canopycms 0.12.0 → 0.13.0

package/dist/services.js

@@ -17,6 +17,7 @@
  */
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { getConfigDefaults } from './config/index.js';
 import { createCheckBranchAccess, createCheckContentAccess, createContentAccessChecker, loadPathPermissions, } from './authorization/index.js';
 import { GitManager, GitRemoteRefMissingError } from './git-manager.js';
@@ -30,14 +31,15 @@ import { enqueueTask } from './task-queue/cms-task-queue.js';
 import { getTaskQueueDir } from './task-queue/task-queue-config.js';
 import { baseBranchOf } from './utils/base-branch.js';
 import { shortNameOf } from './branch-param.js';
-import { detectHeadBranch, isCanopyInternalPath } from './utils/git.js';
+import { detectHeadBranch, isCanopyInternalPath, isRebaseInProgress } from './utils/git.js';
 import { readsFromCheckout } from './build-mode.js';
 import { timeRequestPhase } from './utils/request-timing.js';
 import { appendTrailers, buildEditorTrailers, describeEditors, MAX_LISTED_ENTRIES, } from './submission-attribution.js';
 import { getBranchMetadataFileManager, recordBranchEditor } from './branch-metadata.js';
 import { readBranchMetadataFile } from './branch-metadata-file.js';
 import { getErrorMessage, redactCredentials } from './utils/error.js';
-import { withContentWriteLock } from './utils/content-write-lock.js';
+import { ContentWriteLockBusyError, withContentWriteLock } from './utils/content-write-lock.js';
+import { assertNoOpenConflicts } from './merge-conflicts.js';
 import { ContentStore } from './content-store.js';
 import { entryLogicalPathOfFile } from './content-id-index.js';
 import { stampNewEntries } from './stamp-on-publish.js';
@@ -138,6 +140,33 @@ export const createTestCanopyServices = async (config, options = {}) => {
     };
     return _createCanopyServicesInternal(testConfig, options);
 };
+/**
+ * A remote URL's local path as git reads it: a `file://` URL, a drive path, or a path relative to
+ * `cwd` with its links resolved; undefined for a scheme or git's scp form (a colon before any
+ * slash), which name another host.
+ */
+const localPathOf = async (url, cwd) => {
+    if (url.startsWith('file://')) {
+        try {
+            return fileURLToPath(url);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    if (process.platform === 'win32' && /^[A-Za-z]:[\\/]/.test(url))
+        return path.resolve(url);
+    const colon = url.indexOf(':');
+    const slash = url.search(/[\\/]/);
+    if (colon >= 0 && (slash < 0 || colon < slash))
+        return undefined;
+    return path.resolve(await fs.realpath(cwd).catch(() => cwd), url);
+};
+/** Whether two paths name one directory, symlinks resolved where they exist. */
+const samePath = async (a, b) => {
+    const real = (p) => fs.realpath(p).catch(() => path.resolve(p));
+    return (await real(a)) === (await real(b));
+};
 /** Shared implementation; call createCanopyServices or createTestCanopyServices. */
 async function _createCanopyServicesInternal(config, options) {
     // Mode-specific requirements, e.g. prod's git bot credentials for GitHub.
@@ -213,10 +242,81 @@ async function _createCanopyServicesInternal(config, options) {
         // lands on its detached head with the rebase's half-resolved index, and the
         // rebase's `--abort` discards it.
         await withContentWriteLock(options.context.branchRoot, async () => {
+            await refuseDuringRebase(options.context.branchRoot);
             await git.add(options.files);
             await git.commit(options.message);
         });
     };
+    /**
+     * Inside the content-write lock, before a commit: a rebase left by a worker that died holds no
+     * lock, and its recovery (`rebase --abort`, worker/rebase.ts) would reset the branch past the
+     * commit, silently. In prod the worker clears it on its next cycle, so this is a retry.
+     */
+    const refuseDuringRebase = async (branchRoot) => {
+        if (await isRebaseInProgress(branchRoot))
+            throw new ContentWriteLockBusyError();
+    };
+    /**
+     * Commit every saved change but canopycms's own state, if there is one, with trailers naming
+     * `credited` and then the editors who saved since the last commit. Runs inside the caller's
+     * content-write lock. Resolves whether it committed.
+     */
+    const commitSavedChanges = async (git, status, commit) => {
+        if (!status.files.some((f) => !isCanopyInternalPath(f.path)))
