canopycms 0.0.59 → 0.0.60

package/dist/cli/cli.js

@@ -794,7 +794,7 @@ CanopyCMS worker run-once (mode: ${mode}, auth: ${authMode})
   }
   console.log("\nDone");
 }
-var __defProp2, __getOwnPropNames2, __esm2, __export2, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_validation, init_helpers, init_config2, templates_exports, __dirname, TEMPLATES_DIR, init_templates, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, ProdStrategy, DevStrategy, strategyCache;
+var __defProp2, __getOwnPropNames2, __esm2, __export2, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_validation, init_helpers, init_config2, templates_exports, __dirname, TEMPLATES_DIR, init_templates, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, ProdStrategy, DevStrategy, strategyCache;
 var init_init = __esm({
   "dist/cli/init.js"() {
     "use strict";
@@ -980,7 +980,13 @@ var init_init = __esm({
         init_collection();
         init_media();
         defaultBranchAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-        defaultPathAccessSchema = z4.enum(["allow", "deny"]).default("deny");
+        defaultPathAccessLevelSchema = z4.enum(["allow", "deny"]);
+        defaultPathAccessLevelsSchema = z4.object({
+          read: defaultPathAccessLevelSchema.optional(),
+          edit: defaultPathAccessLevelSchema.optional(),
+          review: defaultPathAccessLevelSchema.optional()
+        }).strict();
+        defaultPathAccessSchema = z4.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
         defaultBaseBranchSchema = z4.string().default("main");
         defaultRemoteNameSchema = z4.string().default("origin");
         defaultRemoteUrlSchema = z4.string().min(1);
@@ -1013,6 +1019,10 @@ var init_init = __esm({
           // have .default('deny'), so the field is optional on input but always resolves to
           // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
           // before the inner default runs, defeating the fail-closed default (SCH-M1).
+          // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+          // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+          // still resolves to 'deny' and an omitted level inside the object form stays undefined
+          // (resolved to 'deny' at read time by resolveDefaultPathAccess).
           defaultBranchAccess: defaultBranchAccessSchema,
           defaultPathAccess: defaultPathAccessSchema,
           // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -3560,7 +3570,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_validation2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, log5, GIT_ENV_PASSTHROUGH, remoteInitLocks, GitConflictError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_validation2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, log5, GIT_ENV_PASSTHROUGH, remoteInitLocks, GitConflictError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -3924,7 +3934,13 @@ var init_generate_ai_content = __esm({
         init_collection2();
         init_media2();
         defaultBranchAccessSchema2 = z52.enum(["allow", "deny"]).default("deny");
-        defaultPathAccessSchema2 = z52.enum(["allow", "deny"]).default("deny");
+        defaultPathAccessLevelSchema2 = z52.enum(["allow", "deny"]);
+        defaultPathAccessLevelsSchema2 = z52.object({
+          read: defaultPathAccessLevelSchema2.optional(),
+          edit: defaultPathAccessLevelSchema2.optional(),
+          review: defaultPathAccessLevelSchema2.optional()
+        }).strict();
+        defaultPathAccessSchema2 = z52.union([defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2]).default("deny");
         defaultBaseBranchSchema2 = z52.string().default("main");
         defaultRemoteNameSchema2 = z52.string().default("origin");
         defaultRemoteUrlSchema2 = z52.string().min(1);
@@ -3957,6 +3973,10 @@ var init_generate_ai_content = __esm({
           // have .default('deny'), so the field is optional on input but always resolves to
           // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
           // before the inner default runs, defeating the fail-closed default (SCH-M1).
