canopycms 0.0.54 → 0.0.56

package/dist/cli/generate-ai-content.js

@@ -9,11 +9,11 @@ var __export = (target, all) => {
 };
 
 // dist/paths/normalize.js
-function normalizeFilesystemPath(path15) {
-  return path15.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path18) {
+  return path18.split(/[\\/]+/).filter(Boolean).join("/");
 }
-function hasTraversalSequence(path15) {
-  const normalized = normalizeFilesystemPath(path15);
+function hasTraversalSequence(path18) {
+  const normalized = normalizeFilesystemPath(path18);
   return normalized.includes("..");
 }
 function createLogicalPath(...segments) {
@@ -23,14 +23,14 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
-function trimSlashes(path15) {
+function trimSlashes(path18) {
   let start = 0;
-  let end = path15.length;
-  while (start < end && path15[start] === "/")
+  let end = path18.length;
+  while (start < end && path18[start] === "/")
     start++;
-  while (end > start && path15[end - 1] === "/")
+  while (end > start && path18[end - 1] === "/")
     end--;
-  return path15.slice(start, end);
+  return path18.slice(start, end);
 }
 var init_normalize = __esm({
   "dist/paths/normalize.js"() {
@@ -284,7 +284,7 @@ var mediaSchema;
 var init_media = __esm({
   "dist/config/schemas/media.js"() {
     "use strict";
-    mediaSchema = z3.union([
+    mediaSchema = z3.discriminatedUnion("adapter", [
       z3.object({
         adapter: z3.literal("local"),
         publicBaseUrl: z3.string().url().optional()
@@ -298,10 +298,6 @@ var init_media = __esm({
       z3.object({
         adapter: z3.literal("lfs"),
         publicBaseUrl: z3.string().url().optional()
-      }),
-      z3.object({
-        adapter: z3.string().min(1),
-        publicBaseUrl: z3.string().url().optional()
       })
     ]);
   }
@@ -323,7 +319,7 @@ var init_config = __esm({
     gitBotAuthorNameSchema = z4.string().min(1);
     gitBotAuthorEmailSchema = z4.string().email();
     githubTokenEnvVarSchema = z4.string().default("GITHUB_BOT_TOKEN");
-    operatingModeSchema = z4.enum(["prod", "dev"]).default("dev");
+    operatingModeSchema = z4.enum(["prod", "dev"]);
     deployedAsSchema = z4.enum(["static", "server"]).default("server");
     contentRootSchema = relativePathSchema.default("content");
     sourceRootSchema = z4.string().min(1).optional();
@@ -345,8 +341,12 @@ var init_config = __esm({
     });
     CanopyConfigSchema = z4.object({
       media: mediaSchema.optional(),
-      defaultBranchAccess: defaultBranchAccessSchema.optional(),
-      defaultPathAccess: defaultPathAccessSchema.optional(),
+      // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
+      // have .default('deny'), so the field is optional on input but always resolves to
+      // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
+      // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      defaultBranchAccess: defaultBranchAccessSchema,
+      defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
       // unset must stay undefined after parsing so dev mode can detect the fork
       // point from git HEAD (see resolveBaseBranch in utils/git.ts).
@@ -357,8 +357,9 @@ var init_config = __esm({
       gitBotAuthorName: gitBotAuthorNameSchema,
       gitBotAuthorEmail: gitBotAuthorEmailSchema,
       githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
+      // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
+      // validation loudly rather than silently running header-trusting dev auth semantics.
       mode: operatingModeSchema,
-      // Has .default(), so not optional in output type
       deployedAs: deployedAsSchema,
       // Has .default('server'), so always present after validation
       settingsBranch: z4.string().optional(),
@@ -541,7 +542,7 @@ var init_config2 = __esm({
 });
 
 // dist/operating-mode/client-unsafe-strategy.js
-import path3 from "node:path";
+import path5 from "node:path";
 function operatingStrategy(mode) {
   const cached = strategyCache.get(mode);
   if (cached)
@@ -578,32 +579,32 @@ var init_client_unsafe_strategy = __esm({
       // - shouldCommit(), shouldPush()
       // Add client-unsafe methods (use Node.js APIs)
       getWorkspaceRoot(_sourceRoot) {
-        return path3.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
+        return path5.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
       }
       getContentRoot(sourceRoot) {
-        return path3.resolve(sourceRoot ?? process.cwd(), "content");
+        return path5.resolve(sourceRoot ?? process.cwd(), "content");
       }
       getContentBranchesRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path5.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path3.join(root, this.getPermissionsFileName());
+        return path5.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path3.join(root, this.getGroupsFileName());
+        return path5.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
           shouldAutoInitLocal: false,
           defaultRemotePath: "",
           envVarName: "CANOPYCMS_REMOTE_URL",
-          autoDetectRemotePath: path3.join(this.getWorkspaceRoot(), "remote.git")
+          autoDetectRemotePath: path5.join(this.getWorkspaceRoot(), "remote.git")
         };
       }
       requiresExistingRepo() {
@@ -616,7 +617,7 @@ var init_client_unsafe_strategy = __esm({
         return `canopycms-settings-${deploymentName}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -633,25 +634,25 @@ var init_client_unsafe_strategy = __esm({
     DevStrategy = class extends DevClientSafeStrategy {
       // Inherits client-safe methods from DevClientSafeStrategy
       getWorkspaceRoot(sourceRoot) {
-        return path3.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
+        return path5.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
       getContentRoot(sourceRoot) {
-        return path3.resolve(sourceRoot ?? process.cwd(), "content");
+        return path5.resolve(sourceRoot ?? process.cwd(), "content");
       }
       getContentBranchesRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path5.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path3.join(root, this.getPermissionsFileName());
+        return path5.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path3.join(root, this.getGroupsFileName());
+        return path5.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
@@ -670,7 +671,7 @@ var init_client_unsafe_strategy = __esm({
         return `canopycms-settings-${deploymentName}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path5.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -702,16 +703,16 @@ var init_operating_mode = __esm({
 });
 
 // dist/cli/generate-ai-content.js
-import path14 from "node:path";
+import path17 from "node:path";
 import { createJiti } from "jiti";
 
 // dist/build/generate-ai-content.js
-import fs12 from "node:fs/promises";
-import path13 from "node:path";
+import fs15 from "node:fs/promises";
+import path16 from "node:path";
 
 // dist/content-store.js
-import fs4 from "node:fs/promises";
-import path5 from "node:path";
+import fs6 from "node:fs/promises";
+import path7 from "node:path";
 import matter from "gray-matter";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 
@@ -736,16 +737,16 @@ async function atomicWriteFile(filePath, content) {
 var locks = /* @__PURE__ */ new Map();
 async function withLock(key, fn) {
   const prev = locks.get(key) ?? Promise.resolve();
-  let resolve;
+  let resolve2;
   const next = new Promise((r) => {
-    resolve = r;
+    resolve2 = r;
   });
   locks.set(key, next);
   await prev;
   try {
     return await fn();
   } finally {
-    resolve();
+    resolve2();
     if (locks.get(key) === next)
       locks.delete(key);
   }
@@ -1076,13 +1077,13 @@ function extractIdFromFilename(filename) {
   return null;
 }
 async function resolveCollectionPath(root, logicalPath) {
-  const fs13 = await import("node:fs/promises");
-  const path15 = await import("node:path");
+  const fs16 = await import("node:fs/promises");
+  const path18 = await import("node:path");
   const segments = logicalPath.split("/").filter(Boolean);
   let currentPath = root;
   for (const segment of segments) {
     try {
-      const entries = await fs13.readdir(currentPath, { withFileTypes: true });
+      const entries = await fs16.readdir(currentPath, { withFileTypes: true });
       const matchingDir = entries.find((entry) => {
         if (!entry.isDirectory())
           return false;
@@ -1090,7 +1091,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return logicalName === segment.toLowerCase();
       });
       if (matchingDir) {
-        currentPath = path15.join(currentPath, matchingDir.name);
+        currentPath = path18.join(currentPath, matchingDir.name);
       } else {
         return null;
       }
@@ -1140,6 +1141,192 @@ function extractSlugFromFilename(filename, entryTypeName) {
   return filename.toLowerCase();
 }
 
+// dist/content-index-registry.js
+import path3 from "node:path";
+var registry = /* @__PURE__ */ new Map();
+var finalization = new FinalizationRegistry(({ rootKey, ref }) => {
+  const refs = registry.get(rootKey);
+  if (!refs)
+    return;
+  refs.delete(ref);
+  if (refs.size === 0)
+    registry.delete(rootKey);
+});
+function registerContentIndexForInvalidation(root, target) {
+  const rootKey = path3.resolve(root);
+  let refs = registry.get(rootKey);
+  if (!refs) {
+    refs = /* @__PURE__ */ new Set();
+    registry.set(rootKey, refs);
+  }
+  const ref = new WeakRef(target);
+  refs.add(ref);
+  finalization.register(target, { rootKey, ref });
+}
+function invalidateContentIndexesForRoot(root) {
+  const rootKey = path3.resolve(root);
+  const prefix = rootKey + path3.sep;
+  for (const [storeRoot, refs] of registry) {
+    if (storeRoot !== rootKey && !storeRoot.startsWith(prefix))
+      continue;
+    for (const ref of refs) {
+      const target = ref.deref();
+      if (target) {
+        target.invalidateIndex();
+      } else {
+        refs.delete(ref);
+      }
+    }
+    if (refs.size === 0)
+      registry.delete(storeRoot);
+  }
+}
+
+// dist/content-index-generation.js
+import fs3 from "node:fs/promises";
+import path4 from "node:path";
+import { randomUUID } from "node:crypto";
+
+// dist/utils/debug.js
+var LOG_LEVELS = {
+  DEBUG: 0,
+  INFO: 1,
+  WARN: 2,
+  ERROR: 3
+};
+var DebugLogger = class {
+  constructor(options = {}) {
+    this.timers = /* @__PURE__ */ new Map();
+    this.options = options;
+  }
+  shouldLog(level) {
+    const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
+    if (!enabled)
+      return false;
+    const minLevel = this.options.minLevel ?? "DEBUG";
+    return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
+  }
+  formatMessage(level, category, message) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const prefix = this.options.prefix ?? "CanopyCMS";
+    return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+  }
+  debug(category, message, data) {
+    if (this.shouldLog("DEBUG")) {
+      console.log(this.formatMessage("DEBUG", category, message), data ?? "");
+    }
+  }
+  info(category, message, data) {
+    if (this.shouldLog("INFO")) {
+      console.log(this.formatMessage("INFO", category, message), data ?? "");
+    }
+  }
+  warn(category, message, data) {
+    if (this.shouldLog("WARN")) {
+      console.warn(this.formatMessage("WARN", category, message), data ?? "");
+    }
+  }
+  error(category, message, data) {
+    const msg = this.formatMessage("ERROR", category, message);
+    if (this.shouldLog("ERROR")) {
+      console.error(msg, data ?? "");
+    }
+    const throwOnError = this.options.throwOnError ?? false;
+    if (throwOnError) {
+      const errorMsg = data ? `${message}: ${JSON.stringify(data)}` : message;
+      throw new Error(errorMsg);
+    }
+  }
+  /**
+   * Start timing an operation
+   */
+  time(label) {
+    this.timers.set(label, Date.now());
+  }
+  /**
+   * End timing an operation and log the duration
+   */
+  timeEnd(category, label) {
+    const start = this.timers.get(label);
+    if (start === void 0) {
+      this.warn(category, `Timer '${label}' does not exist`);
+      return;
+    }
+    const duration = Date.now() - start;
+    this.timers.delete(label);
+    this.debug(category, `${label} completed`, { durationMs: duration });
+    return duration;
+  }
+  /**
+   * Wrap an async function with automatic timing
+   */
+  async timed(category, label, fn) {
+    this.time(label);
+    try {
+      return await fn();
+    } finally {
+      this.timeEnd(category, label);
+    }
+  }
+};
+function createDebugLogger(options) {
+  return new DebugLogger(options);
+}
+var testLogger = createDebugLogger({
+  enabled: process.env.E2E_DEBUG === "true",
+  prefix: "E2E",
+  throwOnError: false
+});
+
+// dist/content-index-generation.js
+var log = createDebugLogger({ prefix: "ContentIndex" });
+var META_DIR = ".canopy-meta";
+var GENERATION_FILE = "content-index.generation";
+function contentIndexGenerationPath(root) {
+  return path4.join(path4.resolve(root), META_DIR, GENERATION_FILE);
+}
+async function bumpContentIndexGeneration(root) {
+  const token = randomUUID();
+  try {
+    await atomicWriteFile(contentIndexGenerationPath(root), token);
+    return token;
+  } catch (err) {
+    log.warn("generation", `Failed to bump content index generation for ${root}`, {
+      error: getErrorMessage(err)
+    });
+    return null;
+  }
+}
+async function readContentIndexGeneration(root) {
+  try {
+    return await fs3.readFile(contentIndexGenerationPath(root), "utf-8");
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT")
+      return null;
+    log.warn("generation", `Failed to read content index generation for ${root}`, {
+      error: getErrorMessage(err)
+    });
+    return null;
+  }
+}
+async function invalidateContentIndexesDurable(root) {
+  await bumpContentIndexGeneration(root);
+  invalidateContentIndexesForRoot(root);
+}
+
+// dist/utils/fs.js
+import fs4 from "node:fs/promises";
+async function filePathExists(filePath) {
+  try {
+    await fs4.stat(filePath);
+    return true;
+  } catch (err) {
+    if (isNotFoundError(err))
+      return false;
+    throw err;
+  }
+}
+
 // dist/utils/format.js
 var getFormatExtension = (format) => {
   if (format === "md")
@@ -1156,10 +1343,29 @@ var asRecord = (value) => value && typeof value === "object" && !Array.isArray(v
 // dist/paths/index.js
 init_normalize();
 
