canopycms 0.0.55 → 0.0.57

package/dist/cli/generate-ai-content.js

@@ -9,11 +9,11 @@ var __export = (target, all) => {
 };
 
 // dist/paths/normalize.js
-function normalizeFilesystemPath(path17) {
-  return path17.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path19) {
+  return path19.split(/[\\/]+/).filter(Boolean).join("/");
 }
-function hasTraversalSequence(path17) {
-  const normalized = normalizeFilesystemPath(path17);
+function hasTraversalSequence(path19) {
+  const normalized = normalizeFilesystemPath(path19);
   return normalized.includes("..");
 }
 function createLogicalPath(...segments) {
@@ -23,14 +23,14 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
-function trimSlashes(path17) {
+function trimSlashes(path19) {
   let start = 0;
-  let end = path17.length;
-  while (start < end && path17[start] === "/")
+  let end = path19.length;
+  while (start < end && path19[start] === "/")
     start++;
-  while (end > start && path17[end - 1] === "/")
+  while (end > start && path19[end - 1] === "/")
     end--;
-  return path17.slice(start, end);
+  return path19.slice(start, end);
 }
 var init_normalize = __esm({
   "dist/paths/normalize.js"() {
@@ -38,6 +38,118 @@ var init_normalize = __esm({
   }
 });
 
+// dist/paths/types.js
+var ROOT_COLLECTION_ID;
+var init_types = __esm({
+  "dist/paths/types.js"() {
+    "use strict";
+    ROOT_COLLECTION_ID = "__rootcoll__";
+  }
+});
+
+// dist/config/flatten.js
+import { join as join2, normalize } from "pathe";
+var normalizePathValue, flattenSchema;
+var init_flatten = __esm({
+  "dist/config/flatten.js"() {
+    "use strict";
+    init_normalize();
+    init_types();
+    normalizePathValue = (val) => normalize(val).split("/").filter(Boolean).join("/");
+    flattenSchema = (root, basePath = "") => {
+      const flat = [];
+      const base = normalizePathValue(basePath || "");
+      const walkCollection = (collection, parentPath) => {
+        const normalizedPath = normalizePathValue(collection.path);
+        let logicalPath;
+        if (base) {
+          logicalPath = join2(base, normalizedPath);
+        } else {
+          logicalPath = normalizedPath;
+        }
+        const normalizedFull = normalizePathValue(logicalPath);
+        flat.push({
+          type: "collection",
+          logicalPath: createLogicalPath(normalizedFull),
+          name: collection.name,
+          label: collection.label,
+          description: collection.description,
+          contentId: collection.contentId,
+          parentPath: parentPath ? createLogicalPath(parentPath) : void 0,
+          entries: collection.entries,
+          collections: collection.collections,
+          order: collection.order
+        });
+        if (collection.entries) {
+          for (const entryType of collection.entries) {
+            const entryTypePath = join2(normalizedFull, entryType.name);
+            flat.push({
+              type: "entry-type",
+              logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
+              name: entryType.name,
+              label: entryType.label,
+              description: entryType.description,
+              parentPath: createLogicalPath(normalizedFull),
+              format: entryType.format,
+              schema: entryType.schema,
+              schemaRef: entryType.schemaRef,
+              default: entryType.default,
+              maxItems: entryType.maxItems
+            });
+          }
+        }
+        if (collection.collections) {
+          for (const child of collection.collections) {
+            walkCollection(child, normalizedFull);
+          }
+        }
+      };
+      if (base) {
+        flat.push({
+          type: "collection",
+          logicalPath: createLogicalPath(base),
+          name: base,
+          // Use base path as the name (e.g., 'content')
+          label: void 0,
+          // Root collection has no label
+          contentId: ROOT_COLLECTION_ID,
+          // Sentinel — root dir has no embedded ID
+          parentPath: void 0,
+          // No parent - this is the root
+          entries: root.entries,
+          collections: root.collections,
+          order: root.order
+        });
+      }
+      if (root.entries) {
+        for (const entryType of root.entries) {
+          const entryTypePath = base ? join2(base, entryType.name) : entryType.name;
+          flat.push({
+            type: "entry-type",
+            logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
+            name: entryType.name,
+            label: entryType.label,
+            description: entryType.description,
+            parentPath: base ? createLogicalPath(base) : createLogicalPath(""),
+            // Now references the root collection (e.g., 'content')
+            format: entryType.format,
+            schema: entryType.schema,
+            schemaRef: entryType.schemaRef,
+            default: entryType.default,
+            maxItems: entryType.maxItems
+          });
+        }
+      }
+      if (root.collections) {
+        for (const collection of root.collections) {
+          walkCollection(collection, base || "");
+        }
+      }
+      return flat;
+    };
+  }
+});
+
 // dist/operating-mode/client-safe-strategy.js
 function clientOperatingStrategy(mode) {
   const cached = clientStrategyCache.get(mode);
@@ -134,7 +246,7 @@ var init_client_safe_strategy = __esm({
 
 // dist/config/types.js
 var primitiveFieldTypes, fieldTypes;
-var init_types = __esm({
+var init_types2 = __esm({
   "dist/config/types.js"() {
     "use strict";
     primitiveFieldTypes = [
@@ -160,77 +272,77 @@ var init_types = __esm({
 });
 
 // dist/config/schemas/field.js
-import { z } from "zod";
+import { z as z2 } from "zod";
 var fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema;
 var init_field = __esm({
   "dist/config/schemas/field.js"() {
     "use strict";
-    init_types();
-    fieldBaseSchema = z.object({
-      name: z.string().min(1),
-      label: z.string().optional(),
-      description: z.string().optional(),
-      required: z.boolean().optional(),
-      list: z.boolean().optional(),
-      isTitle: z.boolean().optional(),
-      isBody: z.boolean().optional()
+    init_types2();
+    fieldBaseSchema = z2.object({
+      name: z2.string().min(1),
+      label: z2.string().optional(),
+      description: z2.string().optional(),
+      required: z2.boolean().optional(),
+      list: z2.boolean().optional(),
+      isTitle: z2.boolean().optional(),
+      isBody: z2.boolean().optional()
     });
-    selectOptionSchema = z.union([
-      z.string(),
-      z.object({
-        label: z.string().min(1),
-        value: z.string().min(1)
+    selectOptionSchema = z2.union([
+      z2.string(),
+      z2.object({
+        label: z2.string().min(1),
+        value: z2.string().min(1)
       })
     ]);
-    referenceOptionSchema = z.union([
-      z.string(),
-      z.object({
-        label: z.string().min(1),
-        value: z.string().min(1)
+    referenceOptionSchema = z2.union([
+      z2.string(),
+      z2.object({
+        label: z2.string().min(1),
+        value: z2.string().min(1)
       })
     ]);
     primitiveFieldSchema = fieldBaseSchema.extend({
-      type: z.enum(primitiveFieldTypes)
+      type: z2.enum(primitiveFieldTypes)
     });
     selectFieldSchema = fieldBaseSchema.extend({
-      type: z.literal("select"),
-      options: z.array(selectOptionSchema).min(1)
+      type: z2.literal("select"),
+      options: z2.array(selectOptionSchema).min(1)
     });
     referenceFieldSchema = fieldBaseSchema.extend({
-      type: z.literal("reference"),
-      collections: z.array(z.string().min(1)).min(1).optional(),
-      entryTypes: z.array(z.string().min(1)).min(1).optional(),
-      displayField: z.string().min(1).optional(),
-      options: z.array(referenceOptionSchema).optional()
+      type: z2.literal("reference"),
+      collections: z2.array(z2.string().min(1)).min(1).optional(),
+      entryTypes: z2.array(z2.string().min(1)).min(1).optional(),
+      displayField: z2.string().min(1).optional(),
+      options: z2.array(referenceOptionSchema).optional()
     });
-    fieldHolder = [z.never()];
-    blockSchema = z.object({
-      name: z.string().min(1),
-      label: z.string().optional(),
-      description: z.string().optional(),
-      fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+    fieldHolder = [z2.never()];
+    blockSchema = z2.object({
+      name: z2.string().min(1),
+      label: z2.string().optional(),
+      description: z2.string().optional(),
+      fields: z2.array(z2.lazy(() => fieldHolder[0])).min(1)
     });
     blockFieldSchema = fieldBaseSchema.extend({
-      type: z.literal("block"),
-      templates: z.array(blockSchema).min(1)
+      type: z2.literal("block"),
+      templates: z2.array(blockSchema).min(1)
     });
     objectFieldSchema = fieldBaseSchema.extend({
-      type: z.literal("object"),
-      fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+      type: z2.literal("object"),
+      fields: z2.array(z2.lazy(() => fieldHolder[0])).min(1)
     });
-    inlineGroupFieldSchema = z.object({
-      type: z.literal("group"),
-      name: z.string().min(1),
-      label: z.string().optional(),
-      description: z.string().optional(),
-      fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+    inlineGroupFieldSchema = z2.object({
+      type: z2.literal("group"),
+      name: z2.string().min(1),
+      label: z2.string().optional(),
+      description: z2.string().optional(),
+      fields: z2.array(z2.lazy(() => fieldHolder[0])).min(1)
     });
-    customFieldSchema = z.lazy(() => fieldBaseSchema.extend({
-      type: z.string().min(1).refine((val) => !fieldTypes.includes(val), {
+    customFieldSchema = z2.lazy(() => fieldBaseSchema.extend({
+      type: z2.string().min(1).refine((val) => !fieldTypes.includes(val), {
         message: "Custom field types must not conflict with built-in types"
       })
     }).passthrough());
-    knownFieldSchema = z.discriminatedUnion("type", [
+    knownFieldSchema = z2.discriminatedUnion("type", [
       primitiveFieldSchema,
       selectFieldSchema,
       referenceFieldSchema,
@@ -238,39 +350,39 @@ var init_field = __esm({
       blockFieldSchema,
       inlineGroupFieldSchema
     ]);
-    fieldSchema = z.lazy(() => z.union([knownFieldSchema, customFieldSchema]));
+    fieldSchema = z2.lazy(() => z2.union([knownFieldSchema, customFieldSchema]));
     fieldHolder[0] = fieldSchema;
   }
 });
 
 // dist/config/schemas/collection.js
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 import { isAbsolute } from "pathe";
 var relativePathSchema, entryTypeSchema, collectionSchema;
 var init_collection = __esm({
   "dist/config/schemas/collection.js"() {
     "use strict";
     init_field();
-    relativePathSchema = z2.string().min(1).refine((val) => !isAbsolute(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
+    relativePathSchema = z3.string().min(1).refine((val) => !isAbsolute(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
       message: 'Path must not contain ".."'
     }).transform((val) => val.split(/[\\/]+/).filter(Boolean).join("/"));
-    entryTypeSchema = z2.object({
-      name: z2.string().min(1),
-      format: z2.enum(["md", "mdx", "json", "yaml"]),
-      schema: z2.array(z2.lazy(() => fieldSchema)).min(1),
-      label: z2.string().optional(),
-      description: z2.string().optional(),
-      default: z2.boolean().optional(),
-      maxItems: z2.number().int().positive().optional()
+    entryTypeSchema = z3.object({
+      name: z3.string().min(1),
+      format: z3.enum(["md", "mdx", "json", "yaml"]),
+      schema: z3.array(z3.lazy(() => fieldSchema)).min(1),
+      label: z3.string().optional(),
+      description: z3.string().optional(),
+      default: z3.boolean().optional(),
+      maxItems: z3.number().int().positive().optional()
     });
-    collectionSchema = z2.lazy(() => z2.object({
-      name: z2.string().min(1),
+    collectionSchema = z3.lazy(() => z3.object({
+      name: z3.string().min(1),
       path: relativePathSchema,
-      label: z2.string().optional(),
-      description: z2.string().optional(),
-      entries: z2.array(entryTypeSchema).optional(),
-      collections: z2.array(collectionSchema).optional(),
-      order: z2.array(z2.string()).optional()
+      label: z3.string().optional(),
+      description: z3.string().optional(),
+      entries: z3.array(entryTypeSchema).optional(),
+      collections: z3.array(collectionSchema).optional(),
+      order: z3.array(z3.string()).optional()
       // Embedded IDs for ordering items
     }).refine((data) => data.entries || data.collections, {
       message: "Collection must have entries or collections"
@@ -279,67 +391,67 @@ var init_collection = __esm({
 });
 
 // dist/config/schemas/media.js
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var mediaSchema;
 var init_media = __esm({
   "dist/config/schemas/media.js"() {
     "use strict";
-    mediaSchema = z3.discriminatedUnion("adapter", [
-      z3.object({
-        adapter: z3.literal("local"),
-        publicBaseUrl: z3.string().url().optional()
+    mediaSchema = z4.discriminatedUnion("adapter", [
+      z4.object({
+        adapter: z4.literal("local"),
+        publicBaseUrl: z4.string().url().optional()
       }),
-      z3.object({
-        adapter: z3.literal("s3"),
-        bucket: z3.string().min(1),
-        region: z3.string().min(1),
-        publicBaseUrl: z3.string().url().optional()
+      z4.object({
+        adapter: z4.literal("s3"),
+        bucket: z4.string().min(1),
+        region: z4.string().min(1),
+        publicBaseUrl: z4.string().url().optional()
       }),
-      z3.object({
-        adapter: z3.literal("lfs"),
-        publicBaseUrl: z3.string().url().optional()
+      z4.object({
+        adapter: z4.literal("lfs"),
+        publicBaseUrl: z4.string().url().optional()
       })
     ]);
   }
 });
 
 // dist/config/schemas/config.js
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var defaultBranchAccessSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE;
 var init_config = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection();
     init_media();
-    defaultBranchAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-    defaultBaseBranchSchema = z4.string().default("main");
-    defaultRemoteNameSchema = z4.string().default("origin");
-    defaultRemoteUrlSchema = z4.string().min(1);
-    gitBotAuthorNameSchema = z4.string().min(1);
-    gitBotAuthorEmailSchema = z4.string().email();
-    githubTokenEnvVarSchema = z4.string().default("GITHUB_BOT_TOKEN");
-    operatingModeSchema = z4.enum(["prod", "dev"]).default("dev");
-    deployedAsSchema = z4.enum(["static", "server"]).default("server");
+    defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessSchema = z5.enum(["allow", "deny"]).default("deny");
+    defaultBaseBranchSchema = z5.string().default("main");
+    defaultRemoteNameSchema = z5.string().default("origin");
+    defaultRemoteUrlSchema = z5.string().min(1);
+    gitBotAuthorNameSchema = z5.string().min(1);
+    gitBotAuthorEmailSchema = z5.string().email();
+    githubTokenEnvVarSchema = z5.string().default("GITHUB_BOT_TOKEN");
+    operatingModeSchema = z5.enum(["prod", "dev"]);
+    deployedAsSchema = z5.enum(["static", "server"]).default("server");
     contentRootSchema = relativePathSchema.default("content");
-    sourceRootSchema = z4.string().min(1).optional();
-    deploymentNameSchema = z4.string().default("prod");
-    devContentSyncSchema = z4.enum(["off", "warn"]).default("warn");
-    devConfigSchema = z4.object({
+    sourceRootSchema = z5.string().min(1).optional();
+    deploymentNameSchema = z5.string().default("prod");
+    devContentSyncSchema = z5.enum(["off", "warn"]).default("warn");
+    devConfigSchema = z5.object({
       contentSync: devContentSyncSchema.optional()
     });
-    editorConfigSchema = z4.object({
-      title: z4.string().optional(),
-      subtitle: z4.string().optional(),
-      theme: z4.unknown().optional(),
-      previewBase: z4.record(z4.string()).optional(),
+    editorConfigSchema = z5.object({
+      title: z5.string().optional(),
+      subtitle: z5.string().optional(),
+      theme: z5.unknown().optional(),
+      previewBase: z5.record(z5.string()).optional(),
       // UI handler functions (runtime only, don't serialize)
-      onAccountClick: z4.function().returns(z4.void()).optional(),
-      onLogoutClick: z4.function().returns(z4.void()).optional(),
+      onAccountClick: z5.function().returns(z5.void()).optional(),
+      onLogoutClick: z5.function().returns(z5.void()).optional(),
       // Optional: custom account component (e.g., Clerk's UserButton)
-      AccountComponent: z4.custom().optional()
+      AccountComponent: z5.custom().optional()
     });
-    CanopyConfigSchema = z4.object({
+    CanopyConfigSchema = z5.object({
       media: mediaSchema.optional(),
       // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
       // have .default('deny'), so the field is optional on input but always resolves to
@@ -351,25 +463,26 @@ var init_config = __esm({
       // unset must stay undefined after parsing so dev mode can detect the fork
       // point from git HEAD (see resolveBaseBranch in utils/git.ts).
       defaultBaseBranch: defaultBaseBranchSchema.optional(),
-      defaultActiveBranch: z4.string().min(1).optional(),
+      defaultActiveBranch: z5.string().min(1).optional(),
       defaultRemoteName: defaultRemoteNameSchema.optional(),
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
       gitBotAuthorEmail: gitBotAuthorEmailSchema,
       githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
+      // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
+      // validation loudly rather than silently running header-trusting dev auth semantics.
       mode: operatingModeSchema,
-      // Has .default(), so not optional in output type
       deployedAs: deployedAsSchema,
       // Has .default('server'), so always present after validation
-      settingsBranch: z4.string().optional(),
-      autoCreateSettingsPR: z4.boolean().optional(),
+      settingsBranch: z5.string().optional(),
+      autoCreateSettingsPR: z5.boolean().optional(),
       deploymentName: deploymentNameSchema.optional(),
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
       editor: editorConfigSchema.optional(),
-      authPlugin: z4.custom().optional(),
-      entryLinkUrl: z4.custom().optional(),
-      validateEntry: z4.custom().optional(),
+      authPlugin: z5.custom().optional(),
+      entryLinkUrl: z5.custom().optional(),
+      validateEntry: z5.custom().optional(),
       dev: devConfigSchema.optional()
     }).strict();
     DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
@@ -377,17 +490,17 @@ var init_config = __esm({
 });
 
 // dist/config/schemas/permissions.js
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 var permissionTargetSchema, pathPermissionSchema;
 var init_permissions = __esm({
   "dist/config/schemas/permissions.js"() {
     "use strict";
-    permissionTargetSchema = z5.object({
-      allowedUsers: z5.array(z5.string()).optional(),
-      allowedGroups: z5.array(z5.string()).optional()
+    permissionTargetSchema = z6.object({
+      allowedUsers: z6.array(z6.string()).optional(),
+      allowedGroups: z6.array(z6.string()).optional()
     });
-    pathPermissionSchema = z5.object({
-      path: z5.string().min(1),
+    pathPermissionSchema = z6.object({
+      path: z6.string().min(1),
       read: permissionTargetSchema.optional(),
       edit: permissionTargetSchema.optional(),
       review: permissionTargetSchema.optional()
@@ -395,118 +508,6 @@ var init_permissions = __esm({
   }
 });
 
-// dist/paths/types.js
-var ROOT_COLLECTION_ID;
-var init_types2 = __esm({
-  "dist/paths/types.js"() {
-    "use strict";
-    ROOT_COLLECTION_ID = "__rootcoll__";
-  }
-});
-
-// dist/config/flatten.js
-import { join, normalize } from "pathe";
-var normalizePathValue, flattenSchema;
-var init_flatten = __esm({
-  "dist/config/flatten.js"() {
-    "use strict";
-    init_normalize();
-    init_types2();
-    normalizePathValue = (val) => normalize(val).split("/").filter(Boolean).join("/");
-    flattenSchema = (root, basePath = "") => {
-      const flat = [];
-      const base = normalizePathValue(basePath || "");
-      const walkCollection = (collection, parentPath) => {
-        const normalizedPath = normalizePathValue(collection.path);
-        let logicalPath;
-        if (base) {
-          logicalPath = join(base, normalizedPath);
-        } else {
-          logicalPath = normalizedPath;
-        }
-        const normalizedFull = normalizePathValue(logicalPath);
-        flat.push({
-          type: "collection",
-          logicalPath: createLogicalPath(normalizedFull),
-          name: collection.name,
-          label: collection.label,
-          description: collection.description,
-          contentId: collection.contentId,
-          parentPath: parentPath ? createLogicalPath(parentPath) : void 0,
-          entries: collection.entries,
-          collections: collection.collections,
-          order: collection.order
-        });
-        if (collection.entries) {
-          for (const entryType of collection.entries) {
-            const entryTypePath = join(normalizedFull, entryType.name);
-            flat.push({
-              type: "entry-type",
-              logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
-              name: entryType.name,
-              label: entryType.label,
-              description: entryType.description,
-              parentPath: createLogicalPath(normalizedFull),
-              format: entryType.format,
-              schema: entryType.schema,
-              schemaRef: entryType.schemaRef,
-              default: entryType.default,
-              maxItems: entryType.maxItems
-            });
-          }
-        }
-        if (collection.collections) {
-          for (const child of collection.collections) {
-            walkCollection(child, normalizedFull);
-          }
-        }
-      };
-      if (base) {
-        flat.push({
-          type: "collection",
-          logicalPath: createLogicalPath(base),
-          name: base,
-          // Use base path as the name (e.g., 'content')
-          label: void 0,
-          // Root collection has no label
-          contentId: ROOT_COLLECTION_ID,
-          // Sentinel — root dir has no embedded ID
-          parentPath: void 0,
-          // No parent - this is the root
-          entries: root.entries,
-          collections: root.collections,
-          order: root.order
-        });
-      }
-      if (root.entries) {
-        for (const entryType of root.entries) {
-          const entryTypePath = base ? join(base, entryType.name) : entryType.name;
-          flat.push({
-            type: "entry-type",
-            logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
-            name: entryType.name,
-            label: entryType.label,
-            description: entryType.description,
-            parentPath: base ? createLogicalPath(base) : createLogicalPath(""),
-            // Now references the root collection (e.g., 'content')
-            format: entryType.format,
-            schema: entryType.schema,
-            schemaRef: entryType.schemaRef,
-            default: entryType.default,
-            maxItems: entryType.maxItems
-          });
-        }
-      }
-      if (root.collections) {
-        for (const collection of root.collections) {
-          walkCollection(collection, base || "");
-        }
-      }
-      return flat;
-    };
-  }
-});
-
 // dist/config/validation.js
 var init_validation = __esm({
   "dist/config/validation.js"() {
@@ -528,7 +529,7 @@ var init_helpers = __esm({
 var init_config2 = __esm({
   "dist/config/index.js"() {
     "use strict";
-    init_types();
+    init_types2();
     init_config();
     init_field();
     init_collection();
@@ -541,7 +542,7 @@ var init_config2 = __esm({
 });
 
