canopycms 0.0.59 → 0.0.61-int.74

package/dist/cli/cli.js

@@ -362,6 +362,36 @@ async function retryTask(taskDir, taskId, error, logger = nullLogger) {
   });
   logger.debug("Retrying task", { id: taskId, retryCount, backoffMs });
 }
+async function requeueFailedTask(taskDir, taskId, logger = nullLogger) {
+  const failedPath = path5.join(taskDir, "failed", `${taskId}.json`);
+  let content;
+  try {
+    content = await fs4.readFile(failedPath, "utf-8");
+  } catch (err) {
+    if (isNotFoundError2(err))
+      return { error: "not-found" };
+    throw err;
+  }
+  const original = parseTaskJson(content);
+  if (!original)
+    return { error: "unparseable" };
+  const newTaskId = crypto.randomUUID();
+  const newTask = {
+    id: newTaskId,
+    action: original.action,
+    payload: { ...original.payload, requeuedFrom: taskId },
+    status: "pending",
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    retryCount: 0,
+    maxRetries: original.maxRetries
+  };
+  const pendingPath = path5.join(taskDir, "pending", `${newTaskId}.json`);
+  await atomicWriteFile(pendingPath, JSON.stringify(newTask, null, 2));
+  await fs4.unlink(failedPath).catch(() => {
+  });
+  logger.debug("Requeued failed task", { originalId: taskId, newTaskId });
+  return { newTaskId };
+}
 async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLogger) {
   const processingDir = path5.join(taskDir, "processing");
   const pendingDir = path5.join(taskDir, "pending");
@@ -491,6 +521,46 @@ async function getQueueStats(taskDir) {
   }
   return stats;
 }
+async function listCorruptTaskFiles(taskDir, limit = 50, logger = nullLogger) {
+  const corruptDir = path5.join(taskDir, "corrupt");
+  let files;
+  try {
+    files = await fs4.readdir(corruptDir);
+  } catch (err) {
+    if (isNotFoundError2(err))
+      return [];
+    throw err;
+  }
+  const entries = [];
+  for (const fileName of files.filter((f) => f.endsWith(".json"))) {
+    const filePath = path5.join(corruptDir, fileName);
+    try {
+      const stat = await fs4.stat(filePath);
+      entries.push({
+        fileName,
+        size: stat.size,
+        mtime: stat.mtime.toISOString(),
+        rawSnippet: await readSnippet(filePath, 500)
+      });
+    } catch (err) {
+      if (isNotFoundError2(err))
+        continue;
+      logger.debug("Failed to read corrupt task file", { fileName });
+    }
+  }
+  entries.sort((a, b) => new Date(b.mtime).getTime() - new Date(a.mtime).getTime());
+  return entries.slice(0, limit);
+}
+async function readSnippet(filePath, maxBytes) {
+  const handle = await fs4.open(filePath, "r");
+  try {
+    const buffer = Buffer.alloc(maxBytes);
+    const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0);
+    return buffer.subarray(0, bytesRead).toString("utf-8");
+  } finally {
+    await handle.close();
+  }
+}
 function parseTaskJson(content) {
   try {
     const parsed = JSON.parse(content);
@@ -794,7 +864,7 @@ CanopyCMS worker run-once (mode: ${mode}, auth: ${authMode})
   }
   console.log("\nDone");
 }
-var __defProp2, __getOwnPropNames2, __esm2, __export2, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_validation, init_helpers, init_config2, templates_exports, __dirname, TEMPLATES_DIR, init_templates, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, ProdStrategy, DevStrategy, strategyCache;
+var __defProp2, __getOwnPropNames2, __esm2, __export2, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_validation, init_helpers, init_config2, templates_exports, __dirname, TEMPLATES_DIR, init_templates, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, ProdStrategy, DevStrategy, strategyCache;
 var init_init = __esm({
   "dist/cli/init.js"() {
     "use strict";
@@ -980,7 +1050,13 @@ var init_init = __esm({
         init_collection();
         init_media();
         defaultBranchAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-        defaultPathAccessSchema = z4.enum(["allow", "deny"]).default("deny");
+        defaultPathAccessLevelSchema = z4.enum(["allow", "deny"]);
+        defaultPathAccessLevelsSchema = z4.object({
+          read: defaultPathAccessLevelSchema.optional(),
+          edit: defaultPathAccessLevelSchema.optional(),
+          review: defaultPathAccessLevelSchema.optional()
+        }).strict();
+        defaultPathAccessSchema = z4.union([defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema]).default("deny");
         defaultBaseBranchSchema = z4.string().default("main");
         defaultRemoteNameSchema = z4.string().default("origin");
         defaultRemoteUrlSchema = z4.string().min(1);
@@ -1013,6 +1089,10 @@ var init_init = __esm({
           // have .default('deny'), so the field is optional on input but always resolves to
           // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
           // before the inner default runs, defeating the fail-closed default (SCH-M1).