+            return false;
+        await git.addAllExceptCanopyState();
+        const committers = commit.uncommitted.map((userId) => commit.named.get(userId) ?? { userId });
+        const trailers = buildEditorTrailers(commit.credited ? [commit.credited, ...committers] : committers, {
+            editedBy: config.gitEditedByTrailers ?? true,
+            coAuthoredBy: config.gitCoAuthoredByTrailers ?? false,
+        });
+        await git.commit(appendTrailers(commit.message, trailers));
+        return true;
+    };
+    /** Clear the editors a commit named; a failure leaves them for the next commit to name again. */
+    const markCommitted = async (context, uncommitted) => {
+        if (uncommitted.length === 0)
+            return;
+        try {
+            await getBranchMetadataFileManager(context.branchRoot, context.baseRoot).markEditorsCommitted(uncommitted);
+        }
+        catch (err) {
+            console.warn(`CanopyCMS: Could not clear the committed editors of ${context.branch.name}:`, getErrorMessage(err));
+        }
+    };
+    /** The editors recorded on the branch, each with the name `lookupEditor` gives. */
+    const namedEditors = async (context, lookupEditor) => new Map((await describeEditors((await readRecordedEditors(context))?.editors ?? [], memoizeLookup(lookupEditor))).map((e) => [e.userId, e]));
+    const commitSavedWork = async (options) => {
+        const git = createGitManagerFor(options.context.branchRoot, {
+            baseBranch: options.context.branch.baseBranch,
+        });
+        await git.ensureAuthor({ name: config.gitBotAuthorName, email: config.gitBotAuthorEmail });
+        // Names are looked up before taking the lock, so a slow auth provider never holds it.
+        const named = await namedEditors(options.context, options.lookupEditor);
+        // [SYNC-C1] Locked for the same reason as submitBranch: a commit landing while a rebase is
+        // stopped on a conflict is discarded by its abort.
+        const committed = await withContentWriteLock(options.context.branchRoot, async () => {
+            await refuseDuringRebase(options.context.branchRoot);
+            // A submit since the caller's read: a branch in review takes no commit until it is withdrawn.
+            const branchStatus = (await readBranchMetadataFile(options.context.branchRoot))?.branch.status;
+            if (branchStatus !== undefined && branchStatus !== 'editing')
+                return false;
+            await git.checkoutBranch(options.context.branch.name);
+            const status = await git.status();
+            const uncommitted = (await readRecordedEditors(options.context))?.uncommittedEditors ?? [];
+            const done = await commitSavedChanges(git, status, {
+                message: options.message,
+                uncommitted,
+                named,
+            });
+            // Inside the lock, as submitBranch does: a save after it would record its editor as still
+            // uncommitted, and this would then clear them with the save left out of the commit.
+            if (done)
+                await markCommitted(options.context, uncommitted);
+            return done;
+        });
+        return committed;
+    };
     /** Runs inside submitBranch's content-write lock; a stamp that fails never blocks the submit. */
     const stampNewEntriesOrWarn = async (context, git) => {
         const contentRoot = services.config.contentRoot || 'content';
@@ -286,6 +386,9 @@ async function _createCanopyServicesInternal(config, options) {
         let recorded = {};
         let stamped = [];
         const submitted = await withContentWriteLock(options.context.branchRoot, async () => {
+            await refuseDuringRebase(options.context.branchRoot);
+            // In the lock, as the worker records a merge's conflicts in it before the merge lands.
+            await assertNoOpenConflicts(options.context.branchRoot);
             await git.checkoutBranch(options.context.branch.name);
             // Before the status read, so the stamp joins this commit even when an earlier attempt
             // already committed the entry and only its push failed.
@@ -303,18 +406,13 @@ async function _createCanopyServicesInternal(config, options) {
             // branch already had unpushed commits from an earlier attempt.
             // canopycms's own state under .canopy-meta/ is never content, so it neither