+// dist/paths/normalize-server.js
+import { sep, resolve, relative } from "node:path";
+function validateAndNormalizePath(root, target) {
+  const resolvedRoot = resolve(root);
+  const withSep = resolvedRoot.endsWith(sep) ? resolvedRoot : `${resolvedRoot}${sep}`;
+  const resolvedTarget = resolve(target);
+  if (!resolvedTarget.startsWith(withSep) && resolvedTarget !== resolvedRoot) {
+    return {
+      valid: false,
+      error: "Path traversal detected"
+    };
+  }
+  const relativePath = relative(resolvedRoot, resolvedTarget).split(sep).join("/");
+  return {
+    valid: true,
+    normalizedPath: relativePath
+  };
+}
+
 // dist/paths/branch.js
 init_operating_mode();
-import fs3 from "node:fs/promises";
-import path4 from "node:path";
+import fs5 from "node:fs/promises";
+import path6 from "node:path";
 var BranchPathError = class extends Error {
 };
 function sanitizeBranchName(branchName) {
@@ -1178,11 +1384,11 @@ function resolveBranchPath(options) {
   const safeBranch = sanitizeBranchName(options.branchName);
   const strategy = operatingStrategy(options.mode);
   const baseRoot = resolveContentBranchesRoot(options.mode, options.basePathOverride);
-  const normalizedBase = path4.resolve(baseRoot);
-  const baseWithSep = normalizedBase.endsWith(path4.sep) ? normalizedBase : `${normalizedBase}${path4.sep}`;
+  const normalizedBase = path6.resolve(baseRoot);
+  const baseWithSep = normalizedBase.endsWith(path6.sep) ? normalizedBase : `${normalizedBase}${path6.sep}`;
   const branchRoot = strategy.getContentBranchRoot(safeBranch, options.basePathOverride);
   const withinBase = (target) => {
-    const resolved = path4.resolve(target);
+    const resolved = path6.resolve(target);
     return resolved === normalizedBase || resolved.startsWith(baseWithSep);
   };
   if (!withinBase(branchRoot)) {
@@ -1192,7 +1398,7 @@ function resolveBranchPath(options) {
 }
 async function ensureBranchRoot(options) {
   const result = resolveBranchPath(options);
-  await fs3.mkdir(result.branchRoot, { recursive: true });
+  await fs5.mkdir(result.branchRoot, { recursive: true });
   return result;
 }
 
