canopycms 0.0.61 → 0.0.63

package/dist/operating-mode/mode-env.js

@@ -0,0 +1,97 @@
+/**
+ * Single resolution point for the operating `mode`.
+ *
+ * `mode` is required in `canopycms.config.ts` (SEC-C1) and that file lives in
+ * the adopter's repo — the SAME file is loaded by `next dev` locally, by
+ * `next build` inside the image builder, and by the deployed Lambda. Those
+ * three want different answers, so a literal in the config file cannot be
+ * right for all of them:
+ *
+ *   - `next dev` must be `dev` (workspace at `<cwd>/.canopy-dev`).
+ *   - `next build` must be `dev` too: prod-mode build reads would try to open
+ *     a branch workspace on EFS that cannot exist in an image builder (see
+ *     the note in `cli/template-files/Dockerfile.cms.template`).
+ *   - The deployed Lambda must be `prod`: dev mode resolves the workspace to
+ *     `<cwd>/.canopy-dev`, and Lambda's filesystem is read-only outside /tmp,
+ *     so the first write fails with EROFS.
+ *
+ * Only a value resolved at RUN time can satisfy all three, which is why this
+ * is an environment override rather than a flag baked into the generated
+ * config file. `CANOPY_MODE` is the name the deployment templates already
+ * referred to; before this module existed nothing read it.
+ *
+ * Precedence (highest wins):
+ *   1. the environment value for the current runtime (see `readModeEnv`)
+ *   2. `config.mode` (the literal in `canopycms.config.ts`)
+ *
+ * ## Two variable names, on purpose
+ *
+ * Server code reads `CANOPY_MODE`, which the CDK construct stamps onto the
+ * Lambda (`CanopyCmsService` sets `CANOPY_MODE=prod`). It is deliberately NOT
+ * set during `next build`, so build-time content reads stay in dev mode.
+ *
+ * Browser code cannot read a runtime environment at all — the editor page
+ * imports `canopycms.config.ts` directly (`config.client()`), so the browser's
+ * copy of `mode` is whatever was inlined when the bundle was built. Next.js
+ * only inlines `NEXT_PUBLIC_*`, so the browser reads
+ * `NEXT_PUBLIC_CANOPY_MODE`, which the generated CDK stack passes as a Docker
+ * build arg. Both names must be spelled as literal `process.env.X` member
+ * expressions here or the bundler cannot substitute them.
+ *
+ * An unrecognized value throws rather than falling back. Falling back would
+ * turn a typo (`CANOPY_MODE=production`) into a silent dev-mode deployment
+ * running header-trusting dev auth semantics — the exact failure SEC-C1 made
+ * `mode` required to prevent.
+ */
+import { canopyLogWarn } from '../utils/logger.js';
+export const SERVER_MODE_ENV_VAR = 'CANOPY_MODE';
+export const BROWSER_MODE_ENV_VAR = 'NEXT_PUBLIC_CANOPY_MODE';
+let warned = false;
+/** Reset the once-per-process warning latch. Test-only. */
+export function resetModeWarning() {
+    warned = false;
+}
+/**
+ * The environment value for the current runtime, or undefined when unset.
+ *
+ * Guarded with `typeof process` because a non-Next bundler may leave no
+ * `process` shim in the browser at all; the member expressions themselves stay
+ * literal so Next's DefinePlugin substitution still applies.
+ */
+function readModeEnv() {
+    if (typeof process === 'undefined' || typeof process.env === 'undefined')
+        return undefined;
+    const inBrowser = typeof window !== 'undefined';
+    const name = inBrowser ? BROWSER_MODE_ENV_VAR : SERVER_MODE_ENV_VAR;
+    const raw = inBrowser ? process.env.NEXT_PUBLIC_CANOPY_MODE : process.env.CANOPY_MODE;
+    const value = raw?.trim();
+    return value ? { name, value } : undefined;
+}
+/**
+ * Resolve the effective operating mode from the environment and the config
+ * literal. Called from `validateCanopyConfig`, the one point every documented
+ * config-authoring path (`defineCanopyConfig`, `composeCanopyConfig`) funnels
+ * through.