 // dist/operating-mode/client-unsafe-strategy.js
-import path5 from "node:path";
+import path6 from "node:path";
 function operatingStrategy(mode) {
   const cached = strategyCache.get(mode);
   if (cached)
@@ -578,32 +579,32 @@ var init_client_unsafe_strategy = __esm({
       // - shouldCommit(), shouldPush()
       // Add client-unsafe methods (use Node.js APIs)
       getWorkspaceRoot(_sourceRoot) {
-        return path5.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
+        return path6.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
       }
       getContentRoot(sourceRoot) {
-        return path5.resolve(sourceRoot ?? process.cwd(), "content");
+        return path6.resolve(sourceRoot ?? process.cwd(), "content");
       }
       getContentBranchesRoot(sourceRoot) {
-        return path5.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path6.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path5.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path6.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path5.join(root, this.getPermissionsFileName());
+        return path6.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path5.join(root, this.getGroupsFileName());
+        return path6.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
           shouldAutoInitLocal: false,
           defaultRemotePath: "",
           envVarName: "CANOPYCMS_REMOTE_URL",
-          autoDetectRemotePath: path5.join(this.getWorkspaceRoot(), "remote.git")
+          autoDetectRemotePath: path6.join(this.getWorkspaceRoot(), "remote.git")
         };
       }
       requiresExistingRepo() {
@@ -616,7 +617,7 @@ var init_client_unsafe_strategy = __esm({
         return `canopycms-settings-${deploymentName}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path5.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path6.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -633,25 +634,25 @@ var init_client_unsafe_strategy = __esm({
     DevStrategy = class extends DevClientSafeStrategy {
       // Inherits client-safe methods from DevClientSafeStrategy
       getWorkspaceRoot(sourceRoot) {
-        return path5.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
+        return path6.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
       getContentRoot(sourceRoot) {
-        return path5.resolve(sourceRoot ?? process.cwd(), "content");
+        return path6.resolve(sourceRoot ?? process.cwd(), "content");
       }
       getContentBranchesRoot(sourceRoot) {
-        return path5.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path6.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path5.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path6.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path5.join(root, this.getPermissionsFileName());
+        return path6.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path5.join(root, this.getGroupsFileName());
+        return path6.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
@@ -670,7 +671,7 @@ var init_client_unsafe_strategy = __esm({
         return `canopycms-settings-${deploymentName}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path5.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path6.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -702,16 +703,16 @@ var init_operating_mode = __esm({
 });
 
 // dist/cli/generate-ai-content.js
-import path16 from "node:path";
+import path18 from "node:path";
 import { createJiti } from "jiti";
 
 // dist/build/generate-ai-content.js
-import fs14 from "node:fs/promises";
-import path15 from "node:path";
+import fs16 from "node:fs/promises";
+import path17 from "node:path";
 
 // dist/content-store.js
-import fs6 from "node:fs/promises";
-import path7 from "node:path";
+import fs8 from "node:fs/promises";
+import path8 from "node:path";
 import matter from "gray-matter";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 
@@ -736,16 +737,16 @@ async function atomicWriteFile(filePath, content) {
 var locks = /* @__PURE__ */ new Map();
 async function withLock(key, fn) {
   const prev = locks.get(key) ?? Promise.resolve();
-  let resolve;
+  let resolve2;
   const next = new Promise((r) => {
-    resolve = r;
+    resolve2 = r;
   });
   locks.set(key, next);
   await prev;
   try {
     return await fn();
   } finally {
-    resolve();
+    resolve2();
     if (locks.get(key) === next)
       locks.delete(key);
   }
@@ -1076,13 +1077,13 @@ function extractIdFromFilename(filename) {
   return null;
 }
 async function resolveCollectionPath(root, logicalPath) {
-  const fs15 = await import("node:fs/promises");
-  const path17 = await import("node:path");
+  const fs17 = await import("node:fs/promises");
+  const path19 = await import("node:path");
   const segments = logicalPath.split("/").filter(Boolean);
   let currentPath = root;
   for (const segment of segments) {
     try {
-      const entries = await fs15.readdir(currentPath, { withFileTypes: true });
+      const entries = await fs17.readdir(currentPath, { withFileTypes: true });
       const matchingDir = entries.find((entry) => {
         if (!entry.isDirectory())
           return false;
@@ -1090,7 +1091,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return logicalName === segment.toLowerCase();
       });
       if (matchingDir) {
-        currentPath = path17.join(currentPath, matchingDir.name);
+        currentPath = path19.join(currentPath, matchingDir.name);
       } else {
         return null;
       }
@@ -1181,7 +1182,7 @@ function invalidateContentIndexesForRoot(root) {
   }
 }
 
-// dist/content-index-generation.js
+// dist/resource-generation.js
 import fs3 from "node:fs/promises";
 import path4 from "node:path";
 import { randomUUID } from "node:crypto";
@@ -1277,1237 +1278,1472 @@ var testLogger = createDebugLogger({
   throwOnError: false
 });
 
-// dist/content-index-generation.js
-var log = createDebugLogger({ prefix: "ContentIndex" });
+// dist/resource-generation.js
+var log = createDebugLogger({ prefix: "ResourceGeneration" });
 var META_DIR = ".canopy-meta";
-var GENERATION_FILE = "content-index.generation";
-function contentIndexGenerationPath(root) {
-  return path4.join(path4.resolve(root), META_DIR, GENERATION_FILE);
+function resourceGenerationPath(root, resource) {
+  return path4.resolve(root, META_DIR, `${resource}.generation`);
 }
-async function bumpContentIndexGeneration(root) {
+async function bumpResourceGeneration(root, resource, options) {
   const token = randomUUID();
   try {
-    await atomicWriteFile(contentIndexGenerationPath(root), token);
+    await atomicWriteFile(resourceGenerationPath(root, resource), token);
     return token;
   } catch (err) {
-    log.warn("generation", `Failed to bump content index generation for ${root}`, {
+    log.warn("generation", `Failed to bump ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
+    if (options?.mustSucceed)
+      throw err;
     return null;
   }
 }
-async function readContentIndexGeneration(root) {
+async function readResourceGeneration(root, resource) {
   try {
-    return await fs3.readFile(contentIndexGenerationPath(root), "utf-8");
+    const token = await fs3.readFile(resourceGenerationPath(root, resource), "utf-8");
+    return { ok: true, token };
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT")
-      return null;
-    log.warn("generation", `Failed to read content index generation for ${root}`, {
+      return { ok: true, token: null };
+    log.warn("generation", `Failed to read ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
-    return null;
+    return { ok: false };
   }
 }
-async function invalidateContentIndexesDurable(root) {
-  await bumpContentIndexGeneration(root);
-  invalidateContentIndexesForRoot(root);
+function isGenerationCurrent(snapshotToken, read) {
+  return read.ok && read.token === snapshotToken;
 }
 
