canopycms 0.0.53 → 0.0.55

package/dist/cli/generate-ai-content.js

@@ -9,11 +9,11 @@ var __export = (target, all) => {
 };
 
 // dist/paths/normalize.js
-function normalizeFilesystemPath(path15) {
-  return path15.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path17) {
+  return path17.split(/[\\/]+/).filter(Boolean).join("/");
 }
-function hasTraversalSequence(path15) {
-  const normalized = normalizeFilesystemPath(path15);
+function hasTraversalSequence(path17) {
+  const normalized = normalizeFilesystemPath(path17);
   return normalized.includes("..");
 }
 function createLogicalPath(...segments) {
@@ -23,14 +23,14 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
-function trimSlashes(path15) {
+function trimSlashes(path17) {
   let start = 0;
-  let end = path15.length;
-  while (start < end && path15[start] === "/")
+  let end = path17.length;
+  while (start < end && path17[start] === "/")
     start++;
-  while (end > start && path15[end - 1] === "/")
+  while (end > start && path17[end - 1] === "/")
     end--;
-  return path15.slice(start, end);
+  return path17.slice(start, end);
 }
 var init_normalize = __esm({
   "dist/paths/normalize.js"() {
@@ -284,7 +284,7 @@ var mediaSchema;
 var init_media = __esm({
   "dist/config/schemas/media.js"() {
     "use strict";
-    mediaSchema = z3.union([
+    mediaSchema = z3.discriminatedUnion("adapter", [
       z3.object({
         adapter: z3.literal("local"),
         publicBaseUrl: z3.string().url().optional()
@@ -298,10 +298,6 @@ var init_media = __esm({
       z3.object({
         adapter: z3.literal("lfs"),
         publicBaseUrl: z3.string().url().optional()
-      }),
-      z3.object({
-        adapter: z3.string().min(1),
-        publicBaseUrl: z3.string().url().optional()
       })
     ]);
   }
@@ -345,8 +341,12 @@ var init_config = __esm({
     });
     CanopyConfigSchema = z4.object({
       media: mediaSchema.optional(),
-      defaultBranchAccess: defaultBranchAccessSchema.optional(),
-      defaultPathAccess: defaultPathAccessSchema.optional(),
+      // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
+      // have .default('deny'), so the field is optional on input but always resolves to
+      // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
+      // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      defaultBranchAccess: defaultBranchAccessSchema,
+      defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
       // unset must stay undefined after parsing so dev mode can detect the fork
       // point from git HEAD (see resolveBaseBranch in utils/git.ts).
@@ -541,7 +541,7 @@ var init_config2 = __esm({
 });
 
 // dist/operating-mode/client-unsafe-strategy.js
-import path3 from "node:path";
+import path5 from "node:path";
 function operatingStrategy(mode) {
   const cached = strategyCache.get(mode);
   if (cached)
@@ -578,32 +578,32 @@ var init_client_unsafe_strategy = __esm({
       // - shouldCommit(), shouldPush()
       // Add client-unsafe methods (use Node.js APIs)
       getWorkspaceRoot(_sourceRoot) {
-        return path3.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
+        return path5.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
       }
       getContentRoot(sourceRoot) {
-        return path3.resolve(sourceRoot ?? process.cwd(), "content");
+        return path5.resolve(sourceRoot ?? process.cwd(), "content");
       }
       getContentBranchesRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path5.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path3.join(root, this.getPermissionsFileName());
+        return path5.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path3.join(root, this.getGroupsFileName());
+        return path5.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
           shouldAutoInitLocal: false,
           defaultRemotePath: "",
           envVarName: "CANOPYCMS_REMOTE_URL",
-          autoDetectRemotePath: path3.join(this.getWorkspaceRoot(), "remote.git")
+          autoDetectRemotePath: path5.join(this.getWorkspaceRoot(), "remote.git")
         };
       }
       requiresExistingRepo() {
@@ -616,7 +616,7 @@ var init_client_unsafe_strategy = __esm({
         return `canopycms-settings-${deploymentName}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -633,25 +633,25 @@ var init_client_unsafe_strategy = __esm({
     DevStrategy = class extends DevClientSafeStrategy {
       // Inherits client-safe methods from DevClientSafeStrategy
       getWorkspaceRoot(sourceRoot) {
-        return path3.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
+        return path5.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
       getContentRoot(sourceRoot) {
-        return path3.resolve(sourceRoot ?? process.cwd(), "content");
+        return path5.resolve(sourceRoot ?? process.cwd(), "content");
       }
       getContentBranchesRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path5.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path3.join(root, this.getPermissionsFileName());
+        return path5.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path3.join(root, this.getGroupsFileName());
+        return path5.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
@@ -670,7 +670,7 @@ var init_client_unsafe_strategy = __esm({
         return `canopycms-settings-${deploymentName}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -702,16 +702,16 @@ var init_operating_mode = __esm({
 });
 
 // dist/cli/generate-ai-content.js
-import path14 from "node:path";
+import path16 from "node:path";
 import { createJiti } from "jiti";
 
 // dist/build/generate-ai-content.js
-import fs11 from "node:fs/promises";
-import path13 from "node:path";
+import fs14 from "node:fs/promises";
+import path15 from "node:path";
 
 // dist/content-store.js
-import fs4 from "node:fs/promises";
-import path5 from "node:path";
+import fs6 from "node:fs/promises";
+import path7 from "node:path";
 import matter from "gray-matter";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 
@@ -1076,13 +1076,13 @@ function extractIdFromFilename(filename) {
   return null;
 }
 async function resolveCollectionPath(root, logicalPath) {
-  const fs12 = await import("node:fs/promises");
-  const path15 = await import("node:path");
+  const fs15 = await import("node:fs/promises");
+  const path17 = await import("node:path");
   const segments = logicalPath.split("/").filter(Boolean);
   let currentPath = root;
   for (const segment of segments) {
     try {
-      const entries = await fs12.readdir(currentPath, { withFileTypes: true });
+      const entries = await fs15.readdir(currentPath, { withFileTypes: true });
       const matchingDir = entries.find((entry) => {
         if (!entry.isDirectory())
           return false;
@@ -1090,7 +1090,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return logicalName === segment.toLowerCase();
       });
       if (matchingDir) {
-        currentPath = path15.join(currentPath, matchingDir.name);
+        currentPath = path17.join(currentPath, matchingDir.name);
       } else {
         return null;
       }
@@ -1140,6 +1140,192 @@ function extractSlugFromFilename(filename, entryTypeName) {
   return filename.toLowerCase();
 }
 
+// dist/content-index-registry.js
+import path3 from "node:path";
+var registry = /* @__PURE__ */ new Map();
+var finalization = new FinalizationRegistry(({ rootKey, ref }) => {
+  const refs = registry.get(rootKey);
+  if (!refs)
+    return;
+  refs.delete(ref);
+  if (refs.size === 0)
+    registry.delete(rootKey);
+});
+function registerContentIndexForInvalidation(root, target) {
+  const rootKey = path3.resolve(root);
+  let refs = registry.get(rootKey);
+  if (!refs) {
+    refs = /* @__PURE__ */ new Set();
+    registry.set(rootKey, refs);
+  }
+  const ref = new WeakRef(target);
+  refs.add(ref);
+  finalization.register(target, { rootKey, ref });
+}
+function invalidateContentIndexesForRoot(root) {
+  const rootKey = path3.resolve(root);
+  const prefix = rootKey + path3.sep;
+  for (const [storeRoot, refs] of registry) {
+    if (storeRoot !== rootKey && !storeRoot.startsWith(prefix))
+      continue;
+    for (const ref of refs) {
+      const target = ref.deref();
+      if (target) {
+        target.invalidateIndex();
+      } else {
+        refs.delete(ref);
+      }
+    }
+    if (refs.size === 0)
+      registry.delete(storeRoot);
+  }
+}
+
+// dist/content-index-generation.js
+import fs3 from "node:fs/promises";
+import path4 from "node:path";
+import { randomUUID } from "node:crypto";
+
+// dist/utils/debug.js
+var LOG_LEVELS = {
+  DEBUG: 0,
+  INFO: 1,
+  WARN: 2,
+  ERROR: 3
+};
+var DebugLogger = class {
+  constructor(options = {}) {
+    this.timers = /* @__PURE__ */ new Map();
+    this.options = options;
+  }
+  shouldLog(level) {
+    const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
+    if (!enabled)
+      return false;
+    const minLevel = this.options.minLevel ?? "DEBUG";
+    return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
+  }
+  formatMessage(level, category, message) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const prefix = this.options.prefix ?? "CanopyCMS";
+    return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+  }
+  debug(category, message, data) {
+    if (this.shouldLog("DEBUG")) {
+      console.log(this.formatMessage("DEBUG", category, message), data ?? "");
+    }
+  }
+  info(category, message, data) {
+    if (this.shouldLog("INFO")) {
+      console.log(this.formatMessage("INFO", category, message), data ?? "");
+    }
+  }
+  warn(category, message, data) {
+    if (this.shouldLog("WARN")) {
+      console.warn(this.formatMessage("WARN", category, message), data ?? "");
+    }
+  }
+  error(category, message, data) {
+    const msg = this.formatMessage("ERROR", category, message);
+    if (this.shouldLog("ERROR")) {
+      console.error(msg, data ?? "");
+    }
+    const throwOnError = this.options.throwOnError ?? false;
+    if (throwOnError) {
+      const errorMsg = data ? `${message}: ${JSON.stringify(data)}` : message;
+      throw new Error(errorMsg);
+    }
+  }
+  /**
+   * Start timing an operation
+   */
+  time(label) {
+    this.timers.set(label, Date.now());
+  }
+  /**
+   * End timing an operation and log the duration
+   */
+  timeEnd(category, label) {
+    const start = this.timers.get(label);
+    if (start === void 0) {
+      this.warn(category, `Timer '${label}' does not exist`);
+      return;
+    }
+    const duration = Date.now() - start;
+    this.timers.delete(label);
+    this.debug(category, `${label} completed`, { durationMs: duration });
+    return duration;
+  }
+  /**
+   * Wrap an async function with automatic timing
+   */
+  async timed(category, label, fn) {
+    this.time(label);
+    try {
+      return await fn();
+    } finally {
+      this.timeEnd(category, label);
+    }
+  }
+};
+function createDebugLogger(options) {
+  return new DebugLogger(options);
+}
+var testLogger = createDebugLogger({
+  enabled: process.env.E2E_DEBUG === "true",
+  prefix: "E2E",
+  throwOnError: false
+});
+
+// dist/content-index-generation.js
+var log = createDebugLogger({ prefix: "ContentIndex" });
+var META_DIR = ".canopy-meta";
+var GENERATION_FILE = "content-index.generation";
+function contentIndexGenerationPath(root) {
+  return path4.join(path4.resolve(root), META_DIR, GENERATION_FILE);
+}
+async function bumpContentIndexGeneration(root) {
+  const token = randomUUID();
+  try {
+    await atomicWriteFile(contentIndexGenerationPath(root), token);
+    return token;
+  } catch (err) {
+    log.warn("generation", `Failed to bump content index generation for ${root}`, {
+      error: getErrorMessage(err)
+    });
+    return null;
+  }
+}
+async function readContentIndexGeneration(root) {
+  try {
+    return await fs3.readFile(contentIndexGenerationPath(root), "utf-8");
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT")
+      return null;
+    log.warn("generation", `Failed to read content index generation for ${root}`, {
+      error: getErrorMessage(err)
+    });
+    return null;
+  }
+}
+async function invalidateContentIndexesDurable(root) {
+  await bumpContentIndexGeneration(root);
+  invalidateContentIndexesForRoot(root);
+}
+
+// dist/utils/fs.js
+import fs4 from "node:fs/promises";
+async function filePathExists(filePath) {
+  try {
+    await fs4.stat(filePath);
+    return true;
+  } catch (err) {
+    if (isNotFoundError(err))
+      return false;
+    throw err;
+  }
+}
+
 // dist/utils/format.js
 var getFormatExtension = (format) => {
   if (format === "md")
@@ -1158,8 +1344,8 @@ init_normalize();
 