+ */
+export function resolveOperatingMode(configMode) {
+    const env = readModeEnv();
+    if (!env)
+        return configMode;
+    if (env.value !== 'prod' && env.value !== 'dev') {
+        throw new Error(`CanopyCMS: invalid ${env.name}=${JSON.stringify(env.value)}. ` +
+            `It must be exactly "prod" or "dev". Refusing to fall back to the configured mode ` +
+            `(${JSON.stringify(configMode)}): a typo here would silently deploy dev auth semantics.`);
+    }
+    if (env.value !== configMode && !warned) {
+        // canopyLogWarn, not console.warn: shared modules can run inside the
+        // worker daemon, where an unprefixed line is folded into the previous
+        // CloudWatch event (see utils/logger.ts).
+        canopyLogWarn(`CanopyCMS: ${env.name}="${env.value}" overrides config.mode="${configMode}". ` +
+            `The environment wins by design — it is the per-deployment value, while ` +
+            `canopycms.config.ts is shared by local dev, the image build and the deployment. ` +
+            `See operating-mode/mode-env.ts.`);
+        warned = true;
+    }
+    return env.value;
+}
+//# sourceMappingURL=mode-env.js.map

package/dist/operating-mode/mode-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mode-env.js","sourceRoot":"","sources":["../../src/operating-mode/mode-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAG/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAA;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAA;AAE7D,IAAI,MAAM,GAAG,KAAK,CAAA;AAElB,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,KAAK,CAAA;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,WAAW;QAAE,OAAO,SAAS,CAAA;IAC1F,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,WAAW,CAAA;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACnE,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAA;IACrF,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAA;IACzB,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAyB;IAC5D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,UAAU,CAAA;IAE3B,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI;YAC7D,mFAAmF;YACnF,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,0DAA0D,CAC3F,CAAA;IACH,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,qEAAqE;QACrE,sEAAsE;QACtE,0CAA0C;QAC1C,aAAa,CACX,cAAc,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,KAAK,4BAA4B,UAAU,KAAK;YAC7E,yEAAyE;YACzE,kFAAkF;YAClF,iCAAiC,CACpC,CAAA;QACD,MAAM,GAAG,IAAI,CAAA;IACf,CAAC;IAED,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC"}

package/dist/resolve-canopy-user.d.ts

@@ -0,0 +1,34 @@
+import type { AuthenticationResult } from './auth/types';
+import type { CanopyUser } from './user';
+import type { OperatingMode } from './operating-mode';
+/** Test-only: reset the once-per-process "no admins configured" warning latch. */
+export declare function resetResolveCanopyUserWarningForTests(): void;
+export interface ResolveCanopyUserDeps {
+    /**
+     * Resolves (and ensures) the settings workspace root. Internal groups are
+     * the single source of truth for group-based privileges and MUST be
+     * loaded from here — the same root `createContentAccessChecker`
+     * (authorization/content.ts) uses for path permissions — never from a
+     * content branch clone.
+     *
+     * Must THROW if the settings workspace cannot be ensured, matching
+     * `createContentAccessChecker`'s fail-loud contract: a caught error here
+     * and a silent fallback to an empty group list would read as "no
+     * privileges", which is a silent authorization change, not a safe
+     * degradation.
+     */
+    getSettingsBranchRoot: () => Promise<string>;
+    mode: OperatingMode;
+    bootstrapAdminIds: Set<string>;
+}
+/**
+ * Resolve the CanopyUser for a request: load internal groups from the
+ * settings workspace and merge them (plus bootstrap admins) into an
+ * authentication result via `authResultToCanopyUser`.
+ *
+ * Framework-agnostic: callers supply the already-computed `authResult` (from
+ * whatever auth-plugin invocation their transport uses) and a small deps
+ * bag drawn from `CanopyServices`.
+ */
+export declare function resolveCanopyUser(authResult: AuthenticationResult, deps: ResolveCanopyUserDeps): Promise<CanopyUser>;
+//# sourceMappingURL=resolve-canopy-user.d.ts.map

package/dist/resolve-canopy-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-canopy-user.d.ts","sourceRoot":"","sources":["../src/resolve-canopy-user.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AAGxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAKrD,kFAAkF;AAClF,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAED,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;OAYG;IACH,qBAAqB,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,EAAE,aAAa,CAAA;IACnB,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC/B;AAcD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,UAAU,CAAC,CAOrB"}

package/dist/resolve-canopy-user.js

@@ -0,0 +1,55 @@
+/**
+ * Shared "authenticate -> resolve internal groups -> merge into CanopyUser"
+ * pipeline.
