canopycms 0.0.65 → 0.0.66-int.82

package/dist/cli/cli.js

@@ -1882,10 +1882,10 @@ import { z as z42 } from "zod";
 import { z as z52 } from "zod";
 import { z as z6 } from "zod";
 import path9 from "node:path";
-import path20 from "node:path";
+import path21 from "node:path";
 import { createJiti as createJiti2 } from "jiti";
-import fs17 from "node:fs/promises";
-import path19 from "node:path";
+import fs18 from "node:fs/promises";
+import path20 from "node:path";
 import fs10 from "node:fs/promises";
 import path11 from "node:path";
 import matter2 from "gray-matter";
@@ -1920,21 +1920,23 @@ import path102 from "node:path";
 import path12 from "node:path";
 import fs11 from "node:fs/promises";
 import { minimatch } from "minimatch";
-import path17 from "node:path";
-import fs14 from "node:fs/promises";
-import path15 from "node:path";
-import fs12 from "node:fs/promises";
-import path13 from "node:path";
+import path18 from "node:path";
+import fs15 from "node:fs/promises";
+import path16 from "node:path";
 import fs13 from "node:fs/promises";
 import path14 from "node:path";
+import fs12 from "node:fs/promises";
+import path13 from "node:path";
+import fs14 from "node:fs/promises";
+import path15 from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import lockfile2 from "proper-lockfile";
-import fs15 from "node:fs/promises";
-import path16 from "node:path";
+import fs16 from "node:fs/promises";
+import path17 from "node:path";
 import { simpleGit as simpleGit2 } from "simple-git";
 import { simpleGit as simpleGit3 } from "simple-git";
-import fs16 from "node:fs/promises";
-import path18 from "node:path";
+import fs17 from "node:fs/promises";
+import path19 from "node:path";
 import matter3 from "gray-matter";
 import { parse as yamlParse2 } from "yaml";
 function canopyLogWarn2(...args) {
@@ -1943,11 +1945,11 @@ function canopyLogWarn2(...args) {
 function canopyLogError(...args) {
   active2.error(...args);
 }
-function normalizeFilesystemPath(path212) {
-  return path212.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path222) {
+  return path222.split(/[\\/]+/).filter(Boolean).join("/");
 }
-function hasTraversalSequence(path212) {
-  const normalized = normalizeFilesystemPath(path212);
+function hasTraversalSequence(path222) {
+  const normalized = normalizeFilesystemPath(path222);
   return normalized.includes("..");
 }
 function createLogicalPath(...segments) {
@@ -1957,14 +1959,14 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
-function trimSlashes(path212) {
+function trimSlashes(path222) {
   let start = 0;
-  let end = path212.length;
-  while (start < end && path212[start] === "/")
+  let end = path222.length;
+  while (start < end && path222[start] === "/")
     start++;
-  while (end > start && path212[end - 1] === "/")
+  while (end > start && path222[end - 1] === "/")
     end--;
-  return path212.slice(start, end);
+  return path222.slice(start, end);
 }
 function readModeEnv() {
   if (typeof process === "undefined" || typeof process.env === "undefined")
@@ -2421,8 +2423,8 @@ function computeEntryUrl(collection, slug, contentRoot) {
   if (slug && !isIndexSlug(slug)) {
     segments.push(slug);
   }
-  const path212 = segments.length > 0 ? `/${segments.join("/")}` : "/";
-  return path212.toLowerCase();
+  const path222 = segments.length > 0 ? `/${segments.join("/")}` : "/";
+  return path222.toLowerCase();
 }
 function isValidContentId(id) {
   return CONTENT_ID_PATTERN.test(id);
@@ -2485,13 +2487,13 @@ function extractIdFromFilename(filename) {
   return null;
 }
 async function resolveCollectionPath(root, logicalPath) {
-  const fs182 = await import("node:fs/promises");
-  const path212 = await import("node:path");
+  const fs192 = await import("node:fs/promises");
+  const path222 = await import("node:path");
   const segments = logicalPath.split("/").filter(Boolean);
   let currentPath = root;
   for (const segment of segments) {
     try {
-      const entries = await fs182.readdir(currentPath, { withFileTypes: true });
+      const entries = await fs192.readdir(currentPath, { withFileTypes: true });
       const matchingDir = entries.find((entry) => {
         if (!entry.isDirectory())
           return false;
@@ -2499,7 +2501,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return logicalName === segment.toLowerCase();
       });
       if (matchingDir) {
-        currentPath = path212.join(currentPath, matchingDir.name);
+        currentPath = path222.join(currentPath, matchingDir.name);
       } else {
         return null;
       }
@@ -3565,7 +3567,7 @@ function splitByCodeRegions(text3) {
   return parts;
 }
 async function generateAIContent(options) {
-  const { store, flatSchema, contentRoot, config, entryLinkUrl } = options;
+  const { store, flatSchema, contentRoot, config, entryLinkUrl, generatedAt, buildId } = options;
   const files = /* @__PURE__ */ new Map();
   const idIndex = await store.idIndex();
   const collections = flatSchema.filter((item) => item.type === "collection");
@@ -3616,7 +3618,8 @@ async function generateAIContent(options) {
     }
   }
   const manifest = {
-    generated: (/* @__PURE__ */ new Date()).toISOString(),
+    ...buildId ? { buildId } : {},
+    ...generatedAt || !buildId ? { generated: generatedAt || (/* @__PURE__ */ new Date()).toISOString() } : {},
     entries: rootEntries,
     collections: manifestCollections,
     bundles: manifestBundles
@@ -3828,35 +3831,50 @@ function matchesBundleFilter(entry, filter, contentRoot) {
   }
   return true;
 }
+async function readBranchMetadataFile(branchRoot) {
+  const resolvedRoot = path13.resolve(branchRoot);
+  try {
+    const raw = await fs12.readFile(branchMetadataFilePath(resolvedRoot), "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (isNotFoundError3(err)) {
+      return null;
+    }
+    if (err instanceof SyntaxError) {
+      throw new BranchMetadataCorruptError(resolvedRoot, err.message);
+    }
+    throw err;
+  }
+}
 async function writeOccJsonFile(filePath, payload, options) {
   const { expectedVersion, settleMs = 50, trailingNewline = false } = options;
   const newVersion = expectedVersion === null ? 1 : expectedVersion + 1;
   const writeId = randomUUID2();
   const data = { ...payload, version: newVersion, writeId };