 // dist/paths/branch.js
 init_operating_mode();
-import fs3 from "node:fs/promises";
-import path4 from "node:path";
+import fs5 from "node:fs/promises";
+import path6 from "node:path";
 var BranchPathError = class extends Error {
 };
 function sanitizeBranchName(branchName) {
@@ -1178,11 +1364,11 @@ function resolveBranchPath(options) {
   const safeBranch = sanitizeBranchName(options.branchName);
   const strategy = operatingStrategy(options.mode);
   const baseRoot = resolveContentBranchesRoot(options.mode, options.basePathOverride);
-  const normalizedBase = path4.resolve(baseRoot);
-  const baseWithSep = normalizedBase.endsWith(path4.sep) ? normalizedBase : `${normalizedBase}${path4.sep}`;
+  const normalizedBase = path6.resolve(baseRoot);
+  const baseWithSep = normalizedBase.endsWith(path6.sep) ? normalizedBase : `${normalizedBase}${path6.sep}`;
   const branchRoot = strategy.getContentBranchRoot(safeBranch, options.basePathOverride);
   const withinBase = (target) => {
-    const resolved = path4.resolve(target);
+    const resolved = path6.resolve(target);
     return resolved === normalizedBase || resolved.startsWith(baseWithSep);
   };
   if (!withinBase(branchRoot)) {
@@ -1192,7 +1378,7 @@ function resolveBranchPath(options) {
 }
 async function ensureBranchRoot(options) {
   const result = resolveBranchPath(options);
-  await fs3.mkdir(result.branchRoot, { recursive: true });
+  await fs5.mkdir(result.branchRoot, { recursive: true });
   return result;
 }
 