+          // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+          // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+          // still resolves to 'deny' and an omitted level inside the object form stays undefined
+          // (resolved to 'deny' at read time by resolveDefaultPathAccess).
           defaultBranchAccess: defaultBranchAccessSchema2,
           defaultPathAccess: defaultPathAccessSchema2,
           // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -5980,7 +6000,11 @@ var init_generate_ai_content = __esm({
                 createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
                 createdAt: existing?.branch.createdAt ?? defaults.createdAt,
                 // Fork point is recorded once at creation; later saves must not move it
-                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
+                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
+                // Always stamped fresh — the spreads above would otherwise let
+                // the existing (creation-time) value win forever, freezing the
+                // timestamp the editor's Branches panel sorts and displays by
+                updatedAt: now
               }
             };
             const written = await this.write(merged, version);
@@ -6450,6 +6474,7 @@ var init_generate_ai_content = __esm({
         }
         if (options.branchType === "orphan") {
           await git.createOrphanSettingsBranch(options.branchName, {});
+          await git.ensureGitExclude("*.lock");
         } else {
           await git.checkoutBranch(options.branchName);
           if (options.gitExcludePattern) {
@@ -7875,14 +7900,20 @@ var init_media3 = __esm({
 
 // dist/config/schemas/config.js
 import { z as z12 } from "zod";
-var defaultBranchAccessSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
+var defaultBranchAccessSchema3, defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
 var init_config4 = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection3();
     init_media3();
     defaultBranchAccessSchema3 = z12.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessSchema3 = z12.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema3 = z12.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema3 = z12.object({
+      read: defaultPathAccessLevelSchema3.optional(),
+      edit: defaultPathAccessLevelSchema3.optional(),
+      review: defaultPathAccessLevelSchema3.optional()
+    }).strict();
+    defaultPathAccessSchema3 = z12.union([defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3]).default("deny");
     defaultBaseBranchSchema3 = z12.string().default("main");
     defaultRemoteNameSchema3 = z12.string().default("origin");
     defaultRemoteUrlSchema3 = z12.string().min(1);
@@ -7915,6 +7946,10 @@ var init_config4 = __esm({
       // have .default('deny'), so the field is optional on input but always resolves to
       // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
       // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+      // still resolves to 'deny' and an omitted level inside the object form stays undefined
+      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
       defaultBranchAccess: defaultBranchAccessSchema3,
       defaultPathAccess: defaultPathAccessSchema3,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -8583,10 +8618,168 @@ var init_schema = __esm({
   }
 });
 
-// dist/branch-registry.js
+// dist/utils/async-mutex.js
+async function withLock2(key, fn) {
+  const prev = locks2.get(key) ?? Promise.resolve();
+  let resolve2;
+  const next = new Promise((r) => {
+    resolve2 = r;
+  });
+  locks2.set(key, next);
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    resolve2();
+    if (locks2.get(key) === next)
+      locks2.delete(key);
+  }
+}
+var locks2;
+var init_async_mutex = __esm({
+  "dist/utils/async-mutex.js"() {
+    "use strict";
+    locks2 = /* @__PURE__ */ new Map();
+  }
+});
+
+// dist/utils/occ-json-write.js
 import fs24 from "node:fs/promises";
 import path27 from "node:path";
-var log11, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
+import { randomUUID as randomUUID4 } from "node:crypto";
+import lockfile4 from "proper-lockfile";
+async function writeOccJsonFile2(filePath, payload, options) {
+  const { expectedVersion, settleMs = 50, trailingNewline = false } = options;
+  const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
+  const writeId = randomUUID4();
+  const data = { ...payload, version: newVersion, writeId };
+  const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