             // makes a commit worth creating nor gets staged into one.
-            let committed = false;
             const preCommitSha = await git.headSha();
-            if (status.files.some((f) => !isCanopyInternalPath(f.path))) {
-                await git.addAllExceptCanopyState();
-                const committers = uncommitted.map((userId) => named.get(userId) ?? { userId });
-                const trailers = buildEditorTrailers(options.submitter ? [options.submitter, ...committers] : committers, {
-                    editedBy: config.gitEditedByTrailers ?? true,
-                    coAuthoredBy: config.gitCoAuthoredByTrailers ?? false,
-                });
-                await git.commit(appendTrailers(options.message ?? `Submit ${options.context.branch.name}`, trailers));
-                committed = true;
-            }
+            const committed = await commitSavedChanges(git, status, {
+                message: options.message ?? `Submit ${options.context.branch.name}`,
+                credited: options.submitter,
+                uncommitted,
+                named,
+            });
             // The diff runs after the commit so it covers saved-but-uncommitted edits too, and
             // before the push so a branch with nothing to submit never reaches the remote. A diff
             // that cannot be computed lets the submit through: the list only feeds the PR body, and
@@ -333,15 +431,8 @@ async function _createCanopyServicesInternal(config, options) {
                     await git.resetKeepingChanges(preCommitSha);
                 throw new NothingToSubmitError(shortNameOf(config, options.context.branch.name), effectiveBase);
             }
-            // A failure here leaves them uncommitted, so the next commit names them again.
-            if (committed && uncommitted.length > 0) {
-                try {
-                    await getBranchMetadataFileManager(options.context.branchRoot, options.context.baseRoot).markEditorsCommitted(uncommitted);
-                }
-                catch (err) {
-                    console.warn(`CanopyCMS: Could not clear the committed editors of ${options.context.branch.name}:`, getErrorMessage(err));
-                }
-            }
+            if (committed)
+                await markCommitted(options.context, uncommitted);
             if (committed || (await git.hasUnpushedCommits(options.context.branch.name))) {
                 await git.push(options.context.branch.name);
             }
@@ -450,6 +541,29 @@ async function _createCanopyServicesInternal(config, options) {
             };
         }
     };
+    const runBaseUpdateNow = async (context) => {
+        const mode = services.config.mode;
+        const strategy = operatingStrategy(mode);
+        if (!strategy.baseUpdateRunsInRequest()) {
+            throw new Error(`CanopyCMS: in ${mode} mode the worker answers requests for the latest changes, never a request.`);
+        }
+        // baseRoot is the workspace's content-branches directory, where the worker looks.
+        const workspacePath = path.dirname(context.baseRoot);
+        const origin = await createGitManagerFor(context.branchRoot).getRemoteUrl();
+        const originPath = origin && (await localPathOf(origin, context.branchRoot));
+        if (!originPath || !(await samePath(originPath, path.join(workspacePath, 'remote.git')))) {
+            return 'other-remote';
+        }
+        // Loaded only when a run is asked for: a server that never runs one never loads the worker.
+        const { createLocalWorker } = await import('./worker/cms-worker.js');
+        const worker = createLocalWorker({
+            workspacePath,
+            baseBranch: context.branch.baseBranch ?? baseBranchOf(services.config),
+            contentRoot: services.config.contentRoot || 'content',
+            settingsBranch: strategy.getSettingsBranchName(services.config),
+        });
+        return worker.syncBranchNow(context.branch.name);
+    };
     const operatingMode = config.mode;
     const modeStrategy = operatingStrategy(operatingMode);
     const registry = modeStrategy.supportsBranching()
@@ -467,7 +581,9 @@ async function _createCanopyServicesInternal(config, options) {
         githubService,
         bootstrapAdminIds,
         commitFiles,
+        commitSavedWork,
         submitBranch,
+        runBaseUpdateNow,
         commitToSettingsBranch,
         getSettingsBranchRoot,
         recordBranchEditor,