@@ -1222,24 +1408,147 @@ function validateSlug(slug) {
     throw new ContentStoreError("Slugs cannot contain backslashes. Use nested collections instead.", "VALIDATION");
   }
 }
+var DEFAULT_INDEX_FRESHNESS_INTERVAL_MS = 1e3;
+var FORCED_REFRESH_MIN_INTERVAL_MS = 5e3;
+var STALE_LOOKUP = Symbol("stale-index-lookup");
 var ContentStore = class {
-  constructor(root, flatSchema) {
-    this.indexLoaded = false;
-    this.root = path5.resolve(root);
+  constructor(root, flatSchema, options = {}) {
+    this.indexGeneration = 0;
+    this.loadedIndexGeneration = -1;
+    this.loadedDiskGeneration = void 0;
+    this.lastDiskProbeMs = 0;
+    this.lastForcedRefreshMs = 0;
+    this.indexBuild = null;
+    this.root = path7.resolve(root);
+    this.indexFreshnessIntervalMs = options.indexFreshnessIntervalMs ?? DEFAULT_INDEX_FRESHNESS_INTERVAL_MS;
     this.schemaIndex = new Map(flatSchema.map((item) => [item.logicalPath, item]));
     this._idIndex = new ContentIdIndex(this.root);
+    registerContentIndexForInvalidation(this.root, this);
+  }
+  /**
+   * Mark the ID index stale so the next idIndex() access rebuilds it from disk.
+   *
+   * Called (via content-index-registry) after in-process operations that change the
+   * working tree underneath this store — git checkout/merge/rebase, the worker's
+   * rebase loop, and sync-core's content replacement. Without this, ID→path lookups
+   * keep resolving to pre-mutation paths and saves can target moved/deleted files.
+   *
+   * Cheap: only bumps a generation counter; the rebuild happens lazily.
+   */
+  invalidateIndex() {
+    this.indexGeneration++;
   }
   /**
-   * Get the ID index, ensuring it's loaded first.
-   * This getter automatically loads the index on first access.
+   * Get the ID index, ensuring it's loaded and current first.
+   * Loads lazily on first access and rebuilds after invalidateIndex(); repeated
+   * accesses with no intervening invalidation reuse the already-built index,
+   * except for a throttled probe of the on-disk generation marker that detects
+   * mutations made by OTHER processes sharing this root (e.g. on EFS).
    */
   async idIndex() {
-    if (!this.indexLoaded) {
-      await this._idIndex.buildFromFilenames("content");
-      this.indexLoaded = true;
+    if (this.loadedIndexGeneration === this.indexGeneration && this.shouldProbeDiskGeneration()) {
+      const diskToken = await readContentIndexGeneration(this.root);
+      if (diskToken !== this.loadedDiskGeneration) {
+        this.indexGeneration++;
+      }
+    }
+    while (this.loadedIndexGeneration !== this.indexGeneration) {
+      if (this.indexBuild) {
+        await this.indexBuild;
+        continue;
+      }
+      const generation = this.indexGeneration;
+      const build = (async () => {
+        const diskToken = await readContentIndexGeneration(this.root);
+        const fresh = new ContentIdIndex(this.root);
+        await fresh.buildFromFilenames("content");
+        return { diskToken, fresh };
+      })();
+      this.indexBuild = build;
+      let result;
+      try {
+        result = await build;
+      } finally {
+        this.indexBuild = null;
+      }
+      this._idIndex = result.fresh;
+      this.loadedIndexGeneration = generation;
+      this.loadedDiskGeneration = result.diskToken;
+      this.lastDiskProbeMs = Date.now();
     }
     return this._idIndex;
   }
+  /**
+   * Throttle for the on-disk marker probe. Stamps the clock synchronously
+   * before the caller's readFile so concurrent idIndex() callers don't
+   * double-probe (and double-rebuild) on the same token change.
+   */
+  shouldProbeDiskGeneration() {
+    const now = Date.now();
+    if (now - this.lastDiskProbeMs < this.indexFreshnessIntervalMs)
+      return false;
+    this.lastDiskProbeMs = now;
+    return true;
+  }
+  /**
+   * After one of this store's own successful mutations: publish the change to
+   * other processes (bump the on-disk marker) and adopt the written token,
+   * since the in-memory index was already updated incrementally — avoiding a
+   * pointless self-rescan on the next probe. Adoption is skipped unless the
+   * index is quiescent and `updatedIndex` is still the live instance: if a
+   * rebuild raced with the mutation, its scan may predate our file change, so
+   * we leave the recorded token older and let the next probe observe our bump
+   * and trigger the healing rebuild.
+   */
+  async recordOwnMutation(updatedIndex) {
+    const token = await bumpContentIndexGeneration(this.root);
+    if (token !== null && this.indexBuild === null && this.loadedIndexGeneration === this.indexGeneration && this._idIndex === updatedIndex) {
+      this.loadedDiskGeneration = token;
+    }
+  }
+  /**
+   * Backstop for the residual staleness windows of the cross-process marker
+   * (NFS attribute caching, probe throttle, self-adoption — see
+   * content-index-generation.ts): force one rebuild in response to a
+   * suspicious lookup (an ID miss, or an index hit whose file is gone), but
+   * throttle how often a caller can force one. Time-boxed so genuinely
+   * dangling IDs cost at most one rescan per window. Returns true if a
+   * refresh was performed by THIS call; callers that lose the throttle race
+   * still benefit — idIndex() dedupes concurrent builds, so a caller that won
+   * the race rebuilds the index for everyone, and callers should still retry
+   * their lookup against the live index regardless of this return value.
+   */
+  async refreshIndexForSuspiciousLookup() {
+    const now = Date.now();
+    if (now - this.lastForcedRefreshMs < FORCED_REFRESH_MIN_INTERVAL_MS)
+      return false;
+    this.lastForcedRefreshMs = now;
+    this.invalidateIndex();
+    await this.idIndex();
+    return true;
+  }
+  /**
+   * Find the file in `dir` whose filename embeds `id`.
+   * Returns its root-relative path, or null if no such file (or no such dir).
+   */
+  async findEntryPathById(dir, id) {
+    let entries;
+    try {
+      entries = await fs6.readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return null;
+      throw err;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory())
+        continue;
+      if (extractIdFromFilename(entry.name) === id) {
+        return path7.relative(this.root, path7.join(dir, entry.name));
+      }
+    }
+    return null;
+  }
   /**
    * Get all schema items for iteration.
    * Used internally by ReferenceResolver for path matching.
@@ -1247,11 +1556,11 @@ var ContentStore = class {
   getSchemaItems() {
     return this.schemaIndex.values();
   }
-  assertSchemaItem(path15) {
-    const normalized = normalizeFilesystemPath(path15);
+  assertSchemaItem(path17) {
+    const normalized = normalizeFilesystemPath(path17);
     const item = this.schemaIndex.get(normalized);
     if (!item) {
-      throw new ContentStoreError(`Unknown schema item: ${path15}`, "NO_SCHEMA_ITEM");
+      throw new ContentStoreError(`Unknown schema item: ${path17}`, "NO_SCHEMA_ITEM");
     }
     return item;
   }
@@ -1278,7 +1587,7 @@ var ContentStore = class {
    * @param options.entryTypeName - For collections with multiple entry types, specify which one to use. Defaults to the default entry type.
    */
   async buildPaths(schemaItem, slug, options = {}) {
-    const rootWithSep = this.root.endsWith(path5.sep) ? this.root : `${this.root}${path5.sep}`;
+    const rootWithSep = this.root.endsWith(path7.sep) ? this.root : `${this.root}${path7.sep}`;
     if (schemaItem.type === "entry-type") {
       const parentPath = schemaItem.parentPath || "";
       const parentCollection = this.schemaIndex.get(parentPath);
@@ -1311,7 +1620,7 @@ var ContentStore = class {
       const entryTypeName = entryTypeConfig?.name || "entry";
       let collectionRoot = await resolveCollectionPath(this.root, schemaItem.logicalPath);
       if (!collectionRoot) {
-        collectionRoot = path5.resolve(this.root, schemaItem.logicalPath);
+        collectionRoot = path7.resolve(this.root, schemaItem.logicalPath);
       }
       if (!collectionRoot.startsWith(rootWithSep)) {
         throw new ContentStoreError("Path traversal detected", "VALIDATION");
@@ -1320,7 +1629,7 @@ var ContentStore = class {
       let existingFilename;
       let existingEntryType;
       if (!id) {
-        const entries = await fs4.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+        const entries = await fs6.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
         const existingFile = entries.find((entry) => {
           if (entry.isDirectory())
             return false;
@@ -1344,14 +1653,14 @@ var ContentStore = class {
         }
         filename = `${finalEntryTypeName}.${safeSlug}.${id}${ext}`;
       }
-      const resolved = path5.resolve(collectionRoot, filename);
-      const collectionRootWithSep = collectionRoot.endsWith(path5.sep) ? collectionRoot : `${collectionRoot}${path5.sep}`;
+      const resolved = path7.resolve(collectionRoot, filename);
+      const collectionRootWithSep = collectionRoot.endsWith(path7.sep) ? collectionRoot : `${collectionRoot}${path7.sep}`;
       if (!resolved.startsWith(collectionRootWithSep)) {
         throw new ContentStoreError("Path traversal detected", "VALIDATION");
       }
       return {
         absolutePath: resolved,
-        relativePath: path5.relative(this.root, resolved),
+        relativePath: path7.relative(this.root, resolved),
         id,
         entryTypeName: finalEntryTypeName
       };
@@ -1386,8 +1695,8 @@ var ContentStore = class {
   async read(collectionPath, slug = "", options = {}) {
     const schemaItem = this.assertSchemaItem(collectionPath);
     const { absolutePath, relativePath, entryTypeName: resolvedEntryTypeName } = await this.buildPaths(schemaItem, slug);
-    const stat = await fs4.stat(absolutePath);
-    const raw = await fs4.readFile(absolutePath, "utf8");
+    const stat = await fs6.stat(absolutePath);
+    const raw = await fs6.readFile(absolutePath, "utf8");
     let doc;
     let format;
     let fields;
@@ -1445,7 +1754,7 @@ var ContentStore = class {
     return doc;
   }
   async write(collectionPath, slug = "", input, entryTypeName, existingId) {
-    const idIndex = await this.idIndex();
+    await this.idIndex();
     const schemaItem = this.assertSchemaItem(collectionPath);
     let expectedFormat;
     let fields = [];
@@ -1473,10 +1782,10 @@ var ContentStore = class {
       existingId
     });
     return withLock(absolutePath, async () => {
-      await fs4.mkdir(path5.dirname(absolutePath), { recursive: true });
+      await fs6.mkdir(path7.dirname(absolutePath), { recursive: true });
       if (input.expectedVersion !== void 0) {
         try {
-          const existing = await fs4.stat(absolutePath);
+          const existing = await fs6.stat(absolutePath);
           if (existing.mtimeMs !== input.expectedVersion) {
             throw new ContentConflictError();
           }
@@ -1489,6 +1798,13 @@ var ContentStore = class {
           }
         }
       }
+      if (existingId && !await filePathExists(absolutePath)) {
+        const actualRelPath = await this.findEntryPathById(path7.dirname(absolutePath), existingId);
+        const indexedRelPath = (await this.idIndex()).findById(existingId)?.relativePath ?? null;
+        if (actualRelPath !== null && actualRelPath !== indexedRelPath) {
+          throw new ContentConflictError();
+        }
+      }
       let content;
       if (input.format === "json") {
         content = `${JSON.stringify(input.data ?? {}, null, 2)}
@@ -1499,19 +1815,17 @@ var ContentStore = class {
         content = matter.stringify(input.body, input.data ?? {});
       }
       await atomicWriteFile(absolutePath, content);
+      const liveIndex = this._idIndex;
+      let staleOldAbsPath = null;
       if (id) {
-        const existing = idIndex.findById(id);
+        const existing = liveIndex.findById(id);
         if (existing) {
           if (existing.relativePath !== relativePath) {
-            const oldAbsPath = path5.join(this.root, existing.relativePath);
-            await fs4.unlink(oldAbsPath).catch((err) => {
-              if (!isNodeError(err) || err.code !== "ENOENT")
-                throw err;
-            });
-            idIndex.updatePath(existing.id, relativePath);
+            staleOldAbsPath = path7.join(this.root, existing.relativePath);
+            liveIndex.updatePath(existing.id, relativePath);
           }
         } else {
-          idIndex.add({
+          liveIndex.add({
             type: "entry",
             relativePath,
             collection: collectionPath,
@@ -1519,7 +1833,14 @@ var ContentStore = class {
           });
         }
       }
-      const afterStat = await fs4.stat(absolutePath);
+      if (staleOldAbsPath) {
+        await fs6.unlink(staleOldAbsPath).catch((err) => {
+          if (!isNodeError(err) || err.code !== "ENOENT")
+            throw err;
+        });
+      }
+      await this.recordOwnMutation(liveIndex);
+      const afterStat = await fs6.stat(absolutePath);
       const base = {
         collection: schemaItem.logicalPath,
         collectionName: schemaItem.name,
@@ -1545,13 +1866,34 @@ var ContentStore = class {
   /**
    * Read an entry by its ID (UUID).
    * Returns null if the ID doesn't exist or points to a collection.
+   *
+   * Suspicious results (ID missing from the index, or an index hit whose file
+   * is gone) trigger one forced index refresh and a retry — self-healing for
+   * mutations by other processes inside the marker's residual windows.
    */
   async readById(id) {
+    const first = await this.readByIdOnce(id);
+    if (first !== STALE_LOOKUP)
+      return first;
+    if (!await this.refreshIndexForSuspiciousLookup())
+      return null;
+    const second = await this.readByIdOnce(id);
+    return second === STALE_LOOKUP ? null : second;
+  }
+  async readByIdOnce(id) {
     const idIndex = await this.idIndex();
     const location = idIndex.findById(id);
-    if (!location || location.type !== "entry")
+    if (!location)
+      return STALE_LOOKUP;
+    if (location.type !== "entry")
       return null;
-    return this.read(location.collection, location.slug);
+    try {
+      return await this.read(location.collection, location.slug);
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return STALE_LOOKUP;
+      throw err;
+    }
   }
   /**
    * Get the ID for an entry given its collection and slug.
@@ -1562,19 +1904,72 @@ var ContentStore = class {
     const { relativePath } = await this.buildPaths(this.assertCollection(collectionPath), slug);
     return idIndex.findByPath(relativePath);
   }
+  /**
+   * Check whether a document already exists on disk for this collection+slug.
+   * Used by the write boundary to distinguish creates from edits (create
+   * scaffolds and maxItems enforcement).
+   */
+  async documentExists(collectionPath, slug = "") {
+    const schemaItem = this.assertSchemaItem(collectionPath);
+    const { absolutePath } = await this.buildPaths(schemaItem, slug);
+    try {
+      await fs6.access(absolutePath);
+      return true;
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return false;
+      throw err;
+    }
+  }
+  /**
+   * Resolve the actual on-disk entry type of an existing collection entry, by
+   * inspecting its filename directly. Entry filenames embed their type
+   * (`{type}.{slug}.{id}.{ext}`) and it is immutable after creation — see the
+   * existing-file lookup in buildPaths(), which this mirrors. Returns
+   * undefined if no entry exists yet at this slug.
+   *
+   * Used at the API write boundary (api/content.ts) to validate an existing
+   * entry's payload against ITS real schema rather than a caller-supplied (or
+   * omitted/spoofed) `entryType` param — ContentStore.write() preserves the
+   * on-disk type regardless of what's requested, so validation must agree
+   * with what will actually be written (post-review M2).
+   *
+   * Cheap: one buildPaths() resolution plus a stat, no file content is read —
+   * same cost class as documentExists().
+   */
+  async getExistingEntryType(collectionPath, slug = "") {
+    const schemaItem = this.assertCollection(collectionPath);
+    const { absolutePath, entryTypeName } = await this.buildPaths(schemaItem, slug);
+    return await filePathExists(absolutePath) ? entryTypeName : void 0;
+  }
+  /**
+   * Count existing entries of a given entry type in a collection, by filename
+   * (entry filenames embed their type: `{type}.{slug}.{id}.{ext}`). Used to
+   * enforce `EntryTypeConfig.maxItems` server-side at the create boundary.
+   */
+  async countEntriesOfType(collectionPath, entryTypeName) {
+    this.assertCollection(collectionPath);
+    const collectionRoot = await resolveCollectionPath(this.root, collectionPath);
+    if (!collectionRoot)
+      return 0;
+    const entries = await fs6.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+    return entries.filter((entry) => !entry.isDirectory() && extractEntryTypeFromFilename(entry.name) === entryTypeName).length;
+  }
   /**
    * Delete an entry and remove it from the index.
    */
   async delete(collectionPath, slug) {
-    const idIndex = await this.idIndex();
+    await this.idIndex();
     const collection = this.assertCollection(collectionPath);
     const { absolutePath, relativePath } = await this.buildPaths(collection, slug);
     return withLock(absolutePath, async () => {
-      const id = idIndex.findByPath(relativePath);
-      await fs4.unlink(absolutePath);
+      await fs6.unlink(absolutePath);
+      const liveIndex = this._idIndex;
+      const id = liveIndex.findByPath(relativePath);
       if (id) {
-        idIndex.remove(id);
+        liveIndex.remove(id);
       }
+      await this.recordOwnMutation(liveIndex);
     });
   }
   /**
@@ -1588,7 +1983,7 @@ var ContentStore = class {
    * @throws ContentStoreError if entry doesn't exist, new slug conflicts, or validation fails
    */
   async renameEntry(collectionPath, currentSlug, newSlug) {
-    const idIndex = await this.idIndex();
+    await this.idIndex();
     const collection = this.assertCollection(collectionPath);
     validateSlug(newSlug);
     const safeNewSlug = newSlug.replace(/^\/+/, "");
@@ -1601,11 +1996,11 @@ var ContentStore = class {
     const { absolutePath: currentPath, relativePath: currentRelPath } = await this.buildPaths(collection, currentSlug);
     return withLock(currentPath, async () => {
       try {
-        await fs4.access(currentPath);
+        await fs6.access(currentPath);
       } catch {
         throw new ContentStoreError(`Entry not found: ${currentSlug}`, "NOT_FOUND");
       }
-      const currentFilename = path5.basename(currentPath);
+      const currentFilename = path7.basename(currentPath);
       const parts = currentFilename.split(".");
       if (parts.length < 4) {
         throw new ContentStoreError(`Invalid entry filename format: ${currentFilename}`, "VALIDATION");
@@ -1614,10 +2009,10 @@ var ContentStore = class {
       const contentId = parts[parts.length - 2];
       const ext = `.${parts[parts.length - 1]}`;
       const newFilename = `${entryTypeName}.${safeNewSlug}.${contentId}${ext}`;
-      const parentDir = path5.dirname(currentPath);
-      const newPath = path5.join(parentDir, newFilename);
+      const parentDir = path7.dirname(currentPath);
+      const newPath = path7.join(parentDir, newFilename);
       try {
-        const entries = await fs4.readdir(parentDir, { withFileTypes: true });
+        const entries = await fs6.readdir(parentDir, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isDirectory())
             continue;
@@ -1631,19 +2026,21 @@ var ContentStore = class {
           throw err;
       }
       try {
-        await fs4.link(currentPath, newPath);
+        await fs6.link(currentPath, newPath);
       } catch (err) {
         if (isNodeError(err) && err.code === "EEXIST") {
           throw new ContentStoreError(`Entry with slug "${safeNewSlug}" already exists in collection "${collectionPath}"`, "VALIDATION");
         }
         throw err;
       }
-      await fs4.unlink(currentPath);
-      const newRelativePath = path5.relative(this.root, newPath);
-      const entryId = idIndex.findByPath(currentRelPath);
+      await fs6.unlink(currentPath);
+      const newRelativePath = path7.relative(this.root, newPath);
+      const liveIndex = this._idIndex;
+      const entryId = liveIndex.findByPath(currentRelPath);
       if (entryId) {
-        idIndex.updatePath(entryId, newRelativePath);
+        liveIndex.updatePath(entryId, newRelativePath);
       }
+      await this.recordOwnMutation(liveIndex);
       return { newPath: `${collectionPath}/${safeNewSlug}` };
     });
   }
@@ -1737,11 +2134,32 @@ var ContentStore = class {
    * Resolve a single reference ID to full entry data.
    * Returns null if the reference is invalid or missing.
    * Includes id, slug, and collection fields for debugging.
+   *
+   * Suspicious results (ID missing from the index, or an index hit whose file
+   * is gone) trigger one forced index refresh and a retry — self-healing for
+   * mutations by other processes inside the marker's residual windows. The
+   * forced refresh itself is throttled (see refreshIndexForSuspiciousLookup),
+   * but the retry against the live index always runs regardless of whether
+   * this call won the throttle race: when a `list: true` reference array is
+   * resolved via Promise.all, every miss shares the same stale snapshot, and
+   * idIndex() dedupes concurrent builds — so a sibling call that wins the
+   * throttle and rebuilds heals every other miss in the same batch, not just
+   * the first.
    */
   async resolveSingleReference(id, idIndex) {
+    const first = await this.resolveSingleReferenceOnce(id, idIndex);
+    if (first !== STALE_LOOKUP)
+      return first;
+    await this.refreshIndexForSuspiciousLookup();
+    const second = await this.resolveSingleReferenceOnce(id, await this.idIndex());
+    return second === STALE_LOOKUP ? null : second;
+  }
+  async resolveSingleReferenceOnce(id, idIndex) {
     try {
       const location = idIndex.findById(id);
-      if (!location || location.type !== "entry" || !location.collection || !location.slug) {
+      if (!location)
+        return STALE_LOOKUP;
+      if (location.type !== "entry" || !location.collection || !location.slug) {
         return null;
       }
       const doc = await this.read(location.collection, location.slug, {
@@ -1754,6 +2172,8 @@ var ContentStore = class {
         ...doc.data
       };
     } catch (error) {
+      if (isNodeError(error) && error.code === "ENOENT")
+        return STALE_LOOKUP;
       console.error(`Failed to resolve reference ${id}:`, error);
       return null;
     }
@@ -1761,11 +2181,11 @@ var ContentStore = class {
 };
 