@@ -1222,24 +1428,147 @@ function validateSlug(slug) {
     throw new ContentStoreError("Slugs cannot contain backslashes. Use nested collections instead.", "VALIDATION");
   }
 }
+var DEFAULT_INDEX_FRESHNESS_INTERVAL_MS = 1e3;
+var FORCED_REFRESH_MIN_INTERVAL_MS = 5e3;
+var STALE_LOOKUP = Symbol("stale-index-lookup");
 var ContentStore = class {
-  constructor(root, flatSchema) {
-    this.indexLoaded = false;
-    this.root = path5.resolve(root);
+  constructor(root, flatSchema, options = {}) {
+    this.indexGeneration = 0;
+    this.loadedIndexGeneration = -1;
+    this.loadedDiskGeneration = void 0;
+    this.lastDiskProbeMs = 0;
+    this.lastForcedRefreshMs = 0;
+    this.indexBuild = null;
+    this.root = path7.resolve(root);
+    this.indexFreshnessIntervalMs = options.indexFreshnessIntervalMs ?? DEFAULT_INDEX_FRESHNESS_INTERVAL_MS;
     this.schemaIndex = new Map(flatSchema.map((item) => [item.logicalPath, item]));
     this._idIndex = new ContentIdIndex(this.root);
+    registerContentIndexForInvalidation(this.root, this);
+  }
+  /**
+   * Mark the ID index stale so the next idIndex() access rebuilds it from disk.
+   *
+   * Called (via content-index-registry) after in-process operations that change the
+   * working tree underneath this store — git checkout/merge/rebase, the worker's
+   * rebase loop, and sync-core's content replacement. Without this, ID→path lookups
+   * keep resolving to pre-mutation paths and saves can target moved/deleted files.
+   *
+   * Cheap: only bumps a generation counter; the rebuild happens lazily.
+   */
+  invalidateIndex() {
+    this.indexGeneration++;
   }
   /**
-   * Get the ID index, ensuring it's loaded first.
-   * This getter automatically loads the index on first access.
+   * Get the ID index, ensuring it's loaded and current first.
+   * Loads lazily on first access and rebuilds after invalidateIndex(); repeated
+   * accesses with no intervening invalidation reuse the already-built index,
+   * except for a throttled probe of the on-disk generation marker that detects
+   * mutations made by OTHER processes sharing this root (e.g. on EFS).
    */
   async idIndex() {
-    if (!this.indexLoaded) {
-      await this._idIndex.buildFromFilenames("content");
-      this.indexLoaded = true;
+    if (this.loadedIndexGeneration === this.indexGeneration && this.shouldProbeDiskGeneration()) {
+      const diskToken = await readContentIndexGeneration(this.root);
+      if (diskToken !== this.loadedDiskGeneration) {
+        this.indexGeneration++;
+      }
+    }
+    while (this.loadedIndexGeneration !== this.indexGeneration) {
+      if (this.indexBuild) {
+        await this.indexBuild;
+        continue;
+      }
+      const generation = this.indexGeneration;
+      const build = (async () => {
+        const diskToken = await readContentIndexGeneration(this.root);
+        const fresh = new ContentIdIndex(this.root);
+        await fresh.buildFromFilenames("content");
+        return { diskToken, fresh };
+      })();
+      this.indexBuild = build;
+      let result;
+      try {
+        result = await build;
+      } finally {
+        this.indexBuild = null;
+      }
+      this._idIndex = result.fresh;
+      this.loadedIndexGeneration = generation;
+      this.loadedDiskGeneration = result.diskToken;
+      this.lastDiskProbeMs = Date.now();
     }
     return this._idIndex;
   }
+  /**
+   * Throttle for the on-disk marker probe. Stamps the clock synchronously
+   * before the caller's readFile so concurrent idIndex() callers don't
+   * double-probe (and double-rebuild) on the same token change.
+   */
+  shouldProbeDiskGeneration() {
+    const now = Date.now();
+    if (now - this.lastDiskProbeMs < this.indexFreshnessIntervalMs)
+      return false;
+    this.lastDiskProbeMs = now;
+    return true;
+  }
+  /**
+   * After one of this store's own successful mutations: publish the change to
+   * other processes (bump the on-disk marker) and adopt the written token,
+   * since the in-memory index was already updated incrementally — avoiding a
+   * pointless self-rescan on the next probe. Adoption is skipped unless the
+   * index is quiescent and `updatedIndex` is still the live instance: if a
+   * rebuild raced with the mutation, its scan may predate our file change, so
+   * we leave the recorded token older and let the next probe observe our bump
+   * and trigger the healing rebuild.
+   */
+  async recordOwnMutation(updatedIndex) {
+    const token = await bumpContentIndexGeneration(this.root);
+    if (token !== null && this.indexBuild === null && this.loadedIndexGeneration === this.indexGeneration && this._idIndex === updatedIndex) {
+      this.loadedDiskGeneration = token;
+    }
+  }
+  /**
+   * Backstop for the residual staleness windows of the cross-process marker
+   * (NFS attribute caching, probe throttle, self-adoption — see
+   * content-index-generation.ts): force one rebuild in response to a
+   * suspicious lookup (an ID miss, or an index hit whose file is gone), but
+   * throttle how often a caller can force one. Time-boxed so genuinely
+   * dangling IDs cost at most one rescan per window. Returns true if a
+   * refresh was performed by THIS call; callers that lose the throttle race
+   * still benefit — idIndex() dedupes concurrent builds, so a caller that won
+   * the race rebuilds the index for everyone, and callers should still retry
+   * their lookup against the live index regardless of this return value.
+   */
+  async refreshIndexForSuspiciousLookup() {
+    const now = Date.now();
+    if (now - this.lastForcedRefreshMs < FORCED_REFRESH_MIN_INTERVAL_MS)
+      return false;
+    this.lastForcedRefreshMs = now;
+    this.invalidateIndex();
+    await this.idIndex();
+    return true;
+  }
+  /**
+   * Find the file in `dir` whose filename embeds `id`.
+   * Returns its root-relative path, or null if no such file (or no such dir).
+   */
+  async findEntryPathById(dir, id) {
+    let entries;
+    try {
+      entries = await fs6.readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return null;
+      throw err;
+    }
+    for (const entry of entries) {
+      if (entry.isDirectory())
+        continue;
+      if (extractIdFromFilename(entry.name) === id) {
+        return path7.relative(this.root, path7.join(dir, entry.name));
+      }
+    }
+    return null;
+  }
   /**
    * Get all schema items for iteration.
    * Used internally by ReferenceResolver for path matching.
@@ -1247,11 +1576,11 @@ var ContentStore = class {
   getSchemaItems() {
     return this.schemaIndex.values();
   }
-  assertSchemaItem(path15) {
-    const normalized = normalizeFilesystemPath(path15);
+  assertSchemaItem(path18) {
+    const normalized = normalizeFilesystemPath(path18);
     const item = this.schemaIndex.get(normalized);
     if (!item) {
-      throw new ContentStoreError(`Unknown schema item: ${path15}`, "NO_SCHEMA_ITEM");
+      throw new ContentStoreError(`Unknown schema item: ${path18}`, "NO_SCHEMA_ITEM");
     }
     return item;
   }
@@ -1278,7 +1607,7 @@ var ContentStore = class {
    * @param options.entryTypeName - For collections with multiple entry types, specify which one to use. Defaults to the default entry type.
    */
   async buildPaths(schemaItem, slug, options = {}) {
-    const rootWithSep = this.root.endsWith(path5.sep) ? this.root : `${this.root}${path5.sep}`;
+    const rootWithSep = this.root.endsWith(path7.sep) ? this.root : `${this.root}${path7.sep}`;
     if (schemaItem.type === "entry-type") {
       const parentPath = schemaItem.parentPath || "";
       const parentCollection = this.schemaIndex.get(parentPath);
@@ -1311,7 +1640,7 @@ var ContentStore = class {
       const entryTypeName = entryTypeConfig?.name || "entry";
       let collectionRoot = await resolveCollectionPath(this.root, schemaItem.logicalPath);
       if (!collectionRoot) {
-        collectionRoot = path5.resolve(this.root, schemaItem.logicalPath);
+        collectionRoot = path7.resolve(this.root, schemaItem.logicalPath);
       }
       if (!collectionRoot.startsWith(rootWithSep)) {
         throw new ContentStoreError("Path traversal detected", "VALIDATION");
@@ -1320,7 +1649,7 @@ var ContentStore = class {
       let existingFilename;
       let existingEntryType;
       if (!id) {
-        const entries = await fs4.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+        const entries = await fs6.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
         const existingFile = entries.find((entry) => {
           if (entry.isDirectory())
             return false;
@@ -1344,14 +1673,14 @@ var ContentStore = class {
         }
         filename = `${finalEntryTypeName}.${safeSlug}.${id}${ext}`;
       }
-      const resolved = path5.resolve(collectionRoot, filename);
-      const collectionRootWithSep = collectionRoot.endsWith(path5.sep) ? collectionRoot : `${collectionRoot}${path5.sep}`;
+      const resolved = path7.resolve(collectionRoot, filename);
+      const collectionRootWithSep = collectionRoot.endsWith(path7.sep) ? collectionRoot : `${collectionRoot}${path7.sep}`;
       if (!resolved.startsWith(collectionRootWithSep)) {
         throw new ContentStoreError("Path traversal detected", "VALIDATION");
       }
       return {
         absolutePath: resolved,
-        relativePath: path5.relative(this.root, resolved),
+        relativePath: path7.relative(this.root, resolved),
         id,
         entryTypeName: finalEntryTypeName
       };
@@ -1386,8 +1715,8 @@ var ContentStore = class {
   async read(collectionPath, slug = "", options = {}) {
     const schemaItem = this.assertSchemaItem(collectionPath);
     const { absolutePath, relativePath, entryTypeName: resolvedEntryTypeName } = await this.buildPaths(schemaItem, slug);
-    const stat = await fs4.stat(absolutePath);
-    const raw = await fs4.readFile(absolutePath, "utf8");
+    const stat = await fs6.stat(absolutePath);
+    const raw = await fs6.readFile(absolutePath, "utf8");
     let doc;
     let format;
     let fields;
@@ -1445,7 +1774,7 @@ var ContentStore = class {
     return doc;
   }
   async write(collectionPath, slug = "", input, entryTypeName, existingId) {
-    const idIndex = await this.idIndex();
+    await this.idIndex();
     const schemaItem = this.assertSchemaItem(collectionPath);
     let expectedFormat;
     let fields = [];
@@ -1473,10 +1802,10 @@ var ContentStore = class {
       existingId
     });
     return withLock(absolutePath, async () => {
-      await fs4.mkdir(path5.dirname(absolutePath), { recursive: true });
+      await fs6.mkdir(path7.dirname(absolutePath), { recursive: true });
       if (input.expectedVersion !== void 0) {
         try {
-          const existing = await fs4.stat(absolutePath);
+          const existing = await fs6.stat(absolutePath);
           if (existing.mtimeMs !== input.expectedVersion) {
             throw new ContentConflictError();
           }
@@ -1489,6 +1818,13 @@ var ContentStore = class {
           }
         }
       }
+      if (existingId && !await filePathExists(absolutePath)) {
+        const actualRelPath = await this.findEntryPathById(path7.dirname(absolutePath), existingId);
+        const indexedRelPath = this._idIndex.findById(existingId)?.relativePath ?? null;
+        if (actualRelPath !== null && actualRelPath !== indexedRelPath) {
+          throw new ContentConflictError();
+        }
+      }
       let content;
       if (input.format === "json") {
         content = `${JSON.stringify(input.data ?? {}, null, 2)}
@@ -1499,19 +1835,17 @@ var ContentStore = class {
         content = matter.stringify(input.body, input.data ?? {});
       }
       await atomicWriteFile(absolutePath, content);
+      const liveIndex = this._idIndex;
+      let staleOldAbsPath = null;
       if (id) {
-        const existing = idIndex.findById(id);
+        const existing = liveIndex.findById(id);
         if (existing) {
           if (existing.relativePath !== relativePath) {
-            const oldAbsPath = path5.join(this.root, existing.relativePath);
-            await fs4.unlink(oldAbsPath).catch((err) => {
-              if (!isNodeError(err) || err.code !== "ENOENT")
-                throw err;
-            });
-            idIndex.updatePath(existing.id, relativePath);
+            staleOldAbsPath = path7.join(this.root, existing.relativePath);
+            liveIndex.updatePath(existing.id, relativePath);
           }
         } else {
-          idIndex.add({
+          liveIndex.add({
             type: "entry",
             relativePath,
             collection: collectionPath,
@@ -1519,7 +1853,14 @@ var ContentStore = class {
           });
         }
       }
-      const afterStat = await fs4.stat(absolutePath);
+      if (staleOldAbsPath) {
+        await fs6.unlink(staleOldAbsPath).catch((err) => {
+          if (!isNodeError(err) || err.code !== "ENOENT")
+            throw err;
+        });
+      }
+      await this.recordOwnMutation(liveIndex);
+      const afterStat = await fs6.stat(absolutePath);
       const base = {
         collection: schemaItem.logicalPath,
         collectionName: schemaItem.name,
@@ -1545,13 +1886,34 @@ var ContentStore = class {
   /**
    * Read an entry by its ID (UUID).
    * Returns null if the ID doesn't exist or points to a collection.
+   *
+   * Suspicious results (ID missing from the index, or an index hit whose file
+   * is gone) trigger one forced index refresh and a retry — self-healing for
+   * mutations by other processes inside the marker's residual windows.
    */
   async readById(id) {
+    const first = await this.readByIdOnce(id);
+    if (first !== STALE_LOOKUP)
+      return first;
+    if (!await this.refreshIndexForSuspiciousLookup())
+      return null;
+    const second = await this.readByIdOnce(id);
+    return second === STALE_LOOKUP ? null : second;
+  }
+  async readByIdOnce(id) {
     const idIndex = await this.idIndex();
     const location = idIndex.findById(id);
-    if (!location || location.type !== "entry")
+    if (!location)
+      return STALE_LOOKUP;
+    if (location.type !== "entry")
       return null;
-    return this.read(location.collection, location.slug);
+    try {
+      return await this.read(location.collection, location.slug);
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return STALE_LOOKUP;
+      throw err;
+    }
   }
   /**
    * Get the ID for an entry given its collection and slug.
@@ -1562,19 +1924,72 @@ var ContentStore = class {
     const { relativePath } = await this.buildPaths(this.assertCollection(collectionPath), slug);
     return idIndex.findByPath(relativePath);
   }
+  /**
+   * Check whether a document already exists on disk for this collection+slug.
+   * Used by the write boundary to distinguish creates from edits (create
+   * scaffolds and maxItems enforcement).
+   */
+  async documentExists(collectionPath, slug = "") {
+    const schemaItem = this.assertSchemaItem(collectionPath);
+    const { absolutePath } = await this.buildPaths(schemaItem, slug);
+    try {
+      await fs6.access(absolutePath);
+      return true;
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return false;
+      throw err;
+    }
+  }
+  /**
+   * Resolve the actual on-disk entry type of an existing collection entry, by
+   * inspecting its filename directly. Entry filenames embed their type
+   * (`{type}.{slug}.{id}.{ext}`) and it is immutable after creation — see the
+   * existing-file lookup in buildPaths(), which this mirrors. Returns
+   * undefined if no entry exists yet at this slug.
+   *
+   * Used at the API write boundary (api/content.ts) to validate an existing
+   * entry's payload against ITS real schema rather than a caller-supplied (or
+   * omitted/spoofed) `entryType` param — ContentStore.write() preserves the
+   * on-disk type regardless of what's requested, so validation must agree
+   * with what will actually be written (post-review M2).
+   *
+   * Cheap: one buildPaths() resolution plus a stat, no file content is read —
+   * same cost class as documentExists().
+   */
+  async getExistingEntryType(collectionPath, slug = "") {
+    const schemaItem = this.assertCollection(collectionPath);
+    const { absolutePath, entryTypeName } = await this.buildPaths(schemaItem, slug);
+    return await filePathExists(absolutePath) ? entryTypeName : void 0;
+  }
+  /**
+   * Count existing entries of a given entry type in a collection, by filename
+   * (entry filenames embed their type: `{type}.{slug}.{id}.{ext}`). Used to
+   * enforce `EntryTypeConfig.maxItems` server-side at the create boundary.
+   */
+  async countEntriesOfType(collectionPath, entryTypeName) {
+    this.assertCollection(collectionPath);
+    const collectionRoot = await resolveCollectionPath(this.root, collectionPath);
+    if (!collectionRoot)
+      return 0;
+    const entries = await fs6.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+    return entries.filter((entry) => !entry.isDirectory() && extractEntryTypeFromFilename(entry.name) === entryTypeName).length;
+  }
   /**
    * Delete an entry and remove it from the index.
    */
   async delete(collectionPath, slug) {
-    const idIndex = await this.idIndex();
+    await this.idIndex();
     const collection = this.assertCollection(collectionPath);
     const { absolutePath, relativePath } = await this.buildPaths(collection, slug);
     return withLock(absolutePath, async () => {
-      const id = idIndex.findByPath(relativePath);
-      await fs4.unlink(absolutePath);
+      await fs6.unlink(absolutePath);
+      const liveIndex = this._idIndex;
+      const id = liveIndex.findByPath(relativePath);
       if (id) {
-        idIndex.remove(id);
+        liveIndex.remove(id);
       }
+      await this.recordOwnMutation(liveIndex);
     });
   }
   /**
@@ -1588,7 +2003,7 @@ var ContentStore = class {
    * @throws ContentStoreError if entry doesn't exist, new slug conflicts, or validation fails
    */
   async renameEntry(collectionPath, currentSlug, newSlug) {
-    const idIndex = await this.idIndex();
+    await this.idIndex();
     const collection = this.assertCollection(collectionPath);
     validateSlug(newSlug);
     const safeNewSlug = newSlug.replace(/^\/+/, "");
@@ -1601,11 +2016,11 @@ var ContentStore = class {
     const { absolutePath: currentPath, relativePath: currentRelPath } = await this.buildPaths(collection, currentSlug);
     return withLock(currentPath, async () => {
       try {
-        await fs4.access(currentPath);
+        await fs6.access(currentPath);
       } catch {
         throw new ContentStoreError(`Entry not found: ${currentSlug}`, "NOT_FOUND");
       }
-      const currentFilename = path5.basename(currentPath);
+      const currentFilename = path7.basename(currentPath);
       const parts = currentFilename.split(".");
       if (parts.length < 4) {
         throw new ContentStoreError(`Invalid entry filename format: ${currentFilename}`, "VALIDATION");
@@ -1614,10 +2029,10 @@ var ContentStore = class {
       const contentId = parts[parts.length - 2];
       const ext = `.${parts[parts.length - 1]}`;
       const newFilename = `${entryTypeName}.${safeNewSlug}.${contentId}${ext}`;
-      const parentDir = path5.dirname(currentPath);
-      const newPath = path5.join(parentDir, newFilename);
+      const parentDir = path7.dirname(currentPath);
+      const newPath = path7.join(parentDir, newFilename);
       try {
-        const entries = await fs4.readdir(parentDir, { withFileTypes: true });
+        const entries = await fs6.readdir(parentDir, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isDirectory())
             continue;
@@ -1631,19 +2046,21 @@ var ContentStore = class {
           throw err;
       }
       try {
-        await fs4.link(currentPath, newPath);
+        await fs6.link(currentPath, newPath);
       } catch (err) {
         if (isNodeError(err) && err.code === "EEXIST") {
           throw new ContentStoreError(`Entry with slug "${safeNewSlug}" already exists in collection "${collectionPath}"`, "VALIDATION");
         }
         throw err;
       }
-      await fs4.unlink(currentPath);
-      const newRelativePath = path5.relative(this.root, newPath);
-      const entryId = idIndex.findByPath(currentRelPath);
+      await fs6.unlink(currentPath);
+      const newRelativePath = path7.relative(this.root, newPath);
+      const liveIndex = this._idIndex;
+      const entryId = liveIndex.findByPath(currentRelPath);
       if (entryId) {
-        idIndex.updatePath(entryId, newRelativePath);
+        liveIndex.updatePath(entryId, newRelativePath);
       }
+      await this.recordOwnMutation(liveIndex);
       return { newPath: `${collectionPath}/${safeNewSlug}` };
     });
   }
@@ -1737,11 +2154,32 @@ var ContentStore = class {
    * Resolve a single reference ID to full entry data.
    * Returns null if the reference is invalid or missing.
    * Includes id, slug, and collection fields for debugging.
+   *
+   * Suspicious results (ID missing from the index, or an index hit whose file
+   * is gone) trigger one forced index refresh and a retry — self-healing for
+   * mutations by other processes inside the marker's residual windows. The
+   * forced refresh itself is throttled (see refreshIndexForSuspiciousLookup),
+   * but the retry against the live index always runs regardless of whether
+   * this call won the throttle race: when a `list: true` reference array is
+   * resolved via Promise.all, every miss shares the same stale snapshot, and
+   * idIndex() dedupes concurrent builds — so a sibling call that wins the
+   * throttle and rebuilds heals every other miss in the same batch, not just
+   * the first.
    */
   async resolveSingleReference(id, idIndex) {
+    const first = await this.resolveSingleReferenceOnce(id, idIndex);
+    if (first !== STALE_LOOKUP)
+      return first;
+    await this.refreshIndexForSuspiciousLookup();
+    const second = await this.resolveSingleReferenceOnce(id, await this.idIndex());
+    return second === STALE_LOOKUP ? null : second;
+  }
+  async resolveSingleReferenceOnce(id, idIndex) {
     try {
       const location = idIndex.findById(id);
-      if (!location || location.type !== "entry" || !location.collection || !location.slug) {
+      if (!location)
+        return STALE_LOOKUP;
+      if (location.type !== "entry" || !location.collection || !location.slug) {
         return null;
       }
       const doc = await this.read(location.collection, location.slug, {
@@ -1754,6 +2192,8 @@ var ContentStore = class {
         ...doc.data
       };
     } catch (error) {
+      if (isNodeError(error) && error.code === "ENOENT")
+        return STALE_LOOKUP;
       console.error(`Failed to resolve reference ${id}:`, error);
       return null;
     }
@@ -1761,11 +2201,11 @@ var ContentStore = class {
 };
 
