canopycms 0.0.68-int.98 → 0.1.0

package/dist/api/assets.js

@@ -4,8 +4,8 @@ import { ASSET_PREFIXES } from '../assets/keys.js';
 import { ALLOWED_UPLOAD_CONTENT_TYPES } from '../assets/pipeline.js';
 import { finalizeStagedUpload } from '../assets/finalize.js';
 import { assetSrc } from '../assets/asset-src.js';
-import { formatDirectives, parseTransformPath } from '../assets/transform-directives.js';
-import { applyTransform } from '../assets/transform.js';
+import { canonicalizeTransformPath } from '../assets/transform-directives.js';
+import { storeTransform, TRANSFORM_CACHE_CONTROL } from '../assets/materialize.js';
 import { isAdmin } from '../authorization/helpers.js';
 function toAssetRecord(meta) {
     return { ...meta, src: assetSrc(meta) };
@@ -194,9 +194,9 @@ const listAssetsHandler = async (ctx, _req, params) => {
  * `uploadedBy` records the FIRST uploader only: finalizeAsset dedups on content hash, so a second
  * person uploading an identical file gains no delete rights over it — benign (a 403 where they
  * expected success, never the reverse; see
- * .claude/future-tasks/asset-listing-cross-branch-exposure.md).
+ * safeinsights/canopycms#572).
  *
- * Coupled to the blob-GC follow-up in asset-review-followups.md: this permission is safe because
+ * Coupled to the blob-GC follow-up in safeinsights/canopycms#575: this permission is safe because
  * delete is a de-list, not a destroy — nothing another branch references breaks. If GC ever makes
  * delete destroy the blob, this needs a reference check too.
  */
@@ -212,63 +212,41 @@ const deleteAssetHandler = async (ctx, req, params) => {
     await ctx.assetStore.deleteMeta(params.key);
     return { ok: true, status: 200, data: { deleted: true } };
 };
-/** Cache-Control applied to every transform output this route writes/serves - matches finalize.ts's PUBLIC_CACHE_CONTROL for static public objects. */
-const TRANSFORM_CACHE_CONTROL = 'public, max-age=31536000, immutable';
 /**
- * Lazy dev-mode emulation of the prod transform Lambda (reuses `parseTransformPath`/
- * `formatDirectives`/`applyTransform` unchanged): parse, load the original, transform, write the
- * result back under its CANONICAL key (so a non-canonically-ordered directive string still
- * dedupes with any equivalent request), then serve the bytes just computed.
- *
- * `key` here already starts with `assets/t/` and already missed `rawAssetHandler`'s cache-hit
- * `readPublicObject` check.
+ * The largest body this route returns inline. The CMS Lambda's Function URL buffers its response
+ * and caps it at 6 MiB after base64 encoding, which inflates by 4/3, so 4 MiB leaves headroom.
+ * Same bound and reasoning as the transform Lambda's `INLINE_BODY_LIMIT_BYTES`.
  */
-async function serveLazyTransform(assetStore, key) {
-    const rest = key.slice(ASSET_PREFIXES.transform.length + 1);
-    const parsed = parseTransformPath(rest.split('/'));
-    if (!parsed.ok) {
-        return { ok: false, status: 400, error: parsed.error };
-    }
-    const meta = await assetStore.getMeta(parsed.hash32);
-    if (!meta) {
-        return { ok: false, status: 404, error: 'Not found' };
-    }
-    if (meta.kind !== 'raster') {
-        return { ok: false, status: 400, error: 'Not a raster asset - svg/pdf are served statically' };
-    }
-    // The slug is decorative in the URL but load-bearing in the stored key, so it must equal the
-    // asset's real slug — the parser only enforces `[a-z0-9-]+`, and any other string that passes
-    // it aliases the same image into a new cache key. Mirrors the prod transform Lambda's check
-    // (assets/asset-url.ts); the two paths must agree, or dev accepts URLs prod 404s.
-    if (parsed.slug !== meta.slug) {
-        return { ok: false, status: 404, error: 'Not found' };
-    }
-    // When the URL omits an explicit `f=` format, the transform preserves the
-    // source format, so the URL's `{ext}` must match the source's real ext
-    // exactly - the parser alone can't check this (it doesn't know the source