   const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
-  const dir = path14.dirname(filePath);
-  await fs13.mkdir(dir, { recursive: true });
+  const dir = path15.dirname(filePath);
+  await fs14.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs13.writeFile(tempPath, content, "utf-8");
+  await fs14.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs13.link(tempPath, filePath);
+      await fs14.link(tempPath, filePath);
     } catch (err) {
-      await fs13.unlink(tempPath).catch(() => {
+      await fs14.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError2(err)) {
         throw new OccWriteConflictError();
       }
       throw err;
     }
-    await fs13.unlink(tempPath).catch(() => {
+    await fs14.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs13.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs14.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -3864,16 +3882,16 @@ async function writeOccJsonFile(filePath, payload, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError();
     }
-    await fs13.rename(tempPath, filePath);
+    await fs14.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs13.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs14.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError();
     }
   } catch (err) {
-    await fs13.unlink(tempPath).catch(() => {
+    await fs14.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -3899,8 +3917,8 @@ async function withOccRetry(operation, options) {
   throw new Error("Unreachable");
 }
 async function withOccFileLock(filePath, fn) {
-  const dir = path14.dirname(filePath);
-  await fs13.mkdir(dir, { recursive: true });
+  const dir = path15.dirname(filePath);
+  await fs14.mkdir(dir, { recursive: true });
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -3984,11 +4002,11 @@ function gitChildEnv(overrides) {
   return { ...env, ...FORCE_C_LOCALE, ...overrides };
 }
 async function ensureGitExcludePattern(repoPath, pattern) {
-  const excludePath = path16.join(repoPath, ".git", "info", "exclude");
-  await fs15.mkdir(path16.dirname(excludePath), { recursive: true });
+  const excludePath = path17.join(repoPath, ".git", "info", "exclude");
+  await fs16.mkdir(path17.dirname(excludePath), { recursive: true });
   let content = "";
   try {
-    content = await fs15.readFile(excludePath, "utf-8");
+    content = await fs16.readFile(excludePath, "utf-8");
   } catch (err) {
     if (!isNotFoundError3(err))
       throw err;
@@ -4000,7 +4018,7 @@ async function ensureGitExcludePattern(repoPath, pattern) {
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-  await fs15.writeFile(excludePath, newContent, "utf-8");
+  await fs16.writeFile(excludePath, newContent, "utf-8");
   log5.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
 async function loadOrCreateBranchContext(options) {
@@ -4156,30 +4174,30 @@ function isValidImageCropValue(value) {
   }
   return isValidCropRect(x, y, w, h);
 }
-function validateImageValue(field, value, path212) {
+function validateImageValue(field, value, path222) {
   if (!isPlainRecord3(value)) {
-    return [{ fieldPath: path212, message: "Expected an image object with { src, alt }" }];
+    return [{ fieldPath: path222, message: "Expected an image object with { src, alt }" }];
   }
   const errors = [];
   if (typeof value.src !== "string" || value.src.trim() === "") {
-    errors.push({ fieldPath: `${path212}.src`, message: "Image src is required" });
+    errors.push({ fieldPath: `${path222}.src`, message: "Image src is required" });
   }
   if (typeof value.alt !== "string") {
-    errors.push({ fieldPath: `${path212}.alt`, message: "Image alt text is required" });
+    errors.push({ fieldPath: `${path222}.alt`, message: "Image alt text is required" });
   } else if (value.alt.trim() === "" && field.altOptional !== true) {
-    errors.push({ fieldPath: `${path212}.alt`, message: "Image alt text is required" });
+    errors.push({ fieldPath: `${path222}.alt`, message: "Image alt text is required" });
   }
   if (value.width !== void 0 && !isPositiveInt(value.width)) {
-    errors.push({ fieldPath: `${path212}.width`, message: "Image width must be a positive integer" });
+    errors.push({ fieldPath: `${path222}.width`, message: "Image width must be a positive integer" });
   }
   if (value.height !== void 0 && !isPositiveInt(value.height)) {
     errors.push({
-      fieldPath: `${path212}.height`,
+      fieldPath: `${path222}.height`,
       message: "Image height must be a positive integer"
     });
   }
   if (value.crop !== void 0 && !isValidImageCropValue(value.crop)) {
-    errors.push({ fieldPath: `${path212}.crop`, message: "Invalid image crop rect" });
+    errors.push({ fieldPath: `${path222}.crop`, message: "Invalid image crop rect" });
   }
   return errors;
 }
@@ -4190,44 +4208,44 @@ function referenceValueId(value) {
     return value.id;
   return void 0;
 }
-function validateScalar(field, value, path212) {
+function validateScalar(field, value, path222) {
   switch (field.type) {
     case "number":
       if (typeof value !== "number" || !Number.isFinite(value)) {
-        return [{ fieldPath: path212, message: "Expected a number" }];
+        return [{ fieldPath: path222, message: "Expected a number" }];
       }
       return [];
     case "boolean":
       if (typeof value !== "boolean") {
-        return [{ fieldPath: path212, message: "Expected true or false" }];
+        return [{ fieldPath: path222, message: "Expected true or false" }];
       }
       return [];
     case "datetime":
       if (typeof value !== "string" || value !== "" && Number.isNaN(Date.parse(value))) {
-        return [{ fieldPath: path212, message: "Expected a valid date/time string" }];
+        return [{ fieldPath: path222, message: "Expected a valid date/time string" }];
       }
       return [];
     case "select": {
       if (typeof value !== "string") {
-        return [{ fieldPath: path212, message: "Expected a selection" }];
+        return [{ fieldPath: path222, message: "Expected a selection" }];
       }
       const options = selectOptionValues(field);
       if (value !== "" && !options.includes(value)) {
-        return [{ fieldPath: path212, message: `Must be one of: ${options.join(", ")}` }];
