canopycms 0.8.0 → 0.8.2

package/dist/content-reader.js

@@ -16,6 +16,11 @@ import { CONTENT_READER_USER_ID } from './system-users.js';
  * reads as NOT_FOUND unless `allowCreateBranch` or a `getBranchContext` resolver says otherwise.
  */
 export const createContentReader = (options) => {
+    const { read } = createContentReaderInternal(options);
+    return { read };
+};
+/** @internal {@link createContentReader} plus `readFirst`, for context.ts. */
+export const createContentReaderInternal = (options) => {
     const services = options.services;
     const operatingMode = services.config.mode;
     const basePathOverride = options.basePathOverride;
@@ -127,9 +132,9 @@ export const createContentReader = (options) => {
         const url = encodedSlug ? `${trimmed}/${encodedSlug}` : trimmed || '/';
         return appendBranch(url);
     };
-    const readDocument = async (input) => {
-        const { entryPath, slug, branchName, user } = resolveTarget(input);
-        const { context, branchRoot, store } = await resolveStore(branchName);
+    const readDocument = async (input, resolved) => {
+        const { entryPath, slug, user } = resolveTarget(input);
+        const { context, branchRoot, store } = resolved;
         // Rule 1 of urlAddressableOnly (see ReadContentInput): a published URL's non-slug segments
         // are collection names, so a candidate landing on an entry-TYPE item can only ever produce a
         // URL enumeration never emits. NO_SCHEMA_ITEM is what assertCollection raises for exactly
@@ -216,9 +221,9 @@ export const createContentReader = (options) => {
             throw err;
         }
     };
-    const read = async (input, message) => {
+    const readResolved = async (input, resolved, message) => {
         const { entryPath, slug, branchName } = resolveTarget(input);
-        const result = await readDocument(input);
+        const result = await readDocument(input, resolved);
         if (!result || typeof result.doc !== 'object' || !('data' in result.doc)) {
             const defaultMessage = `Content not found for ${entryPath}${slug ? `/${slug}` : ''} on branch ${branchName}`;
             throw new ContentStoreError(message ?? defaultMessage, 'NOT_FOUND');
@@ -242,5 +247,37 @@ export const createContentReader = (options) => {
         });
         return { data, path, meta: { physicalPath, entryType, entryId, slug: entrySlug, urlPath } };
     };
-    return { read };
+    const read = async (input, message) => {
+        const { branchName } = resolveTarget(input);
+        return readResolved(input, await resolveStore(branchName), message);
+    };
+    const readFirst = async (inputs, isMiss) => {
+        const [first] = inputs;
+        if (!first)
+            return null;
+        if (inputs.some((input) => input.branch !== first.branch || input.user !== first.user)) {
+            throw new Error('readFirst: every input must name the same branch and user');
+        }
+        let resolved;
+        try {
+            resolved = await resolveStore(resolveTarget(first).branchName);
+        }
+        catch (err) {
+            if (isMiss(err, first))
+                return null;
+            throw err;
+        }
+        for (const input of inputs) {
+            try {
+                return await readResolved(input, resolved);
+            }
+            catch (err) {
+                if (isMiss(err, input))
+                    continue;
+                throw err;
+            }
+        }
+        return null;
+    };
+    return { read, readFirst };
 };

package/dist/context.js

@@ -1,5 +1,5 @@
 import { isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER } from './build-mode.js';
-import { createContentReader } from './content-reader.js';
+import { createContentReaderInternal } from './content-reader.js';
 import { ContentStoreError } from './content-store.js';
 import { createLogicalPath, namesNoWorkspace, parseSlug, resolveBranchPaths, } from './paths/index.js';
 import { resolveUrlPathCandidates } from './url-path-resolver.js';
@@ -129,7 +129,7 @@ export function createCanopyContext(options) {
         };
         // The reader resolves every branch through resolveBranch; a null reads as
         // NOT_FOUND. Reads from the checkout bypass the resolver inside the reader.
-        const baseReader = createContentReader({
+        const baseReader = createContentReaderInternal({
             services,
             defaultBranch: activeBranch,
             getBranchContext: (branchName) => resolveBranch(otherBranch(branchName)),
@@ -140,7 +140,7 @@ export function createCanopyContext(options) {
         // function rather than an optional second parameter on the
         // `CanopyContext['read']`-typed closure, so the two call sites stay visible
         // and nobody widens the public API by accident.
-        const readWithOptions = async (input, extra) => {
+        const toReadInput = (input, extra) => {
             const entryPath = createLogicalPath(input.entryPath);
             let slug;
             if (input.slug) {
@@ -161,53 +161,55 @@ export function createCanopyContext(options) {
                 resolveReferences: input.resolveReferences ?? true,
                 ...extra,
             };
-            return baseReader.read(readInput);
+            return readInput;
         };
-        const read = (input) => readWithOptions(input);
+        const read = async (input) => baseReader.read(toReadInput(input));
         const readByUrlPath = async (urlPath, options) => {
             const contentRoot = services.config.contentRoot || 'content';
             const candidates = resolveUrlPathCandidates(urlPath, contentRoot);
             if (candidates.length === 0)
                 return null;
             const { branch, resolveReferences } = options ?? {};
-            for (const candidate of candidates) {
-                // Skip a candidate whose slug isn't valid (/favicon.ico, Next internals
-                // the [...slug] route catches). None can match an entry, so treat it as
-                // a miss rather than let read() throw "Invalid slug".