-// dist/utils/fs.js
-import fs4 from "node:fs/promises";
-async function filePathExists(filePath) {
+// dist/branch-schema-cache.js
+import fs5 from "node:fs/promises";
+import path5 from "node:path";
+
+// dist/schema/meta-loader.js
+import { promises as fs4 } from "fs";
+import { join } from "pathe";
+import { z } from "zod";
+import chokidar from "chokidar";
+var entryTypeMetaSchema = z.object({
+  name: z.string().min(1),
+  format: z.enum(["md", "mdx", "json", "yaml"]),
+  schema: z.string().min(1),
+  // Entry schema registry key (validated at resolution time)
+  label: z.string().optional(),
+  description: z.string().optional(),
+  default: z.boolean().optional(),
+  maxItems: z.number().int().positive().optional()
+});
+var collectionMetaSchema = z.object({
+  name: z.string().min(1),
+  label: z.string().optional(),
+  description: z.string().optional(),
+  entries: z.array(entryTypeMetaSchema).optional(),
+  order: z.array(z.string()).default([])
+  // Embedded IDs for ordering; optional in the file, [] = alphabetical
+}).refine((data) => data.entries && data.entries.length > 0, {
+  message: "Collection must have at least one entry type"
+});
+var rootCollectionMetaSchema = z.object({
+  label: z.string().optional(),
+  entries: z.array(entryTypeMetaSchema).optional(),
+  order: z.array(z.string()).optional()
+  // Embedded IDs for ordering items
+});
+function stripEmbeddedIdFromName(name) {
+  return extractSlugFromFilename(name);
+}
+async function scanForCollectionMeta(baseDir, relativePath = "") {
+  const collections = [];
   try {
-    await fs4.stat(filePath);
-    return true;
+    const entries = await fs4.readdir(baseDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory())
+        continue;
+      const folderName = entry.name;
+      const logicalName = stripEmbeddedIdFromName(folderName);
+      const collectionContentId = extractIdFromFilename(folderName) ?? void 0;
+      const folderPath = relativePath ? `${relativePath}/${logicalName}` : logicalName;
+      const absolutePath = join(baseDir, folderName);
+      const metaPath = join(absolutePath, ".collection.json");
+      try {
+        await fs4.access(metaPath);
+        const content = await fs4.readFile(metaPath, "utf-8");
+        const parsed = JSON.parse(content);
+        const meta = collectionMetaSchema.parse(parsed);
+        collections.push({
+          ...meta,
+          path: folderPath,
+          // Path derived from folder name
+          contentId: collectionContentId
+        });
+        const nestedCollections = await scanForCollectionMeta(absolutePath, folderPath);
+        collections.push(...nestedCollections);
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          console.error(`Error loading ${metaPath}:`, err);
+          throw new Error(`Invalid .collection.json in ${folderPath}: ${err.message}`);
+        }
+        const nestedCollections = await scanForCollectionMeta(absolutePath, folderPath);
+        collections.push(...nestedCollections);
+      }
+    }
+    return collections;
   } catch (err) {
-    if (isNotFoundError(err))
-      return false;
+    if (err.code === "ENOENT") {
+      return [];
+    }
     throw err;
   }
 }
-
-// dist/utils/format.js
-var getFormatExtension = (format) => {
-  if (format === "md")
-    return ".md";
-  if (format === "mdx")
-    return ".mdx";
-  if (format === "yaml")
-    return ".yaml";
-  return ".json";
-};
-var isDataOnlyFormat = (format) => format === "json" || format === "yaml";
-var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
-
-// dist/paths/index.js
-init_normalize();
-
-// dist/paths/branch.js
-init_operating_mode();
-import fs5 from "node:fs/promises";
-import path6 from "node:path";
-var BranchPathError = class extends Error {
-};
-function sanitizeBranchName(branchName) {
-  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
-  const squashed = replaced.replace(/-+/g, "-");
-  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
-  return trimmedDots || "branch";
-}
-var resolveContentBranchesRoot = (mode, override) => {
-  return operatingStrategy(mode).getContentBranchesRoot(override);
-};
-function resolveBranchPath(options) {
-  if (options.branchName.includes("..")) {
-    throw new BranchPathError("Branch name cannot contain traversal segments");
+async function loadCollectionMetaFiles(contentRoot) {
+  let root = null;
+  const rootMetaPath = join(contentRoot, ".collection.json");
+  try {
+    await fs4.access(rootMetaPath);
+  } catch (err) {
+    if (err.code === "ENOENT") {
+    } else {
+      throw err;
+    }
   }
-  const safeBranch = sanitizeBranchName(options.branchName);
-  const strategy = operatingStrategy(options.mode);
-  const baseRoot = resolveContentBranchesRoot(options.mode, options.basePathOverride);
-  const normalizedBase = path6.resolve(baseRoot);
-  const baseWithSep = normalizedBase.endsWith(path6.sep) ? normalizedBase : `${normalizedBase}${path6.sep}`;
-  const branchRoot = strategy.getContentBranchRoot(safeBranch, options.basePathOverride);
-  const withinBase = (target) => {
-    const resolved = path6.resolve(target);
-    return resolved === normalizedBase || resolved.startsWith(baseWithSep);
-  };
-  if (!withinBase(branchRoot)) {
-    throw new BranchPathError("Branch path resolves outside the base root");
+  try {
+    const content = await fs4.readFile(rootMetaPath, "utf-8");
+    const parsed = JSON.parse(content);
+    root = rootCollectionMetaSchema.parse(parsed);
+  } catch (err) {
+    const errno = err.code;
+    if (errno !== "ENOENT") {
+      throw new Error(`Invalid root .collection.json`);
+    }
   }
-  return { branchRoot, baseRoot: normalizedBase, branchName: safeBranch };
+  const collections = await scanForCollectionMeta(contentRoot);
+  return { root, collections };
 }
-async function ensureBranchRoot(options) {
-  const result = resolveBranchPath(options);
-  await fs5.mkdir(result.branchRoot, { recursive: true });
-  return result;
+function resolveEntryTypes(entryTypes, entrySchemaRegistry, contextName) {
+  return entryTypes.map((entryType) => {
+    const resolvedSchema = entrySchemaRegistry[entryType.schema];
+    if (!resolvedSchema) {
+      throw new Error(`Schema reference "${entryType.schema}" in entry type "${entryType.name}" (${contextName}) not found in registry. Available schemas: ${Object.keys(entrySchemaRegistry).join(", ")}`);
+    }
+    return {
+      name: entryType.name,
+      label: entryType.label,
+      format: entryType.format,
+      schema: resolvedSchema,
+      schemaRef: entryType.schema,
+      default: entryType.default,
+      maxItems: entryType.maxItems
+    };
+  });
 }
-
-// dist/content-store.js
-var ContentStoreError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
+function resolveCollectionMeta(meta, entrySchemaRegistry, allCollections) {
+  const entries = meta.entries && meta.entries.length > 0 ? resolveEntryTypes(meta.entries, entrySchemaRegistry, `collection "${meta.name}"`) : void 0;
+  const nestedCollections = allCollections.filter((col) => {
+    return col.path.startsWith(`${meta.path}/`) && col.path.split("/").length === meta.path.split("/").length + 1;
+  });
+  const collections = nestedCollections.length > 0 ? nestedCollections.map((nestedMeta) => resolveCollectionMeta(nestedMeta, entrySchemaRegistry, allCollections)) : void 0;
+  return {
+    name: meta.name,
+    label: meta.label,
+    path: meta.path,
+    contentId: meta.contentId,
+    ...entries && { entries },
+    ...meta.order && { order: meta.order },
+    ...collections && { collections }
+  };
+}
+function resolveCollectionReferences(metaFiles, entrySchemaRegistry) {
+  const result = {};
+  if (metaFiles.root?.label) {
+    result.label = metaFiles.root.label;
   }
-};
-var ContentConflictError = class extends Error {
-  constructor() {
-    super("Content was modified by another editor");
-    this.name = "ContentConflictError";
+  if (metaFiles.root?.entries && metaFiles.root.entries.length > 0) {
+    result.entries = resolveEntryTypes(metaFiles.root.entries, entrySchemaRegistry, "root collection");
   }
-};
-function getDefaultEntryType(entries) {
-  if (!entries || entries.length === 0)
-    return void 0;
-  return entries.find((e) => e.default) || entries[0];
-}
-function validateSlug(slug) {
-  if (slug.includes("/")) {
-    throw new ContentStoreError("Slugs cannot contain forward slashes. Use nested collections instead.", "VALIDATION");
+  if (metaFiles.root?.order) {
+    result.order = metaFiles.root.order;
   }
-  if (slug.includes("\\")) {
-    throw new ContentStoreError("Slugs cannot contain backslashes. Use nested collections instead.", "VALIDATION");
+  const topLevelCollections = metaFiles.collections.filter((meta) => !meta.path.includes("/"));
+  if (topLevelCollections.length > 0) {
+    result.collections = topLevelCollections.map((meta) => resolveCollectionMeta(meta, entrySchemaRegistry, metaFiles.collections));
   }
+  return result;
 }
-var DEFAULT_INDEX_FRESHNESS_INTERVAL_MS = 1e3;
-var FORCED_REFRESH_MIN_INTERVAL_MS = 5e3;
-var STALE_LOOKUP = Symbol("stale-index-lookup");
-var ContentStore = class {
-  constructor(root, flatSchema, options = {}) {
-    this.indexGeneration = 0;
-    this.loadedIndexGeneration = -1;
-    this.loadedDiskGeneration = void 0;
-    this.lastDiskProbeMs = 0;
-    this.lastForcedRefreshMs = 0;
-    this.indexBuild = null;
-    this.root = path7.resolve(root);
-    this.indexFreshnessIntervalMs = options.indexFreshnessIntervalMs ?? DEFAULT_INDEX_FRESHNESS_INTERVAL_MS;
-    this.schemaIndex = new Map(flatSchema.map((item) => [item.logicalPath, item]));
-    this._idIndex = new ContentIdIndex(this.root);
-    registerContentIndexForInvalidation(this.root, this);
+
+// dist/schema/resolver.js
+async function resolveSchema(contentRoot, entrySchemaRegistry) {
+  const metaFiles = await loadCollectionMetaFiles(contentRoot);
+  const sources = [];
+  if (metaFiles.root) {
+    sources.push({
+      path: ".collection.json",
+      type: "root",
+      collections: []
+    });
   }
-  /**
-   * Mark the ID index stale so the next idIndex() access rebuilds it from disk.
-   *
-   * Called (via content-index-registry) after in-process operations that change the
-   * working tree underneath this store — git checkout/merge/rebase, the worker's
-   * rebase loop, and sync-core's content replacement. Without this, ID→path lookups
-   * keep resolving to pre-mutation paths and saves can target moved/deleted files.
-   *
-   * Cheap: only bumps a generation counter; the rebuild happens lazily.
-   */
-  invalidateIndex() {
-    this.indexGeneration++;
+  for (const collection of metaFiles.collections) {
+    sources.push({
+      path: `${collection.path}/.collection.json`,
+      type: "collection",
+      collections: [collection.name]
+    });
   }
-  /**
-   * Get the ID index, ensuring it's loaded and current first.
-   * Loads lazily on first access and rebuilds after invalidateIndex(); repeated
-   * accesses with no intervening invalidation reuse the already-built index,
-   * except for a throttled probe of the on-disk generation marker that detects
-   * mutations made by OTHER processes sharing this root (e.g. on EFS).
-   */
-  async idIndex() {
-    if (this.loadedIndexGeneration === this.indexGeneration && this.shouldProbeDiskGeneration()) {
-      const diskToken = await readContentIndexGeneration(this.root);
-      if (diskToken !== this.loadedDiskGeneration) {
-        this.indexGeneration++;
-      }
-    }
-    while (this.loadedIndexGeneration !== this.indexGeneration) {
-      if (this.indexBuild) {
-        await this.indexBuild;
-        continue;
-      }
-      const generation = this.indexGeneration;
-      const build = (async () => {
-        const diskToken = await readContentIndexGeneration(this.root);
-        const fresh = new ContentIdIndex(this.root);
-        await fresh.buildFromFilenames("content");
-        return { diskToken, fresh };
-      })();
-      this.indexBuild = build;
-      let result;
-      try {
-        result = await build;
-      } finally {
-        this.indexBuild = null;
-      }
-      this._idIndex = result.fresh;
-      this.loadedIndexGeneration = generation;
-      this.loadedDiskGeneration = result.diskToken;
-      this.lastDiskProbeMs = Date.now();
+  const schema = resolveCollectionReferences(metaFiles, entrySchemaRegistry);
+  return { schema, sources };
+}
+function isValidSchema(schema) {
+  const hasEntries = !!(schema.entries && schema.entries.length > 0);
+  const hasCollections = !!(schema.collections && schema.collections.length > 0);
+  return hasEntries || hasCollections;
+}
+
+// dist/branch-schema-cache.js
+init_flatten();
+
+// dist/build-mode.js
+var isDeployedStatic = (config) => {
+  return config.deployedAs === "static";
+};
+var isBuildMode = () => {
+  if (process.env.NEXT_PHASE === "phase-production-build")
+    return true;
+  if (process.env.CANOPY_BUILD_MODE === "true")
+    return true;
+  return false;
+};
+var STATIC_DEPLOY_USER = Object.freeze({
+  type: "authenticated",
+  userId: "__static_deploy__",
+  groups: ["Admins"],
+  email: "static-deploy@canopycms",
+  name: "Static Deploy"
+});
+
+// dist/branch-schema-cache.js
+var SCHEMA_CACHE_VERSION = 3;
+var MTIME_CHECK_DEBOUNCE_MS = 1e3;
+var SCHEMA_GENERATION_RESOURCE = "schema";
+async function isStaleByMtime(dir, cachedAt) {
+  let entries;
+  try {
+    entries = await fs5.readdir(dir, { recursive: true, encoding: "utf-8" });
+  } catch {
+    return true;
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith(".collection.json"))
+      continue;
+    const full = path5.join(dir, entry);
+    try {
+      const stat = await fs5.stat(full);
+      if (stat.mtimeMs > cachedAt.getTime())
+        return true;
+    } catch {
+      return true;
     }
-    return this._idIndex;
+  }
+  return false;
+}
+var BranchSchemaCache = class {
+  constructor(mode = "prod") {
+    this.lastMtimeCheck = /* @__PURE__ */ new Map();
+    this.devMode = mode === "dev";
   }
   /**
-   * Throttle for the on-disk marker probe. Stamps the clock synchronously
-   * before the caller's readFile so concurrent idIndex() callers don't
-   * double-probe (and double-rebuild) on the same token change.
+   * Whether to skip the on-disk cache for this branchRoot.
+   *
+   * branchRoot equals the project root (process.cwd()) only in the synthetic
+   * contexts used by static deployments and build phases — real branch roots are
+   * always nested under the workspace (.canopy-dev/content-branches/<name> in dev,
+   * <workspaceRoot>/content-branches/<name> in prod). Never write .canopy-meta/ at
+   * the project root, regardless of which entrypoint produced the cwd branchRoot.
    */
-  shouldProbeDiskGeneration() {
-    const now = Date.now();
-    if (now - this.lastDiskProbeMs < this.indexFreshnessIntervalMs)
-      return false;
-    this.lastDiskProbeMs = now;
-    return true;
+  skipDiskCache(branchRoot) {
+    return isBuildMode() || path5.resolve(branchRoot) === path5.resolve(process.cwd());
   }
   /**
-   * After one of this store's own successful mutations: publish the change to
-   * other processes (bump the on-disk marker) and adopt the written token,
-   * since the in-memory index was already updated incrementally — avoiding a
-   * pointless self-rescan on the next probe. Adoption is skipped unless the
-   * index is quiescent and `updatedIndex` is still the live instance: if a
-   * rebuild raced with the mutation, its scan may predate our file change, so
-   * we leave the recorded token older and let the next probe observe our bump
-   * and trigger the healing rebuild.
+   * Get schema for a branch (loads from cache or resolves fresh).
+   *
+   * @param branchRoot - Root directory of the branch (e.g., .canopy-dev/content-branches/main)
+   * @param entrySchemaRegistry - Map of schema names to field definitions
+   * @param contentRootName - Name of content directory (e.g., "content") from config
+   * @returns Resolved schema tree and flattened schema
    */
-  async recordOwnMutation(updatedIndex) {
-    const token = await bumpContentIndexGeneration(this.root);
-    if (token !== null && this.indexBuild === null && this.loadedIndexGeneration === this.indexGeneration && this._idIndex === updatedIndex) {
-      this.loadedDiskGeneration = token;
-    }
+  async getSchema(branchRoot, entrySchemaRegistry, contentRootName = "content") {
+    return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
   }
   /**
-   * Backstop for the residual staleness windows of the cross-process marker
-   * (NFS attribute caching, probe throttle, self-adoption — see
-   * content-index-generation.ts): force one rebuild in response to a
-   * suspicious lookup (an ID miss, or an index hit whose file is gone), but
-   * throttle how often a caller can force one. Time-boxed so genuinely
-   * dangling IDs cost at most one rescan per window. Returns true if a
-   * refresh was performed by THIS call; callers that lose the throttle race
-   * still benefit — idIndex() dedupes concurrent builds, so a caller that won
-   * the race rebuilds the index for everyone, and callers should still retry
-   * their lookup against the live index regardless of this return value.
+   * Resolve the schema from disk. Wrapped in a protected method (rather than
+   * calling the imported resolveSchema directly) so tests can subclass and
+   * override with a deferred/blocking implementation to simulate cross-process
+   * interleavings — mirrors BranchRegistry's scanBranchDirectories() hook.
    */
-  async refreshIndexForSuspiciousLookup() {
-    const now = Date.now();
-    if (now - this.lastForcedRefreshMs < FORCED_REFRESH_MIN_INTERVAL_MS)
-      return false;
-    this.lastForcedRefreshMs = now;
-    this.invalidateIndex();
-    await this.idIndex();
-    return true;
+  async resolveFresh(contentRoot, entrySchemaRegistry) {
+    return resolveSchema(contentRoot, entrySchemaRegistry);
   }
   /**
-   * Find the file in `dir` whose filename embeds `id`.
-   * Returns its root-relative path, or null if no such file (or no such dir).
+   * Load schema from cache or resolve fresh if cache is missing or stale.
    */
-  async findEntryPathById(dir, id) {
-    let entries;
-    try {
-      entries = await fs6.readdir(dir, { withFileTypes: true });
-    } catch (err) {
-      if (isNodeError(err) && err.code === "ENOENT")
-        return null;
-      throw err;
-    }
-    for (const entry of entries) {
-      if (entry.isDirectory())
-        continue;
-      if (extractIdFromFilename(entry.name) === id) {
-        return path7.relative(this.root, path7.join(dir, entry.name));
+  async loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName) {
+    const contentRoot = path5.join(branchRoot, contentRootName);
+    const skipDiskCache = this.skipDiskCache(branchRoot);
+    if (!skipDiskCache) {
+      const cacheDir = path5.join(branchRoot, ".canopy-meta");
+      const cachePath = path5.join(cacheDir, "schema-cache.json");
+      let cacheData = null;
+      try {
+        const cacheContent = await fs5.readFile(cachePath, "utf-8");
+        cacheData = JSON.parse(cacheContent);
+      } catch {
+        cacheData = null;
+      }
+      if (cacheData && cacheData.version === SCHEMA_CACHE_VERSION) {
+        const read = await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
+        if (isGenerationCurrent(cacheData.generation, read)) {
+          const now = Date.now();
+          const lastCheck = this.lastMtimeCheck.get(contentRoot) ?? 0;
+          if (this.devMode && now - lastCheck >= MTIME_CHECK_DEBOUNCE_MS && await isStaleByMtime(contentRoot, new Date(cacheData.cachedAt))) {
+            this.lastMtimeCheck.set(contentRoot, now);
+            cacheData = null;
+          } else {
+            if (this.devMode)
+              this.lastMtimeCheck.set(contentRoot, now);
+            return { schema: cacheData.schema, flatSchema: cacheData.flatSchema };
+          }
+        } else {
+          cacheData = null;
+        }
+      } else {
+        cacheData = null;
       }
     }
-    return null;
+    return this.resolveFreshAndPersist(branchRoot, entrySchemaRegistry, contentRootName, {
+      skipDiskCache
+    });
   }
   /**
-   * Get all schema items for iteration.
-   * Used internally by ReferenceResolver for path matching.
+   * Resolve the schema fresh from disk and persist it (subject to the
+   * skip-persist rule below), UNCONDITIONALLY -- never through the cache-read
+   * fast path in {@link loadFromCacheOrResolve}. Shared by that method's
+   * cache-miss fallback and by {@link resolveAndPersist}.
    */
-  getSchemaItems() {
-    return this.schemaIndex.values();
-  }
-  assertSchemaItem(path17) {
-    const normalized = normalizeFilesystemPath(path17);
-    const item = this.schemaIndex.get(normalized);
-    if (!item) {
-      throw new ContentStoreError(`Unknown schema item: ${path17}`, "NO_SCHEMA_ITEM");
+  async resolveFreshAndPersist(branchRoot, entrySchemaRegistry, contentRootName, options) {
+    const { skipDiskCache } = options;
+    const contentRoot = path5.join(branchRoot, contentRootName);
+    const read = skipDiskCache ? null : await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
+    const result = await this.resolveFresh(contentRoot, entrySchemaRegistry);
+    if (!isValidSchema(result.schema)) {
+      throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
     }
-    return item;
-  }
-  assertCollection(collectionPath) {
-    const item = this.assertSchemaItem(collectionPath);
-    if (item.type !== "collection") {
-      throw new ContentStoreError(`Path is not a collection: ${collectionPath}`, "NO_SCHEMA_ITEM");
+    const flatSchema = flattenSchema(result.schema, contentRootName);
+    if (!skipDiskCache) {
+      const cacheDir = path5.join(branchRoot, ".canopy-meta");
+      const cachePath = path5.join(cacheDir, "schema-cache.json");
+      await fs5.unlink(path5.join(cacheDir, "schema-cache.stale")).catch(() => {
+      });
+      if (read && read.ok) {
+        const newCache = {
+          version: SCHEMA_CACHE_VERSION,
+          schema: result.schema,
+          flatSchema,
+          cachedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          generation: read.token
+        };
+        await fs5.mkdir(cacheDir, { recursive: true });
+        const tmpPath = path5.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
+        await fs5.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
+        try {
+          await fs5.rename(tmpPath, cachePath);
+        } catch (err) {
+          await fs5.unlink(tmpPath).catch(() => {
+          });
+          throw err;
+        }
+      }
     }
-    return item;
+    return { schema: result.schema, flatSchema };
   }
   /**
-   * Build absolute and relative paths with security validation.
-   * All entries use the unified filename pattern: {type}.{slug}.{id}.{ext}
+   * Resolve the schema fresh from disk and persist it, SKIPPING the cache
+   * read entirely -- unlike {@link getSchema}, which can short-circuit
+   * through a cache HIT. That distinction matters for eager re-resolve after
+   * invalidation (see {@link invalidate}'s doc comment and
+   * `SchemaOps.invalidateSchemaCache()` in schema/schema-store.ts, the sole
+   * intended caller): the whole point of an eager re-resolve is to guarantee
+   * ONE scan that is coherent with the mutation this host just made. A plain
+   * `getSchema()` call right after `invalidate()` is NOT that guarantee --
+   * `getSchema()`'s cache-read fast path (`loadFromCacheOrResolve`) can still
+   * return a snapshot written by a DIFFERENT, concurrent host: if that
+   * foreign host's own eager re-resolve raced this one and embedded the
+   * (now-current) marker token over ITS OWN stale-NFS-cache scan (the
+   * window-E case this class's doc comment describes), this host's
+   * `getSchema()` would happily accept that foreign snapshot as "current"
+   * and skip the one scan this call was specifically trying to guarantee.
+   * `resolveAndPersist()` never reads the cache file at all, so it cannot be
+   * short-circuited that way.
+   */
+  async resolveAndPersist(branchRoot, entrySchemaRegistry, contentRootName = "content") {
+    const skipDiskCache = this.skipDiskCache(branchRoot);
+    return this.resolveFreshAndPersist(branchRoot, entrySchemaRegistry, contentRootName, {
+      skipDiskCache
+    });
+  }
+  /**
+   * Invalidate cache for a branch by bumping the cross-process generation
+   * marker (resource-generation.ts). Every process sharing this branchRoot
+   * will re-resolve at its next read.
    *
-   * SECURITY BOUNDARY: This method prevents path traversal attacks by:
-   * 1. Validating that resolved paths stay within the content root
-   * 2. Checking slugs for malicious patterns (via validateSlug)
-   * 3. Using path.resolve to normalize paths before validation
+   * The bump must succeed: a swallowed failure here would leave the schema
+   * cache stale indefinitely with no bounding backstop (unlike
+   * BranchRegistry, there is no get-miss backstop for a resolved schema).
    *
-   * This validation is performed BEFORE file I/O in resolveDocumentPath(),
-   * ensuring permission checks happen before any file system access.
+   * No eager regeneration here (unlike BranchRegistry.invalidate()): this
+   * method isn't given the entrySchemaRegistry/contentRootName resolveSchema
+   * needs. See the class doc comment for why the mutating request's own
+   * follow-up schema read closes the same window-E gap instead.
    *
-   * @param options.existingId - Optional ID to use (for edits). If not provided, generates new ID.
-   * @param options.entryTypeName - For collections with multiple entry types, specify which one to use. Defaults to the default entry type.
+   * @param branchRoot - Root directory of the branch
    */
-  async buildPaths(schemaItem, slug, options = {}) {
-    const rootWithSep = this.root.endsWith(path7.sep) ? this.root : `${this.root}${path7.sep}`;
-    if (schemaItem.type === "entry-type") {
-      const parentPath = schemaItem.parentPath || "";
-      const parentCollection = this.schemaIndex.get(parentPath);
-      if (!parentCollection || parentCollection.type !== "collection") {
-        throw new ContentStoreError(`Parent collection not found for entry type: ${schemaItem.name}`, "NO_SCHEMA_ITEM");
-      }
-      const effectiveSlug = slug || schemaItem.name;
-      return this.buildPaths(parentCollection, effectiveSlug, {
-        ...options,
-        entryTypeName: schemaItem.name
-      });
-    }
-    if (schemaItem.type === "collection") {
-      const safeSlug = slug.replace(/^\/+/, "").toLowerCase();
-      if (!safeSlug) {
-        throw new ContentStoreError("Slug is required for collection entries", "VALIDATION");
-      }
-      validateSlug(safeSlug);
-      let entryTypeConfig;
-      if (options.entryTypeName) {
-        entryTypeConfig = schemaItem.entries?.find((e) => e.name === options.entryTypeName);
-        if (!entryTypeConfig) {
-          throw new ContentStoreError(`Entry type '${options.entryTypeName}' not found in collection`, "NO_SCHEMA_ITEM");
-        }
-      } else {
-        entryTypeConfig = getDefaultEntryType(schemaItem.entries);
-      }
-      const format = entryTypeConfig?.format || "json";
-      const ext = getFormatExtension(format);
-      const entryTypeName = entryTypeConfig?.name || "entry";
-      let collectionRoot = await resolveCollectionPath(this.root, schemaItem.logicalPath);
-      if (!collectionRoot) {
-        collectionRoot = path7.resolve(this.root, schemaItem.logicalPath);
-      }
-      if (!collectionRoot.startsWith(rootWithSep)) {
-        throw new ContentStoreError("Path traversal detected", "VALIDATION");
-      }
-      let id = options.existingId;
-      let existingFilename;
-      let existingEntryType;
-      if (!id) {
-        const entries = await fs6.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
-        const existingFile = entries.find((entry) => {
-          if (entry.isDirectory())
-            return false;
-          const fileEntryType = extractEntryTypeFromFilename(entry.name);
-          const existingSlug = extractSlugFromFilename(entry.name, fileEntryType || void 0);
-          return existingSlug === safeSlug;
-        });
-        if (existingFile) {
-          id = extractIdFromFilename(existingFile.name) || void 0;
-          existingFilename = existingFile.name;
-          existingEntryType = extractEntryTypeFromFilename(existingFile.name) || void 0;
-        }
-      }
-      const finalEntryTypeName = existingEntryType || entryTypeName;
-      let filename;
-      if (existingFilename) {
-        filename = existingFilename;
-      } else {
-        if (!id) {
-          id = generateId();
-        }
-        filename = `${finalEntryTypeName}.${safeSlug}.${id}${ext}`;
-      }
-      const resolved = path7.resolve(collectionRoot, filename);
-      const collectionRootWithSep = collectionRoot.endsWith(path7.sep) ? collectionRoot : `${collectionRoot}${path7.sep}`;
-      if (!resolved.startsWith(collectionRootWithSep)) {
-        throw new ContentStoreError("Path traversal detected", "VALIDATION");
-      }
-      return {
-        absolutePath: resolved,
-        relativePath: path7.relative(this.root, resolved),
-        id,
-        entryTypeName: finalEntryTypeName
-      };
-    }
-    throw new ContentStoreError("Invalid schema item type", "VALIDATION");
+  async invalidate(branchRoot) {
+    if (this.skipDiskCache(branchRoot))
+      return;
+    await bumpResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE, { mustSucceed: true });
   }
-  /**
-   * Path resolution: resolves a URL path to a schema item
-   * - Try as collection + slug (last segment = slug)
-   */
-  resolvePath(pathSegments) {
-    if (pathSegments.length === 0) {
-      throw new ContentStoreError("Empty path", "VALIDATION");
-    }
-    const logicalPath = pathSegments.join("/");
-    const slug = pathSegments[pathSegments.length - 1].toLowerCase();
-    const collectionPath = pathSegments.slice(0, -1).join("/");
-    const normalizedCollection = normalizeFilesystemPath(collectionPath);
-    const collection = this.schemaIndex.get(normalizedCollection);
-    if (collection?.type === "collection" && collection.entries) {
-      return {
-        schemaItem: collection,
-        slug
-      };
-    }
-    throw new ContentStoreError(`No schema item found for path: ${logicalPath}`, "NO_SCHEMA_ITEM");
+};
+
+// dist/content-index-generation.js
+var RESOURCE = "content-index";
+async function bumpContentIndexGeneration(root) {
+  return bumpResourceGeneration(root, RESOURCE);
+}
+async function readContentIndexGeneration(root) {
+  const result = await readResourceGeneration(root, RESOURCE);
+  return result.ok ? result.token : null;
+}
+async function invalidateBranchContentCaches(root) {
+  await bumpContentIndexGeneration(root);
+  await bumpResourceGeneration(root, SCHEMA_GENERATION_RESOURCE);
+  invalidateContentIndexesForRoot(root);
+}
+
+// dist/utils/fs.js
+import fs6 from "node:fs/promises";
+async function filePathExists(filePath) {
+  try {
+    await fs6.stat(filePath);
+    return true;
+  } catch (err) {
+    if (isNotFoundError(err))
+      return false;
+    throw err;
   }
-  async resolveDocumentPath(schemaPath, slug = "") {
-    const schemaItem = this.assertSchemaItem(schemaPath);
-    return await this.buildPaths(schemaItem, slug);
+}
+
+// dist/utils/format.js
+var getFormatExtension = (format) => {
+  if (format === "md")
+    return ".md";
+  if (format === "mdx")
+    return ".mdx";
+  if (format === "yaml")
+    return ".yaml";
+  return ".json";
+};
+var isDataOnlyFormat = (format) => format === "json" || format === "yaml";
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+
+// dist/paths/index.js
+init_normalize();
+
+// dist/paths/normalize-server.js
+import { sep, resolve, relative } from "node:path";
+function validateAndNormalizePath(root, target) {
+  const resolvedRoot = resolve(root);
+  const withSep = resolvedRoot.endsWith(sep) ? resolvedRoot : `${resolvedRoot}${sep}`;
+  const resolvedTarget = resolve(target);
+  if (!resolvedTarget.startsWith(withSep) && resolvedTarget !== resolvedRoot) {
+    return {
+      valid: false,
+      error: "Path traversal detected"
+    };
   }
-  async read(collectionPath, slug = "", options = {}) {
-    const schemaItem = this.assertSchemaItem(collectionPath);
-    const { absolutePath, relativePath, entryTypeName: resolvedEntryTypeName } = await this.buildPaths(schemaItem, slug);
-    const stat = await fs6.stat(absolutePath);
-    const raw = await fs6.readFile(absolutePath, "utf8");
-    let doc;
-    let format;
-    let fields;
-    if (schemaItem.type === "entry-type") {
-      format = schemaItem.format;
-      fields = schemaItem.schema;
-    } else {
-      let entryTypeConfig;
-      if (resolvedEntryTypeName && schemaItem.entries) {
-        entryTypeConfig = schemaItem.entries.find((e) => e.name === resolvedEntryTypeName);
-      }
-      if (!entryTypeConfig) {
-        entryTypeConfig = getDefaultEntryType(schemaItem.entries);
-      }
-      format = entryTypeConfig?.format || "json";
-      fields = entryTypeConfig?.schema || [];
-    }
-    if (format === "json") {
-      const data = asRecord(JSON.parse(raw));
-      doc = {
-        collection: schemaItem.logicalPath,
-        collectionName: schemaItem.name,
-        format: "json",
-        data,
-        relativePath,
-        absolutePath
-      };
-    } else if (format === "yaml") {
-      const data = asRecord(yamlParse(raw));
-      doc = {
-        collection: schemaItem.logicalPath,
-        collectionName: schemaItem.name,
-        format: "yaml",
-        data,
-        relativePath,
-        absolutePath
-      };
-    } else {
-      const parsed = matter(raw);
-      doc = {
-        collection: schemaItem.logicalPath,
-        collectionName: schemaItem.name,
-        format,
-        data: parsed.data ?? {},
-        body: parsed.content,
-        bodyFieldName: findBodyFieldName(fields),
-        relativePath,
-        absolutePath
-      };
-    }
-    if (options.resolveReferences !== false) {
-      doc.data = await this.resolveReferencesInData(doc.data, fields);
-    }
-    doc.version = stat.mtimeMs;
-    return doc;
+  const relativePath = relative(resolvedRoot, resolvedTarget).split(sep).join("/");
+  return {
+    valid: true,
+    normalizedPath: relativePath
+  };
+}
+
+// dist/paths/branch.js
+init_operating_mode();