+        return [{ fieldPath: path222, message: `Must be one of: ${options.join(", ")}` }];
       }
       return [];
     }
     case "reference":
       if (referenceValueId(value) === void 0) {
-        return [{ fieldPath: path212, message: "Expected a reference id" }];
+        return [{ fieldPath: path222, message: "Expected a reference id" }];
       }
       return [];
     case "image":
-      return validateImageValue(field, value, path212);
+      return validateImageValue(field, value, path222);
     default:
       if (STRING_FIELD_TYPES.has(field.type)) {
         if (typeof value !== "string") {
-          return [{ fieldPath: path212, message: "Expected text" }];
+          return [{ fieldPath: path222, message: "Expected text" }];
         }
       }
       return [];
@@ -4250,12 +4268,12 @@ function validateEntryData(fields, data, pathPrefix = "") {
       errors.push(...validateEntryData(field.fields, data, pathPrefix));
       continue;
     }
-    const path212 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
+    const path222 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
     const value = data[field.name];
     const isRequired = "required" in field && field.required === true;
     if (isRequired && isEmptyForRequired(field, value)) {
       const message = Array.isArray(value) ? "At least one item is required" : "This field is required";
-      errors.push({ fieldPath: path212, message });
+      errors.push({ fieldPath: path222, message });
       continue;
     }
     if (value === void 0 || value === null)
@@ -4263,11 +4281,11 @@ function validateEntryData(fields, data, pathPrefix = "") {
     if (field.type === "block") {
       const blockField = field;
       if (!Array.isArray(value)) {
-        errors.push({ fieldPath: path212, message: "Expected a list of blocks" });
+        errors.push({ fieldPath: path222, message: "Expected a list of blocks" });
         continue;
       }
       value.forEach((item, index) => {
-        const itemPath = `${path212}[${index}]`;
+        const itemPath = `${path222}[${index}]`;
         if (!isPlainRecord3(item)) {
           errors.push({ fieldPath: itemPath, message: "Expected a block object" });
           return;
@@ -4289,11 +4307,11 @@ function validateEntryData(fields, data, pathPrefix = "") {
       const objectField = field;
       if (objectField.list) {
         if (!Array.isArray(value)) {
-          errors.push({ fieldPath: path212, message: "Expected a list of items" });
+          errors.push({ fieldPath: path222, message: "Expected a list of items" });
           continue;
         }
         value.forEach((item, index) => {
-          const itemPath = `${path212}[${index}]`;
+          const itemPath = `${path222}[${index}]`;
           if (!isPlainRecord3(item)) {
             errors.push({ fieldPath: itemPath, message: "Expected an object" });
             return;
@@ -4303,27 +4321,27 @@ function validateEntryData(fields, data, pathPrefix = "") {
           }
         });
       } else if (!isPlainRecord3(value)) {
-        errors.push({ fieldPath: path212, message: "Expected an object" });
+        errors.push({ fieldPath: path222, message: "Expected an object" });
       } else if (objectField.fields) {
-        errors.push(...validateEntryData(objectField.fields, value, path212));
+        errors.push(...validateEntryData(objectField.fields, value, path222));
       }
       continue;
     }
     if ("list" in field && field.list) {
       if (!Array.isArray(value)) {
-        errors.push({ fieldPath: path212, message: "Expected a list of values" });
+        errors.push({ fieldPath: path222, message: "Expected a list of values" });
         continue;
       }
       value.forEach((item, index) => {
-        errors.push(...validateScalar(field, item, `${path212}[${index}]`));
+        errors.push(...validateScalar(field, item, `${path222}[${index}]`));
       });
       continue;
     }
     if (Array.isArray(value) && KNOWN_FIELD_TYPES.has(field.type)) {
-      errors.push({ fieldPath: path212, message: "Expected a single value, not a list" });
+      errors.push({ fieldPath: path222, message: "Expected a single value, not a list" });
       continue;
     }
-    errors.push(...validateScalar(field, value, path212));
+    errors.push(...validateScalar(field, value, path222));
   }
   return errors;
 }
@@ -4369,7 +4387,7 @@ These are likely abandoned create-scaffolds (empty entries left behind when a cr
 }
 async function readGeneratedRecord(outputDir) {
   try {
-    const raw = await fs17.readFile(path19.join(outputDir, GENERATED_RECORD_FILENAME), "utf-8");
+    const raw = await fs18.readFile(path20.join(outputDir, GENERATED_RECORD_FILENAME), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || !("files" in parsed))
       return [];
@@ -4383,20 +4401,54 @@ async function readGeneratedRecord(outputDir) {
 }
 async function writeGeneratedRecord(outputDir, files) {
   const record = { files: [...files].sort() };
-  await fs17.mkdir(outputDir, { recursive: true });
-  await fs17.writeFile(path19.join(outputDir, GENERATED_RECORD_FILENAME), `${JSON.stringify(record, null, 2)}
+  await fs18.mkdir(outputDir, { recursive: true });
+  await fs18.writeFile(path20.join(outputDir, GENERATED_RECORD_FILENAME), `${JSON.stringify(record, null, 2)}
 `, "utf-8");
 }
 async function removeEmptyDirsUpward(startDir, stopAt) {
   let current = startDir;
   while (current.startsWith(stopAt) && current !== stopAt) {
     try {
-      await fs17.rmdir(current);
+      await fs18.rmdir(current);
     } catch {
       return;
     }
-    current = path19.dirname(current);
+    current = path20.dirname(current);
+  }
+}
+function isUsableBuildId(value) {
+  return SAFE_BUILD_ID.test(value) && value !== "." && value !== "..";
+}
+function unpinnedConsequence(buildId) {
+  return buildId ? "omitting `generated` from the manifest entirely (a build id is set, so no build clock is recorded)." : "recording the current time in `generated` instead.";
+}
+function resolveBuildStamp() {
+  const rawBuildId = process.env.CANOPY_BUILD_ID;
+  const trimmedBuildId = rawBuildId?.trim();
+  let buildId;
+  if (rawBuildId === void 0) {
+    buildId = void 0;
+  } else if (!trimmedBuildId) {