-                if (!parseSlug(candidate.slug).ok)
-                    continue;
-                try {
-                    return await readWithOptions({
-                        entryPath: candidate.entryPath,
-                        slug: candidate.slug,
-                        branch,
-                        resolveReferences,
-                    }, 
-                    // A read BY PUBLISHED URL accepts only what listEntries publishes.
-                    // See ReadContentInput.urlAddressableOnly for the two rules, and
-                    // why they live in the reader (which holds the branch-correct
-                    // schema) rather than the candidate builder (pure and schema-free).
-                    { urlAddressableOnly: true });
-                }
-                catch (err) {
-                    // Swallow a candidate path's "not found", and FORBIDDEN so a denied
-                    // or anonymous read renders as the adopter's 404 rather than an
-                    // unhandled 500. Real errors (validation, corruption, anything not a
-                    // ContentStoreError) rethrow.
-                    if (err instanceof ContentStoreError && isPageSwallowable(err)) {
-                        if (err.code === 'FORBIDDEN') {
-                            log.debug('readByUrlPath', 'Read denied, treating as not-found: ' + err.message, {
-                                urlPath,
-                                entryPath: candidate.entryPath,
-                                slug: candidate.slug,
-                            });
-                        }
-                        continue;
-                    }
-                    throw err;
+            // Swallow a candidate path's "not found", and FORBIDDEN so a denied or
+            // anonymous read renders as the adopter's 404 rather than an unhandled
+            // 500. Real errors (validation, corruption, anything not a
+            // ContentStoreError) rethrow.
+            const isMiss = (err, input) => {
+                if (!(err instanceof ContentStoreError && isPageSwallowable(err)))
+                    return false;
+                if (err.code === 'FORBIDDEN') {
+                    log.debug('readByUrlPath', 'Read denied, treating as not-found: ' + err.message, {
+                        urlPath,
+                        entryPath: input?.entryPath,
+                        slug: input?.slug,
+                    });
                 }
+                return true;
+            };
+            // Converting every candidate up front throws nothing a candidate-by-candidate
+            // loop would not: a valid slug holds no `..`, so the index candidate's path
+            // fails createLogicalPath only when the entry candidate's does.
+            let inputs;
+            try {
+                inputs = candidates
+                    // Skip a candidate whose slug isn't valid (/favicon.ico, Next internals
+                    // the [...slug] route catches). None can match an entry, so treat it as
+                    // a miss rather than let read() throw "Invalid slug".
+                    .filter((candidate) => parseSlug(candidate.slug).ok)
+                    .map((candidate) => toReadInput({ entryPath: candidate.entryPath, slug: candidate.slug, branch, resolveReferences }, 
+                // A read BY PUBLISHED URL accepts only what listEntries publishes.
+                // See ReadContentInput.urlAddressableOnly for the two rules, and
+                // why they live in the reader (which holds the branch-correct
+                // schema) rather than the candidate builder (pure and schema-free).
+                { urlAddressableOnly: true }));
             }
-            return null;
+            catch (err) {
+                if (isMiss(err))
+                    return null;
+                throw err;
+            }
+            // One branch and schema resolve for every candidate.
+            return baseReader.readFirst(inputs, isMiss);
         };
         /**
          * What a batch read (listEntries / buildContentTree) lists from: the branch's

package/dist/editor/BranchManager.d.ts

@@ -1,6 +1,6 @@
 import React from 'react';
 import type { OperatingMode } from '../operating-mode/index.js';
-import type { ConflictStatus, PullRequestState, SyncStatus } from '../types.js';
+import type { BranchHold, ConflictStatus, PullRequestState, SyncStatus } from '../types.js';
 import type { CommentThread } from '../comment-store.js';
 import type { UserSearchResult } from '../auth/types.js';
 import type { CreateRefusal } from './hooks/create-branch-request.js';
@@ -32,17 +32,21 @@ export interface BranchSummary {
     conflictStatus?: ConflictStatus;
     /** ContentIds of entries where --theirs was applied during rebase; cleared on clean rebase */
     conflictFiles?: string[];
+    /** What is stuck and needs a person (api/branch.ts). */
+    hold?: BranchHold;
     commentCount?: number;
     isProtected?: boolean;
     readOnly?: boolean;
     /**
-     * Server-computed compound submit rule (base-branch OR non-'editing'
-     * status) -- see `useBranchManager.tsx`'s `BranchSummary.submitBlocked` and
-     * `BranchWriteProtection.submitBlockedIncludingStatus` for the full
+     * Server-computed compound submit rule (base-branch, non-'editing'
+     * status, or rewritten on GitHub) -- see `useBranchManager.tsx`'s
+     * `BranchSummary.submitBlocked` and `BranchWriteProtection.submitBlockedIncludingStatus` for the full
      * rationale. `getBranchPermissions`'s `canSubmit` consumes this directly
      * instead of re-deriving `status === 'editing' && !isProtected`.