+import fs7 from "node:fs/promises";
+import path7 from "node:path";
+var BranchPathError = class extends Error {
+};
+function sanitizeBranchName(branchName) {
+  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const squashed = replaced.replace(/-+/g, "-");
+  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
+  return trimmedDots || "branch";
+}
+var resolveContentBranchesRoot = (mode, override) => {
+  return operatingStrategy(mode).getContentBranchesRoot(override);
+};
+function resolveBranchPath(options) {
+  if (options.branchName.includes("..")) {
+    throw new BranchPathError("Branch name cannot contain traversal segments");
   }
-  async write(collectionPath, slug = "", input, entryTypeName, existingId) {
-    await this.idIndex();
-    const schemaItem = this.assertSchemaItem(collectionPath);
-    let expectedFormat;
-    let fields = [];
-    if (schemaItem.type === "entry-type") {
-      expectedFormat = schemaItem.format;
-      fields = schemaItem.schema;
-    } else {
-      let entryTypeConfig;
-      if (entryTypeName) {
-        entryTypeConfig = schemaItem.entries?.find((e) => e.name === entryTypeName);
-        if (!entryTypeConfig) {
-          throw new ContentStoreError(`Entry type '${entryTypeName}' not found in collection`, "NO_SCHEMA_ITEM");
-        }
-      } else {
-        entryTypeConfig = getDefaultEntryType(schemaItem.entries);
+  const safeBranch = sanitizeBranchName(options.branchName);
+  const strategy = operatingStrategy(options.mode);
+  const baseRoot = resolveContentBranchesRoot(options.mode, options.basePathOverride);
+  const normalizedBase = path7.resolve(baseRoot);
+  const baseWithSep = normalizedBase.endsWith(path7.sep) ? normalizedBase : `${normalizedBase}${path7.sep}`;
+  const branchRoot = strategy.getContentBranchRoot(safeBranch, options.basePathOverride);
+  const withinBase = (target) => {
+    const resolved = path7.resolve(target);
+    return resolved === normalizedBase || resolved.startsWith(baseWithSep);
+  };
+  if (!withinBase(branchRoot)) {
+    throw new BranchPathError("Branch path resolves outside the base root");
+  }
+  return { branchRoot, baseRoot: normalizedBase, branchName: safeBranch };
+}
+async function ensureBranchRoot(options) {
+  const result = resolveBranchPath(options);
+  await fs7.mkdir(result.branchRoot, { recursive: true });
+  return result;
+}
+
+// dist/content-store.js
+async function withLocks(keys, fn) {
+  const sorted = Array.from(new Set(keys)).sort();
+  const acquireFrom = (index) => index === sorted.length ? fn() : withLock(sorted[index], () => acquireFrom(index + 1));
+  return acquireFrom(0);
+}
+var ContentStoreError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+};
+var ContentConflictError = class extends Error {
+  constructor() {
+    super("Content was modified by another editor");
+    this.name = "ContentConflictError";
+  }
+};
+function getDefaultEntryType(entries) {
+  if (!entries || entries.length === 0)
+    return void 0;
+  return entries.find((e) => e.default) || entries[0];
+}
+function validateSlug(slug) {
+  if (slug.includes("/")) {
+    throw new ContentStoreError("Slugs cannot contain forward slashes. Use nested collections instead.", "VALIDATION");
+  }
+  if (slug.includes("\\")) {
+    throw new ContentStoreError("Slugs cannot contain backslashes. Use nested collections instead.", "VALIDATION");
+  }
+}
+var DEFAULT_INDEX_FRESHNESS_INTERVAL_MS = 1e3;
+var FORCED_REFRESH_MIN_INTERVAL_MS = 5e3;
+var STALE_LOOKUP = Symbol("stale-index-lookup");
+var ContentStore = class {
+  constructor(root, flatSchema, options = {}) {
+    this.indexGeneration = 0;
+    this.loadedIndexGeneration = -1;
+    this.loadedDiskGeneration = void 0;
+    this.lastDiskProbeMs = 0;
+    this.lastForcedRefreshMs = 0;
+    this.indexBuild = null;
+    this.root = path8.resolve(root);
+    this.indexFreshnessIntervalMs = options.indexFreshnessIntervalMs ?? DEFAULT_INDEX_FRESHNESS_INTERVAL_MS;
+    this.schemaIndex = new Map(flatSchema.map((item) => [item.logicalPath, item]));
+    this._idIndex = new ContentIdIndex(this.root);
+    registerContentIndexForInvalidation(this.root, this);
+  }
+  /**
+   * Mark the ID index stale so the next idIndex() access rebuilds it from disk.
+   *
+   * Called (via content-index-registry) after in-process operations that change the
+   * working tree underneath this store — git checkout/merge/rebase, the worker's
+   * rebase loop, and sync-core's content replacement. Without this, ID→path lookups
+   * keep resolving to pre-mutation paths and saves can target moved/deleted files.
+   *
+   * Cheap: only bumps a generation counter; the rebuild happens lazily.
+   */
+  invalidateIndex() {
+    this.indexGeneration++;
+  }
+  /**
+   * Get the ID index, ensuring it's loaded and current first.
+   * Loads lazily on first access and rebuilds after invalidateIndex(); repeated
+   * accesses with no intervening invalidation reuse the already-built index,
+   * except for a throttled probe of the on-disk generation marker that detects
+   * mutations made by OTHER processes sharing this root (e.g. on EFS).
+   */
+  async idIndex() {
+    if (this.loadedIndexGeneration === this.indexGeneration && this.shouldProbeDiskGeneration()) {
+      const diskToken = await readContentIndexGeneration(this.root);
+      if (diskToken !== this.loadedDiskGeneration) {
+        this.indexGeneration++;
       }
-      expectedFormat = entryTypeConfig?.format || "json";
-      fields = entryTypeConfig?.schema || [];
-    }
-    if (expectedFormat !== input.format) {
-      throw new ContentStoreError(`Format mismatch: expects ${expectedFormat}, got ${input.format}`, "VALIDATION");
     }
-    const { absolutePath, relativePath, id } = await this.buildPaths(schemaItem, slug, {
-      entryTypeName,
-      existingId
-    });
-    return withLock(absolutePath, async () => {
-      await fs6.mkdir(path7.dirname(absolutePath), { recursive: true });
-      if (input.expectedVersion !== void 0) {
-        try {
-          const existing = await fs6.stat(absolutePath);
-          if (existing.mtimeMs !== input.expectedVersion) {
-            throw new ContentConflictError();
-          }
-        } catch (err) {
-          if (err instanceof ContentConflictError)
-            throw err;
-          if (isNodeError(err) && err.code === "ENOENT") {
-          } else {
-            throw err;
-          }
-        }
-      }
-      if (existingId && !await filePathExists(absolutePath)) {
-        const actualRelPath = await this.findEntryPathById(path7.dirname(absolutePath), existingId);
-        const indexedRelPath = (await this.idIndex()).findById(existingId)?.relativePath ?? null;
-        if (actualRelPath !== null && actualRelPath !== indexedRelPath) {
-          throw new ContentConflictError();
-        }
-      }
-      let content;
-      if (input.format === "json") {
-        content = `${JSON.stringify(input.data ?? {}, null, 2)}
-`;
-      } else if (input.format === "yaml") {
-        content = yamlStringify(input.data ?? {});
-      } else {
-        content = matter.stringify(input.body, input.data ?? {});
-      }
-      await atomicWriteFile(absolutePath, content);
-      const liveIndex = this._idIndex;
-      let staleOldAbsPath = null;
-      if (id) {
-        const existing = liveIndex.findById(id);
-        if (existing) {
-          if (existing.relativePath !== relativePath) {
-            staleOldAbsPath = path7.join(this.root, existing.relativePath);
-            liveIndex.updatePath(existing.id, relativePath);
-          }
-        } else {
-          liveIndex.add({
-            type: "entry",
-            relativePath,
-            collection: collectionPath,
-            slug: slug || void 0
-          });
-        }
-      }
-      if (staleOldAbsPath) {
-        await fs6.unlink(staleOldAbsPath).catch((err) => {
-          if (!isNodeError(err) || err.code !== "ENOENT")
-            throw err;
-        });
-      }
-      await this.recordOwnMutation(liveIndex);
-      const afterStat = await fs6.stat(absolutePath);
-      const base = {
-        collection: schemaItem.logicalPath,
-        collectionName: schemaItem.name,
-        relativePath,
-        absolutePath,
-        version: afterStat.mtimeMs
-      };
-      if (input.format === "json") {
-        return { ...base, format: "json", data: input.data ?? {} };
+    while (this.loadedIndexGeneration !== this.indexGeneration) {
+      if (this.indexBuild) {
+        await this.indexBuild;
+        continue;
       }
-      if (input.format === "yaml") {
-        return { ...base, format: "yaml", data: input.data ?? {} };
+      const generation = this.indexGeneration;
+      const build = (async () => {
+        const diskToken = await readContentIndexGeneration(this.root);
+        const fresh = new ContentIdIndex(this.root);
+        await fresh.buildFromFilenames("content");
+        return { diskToken, fresh };
+      })();
+      this.indexBuild = build;
+      let result;
+      try {
+        result = await build;
+      } finally {
+        this.indexBuild = null;
       }
-      return {
-        ...base,
-        format: input.format,
-        data: input.data ?? {},
-        body: input.body,
-        bodyFieldName: findBodyFieldName(fields)
-      };
-    });
+      this._idIndex = result.fresh;
+      this.loadedIndexGeneration = generation;
+      this.loadedDiskGeneration = result.diskToken;
+      this.lastDiskProbeMs = Date.now();
+    }
+    return this._idIndex;
   }
   /**
-   * Read an entry by its ID (UUID).
-   * Returns null if the ID doesn't exist or points to a collection.
-   *
-   * Suspicious results (ID missing from the index, or an index hit whose file
-   * is gone) trigger one forced index refresh and a retry — self-healing for
-   * mutations by other processes inside the marker's residual windows.
+   * Throttle for the on-disk marker probe. Stamps the clock synchronously
+   * before the caller's readFile so concurrent idIndex() callers don't
+   * double-probe (and double-rebuild) on the same token change.
    */
-  async readById(id) {
-    const first = await this.readByIdOnce(id);
-    if (first !== STALE_LOOKUP)
-      return first;
-    if (!await this.refreshIndexForSuspiciousLookup())
-      return null;
-    const second = await this.readByIdOnce(id);
-    return second === STALE_LOOKUP ? null : second;
+  shouldProbeDiskGeneration() {
+    const now = Date.now();
+    if (now - this.lastDiskProbeMs < this.indexFreshnessIntervalMs)
+      return false;
+    this.lastDiskProbeMs = now;
+    return true;
   }
-  async readByIdOnce(id) {
-    const idIndex = await this.idIndex();
-    const location = idIndex.findById(id);
-    if (!location)
-      return STALE_LOOKUP;
-    if (location.type !== "entry")
-      return null;
-    try {
-      return await this.read(location.collection, location.slug);
-    } catch (err) {
-      if (isNodeError(err) && err.code === "ENOENT")
-        return STALE_LOOKUP;
-      throw err;
+  /**
+   * After one of this store's own successful mutations: publish the change to
+   * other processes (bump the on-disk marker) and adopt the written token,
+   * since the in-memory index was already updated incrementally — avoiding a
+   * pointless self-rescan on the next probe. Adoption is skipped unless the
+   * index is quiescent and `updatedIndex` is still the live instance: if a
+   * rebuild raced with the mutation, its scan may predate our file change, so
+   * we leave the recorded token older and let the next probe observe our bump
+   * and trigger the healing rebuild.
+   */
+  async recordOwnMutation(updatedIndex) {
+    const token = await bumpContentIndexGeneration(this.root);
+    if (token !== null && this.indexBuild === null && this.loadedIndexGeneration === this.indexGeneration && this._idIndex === updatedIndex) {
+      this.loadedDiskGeneration = token;
     }
   }
   /**
-   * Get the ID for an entry given its collection and slug.
-   * Returns null if no ID exists yet.
+   * Backstop for the residual staleness windows of the cross-process marker
+   * (NFS attribute caching, probe throttle, self-adoption — see
+   * content-index-generation.ts): force one rebuild in response to a
+   * suspicious lookup (an ID miss, or an index hit whose file is gone), but
+   * throttle how often a caller can force one. Time-boxed so genuinely
+   * dangling IDs cost at most one rescan per window. Returns true if a
+   * refresh was performed by THIS call; callers that lose the throttle race
+   * still benefit — idIndex() dedupes concurrent builds, so a caller that won
+   * the race rebuilds the index for everyone, and callers should still retry
+   * their lookup against the live index regardless of this return value.
    */
-  async getIdForEntry(collectionPath, slug) {
-    const idIndex = await this.idIndex();
-    const { relativePath } = await this.buildPaths(this.assertCollection(collectionPath), slug);
-    return idIndex.findByPath(relativePath);
+  async refreshIndexForSuspiciousLookup() {
+    const now = Date.now();
+    if (now - this.lastForcedRefreshMs < FORCED_REFRESH_MIN_INTERVAL_MS)
+      return false;
+    this.lastForcedRefreshMs = now;
+    this.invalidateIndex();
+    await this.idIndex();
+    return true;
   }
   /**
-   * Check whether a document already exists on disk for this collection+slug.
-   * Used by the write boundary to distinguish creates from edits (create
-   * scaffolds and maxItems enforcement).
+   * Find the file in `dir` whose filename embeds `id`.
+   * Returns its root-relative path, or null if no such file (or no such dir).
    */
-  async documentExists(collectionPath, slug = "") {
-    const schemaItem = this.assertSchemaItem(collectionPath);
-    const { absolutePath } = await this.buildPaths(schemaItem, slug);
+  async findEntryPathById(dir, id) {
+    let entries;
     try {
-      await fs6.access(absolutePath);
-      return true;
+      entries = await fs8.readdir(dir, { withFileTypes: true });
     } catch (err) {
       if (isNodeError(err) && err.code === "ENOENT")
-        return false;
+        return null;
       throw err;
     }
+    for (const entry of entries) {
+      if (entry.isDirectory())
+        continue;
+      if (extractIdFromFilename(entry.name) === id) {
+        return path8.relative(this.root, path8.join(dir, entry.name));
+      }
+    }
+    return null;
   }
   /**
-   * Resolve the actual on-disk entry type of an existing collection entry, by
-   * inspecting its filename directly. Entry filenames embed their type
-   * (`{type}.{slug}.{id}.{ext}`) and it is immutable after creation — see the
-   * existing-file lookup in buildPaths(), which this mirrors. Returns
-   * undefined if no entry exists yet at this slug.
-   *
-   * Used at the API write boundary (api/content.ts) to validate an existing
-   * entry's payload against ITS real schema rather than a caller-supplied (or
-   * omitted/spoofed) `entryType` param — ContentStore.write() preserves the
-   * on-disk type regardless of what's requested, so validation must agree
-   * with what will actually be written (post-review M2).
-   *
-   * Cheap: one buildPaths() resolution plus a stat, no file content is read —
-   * same cost class as documentExists().
+   * Get all schema items for iteration.
+   * Used internally by ReferenceResolver for path matching.
    */
-  async getExistingEntryType(collectionPath, slug = "") {
-    const schemaItem = this.assertCollection(collectionPath);
-    const { absolutePath, entryTypeName } = await this.buildPaths(schemaItem, slug);
-    return await filePathExists(absolutePath) ? entryTypeName : void 0;
+  getSchemaItems() {
+    return this.schemaIndex.values();
+  }
+  assertSchemaItem(path19) {
+    const normalized = normalizeFilesystemPath(path19);
+    const item = this.schemaIndex.get(normalized);
+    if (!item) {
+      throw new ContentStoreError(`Unknown schema item: ${path19}`, "NO_SCHEMA_ITEM");
+    }
+    return item;
+  }
+  assertCollection(collectionPath) {
+    const item = this.assertSchemaItem(collectionPath);
+    if (item.type !== "collection") {
+      throw new ContentStoreError(`Path is not a collection: ${collectionPath}`, "NO_SCHEMA_ITEM");
+    }
+    return item;
   }
   /**
-   * Count existing entries of a given entry type in a collection, by filename
-   * (entry filenames embed their type: `{type}.{slug}.{id}.{ext}`). Used to
-   * enforce `EntryTypeConfig.maxItems` server-side at the create boundary.
+   * Lock key for an existing entry, addressed by its permanent content ID
+   * (stable across renames -- the whole point of this locking scheme; see
+   * .claude/future-tasks/resolved/content-store-lock-key.md). Namespaced by store
+   * root: the same content ID exists in every clone of a branch, and one
+   * process can hold ContentStore instances on several clones (dev
+   * workspace roots, prod branch clones) at once, so the root prefix keeps
+   * the keyspace scoped per-store. It also keeps this ID keyspace disjoint
+   * from other modules' raw-path-keyed locks sharing the same withLock()
+   * map (comment-store, branch-metadata, etc).
    */
-  async countEntriesOfType(collectionPath, entryTypeName) {
-    this.assertCollection(collectionPath);
-    const collectionRoot = await resolveCollectionPath(this.root, collectionPath);
-    if (!collectionRoot)
-      return 0;
-    const entries = await fs6.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
-    return entries.filter((entry) => !entry.isDirectory() && extractEntryTypeFromFilename(entry.name) === entryTypeName).length;
+  idLockKey(id) {
+    return `${this.root}:id:${id}`;
   }
   /**
-   * Delete an entry and remove it from the index.
+   * Stable collection+slug identifier for lock-key namespacing. Mirrors the
+   * schemaItem resolution buildPaths() performs for entry-type delegation:
+   * an entry-type item delegates to its parent collection with the slug
+   * defaulting to the entry type's own name (see buildPaths()'s
+   * `schemaItem.type === 'entry-type'` branch).
    */
-  async delete(collectionPath, slug) {
-    await this.idIndex();
-    const collection = this.assertCollection(collectionPath);
-    const { absolutePath, relativePath } = await this.buildPaths(collection, slug);
-    return withLock(absolutePath, async () => {
-      await fs6.unlink(absolutePath);
-      const liveIndex = this._idIndex;
-      const id = liveIndex.findByPath(relativePath);
-      if (id) {
-        liveIndex.remove(id);
-      }
-      await this.recordOwnMutation(liveIndex);
-    });
+  collectionSlugKey(schemaItem, slug) {
+    if (schemaItem.type === "entry-type") {
+      return `${schemaItem.parentPath}/${slug || schemaItem.name}`;
+    }
+    return `${schemaItem.logicalPath}/${slug}`;
   }
   /**
-   * Rename an entry by changing its slug (middle segment of filename).
-   * Entry filename pattern: {entryTypeName}.{slug}.{id}.{ext}
-   *
-   * @param collectionPath - Logical path to the collection
-   * @param currentSlug - Current slug of the entry
-   * @param newSlug - New slug (must be unique within collection)
-   * @returns Object with new logical path
-   * @throws ContentStoreError if entry doesn't exist, new slug conflicts, or validation fails
+   * Lock key for a not-yet-existing entry (a create). Serializes concurrent
+   * same-slug creates WITHIN this process: the second call's in-lock
+   * buildPaths() re-resolution will find the first call's just-written file
+   * and fold in as an edit (see write()). A concurrent create racing from a
+   * DIFFERENT process is NOT covered by this in-process mutex -- accepted
+   * per the epic's design review: each writer mints its own fresh ID and
+   * writes its own distinct filename, so both writes succeed and the result
+   * is two same-slug files with different IDs (a slug-uniqueness violation
+   * surfaced on the next listing/lookup), never a duplicate-ID collision
+   * that would poison index rebuilds.
    */
-  async renameEntry(collectionPath, currentSlug, newSlug) {
-    await this.idIndex();
-    const collection = this.assertCollection(collectionPath);
-    validateSlug(newSlug);
-    const safeNewSlug = newSlug.replace(/^\/+/, "");
-    if (!safeNewSlug) {
-      throw new ContentStoreError("New slug cannot be empty", "VALIDATION");
-    }
-    if (currentSlug === safeNewSlug) {
-      return { newPath: `${collectionPath}/${currentSlug}` };
-    }
-    const { absolutePath: currentPath, relativePath: currentRelPath } = await this.buildPaths(collection, currentSlug);
-    return withLock(currentPath, async () => {
-      try {
-        await fs6.access(currentPath);
-      } catch {
-        throw new ContentStoreError(`Entry not found: ${currentSlug}`, "NOT_FOUND");
-      }
-      const currentFilename = path7.basename(currentPath);
-      const parts = currentFilename.split(".");
-      if (parts.length < 4) {
-        throw new ContentStoreError(`Invalid entry filename format: ${currentFilename}`, "VALIDATION");
-      }
-      const entryTypeName = parts[0];
-      const contentId = parts[parts.length - 2];
-      const ext = `.${parts[parts.length - 1]}`;
-      const newFilename = `${entryTypeName}.${safeNewSlug}.${contentId}${ext}`;
-      const parentDir = path7.dirname(currentPath);
-      const newPath = path7.join(parentDir, newFilename);
-      try {
-        const entries = await fs6.readdir(parentDir, { withFileTypes: true });
-        for (const entry of entries) {
-          if (entry.isDirectory())
-            continue;
-          const existingSlug = extractSlugFromFilename(entry.name, entryTypeName);
-          if (existingSlug === safeNewSlug) {
-            throw new ContentStoreError(`Entry with slug "${safeNewSlug}" already exists in collection "${collectionPath}"`, "VALIDATION");
-          }
-        }
-      } catch (err) {
-        if (err instanceof ContentStoreError)
-          throw err;
-      }
-      try {
-        await fs6.link(currentPath, newPath);
-      } catch (err) {
-        if (isNodeError(err) && err.code === "EEXIST") {
-          throw new ContentStoreError(`Entry with slug "${safeNewSlug}" already exists in collection "${collectionPath}"`, "VALIDATION");
-        }
-        throw err;
-      }
-      await fs6.unlink(currentPath);
-      const newRelativePath = path7.relative(this.root, newPath);
-      const liveIndex = this._idIndex;
-      const entryId = liveIndex.findByPath(currentRelPath);
-      if (entryId) {
-        liveIndex.updatePath(entryId, newRelativePath);
-      }
-      await this.recordOwnMutation(liveIndex);
-      return { newPath: `${collectionPath}/${safeNewSlug}` };
-    });
+  createLockKey(schemaItem, slug) {
+    return `${this.root}:create:${this.collectionSlugKey(schemaItem, slug)}`;
   }
   /**
-   * List all entries in a collection tree (including subcollections).
-   * For example, passing 'content/data-catalog' returns entries from
-   * 'content/data-catalog', 'content/data-catalog/partner-a', etc.
-   * Returns array of entry metadata (relativePath, collection, slug).
-   * Returns empty array if the collection doesn't exist.
+   * Lock key for a write()/delete() pre-pass classification. Existing
+   * entries lock on their content ID (idLockKey()). Legacy entries with no
+   * embedded ID (pre-ID-era filenames -- renameEntry() already refuses to
+   * touch these, via its four-part filename check, so there is no rename
+   * race to guard against for them) fall back to the physical path, matching
+   * this store's original locking behavior for that narrow case. Not-yet-
+   * existing entries lock on a per-slug create-key (createLockKey()).
    */
-  async getCollectionEntryPaths(collectionPath) {
-    const idIndex = await this.idIndex();
-    const normalized = normalizeFilesystemPath(collectionPath);
-    let item = this.schemaIndex.get(normalized);
-    if (!item) {
-      for (const schemaItem of this.schemaIndex.values()) {
-        if (schemaItem.type === "collection") {
-          const lastSegment = schemaItem.logicalPath.split("/").pop();
-          if (lastSegment === collectionPath) {
-            item = schemaItem;
-            break;
-          }
+  entryLockKey(schemaItem, slug, prePass) {
+    if (!prePass.existed)
+      return this.createLockKey(schemaItem, slug);
+    return prePass.id ? this.idLockKey(prePass.id) : prePass.absolutePath;
+  }
+  /**
+   * Build absolute and relative paths with security validation.
+   * All entries use the unified filename pattern: {type}.{slug}.{id}.{ext}
+   *
+   * SECURITY BOUNDARY: This method prevents path traversal attacks by:
+   * 1. Validating that resolved paths stay within the content root
+   * 2. Checking slugs for malicious patterns (via validateSlug)
+   * 3. Using path.resolve to normalize paths before validation
+   *
+   * This validation is performed BEFORE file I/O in resolveDocumentPath(),
+   * ensuring permission checks happen before any file system access.
+   *
+   * @param options.existingId - Optional ID to use (for edits). If not provided, generates new ID.
+   * @param options.entryTypeName - For collections with multiple entry types, specify which one to use. Defaults to the default entry type.
+   */
+  async buildPaths(schemaItem, slug, options = {}) {
+    const rootWithSep = this.root.endsWith(path8.sep) ? this.root : `${this.root}${path8.sep}`;
+    if (schemaItem.type === "entry-type") {
+      const parentPath = schemaItem.parentPath || "";
+      const parentCollection = this.schemaIndex.get(parentPath);
+      if (!parentCollection || parentCollection.type !== "collection") {
+        throw new ContentStoreError(`Parent collection not found for entry type: ${schemaItem.name}`, "NO_SCHEMA_ITEM");
+      }
+      const effectiveSlug = slug || schemaItem.name;
+      return this.buildPaths(parentCollection, effectiveSlug, {
+        ...options,
+        entryTypeName: schemaItem.name
+      });
+    }
+    if (schemaItem.type === "collection") {
+      const safeSlug = slug.replace(/^\/+/, "").toLowerCase();
+      if (!safeSlug) {
+        throw new ContentStoreError("Slug is required for collection entries", "VALIDATION");
+      }
+      validateSlug(safeSlug);
+      let entryTypeConfig;
+      if (options.entryTypeName) {
+        entryTypeConfig = schemaItem.entries?.find((e) => e.name === options.entryTypeName);
+        if (!entryTypeConfig) {
+          throw new ContentStoreError(`Entry type '${options.entryTypeName}' not found in collection`, "NO_SCHEMA_ITEM");
         }
+      } else {
+        entryTypeConfig = getDefaultEntryType(schemaItem.entries);
       }
-    }
-    if (!item || item.type !== "collection") {
-      return [];
-    }
-    const collection = item;
-    const treeEntries = idIndex.getEntriesInCollectionTree(collection.logicalPath);
-    const entries = [];
-    for (const location of treeEntries) {
-      if (location.type === "entry" && location.slug && location.collection) {
-        entries.push({
-          relativePath: location.relativePath,
-          collection: location.collection,
-          slug: location.slug
-        });
+      const format = entryTypeConfig?.format || "json";
+      const ext = getFormatExtension(format);
+      const entryTypeName = entryTypeConfig?.name || "entry";
+      let collectionRoot = await resolveCollectionPath(this.root, schemaItem.logicalPath);
+      if (!collectionRoot) {
+        collectionRoot = path8.resolve(this.root, schemaItem.logicalPath);
       }
-    }
-    return entries;
-  }
-  /**
-   * Recursively resolve reference fields in data.
-   * This traverses objects, arrays, and blocks to find and resolve all reference fields.
-   */
-  async resolveReferencesInData(data, fields) {
-    const resolved = { ...data };
-    const idIndex = await this.idIndex();
-    for (const field of fields) {
-      if (field.type === "group") {
-        const groupResolved = await this.resolveReferencesInData(resolved, field.fields);
-        Object.assign(resolved, groupResolved);
-        continue;
+      if (!collectionRoot.startsWith(rootWithSep)) {
+        throw new ContentStoreError("Path traversal detected", "VALIDATION");
       }
-      const value = data[field.name];
-      if (field.type === "reference") {
-        if (typeof value === "string" && value) {
-          resolved[field.name] = await this.resolveSingleReference(value, idIndex);
-        } else if (field.list && Array.isArray(value)) {
-          resolved[field.name] = await Promise.all(value.map((id) => typeof id === "string" ? this.resolveSingleReference(id, idIndex) : null));
+      let id = options.existingId;
+      let existingFilename;
+      let existingEntryType;
+      let foundExisting = false;
+      if (!id) {
+        const entries = await fs8.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+        const existingFile = entries.find((entry) => {
+          if (entry.isDirectory())
+            return false;
+          const fileEntryType = extractEntryTypeFromFilename(entry.name);
+          const existingSlug = extractSlugFromFilename(entry.name, fileEntryType || void 0);
+          return existingSlug === safeSlug;
+        });
+        if (existingFile) {
+          id = extractIdFromFilename(existingFile.name) || void 0;
+          existingFilename = existingFile.name;
+          existingEntryType = extractEntryTypeFromFilename(existingFile.name) || void 0;
+          foundExisting = true;
         }
-      } else if (field.type === "object" && value) {
-        const objectField = field;
-        if (!objectField.fields)
-          continue;
-        if (objectField.list && Array.isArray(value)) {
-          resolved[field.name] = await Promise.all(value.map((item) => typeof item === "object" && item !== null ? this.resolveReferencesInData(item, objectField.fields) : item));
-        } else if (typeof value === "object") {
-          resolved[field.name] = await this.resolveReferencesInData(value, objectField.fields);
+      }
+      const existed = foundExisting || Boolean(options.existingId);
+      const finalEntryTypeName = existingEntryType || entryTypeName;
+      let filename;
+      if (existingFilename) {
+        filename = existingFilename;
+      } else {
+        if (!id) {
+          id = generateId();
         }
-      } else if (field.type === "block" && Array.isArray(value)) {
-        const blockField = field;
-        resolved[field.name] = await Promise.all(value.map(async (block) => {
-          const b = block;
-          if (!b || typeof b.value !== "object")
-            return block;
-          const template = blockField.templates.find((t) => t.name === b.template);
-          if (!template)
-            return block;
-          return {
-            ...b,
-            value: await this.resolveReferencesInData(b.value, template.fields)
-          };
-        }));
+        filename = `${finalEntryTypeName}.${safeSlug}.${id}${ext}`;
       }
+      const resolved = path8.resolve(collectionRoot, filename);
+      const collectionRootWithSep = collectionRoot.endsWith(path8.sep) ? collectionRoot : `${collectionRoot}${path8.sep}`;
+      if (!resolved.startsWith(collectionRootWithSep)) {
+        throw new ContentStoreError("Path traversal detected", "VALIDATION");
+      }
+      return {
+        absolutePath: resolved,
+        relativePath: path8.relative(this.root, resolved),
+        id,
+        entryTypeName: finalEntryTypeName,
+        existed
+      };
     }
-    return resolved;
+    throw new ContentStoreError("Invalid schema item type", "VALIDATION");
   }
   /**
-   * Resolve a single reference ID to full entry data.
-   * Returns null if the reference is invalid or missing.
-   * Includes id, slug, and collection fields for debugging.
-   *
-   * Suspicious results (ID missing from the index, or an index hit whose file
-   * is gone) trigger one forced index refresh and a retry — self-healing for
-   * mutations by other processes inside the marker's residual windows. The
-   * forced refresh itself is throttled (see refreshIndexForSuspiciousLookup),
-   * but the retry against the live index always runs regardless of whether
-   * this call won the throttle race: when a `list: true` reference array is
-   * resolved via Promise.all, every miss shares the same stale snapshot, and
-   * idIndex() dedupes concurrent builds — so a sibling call that wins the
-   * throttle and rebuilds heals every other miss in the same batch, not just
-   * the first.
+   * Path resolution: resolves a URL path to a schema item
+   * - Try as collection + slug (last segment = slug)
    */
-  async resolveSingleReference(id, idIndex) {
-    const first = await this.resolveSingleReferenceOnce(id, idIndex);
-    if (first !== STALE_LOOKUP)
-      return first;
-    await this.refreshIndexForSuspiciousLookup();
-    const second = await this.resolveSingleReferenceOnce(id, await this.idIndex());
-    return second === STALE_LOOKUP ? null : second;
-  }
-  async resolveSingleReferenceOnce(id, idIndex) {
-    try {
-      const location = idIndex.findById(id);
-      if (!location)
-        return STALE_LOOKUP;
-      if (location.type !== "entry" || !location.collection || !location.slug) {
-        return null;
-      }
-      const doc = await this.read(location.collection, location.slug, {
-        resolveReferences: false
-      });
+  resolvePath(pathSegments) {
+    if (pathSegments.length === 0) {
+      throw new ContentStoreError("Empty path", "VALIDATION");
+    }
+    const logicalPath = pathSegments.join("/");
+    const slug = pathSegments[pathSegments.length - 1].toLowerCase();
+    const collectionPath = pathSegments.slice(0, -1).join("/");
+    const normalizedCollection = normalizeFilesystemPath(collectionPath);
+    const collection = this.schemaIndex.get(normalizedCollection);
+    if (collection?.type === "collection" && collection.entries) {
       return {
-        id,
-        slug: location.slug,
-        collection: location.collection,
-        ...doc.data
+        schemaItem: collection,
+        slug
       };
-    } catch (error) {
-      if (isNodeError(error) && error.code === "ENOENT")
-        return STALE_LOOKUP;
-      console.error(`Failed to resolve reference ${id}:`, error);
-      return null;
     }
+    throw new ContentStoreError(`No schema item found for path: ${logicalPath}`, "NO_SCHEMA_ITEM");
   }
-};
-
-// dist/branch-schema-cache.js
-import fs8 from "node:fs/promises";
-import path8 from "node:path";
-
-// dist/schema/meta-loader.js
-import { promises as fs7 } from "fs";
-import { join as join2 } from "pathe";