+          // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+          // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+          // still resolves to 'deny' and an omitted level inside the object form stays undefined
+          // (resolved to 'deny' at read time by resolveDefaultPathAccess).
           defaultBranchAccess: defaultBranchAccessSchema,
           defaultPathAccess: defaultPathAccessSchema,
           // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -1261,8 +1341,10 @@ var init_init = __esm({
       getQueueStats: () => getQueueStats,
       getTask: () => getTask,
       getTaskResult: () => getTask,
+      listCorruptTaskFiles: () => listCorruptTaskFiles,
       listTasks: () => listTasks,
       recoverOrphanedTasks: () => recoverOrphanedTasks,
+      requeueFailedTask: () => requeueFailedTask,
       retryTask: () => retryTask
     });
     init_task_queue3 = __esm2({
@@ -3046,6 +3128,8 @@ async function withOccFileLock(filePath, fn) {
     return await fn();
   } finally {
     await release().catch((err) => {
+      if (isNodeError3(err) && err.code === "ENOENT")
+        return;
       log4.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage3(err) });
     });
   }
@@ -3560,7 +3644,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_validation2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, log5, GIT_ENV_PASSTHROUGH, remoteInitLocks, GitConflictError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_validation2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, log5, GIT_ENV_PASSTHROUGH, remoteInitLocks, GitConflictError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -3924,7 +4008,13 @@ var init_generate_ai_content = __esm({
         init_collection2();
         init_media2();
         defaultBranchAccessSchema2 = z52.enum(["allow", "deny"]).default("deny");
-        defaultPathAccessSchema2 = z52.enum(["allow", "deny"]).default("deny");
+        defaultPathAccessLevelSchema2 = z52.enum(["allow", "deny"]);
+        defaultPathAccessLevelsSchema2 = z52.object({
+          read: defaultPathAccessLevelSchema2.optional(),
+          edit: defaultPathAccessLevelSchema2.optional(),
+          review: defaultPathAccessLevelSchema2.optional()
+        }).strict();
+        defaultPathAccessSchema2 = z52.union([defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2]).default("deny");
         defaultBaseBranchSchema2 = z52.string().default("main");
         defaultRemoteNameSchema2 = z52.string().default("origin");
         defaultRemoteUrlSchema2 = z52.string().min(1);
@@ -3957,6 +4047,10 @@ var init_generate_ai_content = __esm({
           // have .default('deny'), so the field is optional on input but always resolves to
           // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
           // before the inner default runs, defeating the fail-closed default (SCH-M1).
+          // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+          // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+          // still resolves to 'deny' and an omitted level inside the object form stays undefined
+          // (resolved to 'deny' at read time by resolveDefaultPathAccess).
           defaultBranchAccess: defaultBranchAccessSchema2,
           defaultPathAccess: defaultPathAccessSchema2,
           // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -5521,8 +5615,22 @@ var init_generate_ai_content = __esm({
        * Returns array of entry metadata (relativePath, collection, slug).
        * Returns empty array if the collection doesn't exist.
        */
-      async getCollectionEntryPaths(collectionPath) {
-        const idIndex = await this.idIndex();
+      /**
+       * Resolve a schema collection referenced by name or logical path.
+       *
+       * Accepts either a full logical path ("content/authors") or a bare
+       * collection name ("authors") — the contract reference fields use for
+       * `collections: [...]` (see README). This is the single normalization
+       * point shared by reference-option loading and reference validation so
+       * the dropdown and the write boundary can never disagree.
+       *
+       * CAVEAT: the bare-name fallback matches on the LAST path segment and
+       * returns the first hit in schema order — with two collections sharing a
+       * leaf name (e.g. content/blog/posts and content/news/posts), a bare
+       * 'posts' is ambiguous. Use the full logical path in schemas that nest
+       * same-named collections.