 // dist/branch-schema-cache.js
-import fs6 from "node:fs/promises";
-import path6 from "node:path";
+import fs8 from "node:fs/promises";
+import path8 from "node:path";
 
 // dist/schema/meta-loader.js
-import { promises as fs5 } from "fs";
+import { promises as fs7 } from "fs";
 import { join as join2 } from "pathe";
 import { z as z6 } from "zod";
 import chokidar from "chokidar";
@@ -1801,7 +2221,7 @@ function stripEmbeddedIdFromName(name) {
 async function scanForCollectionMeta(baseDir, relativePath = "") {
   const collections = [];
   try {
-    const entries = await fs5.readdir(baseDir, { withFileTypes: true });
+    const entries = await fs7.readdir(baseDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -1812,8 +2232,8 @@ async function scanForCollectionMeta(baseDir, relativePath = "") {
       const absolutePath = join2(baseDir, folderName);
       const metaPath = join2(absolutePath, ".collection.json");
       try {
-        await fs5.access(metaPath);
-        const content = await fs5.readFile(metaPath, "utf-8");
+        await fs7.access(metaPath);
+        const content = await fs7.readFile(metaPath, "utf-8");
         const parsed = JSON.parse(content);
         const meta = collectionMetaSchema.parse(parsed);
         collections.push({
@@ -1845,7 +2265,7 @@ async function loadCollectionMetaFiles(contentRoot) {
   let root = null;
   const rootMetaPath = join2(contentRoot, ".collection.json");
   try {
-    await fs5.access(rootMetaPath);
+    await fs7.access(rootMetaPath);
   } catch (err) {
     if (err.code === "ENOENT") {
     } else {
@@ -1853,7 +2273,7 @@ async function loadCollectionMetaFiles(contentRoot) {
     }
   }
   try {
-    const content = await fs5.readFile(rootMetaPath, "utf-8");
+    const content = await fs7.readFile(rootMetaPath, "utf-8");
     const parsed = JSON.parse(content);
     root = rootCollectionMetaSchema.parse(parsed);
   } catch (err) {
@@ -1971,16 +2391,16 @@ var MTIME_CHECK_DEBOUNCE_MS = 1e3;
 async function isStaleByMtime(dir, cachedAt) {
   let entries;
   try {
-    entries = await fs6.readdir(dir, { recursive: true, encoding: "utf-8" });
+    entries = await fs8.readdir(dir, { recursive: true, encoding: "utf-8" });
   } catch {
     return true;
   }
   for (const entry of entries) {
     if (!entry.endsWith(".collection.json"))
       continue;
-    const full = path6.join(dir, entry);
+    const full = path8.join(dir, entry);
     try {
-      const stat = await fs6.stat(full);
+      const stat = await fs8.stat(full);
       if (stat.mtimeMs > cachedAt.getTime())
         return true;
     } catch {
@@ -2004,7 +2424,7 @@ var BranchSchemaCache = class {
    * the project root, regardless of which entrypoint produced the cwd branchRoot.
    */
   skipDiskCache(branchRoot) {
-    return isBuildMode() || path6.resolve(branchRoot) === path6.resolve(process.cwd());
+    return isBuildMode() || path8.resolve(branchRoot) === path8.resolve(process.cwd());
   }
   /**
    * Get schema for a branch (loads from cache or resolves fresh).
@@ -2021,17 +2441,17 @@ var BranchSchemaCache = class {
    * Load schema from cache or resolve fresh if cache is missing or stale.
    */
   async loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName) {
-    const contentRoot = path6.join(branchRoot, contentRootName);
+    const contentRoot = path8.join(branchRoot, contentRootName);
     const skipDiskCache = this.skipDiskCache(branchRoot);
     if (!skipDiskCache) {
-      const cacheDir = path6.join(branchRoot, ".canopy-meta");
-      const cachePath = path6.join(cacheDir, "schema-cache.json");
-      const stalePath = path6.join(cacheDir, "schema-cache.stale");
+      const cacheDir = path8.join(branchRoot, ".canopy-meta");
+      const cachePath = path8.join(cacheDir, "schema-cache.json");
+      const stalePath = path8.join(cacheDir, "schema-cache.stale");
       let cacheData = null;
       try {
-        const staleExists = await fs6.access(stalePath).then(() => true).catch(() => false);
+        const staleExists = await fs8.access(stalePath).then(() => true).catch(() => false);
         if (!staleExists) {
-          const cacheContent = await fs6.readFile(cachePath, "utf-8");
+          const cacheContent = await fs8.readFile(cachePath, "utf-8");
           cacheData = JSON.parse(cacheContent);
         }
       } catch {
@@ -2056,21 +2476,21 @@ var BranchSchemaCache = class {
     }
     const flatSchema = flattenSchema(result.schema, contentRootName);
     if (!skipDiskCache) {
-      const cacheDir = path6.join(branchRoot, ".canopy-meta");
-      const cachePath = path6.join(cacheDir, "schema-cache.json");
-      const stalePath = path6.join(cacheDir, "schema-cache.stale");
-      await fs6.mkdir(cacheDir, { recursive: true });
+      const cacheDir = path8.join(branchRoot, ".canopy-meta");
+      const cachePath = path8.join(cacheDir, "schema-cache.json");
+      const stalePath = path8.join(cacheDir, "schema-cache.stale");
+      await fs8.mkdir(cacheDir, { recursive: true });
       const newCache = {
         version: SCHEMA_CACHE_VERSION,
         schema: result.schema,
         flatSchema,
         cachedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const tmpPath = path6.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
-      await fs6.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
-      await fs6.rename(tmpPath, cachePath);
+      const tmpPath = path8.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
+      await fs8.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
+      await fs8.rename(tmpPath, cachePath);
       try {
-        await fs6.unlink(stalePath);
+        await fs8.unlink(stalePath);
       } catch {
       }
     }
@@ -2084,15 +2504,16 @@ var BranchSchemaCache = class {
   async invalidate(branchRoot) {
     if (this.skipDiskCache(branchRoot))
       return;
-    const cacheDir = path6.join(branchRoot, ".canopy-meta");
-    const stalePath = path6.join(cacheDir, "schema-cache.stale");
-    await fs6.mkdir(cacheDir, { recursive: true });
-    await fs6.writeFile(stalePath, "", "utf-8");
+    const cacheDir = path8.join(branchRoot, ".canopy-meta");
+    const stalePath = path8.join(cacheDir, "schema-cache.stale");
+    await fs8.mkdir(cacheDir, { recursive: true });
+    await fs8.writeFile(stalePath, "", "utf-8");
   }
 };
 