 // dist/branch-schema-cache.js
-import fs6 from "node:fs/promises";
-import path6 from "node:path";
+import fs8 from "node:fs/promises";
+import path8 from "node:path";
 
 // dist/schema/meta-loader.js
-import { promises as fs5 } from "fs";
+import { promises as fs7 } from "fs";
 import { join as join2 } from "pathe";
 import { z as z6 } from "zod";
 import chokidar from "chokidar";
@@ -1801,7 +2241,7 @@ function stripEmbeddedIdFromName(name) {
 async function scanForCollectionMeta(baseDir, relativePath = "") {
   const collections = [];
   try {
-    const entries = await fs5.readdir(baseDir, { withFileTypes: true });
+    const entries = await fs7.readdir(baseDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -1812,8 +2252,8 @@ async function scanForCollectionMeta(baseDir, relativePath = "") {
       const absolutePath = join2(baseDir, folderName);
       const metaPath = join2(absolutePath, ".collection.json");
       try {
-        await fs5.access(metaPath);
-        const content = await fs5.readFile(metaPath, "utf-8");
+        await fs7.access(metaPath);
+        const content = await fs7.readFile(metaPath, "utf-8");
         const parsed = JSON.parse(content);
         const meta = collectionMetaSchema.parse(parsed);
         collections.push({
@@ -1845,7 +2285,7 @@ async function loadCollectionMetaFiles(contentRoot) {
   let root = null;
   const rootMetaPath = join2(contentRoot, ".collection.json");
   try {
-    await fs5.access(rootMetaPath);
+    await fs7.access(rootMetaPath);
   } catch (err) {
     if (err.code === "ENOENT") {
     } else {
@@ -1853,7 +2293,7 @@ async function loadCollectionMetaFiles(contentRoot) {
     }
   }
   try {
-    const content = await fs5.readFile(rootMetaPath, "utf-8");
+    const content = await fs7.readFile(rootMetaPath, "utf-8");
     const parsed = JSON.parse(content);
     root = rootCollectionMetaSchema.parse(parsed);
   } catch (err) {
@@ -1971,16 +2411,16 @@ var MTIME_CHECK_DEBOUNCE_MS = 1e3;
 async function isStaleByMtime(dir, cachedAt) {
   let entries;
   try {
-    entries = await fs6.readdir(dir, { recursive: true, encoding: "utf-8" });
+    entries = await fs8.readdir(dir, { recursive: true, encoding: "utf-8" });
   } catch {
     return true;
   }
   for (const entry of entries) {
     if (!entry.endsWith(".collection.json"))
       continue;
-    const full = path6.join(dir, entry);
+    const full = path8.join(dir, entry);
     try {
-      const stat = await fs6.stat(full);
+      const stat = await fs8.stat(full);
       if (stat.mtimeMs > cachedAt.getTime())
         return true;
     } catch {
@@ -2004,7 +2444,7 @@ var BranchSchemaCache = class {
    * the project root, regardless of which entrypoint produced the cwd branchRoot.
    */
   skipDiskCache(branchRoot) {
-    return isBuildMode() || path6.resolve(branchRoot) === path6.resolve(process.cwd());
+    return isBuildMode() || path8.resolve(branchRoot) === path8.resolve(process.cwd());
   }
   /**
    * Get schema for a branch (loads from cache or resolves fresh).
@@ -2021,17 +2461,17 @@ var BranchSchemaCache = class {
    * Load schema from cache or resolve fresh if cache is missing or stale.
    */
   async loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName) {
-    const contentRoot = path6.join(branchRoot, contentRootName);
+    const contentRoot = path8.join(branchRoot, contentRootName);
     const skipDiskCache = this.skipDiskCache(branchRoot);
     if (!skipDiskCache) {
-      const cacheDir = path6.join(branchRoot, ".canopy-meta");
-      const cachePath = path6.join(cacheDir, "schema-cache.json");
-      const stalePath = path6.join(cacheDir, "schema-cache.stale");
+      const cacheDir = path8.join(branchRoot, ".canopy-meta");
+      const cachePath = path8.join(cacheDir, "schema-cache.json");
+      const stalePath = path8.join(cacheDir, "schema-cache.stale");
       let cacheData = null;
       try {
-        const staleExists = await fs6.access(stalePath).then(() => true).catch(() => false);
+        const staleExists = await fs8.access(stalePath).then(() => true).catch(() => false);
         if (!staleExists) {
-          const cacheContent = await fs6.readFile(cachePath, "utf-8");
+          const cacheContent = await fs8.readFile(cachePath, "utf-8");
           cacheData = JSON.parse(cacheContent);
         }
       } catch {
@@ -2056,21 +2496,21 @@ var BranchSchemaCache = class {
     }
     const flatSchema = flattenSchema(result.schema, contentRootName);
     if (!skipDiskCache) {
-      const cacheDir = path6.join(branchRoot, ".canopy-meta");
-      const cachePath = path6.join(cacheDir, "schema-cache.json");
-      const stalePath = path6.join(cacheDir, "schema-cache.stale");
-      await fs6.mkdir(cacheDir, { recursive: true });
+      const cacheDir = path8.join(branchRoot, ".canopy-meta");
+      const cachePath = path8.join(cacheDir, "schema-cache.json");
+      const stalePath = path8.join(cacheDir, "schema-cache.stale");
+      await fs8.mkdir(cacheDir, { recursive: true });
       const newCache = {
         version: SCHEMA_CACHE_VERSION,
         schema: result.schema,
         flatSchema,
         cachedAt: (/* @__PURE__ */ new Date()).toISOString()
       };
-      const tmpPath = path6.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
-      await fs6.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
-      await fs6.rename(tmpPath, cachePath);
+      const tmpPath = path8.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
+      await fs8.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
+      await fs8.rename(tmpPath, cachePath);
       try {
-        await fs6.unlink(stalePath);
+        await fs8.unlink(stalePath);
       } catch {
       }
     }
@@ -2084,16 +2524,16 @@ var BranchSchemaCache = class {
   async invalidate(branchRoot) {
     if (this.skipDiskCache(branchRoot))
       return;
-    const cacheDir = path6.join(branchRoot, ".canopy-meta");
-    const stalePath = path6.join(cacheDir, "schema-cache.stale");
-    await fs6.mkdir(cacheDir, { recursive: true });
-    await fs6.writeFile(stalePath, "", "utf-8");
+    const cacheDir = path8.join(branchRoot, ".canopy-meta");
+    const stalePath = path8.join(cacheDir, "schema-cache.stale");
+    await fs8.mkdir(cacheDir, { recursive: true });
+    await fs8.writeFile(stalePath, "", "utf-8");
   }
 };
 
 // dist/ai/generate.js
-import path7 from "node:path";
-import fs7 from "node:fs/promises";
+import path9 from "node:path";
+import fs9 from "node:fs/promises";
 import { minimatch } from "minimatch";
 
 // dist/ai/strip-mdx.js
@@ -2599,97 +3039,6 @@ function yamlValue(value) {
   return value;
 }
 
-// dist/utils/debug.js
-var LOG_LEVELS = {
-  DEBUG: 0,
-  INFO: 1,
-  WARN: 2,
-  ERROR: 3
-};
-var DebugLogger = class {
-  constructor(options = {}) {
-    this.timers = /* @__PURE__ */ new Map();
-    this.options = options;
-  }
-  shouldLog(level) {
-    const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
-    if (!enabled)
-      return false;
-    const minLevel = this.options.minLevel ?? "DEBUG";
-    return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
-  }
-  formatMessage(level, category, message) {
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const prefix = this.options.prefix ?? "CanopyCMS";
-    return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
-  }
-  debug(category, message, data) {
-    if (this.shouldLog("DEBUG")) {
-      console.log(this.formatMessage("DEBUG", category, message), data ?? "");
-    }
-  }
-  info(category, message, data) {
-    if (this.shouldLog("INFO")) {
-      console.log(this.formatMessage("INFO", category, message), data ?? "");
-    }
-  }
-  warn(category, message, data) {
-    if (this.shouldLog("WARN")) {
-      console.warn(this.formatMessage("WARN", category, message), data ?? "");
-    }
-  }
-  error(category, message, data) {
-    const msg = this.formatMessage("ERROR", category, message);
-    if (this.shouldLog("ERROR")) {
-      console.error(msg, data ?? "");
-    }
-    const throwOnError = this.options.throwOnError ?? false;
-    if (throwOnError) {
-      const errorMsg = data ? `${message}: ${JSON.stringify(data)}` : message;
-      throw new Error(errorMsg);
-    }
-  }
-  /**
-   * Start timing an operation
-   */
-  time(label) {
-    this.timers.set(label, Date.now());
-  }
-  /**
-   * End timing an operation and log the duration
-   */
-  timeEnd(category, label) {
-    const start = this.timers.get(label);
-    if (start === void 0) {
-      this.warn(category, `Timer '${label}' does not exist`);
-      return;
-    }
-    const duration = Date.now() - start;
-    this.timers.delete(label);
-    this.debug(category, `${label} completed`, { durationMs: duration });
-    return duration;
-  }
-  /**
-   * Wrap an async function with automatic timing
-   */
-  async timed(category, label, fn) {
-    this.time(label);
-    try {
-      return await fn();
-    } finally {
-      this.timeEnd(category, label);
-    }
-  }
-};
-function createDebugLogger(options) {
-  return new DebugLogger(options);
-}
-var testLogger = createDebugLogger({
-  enabled: process.env.E2E_DEBUG === "true",
-  prefix: "E2E",
-  throwOnError: false
-});
-
 // dist/utils/entry-url.js
 init_normalize();
 function computeEntryUrl(collection, slug, contentRoot) {
@@ -2704,12 +3053,12 @@ function computeEntryUrl(collection, slug, contentRoot) {
   if (slug && slug !== "index") {
     segments.push(slug);
   }
-  const path15 = segments.length > 0 ? `/${segments.join("/")}` : "/";
-  return path15.toLowerCase();
+  const path18 = segments.length > 0 ? `/${segments.join("/")}` : "/";
+  return path18.toLowerCase();
 }
 