      */
     submitBlocked?: boolean;
+    /** Server-computed: the API refuses Approve, as the last submit didn't finish. */
+    approveBlocked?: boolean;
 }
 export interface UserContext {
     userId: string;

package/dist/editor/BranchManager.js

@@ -1,7 +1,7 @@
 'use client';
 import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { useEffect, useRef, useState } from 'react';
-import { ActionIcon, Badge, Button, Group, Menu, Paper, ScrollArea, Stack, Text, TextInput, Textarea, Collapse, Tooltip, } from '@mantine/core';
+import { ActionIcon, Anchor, Badge, Button, Group, Menu, Paper, ScrollArea, Stack, Text, TextInput, Textarea, Collapse, Tooltip, } from '@mantine/core';
 import { IconDots, IconExternalLink } from '@tabler/icons-react';
 import { BranchComments } from './comments/BranchComments.js';
 import { UserBadge } from './components/UserBadge.js';
@@ -13,9 +13,10 @@ import { parseCreatedBranchName } from '../paths/validation.js';
 import { DestructiveMenuItem } from './components/DestructiveMenuItem.js';
 import { ReasonedMenuItem } from './components/ReasonedMenuItem.js';
 import { RelativeTime } from './components/RelativeTime.js';
-import { branchStatusPresentation } from './branch-status.js';
+import { HOLD_BADGE, SYNC_FAILED_IN_REVIEW_NOTE, branchHoldMessage, endSentence, syncFailedFallback, branchStatusPresentation, } from './branch-status.js';
+import { TooltipDetail } from './components/TooltipDetail.js';
 import { branchAddress, displayBranchName } from './branch-names.js';
-import { CLOSED_PULL_REQUEST_REASON, EDITOR_ACTIONS } from './copy.js';
+import { CLOSED_PULL_REQUEST_REASON, EDITOR_ACTIONS, rewrittenSubmitReason, UNFINISHED_SUBMIT_APPROVE_REASON, } from './copy.js';
 import { isReviewerOfOthersReview } from '../authorization/review-role.js';
 import { SYSTEM_USER_ID } from '../system-users.js';
 /**
@@ -51,8 +52,8 @@ export const getBranchPermissions = (branch, user) => {
         (userIsCreator || userInACL || isSystemBranch || userIsAdmin || userIsReviewer);
     // Submit: can perform workflow actions AND the server says submit isn't
     // blocked. `submitBlocked` is the server's own compound answer -- status
-    // past 'editing' OR the protected base branch -- computed once in
-    // `getBranchWriteProtection` (protected-branch.ts) and threaded through
+    // past 'editing', the protected base branch, or a rewrite on GitHub --
+    // computed once in `toBranchListItem` (api/branch.ts) and threaded through
     // unchanged.
     //
     // `?? true`, not a bare `!branch.submitBlocked`: the field is optional (like
@@ -80,10 +81,11 @@ export const getBranchPermissions = (branch, user) => {
     // Approve and Request changes: a Reviewer or Admin other than the creator, who for an author
     // would only do what Withdraw does. Neither applies to the protected base branch, whose way
     // out of review is Withdraw. A closed PR refuses both (Request changes converts the PR to
-    // a draft); Approve also needs the branch submitted, Request changes accepts approved too.
+    // a draft); Approve also needs the branch submitted and its last submit finished, Request changes
+    // accepts approved too.
     const reviewsOthers = (userIsAdmin || userIsReviewer) && !userIsCreator && !branch.isProtected;
     const prLive = branch.pullRequestState !== 'closed';
-    const canApprove = reviewsOthers && branch.status === 'submitted' && prLive;
+    const canApprove = reviewsOthers && branch.status === 'submitted' && prLive && !branch.approveBlocked;
     const canRequestChanges = reviewsOthers && (branch.status === 'submitted' || branch.status === 'approved') && prLive;
     return {
         hasWorkflowAccess: canPerformWorkflowActions,
@@ -102,7 +104,7 @@ const noUserLookup = async () => null;
  * author's way back. A user without workflow access is offered neither, since it
  * would never apply to them; a reason is given only for a block that depends on the branch's state.