-import { z as z6 } from "zod";
-import chokidar from "chokidar";
-var entryTypeMetaSchema = z6.object({
-  name: z6.string().min(1),
-  format: z6.enum(["md", "mdx", "json", "yaml"]),
-  schema: z6.string().min(1),
-  // Entry schema registry key (validated at resolution time)
-  label: z6.string().optional(),
-  description: z6.string().optional(),
-  default: z6.boolean().optional(),
-  maxItems: z6.number().int().positive().optional()
-});
-var collectionMetaSchema = z6.object({
-  name: z6.string().min(1),
-  label: z6.string().optional(),
-  description: z6.string().optional(),
-  entries: z6.array(entryTypeMetaSchema).optional(),
-  order: z6.array(z6.string()).default([])
-  // Embedded IDs for ordering; optional in the file, [] = alphabetical
-}).refine((data) => data.entries && data.entries.length > 0, {
-  message: "Collection must have at least one entry type"
-});
-var rootCollectionMetaSchema = z6.object({
-  label: z6.string().optional(),
-  entries: z6.array(entryTypeMetaSchema).optional(),
-  order: z6.array(z6.string()).optional()
-  // Embedded IDs for ordering items
-});
-function stripEmbeddedIdFromName(name) {
-  return extractSlugFromFilename(name);
-}
-async function scanForCollectionMeta(baseDir, relativePath = "") {
-  const collections = [];
-  try {
-    const entries = await fs7.readdir(baseDir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (!entry.isDirectory())
-        continue;
-      const folderName = entry.name;
-      const logicalName = stripEmbeddedIdFromName(folderName);
-      const collectionContentId = extractIdFromFilename(folderName) ?? void 0;
-      const folderPath = relativePath ? `${relativePath}/${logicalName}` : logicalName;
-      const absolutePath = join2(baseDir, folderName);
-      const metaPath = join2(absolutePath, ".collection.json");
-      try {
-        await fs7.access(metaPath);
-        const content = await fs7.readFile(metaPath, "utf-8");
-        const parsed = JSON.parse(content);
-        const meta = collectionMetaSchema.parse(parsed);
-        collections.push({
-          ...meta,
-          path: folderPath,
-          // Path derived from folder name
-          contentId: collectionContentId
-        });
-        const nestedCollections = await scanForCollectionMeta(absolutePath, folderPath);
-        collections.push(...nestedCollections);
-      } catch (err) {
-        if (err.code !== "ENOENT") {
-          console.error(`Error loading ${metaPath}:`, err);
-          throw new Error(`Invalid .collection.json in ${folderPath}: ${err.message}`);
-        }
-        const nestedCollections = await scanForCollectionMeta(absolutePath, folderPath);
-        collections.push(...nestedCollections);
+  async resolveDocumentPath(schemaPath, slug = "") {
+    const schemaItem = this.assertSchemaItem(schemaPath);
+    return await this.buildPaths(schemaItem, slug);
+  }
+  async read(collectionPath, slug = "", options = {}) {
+    const schemaItem = this.assertSchemaItem(collectionPath);
+    const { absolutePath, relativePath, entryTypeName: resolvedEntryTypeName } = await this.buildPaths(schemaItem, slug);
+    const stat = await fs8.stat(absolutePath);
+    const raw = await fs8.readFile(absolutePath, "utf8");
+    let doc;
+    let format;
+    let fields;
+    if (schemaItem.type === "entry-type") {
+      format = schemaItem.format;
+      fields = schemaItem.schema;
+    } else {
+      let entryTypeConfig;
+      if (resolvedEntryTypeName && schemaItem.entries) {
+        entryTypeConfig = schemaItem.entries.find((e) => e.name === resolvedEntryTypeName);
+      }
+      if (!entryTypeConfig) {
+        entryTypeConfig = getDefaultEntryType(schemaItem.entries);
       }
+      format = entryTypeConfig?.format || "json";
+      fields = entryTypeConfig?.schema || [];
+    }
+    if (format === "json") {
+      const data = asRecord(JSON.parse(raw));
+      doc = {
+        collection: schemaItem.logicalPath,
+        collectionName: schemaItem.name,
+        format: "json",
+        data,
+        relativePath,
+        absolutePath
+      };
+    } else if (format === "yaml") {
+      const data = asRecord(yamlParse(raw));
+      doc = {
+        collection: schemaItem.logicalPath,
+        collectionName: schemaItem.name,
+        format: "yaml",
+        data,
+        relativePath,
+        absolutePath
+      };
+    } else {
+      const parsed = matter(raw);
+      doc = {
+        collection: schemaItem.logicalPath,
+        collectionName: schemaItem.name,
+        format,
+        data: parsed.data ?? {},
+        body: parsed.content,
+        bodyFieldName: findBodyFieldName(fields),
+        relativePath,
+        absolutePath
+      };
     }
-    return collections;
-  } catch (err) {
-    if (err.code === "ENOENT") {
-      return [];
+    if (options.resolveReferences !== false) {
+      doc.data = await this.resolveReferencesInData(doc.data, fields);
     }
-    throw err;
+    doc.version = stat.mtimeMs;
+    return doc;
   }
-}
-async function loadCollectionMetaFiles(contentRoot) {
-  let root = null;
-  const rootMetaPath = join2(contentRoot, ".collection.json");
-  try {
-    await fs7.access(rootMetaPath);
-  } catch (err) {
-    if (err.code === "ENOENT") {
+  async write(collectionPath, slug = "", input, entryTypeName, existingId) {
+    await this.idIndex();
+    const schemaItem = this.assertSchemaItem(collectionPath);
+    let expectedFormat;
+    let fields = [];
+    if (schemaItem.type === "entry-type") {
+      expectedFormat = schemaItem.format;
+      fields = schemaItem.schema;
     } else {
-      throw err;
+      let entryTypeConfig;
+      if (entryTypeName) {
+        entryTypeConfig = schemaItem.entries?.find((e) => e.name === entryTypeName);
+        if (!entryTypeConfig) {
+          throw new ContentStoreError(`Entry type '${entryTypeName}' not found in collection`, "NO_SCHEMA_ITEM");
+        }
+      } else {
+        entryTypeConfig = getDefaultEntryType(schemaItem.entries);
+      }
+      expectedFormat = entryTypeConfig?.format || "json";
+      fields = entryTypeConfig?.schema || [];
     }
-  }
-  try {
-    const content = await fs7.readFile(rootMetaPath, "utf-8");
-    const parsed = JSON.parse(content);
-    root = rootCollectionMetaSchema.parse(parsed);
-  } catch (err) {
-    const errno = err.code;
-    if (errno !== "ENOENT") {
-      throw new Error(`Invalid root .collection.json`);
+    if (expectedFormat !== input.format) {
+      throw new ContentStoreError(`Format mismatch: expects ${expectedFormat}, got ${input.format}`, "VALIDATION");
     }
-  }
-  const collections = await scanForCollectionMeta(contentRoot);
-  return { root, collections };
-}
-function resolveEntryTypes(entryTypes, entrySchemaRegistry, contextName) {
-  return entryTypes.map((entryType) => {
-    const resolvedSchema = entrySchemaRegistry[entryType.schema];
-    if (!resolvedSchema) {
-      throw new Error(`Schema reference "${entryType.schema}" in entry type "${entryType.name}" (${contextName}) not found in registry. Available schemas: ${Object.keys(entrySchemaRegistry).join(", ")}`);
+    const prePass = await this.buildPaths(schemaItem, slug, { entryTypeName, existingId });
+    let lockKey = this.entryLockKey(schemaItem, slug, prePass);
+    const RETRY_KEY = Symbol("retry-with-new-lock-key");
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const outcome = await withLock(lockKey, async () => {
+        const inLock = await this.buildPaths(schemaItem, slug, {
+          entryTypeName,
+          existingId
+        });
+        const currentKey = this.entryLockKey(schemaItem, slug, inLock);
+        if (currentKey !== lockKey) {
+          lockKey = currentKey;
+          return RETRY_KEY;
+        }
+        const { absolutePath, relativePath, id } = inLock;
+        await fs8.mkdir(path8.dirname(absolutePath), { recursive: true });
+        if (input.expectedVersion !== void 0) {
+          try {
+            const existing = await fs8.stat(absolutePath);
+            if (existing.mtimeMs !== input.expectedVersion) {
+              throw new ContentConflictError();
+            }
+          } catch (err) {
+            if (err instanceof ContentConflictError)
+              throw err;
+            if (isNodeError(err) && err.code === "ENOENT") {
+            } else {
+              throw err;
+            }
+          }
+        }
+        if (existingId && !await filePathExists(absolutePath)) {
+          const actualRelPath = await this.findEntryPathById(path8.dirname(absolutePath), existingId);
+          const indexedRelPath = this._idIndex.findById(existingId)?.relativePath ?? null;
+          if (actualRelPath !== null && actualRelPath !== indexedRelPath) {
+            throw new ContentConflictError();
+          }
+        }
+        let content;
+        if (input.format === "json") {
+          content = `${JSON.stringify(input.data ?? {}, null, 2)}
+`;
+        } else if (input.format === "yaml") {
+          content = yamlStringify(input.data ?? {});
+        } else {
+          content = matter.stringify(input.body, input.data ?? {});
+        }
+        await atomicWriteFile(absolutePath, content);
+        const liveIndex = this._idIndex;
+        let staleOldAbsPath = null;
+        if (id) {
+          const existing = liveIndex.findById(id);
+          if (existing) {
+            if (existing.relativePath !== relativePath) {
+              staleOldAbsPath = path8.join(this.root, existing.relativePath);
+              liveIndex.updatePath(existing.id, relativePath);
+            }
+          } else {
+            liveIndex.add({
+              type: "entry",
+              relativePath,
+              collection: collectionPath,
+              slug: slug || void 0
+            });
+          }
+        }
+        if (staleOldAbsPath) {
+          await fs8.unlink(staleOldAbsPath).catch((err) => {
+            if (!isNodeError(err) || err.code !== "ENOENT")
+              throw err;
+          });
+        }
+        await this.recordOwnMutation(liveIndex);
+        const afterStat = await fs8.stat(absolutePath);
+        const base = {
+          collection: schemaItem.logicalPath,
+          collectionName: schemaItem.name,
+          relativePath,
+          absolutePath,
+          version: afterStat.mtimeMs
+        };
+        if (input.format === "json") {
+          return { ...base, format: "json", data: input.data ?? {} };
+        }
+        if (input.format === "yaml") {
+          return { ...base, format: "yaml", data: input.data ?? {} };
+        }
+        return {
+          ...base,
+          format: input.format,
+          data: input.data ?? {},
+          body: input.body,
+          bodyFieldName: findBodyFieldName(fields)
+        };
+      });
+      if (typeof outcome !== "symbol")
+        return outcome;
     }
-    return {
-      name: entryType.name,
-      label: entryType.label,
-      format: entryType.format,
-      schema: resolvedSchema,
-      schemaRef: entryType.schema,
-      default: entryType.default,
-      maxItems: entryType.maxItems
-    };
-  });
-}
-function resolveCollectionMeta(meta, entrySchemaRegistry, allCollections) {
-  const entries = meta.entries && meta.entries.length > 0 ? resolveEntryTypes(meta.entries, entrySchemaRegistry, `collection "${meta.name}"`) : void 0;
-  const nestedCollections = allCollections.filter((col) => {
-    return col.path.startsWith(`${meta.path}/`) && col.path.split("/").length === meta.path.split("/").length + 1;
-  });
-  const collections = nestedCollections.length > 0 ? nestedCollections.map((nestedMeta) => resolveCollectionMeta(nestedMeta, entrySchemaRegistry, allCollections)) : void 0;
-  return {
-    name: meta.name,
-    label: meta.label,
-    path: meta.path,
-    contentId: meta.contentId,
-    ...entries && { entries },
-    ...meta.order && { order: meta.order },
-    ...collections && { collections }
-  };
-}
-function resolveCollectionReferences(metaFiles, entrySchemaRegistry) {
-  const result = {};
-  if (metaFiles.root?.label) {
-    result.label = metaFiles.root.label;
-  }
-  if (metaFiles.root?.entries && metaFiles.root.entries.length > 0) {
-    result.entries = resolveEntryTypes(metaFiles.root.entries, entrySchemaRegistry, "root collection");
+    throw new ContentConflictError();
   }
-  if (metaFiles.root?.order) {
-    result.order = metaFiles.root.order;
+  /**
+   * Read an entry by its ID (UUID).
+   * Returns null if the ID doesn't exist or points to a collection.
+   *
+   * Suspicious results (ID missing from the index, or an index hit whose file
+   * is gone) trigger one forced index refresh and a retry — self-healing for
+   * mutations by other processes inside the marker's residual windows.
+   */
+  async readById(id) {
+    const first = await this.readByIdOnce(id);
+    if (first !== STALE_LOOKUP)
+      return first;
+    if (!await this.refreshIndexForSuspiciousLookup())
+      return null;
+    const second = await this.readByIdOnce(id);
+    return second === STALE_LOOKUP ? null : second;
   }
-  const topLevelCollections = metaFiles.collections.filter((meta) => !meta.path.includes("/"));
-  if (topLevelCollections.length > 0) {
-    result.collections = topLevelCollections.map((meta) => resolveCollectionMeta(meta, entrySchemaRegistry, metaFiles.collections));
+  async readByIdOnce(id) {
+    const idIndex = await this.idIndex();
+    const location = idIndex.findById(id);
+    if (!location)
+      return STALE_LOOKUP;
+    if (location.type !== "entry")
+      return null;
+    try {
+      return await this.read(location.collection, location.slug);
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return STALE_LOOKUP;
+      throw err;
+    }
   }
-  return result;
-}
-
-// dist/schema/resolver.js
-async function resolveSchema(contentRoot, entrySchemaRegistry) {
-  const metaFiles = await loadCollectionMetaFiles(contentRoot);
-  const sources = [];
-  if (metaFiles.root) {
-    sources.push({
-      path: ".collection.json",
-      type: "root",
-      collections: []
-    });
+  /**
+   * Get the ID for an entry given its collection and slug.
+   * Returns null if no ID exists yet.
+   */
+  async getIdForEntry(collectionPath, slug) {
+    const idIndex = await this.idIndex();
+    const { relativePath } = await this.buildPaths(this.assertCollection(collectionPath), slug);
+    return idIndex.findByPath(relativePath);
   }
-  for (const collection of metaFiles.collections) {
-    sources.push({
-      path: `${collection.path}/.collection.json`,
-      type: "collection",
-      collections: [collection.name]
-    });
+  /**
+   * Check whether a document already exists on disk for this collection+slug.
+   * Used by the write boundary to distinguish creates from edits (create
+   * scaffolds and maxItems enforcement).
+   */
+  async documentExists(collectionPath, slug = "") {
+    const schemaItem = this.assertSchemaItem(collectionPath);
+    const { absolutePath } = await this.buildPaths(schemaItem, slug);
+    try {
+      await fs8.access(absolutePath);
+      return true;
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return false;
+      throw err;
+    }
   }
-  const schema = resolveCollectionReferences(metaFiles, entrySchemaRegistry);
-  return { schema, sources };
-}
-function isValidSchema(schema) {
-  const hasEntries = !!(schema.entries && schema.entries.length > 0);
-  const hasCollections = !!(schema.collections && schema.collections.length > 0);
-  return hasEntries || hasCollections;
-}
-
-// dist/branch-schema-cache.js
-init_flatten();
-
-// dist/build-mode.js
-var isDeployedStatic = (config) => {
-  return config.deployedAs === "static";
-};
-var isBuildMode = () => {
-  if (process.env.NEXT_PHASE === "phase-production-build")
-    return true;
-  if (process.env.CANOPY_BUILD_MODE === "true")
-    return true;
-  return false;
-};
-var STATIC_DEPLOY_USER = Object.freeze({
-  type: "authenticated",
-  userId: "__static_deploy__",
-  groups: ["Admins"],
-  email: "static-deploy@canopycms",
-  name: "Static Deploy"
-});
-
-// dist/branch-schema-cache.js
-var SCHEMA_CACHE_VERSION = 2;
-var MTIME_CHECK_DEBOUNCE_MS = 1e3;
-async function isStaleByMtime(dir, cachedAt) {
-  let entries;
-  try {
-    entries = await fs8.readdir(dir, { recursive: true, encoding: "utf-8" });
-  } catch {
-    return true;
+  /**
+   * Resolve the actual on-disk entry type of an existing collection entry, by
+   * inspecting its filename directly. Entry filenames embed their type
+   * (`{type}.{slug}.{id}.{ext}`) and it is immutable after creation — see the
+   * existing-file lookup in buildPaths(), which this mirrors. Returns
+   * undefined if no entry exists yet at this slug.
+   *
+   * Used at the API write boundary (api/content.ts) to validate an existing
+   * entry's payload against ITS real schema rather than a caller-supplied (or
+   * omitted/spoofed) `entryType` param — ContentStore.write() preserves the
+   * on-disk type regardless of what's requested, so validation must agree
+   * with what will actually be written (post-review M2).
+   *
+   * Cheap: one buildPaths() resolution plus a stat, no file content is read —
+   * same cost class as documentExists().
+   */
+  async getExistingEntryType(collectionPath, slug = "") {
+    const schemaItem = this.assertCollection(collectionPath);
+    const { absolutePath, entryTypeName } = await this.buildPaths(schemaItem, slug);
+    return await filePathExists(absolutePath) ? entryTypeName : void 0;
   }
-  for (const entry of entries) {
-    if (!entry.endsWith(".collection.json"))
-      continue;
-    const full = path8.join(dir, entry);
-    try {
-      const stat = await fs8.stat(full);
-      if (stat.mtimeMs > cachedAt.getTime())
-        return true;
-    } catch {
-      return true;
-    }
+  /**
+   * Count existing entries of a given entry type in a collection, by filename
+   * (entry filenames embed their type: `{type}.{slug}.{id}.{ext}`). Used to
+   * enforce `EntryTypeConfig.maxItems` server-side at the create boundary.
+   */
+  async countEntriesOfType(collectionPath, entryTypeName) {
+    this.assertCollection(collectionPath);
+    const collectionRoot = await resolveCollectionPath(this.root, collectionPath);
+    if (!collectionRoot)
+      return 0;
+    const entries = await fs8.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+    return entries.filter((entry) => !entry.isDirectory() && extractEntryTypeFromFilename(entry.name) === entryTypeName).length;
   }
-  return false;
-}
-var BranchSchemaCache = class {
-  constructor(mode = "prod") {
-    this.lastMtimeCheck = /* @__PURE__ */ new Map();
-    this.devMode = mode === "dev";
+  /**
+   * Test-only seam: awaited right after the pre-pass buildPaths() resolves
+   * in delete() and renameEntry(), before the lock key is used to acquire
+   * anything. No-op in production. A test subclass can override this to
+   * inject a controlled pause in that exact window, letting a test
+   * deterministically run OTHER mutations (which don't hold this call's
+   * not-yet-acquired lock) to completion before this call proceeds to
+   * acquire its (possibly now-stale) lock key -- see the "Deterministic
+   * interleavings" testing pattern in docs/concurrency.md and
+   * branch-registry.test.ts's `BlockingRegistry` for the same idiom.
+   */
+  async afterPrePassForTesting() {
   }
   /**
-   * Whether to skip the on-disk cache for this branchRoot.
-   *
-   * branchRoot equals the project root (process.cwd()) only in the synthetic
-   * contexts used by static deployments and build phases — real branch roots are
-   * always nested under the workspace (.canopy-dev/content-branches/<name> in dev,
-   * <workspaceRoot>/content-branches/<name> in prod). Never write .canopy-meta/ at
-   * the project root, regardless of which entrypoint produced the cwd branchRoot.
+   * Delete an entry and remove it from the index.
    */
-  skipDiskCache(branchRoot) {
-    return isBuildMode() || path8.resolve(branchRoot) === path8.resolve(process.cwd());
+  async delete(collectionPath, slug) {
+    await this.idIndex();
+    const collection = this.assertCollection(collectionPath);
+    const prePass = await this.buildPaths(collection, slug);
+    if (!prePass.existed) {
+      await fs8.unlink(prePass.absolutePath);
+      return;
+    }
+    let lockKey = this.entryLockKey(collection, slug, prePass);
+    await this.afterPrePassForTesting();
+    const RETRY_KEY = Symbol("retry-with-new-lock-key");
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const outcome = await withLock(lockKey, async () => {
+        const inLock = await this.buildPaths(collection, slug);
+        const currentKey = this.entryLockKey(collection, slug, inLock);
+        if (currentKey !== lockKey) {
+          lockKey = currentKey;
+          return RETRY_KEY;
+        }
+        const { absolutePath, relativePath } = inLock;
+        await fs8.unlink(absolutePath);
+        const liveIndex = this._idIndex;
+        const id = liveIndex.findByPath(relativePath);
+        if (id) {
+          liveIndex.remove(id);
+        }
+        await this.recordOwnMutation(liveIndex);
+        return void 0;
+      });
+      if (outcome !== RETRY_KEY)
+        return;
+    }
+    throw new ContentConflictError();
   }
   /**
-   * Get schema for a branch (loads from cache or resolves fresh).
+   * Rename an entry by changing its slug (middle segment of filename).
+   * Entry filename pattern: {entryTypeName}.{slug}.{id}.{ext}
    *
-   * @param branchRoot - Root directory of the branch (e.g., .canopy-dev/content-branches/main)
-   * @param entrySchemaRegistry - Map of schema names to field definitions
-   * @param contentRootName - Name of content directory (e.g., "content") from config
-   * @returns Resolved schema tree and flattened schema
+   * @param collectionPath - Logical path to the collection
+   * @param currentSlug - Current slug of the entry
+   * @param newSlug - New slug (must be unique within collection)
+   * @returns Object with new logical path
+   * @throws ContentStoreError if entry doesn't exist, new slug conflicts, or validation fails
    */
-  async getSchema(branchRoot, entrySchemaRegistry, contentRootName = "content") {
-    return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
+  async renameEntry(collectionPath, currentSlug, newSlug) {
+    await this.idIndex();
+    const collection = this.assertCollection(collectionPath);
+    validateSlug(newSlug);
+    const safeNewSlug = newSlug.replace(/^\/+/, "");
+    if (!safeNewSlug) {
+      throw new ContentStoreError("New slug cannot be empty", "VALIDATION");
+    }
+    if (currentSlug === safeNewSlug) {
+      return { newPath: `${collectionPath}/${currentSlug}` };
+    }
+    const prePass = await this.buildPaths(collection, currentSlug);
+    if (!prePass.existed) {
+      throw new ContentStoreError(`Entry not found: ${currentSlug}`, "NOT_FOUND");
+    }
+    let sourceLockKey = this.entryLockKey(collection, currentSlug, prePass);
+    let sourceId = prePass.id;
+    let destLockKey = this.createLockKey(collection, safeNewSlug);
+    await this.afterPrePassForTesting();
+    const RETRY_KEY = Symbol("retry-with-new-lock-key");
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const outcome = await withLocks([sourceLockKey, destLockKey], async () => {
+        const inLock = await this.buildPaths(collection, currentSlug);
+        if (!inLock.existed) {
+          throw new ContentStoreError(`Entry not found: ${currentSlug}`, "NOT_FOUND");
+        }
+        const currentSourceKey = this.entryLockKey(collection, currentSlug, inLock);
+        const currentDestKey = this.createLockKey(collection, safeNewSlug);
+        if (currentSourceKey !== sourceLockKey || inLock.id !== sourceId) {
+          sourceLockKey = currentSourceKey;
+          destLockKey = currentDestKey;
+          sourceId = inLock.id;
+          return RETRY_KEY;
+        }
+        destLockKey = currentDestKey;
+        const { absolutePath: currentPath, relativePath: currentRelPath } = inLock;
+        const currentFilename = path8.basename(currentPath);
+        const parts = currentFilename.split(".");
+        if (parts.length < 4) {
+          throw new ContentStoreError(`Invalid entry filename format: ${currentFilename}`, "VALIDATION");
+        }
+        const entryTypeName = parts[0];
+        const contentId = parts[parts.length - 2];
+        const ext = `.${parts[parts.length - 1]}`;
+        const newFilename = `${entryTypeName}.${safeNewSlug}.${contentId}${ext}`;
+        const parentDir = path8.dirname(currentPath);
+        const newPath = path8.join(parentDir, newFilename);
+        try {
+          const entries = await fs8.readdir(parentDir, { withFileTypes: true });
+          for (const entry of entries) {
+            if (entry.isDirectory())
+              continue;
+            const existingSlug = extractSlugFromFilename(entry.name, entryTypeName);
+            if (existingSlug === safeNewSlug) {
+              throw new ContentStoreError(`Entry with slug "${safeNewSlug}" already exists in collection "${collectionPath}"`, "VALIDATION");
+            }
+          }
+        } catch (err) {
+          if (err instanceof ContentStoreError)
+            throw err;
+        }
+        try {
+          await fs8.link(currentPath, newPath);
+        } catch (err) {
+          if (isNodeError(err) && err.code === "EEXIST") {
+            throw new ContentStoreError(`Entry with slug "${safeNewSlug}" already exists in collection "${collectionPath}"`, "VALIDATION");
+          }
+          throw err;
+        }
+        await fs8.unlink(currentPath);
+        const newRelativePath = path8.relative(this.root, newPath);
+        const liveIndex = this._idIndex;
+        const entryId = liveIndex.findByPath(currentRelPath);
+        if (entryId) {
+          liveIndex.updatePath(entryId, newRelativePath);
+        }
+        await this.recordOwnMutation(liveIndex);
+        return { newPath: `${collectionPath}/${safeNewSlug}` };
+      });
+      if (typeof outcome !== "symbol")
+        return outcome;
+    }
+    throw new ContentConflictError();
   }
   /**
-   * Load schema from cache or resolve fresh if cache is missing or stale.
+   * List all entries in a collection tree (including subcollections).
+   * For example, passing 'content/data-catalog' returns entries from
+   * 'content/data-catalog', 'content/data-catalog/partner-a', etc.
+   * Returns array of entry metadata (relativePath, collection, slug).
+   * Returns empty array if the collection doesn't exist.
    */
-  async loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName) {
-    const contentRoot = path8.join(branchRoot, contentRootName);
-    const skipDiskCache = this.skipDiskCache(branchRoot);
-    if (!skipDiskCache) {
-      const cacheDir = path8.join(branchRoot, ".canopy-meta");
-      const cachePath = path8.join(cacheDir, "schema-cache.json");
-      const stalePath = path8.join(cacheDir, "schema-cache.stale");
-      let cacheData = null;
-      try {
-        const staleExists = await fs8.access(stalePath).then(() => true).catch(() => false);
-        if (!staleExists) {
-          const cacheContent = await fs8.readFile(cachePath, "utf-8");
-          cacheData = JSON.parse(cacheContent);
-        }
-      } catch {
-        cacheData = null;
-      }
-      if (cacheData && cacheData.version === SCHEMA_CACHE_VERSION) {
-        const now = Date.now();
-        const lastCheck = this.lastMtimeCheck.get(contentRoot) ?? 0;
-        if (this.devMode && now - lastCheck >= MTIME_CHECK_DEBOUNCE_MS && await isStaleByMtime(contentRoot, new Date(cacheData.cachedAt))) {
-          this.lastMtimeCheck.set(contentRoot, now);
-          cacheData = null;
-        } else {
-          if (this.devMode)
-            this.lastMtimeCheck.set(contentRoot, now);
-          return { schema: cacheData.schema, flatSchema: cacheData.flatSchema };
+  async getCollectionEntryPaths(collectionPath) {
+    const idIndex = await this.idIndex();
+    const normalized = normalizeFilesystemPath(collectionPath);
+    let item = this.schemaIndex.get(normalized);
+    if (!item) {
+      for (const schemaItem of this.schemaIndex.values()) {
+        if (schemaItem.type === "collection") {
+          const lastSegment = schemaItem.logicalPath.split("/").pop();
+          if (lastSegment === collectionPath) {
+            item = schemaItem;
+            break;
+          }
         }
       }
     }
-    const result = await resolveSchema(contentRoot, entrySchemaRegistry);
-    if (!isValidSchema(result.schema)) {
-      throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
+    if (!item || item.type !== "collection") {
+      return [];
     }
-    const flatSchema = flattenSchema(result.schema, contentRootName);
-    if (!skipDiskCache) {
-      const cacheDir = path8.join(branchRoot, ".canopy-meta");
-      const cachePath = path8.join(cacheDir, "schema-cache.json");
-      const stalePath = path8.join(cacheDir, "schema-cache.stale");
-      await fs8.mkdir(cacheDir, { recursive: true });
-      const newCache = {
-        version: SCHEMA_CACHE_VERSION,
-        schema: result.schema,
-        flatSchema,
-        cachedAt: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      const tmpPath = path8.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
-      await fs8.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
-      await fs8.rename(tmpPath, cachePath);
-      try {
-        await fs8.unlink(stalePath);
-      } catch {
+    const collection = item;
+    const treeEntries = idIndex.getEntriesInCollectionTree(collection.logicalPath);
+    const entries = [];
+    for (const location of treeEntries) {
+      if (location.type === "entry" && location.slug && location.collection) {
+        entries.push({
+          relativePath: location.relativePath,
+          collection: location.collection,
+          slug: location.slug
+        });
       }
     }
-    return { schema: result.schema, flatSchema };
+    return entries;
+  }
+  /**
+   * Recursively resolve reference fields in data.
+   * This traverses objects, arrays, and blocks to find and resolve all reference fields.
+   */
+  async resolveReferencesInData(data, fields) {
+    const resolved = { ...data };
+    const idIndex = await this.idIndex();
+    for (const field of fields) {
+      if (field.type === "group") {
+        const groupResolved = await this.resolveReferencesInData(resolved, field.fields);
+        Object.assign(resolved, groupResolved);
+        continue;
+      }
+      const value = data[field.name];
+      if (field.type === "reference") {
+        if (typeof value === "string" && value) {
+          resolved[field.name] = await this.resolveSingleReference(value, idIndex);
+        } else if (field.list && Array.isArray(value)) {
+          resolved[field.name] = await Promise.all(value.map((id) => typeof id === "string" ? this.resolveSingleReference(id, idIndex) : null));
+        }
+      } else if (field.type === "object" && value) {
+        const objectField = field;
+        if (!objectField.fields)
+          continue;
+        if (objectField.list && Array.isArray(value)) {
+          resolved[field.name] = await Promise.all(value.map((item) => typeof item === "object" && item !== null ? this.resolveReferencesInData(item, objectField.fields) : item));
+        } else if (typeof value === "object") {
+          resolved[field.name] = await this.resolveReferencesInData(value, objectField.fields);
+        }
+      } else if (field.type === "block" && Array.isArray(value)) {
+        const blockField = field;
+        resolved[field.name] = await Promise.all(value.map(async (block) => {
+          const b = block;
+          if (!b || typeof b.value !== "object")
+            return block;
+          const template = blockField.templates.find((t) => t.name === b.template);
+          if (!template)
+            return block;
+          return {
+            ...b,
+            value: await this.resolveReferencesInData(b.value, template.fields)
+          };
+        }));
+      }
+    }
+    return resolved;
   }
   /**
-   * Invalidate cache for a branch (creates .stale marker).
+   * Resolve a single reference ID to full entry data.
+   * Returns null if the reference is invalid or missing.
+   * Includes id, slug, and collection fields for debugging.
    *
-   * @param branchRoot - Root directory of the branch
+   * Suspicious results (ID missing from the index, or an index hit whose file
+   * is gone) trigger one forced index refresh and a retry — self-healing for
+   * mutations by other processes inside the marker's residual windows. The
+   * forced refresh itself is throttled (see refreshIndexForSuspiciousLookup),
+   * but the retry against the live index always runs regardless of whether
+   * this call won the throttle race: when a `list: true` reference array is
+   * resolved via Promise.all, every miss shares the same stale snapshot, and
+   * idIndex() dedupes concurrent builds — so a sibling call that wins the
+   * throttle and rebuilds heals every other miss in the same batch, not just
+   * the first.
    */
-  async invalidate(branchRoot) {
-    if (this.skipDiskCache(branchRoot))
-      return;
-    const cacheDir = path8.join(branchRoot, ".canopy-meta");
-    const stalePath = path8.join(cacheDir, "schema-cache.stale");
-    await fs8.mkdir(cacheDir, { recursive: true });
-    await fs8.writeFile(stalePath, "", "utf-8");
+  async resolveSingleReference(id, idIndex) {
+    const first = await this.resolveSingleReferenceOnce(id, idIndex);
+    if (first !== STALE_LOOKUP)
+      return first;
+    await this.refreshIndexForSuspiciousLookup();
+    const second = await this.resolveSingleReferenceOnce(id, await this.idIndex());
+    return second === STALE_LOOKUP ? null : second;
+  }
+  async resolveSingleReferenceOnce(id, idIndex) {
+    try {
+      const location = idIndex.findById(id);
+      if (!location)
+        return STALE_LOOKUP;
+      if (location.type !== "entry" || !location.collection || !location.slug) {
+        return null;
+      }
+      const doc = await this.read(location.collection, location.slug, {
+        resolveReferences: false
+      });
+      return {
+        id,
+        slug: location.slug,
+        collection: location.collection,
+        ...doc.data
+      };
+    } catch (error) {
+      if (isNodeError(error) && error.code === "ENOENT")
+        return STALE_LOOKUP;
+      console.error(`Failed to resolve reference ${id}:`, error);
+      return null;
+    }
   }
 };
 