+    console.warn("CanopyCMS: CANOPY_BUILD_ID is set but blank \u2014 recording no buildId in the manifest.");
+  } else if (!isUsableBuildId(trimmedBuildId)) {
+    console.warn(`CanopyCMS: ignoring CANOPY_BUILD_ID="${trimmedBuildId}": it ${BUILD_ID_RULE}, so that the manifest's buildId can match the build id Next stores for the same artifact.`);
+  } else {
+    buildId = trimmedBuildId;
+  }
+  const rawEpoch = process.env.SOURCE_DATE_EPOCH;
+  const trimmedEpoch = rawEpoch?.trim();
+  if (rawEpoch !== void 0 && !trimmedEpoch) {
+    console.warn(`CanopyCMS: SOURCE_DATE_EPOCH is set but blank \u2014 ${unpinnedConsequence(buildId)}`);
+  }
+  if (!trimmedEpoch)
+    return { buildId };
+  const seconds = /^\d+$/.test(trimmedEpoch) ? Number(trimmedEpoch) : Number.NaN;
+  const date = new Date(seconds * 1e3);
+  if (Number.isNaN(date.getTime())) {
+    console.warn(`CanopyCMS: ignoring SOURCE_DATE_EPOCH="${trimmedEpoch}" (expected decimal seconds since the Unix epoch) \u2014 ${unpinnedConsequence(buildId)}`);
+    return { buildId };
   }
+  return { generatedAt: date.toISOString(), buildId };
 }
 async function generateAIContentFiles(options) {
   const { config, entrySchemaRegistry, outputDir, aiConfig: aiConfig2, _testFlatSchema } = options;
@@ -4418,11 +4470,12 @@ async function generateAIContentFiles(options) {
     flatSchema,
     contentRoot: contentRootName,
     config: aiConfig2,
-    entryLinkUrl: config.entryLinkUrl
+    entryLinkUrl: config.entryLinkUrl,
+    ...resolveBuildStamp()
   });
-  const absoluteOutputDir = path19.resolve(outputDir) + path19.sep;
+  const absoluteOutputDir = path20.resolve(outputDir) + path20.sep;
   const resolveOutputPath = (filePath) => {
-    const absolutePath = path19.resolve(path19.join(absoluteOutputDir, filePath));
+    const absolutePath = path20.resolve(path20.join(absoluteOutputDir, filePath));
     if (!absolutePath.startsWith(absoluteOutputDir)) {
       throw new Error(`Path traversal detected in AI content output: ${filePath}`);
     }
@@ -4434,8 +4487,8 @@ async function generateAIContentFiles(options) {
   let fileCount = 0;
   for (const [filePath, content] of result.files) {
     const absolutePath = resolveOutputPath(filePath);
-    await fs17.mkdir(path19.dirname(absolutePath), { recursive: true });
-    await fs17.writeFile(absolutePath, content, "utf-8");
+    await fs18.mkdir(path20.dirname(absolutePath), { recursive: true });
+    await fs18.writeFile(absolutePath, content, "utf-8");
     fileCount++;
   }
   const currentSet = new Set(currentFiles);
@@ -4444,13 +4497,13 @@ async function generateAIContentFiles(options) {
   for (const filePath of stale) {
     const absolutePath = resolveOutputPath(filePath);
     try {
-      await fs17.unlink(absolutePath);
+      await fs18.unlink(absolutePath);
       removedCount++;
     } catch (err) {
       if (!isNodeError3(err) || err.code !== "ENOENT")
         throw err;
     }
-    await removeEmptyDirsUpward(path19.dirname(absolutePath), absoluteOutputDir);
+    await removeEmptyDirsUpward(path20.dirname(absolutePath), absoluteOutputDir);
   }
   await writeGeneratedRecord(absoluteOutputDir, currentFiles);
   return { fileCount, removedCount, outputDir: absoluteOutputDir };
@@ -4458,7 +4511,7 @@ async function generateAIContentFiles(options) {
 async function generateAIContentCLI(options) {
   const { projectDir, outputDir = "public/ai", configPath, appDir = "app" } = options;
   console.log("\nCanopyCMS generate-ai-content\n");
-  const canopyConfigPath = path20.join(projectDir, "canopycms.config.ts");
+  const canopyConfigPath = path21.join(projectDir, "canopycms.config.ts");
   let canopyConfigModule;
   try {
     canopyConfigModule = await jiti.import(canopyConfigPath);
@@ -4469,7 +4522,7 @@ async function generateAIContentCLI(options) {
   }
   const configExport = canopyConfigModule.default ?? canopyConfigModule.config ?? canopyConfigModule;
   const serverConfig = typeof configExport === "object" && configExport !== null && "server" in configExport ? configExport.server : configExport;
-  const schemasPath = path20.join(projectDir, appDir, "schemas.ts");
+  const schemasPath = path21.join(projectDir, appDir, "schemas.ts");
   let entrySchemaRegistry = {};
   try {
     const schemasModule = await jiti.import(schemasPath);
@@ -4480,7 +4533,7 @@ async function generateAIContentCLI(options) {
   let aiConfig2;
   if (configPath) {
     try {
-      const aiConfigModule = await jiti.import(path20.resolve(configPath));
+      const aiConfigModule = await jiti.import(path21.resolve(configPath));
       aiConfig2 = aiConfigModule.aiContentConfig ?? aiConfigModule.default ?? aiConfigModule.config;
     } catch (err) {
       console.error(`Could not load AI config from ${configPath}`);
@@ -4497,7 +4550,7 @@ async function generateAIContentCLI(options) {
     console.error("Make sure canopycms.config.ts uses defineCanopyConfig().");
     process.exit(1);
   }
-  const resolvedOutput = path20.resolve(projectDir, outputDir);
+  const resolvedOutput = path21.resolve(projectDir, outputDir);
   console.log(`  Output: ${resolvedOutput}`);
   console.log(`  Mode: ${serverConfig.mode ?? "dev"}`);
   const result = await generateAIContentFiles({
@@ -4514,7 +4567,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, DEFAULT_SEO_FIELD_NAMES, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, DEFAULT_SEO_FIELD_NAMES, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, BRANCH_META_DIR, BRANCH_META_FILE, BranchMetadataCorruptError, branchMetadataFilePath, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -6256,14 +6309,62 @@ var init_generate_ai_content = __esm({
       getSchemaItems() {
         return this.schemaIndex.values();
       }
-      assertSchemaItem(path212) {
-        const normalized = normalizeFilesystemPath(path212);
+      assertSchemaItem(path222) {
+        const normalized = normalizeFilesystemPath(path222);
         const item = this.schemaIndex.get(normalized);
         if (!item) {
-          throw new ContentStoreError(`Unknown schema item: ${path212}`, "NO_SCHEMA_ITEM");
+          throw new ContentStoreError(`Unknown schema item: ${path222}`, "NO_SCHEMA_ITEM");
         }
         return item;
       }
+      /**
+       * Is this path a COLLECTION schema item?