+       */
+      resolveCollectionItem(collectionPath) {
         const normalized = normalizeFilesystemPath(collectionPath);
         let item = this.schemaIndex.get(normalized);
         if (!item) {
@@ -5536,10 +5644,14 @@ var init_generate_ai_content = __esm({
             }
           }
         }
-        if (!item || item.type !== "collection") {
+        return item && item.type === "collection" ? item : void 0;
+      }
+      async getCollectionEntryPaths(collectionPath) {
+        const idIndex = await this.idIndex();
+        const collection = this.resolveCollectionItem(collectionPath);
+        if (!collection) {
           return [];
         }
-        const collection = item;
         const treeEntries = idIndex.getEntriesInCollectionTree(collection.logicalPath);
         const entries = [];
         for (const location of treeEntries) {
@@ -5817,7 +5929,13 @@ var init_generate_ai_content = __esm({
               continue;
             }
             const branchRoot = path10.join(this.root, entry.name);
-            const meta = await BranchMetadataFileManager.loadOnly(branchRoot);
+            let meta;
+            try {
+              meta = await BranchMetadataFileManager.loadOnly(branchRoot);
+            } catch (err) {
+              console.warn(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage3(err)}`);
+              continue;
+            }
             if (meta) {
               branches.push({
                 branch: meta.branch,
@@ -5851,6 +5969,14 @@ var init_generate_ai_content = __esm({
         this.name = "BranchMetadataConflictError";
       }
     };
+    BranchMetadataCorruptError = class extends Error {
+      constructor(branchRoot, cause) {
+        super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
+        this.name = "BranchMetadataCorruptError";
+        this.branchRoot = branchRoot;
+        this.parseCause = cause;
+      }
+    };
     BranchMetadataFileManager = class _BranchMetadataFileManager {
       constructor(branchRoot, baseRoot, options) {
         this.branchRoot = path12.resolve(branchRoot);
@@ -5863,7 +5989,8 @@ var init_generate_ai_content = __esm({
        * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
        */
       static async loadOnly(branchRoot) {
-        const filePath = path12.join(path12.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
+        const resolvedRoot = path12.resolve(branchRoot);
+        const filePath = path12.join(resolvedRoot, BRANCH_META_DIR, BRANCH_META_FILE);
         try {
           const raw = await fs12.readFile(filePath, "utf8");
           return JSON.parse(raw);
@@ -5871,6 +5998,9 @@ var init_generate_ai_content = __esm({
           if (isNotFoundError4(err)) {
             return null;
           }
+          if (err instanceof SyntaxError) {
+            throw new BranchMetadataCorruptError(resolvedRoot, err.message);
+          }
           throw err;
         }
       }
@@ -5980,7 +6110,11 @@ var init_generate_ai_content = __esm({
                 createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
                 createdAt: existing?.branch.createdAt ?? defaults.createdAt,
                 // Fork point is recorded once at creation; later saves must not move it
-                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
+                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
+                // Always stamped fresh — the spreads above would otherwise let
+                // the existing (creation-time) value win forever, freezing the
+                // timestamp the editor's Branches panel sorts and displays by
+                updatedAt: now
               }
             };
             const written = await this.write(merged, version);
@@ -6450,6 +6584,7 @@ var init_generate_ai_content = __esm({
         }
         if (options.branchType === "orphan") {
           await git.createOrphanSettingsBranch(options.branchName, {});
+          await git.ensureGitExclude("*.lock");
         } else {
           await git.checkoutBranch(options.branchName);
           if (options.gitExcludePattern) {
@@ -6531,8 +6666,9 @@ var init_generate_ai_content = __esm({
       }
       async pullBaseInner() {
         await this.git.fetch(this.remote, this.baseBranch);