@@ -3033,8 +3269,8 @@ function computeEntryUrl(collection, slug, contentRoot) {
   if (slug && slug !== "index") {
     segments.push(slug);
   }
-  const path17 = segments.length > 0 ? `/${segments.join("/")}` : "/";
-  return path17.toLowerCase();
+  const path19 = segments.length > 0 ? `/${segments.join("/")}` : "/";
+  return path19.toLowerCase();
 }
 
 // dist/entry-link-resolver.js
@@ -3407,77 +3643,139 @@ function matchesBundleFilter(entry, filter, contentRoot) {
 }
 
 // dist/branch-workspace.js
-import path14 from "node:path";
+import path15 from "node:path";
 
 // dist/branch-metadata.js
-import { randomUUID as randomUUID2 } from "node:crypto";
-import fs11 from "node:fs/promises";
-import path11 from "node:path";
+import fs12 from "node:fs/promises";
+import path12 from "node:path";
 
 // dist/branch-registry.js
 import fs10 from "node:fs/promises";
 import path10 from "node:path";
+var log3 = createDebugLogger({ prefix: "BranchRegistry" });
 var REGISTRY_FILE = "branches.json";
 var REGISTRY_STALE_FILE = "branches.stale.json";
 var REGISTRY_TEMP_FILE = "branches.tmp.json";
-var REGISTRY_VERSION = 1;
+var REGISTRY_VERSION = 2;
+var RESOURCE2 = "branch-registry";
+var GET_MISS_REFRESH_MIN_INTERVAL_MS = 5e3;
 var BranchRegistry = class {
   constructor(root) {
+    this.regenInFlight = null;
+    this.lastForcedRefreshMs = 0;
     this.root = path10.resolve(root);
     this.registryPath = path10.join(this.root, REGISTRY_FILE);
     this.stalePath = path10.join(this.root, REGISTRY_STALE_FILE);
     this.tempPath = path10.join(this.root, REGISTRY_TEMP_FILE);
   }
   /**
-   * Returns all branches. Uses cache if fresh, regenerates if stale.
+   * Returns all branches. Uses the cached snapshot if its embedded generation
+   * token matches the live marker, regenerates otherwise.
    */
   async list() {
+    let parsed;
     try {
       const raw = await fs10.readFile(this.registryPath, "utf8");
-      const parsed = JSON.parse(raw);
-      if (!parsed.version || !Array.isArray(parsed.branches)) {
-        return await this.regenerate();
-      }
-      return parsed.branches;
+      parsed = JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError(err)) {
         return await this.regenerate();
       }
       throw err;
     }
+    if (parsed.version !== REGISTRY_VERSION || !Array.isArray(parsed.branches)) {
+      return await this.regenerate();
+    }
+    const read = await readResourceGeneration(this.root, RESOURCE2);
+    if (isGenerationCurrent(parsed.generation, read)) {
+      return parsed.branches;
+    }
+    return await this.regenerate();
   }
   /**
    * Returns a single branch by name. Uses cache if available.
+   *
+   * Suspicious-miss backstop: if `name` isn't in the (possibly cached) list,
+   * that's a signal the snapshot may be stale in the specific direction where
+   * a branch that now exists is missing from it - force one fresh
+   * regeneration and re-search before giving up, throttled per instance so a
+   * genuinely-absent branch costs at most one extra scan per throttle window.
+   * This bounds durable window-E staleness for the "branch exists but
+   * snapshot predates it" direction; see the class doc comment.
    */
   async get(name) {
     const branches = await this.list();
-    return branches.find((b) => b.branch.name === name);
+    const found = branches.find((b) => b.branch.name === name);
+    if (found)
+      return found;
+    if (!this.shouldForceRefresh())
+      return void 0;
+    const refreshed = await this.regenerate();
+    return refreshed.find((b) => b.branch.name === name);
+  }
+  shouldForceRefresh() {
+    const now = Date.now();
+    if (now - this.lastForcedRefreshMs < GET_MISS_REFRESH_MIN_INTERVAL_MS)
+      return false;
+    this.lastForcedRefreshMs = now;
+    return true;
   }
   /**
-   * Marks the cache as stale. Next list() call will regenerate.
-   * Uses atomic rename for safety.
+   * Marks the cache as stale for every process sharing this root by bumping
+   * the cross-process generation marker, then eager-regenerates on this host
+   * (see class doc comment for why). The bump must succeed: a swallowed
+   * failure here would leave the registry stale indefinitely with no
+   * bounding backstop, unlike a failed eager regen below, which only forgoes
+   * closing window (E) early - the bump alone already restored correctness
+   * for every future reader. A failed eager regen therefore must not fail the
+   * caller's save/delete.
    */
   async invalidate() {
+    await bumpResourceGeneration(this.root, RESOURCE2, { mustSucceed: true });
     try {
-      await fs10.rename(this.registryPath, this.stalePath);
+      if (this.regenInFlight)
+        await this.regenInFlight.catch(() => {
+        });
+      await this.regenerate();
     } catch (err) {
-      if (!isNotFoundError(err)) {
-        throw err;
-      }
+      log3.warn("invalidate", "Eager regeneration after invalidate() failed", {
+        error: getErrorMessage(err)
+      });
     }
   }
   /**
-   * Scans branch directories and rebuilds the cache.
-   * Concurrent calls are safe - all produce identical content.
+   * Scans branch directories and rebuilds the cache, deduping concurrent
+   * callers on this instance to a single underlying scan. Never loops waiting
+   * for the snapshot's embedded token to match the marker - under a bump
+   * storm that could livelock; a caller that wants the very latest state
+   * after a concurrent bump should call list() again after this resolves.
    */
   async regenerate() {
+    if (this.regenInFlight)
+      return this.regenInFlight;
+    const run = this.performRegenerate();
+    this.regenInFlight = run;
+    try {
+      return await run;
+    } finally {
+      this.regenInFlight = null;
+    }
+  }
+  async performRegenerate() {
+    const read = await readResourceGeneration(this.root, RESOURCE2);
     const branches = await this.scanBranchDirectories();
-    const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs10.mkdir(this.root, { recursive: true });
+    await fs10.unlink(this.stalePath).catch(() => {
+    });
+    if (!read.ok) {
+      return branches;
+    }
     const snapshot = {
       version: REGISTRY_VERSION,
-      branches
+      branches,
+      generation: read.token
     };
+    const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
+    await fs10.mkdir(this.root, { recursive: true });
     await fs10.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
       await fs10.rename(uniqueTempPath, this.registryPath);
@@ -3486,12 +3784,12 @@ var BranchRegistry = class {
       });
       throw err;
     }
-    await fs10.unlink(this.stalePath).catch(() => {
-    });
     return branches;
   }
   /**
    * Scans the root directory for branch subdirectories with valid branch.json files.
+   * Protected (rather than exported as a test hook) so tests can subclass and
+   * override to simulate cross-process interleavings.
    */
   async scanBranchDirectories() {
     const branches = [];
@@ -3521,30 +3819,156 @@ var BranchRegistry = class {
   }
 };
 