  */
-const workflowAction = (b, perms, onSubmit, onWithdraw) => {
+const workflowAction = (b, perms, onSubmit, onWithdraw, userIsAdmin) => {
     if (!perms.hasWorkflowAccess)
         return undefined;
     if (b.status === 'submitted' || b.status === 'approved') {
@@ -119,7 +121,11 @@ const workflowAction = (b, perms, onSubmit, onWithdraw) => {
             color: 'brand',
             testId: `submit-branch-button-${b.name}`,
             run: () => onSubmit?.(b.name),
-            blockedReason: perms.canSubmit ? undefined : "This branch can't be submitted right now.",
+            blockedReason: perms.canSubmit
+                ? undefined
+                : b.hold?.kind === 'rewritten'
+                    ? rewrittenSubmitReason(userIsAdmin)
+                    : "This branch can't be submitted right now.",
         };
     }
     return undefined;
@@ -133,6 +139,9 @@ const reviewsOthersBranch = (b, user) => isReviewerOfOthersReview({
     isProtected: b.isProtected,
     pullRequestState: b.pullRequestState,
 }, user);
+/** Lets the card's details shrink beside its actions, which a long unbroken name would push out. */
+const CARD_DETAILS = { minWidth: 0, flex: 1 };
+const WRAP_ANYWHERE = { overflowWrap: 'anywhere' };
 /**
  * One branch: its state, and one primary action, with the rest in a "…" menu. The current branch
  * shows its workflow action; to a reviewer of someone else's submission it shows Approve, with
@@ -143,9 +152,9 @@ const reviewsOthersBranch = (b, user) => isReviewerOfOthersReview({
 const BranchCard = ({ branch: b, isCurrent, workflowBlockedReason, user, onSelect, onSubmit, onWithdraw, onApprove, onRequestChanges, onDelete, onGetUserMetadata, onGetOwnerMetadata = onGetUserMetadata, }) => {
     const statusBadge = branchStatusPresentation(b.status, b.isProtected);
     const perms = getBranchPermissions(b, user);
-    const action = workflowAction(b, perms, onSubmit, onWithdraw);
-    const workflow = action && workflowBlockedReason ? { ...action, blockedReason: workflowBlockedReason } : action;
     const userIsAdmin = isAdmin(user?.groups);
+    const action = workflowAction(b, perms, onSubmit, onWithdraw, userIsAdmin);
+    const workflow = action && workflowBlockedReason ? { ...action, blockedReason: workflowBlockedReason } : action;
     // The open branch holds back its review actions as it does its workflow action; the reason is
     // given only for the open branch.
     const heldBack = (a) => a && workflowBlockedReason ? { ...a, blockedReason: workflowBlockedReason } : a;
@@ -157,7 +166,11 @@ const BranchCard = ({ branch: b, isCurrent, workflowBlockedReason, user, onSelec
             color: 'brand',
             testId: `approve-branch-button-${b.name}`,
             run: () => onApprove?.(b.name),
-            blockedReason: perms.canApprove ? undefined : CLOSED_PULL_REQUEST_REASON,
+            blockedReason: perms.canApprove
+                ? undefined
+                : b.pullRequestState === 'closed'
+                    ? CLOSED_PULL_REQUEST_REASON
+                    : UNFINISHED_SUBMIT_APPROVE_REASON,
         }
         : undefined);
     const requestChanges = heldBack(reviewsOthers && (b.status === 'submitted' || b.status === 'approved')
@@ -178,24 +191,36 @@ const BranchCard = ({ branch: b, isCurrent, workflowBlockedReason, user, onSelec
     // alone once approved. Reviewing another one, Review opens it and the actions wait in the menu.
     const primary = !isCurrent ? undefined : reviewing ? (approve ?? requestChanges) : workflow;
     const secondary = isCurrent && reviewing && approve ? requestChanges : undefined;
-    // Two visible actions, or the long "Withdraw from review", would crowd the title at the drawer's
-    // width, so they take a row below it. Open and Review stay beside the title.
-    const actionRow = !!secondary || primary?.label === EDITOR_ACTIONS.withdrawFromReview;
+    // Two visible actions, the long "Withdraw from review", or any action beside a hold's line would
+    // crowd the details at the drawer's width, so they take a row below. Open and Review stay beside
+    // the title.