 // dist/ai/generate.js
-import path7 from "node:path";
+import path9 from "node:path";
+import fs9 from "node:fs/promises";
 import { minimatch } from "minimatch";
 
 // dist/ai/strip-mdx.js
@@ -2279,6 +2700,10 @@ function entryToMarkdown(entry, config) {
   } else {
     parts.push(...renderJsonEntry(entry, config, skipFields));
   }
+  if (entry.appendedSections) {
+    parts.push(entry.appendedSections.trim());
+    parts.push("");
+  }
   return parts.join("\n");
 }
 function renderMarkdownEntry(entry, config, skipFields) {
@@ -2388,6 +2813,9 @@ ${String(value)}`;
 function renderListField(field, values, depth, label, heading, descriptionLine, entry, config) {
   if (values.length === 0)
     return "";
+  if (field.type === "object" && isFlatObjectList(field)) {
+    return renderObjectListTable(field, values, label, heading, descriptionLine);
+  }
   const isComplex = field.type === "object" || field.type === "block";
   if (isComplex) {
     const items2 = values.map((item, i) => {
@@ -2418,6 +2846,59 @@ ${items2.join("\n\n")}`;
 
 ${items}`;
 }
+var FLAT_CELL_TYPES = /* @__PURE__ */ new Set([
+  "string",
+  "number",
+  "datetime",
+  "boolean",
+  "select",
+  "reference",
+  "image"
+]);
+function isFlatObjectList(field) {
+  if (field.type !== "object")
+    return false;
+  const subFields = field.fields;
+  if (!subFields || subFields.length === 0)
+    return false;
+  return subFields.every((f) => !("list" in f && f.list) && FLAT_CELL_TYPES.has(f.type));
+}
+function renderObjectListTable(field, values, label, heading, descriptionLine) {
+  const columns = field.fields;
+  const headerRow = `| ${columns.map((f) => escapeTableCell(f.label || f.name)).join(" | ")} |`;
+  const separatorRow = `| ${columns.map(() => "---").join(" | ")} |`;
+  const dataRows = values.map((item) => {
+    const record = typeof item === "object" && item !== null ? item : {};
+    const cells = columns.map((f) => {
+      const v = record[f.name];
+      if (v === void 0 || v === null)
+        return "";
+      return escapeTableCell(formatCellValue(f, v));
+    });
+    return `| ${cells.join(" | ")} |`;
+  });
+  const table = [headerRow, separatorRow, ...dataRows].join("\n");
+  return `${heading} ${label}${descriptionLine}
+
+${table}`;
+}
+function formatCellValue(field, value) {
+  switch (field.type) {
+    case "boolean":
+      return value ? "Yes" : "No";
+    case "reference":
+      return formatReference(value);
+    case "select":
+      return Array.isArray(value) ? value.map((v) => resolveSelectLabel(field, v)).join(", ") : resolveSelectLabel(field, value);
+    case "image":
+      return `![](${String(value)})`;
+    default:
+      return String(value);
+  }
+}
+function escapeTableCell(value) {
+  return value.replace(/\\/g, "\\\\").replace(/\|/g, "\\|").replace(/\r?\n+/g, " ").trim();
+}
 function renderSelectField(field, value, heading, label, descriptionLine) {
   if (Array.isArray(value)) {
     return `${heading} ${label}${descriptionLine}
@@ -2538,97 +3019,6 @@ function yamlValue(value) {
   return value;
 }
 
-// dist/utils/debug.js
-var LOG_LEVELS = {
-  DEBUG: 0,
-  INFO: 1,
-  WARN: 2,
-  ERROR: 3
-};
-var DebugLogger = class {
-  constructor(options = {}) {
-    this.timers = /* @__PURE__ */ new Map();
-    this.options = options;
-  }
-  shouldLog(level) {
-    const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
-    if (!enabled)
-      return false;
-    const minLevel = this.options.minLevel ?? "DEBUG";
-    return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
-  }
-  formatMessage(level, category, message) {
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const prefix = this.options.prefix ?? "CanopyCMS";
-    return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
-  }
-  debug(category, message, data) {
-    if (this.shouldLog("DEBUG")) {
-      console.log(this.formatMessage("DEBUG", category, message), data ?? "");
-    }
-  }
-  info(category, message, data) {
-    if (this.shouldLog("INFO")) {
-      console.log(this.formatMessage("INFO", category, message), data ?? "");
-    }
-  }
-  warn(category, message, data) {
-    if (this.shouldLog("WARN")) {
-      console.warn(this.formatMessage("WARN", category, message), data ?? "");
-    }
-  }
-  error(category, message, data) {
-    const msg = this.formatMessage("ERROR", category, message);
-    if (this.shouldLog("ERROR")) {
-      console.error(msg, data ?? "");
-    }
-    const throwOnError = this.options.throwOnError ?? false;
-    if (throwOnError) {
-      const errorMsg = data ? `${message}: ${JSON.stringify(data)}` : message;
-      throw new Error(errorMsg);
-    }
-  }
-  /**
-   * Start timing an operation
-   */
-  time(label) {
-    this.timers.set(label, Date.now());
-  }
-  /**
-   * End timing an operation and log the duration
-   */
-  timeEnd(category, label) {
-    const start = this.timers.get(label);
-    if (start === void 0) {
-      this.warn(category, `Timer '${label}' does not exist`);
-      return;
-    }
-    const duration = Date.now() - start;
-    this.timers.delete(label);
-    this.debug(category, `${label} completed`, { durationMs: duration });
-    return duration;
-  }
-  /**
-   * Wrap an async function with automatic timing
-   */
-  async timed(category, label, fn) {
-    this.time(label);
-    try {
-      return await fn();
-    } finally {
-      this.timeEnd(category, label);
-    }
-  }
-};
-function createDebugLogger(options) {
-  return new DebugLogger(options);
-}
-var testLogger = createDebugLogger({
-  enabled: process.env.E2E_DEBUG === "true",
-  prefix: "E2E",
-  throwOnError: false
-});
-
 // dist/utils/entry-url.js
 init_normalize();
 function computeEntryUrl(collection, slug, contentRoot) {
@@ -2643,12 +3033,12 @@ function computeEntryUrl(collection, slug, contentRoot) {
   if (slug && slug !== "index") {
     segments.push(slug);
   }
-  const path15 = segments.length > 0 ? `/${segments.join("/")}` : "/";
-  return path15.toLowerCase();
+  const path17 = segments.length > 0 ? `/${segments.join("/")}` : "/";
+  return path17.toLowerCase();
 }
 
 // dist/entry-link-resolver.js
-var log = createDebugLogger({ prefix: "EntryLinks" });
+var log2 = createDebugLogger({ prefix: "EntryLinks" });
 var BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
 var ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
 function resolveEntryUrl(location, contentRoot) {
@@ -2662,7 +3052,7 @@ function resolveEntryLinksInText(text, idIndex, contentRoot, customResolver) {
     return part.text.replace(ENTRY_LINK_PATTERN, (_match, id, anchor) => {
       const location = idIndex.findById(id);
       if (!location || location.type !== "entry" || !location.collection || !location.slug) {
-        log.warn("resolve", `Entry link target not found: entry:${id}`);
+        log2.warn("resolve", `Entry link target not found: entry:${id}`);
         return anchor ?? "#";
       }
       let url;
@@ -2819,7 +3209,7 @@ async function processCollection(store, collection, flatSchema, contentRoot, con
   const listed = await store.getCollectionEntryPaths(collection.logicalPath);
   const directEntries = listed.filter((e) => e.collection === collection.logicalPath);
   for (const listEntry of directEntries) {
-    const entryTypeName = extractEntryTypeFromFilename(path7.basename(listEntry.relativePath));
+    const entryTypeName = extractEntryTypeFromFilename(path9.basename(listEntry.relativePath));
     if (!entryTypeName)
       continue;
     if (config?.exclude?.entryTypes?.includes(entryTypeName))
@@ -2837,6 +3227,7 @@ async function processCollection(store, collection, flatSchema, contentRoot, con
       }
       if (config?.exclude?.where?.(aiEntry))
         continue;
+      await runEntryTransform(aiEntry, doc.absolutePath, extractIdFromFilename(path9.basename(listEntry.relativePath)), config);
       entries.push(aiEntry);
       const entryFilePath = `${cleanPath}/${listEntry.slug}.md`;
       const entryMarkdown = entryToMarkdown(aiEntry, config);
@@ -2887,7 +3278,7 @@ async function processRootEntries(store, rootCollection, contentRoot, config, id
   const listed = await store.getCollectionEntryPaths(rootCollection.logicalPath);
   const directEntries = listed.filter((e) => e.collection === rootCollection.logicalPath);
   for (const listEntry of directEntries) {
-    const entryTypeName = extractEntryTypeFromFilename(path7.basename(listEntry.relativePath));
+    const entryTypeName = extractEntryTypeFromFilename(path9.basename(listEntry.relativePath));
     if (!entryTypeName)
       continue;
     if (config?.exclude?.entryTypes?.includes(entryTypeName))
@@ -2905,6 +3296,7 @@ async function processRootEntries(store, rootCollection, contentRoot, config, id
       }
       if (config?.exclude?.where?.(aiEntry))
         continue;
+      await runEntryTransform(aiEntry, doc.absolutePath, extractIdFromFilename(path9.basename(listEntry.relativePath)), config);
       entries.push(aiEntry);
       const entryFilePath = `${listEntry.slug}.md`;
       const entryMarkdown = entryToMarkdown(aiEntry, config);
@@ -2951,6 +3343,43 @@ function docToAIEntry(doc, slug, entryTypeName, entryTypeConfig, cleanCollection
     fields: entryTypeConfig.schema
   };
 }
+function makeReadSibling(dir) {
+  const resolvedDir = path9.resolve(dir);
+  return async (name) => {
+    if (!name || name.includes("/") || name.includes("\\") || path9.isAbsolute(name) || hasTraversalSequence(name)) {
+      return null;
+    }
+    const abs = path9.resolve(resolvedDir, name);
+    if (path9.dirname(abs) !== resolvedDir)
+      return null;
+    try {
+      const stats = await fs9.lstat(abs);
+      if (!stats.isFile())
+        return null;
+      return await fs9.readFile(abs, "utf8");
+    } catch (err) {
+      if (isNodeError(err) && (err.code === "ENOENT" || err.code === "ENOTDIR"))
+        return null;
+      throw err;
+    }
+  };
+}
+async function runEntryTransform(entry, absolutePath, contentId, config) {
+  const transform = config?.entryTransforms?.[entry.entryType];
+  if (!transform)
+    return;
+  const ctx = {
+    contentId: contentId ?? "",
+    readSibling: makeReadSibling(path9.dirname(absolutePath))
+  };
+  try {
+    const appended = await transform(entry, ctx);
+    if (appended)
+      entry.appendedSections = appended;
+  } catch (err) {
+    console.warn(`AI content: entry transform for "${entry.slug}" (${entry.entryType}) failed:`, getErrorMessage(err));
+  }
+}
 function matchesBundleFilter(entry, filter, contentRoot) {
   if (filter.collections) {
     const matches = filter.collections.some((pattern) => {
@@ -2978,33 +3407,33 @@ function matchesBundleFilter(entry, filter, contentRoot) {
 }
 