+  const dir = path27.dirname(filePath);
+  await fs24.mkdir(dir, { recursive: true });
+  const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  await fs24.writeFile(tempPath, content, "utf-8");
+  if (expectedVersion === null) {
+    try {
+      await fs24.link(tempPath, filePath);
+    } catch (err) {
+      await fs24.unlink(tempPath).catch(() => {
+      });
+      if (isFileExistsError(err)) {
+        throw new OccWriteConflictError2();
+      }
+      throw err;
+    }
+    await fs24.unlink(tempPath).catch(() => {
+    });
+    return { version: newVersion, writeId };
+  }
+  try {
+    let currentVersion = null;
+    try {
+      const current = JSON.parse(await fs24.readFile(filePath, "utf-8"));
+      currentVersion = current.version ?? 0;
+    } catch {
+      currentVersion = null;
+    }
+    if (currentVersion !== expectedVersion) {
+      throw new OccWriteConflictError2();
+    }
+    await fs24.rename(tempPath, filePath);
+    if (settleMs > 0) {
+      await new Promise((resolve2) => setTimeout(resolve2, settleMs));
+    }
+    const afterWrite = JSON.parse(await fs24.readFile(filePath, "utf-8"));
+    if (afterWrite.writeId !== writeId) {
+      throw new OccWriteConflictError2();
+    }
+  } catch (err) {
+    await fs24.unlink(tempPath).catch(() => {
+    });
+    throw err;
+  }
+  return { version: newVersion, writeId };
+}
+async function withOccRetry2(operation, options) {
+  const maxAttempts = options?.maxAttempts ?? 10;
+  const isRetryable = options?.isRetryable;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      return await operation();
+    } catch (err) {
+      const retryable = err instanceof OccWriteConflictError2 || (isRetryable?.(err) ?? false);
+      if (retryable && attempt < maxAttempts) {
+        const baseDelay = Math.min(10 * Math.pow(2, attempt - 1), 100);
+        const jitter = Math.random() * baseDelay;
+        await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error("Unreachable");
+}
+async function withOccFileLock2(filePath, fn) {
+  const dir = path27.dirname(filePath);
+  await fs24.mkdir(dir, { recursive: true });
+  const MAX_ATTEMPTS = 14;
+  let release = null;
+  for (let attempt = 1; release === null; attempt++) {
+    try {
+      release = await lockfile4.lock(filePath, {
+        lockfilePath: `${filePath}.lock`,
+        realpath: false,
+        stale: 1e4,
+        retries: 0,
+        // A compromised lock (the lock dir vanished or refresh failed
+        // mid-hold, e.g. the branch directory containing it was deleted)
+        // must not crash the process, which is proper-lockfile's default.
+        // Our critical sections are short and idempotent-on-conflict (OCC
+        // verify inside); log and let the section finish.
+        onCompromised: (err) => {
+          log11.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+            error: getErrorMessage(err)
+          });
+        }
+      });
+    } catch (err) {
+      const code = isNodeError(err) ? err.code : void 0;
+      const contended = code === "ELOCKED";
+      if (!contended || attempt >= MAX_ATTEMPTS) {
+        throw new OccWriteConflictError2(`Could not acquire file lock: ${getErrorMessage(err)}`);
+      }
+      const baseDelay = Math.min(50 * Math.pow(1.6, attempt - 1), 2e3);
+      const jitter = Math.random() * baseDelay;
+      await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    await release().catch((err) => {
+      log11.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
+    });
+  }
+}
+var log11, OccWriteConflictError2;
+var init_occ_json_write = __esm({
+  "dist/utils/occ-json-write.js"() {
+    "use strict";
+    init_error();
+    init_debug2();
+    log11 = createDebugLogger3({ prefix: "OccJsonWrite" });
+    OccWriteConflictError2 = class extends Error {
+      constructor(message = "Concurrent modification detected") {
+        super(message);
+        this.name = "OccWriteConflictError";
+      }
+    };
+  }
+});
+
+// dist/branch-registry.js
+import fs25 from "node:fs/promises";
+import path28 from "node:path";
+var log12, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
 var init_branch_registry = __esm({
   "dist/branch-registry.js"() {
     "use strict";
@@ -8594,7 +8787,7 @@ var init_branch_registry = __esm({
     init_error();
     init_debug2();
     init_resource_generation();
-    log11 = createDebugLogger3({ prefix: "BranchRegistry" });
+    log12 = createDebugLogger3({ prefix: "BranchRegistry" });
     REGISTRY_FILE2 = "branches.json";
     REGISTRY_STALE_FILE2 = "branches.stale.json";