-    // format until this meta lookup).
-    const requestedFormat = parsed.directives.identity ? undefined : parsed.directives.format;
-    if (requestedFormat === undefined && parsed.ext !== meta.ext) {
-        return { ok: false, status: 400, error: 'Extension does not match the source format' };
-    }
-    const original = await assetStore.readOriginal(parsed.hash32);
-    if (!original) {
-        return { ok: false, status: 404, error: 'Not found' };
-    }
-    const transformed = await applyTransform({ data: original.data, ext: original.ext }, parsed.directives);
+const INLINE_BODY_LIMIT_BYTES = 4 * 1024 * 1024;
+/**
+ * A 302 to a presigned store URL. `no-store` because the URL expires: a cached redirect would
+ * outlive it, and a browser revisiting the page would follow it to a 403.
+ */
+function presignedRedirect(url) {
+    return {
+        kind: 'binary',
+        status: 302,
+        body: new Uint8Array(),
+        headers: { location: url, cacheControl: 'no-store' },
+    };
+}
+/**
+ * This route's own lazy transform: `storeTransform` computes and stores the output, then this
+ * serves the bytes just computed. `parsed` is the canonical parse from `canonicalizeTransformPath`,
+ * and `canonicalKey` already missed `rawAssetHandler`'s cache check.
+ */
+async function serveLazyTransform(assetStore, parsed, canonicalKey) {
+    const transformed = await storeTransform(assetStore, parsed, canonicalKey);
     if (!transformed.ok) {
-        // Pass the real status through instead of flattening every rejection to 502:
-        // `applyTransform` already distinguishes client-input errors (400/413) from a genuine decode
-        // failure (422), none of which are "this server failed." Mirrors the prod transform Lambda.
-        return { ok: false, status: transformed.status, error: transformed.error };
+        // The real status, not a flat 502: none of these rejections is "this server failed".
+        const error = transformed.status === 404 ? 'Not found' : transformed.error;
+        return { ok: false, status: transformed.status, error };
+    }
+    if (transformed.data.byteLength > INLINE_BODY_LIMIT_BYTES && assetStore.presignPublicObjectRead) {
+        const url = await assetStore.presignPublicObjectRead(canonicalKey);
+        if (url)
+            return presignedRedirect(url);
     }
-    const canonicalKey = `${ASSET_PREFIXES.transform}/${formatDirectives(parsed.directives)}/${parsed.hash32}/${parsed.slug}.${parsed.ext}`;
-    await assetStore.putPublicObject({
-        key: canonicalKey,
-        data: transformed.data,
-        contentType: transformed.contentType,
-        cacheControl: TRANSFORM_CACHE_CONTROL,
-    });
     return {
         kind: 'binary',
         status: 200,
@@ -276,16 +254,47 @@ async function serveLazyTransform(assetStore, key) {
         headers: { contentType: transformed.contentType, cacheControl: TRANSFORM_CACHE_CONTROL },
     };
 }
+/** A redirect to, or the bytes of, the public object stored at `key`; `null` when there is none. */
+async function serveStoredObject(assetStore, key) {
+    if (assetStore.presignPublicObjectRead) {
+        const url = await assetStore.presignPublicObjectRead(key);
+        return url ? presignedRedirect(url) : null;
+    }
+    const object = await assetStore.readPublicObject(key);
+    if (!object)
+        return null;
+    return {
+        kind: 'binary',
+        status: 200,
+        body: object.data,
+        headers: {
+            contentType: object.contentType,
+            contentDisposition: object.contentDisposition,
+            cacheControl: object.cacheControl,
+        },
+    };
+}
 /**
  * Serve a public asset object (sanitized svg/pdf finalize wrote, or a cached transform output)
- * for dev-mode `/assets/*` rewrites. Hand-built (not `defineEndpoint`), not registered in
- * `ASSET_ROUTES`/the client generator: this returns raw bytes (`CanopyBinaryResponse`), not a
- * JSON envelope, so a generated `response.json()` client method would be wrong. Consumers hit