package/dist/task-queue/cms-task-queue.d.ts

@@ -5,7 +5,9 @@
  */
 import type { Task, TaskQueueLogger } from './types.js';
 /** Actions the EC2 worker can execute on behalf of Lambda. */
-export type TaskAction = 'push-and-create-pr' | 'push-and-update-pr' | 'push-and-create-or-update-pr' | 'convert-to-draft' | 'close-pr' | 'delete-remote-branch' | 'push-branch' | 'sync-pr-comments';
+export type TaskAction = 'push-and-create-pr' | 'push-and-update-pr' | 'push-and-create-or-update-pr' | 'convert-to-draft' | 'close-pr' | 'delete-remote-branch' | 'push-branch' | 'sync-pr-comments'
+/** Wake the git sync early for `payload.branch` (base-update.ts). */
+ | 'sync-branch';
 /** A task with a CMS-specific action. */
 export type WorkerTask = Task & {
     action: TaskAction;

package/dist/types.d.ts

@@ -49,6 +49,8 @@ export interface BranchReview {
     };
     /** ISO timestamp of the verdict. */
     at: string;
+    /** The head commit the reviewer's page showed, which the API checked against the clone's. */
+    commit?: string;
 }
 /** What keeps a pull request behind its base. `base` is the branch GitHub says it targets now. */
 export type PullRequestHold = {
@@ -108,16 +110,20 @@ export interface BranchMetadata {
      */
     pushedToGitHubAt?: string;
     /**
-     * The latest editor URL a submit took from its request (editor-url.ts); a submit that took
-     * none, or used config.editorUrl, leaves it as it was. A comment change re-renders the PR's
-     * comment summary with config.editorUrl or this, so a commenter never supplies the links.
+     * The editor URL the latest submit resolved (editor-url.ts): config.editorUrl, else one taken
+     * from its request; a submit that resolved none leaves it as it was. A comment change re-renders
+     * the PR's comment summary with config.editorUrl or this, so a commenter never supplies the
+     * links. The worker links the conflicts status with it (worker/conflicts-status.ts).
      */
     editorUrl?: string;
     /** Sync status for async GitHub operations (used when Lambda has no internet) */
     syncStatus?: SyncStatus;
-    /** Whether any rebase of this branch kept its version of an entry base also changed */
+    /** Whether {@link conflictFiles} names any entry */
     conflictStatus?: ConflictStatus;
-    /** ContentIds of the entries where a rebase kept the branch's version; cleared when it merges */
+    /**
+     * ContentIds of the entries with a merge conflict a person has yet to resolve, derived from the
+     * clone's merge-conflicts.json (merge-conflicts.ts); cleared when the branch merges
+     */
     conflictFiles?: ContentId[];
     /**
      * Lifecycle state of the branch's PR as last observed by the worker's merge-poll
@@ -162,6 +168,12 @@ export interface BranchMetadata {
      * rebase loop's self-heal pass.
      */
     historyRewrittenFrom?: string;
+    /**
+     * The rebased tip of the latest rewrite while `historyRewrittenFrom` is set: the one commit a
+     * rewrite's publish moves `remote.git` to, since the clone can hold a commit made after it that
+     * no one has submitted. Advanced by each rewrite, cleared with the marker.
+     */
+    historyRewrittenTo?: string;
     /**
      * The newest commit this deployment has seen on GitHub's branch, or knows it will hold once a
      * queued push of a rewrite lands: the last one it pushed, took in or published, and any