+ *
+ * This used to be duplicated between `http/handler.ts` (the core API
+ * handler) and `canopycms-next`'s `context-wrapper.ts` (Next.js SSR user
+ * extraction) - including a module-level `warnedNoAdmins` flag in each copy.
+ * The duplication let the two drift: `http/handler.ts` loaded internal
+ * groups from the BASE BRANCH content clone's `groups.json`, which nothing
+ * in the product ever writes (writes go to the settings workspace via
+ * `mutateGroupsFile` - `api/groups.ts`), so group-based privileges never
+ * actually took effect. Consolidating the pipeline here means both callers
+ * read from the same place and cannot silently diverge again.
+ *
+ * canopyLogWarn, not console.warn: this module has no worker-specific logic,
+ * but nothing prevents it from becoming reachable from the worker's runtime
+ * import closure later, and the existing "no admins configured" warning is
+ * exactly the kind of operationally interesting line that must not be
+ * silently folded into an unrelated worker.log event (see utils/logger.ts).
+ */
+import { canopyLogWarn } from './utils/logger.js';
+import { authResultToCanopyUser } from './user.js';
+import { loadInternalGroups, RESERVED_GROUPS } from './authorization/index.js';
+/** Module-level, matching the pre-extraction behavior: warn at most once per process. */
+let warnedNoAdmins = false;
+/** Test-only: reset the once-per-process "no admins configured" warning latch. */
+export function resetResolveCanopyUserWarningForTests() {
+    warnedNoAdmins = false;
+}
+function warnIfNoAdmins(internalGroups, bootstrapAdminIds) {
+    if (warnedNoAdmins)
+        return;
+    const adminsGroup = internalGroups.find((g) => g.id === RESERVED_GROUPS.ADMINS);
+    const hasAdmins = (adminsGroup?.members.length ?? 0) > 0 || bootstrapAdminIds.size > 0;
+    if (!hasAdmins) {
+        canopyLogWarn('CanopyCMS: No admin users configured. Set CANOPY_BOOTSTRAP_ADMIN_IDS or add members to the Admins group.');
+    }
+    warnedNoAdmins = true;
+}
+/**
+ * Resolve the CanopyUser for a request: load internal groups from the
+ * settings workspace and merge them (plus bootstrap admins) into an
+ * authentication result via `authResultToCanopyUser`.
+ *
+ * Framework-agnostic: callers supply the already-computed `authResult` (from
+ * whatever auth-plugin invocation their transport uses) and a small deps
+ * bag drawn from `CanopyServices`.
+ */
+export async function resolveCanopyUser(authResult, deps) {
+    const settingsRoot = await deps.getSettingsBranchRoot();
+    const internalGroups = await loadInternalGroups(settingsRoot, deps.mode, deps.bootstrapAdminIds);
+    warnIfNoAdmins(internalGroups, deps.bootstrapAdminIds);
+    return authResultToCanopyUser(authResult, deps.bootstrapAdminIds, internalGroups);
+}
+//# sourceMappingURL=resolve-canopy-user.js.map

package/dist/resolve-canopy-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-canopy-user.js","sourceRoot":"","sources":["../src/resolve-canopy-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAG9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,QAAQ,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAsB,MAAM,iBAAiB,CAAA;AAGzF,yFAAyF;AACzF,IAAI,cAAc,GAAG,KAAK,CAAA;AAE1B,kFAAkF;AAClF,MAAM,UAAU,qCAAqC;IACnD,cAAc,GAAG,KAAK,CAAA;AACxB,CAAC;AAqBD,SAAS,cAAc,CAAC,cAA+B,EAAE,iBAA8B;IACrF,IAAI,cAAc;QAAE,OAAM;IAC1B,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,CAAC,CAAA;IAC/E,MAAM,SAAS,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAA;IACtF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,aAAa,CACX,0GAA0G,CAC3G,CAAA;IACH,CAAC;IACD,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAgC,EAChC,IAA2B;IAE3B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAA;IACvD,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEhG,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEtD,OAAO,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AACnF,CAAC"}

package/dist/schema/schema-store.d.ts

@@ -130,6 +130,7 @@ declare const createCollectionInputSchema: z.ZodObject<{
         maxItems?: number | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
+    name: string;
     entries: {
         name: string;
         format: "mdx" | "md" | "json" | "yaml";
@@ -138,10 +139,10 @@ declare const createCollectionInputSchema: z.ZodObject<{
         label?: string | undefined;
         maxItems?: number | undefined;
     }[];
-    name: string;
     label?: string | undefined;
     parentPath?: string | undefined;
 }, {
+    name: string;
     entries: {
         name: string;
         format: "mdx" | "md" | "json" | "yaml";
@@ -150,7 +151,6 @@ declare const createCollectionInputSchema: z.ZodObject<{
         label?: string | undefined;
         maxItems?: number | undefined;
     }[];
-    name: string;
     label?: string | undefined;
     parentPath?: string | undefined;
 }>;
@@ -294,6 +294,51 @@ export declare class SchemaOps {
      * bulk-mutation call sites that use the combined helper.