+       *
+       * The non-throwing form of `assertCollection`, reading the same `schemaIndex` -- which is the
+       * point. A caller that gates on this cannot disagree with what `buildPaths` will then do: the
+       * Map is last-wins, so where a subcollection's path collides with a parent's entry-type name
+       * both this and `buildPaths` see the collection. A `find` over the flat schema LIST is
+       * first-wins and would not.
+       *
+       * Type-only, deliberately -- `resolvePath` additionally requires `entries`, but a collection
+       * with subcollections and no entries of its own is legal, and mirroring that stricter test here
+       * would reject something `buildPaths` accepts.
+       *
+       * Exists for `readByUrlPath`'s URL-addressability gate; see `ReadContentInput`'s
+       * `urlAddressableOnly` and the note on `buildPaths`' entry-type branch below.
+       */
+      isCollectionPath(collectionPath) {
+        return this.schemaIndex.get(normalizeFilesystemPath(collectionPath))?.type === "collection";
+      }
+      /**
+       * Does this collection declare `entryTypeName` in its `entries` config?
+       *
+       * Mirrors `parseTypedFilename(filename, collection.entries)`, which is how `listEntries` decides
+       * whether a file on disk is one of the collection's entries at all. `buildPaths`' own directory
+       * scan deliberately does NOT check this -- it matches on slug alone, so that an entry whose type
+       * was renamed out of the schema stays findable and therefore still editable, renameable and
+       * deletable. Only URL resolution consults this, so what enumeration hides is not served.
+       *
+       * Returns FALSE when the collection declares no `entries` at all, which is stricter than
+       * `parseTypedFilename`'s own `if (entryTypes && ...)` guard and deliberately so: the enumerating
+       * surface is not `parseTypedFilename`, it is `listCollectionEntries`, and that returns `[]`
+       * outright for a collection with no `entries`. A collections-only container therefore publishes
+       * nothing, so a URL read that resolved a file sitting in one would be answering where nothing is
+       * advertised -- the exact disagreement this predicate exists to close. Such a file cannot have
+       * been created by the CMS (there is no entry type to create it as); it arrived by hand, by merge
+       * or by retrofit, and it is invisible to the sitemap and to static params either way.
+       *
+       * Returns true for a path that is not a collection at all, because that is rule 1's question,
+       * not this one's -- and under `urlAddressableOnly` rule 1 has already rejected it.
+       */
+      declaresEntryType(collectionPath, entryTypeName) {
+        const item = this.schemaIndex.get(normalizeFilesystemPath(collectionPath));
+        if (item?.type !== "collection")
+          return true;
+        if (!item.entries)
+          return false;
+        return item.entries.some((e) => e.name === entryTypeName);
+      }
       assertCollection(collectionPath) {
         const item = this.assertSchemaItem(collectionPath);
         if (item.type !== "collection") {
@@ -6520,7 +6621,16 @@ var init_generate_ai_content = __esm({
             collection: schemaItem.logicalPath,
             collectionName: schemaItem.name,
             format,
-            data: parsed.data ?? {},
+            // Copy, never the object gray-matter hands back: its cache is
+            // process-global and keyed by file content, so every caller parsing the
+            // same bytes gets the SAME `data` instance (the hazard content-listing.ts
+            // documents at length). Assigning it straight into `doc.data` was safe
+            // only by accident -- `resolveReferencesInData` spreads its input, so the
+            // shared object got replaced a few lines down. But that only happens when
+            // resolution runs: with `resolveReferences: false` the caller was handed
+            // the shared instance itself, and one mutation would poison every later
+            // parse of those bytes.
+            data: { ...parsed.data ?? {} },
             body: parsed.content,
             bodyFieldName: findBodyFieldName(fields),
             relativePath,
@@ -7186,6 +7296,17 @@ var init_generate_ai_content = __esm({
     log22 = createDebugLogger2({ prefix: "EntryLinks" });
     BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
     ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
+    BRANCH_META_DIR = ".canopy-meta";
+    BRANCH_META_FILE = "branch.json";
+    BranchMetadataCorruptError = class extends Error {
+      constructor(branchRoot, cause) {
+        super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
+        this.name = "BranchMetadataCorruptError";
+        this.branchRoot = branchRoot;
+        this.parseCause = cause;
+      }
+    };
+    branchMetadataFilePath = (branchRoot) => path13.join(path13.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
     init_logger2();
     log3 = createDebugLogger2({ prefix: "BranchRegistry" });
     REGISTRY_FILE = "branches.json";
@@ -7198,10 +7319,10 @@ var init_generate_ai_content = __esm({
       constructor(root) {
         this.regenInFlight = null;
         this.lastForcedRefreshMs = 0;
-        this.root = path13.resolve(root);
-        this.registryPath = path13.join(this.root, REGISTRY_FILE);
-        this.stalePath = path13.join(this.root, REGISTRY_STALE_FILE);
-        this.tempPath = path13.join(this.root, REGISTRY_TEMP_FILE);
+        this.root = path14.resolve(root);
+        this.registryPath = path14.join(this.root, REGISTRY_FILE);
+        this.stalePath = path14.join(this.root, REGISTRY_STALE_FILE);
+        this.tempPath = path14.join(this.root, REGISTRY_TEMP_FILE);
       }
       /**
        * Returns all branches. Uses the cached snapshot if its embedded generation
@@ -7210,7 +7331,7 @@ var init_generate_ai_content = __esm({
       async list() {
         let parsed;
         try {
-          const raw = await fs12.readFile(this.registryPath, "utf8");
+          const raw = await fs13.readFile(this.registryPath, "utf8");
           parsed = JSON.parse(raw);
         } catch (err) {
           if (isNotFoundError3(err)) {
@@ -7299,7 +7420,7 @@ var init_generate_ai_content = __esm({
       async performRegenerate() {