- * this route directly (`<img>`/`<a>` src, or a framework rewrite), never through `client.ts`.
+ * to the editor, the live preview, and `withCanopy`'s `/assets/*` rewrite. Hand-built (not
+ * `defineEndpoint`), not registered in `ASSET_ROUTES`/the client generator: this returns raw bytes
+ * (`CanopyBinaryResponse`), not a JSON envelope, so a generated `response.json()` client method
+ * would be wrong. Consumers hit this route directly (`<img>`/`<a>` src, or a framework rewrite),
+ * never through `client.ts`.
  *
- * Transform outputs (`assets/t/...`) are cache-checked like any other public object first — only
- * a MISS under `assets/t/` falls through to `serveLazyTransform`. Mirrors prod (CloudFront
- * origin-group -> S3 -> Lambda on miss).
+ * A transform key (`assets/t/...`) is resolved to its canonical key first, and that key is what is
+ * cache-checked and, on a miss, computed by `serveLazyTransform`. Mirrors `AssetSupport`'s lazy
+ * mode (CloudFront origin-group -> S3 -> Lambda on miss), except that a non-canonical spelling is
+ * served the canonical bytes rather than the Lambda's 301: this route is authenticated, and
+ * redirecting to `/assets/t/...` would bounce the request onto the public path.
+ *
+ * A stored object on a store that can presign (S3) is answered with a 302 to a presigned GET, so
+ * its bytes never pass through this process: the CMS Lambda is concurrency-capped and uncached,
+ * the live preview asks for every image on a page at once, and its Function URL cannot return a
+ * body over about 6 MiB. The redirect never targets the public `/assets/...` URL, because whether
+ * that URL reaches this route again is topology: `withCanopy` rewrites `/assets/:path*` here, so
+ * on any deployment where Next serves `/assets` the redirect would loop. Other stores stream the
+ * bytes, as does a fresh transform no larger than `INLINE_BODY_LIMIT_BYTES`.
  */
 const rawAssetHandler = async (ctx, _req, params) => {
     if (!ctx.assetStore)
@@ -300,23 +309,22 @@ const rawAssetHandler = async (ctx, _req, params) => {
     if (!key.startsWith(publicPrefix) || key.includes('..')) {
         return { ok: false, status: 404, error: 'Not found' };
     }
-    const object = await ctx.assetStore.readPublicObject(key);
-    if (object) {
-        return {
-            kind: 'binary',
-            status: 200,
-            body: object.data,
-            headers: {
-                contentType: object.contentType,
-                contentDisposition: object.contentDisposition,
-                cacheControl: object.cacheControl,
-            },
-        };
+    let readKey = key;
+    let transform;
+    if (key.startsWith(transformPrefix)) {
+        const canonical = canonicalizeTransformPath(key.slice(transformPrefix.length).split('/'), 'any');
+        if (!canonical.ok)
+            return { ok: false, status: 400, error: canonical.error };
+        readKey = `${transformPrefix}${canonical.canonicalPath}`;
+        transform = canonical;
     }
-    if (!key.startsWith(transformPrefix)) {
+    const stored = await serveStoredObject(ctx.assetStore, readKey);
+    if (stored)
+        return stored;
+    if (!transform) {
         return { ok: false, status: 404, error: 'Not found' };
     }
-    return serveLazyTransform(ctx.assetStore, key);
+    return serveLazyTransform(ctx.assetStore, transform, readKey);
 };
 // Deliberately no 'writableBranch' guard on any endpoint below: none take a
 // :branch param -- the asset store is branch-agnostic (a single global store,
@@ -325,6 +333,7 @@ const presignAsset = defineEndpoint({
     namespace: 'assets',
     name: 'presign',
     method: 'POST',
+    readOnly: true,
     path: '/assets/presign',
     body: presignAssetBodySchema,
     bodyType: 'PresignAssetBody',
@@ -353,6 +362,7 @@ const finalizeAsset = defineEndpoint({
 const uploadProxied = defineEndpoint({
     namespace: 'assets',
     name: 'uploadProxied',
+    clientTimeout: 'long',
     method: 'POST',
     path: '/assets/upload',
     bodyFormat: 'multipart',