+// dist/utils/occ-json-write.js
+import fs11 from "node:fs/promises";
+import path11 from "node:path";
+import { randomUUID as randomUUID2 } from "node:crypto";
+import lockfile from "proper-lockfile";
+var log4 = createDebugLogger({ prefix: "OccJsonWrite" });
+var OccWriteConflictError = class extends Error {
+  constructor(message = "Concurrent modification detected") {
+    super(message);
+    this.name = "OccWriteConflictError";
+  }
+};
+async function writeOccJsonFile(filePath, payload, options) {
+  const { expectedVersion, settleMs = 50, trailingNewline = false } = options;
+  const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
+  const writeId = randomUUID2();
+  const data = { ...payload, version: newVersion, writeId };
+  const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
+  const dir = path11.dirname(filePath);
+  await fs11.mkdir(dir, { recursive: true });
+  const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  await fs11.writeFile(tempPath, content, "utf-8");
+  if (expectedVersion === null) {
+    try {
+      await fs11.link(tempPath, filePath);
+    } catch (err) {
+      await fs11.unlink(tempPath).catch(() => {
+      });
+      if (isFileExistsError(err)) {
+        throw new OccWriteConflictError();
+      }
+      throw err;
+    }
+    await fs11.unlink(tempPath).catch(() => {
+    });
+    return { version: newVersion, writeId };
+  }
+  try {
+    let currentVersion = null;
+    try {
+      const current = JSON.parse(await fs11.readFile(filePath, "utf-8"));
+      currentVersion = current.version ?? 0;
+    } catch {
+      currentVersion = null;
+    }
+    if (currentVersion !== expectedVersion) {
+      throw new OccWriteConflictError();
+    }
+    await fs11.rename(tempPath, filePath);
+    if (settleMs > 0) {
+      await new Promise((resolve2) => setTimeout(resolve2, settleMs));
+    }
+    const afterWrite = JSON.parse(await fs11.readFile(filePath, "utf-8"));
+    if (afterWrite.writeId !== writeId) {
+      throw new OccWriteConflictError();
+    }
+  } catch (err) {
+    await fs11.unlink(tempPath).catch(() => {
+    });
+    throw err;
+  }
+  return { version: newVersion, writeId };
+}
+async function withOccRetry(operation, options) {
+  const maxAttempts = options?.maxAttempts ?? 10;
+  const isRetryable = options?.isRetryable;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      return await operation();
+    } catch (err) {
+      const retryable = err instanceof OccWriteConflictError || (isRetryable?.(err) ?? false);
+      if (retryable && attempt < maxAttempts) {
+        const baseDelay = Math.min(10 * Math.pow(2, attempt - 1), 100);
+        const jitter = Math.random() * baseDelay;
+        await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error("Unreachable");
+}
+async function withOccFileLock(filePath, fn) {
+  const dir = path11.dirname(filePath);
+  await fs11.mkdir(dir, { recursive: true });
+  const MAX_ATTEMPTS = 14;
+  let release = null;
+  for (let attempt = 1; release === null; attempt++) {
+    try {
+      release = await lockfile.lock(filePath, {
+        lockfilePath: `${filePath}.lock`,
+        realpath: false,
+        stale: 1e4,
+        retries: 0,
+        // A compromised lock (the lock dir vanished or refresh failed
+        // mid-hold, e.g. the branch directory containing it was deleted)
+        // must not crash the process, which is proper-lockfile's default.
+        // Our critical sections are short and idempotent-on-conflict (OCC
+        // verify inside); log and let the section finish.
+        onCompromised: (err) => {
+          log4.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+            error: getErrorMessage(err)
+          });
+        }
+      });
+    } catch (err) {
+      const code = isNodeError(err) ? err.code : void 0;
+      const contended = code === "ELOCKED";
+      if (!contended || attempt >= MAX_ATTEMPTS) {
+        throw new OccWriteConflictError(`Could not acquire file lock: ${getErrorMessage(err)}`);
+      }
+      const baseDelay = Math.min(50 * Math.pow(1.6, attempt - 1), 2e3);
+      const jitter = Math.random() * baseDelay;
+      await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    await release().catch((err) => {
+      log4.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
+    });
+  }
+}
+
 // dist/branch-metadata.js
 var BRANCH_META_DIR = ".canopy-meta";
 var BRANCH_META_FILE = "branch.json";
 var CURRENT_SCHEMA_VERSION = 1;
 var BranchMetadataConflictError = class extends Error {
-  constructor() {
-    super("Concurrent modification detected in branch metadata");
+  constructor(message = "Concurrent modification detected in branch metadata") {
+    super(message);
     this.name = "BranchMetadataConflictError";
   }
 };
 var BranchMetadataFileManager = class _BranchMetadataFileManager {
-  constructor(branchRoot, baseRoot) {
-    this.branchRoot = path11.resolve(branchRoot);
-    this.filePath = path11.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
+  constructor(branchRoot, baseRoot, options) {
+    this.branchRoot = path12.resolve(branchRoot);
+    this.filePath = path12.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
     this.baseRoot = baseRoot;
+    this.settleMs = options?.settleMs;
   }
   /**
    * Load branch metadata without requiring baseRoot.
    * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
    */
   static async loadOnly(branchRoot) {
-    const filePath = path11.join(path11.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
+    const filePath = path12.join(path12.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
     try {
-      const raw = await fs11.readFile(filePath, "utf8");
+      const raw = await fs12.readFile(filePath, "utf8");
       return JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError(err)) {
@@ -3557,12 +3981,12 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Get a BranchMetadataFileManager instance configured for registry invalidation.
    * Use this in API handlers to ensure registry cache is invalidated on updates.
    */
-  static get(branchRoot, baseRoot) {
-    return new _BranchMetadataFileManager(branchRoot, baseRoot);
+  static get(branchRoot, baseRoot, options) {
+    return new _BranchMetadataFileManager(branchRoot, baseRoot, options);
   }
   async load() {
     try {
-      const raw = await fs11.readFile(this.filePath, "utf8");
+      const raw = await fs12.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -3574,114 +3998,107 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     }
   }
   /**
-   * Atomic write using temp-file + rename + post-write verification.
-   * Follows the same pattern as CommentStore for EFS/NFS safety.
+   * Write branch.json via the shared OCC helper, with the schemaVersion
+   * default applied here (payload shaping stays branch-metadata's concern).
+   *
+   * Throws the helper's raw {@link OccWriteConflictError} so the surrounding
+   * {@link withOccRetry} in save() recognizes and retries it; translation to
+   * the public `BranchMetadataConflictError` contract happens at the save()
+   * boundary, after retries are exhausted (translating earlier would make
+   * withOccRetry's default predicate miss it, since it only recognizes the
+   * raw error type).
+   *
+   * branch-metadata historically writes WITH a trailing newline, unlike
+   * comment-store; `trailingNewline: true` preserves that.
    */
   async write(meta, expectedVersion) {
-    const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
-    const writeId = randomUUID2();
     const payload = {
       ...meta,
-      schemaVersion: meta.schemaVersion ?? CURRENT_SCHEMA_VERSION,
-      version: newVersion,
-      writeId
+      schemaVersion: meta.schemaVersion ?? CURRENT_SCHEMA_VERSION
     };
-    await fs11.mkdir(path11.dirname(this.filePath), { recursive: true });
-    const content = JSON.stringify(payload, null, 2) + "\n";
-    if (expectedVersion === null) {
-      const tempPath2 = `${this.filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-      await fs11.writeFile(tempPath2, content, "utf-8");
-      try {
-        await fs11.link(tempPath2, this.filePath);
-      } catch (err) {
-        await fs11.unlink(tempPath2).catch(() => {
-        });
-        if (isFileExistsError(err)) {
-          throw new BranchMetadataConflictError();
-        }
-        throw err;
+    return writeOccJsonFile(this.filePath, payload, {
+      expectedVersion,
+      settleMs: this.settleMs,
+      trailingNewline: true
+    });
+  }
+  /**
+   * Run a save cycle under the full lock + OCC-retry stack described in the
+   * class doc comment. A conflict that survives every retry surfaces as the
+   * public `BranchMetadataConflictError`.
+   *
+   * Guards against a phantom-resurrection race with branch deletion: a
+   * caller's branchContext can be resolved BEFORE a concurrent
+   * deleteBranchHandler removes the branch directory, but this save() call
+   * only reaches here (and its own mkdir({recursive:true}) inside write())
+   * AFTER the removal. Without this check, that mkdir would silently
+   * recreate `.canopy-meta/` (and this save would recreate branch.json from
+   * defaults) inside a directory tree that no longer exists anywhere else --
+   * a registry entry with no clone behind it. Checking BEFORE the lock stack
+   * (rather than after) fails fast without paying for a lock acquisition on
+   * a doomed save.
+   *
+   * Residual window (accepted): a save that passes this check can still
+   * race a `rm` that starts moments later and is still mid-flight when this
+   * save's write lands, resurrecting the tree. Closing that fully would
+   * need a tombstone OUTSIDE the tree being removed -- the lockfile
+   * (`withOccFileLock`) this save takes next lives INSIDE `branchRoot`, so
+   * it cannot itself provide a wider guarantee than "the directory existed
+   * a moment ago."
+   */
+  async save(incoming) {
+    try {
+      await fs12.stat(this.branchRoot);
+    } catch (err) {
+      if (isNotFoundError(err)) {
+        throw new BranchMetadataConflictError("Branch no longer exists");
       }
-      await fs11.unlink(tempPath2).catch(() => {
-      });
-      return { version: newVersion, writeId };
+      throw err;
     }
-    const tempPath = `${this.filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    await fs11.writeFile(tempPath, content, "utf-8");
+    let saved;
     try {
-      let currentVersion = null;
-      try {
-        const current = JSON.parse(await fs11.readFile(this.filePath, "utf-8"));
-        currentVersion = current.version ?? 0;
-      } catch {
-        currentVersion = null;
-      }
-      if (currentVersion !== expectedVersion) {
-        throw new BranchMetadataConflictError();
-      }
-      await fs11.rename(tempPath, this.filePath);
-      const afterWrite = JSON.parse(await fs11.readFile(this.filePath, "utf-8"));
-      if (afterWrite.writeId !== writeId) {
+      saved = await withLock(this.filePath, () => withOccFileLock(this.filePath, () => withOccRetry(async () => {
+        const { meta: existing, version } = await this.load();
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const defaults = {
+          name: "unknown",
+          status: "editing",
+          access: {},
+          createdBy: "unknown",
+          createdAt: now,
+          updatedAt: now
+        };
+        const merged = {
+          schemaVersion: CURRENT_SCHEMA_VERSION,
+          version: version ?? 0,
+          branch: {
+            ...defaults,
+            ...existing?.branch,
+            ...incoming.branch,
+            access: {
+              ...existing?.branch?.access,
+              ...incoming.branch?.access
+            },
+            // Immutable after creation
+            createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
+            createdAt: existing?.branch.createdAt ?? defaults.createdAt,
+            // Fork point is recorded once at creation; later saves must not move it
+            baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
+          }
+        };
+        const written = await this.write(merged, version);
+        merged.version = written.version;
+        merged.writeId = written.writeId;
+        return merged;
+      })));
+    } catch (err) {
+      if (err instanceof OccWriteConflictError) {
         throw new BranchMetadataConflictError();
       }
-    } catch (err) {
-      await fs11.unlink(tempPath).catch(() => {
-      });
       throw err;
     }
-    return { version: newVersion, writeId };
-  }
-  async withRetry(operation, maxAttempts = 5) {
-    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-      try {
-        return await operation();
-      } catch (err) {
-        if (err instanceof BranchMetadataConflictError && attempt < maxAttempts) {
-          const baseDelay = Math.min(10 * Math.pow(2, attempt - 1), 100);
-          const jitter = Math.random() * baseDelay;
-          await new Promise((resolve) => setTimeout(resolve, baseDelay + jitter));
-          continue;
-        }
-        throw err;
-      }
-    }
-    throw new Error("Unreachable");
-  }
-  async save(incoming) {
-    return withLock(this.filePath, () => this.withRetry(async () => {
-      const { meta: existing, version } = await this.load();
-      const now = (/* @__PURE__ */ new Date()).toISOString();
-      const defaults = {
-        name: "unknown",
-        status: "editing",
-        access: {},
-        createdBy: "unknown",
-        createdAt: now,
-        updatedAt: now
-      };
-      const merged = {
-        schemaVersion: CURRENT_SCHEMA_VERSION,
-        version: version ?? 0,
-        branch: {
-          ...defaults,
-          ...existing?.branch,
-          ...incoming.branch,
-          access: {
-            ...existing?.branch?.access,
-            ...incoming.branch?.access
-          },
-          // Immutable after creation
-          createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
-          createdAt: existing?.branch.createdAt ?? defaults.createdAt,
-          // Fork point is recorded once at creation; later saves must not move it
-          baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
-        }
-      };
-      const written = await this.write(merged, version);
-      merged.version = written.version;
-      merged.writeId = written.writeId;
-      await this.invalidateRegistry();
-      return merged;
-    }));
+    await this.invalidateRegistry();
+    return saved;
   }
   /**
    * Invalidates the registry cache so next list() call regenerates from branch.json files.
@@ -3691,8 +4108,8 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     await registry2.invalidate();
   }
 };
-var getBranchMetadataFileManager = (branchRoot, baseRoot) => {
-  return BranchMetadataFileManager.get(branchRoot, baseRoot);
+var getBranchMetadataFileManager = (branchRoot, baseRoot, options) => {
+  return BranchMetadataFileManager.get(branchRoot, baseRoot, options);
 };
 var loadBranchContext = async (options) => {
   const { branchRoot, baseRoot } = resolveBranchPath({
@@ -3715,8 +4132,8 @@ var loadBranchContext = async (options) => {
 init_operating_mode();
 
 // dist/git-manager.js
-import fs13 from "node:fs/promises";
-import path13 from "node:path";
+import fs14 from "node:fs/promises";
+import path14 from "node:path";
 import { simpleGit as simpleGit2 } from "simple-git";
 
 // dist/utils/git.js
@@ -3740,40 +4157,40 @@ async function resolveBaseBranch(options) {
 }
 
 // dist/utils/provisioning-lock.js
-import fs12 from "node:fs/promises";
-import path12 from "node:path";
-import lockfile from "proper-lockfile";
+import fs13 from "node:fs/promises";
+import path13 from "node:path";
+import lockfile2 from "proper-lockfile";
 async function acquireProvisioningLock(lockTargetDir, lockName) {
-  await fs12.mkdir(lockTargetDir, { recursive: true });
-  return lockfile.lock(lockTargetDir, {
-    lockfilePath: path12.join(lockTargetDir, lockName),
+  await fs13.mkdir(lockTargetDir, { recursive: true });
+  return lockfile2.lock(lockTargetDir, {
+    lockfilePath: path13.join(lockTargetDir, lockName),
     retries: { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true },
     stale: 3e4
   });
 }
 
 // dist/git-manager.js
-var log3 = createDebugLogger({ prefix: "GitManager" });
+var log5 = createDebugLogger({ prefix: "GitManager" });
 var remoteInitLocks = /* @__PURE__ */ new Map();
 async function ensureGitExcludePattern(repoPath, pattern) {
-  const excludePath = path13.join(repoPath, ".git", "info", "exclude");
-  await fs13.mkdir(path13.dirname(excludePath), { recursive: true });
+  const excludePath = path14.join(repoPath, ".git", "info", "exclude");
+  await fs14.mkdir(path14.dirname(excludePath), { recursive: true });
   let content = "";
   try {
-    content = await fs13.readFile(excludePath, "utf-8");
+    content = await fs14.readFile(excludePath, "utf-8");
   } catch (err) {
     if (!isNotFoundError(err))
       throw err;
   }
   const lines = content.split("\n");
   if (lines.some((line) => line.trim() === pattern)) {
-    log3.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    log5.debug("git", "Pattern already in .git/info/exclude", { pattern });
     return;
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-  await fs13.writeFile(excludePath, newContent, "utf-8");
-  log3.debug("git", "Added pattern to .git/info/exclude", { pattern });
+  await fs14.writeFile(excludePath, newContent, "utf-8");
+  log5.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
 var GitConflictError = class extends Error {
   constructor(conflictedFiles) {
@@ -3784,22 +4201,22 @@ var GitConflictError = class extends Error {
 };
 var GitManager = class _GitManager {
   constructor(options, gitOptions) {
-    this.repoPath = path13.resolve(options.repoPath);
+    this.repoPath = path14.resolve(options.repoPath);
     this.baseBranch = options.baseBranch ?? "main";
     this.remote = options.remote ?? "origin";
     this.skipIndexMarker = options.skipIndexMarker ?? false;
     this.git = simpleGit2({ baseDir: this.repoPath, ...gitOptions });
-    this.git.env("GIT_CEILING_DIRECTORIES", path13.dirname(this.repoPath));
+    this.git.env("GIT_CEILING_DIRECTORIES", path14.dirname(this.repoPath));
   }
   static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
-    log3.debug("git", "Cloning repository", {
+    log5.debug("git", "Cloning repository", {
       remoteUrl,
       targetPath,
       baseBranch
     });
     const git = simpleGit2();
     await git.clone(remoteUrl, targetPath, ["--branch", baseBranch, "--single-branch"]);
-    log3.debug("git", "Clone complete");
+    log5.debug("git", "Clone complete");
   }
   /**
    * Initializes a local bare git repository to simulate a remote for dev mode.
@@ -3819,30 +4236,30 @@ var GitManager = class _GitManager {
   static async ensureLocalSimulatedRemote(options) {
     const existingLock = remoteInitLocks.get(options.remotePath);
     if (existingLock) {
-      log3.debug("git", "Waiting for existing remote initialization", {
+      log5.debug("git", "Waiting for existing remote initialization", {
         remotePath: options.remotePath
       });
       await existingLock;
     }
-    const lockPromise = log3.timed("git", "ensureLocalSimulatedRemote", async () => {
+    const lockPromise = log5.timed("git", "ensureLocalSimulatedRemote", async () => {
       let releaseLock;
       try {
-        log3.debug("git", "Initializing local simulated remote", {
+        log5.debug("git", "Initializing local simulated remote", {
           remotePath: options.remotePath,
           baseBranch: options.baseBranch
         });
-        const remoteParent = path13.dirname(options.remotePath);
+        const remoteParent = path14.dirname(options.remotePath);
         releaseLock = await acquireProvisioningLock(remoteParent, ".remote-init.lock");
         let remoteExists = false;
         try {
-          const stat = await fs13.stat(options.remotePath);
+          const stat = await fs14.stat(options.remotePath);
           remoteExists = stat.isDirectory();
         } catch (err) {
           if (!isNotFoundError(err))
             throw err;
         }
         if (remoteExists && await _GitManager.bareRemoteHasBranch(options.remotePath, options.baseBranch)) {
-          log3.debug("git", "Remote already has base branch, skipping");
+          log5.debug("git", "Remote already has base branch, skipping");
           return;
         }
         let gitRoot = options.sourcePath;
@@ -3861,8 +4278,8 @@ var GitManager = class _GitManager {
         }
         let hasCommits = false;
         try {
-          const log5 = await sourceGit.log(["-1"]);
-          hasCommits = log5.total > 0;
+          const log8 = await sourceGit.log(["-1"]);
+          hasCommits = log8.total > 0;
         } catch {
           hasCommits = false;
         }
@@ -3874,12 +4291,12 @@ var GitManager = class _GitManager {
           throw new Error(`Cannot initialize local simulated remote: base branch '${options.baseBranch}' does not exist locally. Please checkout '${options.baseBranch}' first or provide an explicit remoteUrl.`);
         }
         if (remoteExists) {
-          log3.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
+          log5.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
             remotePath: options.remotePath,
             baseBranch: options.baseBranch
           });
         } else {
-          log3.debug("git", "Creating bare remote repository");
+          log5.debug("git", "Creating bare remote repository");
           await simpleGit2().raw([
             "init",
             "--bare",
@@ -3893,13 +4310,13 @@ var GitManager = class _GitManager {
           baseBranch: options.baseBranch,
           subdirectory: options.subdirectory
         });
-        log3.debug("git", "Remote initialization complete");
+        log5.debug("git", "Remote initialization complete");
       } finally {
         if (releaseLock) {
           try {
             await releaseLock();
           } catch (err) {
-            log3.debug("git", "Failed to release remote-init lock", { err });
+            log5.debug("git", "Failed to release remote-init lock", { err });
           }
         }
         remoteInitLocks.delete(options.remotePath);
@@ -3998,7 +4415,7 @@ var GitManager = class _GitManager {
    */
   static async validateGitRepoExists(repoPath) {
     try {
-      const stat = await fs13.stat(path13.join(repoPath, ".git"));
+      const stat = await fs14.stat(path14.join(repoPath, ".git"));
       if (!stat.isDirectory()) {
         throw new Error(`Expected git repo at ${repoPath}`);
       }
@@ -4036,9 +4453,9 @@ var GitManager = class _GitManager {
       return process.env[config.envVarName];
     if (config.autoDetectRemotePath) {
       try {
-        const stat = await fs13.stat(config.autoDetectRemotePath);
+        const stat = await fs14.stat(config.autoDetectRemotePath);
         if (stat.isDirectory()) {
-          log3.debug("git", "Auto-detected local remote", {
+          log5.debug("git", "Auto-detected local remote", {
             path: config.autoDetectRemotePath
           });
           return config.autoDetectRemotePath;
@@ -4049,8 +4466,8 @@ var GitManager = class _GitManager {
     if (config.shouldAutoInitLocal) {
       const gitRoot = await this.findGitRoot();
       const sourceRoot = options.sourceRoot;
-      const sourcePath = sourceRoot ? path13.resolve(gitRoot, sourceRoot) : gitRoot;
-      const localRemotePath = path13.join(sourcePath, config.defaultRemotePath);
+      const sourcePath = sourceRoot ? path14.resolve(gitRoot, sourceRoot) : gitRoot;
+      const localRemotePath = path14.join(sourcePath, config.defaultRemotePath);
       await this.ensureLocalSimulatedRemote({
         remotePath: localRemotePath,
         sourcePath: gitRoot,
@@ -4076,24 +4493,24 @@ var GitManager = class _GitManager {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: options.baseBranch,
       mode: options.mode,
-      detectFrom: options.sourceRoot ? path13.resolve(process.cwd(), options.sourceRoot) : process.cwd()
+      detectFrom: options.sourceRoot ? path14.resolve(process.cwd(), options.sourceRoot) : process.cwd()
     });
     const remoteName = options.remoteName ?? "origin";
     let repoExists = false;
     try {
       const checkGit = simpleGit2({ baseDir: options.workspacePath });
-      checkGit.env("GIT_CEILING_DIRECTORIES", path13.dirname(options.workspacePath));
+      checkGit.env("GIT_CEILING_DIRECTORIES", path14.dirname(options.workspacePath));
       await checkGit.raw(["rev-parse", "--git-dir"]);
       repoExists = true;
     } catch {
-      const gitPath = path13.join(options.workspacePath, ".git");
+      const gitPath = path14.join(options.workspacePath, ".git");
       try {
-        const stat = await fs13.stat(gitPath);
+        const stat = await fs14.stat(gitPath);
         if (stat.isDirectory()) {
-          log3.debug("git", "Removing corrupt .git directory", {
+          log5.debug("git", "Removing corrupt .git directory", {
             workspacePath: options.workspacePath
           });
-          await fs13.rm(gitPath, { recursive: true });
+          await fs14.rm(gitPath, { recursive: true });
         }
       } catch (cleanupErr) {
         if (!isNotFoundError(cleanupErr))
@@ -4119,7 +4536,7 @@ var GitManager = class _GitManager {
       }
       justCloned = true;
       const freshGit = simpleGit2({ baseDir: options.workspacePath });
-      freshGit.env("GIT_CEILING_DIRECTORIES", path13.dirname(options.workspacePath));
+      freshGit.env("GIT_CEILING_DIRECTORIES", path14.dirname(options.workspacePath));
       await freshGit.addConfig("canopycms.managed", "true");
       await freshGit.addConfig("user.name", options.gitBotAuthorName);
       await freshGit.addConfig("user.email", options.gitBotAuthorEmail);
@@ -4133,7 +4550,7 @@ var GitManager = class _GitManager {
     await git.git.addConfig("canopycms.managed", "true");
     await git.git.addConfig("user.name", options.gitBotAuthorName);
     await git.git.addConfig("user.email", options.gitBotAuthorEmail);
-    log3.debug("git", "Marked workspace as CanopyCMS-managed", {
+    log5.debug("git", "Marked workspace as CanopyCMS-managed", {
       workspacePath: options.workspacePath
     });
     if (!justCloned) {
@@ -4169,23 +4586,28 @@ var GitManager = class _GitManager {
     };
   }
   /**
-   * Mark ContentStore ID indexes rooted at (or under) this repo as stale.
-   * Called after operations that mutate the working tree (checkout/merge/rebase) so
-   * ID→path lookups don't keep resolving to pre-mutation paths. Invoked in `finally`
-   * blocks because even failed merges/rebases may have touched the tree before
-   * aborting; over-invalidating is safe.
+   * Mark ContentStore ID indexes AND the resolved-schema cache rooted at (or
+   * under) this repo as stale. Called after operations that mutate the
+   * working tree (checkout/merge/rebase) so ID→path lookups don't keep
+   * resolving to pre-mutation paths, and so a rebase/checkout that pulled in
+   * upstream `.collection.json` changes doesn't leave the schema cache
+   * pinned to the pre-mutation schema. Invoked in `finally` blocks because
+   * even failed merges/rebases may have touched the tree before aborting;
+   * over-invalidating is safe.
    *
-   * Covers both scopes: in-process stores via the registry, and stores in OTHER
-   * processes sharing the filesystem (worker vs Lambda on EFS) via the on-disk
-   * generation marker — unless this manager targets a settings workspace
-   * (skipIndexMarker), where only the free in-process invalidation runs.
+   * Covers both scopes: in-process stores/caches via their registries, and
+   * consumers in OTHER processes sharing the filesystem (worker vs Lambda on
+   * EFS) via the on-disk generation markers — unless this manager targets a
+   * settings workspace (skipIndexMarker), where only the free in-process
+   * content-index invalidation runs and NEITHER marker is bumped (settings
+   * workspaces have no schema cache of their own either).
    */
   async invalidateContentIndexes() {
     if (this.skipIndexMarker) {
       invalidateContentIndexesForRoot(this.repoPath);
       return;
     }
-    await invalidateContentIndexesDurable(this.repoPath);
+    await invalidateBranchContentCaches(this.repoPath);
   }
   async checkoutBranch(branch) {
     try {
@@ -4411,10 +4833,10 @@ var GitManager = class _GitManager {
     }
   }
   async createOrphanSettingsBranchInner(branchName, initialFiles) {
-    log3.debug("git", "Creating orphan settings branch", { branchName });
+    log5.debug("git", "Creating orphan settings branch", { branchName });
     const branches = await this.git.branch();
     if (branches.all.includes(branchName)) {
-      log3.debug("git", "Orphan branch already exists", { branchName });
+      log5.debug("git", "Orphan branch already exists", { branchName });
       await this.git.checkout(branchName);
       return;
     }
@@ -4424,25 +4846,25 @@ var GitManager = class _GitManager {
     } catch {
     }
     for (const [filePath, content] of Object.entries(initialFiles)) {
-      const absolutePath = path13.join(this.repoPath, filePath);
-      await fs13.mkdir(path13.dirname(absolutePath), { recursive: true });
-      await fs13.writeFile(absolutePath, content, "utf-8");
+      const absolutePath = path14.join(this.repoPath, filePath);
+      await fs14.mkdir(path14.dirname(absolutePath), { recursive: true });
+      await fs14.writeFile(absolutePath, content, "utf-8");
       await this.git.add(filePath);
     }
     await this.git.commit("Initialize settings branch", ["--allow-empty"]);
-    log3.debug("git", "Orphan settings branch created", { branchName });
+    log5.debug("git", "Orphan settings branch created", { branchName });
   }
 };
 