 // dist/branch-workspace.js
-import path12 from "node:path";
+import path14 from "node:path";
 
 // dist/branch-metadata.js
-import { randomUUID } from "node:crypto";
-import fs8 from "node:fs/promises";
-import path9 from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import fs11 from "node:fs/promises";
+import path11 from "node:path";
 
 // dist/branch-registry.js
-import fs7 from "node:fs/promises";
-import path8 from "node:path";
+import fs10 from "node:fs/promises";
+import path10 from "node:path";
 var REGISTRY_FILE = "branches.json";
 var REGISTRY_STALE_FILE = "branches.stale.json";
 var REGISTRY_TEMP_FILE = "branches.tmp.json";
 var REGISTRY_VERSION = 1;
 var BranchRegistry = class {
   constructor(root) {
-    this.root = path8.resolve(root);
-    this.registryPath = path8.join(this.root, REGISTRY_FILE);
-    this.stalePath = path8.join(this.root, REGISTRY_STALE_FILE);
-    this.tempPath = path8.join(this.root, REGISTRY_TEMP_FILE);
+    this.root = path10.resolve(root);
+    this.registryPath = path10.join(this.root, REGISTRY_FILE);
+    this.stalePath = path10.join(this.root, REGISTRY_STALE_FILE);
+    this.tempPath = path10.join(this.root, REGISTRY_TEMP_FILE);
   }
   /**
    * Returns all branches. Uses cache if fresh, regenerates if stale.
    */
   async list() {
     try {
-      const raw = await fs7.readFile(this.registryPath, "utf8");
+      const raw = await fs10.readFile(this.registryPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed.version || !Array.isArray(parsed.branches)) {
         return await this.regenerate();
@@ -3030,7 +3459,7 @@ var BranchRegistry = class {
    */
   async invalidate() {
     try {
-      await fs7.rename(this.registryPath, this.stalePath);
+      await fs10.rename(this.registryPath, this.stalePath);
     } catch (err) {
       if (!isNotFoundError(err)) {
         throw err;
@@ -3044,20 +3473,20 @@ var BranchRegistry = class {
   async regenerate() {
     const branches = await this.scanBranchDirectories();
     const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs7.mkdir(this.root, { recursive: true });
+    await fs10.mkdir(this.root, { recursive: true });
     const snapshot = {
       version: REGISTRY_VERSION,
       branches
     };
-    await fs7.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs10.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
-      await fs7.rename(uniqueTempPath, this.registryPath);
+      await fs10.rename(uniqueTempPath, this.registryPath);
     } catch (err) {
-      await fs7.unlink(uniqueTempPath).catch(() => {
+      await fs10.unlink(uniqueTempPath).catch(() => {
       });
       throw err;
     }
-    await fs7.unlink(this.stalePath).catch(() => {
+    await fs10.unlink(this.stalePath).catch(() => {
     });
     return branches;
   }
@@ -3067,12 +3496,12 @@ var BranchRegistry = class {
   async scanBranchDirectories() {
     const branches = [];
     try {
-      const entries = await fs7.readdir(this.root, { withFileTypes: true });
+      const entries = await fs10.readdir(this.root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) {
           continue;
         }
-        const branchRoot = path8.join(this.root, entry.name);
+        const branchRoot = path10.join(this.root, entry.name);
         const meta = await BranchMetadataFileManager.loadOnly(branchRoot);
         if (meta) {
           branches.push({
@@ -3104,8 +3533,8 @@ var BranchMetadataConflictError = class extends Error {
 };
 var BranchMetadataFileManager = class _BranchMetadataFileManager {
   constructor(branchRoot, baseRoot) {
-    this.branchRoot = path9.resolve(branchRoot);
-    this.filePath = path9.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
+    this.branchRoot = path11.resolve(branchRoot);
+    this.filePath = path11.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
     this.baseRoot = baseRoot;
   }
   /**
@@ -3113,9 +3542,9 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
    */
   static async loadOnly(branchRoot) {
-    const filePath = path9.join(path9.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
+    const filePath = path11.join(path11.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
     try {
-      const raw = await fs8.readFile(filePath, "utf8");
+      const raw = await fs11.readFile(filePath, "utf8");
       return JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError(err)) {
@@ -3133,7 +3562,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   }
   async load() {
     try {
-      const raw = await fs8.readFile(this.filePath, "utf8");
+      const raw = await fs11.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -3150,38 +3579,38 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    */
   async write(meta, expectedVersion) {
     const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
-    const writeId = randomUUID();
+    const writeId = randomUUID2();
     const payload = {
       ...meta,
       schemaVersion: meta.schemaVersion ?? CURRENT_SCHEMA_VERSION,
       version: newVersion,
       writeId
     };
-    await fs8.mkdir(path9.dirname(this.filePath), { recursive: true });
+    await fs11.mkdir(path11.dirname(this.filePath), { recursive: true });
     const content = JSON.stringify(payload, null, 2) + "\n";
     if (expectedVersion === null) {
       const tempPath2 = `${this.filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-      await fs8.writeFile(tempPath2, content, "utf-8");
+      await fs11.writeFile(tempPath2, content, "utf-8");
       try {
-        await fs8.link(tempPath2, this.filePath);
+        await fs11.link(tempPath2, this.filePath);
       } catch (err) {
-        await fs8.unlink(tempPath2).catch(() => {
+        await fs11.unlink(tempPath2).catch(() => {
         });
         if (isFileExistsError(err)) {
           throw new BranchMetadataConflictError();
         }
         throw err;
       }
-      await fs8.unlink(tempPath2).catch(() => {
+      await fs11.unlink(tempPath2).catch(() => {
       });
       return { version: newVersion, writeId };
     }
     const tempPath = `${this.filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    await fs8.writeFile(tempPath, content, "utf-8");
+    await fs11.writeFile(tempPath, content, "utf-8");
     try {
       let currentVersion = null;
       try {
-        const current = JSON.parse(await fs8.readFile(this.filePath, "utf-8"));
+        const current = JSON.parse(await fs11.readFile(this.filePath, "utf-8"));
         currentVersion = current.version ?? 0;
       } catch {
         currentVersion = null;
@@ -3189,13 +3618,13 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
       if (currentVersion !== expectedVersion) {
         throw new BranchMetadataConflictError();
       }
-      await fs8.rename(tempPath, this.filePath);
-      const afterWrite = JSON.parse(await fs8.readFile(this.filePath, "utf-8"));
+      await fs11.rename(tempPath, this.filePath);
+      const afterWrite = JSON.parse(await fs11.readFile(this.filePath, "utf-8"));
       if (afterWrite.writeId !== writeId) {
         throw new BranchMetadataConflictError();
       }
     } catch (err) {
-      await fs8.unlink(tempPath).catch(() => {
+      await fs11.unlink(tempPath).catch(() => {
       });
       throw err;
     }
@@ -3258,8 +3687,8 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Invalidates the registry cache so next list() call regenerates from branch.json files.
    */
   async invalidateRegistry() {
-    const registry = new BranchRegistry(this.baseRoot);
-    await registry.invalidate();
+    const registry2 = new BranchRegistry(this.baseRoot);
+    await registry2.invalidate();
   }
 };
 var getBranchMetadataFileManager = (branchRoot, baseRoot) => {
@@ -3286,8 +3715,8 @@ var loadBranchContext = async (options) => {
 init_operating_mode();
 
 // dist/git-manager.js
-import fs10 from "node:fs/promises";
-import path11 from "node:path";
+import fs13 from "node:fs/promises";
+import path13 from "node:path";
 import { simpleGit as simpleGit2 } from "simple-git";
 
 // dist/utils/git.js
@@ -3311,21 +3740,41 @@ async function resolveBaseBranch(options) {
 }
 
 // dist/utils/provisioning-lock.js
-import fs9 from "node:fs/promises";
-import path10 from "node:path";
+import fs12 from "node:fs/promises";
+import path12 from "node:path";
 import lockfile from "proper-lockfile";
 async function acquireProvisioningLock(lockTargetDir, lockName) {
-  await fs9.mkdir(lockTargetDir, { recursive: true });
+  await fs12.mkdir(lockTargetDir, { recursive: true });
   return lockfile.lock(lockTargetDir, {
-    lockfilePath: path10.join(lockTargetDir, lockName),
+    lockfilePath: path12.join(lockTargetDir, lockName),
     retries: { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true },
     stale: 3e4
   });
 }
 