package/dist/api/branch-create-window.d.ts

@@ -0,0 +1,12 @@
+/**
+ * How long a create of a branch name its own creator just made answers with that branch rather
+ * than a 409, so a request killed between publishing the branch and responding is safe to retry.
+ * Dependency-free: the editor applies the same rule when it settles an unanswered create.
+ * @internal Exported for tests.
+ */
+export declare const IDEMPOTENT_CREATE_WINDOW_MS: number;
+/** Whether `branch` can be the result of `userId`'s create: theirs, and inside the window. */
+export declare function isCreatorsRecentBranch(branch: {
+    createdBy: string;
+    createdAt: string;
+}, userId: string | undefined): boolean;

package/dist/api/branch-create-window.js

@@ -0,0 +1,13 @@
+/**
+ * How long a create of a branch name its own creator just made answers with that branch rather
+ * than a 409, so a request killed between publishing the branch and responding is safe to retry.
+ * Dependency-free: the editor applies the same rule when it settles an unanswered create.
+ * @internal Exported for tests.
+ */
+export const IDEMPOTENT_CREATE_WINDOW_MS = 5 * 60_000;
+/** Whether `branch` can be the result of `userId`'s create: theirs, and inside the window. */
+export function isCreatorsRecentBranch(branch, userId) {
+    return (userId !== undefined &&
+        branch.createdBy === userId &&
+        Date.now() - Date.parse(branch.createdAt) < IDEMPOTENT_CREATE_WINDOW_MS);
+}

package/dist/api/branch-merge.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import type { ApiResponse } from './types.js';
-/** @internal No importer; deletion candidate in knip-no-importer-deletion-candidates.md. */
+/** @internal No importer; deletion candidate in safeinsights/canopycms#725. */
 export interface MarkAsMergedParams {
     branch: string;
 }

package/dist/api/branch-merge.js

@@ -54,7 +54,7 @@ const markAsMergedHandler = async (gc, ctx, _req, params) => {
     //     console.error(`CanopyCMS: Failed to delete remote branch ${branchName}:`, err)
     //   }
     // }
-    // Comments.json is already in the branch workspace at .canopycms/comments.json
+    // Comments.json is already in the branch workspace at .canopy-meta/comments.json
     // It will be preserved with the archived branch - no action needed
     return {
         ok: true,

package/dist/api/branch-review.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { BranchResponse } from './branch.js';
+import { type BranchListItemResponse } from './branch.js';
 export declare const requestChanges: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
 }, "strip", z.ZodTypeAny, {
@@ -10,7 +10,7 @@ export declare const requestChanges: import("./route-builder.js").RouteDefinitio
     branch: string & {
         readonly __brand: "BranchName";
     };
-}>, undefined, BranchResponse>;
+}>, undefined, BranchListItemResponse>;
 export declare const approveBranch: import("./route-builder.js").RouteDefinition<z.ZodObject<{
     branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
 }, "strip", z.ZodTypeAny, {
@@ -21,4 +21,4 @@ export declare const approveBranch: import("./route-builder.js").RouteDefinition
     branch: string & {
         readonly __brand: "BranchName";
     };
-}>, undefined, BranchResponse>;
+}>, undefined, BranchListItemResponse>;