+    const actionRow = !!secondary || primary?.label === EDITOR_ACTIONS.withdrawFromReview || (!!primary && !!b.hold);
     const menuActions = [approve, requestChanges, workflow].filter((a) => !!a && a !== primary && a !== secondary);
     const showViewPullRequest = !!b.pullRequestUrl;
     const showDelete = !b.isProtected && (userIsAdmin || (!!user && b.createdBy === user.userId));
     const hasMenu = menuActions.length > 0 || showViewPullRequest || showDelete;
     const menuLabel = `More actions for ${displayBranchName(b)}`;
     const [menuOpen, setMenuOpen] = useState(false);
-    return (_jsxs(Paper, { withBorder: true, p: "md", shadow: "xs", "aria-current": isCurrent ? 'true' : undefined, "data-current": isCurrent || undefined, "data-testid": `branch-list-item-${b.name}`, children: [_jsxs(Group, { justify: "space-between", align: "flex-start", wrap: "nowrap", children: [_jsxs(Stack, { gap: 4, children: [_jsxs(Group, { gap: "xs", children: [_jsx(Text, { fw: 600, children: displayBranchName(b) }), isCurrent && (_jsx(Badge, { color: "brand", variant: "filled", "data-testid": `branch-current-badge-${b.name}`, children: "Current" })), statusBadge && (_jsx(Badge, { color: statusBadge.color, variant: statusBadge.variant, "data-testid": `branch-status-badge-${b.name}`, "data-status": b.status, "data-protected": b.isProtected || undefined, children: statusBadge.label })), b.status === 'archived' && b.mergedAt && (_jsx(Badge, { color: "teal", variant: "light", "data-testid": `branch-merged-badge-${b.name}`, children: "Merged" })), b.pullRequestNumber && (_jsxs(Badge, { color: b.pullRequestState === 'closed'
+    const inReview = b.status === 'submitted' || b.status === 'approved';
+    const holdViewer = {
+        role: reviewing ? 'review' : perms.canWithdraw ? 'withdraw' : 'none',
+        isAdmin: userIsAdmin,
+    };
+    return (_jsxs(Paper, { withBorder: true, p: "md", shadow: "xs", "aria-current": isCurrent ? 'true' : undefined, "data-current": isCurrent || undefined, "data-testid": `branch-list-item-${b.name}`, children: [_jsxs(Group, { justify: "space-between", align: "flex-start", wrap: "nowrap", children: [_jsxs(Stack, { gap: 4, style: CARD_DETAILS, children: [_jsxs(Group, { gap: "xs", children: [_jsx(Text, { fw: 600, style: WRAP_ANYWHERE, children: displayBranchName(b) }), isCurrent && (_jsx(Badge, { color: "brand", variant: "filled", "data-testid": `branch-current-badge-${b.name}`, children: "Current" })), statusBadge && (_jsx(Badge, { color: statusBadge.color, variant: statusBadge.variant, "data-testid": `branch-status-badge-${b.name}`, "data-status": b.status, "data-protected": b.isProtected || undefined, children: statusBadge.label })), b.hold && (_jsx(Badge, { color: HOLD_BADGE.color, variant: "light", "data-testid": `held-badge-${b.name}`, children: HOLD_BADGE.label })), b.status === 'archived' && b.mergedAt && (_jsx(Badge, { color: "teal", variant: "light", "data-testid": `branch-merged-badge-${b.name}`, children: "Merged" })), b.pullRequestNumber && (_jsxs(Badge, { color: b.pullRequestState === 'closed'
                                             ? 'red'
                                             : b.pullRequestState === 'merged'
                                                 ? 'violet'
-                                                : 'blue', variant: "light", children: ["PR #", b.pullRequestNumber, b.pullRequestState === 'closed' ? ' (closed)' : ''] })), b.commentCount !== undefined && b.commentCount > 0 && (_jsxs(Badge, { color: "grape", variant: "light", children: [b.commentCount, " ", b.commentCount === 1 ? 'comment' : 'comments'] })), b.syncStatus === 'sync-failed' && (_jsx(Tooltip, { label: "GitHub sync failed \u2014 an admin can retry it from System health.", disabled: Boolean(b.syncFailureReason), multiline: true, maw: 320, children: _jsx(Badge, { color: "red", variant: "light", "data-testid": `sync-failed-badge-${b.name}`, children: "Sync failed" }) })), b.syncStatus === 'pending-sync' && (_jsx(Tooltip, { label: "Changes are on their way to GitHub.", children: _jsx(Badge, { color: "gray", variant: "light", "data-testid": `pending-sync-badge-${b.name}`, children: "Syncing\u2026" }) })), b.conflictStatus === 'conflicts-detected' && (_jsx(Tooltip, { label: "This branch's version was kept for conflicting entries during a rebase \u2014 review the flagged entries.", children: _jsxs(Badge, { color: "orange", variant: "light", "data-testid": `conflicts-badge-${b.name}`, children: ["Conflicts", b.conflictFiles?.length ? ` (${b.conflictFiles.length})` : ''] }) }))] }), b.syncStatus === 'sync-failed' && b.syncFailureReason && (_jsxs(Text, { size: "xs", c: "var(--canopy-danger-text)", maw: 480, "data-testid": `sync-failed-reason-${b.name}`, children: [b.syncFailureReason, b.status === 'submitted' && ' Withdraw it from review to make changes.'] })), _jsxs(Group, { gap: "xs", align: "center", children: [b.updatedAt && (_jsx(RelativeTime, { iso: b.updatedAt, prefix: "Updated ", size: "xs", c: "dimmed" })), b.createdBy && (_jsxs(Group, { gap: "xs", align: "center", wrap: "nowrap", children: [_jsx(Text, { size: "xs", c: "dimmed", children: "\u2022" }), _jsxs(Group, { gap: 4, align: "center", wrap: "nowrap", children: [_jsx(Text, { size: "xs", c: "dimmed", children: "Owner:" }), _jsx(UserBadge, { userId: b.createdBy, getUserMetadata: onGetOwnerMetadata ?? noUserLookup, variant: "avatar-name", size: "xs", showEmailTooltip: true, showBadge: true, badgeVariant: "light", color: "gray" })] })] }))] }), b.access && (_jsx(BranchAccessList, { users: b.access.users, groups: b.access.groups, withheldUsers: b.access.withheldUsers, withheldGroups: b.access.withheldGroups, getUserMetadata: onGetOwnerMetadata ?? noUserLookup }))] }), _jsxs(Group, { gap: 8, wrap: "nowrap", children: [!isCurrent && (_jsx(Button, { variant: "light", onClick: () => onSelect?.(b.name), "data-testid": reviewing ? `review-branch-button-${b.name}` : `switch-to-branch-button-${b.name}`, children: reviewing ? EDITOR_ACTIONS.review : 'Open' })), !actionRow && primary && _jsx(CardActionButton, { action: primary }), hasMenu && (_jsxs(Menu, { withinPortal: true, shadow: "sm", position: "bottom-end", width: 280, onChange: setMenuOpen, children: [_jsx(Tooltip, { label: menuLabel, disabled: menuOpen, children: _jsx(Menu.Target, { children: _jsx(ActionIcon, { variant: "subtle", color: "gray", "aria-label": menuLabel, "data-testid": `branch-actions-menu-${b.name}`, children: _jsx(IconDots, { size: 16, "aria-hidden": true }) }) }) }), _jsxs(Menu.Dropdown, { children: [menuActions.map((action) => (_jsx(ReasonedMenuItem, { blockedReason: action.blockedReason, showReason: !action.reasonShownBy, reasonId: `${action.testId}-reason`, reasonDescribedBy: action.reasonShownBy ? `${action.reasonShownBy}-reason` : undefined, onClick: action.run, "data-testid": action.testId, children: action.label }, action.testId))), showViewPullRequest && (_jsx(Menu.Item, { component: "a", href: b.pullRequestUrl, target: "_blank", rel: "noopener noreferrer", leftSection: _jsx(IconExternalLink, { size: 14, "aria-hidden": true }), "data-testid": `view-pull-request-${b.name}`, children: b.pullRequestNumber
+                                                : 'blue', variant: "light", children: ["PR #", b.pullRequestNumber, b.pullRequestState === 'closed' ? ' (closed)' : ''] })), b.commentCount !== undefined && b.commentCount > 0 && (_jsxs(Badge, { color: "grape", variant: "light", children: [b.commentCount, " ", b.commentCount === 1 ? 'comment' : 'comments'] })), b.syncStatus === 'sync-failed' && (_jsx(Badge, { color: "red", variant: "light", "data-testid": `sync-failed-badge-${b.name}`, children: "Sync failed" })), b.syncStatus === 'pending-sync' && (_jsx(Tooltip, { label: "Changes are on their way to GitHub.", children: _jsx(Badge, { color: "gray", variant: "light", "data-testid": `pending-sync-badge-${b.name}`, children: "Syncing\u2026" }) })), b.conflictStatus === 'conflicts-detected' && (_jsx(TooltipDetail, { detail: "This branch's version was kept for conflicting entries. Review the flagged entries.", children: _jsxs(Badge, { color: "orange", variant: "light", "data-testid": `conflicts-badge-${b.name}`, children: ["Conflicts", b.conflictFiles?.length ? ` (${b.conflictFiles.length})` : ''] }) }))] }), b.hold && (_jsxs(Text, { size: "xs", maw: 480, style: WRAP_ANYWHERE, "data-testid": `branch-hold-${b.name}`, children: [branchHoldMessage(b.hold, holdViewer), b.hold.kind === 'retargeted' && b.pullRequestUrl && (_jsxs(_Fragment, { children: [' ', _jsx(Anchor, { href: b.pullRequestUrl, target: "_blank", rel: "noreferrer", inherit: true, children: "View pull request" })] }))] })), b.syncStatus === 'sync-failed' &&
+                                (b.hold ? b.hold.kind !== 'rewritten' && !!b.syncFailureReason?.trim() : true) && (_jsxs(Text, { size: "xs", c: "var(--canopy-danger-text)", maw: 480, style: WRAP_ANYWHERE, "data-testid": `sync-failed-reason-${b.name}`, children: [endSentence(b.syncFailureReason?.trim() || syncFailedFallback(userIsAdmin, b.status)), !b.hold && inReview && b.pullRequestNumber && ` ${SYNC_FAILED_IN_REVIEW_NOTE}`, !b.hold &&
+                                        inReview &&
+                                        holdViewer.role === 'withdraw' &&