     REGISTRY_TEMP_FILE2 = "branches.tmp.json";
@@ -8605,10 +8798,10 @@ var init_branch_registry = __esm({
       constructor(root) {
         this.regenInFlight = null;
         this.lastForcedRefreshMs = 0;
-        this.root = path27.resolve(root);
-        this.registryPath = path27.join(this.root, REGISTRY_FILE2);
-        this.stalePath = path27.join(this.root, REGISTRY_STALE_FILE2);
-        this.tempPath = path27.join(this.root, REGISTRY_TEMP_FILE2);
+        this.root = path28.resolve(root);
+        this.registryPath = path28.join(this.root, REGISTRY_FILE2);
+        this.stalePath = path28.join(this.root, REGISTRY_STALE_FILE2);
+        this.tempPath = path28.join(this.root, REGISTRY_TEMP_FILE2);
       }
       /**
        * Returns all branches. Uses the cached snapshot if its embedded generation
@@ -8617,7 +8810,7 @@ var init_branch_registry = __esm({
       async list() {
         let parsed;
         try {
-          const raw = await fs24.readFile(this.registryPath, "utf8");
+          const raw = await fs25.readFile(this.registryPath, "utf8");
           parsed = JSON.parse(raw);
         } catch (err) {
           if (isNotFoundError(err)) {
@@ -8680,7 +8873,7 @@ var init_branch_registry = __esm({
             });
           await this.regenerate();
         } catch (err) {
-          log11.warn("invalidate", "Eager regeneration after invalidate() failed", {
+          log12.warn("invalidate", "Eager regeneration after invalidate() failed", {
             error: getErrorMessage(err)
           });
         }
@@ -8706,7 +8899,7 @@ var init_branch_registry = __esm({
       async performRegenerate() {
         const read = await readResourceGeneration2(this.root, RESOURCE4);
         const branches = await this.scanBranchDirectories();
-        await fs24.unlink(this.stalePath).catch(() => {
+        await fs25.unlink(this.stalePath).catch(() => {
         });
         if (!read.ok) {
           return branches;
@@ -8717,12 +8910,12 @@ var init_branch_registry = __esm({
           generation: read.token
         };
         const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-        await fs24.mkdir(this.root, { recursive: true });
-        await fs24.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+        await fs25.mkdir(this.root, { recursive: true });
+        await fs25.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
         try {
-          await fs24.rename(uniqueTempPath, this.registryPath);
+          await fs25.rename(uniqueTempPath, this.registryPath);
         } catch (err) {
-          await fs24.unlink(uniqueTempPath).catch(() => {
+          await fs25.unlink(uniqueTempPath).catch(() => {
           });
           throw err;
         }
@@ -8736,12 +8929,12 @@ var init_branch_registry = __esm({
       async scanBranchDirectories() {
         const branches = [];
         try {
-          const entries = await fs24.readdir(this.root, { withFileTypes: true });
+          const entries = await fs25.readdir(this.root, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory() || entry.name.startsWith(".")) {
               continue;
             }
-            const branchRoot = path27.join(this.root, entry.name);
+            const branchRoot = path28.join(this.root, entry.name);
             const meta = await BranchMetadataFileManager2.loadOnly(branchRoot);
             if (meta) {
               branches.push({
@@ -8763,164 +8956,6 @@ var init_branch_registry = __esm({
   }
 });
 
-// dist/utils/async-mutex.js
-async function withLock2(key, fn) {
-  const prev = locks2.get(key) ?? Promise.resolve();
-  let resolve2;
-  const next = new Promise((r) => {
-    resolve2 = r;
-  });
-  locks2.set(key, next);
-  await prev;
-  try {
-    return await fn();
-  } finally {
-    resolve2();
-    if (locks2.get(key) === next)
-      locks2.delete(key);
-  }
-}
-var locks2;
-var init_async_mutex = __esm({
-  "dist/utils/async-mutex.js"() {
-    "use strict";
-    locks2 = /* @__PURE__ */ new Map();
-  }
-});
-
-// dist/utils/occ-json-write.js
-import fs25 from "node:fs/promises";
-import path28 from "node:path";
-import { randomUUID as randomUUID4 } from "node:crypto";
-import lockfile4 from "proper-lockfile";
-async function writeOccJsonFile2(filePath, payload, options) {
-  const { expectedVersion, settleMs = 50, trailingNewline = false } = options;
-  const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
-  const writeId = randomUUID4();
-  const data = { ...payload, version: newVersion, writeId };
-  const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