+        const fetchedTip = (await this.git.revparse(["FETCH_HEAD"])).trim();
         try {
-          await this.git.merge([`${this.remote}/${this.baseBranch}`]);
+          await this.git.merge([fetchedTip]);
         } catch (err) {
           try {
             const status = await this.git.status();
@@ -6587,8 +6723,9 @@ var init_generate_ai_content = __esm({
       }
       async rebaseOntoBaseInner() {
         await this.git.fetch(this.remote, this.baseBranch);
+        const fetchedTip = (await this.git.revparse(["FETCH_HEAD"])).trim();
         try {
-          await this.git.rebase([`${this.remote}/${this.baseBranch}`]);
+          await this.git.rebase([fetchedTip]);
         } catch (err) {
           try {
             const status = await this.git.status();
@@ -7875,14 +8012,20 @@ var init_media3 = __esm({
 
 // dist/config/schemas/config.js
 import { z as z12 } from "zod";
-var defaultBranchAccessSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
+var defaultBranchAccessSchema3, defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
 var init_config4 = __esm({
   "dist/config/schemas/config.js"() {
     "use strict";
     init_collection3();
     init_media3();
     defaultBranchAccessSchema3 = z12.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessSchema3 = z12.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema3 = z12.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema3 = z12.object({
+      read: defaultPathAccessLevelSchema3.optional(),
+      edit: defaultPathAccessLevelSchema3.optional(),
+      review: defaultPathAccessLevelSchema3.optional()
+    }).strict();
+    defaultPathAccessSchema3 = z12.union([defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3]).default("deny");
     defaultBaseBranchSchema3 = z12.string().default("main");
     defaultRemoteNameSchema3 = z12.string().default("origin");
     defaultRemoteUrlSchema3 = z12.string().min(1);
@@ -7915,6 +8058,10 @@ var init_config4 = __esm({
       // have .default('deny'), so the field is optional on input but always resolves to
       // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
       // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+      // still resolves to 'deny' and an omitted level inside the object form stays undefined
+      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
       defaultBranchAccess: defaultBranchAccessSchema3,
       defaultPathAccess: defaultPathAccessSchema3,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -8175,7 +8322,7 @@ async function selectBranch(options, branchesDir) {
   let branches = [];
   if (await filePathExists(branchesDir)) {
     const entries = await fs23.readdir(branchesDir, { withFileTypes: true });
-    branches = entries.filter((e) => e.isDirectory()).map((e) => e.name);
+    branches = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
   }
   let branchName = options.branch;
   if (!branchName) {
@@ -8554,11 +8701,19 @@ var init_resolve = __esm({
   }
 });
 
+// dist/paths/branch-name.js
+var init_branch_name = __esm({
+  "dist/paths/branch-name.js"() {
+    "use strict";
+  }
+});
+
 // dist/paths/branch.js
 var init_branch = __esm({
   "dist/paths/branch.js"() {
     "use strict";
     init_operating_mode2();
+    init_branch_name();
   }
 });
 
@@ -8571,6 +8726,7 @@ var init_paths = __esm({
     init_validation3();
     init_resolve();
     init_branch();
+    init_branch_name();
   }
 });
 
@@ -8583,10 +8739,170 @@ var init_schema = __esm({
   }
 });
 
-// dist/branch-registry.js
+// dist/utils/async-mutex.js
+async function withLock2(key, fn) {
+  const prev = locks2.get(key) ?? Promise.resolve();
+  let resolve2;
+  const next = new Promise((r) => {
+    resolve2 = r;
+  });
+  locks2.set(key, next);
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    resolve2();
+    if (locks2.get(key) === next)
+      locks2.delete(key);
+  }
+}
+var locks2;
+var init_async_mutex = __esm({
+  "dist/utils/async-mutex.js"() {
+    "use strict";
+    locks2 = /* @__PURE__ */ new Map();
+  }
+});
+
+// dist/utils/occ-json-write.js
 import fs24 from "node:fs/promises";
 import path27 from "node:path";
-var log11, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
+import { randomUUID as randomUUID4 } from "node:crypto";