      */
     private invalidateContentIdIndexes;
+    /**
+     * The single normalisation boundary for logical collection paths entering
+     * this class. Every public method that accepts a logical collection path
+     * (or, for `createCollection`, `input.parentPath`) calls this exactly once
+     * before doing anything else with the path — that is the whole fix for the
+     * "Collection not found" bug: `flattenSchema` (branch-schema-cache.ts)
+     * produces content-root-prefixed logical paths (e.g. "content/posts", or
+     * "cms/content/posts" for a multi-segment `contentRoot: 'cms/content'`),
+     * the editor round-trips those straight back into every mutator
+     * (`CollectionEditor.tsx` passes `editingCollection.logicalPath` as-is),
+     * but `resolveCollectionPath(this.contentRoot, ...)` treats its second
+     * argument as relative to `this.contentRoot` — which already embeds the
+     * content-root segment(s). A prefixed path therefore resolved one level
+     * too deep and was reported as not found. `updateCollectionInner` used to
+     * strip the prefix itself (the only mutator that did); that bespoke strip
+     * is gone now that every entry point normalises here instead.
+     *
+     * Prefix-only: strips ONE leading `"{contentRootName}/"` if present (exact
+     * string match against the full, possibly multi-segment, `contentRootName`
+     * — never `path.basename()`, which would break a multi-segment root like
+     * "cms/content"), otherwise returns the path unchanged. So both prefixed
+     * (production/editor) and unprefixed (existing store tests, adopters
+     * calling SchemaOps directly) input work. Deliberately does NOT touch the
+     * bare root-collection sentinel (`collectionPath === this.contentRootName`,
+     * no trailing segment): that has no trailing "/" to match, so it passes
+     * through unchanged and the `=== this.contentRootName` checks in
+     * `updateCollectionInner`/`updateOrderInner` keep working.
+     *
+     * CALL EXACTLY ONCE PER ENTRY POINT — it is NOT idempotent, and an earlier
+     * version of this comment claimed it was. A sub-collection literally named
+     * after the content root defeats the "already normalised" reasoning: with
+     * `contentRoot: 'content'`, "content/content/x" normalises to "content/x"
+     * and again to "x", and "content/content" normalises to "content", which
+     * the `=== this.contentRootName` checks above then treat as the ROOT
+     * collection — so a second call mutates a DIFFERENT collection rather than
+     * reporting not-found. Every entry point calls this exactly once today, so
+     * the ambiguity is unreachable; removing it needs the editor to send an
+     * unambiguously-scoped path, tracked in
+     * .claude/future-tasks/collection-path-content-root-ambiguity.md.
+     *
+     * A future public method that accepts a logical collection path must call
+     * this first, and only once, the same way every existing one does — that is
+     * the "safe by construction" contract this boundary is meant to provide.
+     */
+    private normalizeCollectionPath;
     /**
      * Validate that a schema reference exists in the registry
      */
@@ -343,6 +388,12 @@ export declare class SchemaOps {
      * read-modify-write. Called directly (not via the public `updateCollection`)
      * by `updateOrderInner` for non-root collections — `withSchemaLock` is NOT
      * re-entrant, so going through the public method there would deadlock.
+     *
+     * `collectionPath` here is always already normalized (content-root prefix
+     * stripped, if it had one) by whichever public method reached this — either
+     * `updateCollection` above or `updateOrder` via `updateOrderInner` — so this
+     * no longer re-strips the prefix itself; see normalizeCollectionPath's doc
+     * comment for the single boundary that owns that now.