 // dist/git-manager.js
-var log2 = createDebugLogger({ prefix: "GitManager" });
+var log3 = createDebugLogger({ prefix: "GitManager" });
 var remoteInitLocks = /* @__PURE__ */ new Map();
+async function ensureGitExcludePattern(repoPath, pattern) {
+  const excludePath = path13.join(repoPath, ".git", "info", "exclude");
+  await fs13.mkdir(path13.dirname(excludePath), { recursive: true });
+  let content = "";
+  try {
+    content = await fs13.readFile(excludePath, "utf-8");
+  } catch (err) {
+    if (!isNotFoundError(err))
+      throw err;
+  }
+  const lines = content.split("\n");
+  if (lines.some((line) => line.trim() === pattern)) {
+    log3.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    return;
+  }
+  const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
+  const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
+  await fs13.writeFile(excludePath, newContent, "utf-8");
+  log3.debug("git", "Added pattern to .git/info/exclude", { pattern });
+}
 var GitConflictError = class extends Error {
   constructor(conflictedFiles) {
     super(`Git conflict in ${conflictedFiles.length} file(s): ${conflictedFiles.join(", ")}`);
@@ -3335,21 +3784,22 @@ var GitConflictError = class extends Error {
 };
 var GitManager = class _GitManager {
   constructor(options, gitOptions) {
-    this.repoPath = path11.resolve(options.repoPath);
+    this.repoPath = path13.resolve(options.repoPath);
     this.baseBranch = options.baseBranch ?? "main";
     this.remote = options.remote ?? "origin";
+    this.skipIndexMarker = options.skipIndexMarker ?? false;
     this.git = simpleGit2({ baseDir: this.repoPath, ...gitOptions });
-    this.git.env("GIT_CEILING_DIRECTORIES", path11.dirname(this.repoPath));
+    this.git.env("GIT_CEILING_DIRECTORIES", path13.dirname(this.repoPath));
   }
   static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
-    log2.debug("git", "Cloning repository", {
+    log3.debug("git", "Cloning repository", {
       remoteUrl,
       targetPath,
       baseBranch
     });
     const git = simpleGit2();
     await git.clone(remoteUrl, targetPath, ["--branch", baseBranch, "--single-branch"]);
-    log2.debug("git", "Clone complete");
+    log3.debug("git", "Clone complete");
   }
   /**
    * Initializes a local bare git repository to simulate a remote for dev mode.
@@ -3369,30 +3819,30 @@ var GitManager = class _GitManager {
   static async ensureLocalSimulatedRemote(options) {
     const existingLock = remoteInitLocks.get(options.remotePath);
     if (existingLock) {
-      log2.debug("git", "Waiting for existing remote initialization", {
+      log3.debug("git", "Waiting for existing remote initialization", {
         remotePath: options.remotePath
       });
       await existingLock;
     }
-    const lockPromise = log2.timed("git", "ensureLocalSimulatedRemote", async () => {
+    const lockPromise = log3.timed("git", "ensureLocalSimulatedRemote", async () => {
       let releaseLock;
       try {
-        log2.debug("git", "Initializing local simulated remote", {
+        log3.debug("git", "Initializing local simulated remote", {
           remotePath: options.remotePath,
           baseBranch: options.baseBranch
         });
-        const remoteParent = path11.dirname(options.remotePath);
+        const remoteParent = path13.dirname(options.remotePath);
         releaseLock = await acquireProvisioningLock(remoteParent, ".remote-init.lock");
         let remoteExists = false;
         try {
-          const stat = await fs10.stat(options.remotePath);
+          const stat = await fs13.stat(options.remotePath);
           remoteExists = stat.isDirectory();
         } catch (err) {
           if (!isNotFoundError(err))
             throw err;
         }
         if (remoteExists && await _GitManager.bareRemoteHasBranch(options.remotePath, options.baseBranch)) {
-          log2.debug("git", "Remote already has base branch, skipping");
+          log3.debug("git", "Remote already has base branch, skipping");
           return;
         }
         let gitRoot = options.sourcePath;
@@ -3411,8 +3861,8 @@ var GitManager = class _GitManager {
         }
         let hasCommits = false;
         try {
-          const log4 = await sourceGit.log(["-1"]);
-          hasCommits = log4.total > 0;
+          const log5 = await sourceGit.log(["-1"]);
+          hasCommits = log5.total > 0;
         } catch {
           hasCommits = false;
         }
@@ -3424,12 +3874,12 @@ var GitManager = class _GitManager {
           throw new Error(`Cannot initialize local simulated remote: base branch '${options.baseBranch}' does not exist locally. Please checkout '${options.baseBranch}' first or provide an explicit remoteUrl.`);
         }
         if (remoteExists) {
-          log2.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
+          log3.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
             remotePath: options.remotePath,
             baseBranch: options.baseBranch
           });
         } else {
-          log2.debug("git", "Creating bare remote repository");
+          log3.debug("git", "Creating bare remote repository");
           await simpleGit2().raw([
             "init",
             "--bare",
@@ -3443,13 +3893,13 @@ var GitManager = class _GitManager {
           baseBranch: options.baseBranch,
           subdirectory: options.subdirectory
         });
-        log2.debug("git", "Remote initialization complete");
+        log3.debug("git", "Remote initialization complete");
       } finally {
         if (releaseLock) {
           try {
             await releaseLock();
           } catch (err) {
-            log2.debug("git", "Failed to release remote-init lock", { err });
+            log3.debug("git", "Failed to release remote-init lock", { err });
           }
         }
         remoteInitLocks.delete(options.remotePath);
@@ -3548,7 +3998,7 @@ var GitManager = class _GitManager {
    */
   static async validateGitRepoExists(repoPath) {
     try {
-      const stat = await fs10.stat(path11.join(repoPath, ".git"));
+      const stat = await fs13.stat(path13.join(repoPath, ".git"));
       if (!stat.isDirectory()) {
         throw new Error(`Expected git repo at ${repoPath}`);
       }
@@ -3586,9 +4036,9 @@ var GitManager = class _GitManager {
       return process.env[config.envVarName];
     if (config.autoDetectRemotePath) {
       try {
-        const stat = await fs10.stat(config.autoDetectRemotePath);
+        const stat = await fs13.stat(config.autoDetectRemotePath);
         if (stat.isDirectory()) {
-          log2.debug("git", "Auto-detected local remote", {
+          log3.debug("git", "Auto-detected local remote", {
             path: config.autoDetectRemotePath
           });
           return config.autoDetectRemotePath;
@@ -3599,8 +4049,8 @@ var GitManager = class _GitManager {
     if (config.shouldAutoInitLocal) {
       const gitRoot = await this.findGitRoot();
       const sourceRoot = options.sourceRoot;
-      const sourcePath = sourceRoot ? path11.resolve(gitRoot, sourceRoot) : gitRoot;
-      const localRemotePath = path11.join(sourcePath, config.defaultRemotePath);
+      const sourcePath = sourceRoot ? path13.resolve(gitRoot, sourceRoot) : gitRoot;
+      const localRemotePath = path13.join(sourcePath, config.defaultRemotePath);
       await this.ensureLocalSimulatedRemote({
         remotePath: localRemotePath,
         sourcePath: gitRoot,
@@ -3626,24 +4076,24 @@ var GitManager = class _GitManager {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: options.baseBranch,
       mode: options.mode,
-      detectFrom: options.sourceRoot ? path11.resolve(process.cwd(), options.sourceRoot) : process.cwd()
+      detectFrom: options.sourceRoot ? path13.resolve(process.cwd(), options.sourceRoot) : process.cwd()
     });
     const remoteName = options.remoteName ?? "origin";
     let repoExists = false;
     try {
       const checkGit = simpleGit2({ baseDir: options.workspacePath });
-      checkGit.env("GIT_CEILING_DIRECTORIES", path11.dirname(options.workspacePath));
+      checkGit.env("GIT_CEILING_DIRECTORIES", path13.dirname(options.workspacePath));
       await checkGit.raw(["rev-parse", "--git-dir"]);
       repoExists = true;
     } catch {
-      const gitPath = path11.join(options.workspacePath, ".git");
+      const gitPath = path13.join(options.workspacePath, ".git");
       try {
-        const stat = await fs10.stat(gitPath);
+        const stat = await fs13.stat(gitPath);
         if (stat.isDirectory()) {
-          log2.debug("git", "Removing corrupt .git directory", {
+          log3.debug("git", "Removing corrupt .git directory", {
             workspacePath: options.workspacePath
           });
-          await fs10.rm(gitPath, { recursive: true });
+          await fs13.rm(gitPath, { recursive: true });
         }
       } catch (cleanupErr) {
         if (!isNotFoundError(cleanupErr))
@@ -3669,7 +4119,7 @@ var GitManager = class _GitManager {
       }
       justCloned = true;
       const freshGit = simpleGit2({ baseDir: options.workspacePath });
-      freshGit.env("GIT_CEILING_DIRECTORIES", path11.dirname(options.workspacePath));
+      freshGit.env("GIT_CEILING_DIRECTORIES", path13.dirname(options.workspacePath));
       await freshGit.addConfig("canopycms.managed", "true");
       await freshGit.addConfig("user.name", options.gitBotAuthorName);
       await freshGit.addConfig("user.email", options.gitBotAuthorEmail);
@@ -3677,12 +4127,13 @@ var GitManager = class _GitManager {
     const git = new _GitManager({
       repoPath: options.workspacePath,
       baseBranch,
-      remote: remoteName
+      remote: remoteName,
+      skipIndexMarker: options.branchType === "orphan"
     });
     await git.git.addConfig("canopycms.managed", "true");
     await git.git.addConfig("user.name", options.gitBotAuthorName);
     await git.git.addConfig("user.email", options.gitBotAuthorEmail);
-    log2.debug("git", "Marked workspace as CanopyCMS-managed", {
+    log3.debug("git", "Marked workspace as CanopyCMS-managed", {
       workspacePath: options.workspacePath
     });
     if (!justCloned) {
@@ -3717,7 +4168,33 @@ var GitManager = class _GitManager {
       tracking: s.tracking
     };
   }
+  /**
+   * Mark ContentStore ID indexes rooted at (or under) this repo as stale.
+   * Called after operations that mutate the working tree (checkout/merge/rebase) so
+   * ID→path lookups don't keep resolving to pre-mutation paths. Invoked in `finally`
+   * blocks because even failed merges/rebases may have touched the tree before
+   * aborting; over-invalidating is safe.
+   *
+   * Covers both scopes: in-process stores via the registry, and stores in OTHER
+   * processes sharing the filesystem (worker vs Lambda on EFS) via the on-disk
+   * generation marker — unless this manager targets a settings workspace
+   * (skipIndexMarker), where only the free in-process invalidation runs.
+   */
+  async invalidateContentIndexes() {
+    if (this.skipIndexMarker) {
+      invalidateContentIndexesForRoot(this.repoPath);
+      return;
+    }
+    await invalidateContentIndexesDurable(this.repoPath);
+  }
   async checkoutBranch(branch) {
+    try {
+      await this.checkoutBranchInner(branch);
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async checkoutBranchInner(branch) {
     const branches = await this.git.branch();
     if (branches.all.includes(branch)) {
       await this.git.checkout(branch);
@@ -3741,6 +4218,13 @@ var GitManager = class _GitManager {
     }
   }
   async pullBase() {
+    try {
+      await this.pullBaseInner();
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async pullBaseInner() {
     await this.git.fetch(this.remote, this.baseBranch);
     try {
       await this.git.merge([`${this.remote}/${this.baseBranch}`]);
@@ -3761,6 +4245,13 @@ var GitManager = class _GitManager {
     }
   }
   async pullCurrentBranch() {
+    try {
+      await this.pullCurrentBranchInner();
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async pullCurrentBranchInner() {
     const branches = await this.git.branch();
     const currentBranch = branches.current;
     await this.git.fetch(this.remote, currentBranch);
@@ -3783,6 +4274,13 @@ var GitManager = class _GitManager {
     }
   }
   async rebaseOntoBase() {
+    try {
+      await this.rebaseOntoBaseInner();
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async rebaseOntoBaseInner() {
     await this.git.fetch(this.remote, this.baseBranch);
     try {
       await this.git.rebase([`${this.remote}/${this.baseBranch}`]);
@@ -3811,7 +4309,13 @@ var GitManager = class _GitManager {
   }
   async push(branch) {
     const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
-    await this.git.push(this.remote, `${target}:${target}`, ["--set-upstream"]);
+    await this.git.raw([
+      "push",
+      "--set-upstream",
+      "--end-of-options",
+      this.remote,
+      `${target}:${target}`
+    ]);
   }
   async ensureAuthor(author) {
     const config = await this.git.listConfig();
@@ -3865,7 +4369,7 @@ var GitManager = class _GitManager {
    */
   async forcePush(branch) {
     const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
-    await this.git.push(this.remote, target, ["--force-with-lease"]);
+    await this.git.raw(["push", "--force-with-lease", "--end-of-options", this.remote, target]);
   }
   /**
    * Get remote URL for current repo
@@ -3885,24 +4389,7 @@ var GitManager = class _GitManager {
    * This is idempotent - if the pattern already exists, it won't be added again.
    */
   async ensureGitExclude(pattern) {
-    const excludePath = path11.join(this.repoPath, ".git", "info", "exclude");
-    await fs10.mkdir(path11.dirname(excludePath), { recursive: true });
-    let content = "";
-    try {
-      content = await fs10.readFile(excludePath, "utf-8");
-    } catch (err) {
-      if (!isNotFoundError(err))
-        throw err;
-    }
-    const lines = content.split("\n");
-    if (lines.some((line) => line.trim() === pattern)) {
-      log2.debug("git", "Pattern already in .git/info/exclude", { pattern });
-      return;
-    }
-    const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
-    const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-    await fs10.writeFile(excludePath, newContent, "utf-8");
-    log2.debug("git", "Added pattern to .git/info/exclude", { pattern });
+    await ensureGitExcludePattern(this.repoPath, pattern);
   }
   /**
    * Create an orphan branch for settings (permissions/groups).
@@ -3910,16 +4397,24 @@ var GitManager = class _GitManager {
    * Orphan branches have no shared history with other branches - they start fresh.
    * This is perfect for deployment-specific settings that shouldn't pollute content history.
    *
-   * The branch contains only settings files in .canopy-meta/ (groups.json, permissions.json).
+   * The branch contains only settings files committed by explicit path
+   * (e.g. permissions.json, groups.json at the workspace root).
    *
    * @param branchName - Name of the orphan branch (e.g., 'canopycms-settings-prod')
    * @param initialFiles - Files to commit to the new branch (e.g., { 'permissions.json': '{}', 'groups.json': '{}' })
    */
   async createOrphanSettingsBranch(branchName, initialFiles) {
-    log2.debug("git", "Creating orphan settings branch", { branchName });
+    try {
+      await this.createOrphanSettingsBranchInner(branchName, initialFiles);
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async createOrphanSettingsBranchInner(branchName, initialFiles) {
+    log3.debug("git", "Creating orphan settings branch", { branchName });
     const branches = await this.git.branch();
     if (branches.all.includes(branchName)) {
-      log2.debug("git", "Orphan branch already exists", { branchName });
+      log3.debug("git", "Orphan branch already exists", { branchName });
       await this.git.checkout(branchName);
       return;
     }
@@ -3929,25 +4424,25 @@ var GitManager = class _GitManager {
     } catch {
     }
     for (const [filePath, content] of Object.entries(initialFiles)) {
-      const absolutePath = path11.join(this.repoPath, filePath);
-      await fs10.mkdir(path11.dirname(absolutePath), { recursive: true });
-      await fs10.writeFile(absolutePath, content, "utf-8");
+      const absolutePath = path13.join(this.repoPath, filePath);
+      await fs13.mkdir(path13.dirname(absolutePath), { recursive: true });
+      await fs13.writeFile(absolutePath, content, "utf-8");
       await this.git.add(filePath);
     }
     await this.git.commit("Initialize settings branch", ["--allow-empty"]);
-    log2.debug("git", "Orphan settings branch created", { branchName });
+    log3.debug("git", "Orphan settings branch created", { branchName });
   }
 };
 