 // dist/branch-workspace.js
-var log4 = createDebugLogger({ prefix: "BranchWorkspace" });
+var log6 = createDebugLogger({ prefix: "BranchWorkspace" });
 var workspaceInitLocks = /* @__PURE__ */ new Map();
 var BranchWorkspaceManager = class {
   constructor(config) {
     this.config = config;
   }
   async ensureGitWorkspace(options) {
-    return log4.timed("workspace", "ensureGitWorkspace", async () => {
+    return log6.timed("workspace", "ensureGitWorkspace", async () => {
       const existingLock = workspaceInitLocks.get(options.branchRoot);
       if (existingLock) {
         await existingLock;
@@ -4451,11 +4873,11 @@ var BranchWorkspaceManager = class {
       const lockPromise = (async () => {
         let releaseLock;
         try {
-          log4.debug("workspace", "Ensuring git workspace", {
+          log6.debug("workspace", "Ensuring git workspace", {
             branchName: options.branchName,
             mode: options.mode
           });
-          releaseLock = await acquireProvisioningLock(path14.dirname(options.branchRoot), `.${path14.basename(options.branchRoot)}.init.lock`);
+          releaseLock = await acquireProvisioningLock(path15.dirname(options.branchRoot), `.${path15.basename(options.branchRoot)}.init.lock`);
           await GitManager.initializeWorkspace({
             workspacePath: options.branchRoot,
             branchName: options.branchName,
@@ -4475,7 +4897,7 @@ var BranchWorkspaceManager = class {
             try {
               await releaseLock();
             } catch (err) {
-              log4.debug("workspace", "Failed to release workspace-init lock", { err });
+              log6.debug("workspace", "Failed to release workspace-init lock", { err });
             }
           }
           workspaceInitLocks.delete(options.branchRoot);
@@ -4495,7 +4917,7 @@ var BranchWorkspaceManager = class {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: this.config.defaultBaseBranch,
       mode,
-      detectFrom: this.config.sourceRoot ? path14.resolve(process.cwd(), this.config.sourceRoot) : void 0
+      detectFrom: this.config.sourceRoot ? path15.resolve(process.cwd(), this.config.sourceRoot) : void 0
     });
     await this.ensureGitWorkspace({
       branchRoot,
@@ -4578,6 +5000,384 @@ async function resolveBranchRoot(config) {
   return context.branchRoot;
 }
 
+// dist/content-listing.js
+import fs15 from "node:fs/promises";
+import path16 from "node:path";
+import matter2 from "gray-matter";
+import { parse as yamlParse2 } from "yaml";
+var log7 = createDebugLogger({ prefix: "ContentListing" });
+var normalizePath = (root, target) => {
+  const result = validateAndNormalizePath(root, target);
+  if (!result.valid) {
+    throw new ContentStoreError(result.error || "Path traversal detected", "VALIDATION");
+  }
+  return result.normalizedPath;
+};
+var readEntryData = async (filePath, format, bodyFieldName = "body") => {
+  try {
+    const raw = await fs15.readFile(filePath, "utf8");
+    if (format === "json") {
+      return asRecord(JSON.parse(raw));
+    }
+    if (format === "yaml") {
+      return asRecord(yamlParse2(raw));
+    }
+    const parsed = matter2(raw);
+    const data = parsed.data ?? {};
+    if (parsed.content) {
+      data[bodyFieldName] = parsed.content;
+    }
+    return data;
+  } catch (err) {
+    if (isNotFoundError(err))
+      return {};
+    log7.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage(err)}`);
+    return {};
+  }
+};
+var parseTypedFilename = (filename, entryTypes) => {
+  const lastDot = filename.lastIndexOf(".");
+  if (lastDot === -1)
+    return null;
+  const nameWithoutExt = filename.slice(0, lastDot);
+  const parts = nameWithoutExt.split(".");
+  if (parts.length >= 3) {
+    const potentialType = parts[0];
+    const matchingType = entryTypes.find((e) => e.name === potentialType);
+    if (matchingType) {
+      const id = parts[parts.length - 1];
+      if (!isValidId(id))
+        return null;
+      const slug = parts.slice(1, -1).join(".").toLowerCase();
+      return {
+        type: potentialType,
+        slug,
+        id
+      };
+    }
+  }
+  return null;
+};
+async function listEntries(branchRoot, flatSchema, contentRootName, options) {
+  const rootPath = options?.rootPath ?? contentRootName;
+  const extract = options?.extract;
+  const filter = options?.filter;
+  const customSort = options?.sort;
+  const collections = flatSchema.filter((item) => item.type === "collection" && item.entries !== void 0 && (item.logicalPath === rootPath || item.logicalPath.startsWith(`${rootPath}/`)));
+  const collectionResults = await Promise.all(collections.map(async (collection) => {
+    const entries = await listCollectionEntries(branchRoot, collection);
+    return entries.map((entry) => ({ entry, collection }));
+  }));
+  const contentPrefix = contentRootName ? `${contentRootName}/` : "";
+  const items = [];
+  for (const results of collectionResults) {
+    for (const { entry, collection } of results) {
+      const pathWithoutRoot = entry.logicalPath.startsWith(contentPrefix) ? entry.logicalPath.slice(contentPrefix.length) : entry.logicalPath;
+      const pathSegments = pathWithoutRoot.split("/").filter(Boolean);
+      const urlSegments = entry.slug === "index" ? pathSegments.slice(0, -1) : pathSegments;
+      const urlPath = urlSegments.length > 0 ? `/${urlSegments.join("/")}`.toLowerCase() : "/";
+      const raw = entry.data;
+      const meta = {
+        entryPath: entry.logicalPath,
+        entryType: entry.entryType,
+        format: entry.format
+      };
+      const data = extract ? extract(raw, meta) : raw;
+      const item = {
+        pathSegments,
+        urlPath,
+        slug: entry.slug,
+        entryPath: entry.logicalPath,
+        entryId: entry.contentId,
+        collectionId: collection.contentId,
+        collectionPath: entry.collectionPath,
+        entryType: entry.entryType,
+        format: entry.format,
+        data,
+        schema: collection.entries?.find((e) => e.name === entry.entryType)?.schema
+      };
+      if (filter && !filter(item))
+        continue;
+      items.push(item);
+    }
+  }
+  if (customSort) {
+    items.sort(customSort);
+  } else {
+    items.sort((a, b) => a.entryPath.localeCompare(b.entryPath));
+  }
+  return items;
+}
+var listCollectionEntries = async (root, collection) => {
+  if (collection.type !== "collection" || !collection.entries) {
+    return [];
+  }
+  const entryTypes = collection.entries;
+  const extToTypes = /* @__PURE__ */ new Map();
+  for (const entryType of entryTypes) {
+    const ext = getFormatExtension(entryType.format);
+    const existing = extToTypes.get(ext) || [];
+    existing.push(entryType);
+    extToTypes.set(ext, existing);
+  }
+  const validExts = Array.from(extToTypes.keys());
+  const collectionRoot = await resolveCollectionPath(root, collection.logicalPath);
+  if (!collectionRoot) {
+    return [];
+  }
+  normalizePath(root, collectionRoot);
+  let dirents;
+  try {
+    dirents = await fs15.readdir(collectionRoot, { withFileTypes: true });
+  } catch (err) {
+    if (isNotFoundError(err))
+      return [];
+    throw err;
+  }
+  const files = dirents.filter((d) => d.isFile() && validExts.some((ext) => d.name.endsWith(ext)) && d.name !== ".collection.json").sort((a, b) => a.name.localeCompare(b.name));
+  const entries = await Promise.all(files.map(async (file) => {
+    const absolutePath = path16.join(collectionRoot, file.name);
+    const relativePath = normalizePath(root, absolutePath);
+    const parsed = parseTypedFilename(file.name, entryTypes);
+    if (!parsed) {
+      log7.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
+      return null;
+    }
+    const { type: entryTypeName, slug, id: contentId } = parsed;
+    const entryType = entryTypes.find((e) => e.name === entryTypeName);
+    const format = entryType?.format || "json";
+    const bodyField = entryType?.schema ? findBodyFieldName(entryType.schema) : "body";
+    const [stats, data] = await Promise.all([
+      fs15.stat(absolutePath),
+      readEntryData(absolutePath, format, bodyField)
+    ]);
+    const item = {
+      logicalPath: `${collection.logicalPath}/${slug}`,
+      contentId,
+      slug,
+      collectionPath: collection.logicalPath,
+      collectionName: collection.name,
+      format,
+      entryType: entryTypeName,
+      physicalPath: relativePath,
+      data,
+      updatedAt: stats.mtime.toISOString()
+    };
+    return item;
+  }));
+  return entries.filter((e) => e !== null);
+};
+
+// dist/validation/entry-validator.js
+init_config2();
+
+// dist/validation/field-traversal.js
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function resolveBlockItem(blockField, item) {
+  const templateName = typeof item.template === "string" ? item.template : typeof item._type === "string" ? item._type : void 0;
+  if (!templateName)
+    return void 0;
+  const template = blockField.templates?.find((t) => t.name === templateName);
+  if (!template?.fields)
+    return void 0;
+  const data = isPlainRecord(item.value) ? item.value : item;
+  return { fields: template.fields, data };
+}
+
+// dist/validation/entry-validator.js
+var KNOWN_FIELD_TYPES = new Set(fieldTypes);
+var STRING_FIELD_TYPES = /* @__PURE__ */ new Set(["string", "rich-text", "markdown", "mdx", "image", "code"]);
+function isPlainRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function referenceValueId(value) {
+  if (typeof value === "string")
+    return value;
+  if (isPlainRecord2(value) && typeof value.id === "string")
+    return value.id;
+  return void 0;
+}
+var selectOptionValues = (field) => (field.options ?? []).map((opt) => typeof opt === "string" ? opt : opt.value);
+function validateScalar(field, value, path19) {
+  switch (field.type) {
+    case "number":
+      if (typeof value !== "number" || !Number.isFinite(value)) {
+        return [{ fieldPath: path19, message: "Expected a number" }];
+      }
+      return [];
+    case "boolean":
+      if (typeof value !== "boolean") {
+        return [{ fieldPath: path19, message: "Expected true or false" }];
+      }
+      return [];
+    case "datetime":
+      if (typeof value !== "string" || value !== "" && Number.isNaN(Date.parse(value))) {
+        return [{ fieldPath: path19, message: "Expected a valid date/time string" }];
+      }
+      return [];
+    case "select": {
+      if (typeof value !== "string") {
+        return [{ fieldPath: path19, message: "Expected a selection" }];
+      }
+      const options = selectOptionValues(field);
+      if (value !== "" && !options.includes(value)) {
+        return [{ fieldPath: path19, message: `Must be one of: ${options.join(", ")}` }];
+      }
+      return [];
+    }
+    case "reference":
+      if (referenceValueId(value) === void 0) {
+        return [{ fieldPath: path19, message: "Expected a reference id" }];
+      }
+      return [];
+    default:
+      if (STRING_FIELD_TYPES.has(field.type)) {
+        if (typeof value !== "string") {
+          return [{ fieldPath: path19, message: "Expected text" }];
+        }
+      }
+      return [];
+  }
+}
+function isEmptyForRequired(field, value) {
+  if (value === void 0 || value === null)
+    return true;
+  if (Array.isArray(value))
+    return value.length === 0;
+  if (typeof value === "string") {
+    return value.trim() === "";
+  }
+  return false;
+}
+function validateEntryData(fields, data, pathPrefix = "") {
+  const errors = [];
+  for (const field of fields) {
+    if (field.type === "group") {
+      errors.push(...validateEntryData(field.fields, data, pathPrefix));
+      continue;
+    }
+    const path19 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
+    const value = data[field.name];
+    const isRequired = "required" in field && field.required === true;
+    if (isRequired && isEmptyForRequired(field, value)) {
+      const message = Array.isArray(value) ? "At least one item is required" : "This field is required";
+      errors.push({ fieldPath: path19, message });
+      continue;
+    }
+    if (value === void 0 || value === null)
+      continue;
+    if (field.type === "block") {
+      const blockField = field;
+      if (!Array.isArray(value)) {
+        errors.push({ fieldPath: path19, message: "Expected a list of blocks" });
+        continue;
+      }
+      value.forEach((item, index) => {
+        const itemPath = `${path19}[${index}]`;
+        if (!isPlainRecord2(item)) {
+          errors.push({ fieldPath: itemPath, message: "Expected a block object" });
+          return;
+        }
+        const resolved = resolveBlockItem(blockField, item);
+        if (!resolved) {
+          const template = typeof item.template === "string" ? item.template : void 0;
+          errors.push({
+            fieldPath: itemPath,
+            message: template ? `Unknown block template "${template}"` : "Missing block template"
+          });
+          return;
+        }
+        errors.push(...validateEntryData(resolved.fields, resolved.data, itemPath));
+      });
+      continue;
+    }
+    if (field.type === "object") {
+      const objectField = field;
+      if (objectField.list) {
+        if (!Array.isArray(value)) {
+          errors.push({ fieldPath: path19, message: "Expected a list of items" });
+          continue;
+        }
+        value.forEach((item, index) => {
+          const itemPath = `${path19}[${index}]`;
+          if (!isPlainRecord2(item)) {
+            errors.push({ fieldPath: itemPath, message: "Expected an object" });
+            return;
+          }
+          if (objectField.fields) {
+            errors.push(...validateEntryData(objectField.fields, item, itemPath));
+          }
+        });
+      } else if (!isPlainRecord2(value)) {
+        errors.push({ fieldPath: path19, message: "Expected an object" });
+      } else if (objectField.fields) {
+        errors.push(...validateEntryData(objectField.fields, value, path19));
+      }
+      continue;
+    }
+    if ("list" in field && field.list) {
+      if (!Array.isArray(value)) {
+        errors.push({ fieldPath: path19, message: "Expected a list of values" });
+        continue;
+      }
+      value.forEach((item, index) => {
+        errors.push(...validateScalar(field, item, `${path19}[${index}]`));
+      });
+      continue;
+    }
+    if (Array.isArray(value) && KNOWN_FIELD_TYPES.has(field.type)) {
+      errors.push({ fieldPath: path19, message: "Expected a single value, not a list" });
+      continue;
+    }
+    errors.push(...validateScalar(field, value, path19));
+  }
+  return errors;
+}
+
+// dist/static/index.js
+function normalizeDatesDeep(value) {
+  if (value instanceof Date)
+    return value.toISOString();
+  if (Array.isArray(value))
+    return value.map(normalizeDatesDeep);
+  if (value && typeof value === "object") {
+    const result = {};
+    for (const [key, v] of Object.entries(value)) {
+      result[key] = normalizeDatesDeep(v);
+    }
+    return result;
+  }
+  return value;
+}
+function findInvalidEntries(items) {
+  const invalid = [];
+  for (const item of items) {
+    if (!item.schema)
+      continue;
+    const data = normalizeDatesDeep(item.data);
+    const errors = validateEntryData(item.schema, data);
+    if (errors.length > 0) {
+      invalid.push({ entryPath: item.entryPath, errors });
+    }
+  }
+  return invalid;
+}
+function assertBuildEntriesValid(items, phaseLabel) {
+  const invalid = findInvalidEntries(items);
+  if (invalid.length === 0)
+    return;
+  const lines = invalid.map(({ entryPath, errors }) => {
+    const [first, ...rest] = errors;
+    const summary = rest.length > 0 ? `${first.fieldPath}: ${first.message} (+${rest.length} more)` : `${first.fieldPath}: ${first.message}`;
+    return `  - ${entryPath} \u2014 ${summary}`;
+  });
+  throw new Error(`CanopyCMS static build: found ${invalid.length} schema-invalid ${invalid.length === 1 ? "entry" : "entries"} during ${phaseLabel}:
+${lines.join("\n")}
+These are likely abandoned create-scaffolds (empty entries left behind when a create was started but never finished). Finish editing the entry (fill in its required fields) or delete the abandoned draft, then rebuild.`);
+}
+
 // dist/build/generate-ai-content.js
 async function generateAIContentFiles(options) {
   const { config, entrySchemaRegistry, outputDir, aiConfig, _testFlatSchema } = options;
@@ -4591,6 +5391,8 @@ async function generateAIContentFiles(options) {
     const cached = await schemaCache.getSchema(branchRoot, entrySchemaRegistry, contentRootName);
     flatSchema = cached.flatSchema;
   }
+  const entriesForValidation = await listEntries(branchRoot, flatSchema, contentRootName);
+  assertBuildEntriesValid(entriesForValidation, "AI content generation");
   const store = new ContentStore(branchRoot, flatSchema);
   const result = await generateAIContent({
     store,
@@ -4599,15 +5401,15 @@ async function generateAIContentFiles(options) {
     config: aiConfig,
     entryLinkUrl: config.entryLinkUrl
   });
-  const absoluteOutputDir = path15.resolve(outputDir) + path15.sep;
+  const absoluteOutputDir = path17.resolve(outputDir) + path17.sep;
   let fileCount = 0;
   for (const [filePath, content] of result.files) {
-    const absolutePath = path15.resolve(path15.join(absoluteOutputDir, filePath));
+    const absolutePath = path17.resolve(path17.join(absoluteOutputDir, filePath));
     if (!absolutePath.startsWith(absoluteOutputDir)) {
       throw new Error(`Path traversal detected in AI content output: ${filePath}`);
     }
-    await fs14.mkdir(path15.dirname(absolutePath), { recursive: true });
-    await fs14.writeFile(absolutePath, content, "utf-8");
+    await fs16.mkdir(path17.dirname(absolutePath), { recursive: true });
+    await fs16.writeFile(absolutePath, content, "utf-8");
     fileCount++;
   }
   return { fileCount, outputDir: absoluteOutputDir };
@@ -4618,7 +5420,7 @@ var jiti = createJiti(import.meta.url);
 async function generateAIContentCLI(options) {
   const { projectDir, outputDir = "public/ai", configPath, appDir = "app" } = options;
   console.log("\nCanopyCMS generate-ai-content\n");
-  const canopyConfigPath = path16.join(projectDir, "canopycms.config.ts");
+  const canopyConfigPath = path18.join(projectDir, "canopycms.config.ts");
   let canopyConfigModule;
   try {
     canopyConfigModule = await jiti.import(canopyConfigPath);
@@ -4629,7 +5431,7 @@ async function generateAIContentCLI(options) {
   }
   const configExport = canopyConfigModule.default ?? canopyConfigModule.config ?? canopyConfigModule;
   const serverConfig = typeof configExport === "object" && configExport !== null && "server" in configExport ? configExport.server : configExport;
-  const schemasPath = path16.join(projectDir, appDir, "schemas.ts");
+  const schemasPath = path18.join(projectDir, appDir, "schemas.ts");
   let entrySchemaRegistry = {};
   try {
     const schemasModule = await jiti.import(schemasPath);
@@ -4640,7 +5442,7 @@ async function generateAIContentCLI(options) {
   let aiConfig;
   if (configPath) {
     try {
-      const aiConfigModule = await jiti.import(path16.resolve(configPath));
+      const aiConfigModule = await jiti.import(path18.resolve(configPath));
       aiConfig = aiConfigModule.aiContentConfig ?? aiConfigModule.default ?? aiConfigModule.config;
     } catch (err) {
       console.error(`Could not load AI config from ${configPath}`);
@@ -4657,7 +5459,7 @@ async function generateAIContentCLI(options) {
     console.error("Make sure canopycms.config.ts uses defineCanopyConfig().");
     process.exit(1);
   }
-  const resolvedOutput = path16.resolve(projectDir, outputDir);
+  const resolvedOutput = path18.resolve(projectDir, outputDir);
   console.log(`  Output: ${resolvedOutput}`);
   console.log(`  Mode: ${serverConfig.mode ?? "dev"}`);
   const result = await generateAIContentFiles({