      */
     private updateCollectionInner;
     /**

package/dist/schema/schema-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-store.d.ts","sourceRoot":"","sources":["../../src/schema/schema-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAOvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAKlD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAE7B;;GAEG;AACH,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,aAAa,CAAA;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,aAAa,CAAA;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAoBD,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;EAWxB,CAAA;AAEF,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS/B,CAAA;AAEF,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;EAgB/B,CAAA;AAEF,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;EAM9B,CAAA;AAQF;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA6D;CAIjF;AAED,qBAAa,SAAS;IAgBlB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAjB5B,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;gBAGpB,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,mBAAmB,EACxC,QAAQ,CAAC,EAAE,cAAc,YAAA,EAC1C,UAAU,CAAC,EAAE,MAAM;IAsBrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,cAAc;IAwB5B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,qBAAqB;IAiBnC;;;;;;;;;;;;;;OAcG;YACW,0BAA0B;IAQxC;;OAEG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAgBhC;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;OAEG;IACG,kBAAkB,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAmBzF;;OAEG;IACG,sBAAsB,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAatE;;OAEG;IACG,iBAAiB,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IA4CtE;;OAEG;YACW,mBAAmB;IAMjC;;OAEG;YACW,uBAAuB;IAUrC;;OAEG;IACG,gBAAgB,CACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC;QAAE,cAAc,EAAE,WAAW,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;YAmBnD,qBAAqB;IAuEnC;;OAEG;IACG,gBAAgB,CACpB,cAAc,EAAE,WAAW,EAC3B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;OAKG;YACW,qBAAqB;IAmHnC;;OAEG;IACG,gBAAgB,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;YAMpD,qBAAqB;IAuBnC;;OAEG;IACG,YAAY,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;YAkBjF,iBAAiB;IAoC/B;;OAEG;IACG,eAAe,CACnB,cAAc,EAAE,WAAW,EAC3B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC;YAoBF,oBAAoB;IA6DlC;;OAEG;IACG,eAAe,CAAC,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAM1E,oBAAoB;IAiDlC;;;;;;;;;;;;;;;OAeG;IACG,qBAAqB,CAAC,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAsDhG;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAMhE,gBAAgB;CAqB/B;AAMD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,GAC3B,CAAA"}
+{"version":3,"file":"schema-store.d.ts","sourceRoot":"","sources":["../../src/schema/schema-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAOvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AASlD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGjD,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACrB,MAAM,sBAAsB,CAAA;AAE7B;;GAEG;AACH,UAAU,kBAAkB;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,aAAa,CAAA;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;GAEG;AACH,UAAU,sBAAsB;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAA;QACZ,KAAK,CAAC,EAAE,MAAM,CAAA;QACd,MAAM,EAAE,aAAa,CAAA;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,OAAO,CAAC,EAAE,OAAO,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAoBD,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;EAWxB,CAAA;AAEF,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAS/B,CAAA;AAEF,QAAA,MAAM,2BAA2B;;;;;;;;;;;;;;;EAgB/B,CAAA;AAEF,QAAA,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;EAM9B,CAAA;AAQF;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA6D;CAIjF;AAED,qBAAa,SAAS;IAgBlB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAjB5B,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAQ;IACnC;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAQ;IACxC,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAQ;gBAGpB,WAAW,EAAE,MAAM,EACnB,mBAAmB,EAAE,mBAAmB,EACxC,QAAQ,CAAC,EAAE,cAAc,YAAA,EAC1C,UAAU,CAAC,EAAE,MAAM;IAsBrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;YACW,cAAc;IAwB5B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,qBAAqB;IAiBnC;;;;;;;;;;;;;;OAcG;YACW,0BAA0B;IAQxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,OAAO,CAAC,uBAAuB;IAQ/B;;OAEG;IACH,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAgBhC;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;OAEG;IACG,kBAAkB,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAoBzF;;OAEG;IACG,sBAAsB,IAAI,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;IAatE;;OAEG;IACG,iBAAiB,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IA6CtE;;OAEG;YACW,mBAAmB;IAMjC;;OAEG;YACW,uBAAuB;IAUrC;;OAEG;IACG,gBAAgB,CACpB,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC;QAAE,cAAc,EAAE,WAAW,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;YA4BnD,qBAAqB;IAuEnC;;OAEG;IACG,gBAAgB,CACpB,cAAc,EAAE,WAAW,EAC3B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAahB;;;;;;;;;;;OAWG;YACW,qBAAqB;IA4GnC;;OAEG;IACG,gBAAgB,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;YAOpD,qBAAqB;IAuBnC;;OAEG;IACG,YAAY,CAAC,cAAc,EAAE,WAAW,EAAE,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;YAmBjF,iBAAiB;IAoC/B;;OAEG;IACG,eAAe,CACnB,cAAc,EAAE,WAAW,EAC3B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC;YAqBF,oBAAoB;IA6DlC;;OAEG;IACG,eAAe,CAAC,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAO1E,oBAAoB;IAiDlC;;;;;;;;;;;;;;;OAeG;IACG,qBAAqB,CAAC,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuDhG;;OAEG;IACG,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAOhE,gBAAgB;CAsB/B;AAMD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,GAC3B,CAAA"}

package/dist/schema/schema-store.js

@@ -54,7 +54,7 @@ import { withOccFileLock, OccWriteConflictError } from '../utils/occ-json-write.