 // dist/entry-link-resolver.js
-var log = createDebugLogger({ prefix: "EntryLinks" });
+var log2 = createDebugLogger({ prefix: "EntryLinks" });
 var BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
 var ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
 function resolveEntryUrl(location, contentRoot) {
@@ -2723,7 +3072,7 @@ function resolveEntryLinksInText(text, idIndex, contentRoot, customResolver) {
     return part.text.replace(ENTRY_LINK_PATTERN, (_match, id, anchor) => {
       const location = idIndex.findById(id);
       if (!location || location.type !== "entry" || !location.collection || !location.slug) {
-        log.warn("resolve", `Entry link target not found: entry:${id}`);
+        log2.warn("resolve", `Entry link target not found: entry:${id}`);
         return anchor ?? "#";
       }
       let url;
@@ -2880,7 +3229,7 @@ async function processCollection(store, collection, flatSchema, contentRoot, con
   const listed = await store.getCollectionEntryPaths(collection.logicalPath);
   const directEntries = listed.filter((e) => e.collection === collection.logicalPath);
   for (const listEntry of directEntries) {
-    const entryTypeName = extractEntryTypeFromFilename(path7.basename(listEntry.relativePath));
+    const entryTypeName = extractEntryTypeFromFilename(path9.basename(listEntry.relativePath));
     if (!entryTypeName)
       continue;
     if (config?.exclude?.entryTypes?.includes(entryTypeName))
@@ -2898,7 +3247,7 @@ async function processCollection(store, collection, flatSchema, contentRoot, con
       }
       if (config?.exclude?.where?.(aiEntry))
         continue;
-      await runEntryTransform(aiEntry, doc.absolutePath, extractIdFromFilename(path7.basename(listEntry.relativePath)), config);
+      await runEntryTransform(aiEntry, doc.absolutePath, extractIdFromFilename(path9.basename(listEntry.relativePath)), config);
       entries.push(aiEntry);
       const entryFilePath = `${cleanPath}/${listEntry.slug}.md`;
       const entryMarkdown = entryToMarkdown(aiEntry, config);
@@ -2949,7 +3298,7 @@ async function processRootEntries(store, rootCollection, contentRoot, config, id
   const listed = await store.getCollectionEntryPaths(rootCollection.logicalPath);
   const directEntries = listed.filter((e) => e.collection === rootCollection.logicalPath);
   for (const listEntry of directEntries) {
-    const entryTypeName = extractEntryTypeFromFilename(path7.basename(listEntry.relativePath));
+    const entryTypeName = extractEntryTypeFromFilename(path9.basename(listEntry.relativePath));
     if (!entryTypeName)
       continue;
     if (config?.exclude?.entryTypes?.includes(entryTypeName))
@@ -2967,7 +3316,7 @@ async function processRootEntries(store, rootCollection, contentRoot, config, id
       }
       if (config?.exclude?.where?.(aiEntry))
         continue;
-      await runEntryTransform(aiEntry, doc.absolutePath, extractIdFromFilename(path7.basename(listEntry.relativePath)), config);
+      await runEntryTransform(aiEntry, doc.absolutePath, extractIdFromFilename(path9.basename(listEntry.relativePath)), config);
       entries.push(aiEntry);
       const entryFilePath = `${listEntry.slug}.md`;
       const entryMarkdown = entryToMarkdown(aiEntry, config);
@@ -3015,19 +3364,19 @@ function docToAIEntry(doc, slug, entryTypeName, entryTypeConfig, cleanCollection
   };
 }
 function makeReadSibling(dir) {
-  const resolvedDir = path7.resolve(dir);
+  const resolvedDir = path9.resolve(dir);
   return async (name) => {
-    if (!name || name.includes("/") || name.includes("\\") || path7.isAbsolute(name) || hasTraversalSequence(name)) {
+    if (!name || name.includes("/") || name.includes("\\") || path9.isAbsolute(name) || hasTraversalSequence(name)) {
       return null;
     }
-    const abs = path7.resolve(resolvedDir, name);
-    if (path7.dirname(abs) !== resolvedDir)
+    const abs = path9.resolve(resolvedDir, name);
+    if (path9.dirname(abs) !== resolvedDir)
       return null;
     try {
-      const stats = await fs7.lstat(abs);
+      const stats = await fs9.lstat(abs);
       if (!stats.isFile())
         return null;
-      return await fs7.readFile(abs, "utf8");
+      return await fs9.readFile(abs, "utf8");
     } catch (err) {
       if (isNodeError(err) && (err.code === "ENOENT" || err.code === "ENOTDIR"))
         return null;
@@ -3041,7 +3390,7 @@ async function runEntryTransform(entry, absolutePath, contentId, config) {
     return;
   const ctx = {
     contentId: contentId ?? "",
-    readSibling: makeReadSibling(path7.dirname(absolutePath))
+    readSibling: makeReadSibling(path9.dirname(absolutePath))
   };
   try {
     const appended = await transform(entry, ctx);
@@ -3078,33 +3427,33 @@ function matchesBundleFilter(entry, filter, contentRoot) {
 }
 
 // dist/branch-workspace.js
-import path12 from "node:path";
+import path14 from "node:path";
 
 // dist/branch-metadata.js
-import { randomUUID } from "node:crypto";
-import fs9 from "node:fs/promises";
-import path9 from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import fs11 from "node:fs/promises";
+import path11 from "node:path";
 
 // dist/branch-registry.js
-import fs8 from "node:fs/promises";
-import path8 from "node:path";
+import fs10 from "node:fs/promises";
+import path10 from "node:path";
 var REGISTRY_FILE = "branches.json";
 var REGISTRY_STALE_FILE = "branches.stale.json";
 var REGISTRY_TEMP_FILE = "branches.tmp.json";
 var REGISTRY_VERSION = 1;
 var BranchRegistry = class {
   constructor(root) {
-    this.root = path8.resolve(root);
-    this.registryPath = path8.join(this.root, REGISTRY_FILE);
-    this.stalePath = path8.join(this.root, REGISTRY_STALE_FILE);
-    this.tempPath = path8.join(this.root, REGISTRY_TEMP_FILE);
+    this.root = path10.resolve(root);
+    this.registryPath = path10.join(this.root, REGISTRY_FILE);
+    this.stalePath = path10.join(this.root, REGISTRY_STALE_FILE);
+    this.tempPath = path10.join(this.root, REGISTRY_TEMP_FILE);
   }
   /**
    * Returns all branches. Uses cache if fresh, regenerates if stale.
    */
   async list() {
     try {
-      const raw = await fs8.readFile(this.registryPath, "utf8");
+      const raw = await fs10.readFile(this.registryPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed.version || !Array.isArray(parsed.branches)) {
         return await this.regenerate();
@@ -3130,7 +3479,7 @@ var BranchRegistry = class {
    */
   async invalidate() {
     try {
-      await fs8.rename(this.registryPath, this.stalePath);
+      await fs10.rename(this.registryPath, this.stalePath);
     } catch (err) {
       if (!isNotFoundError(err)) {
         throw err;
@@ -3144,20 +3493,20 @@ var BranchRegistry = class {
   async regenerate() {
     const branches = await this.scanBranchDirectories();
     const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs8.mkdir(this.root, { recursive: true });
+    await fs10.mkdir(this.root, { recursive: true });
     const snapshot = {
       version: REGISTRY_VERSION,
       branches
     };
-    await fs8.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs10.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
-      await fs8.rename(uniqueTempPath, this.registryPath);
+      await fs10.rename(uniqueTempPath, this.registryPath);
     } catch (err) {
-      await fs8.unlink(uniqueTempPath).catch(() => {
+      await fs10.unlink(uniqueTempPath).catch(() => {
       });
       throw err;
     }
-    await fs8.unlink(this.stalePath).catch(() => {
+    await fs10.unlink(this.stalePath).catch(() => {
     });
     return branches;
   }
@@ -3167,12 +3516,12 @@ var BranchRegistry = class {
   async scanBranchDirectories() {
     const branches = [];
     try {
-      const entries = await fs8.readdir(this.root, { withFileTypes: true });
+      const entries = await fs10.readdir(this.root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) {
           continue;
         }
-        const branchRoot = path8.join(this.root, entry.name);
+        const branchRoot = path10.join(this.root, entry.name);
         const meta = await BranchMetadataFileManager.loadOnly(branchRoot);
         if (meta) {
           branches.push({
@@ -3204,8 +3553,8 @@ var BranchMetadataConflictError = class extends Error {
 };
 var BranchMetadataFileManager = class _BranchMetadataFileManager {
   constructor(branchRoot, baseRoot) {
-    this.branchRoot = path9.resolve(branchRoot);
-    this.filePath = path9.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
+    this.branchRoot = path11.resolve(branchRoot);
+    this.filePath = path11.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
     this.baseRoot = baseRoot;
   }
   /**
@@ -3213,9 +3562,9 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
    */
   static async loadOnly(branchRoot) {
-    const filePath = path9.join(path9.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
+    const filePath = path11.join(path11.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
     try {
-      const raw = await fs9.readFile(filePath, "utf8");
+      const raw = await fs11.readFile(filePath, "utf8");
       return JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError(err)) {
@@ -3233,7 +3582,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   }
   async load() {
     try {
-      const raw = await fs9.readFile(this.filePath, "utf8");
+      const raw = await fs11.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -3250,38 +3599,38 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    */
   async write(meta, expectedVersion) {
     const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
-    const writeId = randomUUID();
+    const writeId = randomUUID2();
     const payload = {
       ...meta,
       schemaVersion: meta.schemaVersion ?? CURRENT_SCHEMA_VERSION,
       version: newVersion,
       writeId
     };
-    await fs9.mkdir(path9.dirname(this.filePath), { recursive: true });
+    await fs11.mkdir(path11.dirname(this.filePath), { recursive: true });
     const content = JSON.stringify(payload, null, 2) + "\n";
     if (expectedVersion === null) {
       const tempPath2 = `${this.filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-      await fs9.writeFile(tempPath2, content, "utf-8");
+      await fs11.writeFile(tempPath2, content, "utf-8");
       try {
-        await fs9.link(tempPath2, this.filePath);
+        await fs11.link(tempPath2, this.filePath);
       } catch (err) {
-        await fs9.unlink(tempPath2).catch(() => {
+        await fs11.unlink(tempPath2).catch(() => {
         });
         if (isFileExistsError(err)) {
           throw new BranchMetadataConflictError();
         }
         throw err;
       }
-      await fs9.unlink(tempPath2).catch(() => {
+      await fs11.unlink(tempPath2).catch(() => {
       });
       return { version: newVersion, writeId };
     }
     const tempPath = `${this.filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    await fs9.writeFile(tempPath, content, "utf-8");
+    await fs11.writeFile(tempPath, content, "utf-8");
     try {
       let currentVersion = null;
       try {
-        const current = JSON.parse(await fs9.readFile(this.filePath, "utf-8"));
+        const current = JSON.parse(await fs11.readFile(this.filePath, "utf-8"));
         currentVersion = current.version ?? 0;
       } catch {
         currentVersion = null;
@@ -3289,13 +3638,13 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
       if (currentVersion !== expectedVersion) {
         throw new BranchMetadataConflictError();
       }
-      await fs9.rename(tempPath, this.filePath);
-      const afterWrite = JSON.parse(await fs9.readFile(this.filePath, "utf-8"));
+      await fs11.rename(tempPath, this.filePath);
+      const afterWrite = JSON.parse(await fs11.readFile(this.filePath, "utf-8"));
       if (afterWrite.writeId !== writeId) {
         throw new BranchMetadataConflictError();
       }
     } catch (err) {
-      await fs9.unlink(tempPath).catch(() => {
+      await fs11.unlink(tempPath).catch(() => {
       });
       throw err;
     }
@@ -3309,7 +3658,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
         if (err instanceof BranchMetadataConflictError && attempt < maxAttempts) {
           const baseDelay = Math.min(10 * Math.pow(2, attempt - 1), 100);
           const jitter = Math.random() * baseDelay;
-          await new Promise((resolve) => setTimeout(resolve, baseDelay + jitter));
+          await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
           continue;
         }
         throw err;
@@ -3358,8 +3707,8 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Invalidates the registry cache so next list() call regenerates from branch.json files.
    */
   async invalidateRegistry() {
-    const registry = new BranchRegistry(this.baseRoot);
-    await registry.invalidate();
+    const registry2 = new BranchRegistry(this.baseRoot);
+    await registry2.invalidate();
   }
 };
 var getBranchMetadataFileManager = (branchRoot, baseRoot) => {
@@ -3386,8 +3735,8 @@ var loadBranchContext = async (options) => {
 init_operating_mode();
 
 // dist/git-manager.js
-import fs11 from "node:fs/promises";
-import path11 from "node:path";
+import fs13 from "node:fs/promises";
+import path13 from "node:path";
 import { simpleGit as simpleGit2 } from "simple-git";
 