+                                        ' Withdraw the branch from review to make changes.'] })), _jsxs(Group, { gap: "xs", align: "center", children: [b.updatedAt && (_jsx(RelativeTime, { iso: b.updatedAt, prefix: "Updated ", size: "xs", c: "dimmed" })), b.createdBy && (_jsxs(Group, { gap: "xs", align: "center", wrap: "nowrap", children: [_jsx(Text, { size: "xs", c: "dimmed", children: "\u2022" }), _jsxs(Group, { gap: 4, align: "center", wrap: "nowrap", children: [_jsx(Text, { size: "xs", c: "dimmed", children: "Owner:" }), _jsx(UserBadge, { userId: b.createdBy, getUserMetadata: onGetOwnerMetadata ?? noUserLookup, variant: "avatar-name", size: "xs", showEmailTooltip: true, showBadge: true, badgeVariant: "light", color: "gray" })] })] }))] }), b.access && (_jsx(BranchAccessList, { users: b.access.users, groups: b.access.groups, withheldUsers: b.access.withheldUsers, withheldGroups: b.access.withheldGroups, getUserMetadata: onGetOwnerMetadata ?? noUserLookup }))] }), _jsxs(Group, { gap: 8, wrap: "nowrap", children: [!isCurrent && (_jsx(Button, { variant: "light", onClick: () => onSelect?.(b.name), "data-testid": reviewing ? `review-branch-button-${b.name}` : `switch-to-branch-button-${b.name}`, children: reviewing ? EDITOR_ACTIONS.review : 'Open' })), !actionRow && primary && _jsx(CardActionButton, { action: primary }), hasMenu && (_jsxs(Menu, { withinPortal: true, shadow: "sm", position: "bottom-end", width: 280, onChange: setMenuOpen, children: [_jsx(Tooltip, { label: menuLabel, disabled: menuOpen, children: _jsx(Menu.Target, { children: _jsx(ActionIcon, { variant: "subtle", color: "gray", "aria-label": menuLabel, "data-testid": `branch-actions-menu-${b.name}`, children: _jsx(IconDots, { size: 16, "aria-hidden": true }) }) }) }), _jsxs(Menu.Dropdown, { children: [menuActions.map((action) => (_jsx(ReasonedMenuItem, { blockedReason: action.blockedReason, showReason: !action.reasonShownBy, reasonId: `${action.testId}-reason`, reasonDescribedBy: action.reasonShownBy ? `${action.reasonShownBy}-reason` : undefined, onClick: action.run, "data-testid": action.testId, children: action.label }, action.testId))), showViewPullRequest && (_jsx(Menu.Item, { component: "a", href: b.pullRequestUrl, target: "_blank", rel: "noopener noreferrer", leftSection: _jsx(IconExternalLink, { size: 14, "aria-hidden": true }), "data-testid": `view-pull-request-${b.name}`, children: b.pullRequestNumber
                                                     ? `View pull request #${b.pullRequestNumber}`
                                                     : 'View pull request' })), showDelete && (_jsxs(_Fragment, { children: [(menuActions.length > 0 || showViewPullRequest) && _jsx(Menu.Divider, {}), _jsx(DestructiveMenuItem, { "data-testid": `delete-branch-button-${b.name}`, blockedReason: b.status === 'submitted' || b.status === 'approved'
                                                             ? 'This branch is in review. Withdraw it from review before deleting it.'
-                                                            : undefined, onClick: () => onDelete?.(b.name), children: "Delete branch" })] }))] })] }))] })] }), actionRow && (_jsxs(Group, { justify: "flex-end", gap: 8, wrap: "nowrap", mt: "sm", "data-testid": `branch-action-row-${b.name}`, children: [secondary && _jsx(CardActionButton, { action: secondary }), primary && _jsx(CardActionButton, { action: primary })] }))] }));
+                                                            : b.hold?.kind === 'unpublished-at-merge' && !userIsAdmin
+                                                                ? 'This branch may hold changes that never reached GitHub. Ask an admin to check it before deleting it.'
+                                                                : undefined, onClick: () => onDelete?.(b.name), children: "Delete branch" })] }))] })] }))] })] }), actionRow && (_jsxs(Group, { justify: "flex-end", gap: 8, wrap: "nowrap", mt: "sm", "data-testid": `branch-action-row-${b.name}`, children: [secondary && _jsx(CardActionButton, { action: secondary }), primary && _jsx(CardActionButton, { action: primary })] }))] }));
 };
 const CardActionButton = ({ action }) => (_jsx(Tooltip, { label: action.blockedReason, disabled: !action.blockedReason, multiline: true, maw: 280, children: _jsx(Button, { variant: "light", color: action.color, onClick: () => {
             if (!action.blockedReason)

package/dist/editor/Editor.js

@@ -1578,6 +1578,7 @@ const EditorContent = ({ entries, title, siteTitle = title, branchName = '', col
                         branchMissing,
                         reviewing: branchReviewing,
                         pullRequestClosed: branchPullRequestClosed,
+                        approveBlocked: currentBranch?.approveBlocked,
                     }), dirtyPaths: dirtyPaths, reveal: contentReveal, onRevealed: () => setContentReveal(undefined), entryFilter: entryFilter === 'changed' && !changesOffered ? 'all' : entryFilter, onEntryFilterChange: setEntryFilter, onShowUnsaved: showUnsaved, onShowDeletedChanges: (entry, label) => showEntryChanges(entry, label, 'deleted row'), branchChanges: changesOffered
                     ? {
                         base: branchChanges.data?.base ?? currentBranch?.baseBranch ?? 'the base branch',
@@ -1601,7 +1602,7 @@ const EditorContent = ({ entries, title, siteTitle = title, branchName = '', col
                     // branchWriteBlocked reuses branchContentLocked itself rather than
                     // re-deriving `?? true` a second time here, so there is exactly one
                     // fail-closed computation of "are writes blocked" in this component.