+import lockfile4 from "proper-lockfile";
+async function writeOccJsonFile2(filePath, payload, options) {
+  const { expectedVersion, settleMs = 50, trailingNewline = false } = options;
+  const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
+  const writeId = randomUUID4();
+  const data = { ...payload, version: newVersion, writeId };
+  const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
+  const dir = path27.dirname(filePath);
+  await fs24.mkdir(dir, { recursive: true });
+  const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  await fs24.writeFile(tempPath, content, "utf-8");
+  if (expectedVersion === null) {
+    try {
+      await fs24.link(tempPath, filePath);
+    } catch (err) {
+      await fs24.unlink(tempPath).catch(() => {
+      });
+      if (isFileExistsError(err)) {
+        throw new OccWriteConflictError2();
+      }
+      throw err;
+    }
+    await fs24.unlink(tempPath).catch(() => {
+    });
+    return { version: newVersion, writeId };
+  }
+  try {
+    let currentVersion = null;
+    try {
+      const current = JSON.parse(await fs24.readFile(filePath, "utf-8"));
+      currentVersion = current.version ?? 0;
+    } catch {
+      currentVersion = null;
+    }
+    if (currentVersion !== expectedVersion) {
+      throw new OccWriteConflictError2();
+    }
+    await fs24.rename(tempPath, filePath);
+    if (settleMs > 0) {
+      await new Promise((resolve2) => setTimeout(resolve2, settleMs));
+    }
+    const afterWrite = JSON.parse(await fs24.readFile(filePath, "utf-8"));
+    if (afterWrite.writeId !== writeId) {
+      throw new OccWriteConflictError2();
+    }
+  } catch (err) {
+    await fs24.unlink(tempPath).catch(() => {
+    });
+    throw err;
+  }
+  return { version: newVersion, writeId };
+}
+async function withOccRetry2(operation, options) {
+  const maxAttempts = options?.maxAttempts ?? 10;
+  const isRetryable = options?.isRetryable;
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    try {
+      return await operation();
+    } catch (err) {
+      const retryable = err instanceof OccWriteConflictError2 || (isRetryable?.(err) ?? false);
+      if (retryable && attempt < maxAttempts) {
+        const baseDelay = Math.min(10 * Math.pow(2, attempt - 1), 100);
+        const jitter = Math.random() * baseDelay;
+        await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error("Unreachable");
+}
+async function withOccFileLock2(filePath, fn) {
+  const dir = path27.dirname(filePath);
+  await fs24.mkdir(dir, { recursive: true });
+  const MAX_ATTEMPTS = 14;
+  let release = null;
+  for (let attempt = 1; release === null; attempt++) {
+    try {
+      release = await lockfile4.lock(filePath, {
+        lockfilePath: `${filePath}.lock`,
+        realpath: false,
+        stale: 1e4,
+        retries: 0,
+        // A compromised lock (the lock dir vanished or refresh failed
+        // mid-hold, e.g. the branch directory containing it was deleted)
+        // must not crash the process, which is proper-lockfile's default.
+        // Our critical sections are short and idempotent-on-conflict (OCC
+        // verify inside); log and let the section finish.
+        onCompromised: (err) => {
+          log11.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+            error: getErrorMessage(err)
+          });
+        }
+      });
+    } catch (err) {
+      const code = isNodeError(err) ? err.code : void 0;
+      const contended = code === "ELOCKED";
+      if (!contended || attempt >= MAX_ATTEMPTS) {
+        throw new OccWriteConflictError2(`Could not acquire file lock: ${getErrorMessage(err)}`);
+      }
+      const baseDelay = Math.min(50 * Math.pow(1.6, attempt - 1), 2e3);
+      const jitter = Math.random() * baseDelay;
+      await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    await release().catch((err) => {
+      if (isNodeError(err) && err.code === "ENOENT")
+        return;
+      log11.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
+    });
+  }
+}
+var log11, OccWriteConflictError2;
+var init_occ_json_write = __esm({
+  "dist/utils/occ-json-write.js"() {
+    "use strict";
+    init_error();
+    init_debug2();
+    log11 = createDebugLogger3({ prefix: "OccJsonWrite" });