package/dist/api/branch-review.js

@@ -1,8 +1,9 @@
 import { branchParamSchema } from './validators.js';
+import { toBranchListItem } from './branch.js';
 import { getBranchMetadataFileManager } from '../branch-metadata.js';
 import { defineEndpoint } from './route-builder.js';
 import { syncConvertToDraft } from './github-sync.js';
-const requestChangesHandler = async (gc, ctx, _req, _params) => {
+const requestChangesHandler = async (gc, ctx, req, _params) => {
     const { branchContext } = gc;
     if (branchContext.branch.status !== 'submitted') {
         return {
@@ -16,10 +17,14 @@ const requestChangesHandler = async (gc, ctx, _req, _params) => {
     const updated = await meta.save({
         branch: { name: branchContext.branch.name, status: 'editing' },
     });
-    // TODO: Optionally record comment in .canopycms/comments.json when comment system is implemented
-    return { ok: true, status: 200, data: { branch: updated.branch } };
+    // TODO: Optionally record comment in .canopy-meta/comments.json when comment system is implemented
+    return {
+        ok: true,
+        status: 200,
+        data: { branch: toBranchListItem(ctx.services.config, updated.branch, req.user) },
+    };
 };
-const approveBranchHandler = async (gc, _ctx, _req, _params) => {
+const approveBranchHandler = async (gc, ctx, req, _params) => {
     const { branchContext } = gc;
     if (branchContext.branch.status !== 'submitted') {
         return {
@@ -33,7 +38,11 @@ const approveBranchHandler = async (gc, _ctx, _req, _params) => {
         branch: { name: branchContext.branch.name, status: 'approved' },
     });
     // TODO: Optionally call githubService.approvePullRequest() when GitHub integration is needed
-    return { ok: true, status: 200, data: { branch: updated.branch } };
+    return {
+        ok: true,
+        status: 200,
+        data: { branch: toBranchListItem(ctx.services.config, updated.branch, req.user) },
+    };
 };
 export const requestChanges = defineEndpoint({
     namespace: 'workflow',
@@ -43,7 +52,7 @@ export const requestChanges = defineEndpoint({
     params: branchParamSchema,
     // body/bodyType removed: comment field was declared but never stored.
     // Re-add when comment storage is implemented (see TODO in handler).
-    responseType: 'BranchResponse',
+    responseType: 'BranchListItemResponse',
     response: {},
     defaultMockData: {
         branch: {
@@ -64,7 +73,7 @@ export const approveBranch = defineEndpoint({
     method: 'POST',
     path: '/:branch/approve',
     params: branchParamSchema,
-    responseType: 'BranchResponse',
+    responseType: 'BranchListItemResponse',
     response: {},
     defaultMockData: {
         branch: {

package/dist/api/branch-status.d.ts

@@ -1,6 +1,16 @@
 import { z } from 'zod';
-import type { BranchResponse } from './branch.js';
+import type { ApiResponse } from './types.js';
+import { type BranchListItem, type BranchListItemResponse } from './branch.js';
+import type { StampedEntry } from '../stamp-on-publish.js';
 export type { BranchMergeResponse } from './branch-merge.js';
+/**
+ * A submit's answer: the branch, plus the entries the submit stamped (stamp-on-publish.ts) when
+ * there were any, so the editor can carry its open forms and drafts onto their new versions.
+ */
+export type SubmitBranchResponse = ApiResponse<{
+    branch: BranchListItem;
+    stamped?: StampedEntry[];
+}>;
 export declare const WORKFLOW_ROUTES: {
     readonly getStatus: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
@@ -12,7 +22,7 @@ export declare const WORKFLOW_ROUTES: {
         branch: string & {
             readonly __brand: "BranchName";
         };
-    }>, undefined, BranchResponse>;
+    }>, undefined, BranchListItemResponse>;
     readonly submit: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
@@ -23,7 +33,7 @@ export declare const WORKFLOW_ROUTES: {
         branch: string & {
             readonly __brand: "BranchName";
         };
-    }>, undefined, BranchResponse>;
+    }>, undefined, SubmitBranchResponse>;
     readonly withdraw: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
@@ -34,7 +44,7 @@ export declare const WORKFLOW_ROUTES: {
         branch: string & {
             readonly __brand: "BranchName";
         };
-    }>, undefined, BranchResponse>;
+    }>, undefined, BranchListItemResponse>;
     readonly requestChanges: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
@@ -45,7 +55,7 @@ export declare const WORKFLOW_ROUTES: {
         branch: string & {
             readonly __brand: "BranchName";
         };
-    }>, undefined, BranchResponse>;
+    }>, undefined, BranchListItemResponse>;
     readonly approve: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {
@@ -56,7 +66,7 @@ export declare const WORKFLOW_ROUTES: {
         branch: string & {
             readonly __brand: "BranchName";
         };
-    }>, undefined, BranchResponse>;
+    }>, undefined, BranchListItemResponse>;
     readonly markMerged: import("./route-builder.js").RouteDefinition<z.ZodObject<{
         branch: z.ZodType<import("../paths/index.js").BranchName, z.ZodTypeDef, import("../paths/index.js").BranchName>;
     }, "strip", z.ZodTypeAny, {