 import { resolveCollectionPath } from '../content-id-index.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
 import { generateId, isValidId } from '../id.js';
-import { createLogicalPath, validateAndNormalizePath } from '../paths/index.js';
+import { createLogicalPath, normalizeCollectionPath as stripContentRootPrefix, validateAndNormalizePath, } from '../paths/index.js';
 // ============================================================================
 // Zod Schemas for Validation
 // ============================================================================
@@ -270,6 +270,56 @@ export class SchemaOps {
         await invalidateBranchContentCaches(this.branchRoot);
     }
     // --------------------------------------------------------------------------
+    // Path Normalization
+    // --------------------------------------------------------------------------
+    /**
+     * The single normalisation boundary for logical collection paths entering
+     * this class. Every public method that accepts a logical collection path
+     * (or, for `createCollection`, `input.parentPath`) calls this exactly once
+     * before doing anything else with the path — that is the whole fix for the
+     * "Collection not found" bug: `flattenSchema` (branch-schema-cache.ts)
+     * produces content-root-prefixed logical paths (e.g. "content/posts", or
+     * "cms/content/posts" for a multi-segment `contentRoot: 'cms/content'`),
+     * the editor round-trips those straight back into every mutator
+     * (`CollectionEditor.tsx` passes `editingCollection.logicalPath` as-is),
+     * but `resolveCollectionPath(this.contentRoot, ...)` treats its second
+     * argument as relative to `this.contentRoot` — which already embeds the
+     * content-root segment(s). A prefixed path therefore resolved one level
+     * too deep and was reported as not found. `updateCollectionInner` used to
+     * strip the prefix itself (the only mutator that did); that bespoke strip
+     * is gone now that every entry point normalises here instead.
+     *
+     * Prefix-only: strips ONE leading `"{contentRootName}/"` if present (exact
+     * string match against the full, possibly multi-segment, `contentRootName`
+     * — never `path.basename()`, which would break a multi-segment root like
+     * "cms/content"), otherwise returns the path unchanged. So both prefixed
+     * (production/editor) and unprefixed (existing store tests, adopters
+     * calling SchemaOps directly) input work. Deliberately does NOT touch the
+     * bare root-collection sentinel (`collectionPath === this.contentRootName`,
+     * no trailing segment): that has no trailing "/" to match, so it passes
+     * through unchanged and the `=== this.contentRootName` checks in
+     * `updateCollectionInner`/`updateOrderInner` keep working.
+     *
+     * CALL EXACTLY ONCE PER ENTRY POINT — it is NOT idempotent, and an earlier
+     * version of this comment claimed it was. A sub-collection literally named
+     * after the content root defeats the "already normalised" reasoning: with
+     * `contentRoot: 'content'`, "content/content/x" normalises to "content/x"
+     * and again to "x", and "content/content" normalises to "content", which
+     * the `=== this.contentRootName` checks above then treat as the ROOT
+     * collection — so a second call mutates a DIFFERENT collection rather than
+     * reporting not-found. Every entry point calls this exactly once today, so
+     * the ambiguity is unreachable; removing it needs the editor to send an
+     * unambiguously-scoped path, tracked in
+     * .claude/future-tasks/collection-path-content-root-ambiguity.md.