 // dist/utils/git.js
@@ -3411,21 +3760,41 @@ async function resolveBaseBranch(options) {
 }
 
 // dist/utils/provisioning-lock.js
-import fs10 from "node:fs/promises";
-import path10 from "node:path";
+import fs12 from "node:fs/promises";
+import path12 from "node:path";
 import lockfile from "proper-lockfile";
 async function acquireProvisioningLock(lockTargetDir, lockName) {
-  await fs10.mkdir(lockTargetDir, { recursive: true });
+  await fs12.mkdir(lockTargetDir, { recursive: true });
   return lockfile.lock(lockTargetDir, {
-    lockfilePath: path10.join(lockTargetDir, lockName),
+    lockfilePath: path12.join(lockTargetDir, lockName),
     retries: { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true },
     stale: 3e4
   });
 }
 
 // dist/git-manager.js
-var log2 = createDebugLogger({ prefix: "GitManager" });
+var log3 = createDebugLogger({ prefix: "GitManager" });
 var remoteInitLocks = /* @__PURE__ */ new Map();
+async function ensureGitExcludePattern(repoPath, pattern) {
+  const excludePath = path13.join(repoPath, ".git", "info", "exclude");
+  await fs13.mkdir(path13.dirname(excludePath), { recursive: true });
+  let content = "";
+  try {
+    content = await fs13.readFile(excludePath, "utf-8");
+  } catch (err) {
+    if (!isNotFoundError(err))
+      throw err;
+  }
+  const lines = content.split("\n");
+  if (lines.some((line) => line.trim() === pattern)) {
+    log3.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    return;
+  }
+  const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
+  const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
+  await fs13.writeFile(excludePath, newContent, "utf-8");
+  log3.debug("git", "Added pattern to .git/info/exclude", { pattern });
+}
 var GitConflictError = class extends Error {
   constructor(conflictedFiles) {
     super(`Git conflict in ${conflictedFiles.length} file(s): ${conflictedFiles.join(", ")}`);
@@ -3435,21 +3804,22 @@ var GitConflictError = class extends Error {
 };
 var GitManager = class _GitManager {
   constructor(options, gitOptions) {
-    this.repoPath = path11.resolve(options.repoPath);
+    this.repoPath = path13.resolve(options.repoPath);
     this.baseBranch = options.baseBranch ?? "main";
     this.remote = options.remote ?? "origin";
+    this.skipIndexMarker = options.skipIndexMarker ?? false;
     this.git = simpleGit2({ baseDir: this.repoPath, ...gitOptions });
-    this.git.env("GIT_CEILING_DIRECTORIES", path11.dirname(this.repoPath));
+    this.git.env("GIT_CEILING_DIRECTORIES", path13.dirname(this.repoPath));
   }
   static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
-    log2.debug("git", "Cloning repository", {
+    log3.debug("git", "Cloning repository", {
       remoteUrl,
       targetPath,
       baseBranch
     });
     const git = simpleGit2();
     await git.clone(remoteUrl, targetPath, ["--branch", baseBranch, "--single-branch"]);
-    log2.debug("git", "Clone complete");
+    log3.debug("git", "Clone complete");
   }
   /**
    * Initializes a local bare git repository to simulate a remote for dev mode.
@@ -3469,30 +3839,30 @@ var GitManager = class _GitManager {
   static async ensureLocalSimulatedRemote(options) {
     const existingLock = remoteInitLocks.get(options.remotePath);
     if (existingLock) {
-      log2.debug("git", "Waiting for existing remote initialization", {
+      log3.debug("git", "Waiting for existing remote initialization", {
         remotePath: options.remotePath
       });
       await existingLock;
     }
-    const lockPromise = log2.timed("git", "ensureLocalSimulatedRemote", async () => {
+    const lockPromise = log3.timed("git", "ensureLocalSimulatedRemote", async () => {
       let releaseLock;
       try {
-        log2.debug("git", "Initializing local simulated remote", {
+        log3.debug("git", "Initializing local simulated remote", {
           remotePath: options.remotePath,
           baseBranch: options.baseBranch
         });
-        const remoteParent = path11.dirname(options.remotePath);
+        const remoteParent = path13.dirname(options.remotePath);
         releaseLock = await acquireProvisioningLock(remoteParent, ".remote-init.lock");
         let remoteExists = false;
         try {
-          const stat = await fs11.stat(options.remotePath);
+          const stat = await fs13.stat(options.remotePath);
           remoteExists = stat.isDirectory();
         } catch (err) {
           if (!isNotFoundError(err))
             throw err;
         }
         if (remoteExists && await _GitManager.bareRemoteHasBranch(options.remotePath, options.baseBranch)) {
-          log2.debug("git", "Remote already has base branch, skipping");
+          log3.debug("git", "Remote already has base branch, skipping");
           return;
         }
         let gitRoot = options.sourcePath;
@@ -3511,8 +3881,8 @@ var GitManager = class _GitManager {
         }
         let hasCommits = false;
         try {
-          const log4 = await sourceGit.log(["-1"]);
-          hasCommits = log4.total > 0;
+          const log6 = await sourceGit.log(["-1"]);
+          hasCommits = log6.total > 0;
         } catch {
           hasCommits = false;
         }
@@ -3524,12 +3894,12 @@ var GitManager = class _GitManager {
           throw new Error(`Cannot initialize local simulated remote: base branch '${options.baseBranch}' does not exist locally. Please checkout '${options.baseBranch}' first or provide an explicit remoteUrl.`);
         }
         if (remoteExists) {
-          log2.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
+          log3.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
             remotePath: options.remotePath,
             baseBranch: options.baseBranch
           });
         } else {
-          log2.debug("git", "Creating bare remote repository");
+          log3.debug("git", "Creating bare remote repository");
           await simpleGit2().raw([
             "init",
             "--bare",
@@ -3543,13 +3913,13 @@ var GitManager = class _GitManager {
           baseBranch: options.baseBranch,
           subdirectory: options.subdirectory
         });
-        log2.debug("git", "Remote initialization complete");
+        log3.debug("git", "Remote initialization complete");
       } finally {
         if (releaseLock) {
           try {
             await releaseLock();
           } catch (err) {
-            log2.debug("git", "Failed to release remote-init lock", { err });
+            log3.debug("git", "Failed to release remote-init lock", { err });
           }
         }
         remoteInitLocks.delete(options.remotePath);
@@ -3648,7 +4018,7 @@ var GitManager = class _GitManager {
    */
   static async validateGitRepoExists(repoPath) {
     try {
-      const stat = await fs11.stat(path11.join(repoPath, ".git"));
+      const stat = await fs13.stat(path13.join(repoPath, ".git"));
       if (!stat.isDirectory()) {
         throw new Error(`Expected git repo at ${repoPath}`);
       }
@@ -3686,9 +4056,9 @@ var GitManager = class _GitManager {
       return process.env[config.envVarName];
     if (config.autoDetectRemotePath) {
       try {
-        const stat = await fs11.stat(config.autoDetectRemotePath);
+        const stat = await fs13.stat(config.autoDetectRemotePath);
         if (stat.isDirectory()) {
-          log2.debug("git", "Auto-detected local remote", {
+          log3.debug("git", "Auto-detected local remote", {
             path: config.autoDetectRemotePath
           });
           return config.autoDetectRemotePath;
@@ -3699,8 +4069,8 @@ var GitManager = class _GitManager {
     if (config.shouldAutoInitLocal) {
       const gitRoot = await this.findGitRoot();
       const sourceRoot = options.sourceRoot;
-      const sourcePath = sourceRoot ? path11.resolve(gitRoot, sourceRoot) : gitRoot;
-      const localRemotePath = path11.join(sourcePath, config.defaultRemotePath);
+      const sourcePath = sourceRoot ? path13.resolve(gitRoot, sourceRoot) : gitRoot;
+      const localRemotePath = path13.join(sourcePath, config.defaultRemotePath);
       await this.ensureLocalSimulatedRemote({
         remotePath: localRemotePath,
         sourcePath: gitRoot,
@@ -3726,24 +4096,24 @@ var GitManager = class _GitManager {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: options.baseBranch,
       mode: options.mode,
-      detectFrom: options.sourceRoot ? path11.resolve(process.cwd(), options.sourceRoot) : process.cwd()
+      detectFrom: options.sourceRoot ? path13.resolve(process.cwd(), options.sourceRoot) : process.cwd()
     });
     const remoteName = options.remoteName ?? "origin";
     let repoExists = false;
     try {
       const checkGit = simpleGit2({ baseDir: options.workspacePath });
-      checkGit.env("GIT_CEILING_DIRECTORIES", path11.dirname(options.workspacePath));
+      checkGit.env("GIT_CEILING_DIRECTORIES", path13.dirname(options.workspacePath));
       await checkGit.raw(["rev-parse", "--git-dir"]);
       repoExists = true;
     } catch {
-      const gitPath = path11.join(options.workspacePath, ".git");
+      const gitPath = path13.join(options.workspacePath, ".git");
       try {
-        const stat = await fs11.stat(gitPath);
+        const stat = await fs13.stat(gitPath);
         if (stat.isDirectory()) {
-          log2.debug("git", "Removing corrupt .git directory", {
+          log3.debug("git", "Removing corrupt .git directory", {
             workspacePath: options.workspacePath
           });
-          await fs11.rm(gitPath, { recursive: true });
+          await fs13.rm(gitPath, { recursive: true });
         }
       } catch (cleanupErr) {
         if (!isNotFoundError(cleanupErr))
@@ -3769,7 +4139,7 @@ var GitManager = class _GitManager {
       }
       justCloned = true;
       const freshGit = simpleGit2({ baseDir: options.workspacePath });
-      freshGit.env("GIT_CEILING_DIRECTORIES", path11.dirname(options.workspacePath));
+      freshGit.env("GIT_CEILING_DIRECTORIES", path13.dirname(options.workspacePath));
       await freshGit.addConfig("canopycms.managed", "true");
       await freshGit.addConfig("user.name", options.gitBotAuthorName);
       await freshGit.addConfig("user.email", options.gitBotAuthorEmail);
@@ -3777,12 +4147,13 @@ var GitManager = class _GitManager {
     const git = new _GitManager({
       repoPath: options.workspacePath,
       baseBranch,
-      remote: remoteName
+      remote: remoteName,
+      skipIndexMarker: options.branchType === "orphan"
     });
     await git.git.addConfig("canopycms.managed", "true");
     await git.git.addConfig("user.name", options.gitBotAuthorName);
     await git.git.addConfig("user.email", options.gitBotAuthorEmail);
-    log2.debug("git", "Marked workspace as CanopyCMS-managed", {
+    log3.debug("git", "Marked workspace as CanopyCMS-managed", {
       workspacePath: options.workspacePath
     });
     if (!justCloned) {
@@ -3817,7 +4188,33 @@ var GitManager = class _GitManager {
       tracking: s.tracking
     };
   }
+  /**
+   * Mark ContentStore ID indexes rooted at (or under) this repo as stale.
+   * Called after operations that mutate the working tree (checkout/merge/rebase) so
+   * ID→path lookups don't keep resolving to pre-mutation paths. Invoked in `finally`
+   * blocks because even failed merges/rebases may have touched the tree before
+   * aborting; over-invalidating is safe.
+   *
+   * Covers both scopes: in-process stores via the registry, and stores in OTHER
+   * processes sharing the filesystem (worker vs Lambda on EFS) via the on-disk
+   * generation marker — unless this manager targets a settings workspace
+   * (skipIndexMarker), where only the free in-process invalidation runs.
+   */
+  async invalidateContentIndexes() {
+    if (this.skipIndexMarker) {
+      invalidateContentIndexesForRoot(this.repoPath);
+      return;
+    }
+    await invalidateContentIndexesDurable(this.repoPath);
+  }
   async checkoutBranch(branch) {
+    try {
+      await this.checkoutBranchInner(branch);
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async checkoutBranchInner(branch) {
     const branches = await this.git.branch();
     if (branches.all.includes(branch)) {
       await this.git.checkout(branch);
@@ -3841,6 +4238,13 @@ var GitManager = class _GitManager {
     }
   }
   async pullBase() {
+    try {
+      await this.pullBaseInner();
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async pullBaseInner() {
     await this.git.fetch(this.remote, this.baseBranch);
     try {
       await this.git.merge([`${this.remote}/${this.baseBranch}`]);
@@ -3861,6 +4265,13 @@ var GitManager = class _GitManager {
     }
   }
   async pullCurrentBranch() {
+    try {
+      await this.pullCurrentBranchInner();
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async pullCurrentBranchInner() {
     const branches = await this.git.branch();
     const currentBranch = branches.current;
     await this.git.fetch(this.remote, currentBranch);
@@ -3883,6 +4294,13 @@ var GitManager = class _GitManager {
     }
   }
   async rebaseOntoBase() {
+    try {
+      await this.rebaseOntoBaseInner();
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async rebaseOntoBaseInner() {
     await this.git.fetch(this.remote, this.baseBranch);
     try {
       await this.git.rebase([`${this.remote}/${this.baseBranch}`]);
@@ -3911,7 +4329,13 @@ var GitManager = class _GitManager {
   }
   async push(branch) {
     const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
-    await this.git.push(this.remote, `${target}:${target}`, ["--set-upstream"]);
+    await this.git.raw([
+      "push",
+      "--set-upstream",
+      "--end-of-options",
+      this.remote,
+      `${target}:${target}`
+    ]);
   }
   async ensureAuthor(author) {
     const config = await this.git.listConfig();
@@ -3965,7 +4389,7 @@ var GitManager = class _GitManager {
    */
   async forcePush(branch) {
     const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
-    await this.git.push(this.remote, target, ["--force-with-lease"]);
+    await this.git.raw(["push", "--force-with-lease", "--end-of-options", this.remote, target]);
   }
   /**
    * Get remote URL for current repo
@@ -3985,24 +4409,7 @@ var GitManager = class _GitManager {
    * This is idempotent - if the pattern already exists, it won't be added again.
    */
   async ensureGitExclude(pattern) {
-    const excludePath = path11.join(this.repoPath, ".git", "info", "exclude");
-    await fs11.mkdir(path11.dirname(excludePath), { recursive: true });
-    let content = "";
-    try {
-      content = await fs11.readFile(excludePath, "utf-8");
-    } catch (err) {
-      if (!isNotFoundError(err))
-        throw err;
-    }
-    const lines = content.split("\n");
-    if (lines.some((line) => line.trim() === pattern)) {
-      log2.debug("git", "Pattern already in .git/info/exclude", { pattern });
-      return;
-    }
-    const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
-    const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-    await fs11.writeFile(excludePath, newContent, "utf-8");
-    log2.debug("git", "Added pattern to .git/info/exclude", { pattern });
+    await ensureGitExcludePattern(this.repoPath, pattern);
   }
   /**
    * Create an orphan branch for settings (permissions/groups).
@@ -4010,16 +4417,24 @@ var GitManager = class _GitManager {
    * Orphan branches have no shared history with other branches - they start fresh.
    * This is perfect for deployment-specific settings that shouldn't pollute content history.
    *
-   * The branch contains only settings files in .canopy-meta/ (groups.json, permissions.json).
+   * The branch contains only settings files committed by explicit path
+   * (e.g. permissions.json, groups.json at the workspace root).
    *
    * @param branchName - Name of the orphan branch (e.g., 'canopycms-settings-prod')
    * @param initialFiles - Files to commit to the new branch (e.g., { 'permissions.json': '{}', 'groups.json': '{}' })
    */
   async createOrphanSettingsBranch(branchName, initialFiles) {
-    log2.debug("git", "Creating orphan settings branch", { branchName });
+    try {
+      await this.createOrphanSettingsBranchInner(branchName, initialFiles);
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
+  async createOrphanSettingsBranchInner(branchName, initialFiles) {
+    log3.debug("git", "Creating orphan settings branch", { branchName });
     const branches = await this.git.branch();
     if (branches.all.includes(branchName)) {
-      log2.debug("git", "Orphan branch already exists", { branchName });
+      log3.debug("git", "Orphan branch already exists", { branchName });
       await this.git.checkout(branchName);
       return;
     }
@@ -4029,25 +4444,25 @@ var GitManager = class _GitManager {
     } catch {
     }
     for (const [filePath, content] of Object.entries(initialFiles)) {
-      const absolutePath = path11.join(this.repoPath, filePath);
-      await fs11.mkdir(path11.dirname(absolutePath), { recursive: true });
-      await fs11.writeFile(absolutePath, content, "utf-8");
+      const absolutePath = path13.join(this.repoPath, filePath);
+      await fs13.mkdir(path13.dirname(absolutePath), { recursive: true });
+      await fs13.writeFile(absolutePath, content, "utf-8");
       await this.git.add(filePath);
     }
     await this.git.commit("Initialize settings branch", ["--allow-empty"]);
-    log2.debug("git", "Orphan settings branch created", { branchName });
+    log3.debug("git", "Orphan settings branch created", { branchName });
   }
 };
 