package/dist/api/branch-status.js

@@ -1,4 +1,5 @@
 import { branchParamSchema } from './validators.js';
+import { toBranchListItem } from './branch.js';
 import { getBranchMetadataFileManager } from '../branch-metadata.js';
 import { withdrawBranch } from './branch-withdraw.js';
 import { requestChanges, approveBranch } from './branch-review.js';
@@ -10,9 +11,15 @@ import { getErrorMessage, redactCredentials, sanitizeErrorMessage } from '../uti
 import { isNonFastForwardRejection } from '../utils/git.js';
 import { ContentWriteLockBusyError } from '../utils/content-write-lock.js';
 import { submissionEditorFromUser } from '../submission-attribution.js';
-const getBranchStatusHandler = async (gc, _ctx, _req, _params) => {
+import { NothingToSubmitError } from '../services.js';
+import { baseBranchOf } from '../utils/base-branch.js';
+const getBranchStatusHandler = async (gc, ctx, req, _params) => {
     const { branchContext } = gc;
-    return { ok: true, status: 200, data: { branch: branchContext.branch } };
+    return {
+        ok: true,
+        status: 200,
+        data: { branch: toBranchListItem(ctx.services.config, branchContext.branch, req.user) },
+    };
 };
 const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
     const { branchContext } = gc;
@@ -28,7 +35,7 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
         return {
             ok: false,
             status: 403,
-            error: 'Only the branch creator or users with explicit branch access can submit this branch',
+            error: 'You do not have permission to submit this branch for review.',
         };
     }
     // Only an 'editing' branch may be submitted, mirroring
@@ -37,9 +44,8 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
     // (merged) branch could be re-submitted by its creator, re-stamping it
     // 'submitted' and overwriting the merged PR's title/body.
     //
-    // Fails closed on a missing status (branch.json is read with a bare
-    // JSON.parse, no schema validation, so a damaged file can yield
-    // `undefined`) -- same as runWritableBranchGuard's unreadable-status arm.
+    // Fails closed on a missing status, same as runWritableBranchGuard's
+    // unreadable-status arm.
     const status = branchContext.branch.status;
     if (status !== 'editing') {
         return {
@@ -52,12 +58,22 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
     }
     // Commit and push changes
     const submitter = submissionEditorFromUser(req.user);
+    const { authPlugin } = ctx;
     let changedPaths;
+    let editors;
+    let stamped;
     try {
         ;
-        ({ changedPaths } = await ctx.services.submitBranch({ context: branchContext, submitter }));
+        ({ changedPaths, editors, stamped } = await ctx.services.submitBranch({
+            context: branchContext,
+            submitter,
+            lookupEditor: authPlugin ? (id) => authPlugin.getUserMetadata(id) : undefined,
+        }));
     }
     catch (err) {
+        if (err instanceof NothingToSubmitError) {
+            return { ok: false, status: 400, error: err.message };
+        }
         // Retriable either way: a resubmit commits nothing new and pushes only
         // what has not reached the remote.
         if (err instanceof ContentWriteLockBusyError) {
@@ -106,13 +122,34 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
         };
     }
     // Create or update PR (sync via githubService, or async via task queue)
-    const prResult = await syncSubmitPr(ctx, branchContext, { submitter, changedPaths });
-    // Update metadata with status and PR info
+    const submittedAt = new Date().toISOString();
+    const prResult = await syncSubmitPr(ctx, branchContext, {
+        submitter,
+        editors,
+        changedPaths,
+        submittedAt,
+    });
     const meta = getBranchMetadataFileManager(branchContext.branchRoot, branchContext.baseRoot);
+    const pushed = prResult.pushedToGitHub ? { pushedToGitHubAt: submittedAt } : {};
+    // GitHub found nothing between the pushed branch and its base, though the diff above found
+    // changes: GitHub's base can already hold them, or the diff could not be computed. The branch
+    // stays editable; the stamp records that it is now on GitHub, for delete.
+    if (prResult.nothingToSubmit) {
+        await meta.save({ branch: { name: branchContext.branch.name, ...pushed } });
+        const base = branchContext.branch.baseBranch ?? baseBranchOf(ctx.services.config);
+        return {
+            ok: false,
+            status: 400,
+            error: new NothingToSubmitError(branchContext.branch.name, base).message,
+        };
+    }
     const updated = await meta.save({
         branch: {
             name: branchContext.branch.name,
             status: 'submitted',
+            submittedAt,
+            ...pushed,
+            syncFailureReason: prResult.syncFailureReason,
             pullRequestUrl: prResult.prUrl ?? branchContext.branch.pullRequestUrl,
             pullRequestNumber: prResult.prNumber ?? branchContext.branch.pullRequestNumber,
             ...(prResult.syncStatus !== undefined ? { syncStatus: prResult.syncStatus } : {}),
@@ -122,7 +159,14 @@ const submitBranchForMergeHandler = async (gc, ctx, req, _params) => {
             rebaseFailure: undefined,
         },
     });
-    return { ok: true, status: 200, data: { branch: updated.branch } };
+    return {
+        ok: true,
+        status: 200,
+        data: {
+            branch: toBranchListItem(ctx.services.config, updated.branch, req.user),
+            ...(stamped.length > 0 ? { stamped } : {}),
+        },
+    };
 };
 const getBranchStatus = defineEndpoint({
     namespace: 'workflow',
@@ -130,7 +174,7 @@ const getBranchStatus = defineEndpoint({
     method: 'GET',
     path: '/:branch/status',
     params: branchParamSchema,
-    responseType: 'BranchResponse',
+    responseType: 'BranchListItemResponse',
     response: {},
     defaultMockData: {
         branch: {
@@ -148,10 +192,11 @@ const getBranchStatus = defineEndpoint({
 const submitBranchForMerge = defineEndpoint({
     namespace: 'workflow',
     name: 'submit',
+    clientTimeout: 'long',
     method: 'POST',
     path: '/:branch/submit',
     params: branchParamSchema,
-    responseType: 'BranchResponse',
+    responseType: 'SubmitBranchResponse',
     response: {},
     defaultMockData: {
         branch: {