+     *
+     * A future public method that accepts a logical collection path must call
+     * this first, and only once, the same way every existing one does — that is
+     * the "safe by construction" contract this boundary is meant to provide.
+     */
+    normalizeCollectionPath(collectionPath) {
+        return createLogicalPath(stripContentRootPrefix(collectionPath, this.contentRootName));
+    }
+    // --------------------------------------------------------------------------
     // Validation Helpers
     // --------------------------------------------------------------------------
     /**
@@ -310,8 +360,9 @@ export class SchemaOps {
      * Read a collection's .collection.json file
      */
     async readCollectionMeta(collectionPath) {
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
         // Resolve logical path to physical path with embedded IDs
-        const physicalPath = await resolveCollectionPath(this.contentRoot, collectionPath);
+        const physicalPath = await resolveCollectionPath(this.contentRoot, normalizedPath);
         if (!physicalPath) {
             return null;
         }
@@ -347,7 +398,8 @@ export class SchemaOps {
      * Check if a collection is empty (has no content files or child collections)
      */
     async isCollectionEmpty(collectionPath) {
-        const physicalPath = await resolveCollectionPath(this.contentRoot, collectionPath);
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
+        const physicalPath = await resolveCollectionPath(this.contentRoot, normalizedPath);
         if (!physicalPath) {
             // Collection doesn't exist, consider it empty
             return true;
@@ -422,7 +474,15 @@ export class SchemaOps {
         if (!schemaValidation.valid) {
             throw new Error(schemaValidation.error);
         }
-        const result = await this.withSchemaLock(() => this.createCollectionInner(input));
+        // Normalize parentPath (may be content-root-prefixed, e.g. "content/docs",
+        // exactly like every other logical collection path the editor sends) —
+        // see normalizeCollectionPath's doc comment for why this must happen
+        // exactly once, here at the public entry point, before createCollectionInner
+        // ever resolves it.
+        const normalizedInput = input.parentPath
+            ? { ...input, parentPath: this.normalizeCollectionPath(input.parentPath) }
+            : input;
+        const result = await this.withSchemaLock(() => this.createCollectionInner(normalizedInput));
         // Invalidate schema cache after mutation (outside the lock — see withSchemaLock's doc comment)
         await this.invalidateSchemaCache();
         return result;
@@ -497,7 +557,8 @@ export class SchemaOps {
         if (!parseResult.success) {
             throw new Error(`Invalid input: ${parseResult.error.message}`);
         }
-        await this.withSchemaLock(() => this.updateCollectionInner(collectionPath, updates));
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
+        await this.withSchemaLock(() => this.updateCollectionInner(normalizedPath, updates));
         // Invalidate schema cache after mutation (outside the lock — see withSchemaLock's doc comment)
         await this.invalidateSchemaCache();
     }
@@ -506,6 +567,12 @@ export class SchemaOps {
      * read-modify-write. Called directly (not via the public `updateCollection`)
      * by `updateOrderInner` for non-root collections — `withSchemaLock` is NOT
      * re-entrant, so going through the public method there would deadlock.
+     *
+     * `collectionPath` here is always already normalized (content-root prefix
+     * stripped, if it had one) by whichever public method reached this — either
+     * `updateCollection` above or `updateOrder` via `updateOrderInner` — so this
+     * no longer re-strips the prefix itself; see normalizeCollectionPath's doc
+     * comment for the single boundary that owns that now.
      */
     async updateCollectionInner(collectionPath, updates) {
         // Check if this is the root collection (path equals the configured content
@@ -526,18 +593,15 @@ export class SchemaOps {
             await this.writeRootCollectionMeta(meta);
             return;
         }
-        // Strip contentRoot prefix to get relative path for regular collection
-        // E.g., "content/posts" -> "posts"
-        const relativePath = collectionPath.startsWith(`${this.contentRootName}/`)
-            ? collectionPath.slice(this.contentRootName.length + 1)
-            : collectionPath;
-        // Resolve path for regular collection
-        const physicalPath = await resolveCollectionPath(this.contentRoot, createLogicalPath(relativePath));
+        // Resolve path for regular collection. collectionPath is already
+        // normalized (no content-root prefix) by the caller — see this method's
+        // doc comment.