+    OccWriteConflictError2 = class extends Error {
+      constructor(message = "Concurrent modification detected") {
+        super(message);
+        this.name = "OccWriteConflictError";
+      }
+    };
+  }
+});
+
+// dist/branch-registry.js
+import fs25 from "node:fs/promises";
+import path28 from "node:path";
+var log12, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
 var init_branch_registry = __esm({
   "dist/branch-registry.js"() {
     "use strict";
@@ -8594,7 +8910,7 @@ var init_branch_registry = __esm({
     init_error();
     init_debug2();
     init_resource_generation();
-    log11 = createDebugLogger3({ prefix: "BranchRegistry" });
+    log12 = createDebugLogger3({ prefix: "BranchRegistry" });
     REGISTRY_FILE2 = "branches.json";
     REGISTRY_STALE_FILE2 = "branches.stale.json";
     REGISTRY_TEMP_FILE2 = "branches.tmp.json";
@@ -8605,10 +8921,10 @@ var init_branch_registry = __esm({
       constructor(root) {
         this.regenInFlight = null;
         this.lastForcedRefreshMs = 0;
-        this.root = path27.resolve(root);
-        this.registryPath = path27.join(this.root, REGISTRY_FILE2);
-        this.stalePath = path27.join(this.root, REGISTRY_STALE_FILE2);
-        this.tempPath = path27.join(this.root, REGISTRY_TEMP_FILE2);
+        this.root = path28.resolve(root);
+        this.registryPath = path28.join(this.root, REGISTRY_FILE2);
+        this.stalePath = path28.join(this.root, REGISTRY_STALE_FILE2);
+        this.tempPath = path28.join(this.root, REGISTRY_TEMP_FILE2);
       }
       /**
        * Returns all branches. Uses the cached snapshot if its embedded generation
@@ -8617,7 +8933,7 @@ var init_branch_registry = __esm({
       async list() {
         let parsed;
         try {
-          const raw = await fs24.readFile(this.registryPath, "utf8");
+          const raw = await fs25.readFile(this.registryPath, "utf8");
           parsed = JSON.parse(raw);
         } catch (err) {
           if (isNotFoundError(err)) {
@@ -8680,7 +8996,7 @@ var init_branch_registry = __esm({
             });
           await this.regenerate();
         } catch (err) {
-          log11.warn("invalidate", "Eager regeneration after invalidate() failed", {
+          log12.warn("invalidate", "Eager regeneration after invalidate() failed", {
             error: getErrorMessage(err)
           });
         }
@@ -8706,7 +9022,7 @@ var init_branch_registry = __esm({
       async performRegenerate() {
         const read = await readResourceGeneration2(this.root, RESOURCE4);
         const branches = await this.scanBranchDirectories();
-        await fs24.unlink(this.stalePath).catch(() => {
+        await fs25.unlink(this.stalePath).catch(() => {
         });
         if (!read.ok) {
           return branches;
@@ -8717,12 +9033,12 @@ var init_branch_registry = __esm({
           generation: read.token
         };
         const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-        await fs24.mkdir(this.root, { recursive: true });
-        await fs24.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+        await fs25.mkdir(this.root, { recursive: true });
+        await fs25.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
         try {
-          await fs24.rename(uniqueTempPath, this.registryPath);
+          await fs25.rename(uniqueTempPath, this.registryPath);
         } catch (err) {
-          await fs24.unlink(uniqueTempPath).catch(() => {
+          await fs25.unlink(uniqueTempPath).catch(() => {
           });
           throw err;
         }
@@ -8736,13 +9052,19 @@ var init_branch_registry = __esm({
       async scanBranchDirectories() {
         const branches = [];
         try {
-          const entries = await fs24.readdir(this.root, { withFileTypes: true });
+          const entries = await fs25.readdir(this.root, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory() || entry.name.startsWith(".")) {
               continue;
             }
-            const branchRoot = path27.join(this.root, entry.name);
-            const meta = await BranchMetadataFileManager2.loadOnly(branchRoot);
+            const branchRoot = path28.join(this.root, entry.name);
+            let meta;
+            try {
+              meta = await BranchMetadataFileManager2.loadOnly(branchRoot);