-                    branchIsProtected: currentBranch?.isProtected ?? true, branchServerProtected: currentBranch?.isProtected, branchReadOnly: currentBranch?.readOnly, branchWriteBlocked: branchContentLocked, branchLoading: branchLoading, branchPending: branchPending, branchMissing: branchMissing, branchToggleRef: branchToggleRef, onBranchReloadData: () => {
+                    branchIsProtected: currentBranch?.isProtected ?? true, branchServerProtected: currentBranch?.isProtected, branchReadOnly: currentBranch?.readOnly, branchHold: currentBranch?.hold, branchApproveBlocked: currentBranch?.approveBlocked, branchWriteBlocked: branchContentLocked, branchLoading: branchLoading, branchPending: branchPending, branchMissing: branchMissing, branchToggleRef: branchToggleRef, onBranchReloadData: () => {
                         void Promise.all([handleReloadBranchData(), refreshEntries(branchNameState)]).catch(console.error);
                     }, onBranchDiscardDrafts: () => handleDiscardDrafts(() => branchToggleRef.current), onBranchManagerOpen: openBranchManager, onNewBranch: () => openBranchManager({ create: true }), onSaveAll: runSaveAll, saveAllProgress: saveAllProgress, 
                     // On any entry: EntryHeader's `saving` is the open entry's alone.
@@ -1634,7 +1635,7 @@ const EditorContent = ({ entries, title, siteTitle = title, branchName = '', col
                             // True exactly while the form below shows "Setting up…" or "Loading content…".
                             entryLoading: !currentEntry && ((!branchNameState && busy) || entriesInitializing), branchName: branchNameState, busy: busy, breadcrumbSegments: breadcrumbSegments, 
                             // A draft kept for an unavailable entry stays in storage but cannot be saved.
-                            hasUnsavedChanges: !currentEntryUnavailable && !contentReadOnly && isSelectedDirty(), entryHasDraft: isSelectedDirty(), entryReadOnly: currentEntry?.canEdit === false, entryUnavailable: currentEntryUnavailable, draftStorageFailed: draftStorageFailed, branchStatus: currentBranch?.status, branchReadOnly: currentBranch?.readOnly, branchWriteBlocked: branchContentLocked, branchLoading: branchLoading, branchPending: branchPending, branchMissing: branchMissing, branchReviewing: branchReviewing, branchPullRequestClosed: branchPullRequestClosed, onCollectionOpen: (path) => revealInContentPanel({ kind: 'collection', path }), onEntryReveal: () => currentEntry && revealInContentPanel({ kind: 'entry', path: currentEntry.path }), navigatorToggleRef: navigatorToggleRef, onShowChanges: openEntryChange
+                            hasUnsavedChanges: !currentEntryUnavailable && !contentReadOnly && isSelectedDirty(), entryHasDraft: isSelectedDirty(), entryReadOnly: currentEntry?.canEdit === false, entryUnavailable: currentEntryUnavailable, draftStorageFailed: draftStorageFailed, branchStatus: currentBranch?.status, branchReadOnly: currentBranch?.readOnly, branchWriteBlocked: branchContentLocked, branchLoading: branchLoading, branchPending: branchPending, branchMissing: branchMissing, branchReviewing: branchReviewing, branchPullRequestClosed: branchPullRequestClosed, branchApproveBlocked: currentBranch?.approveBlocked, onCollectionOpen: (path) => revealInContentPanel({ kind: 'collection', path }), onEntryReveal: () => currentEntry && revealInContentPanel({ kind: 'entry', path: currentEntry.path }), navigatorToggleRef: navigatorToggleRef, onShowChanges: openEntryChange
                                 ? () => showEntryChanges(openEntryChange, currentEntry?.label ?? currentEntry?.slug ?? '', 'header')
                                 : undefined, showChangesPending: changesOffered && !!currentEntry, showChangesRef: showChangesRef, onFileReload: () => handleReload(() => navigatorToggleRef.current), onFileDiscardDraft: () => handleDiscardFileDraft(() => navigatorToggleRef.current), onEntryRename: () => currentEntry && handleRenameEntry(currentEntry.path, true), onEntryDelete: () => currentEntry && handleDeleteEntry(currentEntry.path, true), onSave: currentEntryUnavailable ? noop : handleSave, saveAllRunning: !!saveAllProgress, saving: singleSaving?.branch === branchNameState &&
                                 singleSaving.contentId === currentEntry?.contentId, savedSignal: lastSaved?.seq, savedHere: lastSaved?.branch === branchNameState &&