         const read = await readResourceGeneration(this.root, RESOURCE2);
         const branches = await this.scanBranchDirectories();
-        await fs12.unlink(this.stalePath).catch(() => {
+        await fs13.unlink(this.stalePath).catch(() => {
         });
         if (!read.ok) {
           return branches;
@@ -7310,12 +7431,12 @@ var init_generate_ai_content = __esm({
           generation: read.token
         };
         const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-        await fs12.mkdir(this.root, { recursive: true });
-        await fs12.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+        await fs13.mkdir(this.root, { recursive: true });
+        await fs13.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
         try {
-          await fs12.rename(uniqueTempPath, this.registryPath);
+          await fs13.rename(uniqueTempPath, this.registryPath);
         } catch (err) {
-          await fs12.unlink(uniqueTempPath).catch(() => {
+          await fs13.unlink(uniqueTempPath).catch(() => {
           });
           throw err;
         }
@@ -7329,15 +7450,15 @@ var init_generate_ai_content = __esm({
       async scanBranchDirectories() {
         const branches = [];
         try {
-          const entries = await fs12.readdir(this.root, { withFileTypes: true });
+          const entries = await fs13.readdir(this.root, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory() || entry.name.startsWith(".")) {
               continue;
             }
-            const branchRoot = path13.join(this.root, entry.name);
+            const branchRoot = path14.join(this.root, entry.name);
             let meta;
             try {
-              meta = await BranchMetadataFileManager.loadOnly(branchRoot);
+              meta = await readBranchMetadataFile(branchRoot);
             } catch (err) {
               canopyLogWarn2(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage3(err)}`);
               continue;
@@ -7366,8 +7487,6 @@ var init_generate_ai_content = __esm({
         this.name = "OccWriteConflictError";
       }
     };
-    BRANCH_META_DIR = ".canopy-meta";
-    BRANCH_META_FILE = "branch.json";
     CURRENT_SCHEMA_VERSION = 1;
     BranchMetadataConflictError = class extends Error {
       constructor(message = "Concurrent modification detected in branch metadata") {
@@ -7375,18 +7494,10 @@ var init_generate_ai_content = __esm({
         this.name = "BranchMetadataConflictError";
       }
     };
-    BranchMetadataCorruptError = class extends Error {
-      constructor(branchRoot, cause) {
-        super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
-        this.name = "BranchMetadataCorruptError";
-        this.branchRoot = branchRoot;
-        this.parseCause = cause;
-      }
-    };
     BranchMetadataFileManager = class _BranchMetadataFileManager {
       constructor(branchRoot, baseRoot, options) {
-        this.branchRoot = path15.resolve(branchRoot);
-        this.filePath = path15.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
+        this.branchRoot = path16.resolve(branchRoot);
+        this.filePath = path16.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
         this.baseRoot = baseRoot;
         this.settleMs = options?.settleMs;
       }
@@ -7395,20 +7506,7 @@ var init_generate_ai_content = __esm({
        * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
        */
       static async loadOnly(branchRoot) {
-        const resolvedRoot = path15.resolve(branchRoot);
-        const filePath = path15.join(resolvedRoot, BRANCH_META_DIR, BRANCH_META_FILE);
-        try {
-          const raw = await fs14.readFile(filePath, "utf8");
-          return JSON.parse(raw);
-        } catch (err) {
-          if (isNotFoundError3(err)) {
-            return null;
-          }
-          if (err instanceof SyntaxError) {
-            throw new BranchMetadataCorruptError(resolvedRoot, err.message);
-          }
-          throw err;
-        }
+        return readBranchMetadataFile(branchRoot);
       }
       /**
        * Get a BranchMetadataFileManager instance configured for registry invalidation.
@@ -7419,7 +7517,7 @@ var init_generate_ai_content = __esm({
       }
       async load() {
         try {
-          const raw = await fs14.readFile(this.filePath, "utf8");
+          const raw = await fs15.readFile(this.filePath, "utf8");
           const parsed = JSON.parse(raw);
           const version = parsed.version ?? 0;
           return { meta: parsed, version };
@@ -7481,7 +7579,7 @@ var init_generate_ai_content = __esm({
        */
       async save(incoming) {
         try {
-          await fs14.stat(this.branchRoot);
+          await fs15.stat(this.branchRoot);
         } catch (err) {
           if (isNotFoundError3(err)) {
             throw new BranchMetadataConflictError("Branch no longer exists");
@@ -7594,12 +7692,12 @@ var init_generate_ai_content = __esm({
     };
     GitManager = class _GitManager {
       constructor(options, gitOptions) {
-        this.repoPath = path16.resolve(options.repoPath);
+        this.repoPath = path17.resolve(options.repoPath);
         this.baseBranch = options.baseBranch ?? "main";
         this.remote = options.remote ?? "origin";
         this.skipIndexMarker = options.skipIndexMarker ?? false;
         this.git = simpleGit2({ baseDir: this.repoPath, ...gitOptions });
-        this.git.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path16.dirname(this.repoPath) }));
+        this.git.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(this.repoPath) }));
       }
       static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
         log5.debug("git", "Cloning repository", {
@@ -7641,11 +7739,11 @@ var init_generate_ai_content = __esm({
               remotePath: options.remotePath,
               baseBranch: options.baseBranch
             });
-            const remoteParent = path16.dirname(options.remotePath);
+            const remoteParent = path17.dirname(options.remotePath);
             releaseLock = await acquireProvisioningLock(remoteParent, ".remote-init.lock");
             let remoteExists = false;
             try {
-              const stat = await fs15.stat(options.remotePath);
+              const stat = await fs16.stat(options.remotePath);
               remoteExists = stat.isDirectory();
             } catch (err) {
               if (!isNotFoundError3(err))