package/dist/api/branch-withdraw.d.ts

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import type { BranchResponse } from './branch.js';
+import { type BranchListItemResponse } from './branch.js';
 /**
  * Withdraw a submitted branch, converting the PR to draft and unlocking editing
  *
@@ -19,4 +19,4 @@ export declare const withdrawBranch: import("./route-builder.js").RouteDefinitio
     branch: string & {
         readonly __brand: "BranchName";
     };
-}>, undefined, BranchResponse>;
+}>, undefined, BranchListItemResponse>;

package/dist/api/branch-withdraw.js

@@ -1,4 +1,5 @@
 import { branchParamSchema } from './validators.js';
+import { toBranchListItem } from './branch.js';
 import { getBranchMetadataFileManager } from '../branch-metadata.js';
 import { defineEndpoint } from './route-builder.js';
 import { canPerformWorkflowAction, getBranchProtection } from '../authorization/index.js';
@@ -18,7 +19,7 @@ const withdrawBranchHandler = async (gc, ctx, req, _params) => {
         return {
             ok: false,
             status: 403,
-            error: 'Only the branch creator or users with explicit branch access can withdraw this branch',
+            error: 'You do not have permission to withdraw this branch from review.',
         };
     }
     // 'approved' is accepted alongside 'submitted' because withdraw is its only
@@ -60,7 +61,11 @@ const withdrawBranchHandler = async (gc, ctx, req, _params) => {
                 : {}),
         },
     });
-    return { ok: true, status: 200, data: { branch: updated.branch } };
+    return {
+        ok: true,
+        status: 200,
+        data: { branch: toBranchListItem(ctx.services.config, updated.branch, req.user) },
+    };
 };
 /**
  * Withdraw a submitted branch, converting the PR to draft and unlocking editing
@@ -77,7 +82,7 @@ export const withdrawBranch = defineEndpoint({
     method: 'POST',
     path: '/:branch/withdraw',
     params: branchParamSchema,
-    responseType: 'BranchResponse',
+    responseType: 'BranchListItemResponse',
     response: {},
     defaultMockData: {
         branch: {