-  const dir = path28.dirname(filePath);
-  await fs25.mkdir(dir, { recursive: true });
-  const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs25.writeFile(tempPath, content, "utf-8");
-  if (expectedVersion === null) {
-    try {
-      await fs25.link(tempPath, filePath);
-    } catch (err) {
-      await fs25.unlink(tempPath).catch(() => {
-      });
-      if (isFileExistsError(err)) {
-        throw new OccWriteConflictError2();
-      }
-      throw err;
-    }
-    await fs25.unlink(tempPath).catch(() => {
-    });
-    return { version: newVersion, writeId };
-  }
-  try {
-    let currentVersion = null;
-    try {
-      const current = JSON.parse(await fs25.readFile(filePath, "utf-8"));
-      currentVersion = current.version ?? 0;
-    } catch {
-      currentVersion = null;
-    }
-    if (currentVersion !== expectedVersion) {
-      throw new OccWriteConflictError2();
-    }
-    await fs25.rename(tempPath, filePath);
-    if (settleMs > 0) {
-      await new Promise((resolve2) => setTimeout(resolve2, settleMs));
-    }
-    const afterWrite = JSON.parse(await fs25.readFile(filePath, "utf-8"));
-    if (afterWrite.writeId !== writeId) {
-      throw new OccWriteConflictError2();
-    }
-  } catch (err) {
-    await fs25.unlink(tempPath).catch(() => {
-    });
-    throw err;
-  }
-  return { version: newVersion, writeId };
-}
-async function withOccRetry2(operation, options) {
-  const maxAttempts = options?.maxAttempts ?? 10;
-  const isRetryable = options?.isRetryable;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    try {
-      return await operation();
-    } catch (err) {
-      const retryable = err instanceof OccWriteConflictError2 || (isRetryable?.(err) ?? false);
-      if (retryable && attempt < maxAttempts) {
-        const baseDelay = Math.min(10 * Math.pow(2, attempt - 1), 100);
-        const jitter = Math.random() * baseDelay;
-        await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw new Error("Unreachable");
-}
-async function withOccFileLock2(filePath, fn) {
-  const dir = path28.dirname(filePath);
-  await fs25.mkdir(dir, { recursive: true });
-  const MAX_ATTEMPTS = 14;
-  let release = null;
-  for (let attempt = 1; release === null; attempt++) {
-    try {
-      release = await lockfile4.lock(filePath, {
-        lockfilePath: `${filePath}.lock`,
-        realpath: false,
-        stale: 1e4,
-        retries: 0,
-        // A compromised lock (the lock dir vanished or refresh failed
-        // mid-hold, e.g. the branch directory containing it was deleted)
-        // must not crash the process, which is proper-lockfile's default.
-        // Our critical sections are short and idempotent-on-conflict (OCC
-        // verify inside); log and let the section finish.
-        onCompromised: (err) => {
-          log12.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
-            error: getErrorMessage(err)
-          });
-        }
-      });
-    } catch (err) {
-      const code = isNodeError(err) ? err.code : void 0;
-      const contended = code === "ELOCKED";
-      if (!contended || attempt >= MAX_ATTEMPTS) {
-        throw new OccWriteConflictError2(`Could not acquire file lock: ${getErrorMessage(err)}`);
-      }
-      const baseDelay = Math.min(50 * Math.pow(1.6, attempt - 1), 2e3);
-      const jitter = Math.random() * baseDelay;
-      await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
-    }
-  }
-  try {
-    return await fn();
-  } finally {
-    await release().catch((err) => {
-      log12.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
-    });
-  }
-}
-var log12, OccWriteConflictError2;
-var init_occ_json_write = __esm({
-  "dist/utils/occ-json-write.js"() {
-    "use strict";
-    init_error();
-    init_debug2();
-    log12 = createDebugLogger3({ prefix: "OccJsonWrite" });
-    OccWriteConflictError2 = class extends Error {
-      constructor(message = "Concurrent modification detected") {
-        super(message);
-        this.name = "OccWriteConflictError";
-      }
-    };
-  }
-});
-
 // dist/branch-metadata.js
 import fs26 from "node:fs/promises";
 import path29 from "node:path";
@@ -9071,7 +9106,11 @@ var init_branch_metadata = __esm({
                 createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
                 createdAt: existing?.branch.createdAt ?? defaults.createdAt,
                 // Fork point is recorded once at creation; later saves must not move it
-                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
+                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