+            } catch (err) {
+              console.warn(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage(err)}`);
+              continue;
+            }
             if (meta) {
               branches.push({
                 branch: meta.branch,
@@ -8763,168 +9085,10 @@ var init_branch_registry = __esm({
   }
 });
 
-// dist/utils/async-mutex.js
-async function withLock2(key, fn) {
-  const prev = locks2.get(key) ?? Promise.resolve();
-  let resolve2;
-  const next = new Promise((r) => {
-    resolve2 = r;
-  });
-  locks2.set(key, next);
-  await prev;
-  try {
-    return await fn();
-  } finally {
-    resolve2();
-    if (locks2.get(key) === next)
-      locks2.delete(key);
-  }
-}
-var locks2;
-var init_async_mutex = __esm({
-  "dist/utils/async-mutex.js"() {
-    "use strict";
-    locks2 = /* @__PURE__ */ new Map();
-  }
-});
-
-// dist/utils/occ-json-write.js
-import fs25 from "node:fs/promises";
-import path28 from "node:path";
-import { randomUUID as randomUUID4 } from "node:crypto";
-import lockfile4 from "proper-lockfile";
-async function writeOccJsonFile2(filePath, payload, options) {
-  const { expectedVersion, settleMs = 50, trailingNewline = false } = options;
-  const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
-  const writeId = randomUUID4();
-  const data = { ...payload, version: newVersion, writeId };
-  const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
-  const dir = path28.dirname(filePath);
-  await fs25.mkdir(dir, { recursive: true });
-  const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs25.writeFile(tempPath, content, "utf-8");
-  if (expectedVersion === null) {
-    try {
-      await fs25.link(tempPath, filePath);
-    } catch (err) {
-      await fs25.unlink(tempPath).catch(() => {
-      });
-      if (isFileExistsError(err)) {
-        throw new OccWriteConflictError2();
-      }
-      throw err;
-    }
-    await fs25.unlink(tempPath).catch(() => {
-    });
-    return { version: newVersion, writeId };
-  }
-  try {
-    let currentVersion = null;
-    try {
-      const current = JSON.parse(await fs25.readFile(filePath, "utf-8"));
-      currentVersion = current.version ?? 0;
-    } catch {
-      currentVersion = null;
-    }
-    if (currentVersion !== expectedVersion) {
-      throw new OccWriteConflictError2();
-    }
-    await fs25.rename(tempPath, filePath);
-    if (settleMs > 0) {
-      await new Promise((resolve2) => setTimeout(resolve2, settleMs));
-    }
-    const afterWrite = JSON.parse(await fs25.readFile(filePath, "utf-8"));
-    if (afterWrite.writeId !== writeId) {
-      throw new OccWriteConflictError2();
-    }
-  } catch (err) {
-    await fs25.unlink(tempPath).catch(() => {
-    });
-    throw err;
-  }
-  return { version: newVersion, writeId };
-}
-async function withOccRetry2(operation, options) {
-  const maxAttempts = options?.maxAttempts ?? 10;
-  const isRetryable = options?.isRetryable;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    try {
-      return await operation();
-    } catch (err) {
-      const retryable = err instanceof OccWriteConflictError2 || (isRetryable?.(err) ?? false);
-      if (retryable && attempt < maxAttempts) {
-        const baseDelay = Math.min(10 * Math.pow(2, attempt - 1), 100);
-        const jitter = Math.random() * baseDelay;
-        await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
-        continue;
-      }
-      throw err;
-    }
-  }
-  throw new Error("Unreachable");
-}
-async function withOccFileLock2(filePath, fn) {
-  const dir = path28.dirname(filePath);
-  await fs25.mkdir(dir, { recursive: true });
-  const MAX_ATTEMPTS = 14;
-  let release = null;
-  for (let attempt = 1; release === null; attempt++) {
-    try {
-      release = await lockfile4.lock(filePath, {
-        lockfilePath: `${filePath}.lock`,
-        realpath: false,
-        stale: 1e4,
-        retries: 0,
-        // A compromised lock (the lock dir vanished or refresh failed
-        // mid-hold, e.g. the branch directory containing it was deleted)
-        // must not crash the process, which is proper-lockfile's default.
-        // Our critical sections are short and idempotent-on-conflict (OCC
-        // verify inside); log and let the section finish.