 // dist/branch-workspace.js
-var log3 = createDebugLogger({ prefix: "BranchWorkspace" });
+var log4 = createDebugLogger({ prefix: "BranchWorkspace" });
 var workspaceInitLocks = /* @__PURE__ */ new Map();
 var BranchWorkspaceManager = class {
   constructor(config) {
     this.config = config;
   }
   async ensureGitWorkspace(options) {
-    return log3.timed("workspace", "ensureGitWorkspace", async () => {
+    return log4.timed("workspace", "ensureGitWorkspace", async () => {
       const existingLock = workspaceInitLocks.get(options.branchRoot);
       if (existingLock) {
         await existingLock;
@@ -4056,11 +4471,11 @@ var BranchWorkspaceManager = class {
       const lockPromise = (async () => {
         let releaseLock;
         try {
-          log3.debug("workspace", "Ensuring git workspace", {
+          log4.debug("workspace", "Ensuring git workspace", {
             branchName: options.branchName,
             mode: options.mode
           });
-          releaseLock = await acquireProvisioningLock(path12.dirname(options.branchRoot), `.${path12.basename(options.branchRoot)}.init.lock`);
+          releaseLock = await acquireProvisioningLock(path14.dirname(options.branchRoot), `.${path14.basename(options.branchRoot)}.init.lock`);
           await GitManager.initializeWorkspace({
             workspacePath: options.branchRoot,
             branchName: options.branchName,
@@ -4080,7 +4495,7 @@ var BranchWorkspaceManager = class {
             try {
               await releaseLock();
             } catch (err) {
-              log3.debug("workspace", "Failed to release workspace-init lock", { err });
+              log4.debug("workspace", "Failed to release workspace-init lock", { err });
             }
           }
           workspaceInitLocks.delete(options.branchRoot);
@@ -4100,7 +4515,7 @@ var BranchWorkspaceManager = class {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: this.config.defaultBaseBranch,
       mode,
-      detectFrom: this.config.sourceRoot ? path12.resolve(process.cwd(), this.config.sourceRoot) : void 0
+      detectFrom: this.config.sourceRoot ? path14.resolve(process.cwd(), this.config.sourceRoot) : void 0
     });
     await this.ensureGitWorkspace({
       branchRoot,
@@ -4183,6 +4598,384 @@ async function resolveBranchRoot(config) {
   return context.branchRoot;
 }
 