@@ -217,6 +229,35 @@ export interface BranchMetadata {
     uncommittedEditors?: CanopyUserId[];
     /** The reviewer's verdict on the last submit; absent until a reviewer acts. */
     review?: BranchReview;
+    /**
+     * When someone last asked for the latest changes (api/branch-update-from-base.ts). The request
+     * stands while this is newer than `lastBaseUpdate.at`; the editor holds the form read-only and
+     * polls meanwhile, and the worker answers it even after a restart lost its wake-up.
+     */
+    baseUpdateRequestedAt?: string;
+    /** The worker's answer to the latest request for the latest changes (worker/rebase.ts). */
+    lastBaseUpdate?: LastBaseUpdate;
+    /**
+     * The first base commit the worker's automatic sync left out because the branch holds saved but
+     * uncommitted work, which it never commits (worker/rebase.ts). The editor shows that the latest
+     * changes are waiting; cleared once the sync finds the branch holding the base, or in review.
+     */
+    latestChangesWaiting?: string;
+}
+/** How a requested update from the base went. */
+export type BaseUpdateOutcome = 'merged' | 'up-to-date' | 'conflicts' | 'failed';
+export interface LastBaseUpdate {
+    /**
+     * When the GitHub fetch began that the branch was brought up to, as the gateway reports it
+     * (worker/github-gateway.ts, `GitHubFetchResult.startedAt`): a request is answered only from a
+     * fetch begun at or after it, so a cycle already running when it arrived never ends it.
+     */
+    at: string;
+    outcome: BaseUpdateOutcome;
+    /** The base commit the branch now contains; absent when it failed before reading one. */
+    baseSha?: string;
+    /** For `conflicts`: how many entries the merge left a conflict in for a person. */
+    keptEntries?: number;
 }
 export interface BranchPaths {
     /** Root where all branches live (e.g., /mnt/efs/site, ~/.canopycms/branches) */
@@ -308,6 +349,21 @@ export interface UnpublishableBranchesReport {
     count: number;
     at: string;
 }
+/**
+ * The last git sync's failures to set the "CanopyCMS conflicts" status on pull request heads
+ * (worker/conflicts-status.ts): `permission` when GitHub refused the credential (it lacks the Commit
+ * statuses permission), `unreachable` when GitHub or the gateway could not be reached or GitHub was
+ * busy, `other` for anything else, a gateway refusal or an unreadable conflict record included.
+ * `branches` lists at most 50 names, `count` all of them.
+ */
+export interface ConflictsStatusFailure {
+    reason: 'permission' | 'unreachable' | 'other';
+    /** [REDACT] Served to the admin panel, so sanitized. */
+    message: string;
+    branches: string[];
+    count: number;
+    at: string;
+}
 /**
  * Wire shape of the worker's self-reported status file (worker-status.json, under
  * the task queue dir), written by the CmsWorker daemon. Read-only here: GET
@@ -406,6 +462,8 @@ export interface WorkerStatusReport {
      * into a restarted worker's first snapshot, so the bound survives restarts.
      */
     baseHold?: BaseSchemaHold;
+    /** Present while the last git sync failed to set a conflicts status; not carried over a restart. */
+    conflictsStatusFailure?: ConflictsStatusFailure;
     /**
      * How the last worker that ran stopped, carried into each new worker's snapshot
      * (task-queue/worker-status.ts's `readCarriedOverStatus`). A worker that fails at startup