+        const physicalPath = await resolveCollectionPath(this.contentRoot, collectionPath);
         if (!physicalPath) {
             throw new Error(`Collection not found: ${collectionPath}`);
         }
         // Read existing meta
-        const meta = await this.readCollectionMeta(relativePath);
+        const meta = await this.readCollectionMeta(collectionPath);
         if (!meta) {
             throw new Error(`Collection meta not found: ${collectionPath}`);
         }
@@ -608,7 +672,8 @@ export class SchemaOps {
      * Delete a collection (must be empty)
      */
     async deleteCollection(collectionPath) {
-        await this.withSchemaLock(() => this.deleteCollectionInner(collectionPath));
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
+        await this.withSchemaLock(() => this.deleteCollectionInner(normalizedPath));
         // Invalidate schema cache after mutation (outside the lock — see withSchemaLock's doc comment)
         await this.invalidateSchemaCache();
     }
@@ -645,7 +710,8 @@ export class SchemaOps {
             const available = Object.keys(this.entrySchemaRegistry).join(', ');
             throw new Error(`Schema reference "${entryType.schema}" not found. Available: ${available}`);
         }
-        await this.withSchemaLock(() => this.addEntryTypeInner(collectionPath, entryType));
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
+        await this.withSchemaLock(() => this.addEntryTypeInner(normalizedPath, entryType));
         // Invalidate schema cache after mutation (outside the lock — see withSchemaLock's doc comment)
         await this.invalidateSchemaCache();
     }
@@ -691,7 +757,8 @@ export class SchemaOps {
             const available = Object.keys(this.entrySchemaRegistry).join(', ');
             throw new Error(`Schema reference "${updates.schema}" not found. Available: ${available}`);
         }
-        await this.withSchemaLock(() => this.updateEntryTypeInner(collectionPath, entryTypeName, updates));
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
+        await this.withSchemaLock(() => this.updateEntryTypeInner(normalizedPath, entryTypeName, updates));
         // Invalidate schema cache after mutation (outside the lock — see withSchemaLock's doc comment)
         await this.invalidateSchemaCache();
     }
@@ -748,7 +815,8 @@ export class SchemaOps {
      * Remove an entry type from a collection
      */
     async removeEntryType(collectionPath, entryTypeName) {
-        await this.withSchemaLock(() => this.removeEntryTypeInner(collectionPath, entryTypeName));
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
+        await this.withSchemaLock(() => this.removeEntryTypeInner(normalizedPath, entryTypeName));
         // Invalidate schema cache after mutation (outside the lock — see withSchemaLock's doc comment)
         await this.invalidateSchemaCache();
     }
@@ -803,8 +871,9 @@ export class SchemaOps {
      * ```
      */
     async countEntriesUsingType(collectionPath, entryTypeName) {
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
         // Resolve collection physical path
-        const physicalPath = await resolveCollectionPath(this.contentRoot, collectionPath);
+        const physicalPath = await resolveCollectionPath(this.contentRoot, normalizedPath);
         if (!physicalPath) {
             // Collection doesn't exist yet - return 0
             return 0;
@@ -852,7 +921,8 @@ export class SchemaOps {
      * Update the order of items in a collection
      */
     async updateOrder(collectionPath, order) {
-        await this.withSchemaLock(() => this.updateOrderInner(collectionPath, order));
+        const normalizedPath = this.normalizeCollectionPath(collectionPath);
+        await this.withSchemaLock(() => this.updateOrderInner(normalizedPath, order));
         // Invalidate schema cache after mutation (outside the lock — see withSchemaLock's doc comment)
         await this.invalidateSchemaCache();
     }
@@ -869,8 +939,9 @@ export class SchemaOps {
             await this.writeRootCollectionMeta(meta);
             return;
         }
-        // Update regular collection (handles contentRoot prefix stripping internally).
-        // Calls updateCollectionInner DIRECTLY, never the public updateCollection:
+        // Update regular collection. collectionPath is already normalized (no
+        // content-root prefix) by the public updateOrder above. Calls
+        // updateCollectionInner DIRECTLY, never the public updateCollection:
         // we're already inside withSchemaLock's critical section here, and
         // withLock is not re-entrant — going through updateCollection would call
         // withSchemaLock again and deadlock waiting on the lock it itself holds.