+// dist/content-listing.js
+import fs14 from "node:fs/promises";
+import path15 from "node:path";
+import matter2 from "gray-matter";
+import { parse as yamlParse2 } from "yaml";
+var log5 = createDebugLogger({ prefix: "ContentListing" });
+var normalizePath = (root, target) => {
+  const result = validateAndNormalizePath(root, target);
+  if (!result.valid) {
+    throw new ContentStoreError(result.error || "Path traversal detected", "VALIDATION");
+  }
+  return result.normalizedPath;
+};
+var readEntryData = async (filePath, format, bodyFieldName = "body") => {
+  try {
+    const raw = await fs14.readFile(filePath, "utf8");
+    if (format === "json") {
+      return asRecord(JSON.parse(raw));
+    }
+    if (format === "yaml") {
+      return asRecord(yamlParse2(raw));
+    }
+    const parsed = matter2(raw);
+    const data = parsed.data ?? {};
+    if (parsed.content) {
+      data[bodyFieldName] = parsed.content;
+    }
+    return data;
+  } catch (err) {
+    if (isNotFoundError(err))
+      return {};
+    log5.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage(err)}`);
+    return {};
+  }
+};
+var parseTypedFilename = (filename, entryTypes) => {
+  const lastDot = filename.lastIndexOf(".");
+  if (lastDot === -1)
+    return null;
+  const nameWithoutExt = filename.slice(0, lastDot);
+  const parts = nameWithoutExt.split(".");
+  if (parts.length >= 3) {
+    const potentialType = parts[0];
+    const matchingType = entryTypes.find((e) => e.name === potentialType);
+    if (matchingType) {
+      const id = parts[parts.length - 1];
+      if (!isValidId(id))
+        return null;
+      const slug = parts.slice(1, -1).join(".").toLowerCase();
+      return {
+        type: potentialType,
+        slug,
+        id
+      };
+    }
+  }
+  return null;
+};
+async function listEntries(branchRoot, flatSchema, contentRootName, options) {
+  const rootPath = options?.rootPath ?? contentRootName;
+  const extract = options?.extract;
+  const filter = options?.filter;
+  const customSort = options?.sort;
+  const collections = flatSchema.filter((item) => item.type === "collection" && item.entries !== void 0 && (item.logicalPath === rootPath || item.logicalPath.startsWith(`${rootPath}/`)));
+  const collectionResults = await Promise.all(collections.map(async (collection) => {
+    const entries = await listCollectionEntries(branchRoot, collection);
+    return entries.map((entry) => ({ entry, collection }));
+  }));
+  const contentPrefix = contentRootName ? `${contentRootName}/` : "";
+  const items = [];
+  for (const results of collectionResults) {
+    for (const { entry, collection } of results) {
+      const pathWithoutRoot = entry.logicalPath.startsWith(contentPrefix) ? entry.logicalPath.slice(contentPrefix.length) : entry.logicalPath;
+      const pathSegments = pathWithoutRoot.split("/").filter(Boolean);
+      const urlSegments = entry.slug === "index" ? pathSegments.slice(0, -1) : pathSegments;
+      const urlPath = urlSegments.length > 0 ? `/${urlSegments.join("/")}`.toLowerCase() : "/";
+      const raw = entry.data;
+      const meta = {
+        entryPath: entry.logicalPath,
+        entryType: entry.entryType,
+        format: entry.format
+      };
+      const data = extract ? extract(raw, meta) : raw;
+      const item = {
+        pathSegments,
+        urlPath,
+        slug: entry.slug,
+        entryPath: entry.logicalPath,
+        entryId: entry.contentId,
+        collectionId: collection.contentId,
+        collectionPath: entry.collectionPath,
+        entryType: entry.entryType,
+        format: entry.format,
+        data,
+        schema: collection.entries?.find((e) => e.name === entry.entryType)?.schema
+      };
+      if (filter && !filter(item))
+        continue;
+      items.push(item);
+    }
+  }
+  if (customSort) {
+    items.sort(customSort);
+  } else {
+    items.sort((a, b) => a.entryPath.localeCompare(b.entryPath));
+  }
+  return items;
+}
+var listCollectionEntries = async (root, collection) => {
+  if (collection.type !== "collection" || !collection.entries) {
+    return [];
+  }
+  const entryTypes = collection.entries;
+  const extToTypes = /* @__PURE__ */ new Map();
+  for (const entryType of entryTypes) {
+    const ext = getFormatExtension(entryType.format);
+    const existing = extToTypes.get(ext) || [];
+    existing.push(entryType);
+    extToTypes.set(ext, existing);
+  }
+  const validExts = Array.from(extToTypes.keys());
+  const collectionRoot = await resolveCollectionPath(root, collection.logicalPath);
+  if (!collectionRoot) {
+    return [];
+  }
+  normalizePath(root, collectionRoot);
+  let dirents;
+  try {
+    dirents = await fs14.readdir(collectionRoot, { withFileTypes: true });
+  } catch (err) {
+    if (isNotFoundError(err))
+      return [];
+    throw err;
+  }
+  const files = dirents.filter((d) => d.isFile() && validExts.some((ext) => d.name.endsWith(ext)) && d.name !== ".collection.json").sort((a, b) => a.name.localeCompare(b.name));
+  const entries = await Promise.all(files.map(async (file) => {
+    const absolutePath = path15.join(collectionRoot, file.name);
+    const relativePath = normalizePath(root, absolutePath);
+    const parsed = parseTypedFilename(file.name, entryTypes);
+    if (!parsed) {
+      log5.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
+      return null;
+    }
+    const { type: entryTypeName, slug, id: contentId } = parsed;
+    const entryType = entryTypes.find((e) => e.name === entryTypeName);
+    const format = entryType?.format || "json";
+    const bodyField = entryType?.schema ? findBodyFieldName(entryType.schema) : "body";
+    const [stats, data] = await Promise.all([
+      fs14.stat(absolutePath),
+      readEntryData(absolutePath, format, bodyField)
+    ]);
+    const item = {
+      logicalPath: `${collection.logicalPath}/${slug}`,
+      contentId,
+      slug,
+      collectionPath: collection.logicalPath,
+      collectionName: collection.name,
+      format,
+      entryType: entryTypeName,
+      physicalPath: relativePath,
+      data,
+      updatedAt: stats.mtime.toISOString()
+    };
+    return item;
+  }));
+  return entries.filter((e) => e !== null);
+};
+
+// dist/validation/entry-validator.js
+init_config2();
+
+// dist/validation/field-traversal.js
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolveBlockItem(blockField, item) {
+  const templateName = typeof item.template === "string" ? item.template : typeof item._type === "string" ? item._type : void 0;
+  if (!templateName)
+    return void 0;
+  const template = blockField.templates?.find((t) => t.name === templateName);
+  if (!template?.fields)
+    return void 0;
+  const data = isPlainRecord(item.value) ? item.value : item;
+  return { fields: template.fields, data };
+}
+
+// dist/validation/entry-validator.js
+var KNOWN_FIELD_TYPES = new Set(fieldTypes);
+var STRING_FIELD_TYPES = /* @__PURE__ */ new Set(["string", "rich-text", "markdown", "mdx", "image", "code"]);
+function isPlainRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function referenceValueId(value) {
+  if (typeof value === "string")
+    return value;
+  if (isPlainRecord2(value) && typeof value.id === "string")
+    return value.id;
+  return void 0;
+}
+var selectOptionValues = (field) => (field.options ?? []).map((opt) => typeof opt === "string" ? opt : opt.value);
+function validateScalar(field, value, path18) {
+  switch (field.type) {
+    case "number":
+      if (typeof value !== "number" || !Number.isFinite(value)) {
+        return [{ fieldPath: path18, message: "Expected a number" }];
+      }
+      return [];
+    case "boolean":
+      if (typeof value !== "boolean") {
+        return [{ fieldPath: path18, message: "Expected true or false" }];
+      }
+      return [];
+    case "datetime":
+      if (typeof value !== "string" || value !== "" && Number.isNaN(Date.parse(value))) {
+        return [{ fieldPath: path18, message: "Expected a valid date/time string" }];
+      }
+      return [];
+    case "select": {
+      if (typeof value !== "string") {
+        return [{ fieldPath: path18, message: "Expected a selection" }];
+      }
+      const options = selectOptionValues(field);
+      if (value !== "" && !options.includes(value)) {
+        return [{ fieldPath: path18, message: `Must be one of: ${options.join(", ")}` }];
+      }
+      return [];
+    }
+    case "reference":
+      if (referenceValueId(value) === void 0) {
+        return [{ fieldPath: path18, message: "Expected a reference id" }];
+      }
+      return [];
+    default:
+      if (STRING_FIELD_TYPES.has(field.type)) {
+        if (typeof value !== "string") {
+          return [{ fieldPath: path18, message: "Expected text" }];
+        }
+      }
+      return [];
+  }
+}
+function isEmptyForRequired(field, value) {
+  if (value === void 0 || value === null)
+    return true;
+  if (Array.isArray(value))
+    return value.length === 0;
+  if (typeof value === "string") {
+    return value.trim() === "";
+  }
+  return false;
+}
+function validateEntryData(fields, data, pathPrefix = "") {
+  const errors = [];
+  for (const field of fields) {
+    if (field.type === "group") {
+      errors.push(...validateEntryData(field.fields, data, pathPrefix));
+      continue;
+    }
+    const path18 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
+    const value = data[field.name];
+    const isRequired = "required" in field && field.required === true;
+    if (isRequired && isEmptyForRequired(field, value)) {
+      const message = Array.isArray(value) ? "At least one item is required" : "This field is required";
+      errors.push({ fieldPath: path18, message });
+      continue;
+    }
+    if (value === void 0 || value === null)
+      continue;
+    if (field.type === "block") {
+      const blockField = field;
+      if (!Array.isArray(value)) {
+        errors.push({ fieldPath: path18, message: "Expected a list of blocks" });
+        continue;
+      }
+      value.forEach((item, index) => {
+        const itemPath = `${path18}[${index}]`;
+        if (!isPlainRecord2(item)) {
+          errors.push({ fieldPath: itemPath, message: "Expected a block object" });
+          return;
+        }
+        const resolved = resolveBlockItem(blockField, item);
+        if (!resolved) {
+          const template = typeof item.template === "string" ? item.template : void 0;
+          errors.push({
+            fieldPath: itemPath,
+            message: template ? `Unknown block template "${template}"` : "Missing block template"
+          });
+          return;
+        }
+        errors.push(...validateEntryData(resolved.fields, resolved.data, itemPath));
+      });
+      continue;
+    }
+    if (field.type === "object") {
+      const objectField = field;
+      if (objectField.list) {
+        if (!Array.isArray(value)) {
+          errors.push({ fieldPath: path18, message: "Expected a list of items" });
+          continue;
+        }
+        value.forEach((item, index) => {
+          const itemPath = `${path18}[${index}]`;
+          if (!isPlainRecord2(item)) {
+            errors.push({ fieldPath: itemPath, message: "Expected an object" });
+            return;
+          }
+          if (objectField.fields) {
+            errors.push(...validateEntryData(objectField.fields, item, itemPath));
+          }
+        });
+      } else if (!isPlainRecord2(value)) {
+        errors.push({ fieldPath: path18, message: "Expected an object" });
+      } else if (objectField.fields) {
+        errors.push(...validateEntryData(objectField.fields, value, path18));
+      }
+      continue;
+    }
+    if ("list" in field && field.list) {
+      if (!Array.isArray(value)) {
+        errors.push({ fieldPath: path18, message: "Expected a list of values" });
+        continue;
+      }
+      value.forEach((item, index) => {
+        errors.push(...validateScalar(field, item, `${path18}[${index}]`));
+      });
+      continue;
+    }
+    if (Array.isArray(value) && KNOWN_FIELD_TYPES.has(field.type)) {
+      errors.push({ fieldPath: path18, message: "Expected a single value, not a list" });
+      continue;
+    }
+    errors.push(...validateScalar(field, value, path18));
+  }
+  return errors;
+}
+
+// dist/static/index.js
+function normalizeDatesDeep(value) {
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Array.isArray(value))
+    return value.map(normalizeDatesDeep);
+  if (value && typeof value === "object") {
+    const result = {};
+    for (const [key, v] of Object.entries(value)) {
+      result[key] = normalizeDatesDeep(v);
+    }
+    return result;
+  }
+  return value;
+}
+function findInvalidEntries(items) {
+  const invalid = [];
+  for (const item of items) {
+    if (!item.schema)
+      continue;
+    const data = normalizeDatesDeep(item.data);
+    const errors = validateEntryData(item.schema, data);
+    if (errors.length > 0) {
+      invalid.push({ entryPath: item.entryPath, errors });
+    }
+  }
+  return invalid;
+}
+function assertBuildEntriesValid(items, phaseLabel) {
+  const invalid = findInvalidEntries(items);
+  if (invalid.length === 0)
+    return;
+  const lines = invalid.map(({ entryPath, errors }) => {
+    const [first, ...rest] = errors;
+    const summary = rest.length > 0 ? `${first.fieldPath}: ${first.message} (+${rest.length} more)` : `${first.fieldPath}: ${first.message}`;
+    return `  - ${entryPath} \u2014 ${summary}`;
+  });
+  throw new Error(`CanopyCMS static build: found ${invalid.length} schema-invalid ${invalid.length === 1 ? "entry" : "entries"} during ${phaseLabel}:
+${lines.join("\n")}
+These are likely abandoned create-scaffolds (empty entries left behind when a create was started but never finished). Finish editing the entry (fill in its required fields) or delete the abandoned draft, then rebuild.`);
+}
+
 // dist/build/generate-ai-content.js
 async function generateAIContentFiles(options) {
   const { config, entrySchemaRegistry, outputDir, aiConfig, _testFlatSchema } = options;
@@ -4196,6 +4989,8 @@ async function generateAIContentFiles(options) {
     const cached = await schemaCache.getSchema(branchRoot, entrySchemaRegistry, contentRootName);
     flatSchema = cached.flatSchema;
   }
+  const entriesForValidation = await listEntries(branchRoot, flatSchema, contentRootName);
+  assertBuildEntriesValid(entriesForValidation, "AI content generation");
   const store = new ContentStore(branchRoot, flatSchema);
   const result = await generateAIContent({
     store,
@@ -4204,15 +4999,15 @@ async function generateAIContentFiles(options) {
     config: aiConfig,
     entryLinkUrl: config.entryLinkUrl
   });
-  const absoluteOutputDir = path13.resolve(outputDir) + path13.sep;
+  const absoluteOutputDir = path16.resolve(outputDir) + path16.sep;
   let fileCount = 0;
   for (const [filePath, content] of result.files) {
-    const absolutePath = path13.resolve(path13.join(absoluteOutputDir, filePath));
+    const absolutePath = path16.resolve(path16.join(absoluteOutputDir, filePath));
     if (!absolutePath.startsWith(absoluteOutputDir)) {
       throw new Error(`Path traversal detected in AI content output: ${filePath}`);
     }
-    await fs12.mkdir(path13.dirname(absolutePath), { recursive: true });
-    await fs12.writeFile(absolutePath, content, "utf-8");
+    await fs15.mkdir(path16.dirname(absolutePath), { recursive: true });
+    await fs15.writeFile(absolutePath, content, "utf-8");
     fileCount++;
   }
   return { fileCount, outputDir: absoluteOutputDir };
@@ -4223,7 +5018,7 @@ var jiti = createJiti(import.meta.url);
 async function generateAIContentCLI(options) {
   const { projectDir, outputDir = "public/ai", configPath, appDir = "app" } = options;
   console.log("\nCanopyCMS generate-ai-content\n");
-  const canopyConfigPath = path14.join(projectDir, "canopycms.config.ts");
+  const canopyConfigPath = path17.join(projectDir, "canopycms.config.ts");
   let canopyConfigModule;
   try {
     canopyConfigModule = await jiti.import(canopyConfigPath);
@@ -4234,7 +5029,7 @@ async function generateAIContentCLI(options) {
   }
   const configExport = canopyConfigModule.default ?? canopyConfigModule.config ?? canopyConfigModule;
   const serverConfig = typeof configExport === "object" && configExport !== null && "server" in configExport ? configExport.server : configExport;
-  const schemasPath = path14.join(projectDir, appDir, "schemas.ts");
+  const schemasPath = path17.join(projectDir, appDir, "schemas.ts");
   let entrySchemaRegistry = {};
   try {
     const schemasModule = await jiti.import(schemasPath);
@@ -4245,7 +5040,7 @@ async function generateAIContentCLI(options) {
   let aiConfig;
   if (configPath) {
     try {
-      const aiConfigModule = await jiti.import(path14.resolve(configPath));
+      const aiConfigModule = await jiti.import(path17.resolve(configPath));
       aiConfig = aiConfigModule.aiContentConfig ?? aiConfigModule.default ?? aiConfigModule.config;
     } catch (err) {
       console.error(`Could not load AI config from ${configPath}`);
@@ -4262,7 +5057,7 @@ async function generateAIContentCLI(options) {
     console.error("Make sure canopycms.config.ts uses defineCanopyConfig().");
     process.exit(1);
   }
-  const resolvedOutput = path14.resolve(projectDir, outputDir);
+  const resolvedOutput = path17.resolve(projectDir, outputDir);
   console.log(`  Output: ${resolvedOutput}`);
   console.log(`  Mode: ${serverConfig.mode ?? "dev"}`);
   const result = await generateAIContentFiles({