@@ -7730,7 +7828,7 @@ var init_generate_ai_content = __esm({
        * guard, which also needs the tracking namespace: `syncGit()` fetches
        * GitHub into `GITHUB_TRACKING_REF_PREFIX*` rather than `refs/heads/*`
        * directly (see that constant's doc comment above), and
-       * `reconcileTrackedBranches()` (worker/cms-worker.ts) only
+       * `reconcileTrackedBranches()` (worker/git-sync.ts) only
        * non-destructively brings `refs/heads/*` toward what's tracked there — so
        * a branch that another CanopyCMS deployment sharing this repo (or a
        * direct push to GitHub) just created can sit in the tracking namespace
@@ -7805,7 +7903,7 @@ var init_generate_ai_content = __esm({
        * "absent" deterministic instead of parsing update-ref's locale-dependent
        * failure text, and its captured SHA is passed to `update-ref -d` as the
        * expected old value -- same pattern as reconcileTrackedBranches'
-       * guarded updates (worker/cms-worker.ts): a concurrent Lambda push
+       * guarded updates (worker/git-sync.ts): a concurrent Lambda push
        * re-creating/moving this branch between the read and the delete makes
        * update-ref throw (surfaced as the caller's best-effort warning) instead
        * of silently deleting a commit that was just pushed. No
@@ -7897,7 +7995,7 @@ var init_generate_ai_content = __esm({
        */
       static async validateGitRepoExists(repoPath) {
         try {
-          const stat = await fs15.stat(path16.join(repoPath, ".git"));
+          const stat = await fs16.stat(path17.join(repoPath, ".git"));
           if (!stat.isDirectory()) {
             throw new Error(`Expected git repo at ${repoPath}`);
           }
@@ -7975,7 +8073,7 @@ var init_generate_ai_content = __esm({
         }
         if (config.autoDetectRemotePath) {
           try {
-            const stat = await fs15.stat(config.autoDetectRemotePath);
+            const stat = await fs16.stat(config.autoDetectRemotePath);
             if (stat.isDirectory()) {
               log5.debug("git", "Auto-detected local remote", {
                 path: config.autoDetectRemotePath
@@ -7988,8 +8086,8 @@ var init_generate_ai_content = __esm({
         if (config.shouldAutoInitLocal) {
           const gitRoot = await this.findGitRoot();
           const sourceRoot = options.sourceRoot;
-          const sourcePath = sourceRoot ? path16.resolve(gitRoot, sourceRoot) : gitRoot;
-          const localRemotePath = path16.join(sourcePath, config.defaultRemotePath);
+          const sourcePath = sourceRoot ? path17.resolve(gitRoot, sourceRoot) : gitRoot;
+          const localRemotePath = path17.join(sourcePath, config.defaultRemotePath);
           await this.ensureLocalSimulatedRemote({
             remotePath: localRemotePath,
             sourcePath: gitRoot,
@@ -8017,7 +8115,7 @@ var init_generate_ai_content = __esm({
       static async repoExistsAt(workspacePath) {
         try {
           const checkGit = simpleGit2({ baseDir: workspacePath });
-          checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path16.dirname(workspacePath) }));
+          checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(workspacePath) }));
           await checkGit.raw(["rev-parse", "--git-dir"]);
           return true;
         } catch {
@@ -8039,19 +8137,19 @@ var init_generate_ai_content = __esm({
         const baseBranch = await resolveBaseBranch({
           defaultBaseBranch: options.baseBranch,
           mode: options.mode,
-          detectFrom: options.sourceRoot ? path16.resolve(process.cwd(), options.sourceRoot) : process.cwd()
+          detectFrom: options.sourceRoot ? path17.resolve(process.cwd(), options.sourceRoot) : process.cwd()
         });
         const remoteName = options.remoteName ?? "origin";
         const repoExists = await _GitManager.repoExistsAt(options.workspacePath);
         if (!repoExists) {
-          const gitPath = path16.join(options.workspacePath, ".git");
+          const gitPath = path17.join(options.workspacePath, ".git");
           try {
-            const stat = await fs15.stat(gitPath);
+            const stat = await fs16.stat(gitPath);
             if (stat.isDirectory()) {
               log5.debug("git", "Removing corrupt .git directory", {
                 workspacePath: options.workspacePath
               });
-              await fs15.rm(gitPath, { recursive: true });
+              await fs16.rm(gitPath, { recursive: true });
             }
           } catch (cleanupErr) {
             if (!isNotFoundError3(cleanupErr))
@@ -8078,7 +8176,7 @@ var init_generate_ai_content = __esm({
           }
           justCloned = true;
           const freshGit = simpleGit2({ baseDir: options.workspacePath });
-          freshGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path16.dirname(options.workspacePath) }));
+          freshGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(options.workspacePath) }));
           await freshGit.addConfig("canopycms.managed", "true");
           await freshGit.addConfig("user.name", options.gitBotAuthorName);
           await freshGit.addConfig("user.email", options.gitBotAuthorEmail);
@@ -8429,9 +8527,9 @@ var init_generate_ai_content = __esm({
         } catch {
         }
         for (const [filePath, content] of Object.entries(initialFiles)) {
-          const absolutePath = path16.join(this.repoPath, filePath);
-          await fs15.mkdir(path16.dirname(absolutePath), { recursive: true });
-          await fs15.writeFile(absolutePath, content, "utf-8");
+          const absolutePath = path17.join(this.repoPath, filePath);
+          await fs16.mkdir(path17.dirname(absolutePath), { recursive: true });
+          await fs16.writeFile(absolutePath, content, "utf-8");
           await this.git.add(filePath);
         }
         await this.git.commit("Initialize settings branch", ["--allow-empty"]);
@@ -8458,7 +8556,7 @@ var init_generate_ai_content = __esm({
                 branchName: options.branchName,
                 mode: options.mode
               });
-              releaseLock = await acquireProvisioningLock(path17.dirname(options.branchRoot), `.${path17.basename(options.branchRoot)}.init.lock`);
+              releaseLock = await acquireProvisioningLock(path18.dirname(options.branchRoot), `.${path18.basename(options.branchRoot)}.init.lock`);