-        onCompromised: (err) => {
-          log12.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
-            error: getErrorMessage(err)
-          });
-        }
-      });
-    } catch (err) {
-      const code = isNodeError(err) ? err.code : void 0;
-      const contended = code === "ELOCKED";
-      if (!contended || attempt >= MAX_ATTEMPTS) {
-        throw new OccWriteConflictError2(`Could not acquire file lock: ${getErrorMessage(err)}`);
-      }
-      const baseDelay = Math.min(50 * Math.pow(1.6, attempt - 1), 2e3);
-      const jitter = Math.random() * baseDelay;
-      await new Promise((resolve2) => setTimeout(resolve2, baseDelay + jitter));
-    }
-  }
-  try {
-    return await fn();
-  } finally {
-    await release().catch((err) => {
-      log12.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
-    });
-  }
-}
-var log12, OccWriteConflictError2;
-var init_occ_json_write = __esm({
-  "dist/utils/occ-json-write.js"() {
-    "use strict";
-    init_error();
-    init_debug2();
-    log12 = createDebugLogger3({ prefix: "OccJsonWrite" });
-    OccWriteConflictError2 = class extends Error {
-      constructor(message = "Concurrent modification detected") {
-        super(message);
-        this.name = "OccWriteConflictError";
-      }
-    };
-  }
-});
-
 // dist/branch-metadata.js
 import fs26 from "node:fs/promises";
 import path29 from "node:path";
-var BRANCH_META_DIR2, BRANCH_META_FILE2, CURRENT_SCHEMA_VERSION2, BranchMetadataConflictError2, BranchMetadataFileManager2;
+var BRANCH_META_DIR2, BRANCH_META_FILE2, CURRENT_SCHEMA_VERSION2, BranchMetadataConflictError2, BranchMetadataCorruptError2, BranchMetadataFileManager2;
 var init_branch_metadata = __esm({
   "dist/branch-metadata.js"() {
     "use strict";
@@ -8942,6 +9106,14 @@ var init_branch_metadata = __esm({
         this.name = "BranchMetadataConflictError";
       }
     };
+    BranchMetadataCorruptError2 = class extends Error {
+      constructor(branchRoot, cause) {
+        super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
+        this.name = "BranchMetadataCorruptError";
+        this.branchRoot = branchRoot;
+        this.parseCause = cause;
+      }
+    };
     BranchMetadataFileManager2 = class _BranchMetadataFileManager2 {
       constructor(branchRoot, baseRoot, options) {
         this.branchRoot = path29.resolve(branchRoot);
@@ -8954,7 +9126,8 @@ var init_branch_metadata = __esm({
        * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
        */
       static async loadOnly(branchRoot) {
-        const filePath = path29.join(path29.resolve(branchRoot), BRANCH_META_DIR2, BRANCH_META_FILE2);
+        const resolvedRoot = path29.resolve(branchRoot);
+        const filePath = path29.join(resolvedRoot, BRANCH_META_DIR2, BRANCH_META_FILE2);
         try {
           const raw = await fs26.readFile(filePath, "utf8");
           return JSON.parse(raw);
@@ -8962,6 +9135,9 @@ var init_branch_metadata = __esm({
           if (isNotFoundError(err)) {
             return null;
           }
+          if (err instanceof SyntaxError) {
+            throw new BranchMetadataCorruptError2(resolvedRoot, err.message);
+          }
           throw err;
         }
       }
@@ -9071,7 +9247,11 @@ var init_branch_metadata = __esm({
                 createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
                 createdAt: existing?.branch.createdAt ?? defaults.createdAt,
                 // Fork point is recorded once at creation; later saves must not move it
-                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch
+                baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
+                // Always stamped fresh — the spreads above would otherwise let
+                // the existing (creation-time) value win forever, freezing the
+                // timestamp the editor's Branches panel sorts and displays by
+                updatedAt: now
               }
             };
             const written = await this.write(merged, version);
@@ -9256,15 +9436,31 @@ async function migrate(options) {
       return { opCount: 0 };
     }
   }
-  for (const op of ops) {
-    if (op.kind === "rename") {
-      await fs27.rename(op.from, op.to);
-    } else {
-      await fs27.writeFile(op.filePath, op.content, "utf-8");
+  const isBranchClone = Boolean(await BranchMetadataFileManager2.loadOnly(projectDir));
+  const applyOps = async () => {
+    for (const op of ops) {
+      if (op.kind === "rename") {
+        await fs27.rename(op.from, op.to);
+      } else {
+        await fs27.writeFile(op.filePath, op.content, "utf-8");
+      }
     }
+  };
+  if (isBranchClone) {
+    const lockPath = path30.join(projectDir, ".canopy-meta", "schema");
+    try {
+      await withLock2(lockPath, () => withOccFileLock2(lockPath, applyOps));
+    } catch (err) {
+      if (err instanceof OccWriteConflictError2) {
+        throw new MigrateError("Another process is modifying the schema, try again.");
+      }
+      throw err;
+    }
+  } else {
+    await applyOps();
   }
   p3.log.success(`Applied ${ops.length} operation(s).`);
-  if (await BranchMetadataFileManager2.loadOnly(projectDir)) {
+  if (isBranchClone) {
     await invalidateBranchContentCaches2(projectDir);
   }
   try {
@@ -9288,6 +9484,8 @@ var init_migrate = __esm({
     init_fs();
     init_schema();
     init_error();
+    init_async_mutex();
+    init_occ_json_write();
     init_branch_metadata();
     init_content_index_generation();
     MIGRATE_FORMATS = ["md", "mdx", "json", "yaml"];