package/dist/utils/content-serialize.d.ts

@@ -17,7 +17,7 @@
  * (validation/entry-validator.ts) at the API boundary, not by a schema-blind serialiser.
  */
 import type { FieldConfig } from '../config/index.js';
-import { type MarkdownBodyFormat } from './markdown-body-splice.js';
+import type { MarkdownBodyFormat } from './markdown-parse.js';
 /**
  * Serialise entry data as a YAML file, carrying the comments of `existingRaw` through.
  *
@@ -39,3 +39,20 @@ export declare function serializeYaml(data: Record<string, unknown>, existingRaw
  * what the read path reads, so a `date` field's bare date counts as the day it writes.
  */
 export declare function serializeFrontmatter(editorBody: string, data: Record<string, unknown>, existingRaw: string | undefined, format: MarkdownBodyFormat, fields?: readonly FieldConfig[]): string;
+/** What a save hands the serialiser: `ContentStore.write`'s input, less its version token. */
+export type SerializableEntry = {
+    format: MarkdownBodyFormat;
+    data?: Record<string, unknown>;
+    body: string;
+} | {
+    format: 'json';
+    data: Record<string, unknown>;
+} | {
+    format: 'yaml';
+    data: Record<string, unknown>;
+};
+/**
+ * An entry's file text as a save writes it: `entry` serialised onto `existingRaw`, the file's
+ * current text (absent for a new file). `fields` is the entry type's schema.
+ */
+export declare function serializeEntry(entry: SerializableEntry, existingRaw: string | undefined, fields: readonly FieldConfig[]): string;

package/dist/utils/content-serialize.js

@@ -24,6 +24,7 @@ import { ITEM_KEY, isItemKey } from '../item-keys.js';
 import { withCalendarDays } from './calendar-day.js';
 import { createDebugLogger } from './debug.js';
 import { getErrorMessage } from './error.js';
+import { serializeJson } from './json-source-splice.js';
 import { preserveMarkdownSource } from './markdown-body-splice.js';
 import { snapshotDocument, spliceSource, withSourceLineEndings } from './yaml-source-splice.js';
 const log = createDebugLogger({ prefix: 'ContentSerialize' });
@@ -681,3 +682,14 @@ export function serializeFrontmatter(editorBody, data, existingRaw, format, fiel
     log.debug('content-serialize', 'reconciled frontmatter reads back differently; writing as gray-matter prints it');
     return matter.stringify(file, data);
 }
+/**
+ * An entry's file text as a save writes it: `entry` serialised onto `existingRaw`, the file's
+ * current text (absent for a new file). `fields` is the entry type's schema.
+ */
+export function serializeEntry(entry, existingRaw, fields) {
+    if (entry.format === 'json')
+        return serializeJson(entry.data, existingRaw);
+    if (entry.format === 'yaml')
+        return serializeYaml(entry.data, existingRaw);
+    return serializeFrontmatter(entry.body, entry.data ?? {}, existingRaw, entry.format, fields);
+}

package/dist/utils/content-write-lock.d.ts

@@ -4,9 +4,9 @@
  *
  * Production runs a Lambda (API) and an EC2 worker over one EFS filesystem, so `ContentStore`'s
  * in-process mutex (`utils/async-mutex`) does not cover the worker's rebase (`rebaseOneBranch` in
- * worker/rebase.ts) rewriting the same tree. A write landing after `git rebase` started is
- * destroyed either way -- `git checkout --theirs` overwrites it and the rebase then SUCCEEDS
- * silently, or `git rebase --abort` hard-resets the tree -- and the editor already got its 200.
+ * worker/rebase.ts) rewriting the same tree. A write landing after `git rebase` started makes the
+ * next replayed commit fail, and the `git rebase --abort` that follows hard-resets the tree,
+ * discarding it -- and the editor already got its 200.
  *
  * **Asymmetric by design.** The worker retries every branch on its next sync cycle (~5 minutes)
  * while the editor is a person waiting on a save, so the worker yields and the writer waits:

package/dist/utils/content-write-lock.js

@@ -4,9 +4,9 @@
  *
  * Production runs a Lambda (API) and an EC2 worker over one EFS filesystem, so `ContentStore`'s
  * in-process mutex (`utils/async-mutex`) does not cover the worker's rebase (`rebaseOneBranch` in
- * worker/rebase.ts) rewriting the same tree. A write landing after `git rebase` started is
- * destroyed either way -- `git checkout --theirs` overwrites it and the rebase then SUCCEEDS
- * silently, or `git rebase --abort` hard-resets the tree -- and the editor already got its 200.
+ * worker/rebase.ts) rewriting the same tree. A write landing after `git rebase` started makes the
+ * next replayed commit fail, and the `git rebase --abort` that follows hard-resets the tree,
+ * discarding it -- and the editor already got its 200.
  *
  * **Asymmetric by design.** The worker retries every branch on its next sync cycle (~5 minutes)
  * while the editor is a person waiting on a save, so the worker yields and the writer waits:

package/dist/utils/git.d.ts

@@ -99,6 +99,13 @@ export declare function stageAllExceptCanopyState(git: SimpleGit): Promise<void>
  * for).
  */
 export declare function isRebaseInProgress(repoPath: string): Promise<boolean>;
+/**
+ * The commit HEAD names, read from the files: a detached HEAD's sha, or the branch's loose ref,
+ * else its line in `packed-refs`. Null for any other layout, a reftable store among them, which
+ * the caller reads with git instead. Files only, as {@link resolveGitDir} is, for the branch
+ * listing that reads every clone in review (api/branch.ts).
+ */
+export declare function readHeadCommitFromFiles(repoPath: string): Promise<string | null>;
 /**
  * The repository's current HEAD branch name, or `fallback` when detection fails or HEAD is
  * detached.

package/dist/utils/git.js

@@ -223,6 +223,41 @@ export async function isRebaseInProgress(repoPath) {
         .catch(() => false)));
     return results.some(Boolean);
 }
+const FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+/**
+ * The commit HEAD names, read from the files: a detached HEAD's sha, or the branch's loose ref,
+ * else its line in `packed-refs`. Null for any other layout, a reftable store among them, which
+ * the caller reads with git instead. Files only, as {@link resolveGitDir} is, for the branch
+ * listing that reads every clone in review (api/branch.ts).
+ */
+export async function readHeadCommitFromFiles(repoPath) {
+    const gitDir = await resolveGitDir(repoPath);
+    if (!gitDir)
+        return null;
+    try {
+        const head = (await fs.readFile(path.join(gitDir, 'HEAD'), 'utf-8')).trim();
+        if (FULL_SHA.test(head))
+            return head;
+        const ref = /^ref: (refs\/heads\/\S+)$/.exec(head)?.[1];
+        if (!ref || ref.split('/').includes('..'))
+            return null;
+        const commonFile = await fs.readFile(path.join(gitDir, 'commondir'), 'utf-8').catch(() => null);
+        const refsDir = commonFile ? path.resolve(gitDir, commonFile.trim()) : gitDir;
+        const loose = await fs.readFile(path.join(refsDir, ref), 'utf-8').catch(() => null);
+        if (loose !== null)
+            return FULL_SHA.test(loose.trim()) ? loose.trim() : null;
+        const packed = await fs.readFile(path.join(refsDir, 'packed-refs'), 'utf-8').catch(() => '');
+        for (const line of packed.split('\n')) {
+            const [sha, name] = line.split(' ');
+            if (name === ref && FULL_SHA.test(sha))
+                return sha;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * The repository's current HEAD branch name, or `fallback` when detection fails or HEAD is
  * detached.

package/dist/utils/markdown-body-splice.d.ts

@@ -23,7 +23,7 @@
  * then both again from the edit as sent; failing all four, the restyled edit is written whole,
  * or the edit as sent when it did not read back: the worst case is never different content.
  */
-export type MarkdownBodyFormat = 'md' | 'mdx';
+import { type MarkdownBodyFormat } from './markdown-parse.js';
 /**
  * `text`'s top-level blocks, each as its source text and its `canonical` form, or undefined when
  * `text` does not parse: two bodies mean the same to the splice exactly when their `meaning`

