15 +146,24 @@ const customFieldSchema = z.lazy(() => fieldBaseSchema
     }),
 })
     .passthrough());
-const knownFieldSchema = z.discriminatedUnion('type', [
+const knownFieldSchema = z
+    .discriminatedUnion('type', [
     primitiveFieldSchema,
+    markdownFieldSchema,
     selectFieldSchema,
     referenceFieldSchema,
     imageFieldSchema,
     objectFieldSchema,
     blockFieldSchema,
     inlineGroupFieldSchema,
-]);
+])
+    .superRefine((field, ctx) => {
+    if (field.type !== 'markdown' && field.type !== 'mdx')
+        return;
+    const message = markdownFieldOptionsError(field);
+    if (message !== undefined)
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message });
+});
 const fieldSchema = z.lazy(() => z.union([knownFieldSchema, customFieldSchema]));
 fieldHolder[0] = fieldSchema;
 export { fieldSchema };