+                // Always stamped fresh — the spreads above would otherwise let
+                // the existing (creation-time) value win forever, freezing the
+                // timestamp the editor's Branches panel sorts and displays by
+                updatedAt: now
               }
             };
             const written = await this.write(merged, version);
@@ -9256,15 +9295,31 @@ async function migrate(options) {
       return { opCount: 0 };
     }
   }
-  for (const op of ops) {
-    if (op.kind === "rename") {
-      await fs27.rename(op.from, op.to);
-    } else {
-      await fs27.writeFile(op.filePath, op.content, "utf-8");
+  const isBranchClone = Boolean(await BranchMetadataFileManager2.loadOnly(projectDir));
+  const applyOps = async () => {
+    for (const op of ops) {
+      if (op.kind === "rename") {
+        await fs27.rename(op.from, op.to);
+      } else {
+        await fs27.writeFile(op.filePath, op.content, "utf-8");
+      }
     }
+  };
+  if (isBranchClone) {
+    const lockPath = path30.join(projectDir, ".canopy-meta", "schema");
+    try {
+      await withLock2(lockPath, () => withOccFileLock2(lockPath, applyOps));
+    } catch (err) {
+      if (err instanceof OccWriteConflictError2) {
+        throw new MigrateError("Another process is modifying the schema, try again.");
+      }
+      throw err;
+    }
+  } else {
+    await applyOps();
   }
   p3.log.success(`Applied ${ops.length} operation(s).`);
-  if (await BranchMetadataFileManager2.loadOnly(projectDir)) {
+  if (isBranchClone) {
     await invalidateBranchContentCaches2(projectDir);
   }
   try {
@@ -9288,6 +9343,8 @@ var init_migrate = __esm({
     init_fs();
     init_schema();
     init_error();
+    init_async_mutex();
+    init_occ_json_write();
     init_branch_metadata();
     init_content_index_generation();
     MIGRATE_FORMATS = ["md", "mdx", "json", "yaml"];

package/dist/cli/generate-ai-content.js

@@ -429,14 +429,20 @@ var init_media = __esm({
 
 // dist/config/schemas/config.js
 import { z as z5 } from "zod";
-var defaultBranchAccessSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE;
+var defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE;
 var init_config = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection();
     init_media();
     defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessSchema = z5.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema = z5.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema = z5.object({
+      read: defaultPathAccessLevelSchema.optional(),
+      edit: defaultPathAccessLevelSchema.optional(),
+      review: defaultPathAccessLevelSchema.optional()
+    }).strict();
+    defaultPathAccessSchema = z5.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
     defaultBaseBranchSchema = z5.string().default("main");
     defaultRemoteNameSchema = z5.string().default("origin");
     defaultRemoteUrlSchema = z5.string().min(1);
@@ -469,6 +475,10 @@ var init_config = __esm({
       // have .default('deny'), so the field is optional on input but always resolves to
       // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
       // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+      // still resolves to 'deny' and an omitted level inside the object form stays undefined
+      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
       defaultBranchAccess: defaultBranchAccessSchema,
       defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -4117,7 +4127,11 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
             createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
             createdAt: existing?.branch.createdAt ?? defaults.createdAt,
             // Fork point is recorded once at creation; later saves must not move it
-            baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
+            baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
+            // Always stamped fresh — the spreads above would otherwise let
+            // the existing (creation-time) value win forever, freezing the
+            // timestamp the editor's Branches panel sorts and displays by
+            updatedAt: now
           }
         };
         const written = await this.write(merged, version);
@@ -4670,6 +4684,7 @@ var GitManager = class _GitManager {
     }
     if (options.branchType === "orphan") {
       await git.createOrphanSettingsBranch(options.branchName, {});
+      await git.ensureGitExclude("*.lock");
     } else {
       await git.checkoutBranch(options.branchName);
       if (options.gitExcludePattern) {