package/dist/utils/markdown-body-splice.js

@@ -23,32 +23,14 @@
  * then both again from the edit as sent; failing all four, the restyled edit is written whole,
  * or the edit as sent when it did not read back: the worst case is never different content.
  */
-import { fromMarkdown } from 'mdast-util-from-markdown';
-import { gfmFromMarkdown } from 'mdast-util-gfm';
-import { mdxFromMarkdown } from 'mdast-util-mdx';
-import { gfm } from 'micromark-extension-gfm';
-import { mdxjs } from 'micromark-extension-mdxjs';
 import { createDebugLogger } from './debug.js';
 import { getErrorMessage } from './error.js';
+import { parseMarkdownBody as parse, } from './markdown-parse.js';
 import { orderedNumber, restyleMarkdown } from './markdown-restyle.js';
 import { withSourceLineEndings } from './yaml-source-splice.js';
 const log = createDebugLogger({ prefix: 'MarkdownBodySplice' });
 /** Above this many LCS cells the middle of a sequence is treated as one changed run. */
 const MAX_LCS_CELLS = 4_000_000;
-function parse(text, format) {
-    try {
-        return format === 'mdx'
-            ? fromMarkdown(text, {
-                extensions: [gfm(), mdxjs()],
-                mdastExtensions: [gfmFromMarkdown(), mdxFromMarkdown()],
-            })
-            : fromMarkdown(text, { extensions: [gfm()], mdastExtensions: [gfmFromMarkdown()] });
-    }
-    catch (err) {
-        log.debug('markdown-body-splice', 'body does not parse', { error: getErrorMessage(err) });
-        return undefined;
-    }
-}
 /**
  * A node's meaning as a string: its tree without source positions. `data` goes too, because
  * the parser fills it only with derived information (an MDX expression's estree, which carries

package/dist/utils/markdown-parse.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The md/mdx body parser the save path and the merge engine share, so both read a body the same
+ * way. Dependency-free of node built-ins: the merge engine runs in the browser bundle too.
+ */
+import { fromMarkdown } from 'mdast-util-from-markdown';
+export type MarkdownBodyFormat = 'md' | 'mdx';
+export type MarkdownRoot = ReturnType<typeof fromMarkdown>;
+/** `text`'s mdast with GFM, and MDX for `mdx`; undefined when it does not parse. */
+export declare function parseMarkdownBody(text: string, format: MarkdownBodyFormat): MarkdownRoot | undefined;

package/dist/utils/markdown-parse.js

@@ -0,0 +1,27 @@
+/**
+ * The md/mdx body parser the save path and the merge engine share, so both read a body the same
+ * way. Dependency-free of node built-ins: the merge engine runs in the browser bundle too.
+ */
+import { fromMarkdown } from 'mdast-util-from-markdown';
+import { gfmFromMarkdown } from 'mdast-util-gfm';
+import { mdxFromMarkdown } from 'mdast-util-mdx';
+import { gfm } from 'micromark-extension-gfm';
+import { mdxjs } from 'micromark-extension-mdxjs';
+import { createDebugLogger } from './debug.js';
+import { getErrorMessage } from './error.js';
+const log = createDebugLogger({ prefix: 'MarkdownParse' });
+/** `text`'s mdast with GFM, and MDX for `mdx`; undefined when it does not parse. */
+export function parseMarkdownBody(text, format) {
+    try {
+        return format === 'mdx'
+            ? fromMarkdown(text, {
+                extensions: [gfm(), mdxjs()],
+                mdastExtensions: [gfmFromMarkdown(), mdxFromMarkdown()],
+            })
+            : fromMarkdown(text, { extensions: [gfm()], mdastExtensions: [gfmFromMarkdown()] });
+    }
+    catch (err) {
+        log.debug('markdown-parse', 'body does not parse', { error: getErrorMessage(err) });
+        return undefined;
+    }
+}

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CANOPYCMS_VERSION = "0.12.0";
+export declare const CANOPYCMS_VERSION = "0.13.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated by scripts/bump-version.mjs, its only writer. The package builds with plain
 // tsc (rootDir: src), so src/ cannot import ../package.json; version.test.ts keeps the two equal.
-export const CANOPYCMS_VERSION = '0.12.0';
+export const CANOPYCMS_VERSION = '0.13.0';