Initialize the Varbase Canvas Base recipe

Problem/Motivation

The Drupal Canvas setup lives in Varbase Content Base, which is a content-modelling recipe. It installs canvas_override, requires drupal/canvas_override: 1.0.x-dev, and grants 17 Canvas permissions across the Content editor, Content admin and Site admin roles.

Canvas is not a content-modelling concern. A site that wants the Varbase content model should not be obliged to take the Canvas page builder with it, and a site template that wants Canvas should be able to ask for it by name.

Steps to reproduce

1. Build a Varbase 11 site (Drupal ~11.4).
2. grep -n "canvas" recipe.yml composer.json in varbase_content_base: canvas_override is in the install: list, drupal/canvas_override is in require, and the 17 Canvas permission grants are in the role config.
3. There is no way to apply the Canvas setup without also applying the whole Varbase content model.

Proposed resolution

Add a new recipe, Varbase Canvas Base, as the home for the Drupal Canvas setup.

• Package drupal/varbase_canvas_base, type drupal-recipe, branch 1.0.x, version 1.0.x-dev.
• Requires drupal/core: ~11.4.0, drupal/canvas: ~1, drupal/canvas_override: 1.0.x-dev.
• recipe.yml: type: Varbase Canvas, config.strict: false, install: [canvas, canvas_override].

Permission grants, moved verbatim out of Varbase Content Base. This is a pure move: no permission is added, removed or renamed.

• content_editor: create canvas_page, edit canvas_page.
• content_admin: administer folders, administer patterns, create canvas_page, edit canvas_page, publish auto-saves.
• site_admin: administer components, administer content templates, administer folders, administer page template, administer patterns, create canvas_page, delete canvas_page, edit canvas_page, edit canvas global regions, publish auto-saves.

administer code components is deliberately not granted to any role. Canvas marks it restrict access: true because it executes JavaScript.

The recipe is required and applied in Varbase Starter only. Not in Varbase Content Base, not in Varbase Media Base, and deliberately not in Educare, Horizon Aid or RightUp.

Scope decisions

Recorded so reviewers can see what was considered and deliberately left out.

• The canvas module install stays in Varbase Media Base. Educare, Horizon Aid and RightUp each carry between 58 and 80 canvas.component and canvas.content_template config keys, none of them installs the canvas module itself, and all three apply varbase_media_base directly rather than through varbase_starter. Moving the install would break all three. Varbase Canvas Base still lists canvas in its own install: and requires drupal/canvas: ~1, which is harmless and idempotent.
• Canvas Icon Picker is not part of this recipe. It stays with Varbase Admin Base, per #3620064 and #3620066. Those issues stand as they are.
• canvas_interactive_toggle is not included. Adding it would be new shipping surface rather than a move, so it is out of scope here.
• No canvas_override permission is granted. The gap is real: no Varbase recipe has ever granted use canvas override, reset canvas layout, edit canvas default template or administer canvas override, so the module is installed for roles that cannot use it. This issue does not fix that. Keeping the move pure is the point, and the grants need their own decision.
• canvas_translate stays in Varbase i18n Base. It is a language concern, and a monolingual site should not carry it.
• The canvas_html_inline and canvas_html_block text format permissions stay in Varbase Editor Base. They are text format grants, which is that recipe's job.

What was verified

• The recipe applies green with drush recipe on a Varbase 11 DDEV site.
• A fresh drush site:install varbase on a second, clean Varbase 11 site is in progress.
• The code is on the GitHub mirror at Vardot/varbase_canvas_base, branch 1.0.x.

Remaining tasks

• ✅ File an issue
• ✅ Addition/Change/Update/Fix
• ❌ Testing to ensure no regression
• ➖ Automated unit/functional testing coverage
• ➖ Developer Documentation support
• ➖ User Guide Documentation support
• ➖ UX/UI designer responsibilities
• ➖ Accessibility and Readability
• ❌ Follow-up, not yet filed: Varbase Content Base drops the canvas_override install, the drupal/canvas_override requirement and those 17 permission grants, and Varbase Starter applies varbase_canvas_base and requires drupal/varbase_canvas_base: ~1.0.0. Both changes are written locally.
• ❌ Follow-up, needs a decision before Varbase Content Base ships the change above: Educare, Horizon Aid and RightUp lose those Canvas permissions once Varbase Content Base stops granting them, because all three apply varbase_content_base directly and none of them requires this recipe.
• ❌ Decide separately whether the canvas_override permissions should be granted, and by which recipe
• ❌ Reviewed by a human
• ❌ Code review by maintainers
• ❌ Full testing and approval
• ❌ Credit contributors
• ❌ Review with the product owner
• ❌ Update Release Notes
• ❌ Release

User interface changes

• None. The same roles keep exactly the same Canvas permissions, granted by a different recipe.

API changes

• N/A

Data model changes

• N/A

Release notes snippet

• New recipe: Varbase Canvas Base, the home for the Drupal Canvas setup in Varbase. It installs Canvas and Canvas Override and grants the Canvas permissions that Varbase Content Base used to grant, unchanged. Varbase Starter applies it.