 // dist/branch-workspace.js
-var log3 = createDebugLogger({ prefix: "BranchWorkspace" });
+var log4 = createDebugLogger({ prefix: "BranchWorkspace" });
 var workspaceInitLocks = /* @__PURE__ */ new Map();
 var BranchWorkspaceManager = class {
   constructor(config) {
     this.config = config;
   }
   async ensureGitWorkspace(options) {
-    return log3.timed("workspace", "ensureGitWorkspace", async () => {
+    return log4.timed("workspace", "ensureGitWorkspace", async () => {
       const existingLock = workspaceInitLocks.get(options.branchRoot);
       if (existingLock) {
         await existingLock;
@@ -3956,11 +4451,11 @@ var BranchWorkspaceManager = class {
       const lockPromise = (async () => {
         let releaseLock;
         try {
-          log3.debug("workspace", "Ensuring git workspace", {
+          log4.debug("workspace", "Ensuring git workspace", {
             branchName: options.branchName,
             mode: options.mode
           });
-          releaseLock = await acquireProvisioningLock(path12.dirname(options.branchRoot), `.${path12.basename(options.branchRoot)}.init.lock`);
+          releaseLock = await acquireProvisioningLock(path14.dirname(options.branchRoot), `.${path14.basename(options.branchRoot)}.init.lock`);
           await GitManager.initializeWorkspace({
             workspacePath: options.branchRoot,
             branchName: options.branchName,
@@ -3980,7 +4475,7 @@ var BranchWorkspaceManager = class {
             try {
               await releaseLock();
             } catch (err) {
-              log3.debug("workspace", "Failed to release workspace-init lock", { err });
+              log4.debug("workspace", "Failed to release workspace-init lock", { err });
             }
           }
           workspaceInitLocks.delete(options.branchRoot);
@@ -4000,7 +4495,7 @@ var BranchWorkspaceManager = class {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: this.config.defaultBaseBranch,
       mode,
-      detectFrom: this.config.sourceRoot ? path12.resolve(process.cwd(), this.config.sourceRoot) : void 0
+      detectFrom: this.config.sourceRoot ? path14.resolve(process.cwd(), this.config.sourceRoot) : void 0
     });
     await this.ensureGitWorkspace({
       branchRoot,
@@ -4104,15 +4599,15 @@ async function generateAIContentFiles(options) {
     config: aiConfig,
     entryLinkUrl: config.entryLinkUrl
   });
-  const absoluteOutputDir = path13.resolve(outputDir) + path13.sep;
+  const absoluteOutputDir = path15.resolve(outputDir) + path15.sep;
   let fileCount = 0;
   for (const [filePath, content] of result.files) {
-    const absolutePath = path13.resolve(path13.join(absoluteOutputDir, filePath));
+    const absolutePath = path15.resolve(path15.join(absoluteOutputDir, filePath));
     if (!absolutePath.startsWith(absoluteOutputDir)) {
       throw new Error(`Path traversal detected in AI content output: ${filePath}`);
     }
-    await fs11.mkdir(path13.dirname(absolutePath), { recursive: true });
-    await fs11.writeFile(absolutePath, content, "utf-8");
+    await fs14.mkdir(path15.dirname(absolutePath), { recursive: true });
+    await fs14.writeFile(absolutePath, content, "utf-8");
     fileCount++;
   }
   return { fileCount, outputDir: absoluteOutputDir };
@@ -4123,7 +4618,7 @@ var jiti = createJiti(import.meta.url);
 async function generateAIContentCLI(options) {
   const { projectDir, outputDir = "public/ai", configPath, appDir = "app" } = options;
   console.log("\nCanopyCMS generate-ai-content\n");
-  const canopyConfigPath = path14.join(projectDir, "canopycms.config.ts");
+  const canopyConfigPath = path16.join(projectDir, "canopycms.config.ts");
   let canopyConfigModule;
   try {
     canopyConfigModule = await jiti.import(canopyConfigPath);
@@ -4134,7 +4629,7 @@ async function generateAIContentCLI(options) {
   }
   const configExport = canopyConfigModule.default ?? canopyConfigModule.config ?? canopyConfigModule;
   const serverConfig = typeof configExport === "object" && configExport !== null && "server" in configExport ? configExport.server : configExport;
-  const schemasPath = path14.join(projectDir, appDir, "schemas.ts");
+  const schemasPath = path16.join(projectDir, appDir, "schemas.ts");
   let entrySchemaRegistry = {};
   try {
     const schemasModule = await jiti.import(schemasPath);
@@ -4145,7 +4640,7 @@ async function generateAIContentCLI(options) {
   let aiConfig;
   if (configPath) {
     try {
-      const aiConfigModule = await jiti.import(path14.resolve(configPath));
+      const aiConfigModule = await jiti.import(path16.resolve(configPath));
       aiConfig = aiConfigModule.aiContentConfig ?? aiConfigModule.default ?? aiConfigModule.config;
     } catch (err) {
       console.error(`Could not load AI config from ${configPath}`);
@@ -4162,7 +4657,7 @@ async function generateAIContentCLI(options) {
     console.error("Make sure canopycms.config.ts uses defineCanopyConfig().");
     process.exit(1);
   }
-  const resolvedOutput = path14.resolve(projectDir, outputDir);
+  const resolvedOutput = path16.resolve(projectDir, outputDir);
   console.log(`  Output: ${resolvedOutput}`);
   console.log(`  Mode: ${serverConfig.mode ?? "dev"}`);
   const result = await generateAIContentFiles({