               await GitManager.initializeWorkspace({
                 workspacePath: options.branchRoot,
                 branchName: options.branchName,
@@ -8499,7 +8597,7 @@ var init_generate_ai_content = __esm({
         const baseBranch = await resolveBaseBranch({
           defaultBaseBranch: this.config.defaultBaseBranch,
           mode,
-          detectFrom: this.config.sourceRoot ? path17.resolve(process.cwd(), this.config.sourceRoot) : void 0
+          detectFrom: this.config.sourceRoot ? path18.resolve(process.cwd(), this.config.sourceRoot) : void 0
         });
         await this.ensureGitWorkspace({
           branchRoot,
@@ -8536,7 +8634,7 @@ var init_generate_ai_content = __esm({
     };
     readEntryData = async (filePath, format, bodyFieldName = "body") => {
       try {
-        const raw = await fs16.readFile(filePath, "utf8");
+        const raw = await fs17.readFile(filePath, "utf8");
         if (format === "json") {
           return asRecord(JSON.parse(raw));
         }
@@ -8597,7 +8695,7 @@ var init_generate_ai_content = __esm({
       normalizePath(root, collectionRoot);
       let dirents;
       try {
-        dirents = await fs16.readdir(collectionRoot, { withFileTypes: true });
+        dirents = await fs17.readdir(collectionRoot, { withFileTypes: true });
       } catch (err) {
         if (isNotFoundError3(err))
           return [];
@@ -8605,7 +8703,7 @@ var init_generate_ai_content = __esm({
       }
       const files = dirents.filter((d) => d.isFile() && validExts.some((ext) => d.name.endsWith(ext)) && d.name !== ".collection.json").sort((a, b) => a.name.localeCompare(b.name));
       const entries = await Promise.all(files.map(async (file) => {
-        const absolutePath = path18.join(collectionRoot, file.name);
+        const absolutePath = path19.join(collectionRoot, file.name);
         const relativePath = normalizePath(root, absolutePath);
         const parsed = parseTypedFilename(file.name, entryTypes);
         if (!parsed) {
@@ -8620,7 +8718,7 @@ var init_generate_ai_content = __esm({
         const format = entryType?.format || "json";
         const bodyField = entryType?.schema ? findBodyFieldName(entryType.schema) : "body";
         const [stats, data] = await Promise.all([
-          fs16.stat(absolutePath),
+          fs17.stat(absolutePath),
           readEntryData(absolutePath, format, bodyField)
         ]);
         const item = {
@@ -8645,22 +8743,24 @@ var init_generate_ai_content = __esm({
     STRING_FIELD_TYPES = /* @__PURE__ */ new Set(["string", "markdown", "mdx", "code"]);
     selectOptionValues = (field) => (field.options ?? []).map((opt) => typeof opt === "string" ? opt : opt.value);
     GENERATED_RECORD_FILENAME = ".canopy-generated.json";
+    SAFE_BUILD_ID = /^[A-Za-z0-9._-]{1,255}$/;
+    BUILD_ID_RULE = 'must be 1-255 characters of [A-Za-z0-9._-] and not "." or ".."';
     jiti = createJiti2(import.meta.url);
   }
 });
 
 // dist/utils/atomic-write.js
-import fs18 from "node:fs/promises";
-import path21 from "node:path";
+import fs19 from "node:fs/promises";
+import path23 from "node:path";
 async function atomicWriteFile3(filePath, content) {
-  const dir = path21.dirname(filePath);
-  await fs18.mkdir(dir, { recursive: true });
+  const dir = path23.dirname(filePath);
+  await fs19.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs18.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
+  await fs19.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
   try {
-    await fs18.rename(tempPath, filePath);
+    await fs19.rename(tempPath, filePath);
   } catch (err) {
-    await fs18.unlink(tempPath).catch(() => {
+    await fs19.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -8780,11 +8880,11 @@ var init_debug2 = __esm({
 });
 
 // dist/resource-generation.js
-import fs19 from "node:fs/promises";
-import path23 from "node:path";
+import fs20 from "node:fs/promises";
+import path24 from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 function resourceGenerationPath2(root, resource) {
-  return path23.resolve(root, META_DIR3, `${resource}.generation`);
+  return path24.resolve(root, META_DIR3, `${resource}.generation`);
 }
 async function bumpResourceGeneration2(root, resource, options) {
   const token = randomUUID3();
@@ -8802,7 +8902,7 @@ async function bumpResourceGeneration2(root, resource, options) {
 }
 async function readResourceGeneration2(root, resource) {
   try {
-    const token = await fs19.readFile(resourceGenerationPath2(root, resource), "utf-8");
+    const token = await fs20.readFile(resourceGenerationPath2(root, resource), "utf-8");
     return { ok: true, token };
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT")
@@ -8829,10 +8929,10 @@ var init_resource_generation = __esm({
 });
 
 // dist/content-index-registry.js
-import path24 from "node:path";
+import path25 from "node:path";
 function invalidateContentIndexesForRoot2(root) {
-  const rootKey = path24.resolve(root);
-  const prefix = rootKey + path24.sep;
+  const rootKey = path25.resolve(root);
+  const prefix = rootKey + path25.sep;
   for (const [storeRoot, refs] of registry2) {
     if (storeRoot !== rootKey && !storeRoot.startsWith(prefix))
       continue;
@@ -9000,7 +9100,7 @@ var init_content_id_index = __esm({
 });
 
 // dist/schema/meta-loader.js
-import { promises as fs20 } from "fs";
+import { promises as fs21 } from "fs";
 import { join as join4 } from "pathe";
 import { z as z8 } from "zod";
 import chokidar2 from "chokidar";
@@ -9010,7 +9110,7 @@ function stripEmbeddedIdFromName2(name) {
 async function scanForCollectionMeta2(baseDir, relativePath = "") {
   const collections = [];
   try {
-    const entries = await fs20.readdir(baseDir, { withFileTypes: true });
+    const entries = await fs21.readdir(baseDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -9021,8 +9121,8 @@ async function scanForCollectionMeta2(baseDir, relativePath = "") {
       const absolutePath = join4(baseDir, folderName);
       const metaPath = join4(absolutePath, ".collection.json");
       try {
-        await fs20.access(metaPath);
-        const content = await fs20.readFile(metaPath, "utf-8");
+        await fs21.access(metaPath);
+        const content = await fs21.readFile(metaPath, "utf-8");
         const parsed = JSON.parse(content);
         const meta = collectionMetaSchema2.parse(parsed);
         collections.push({
@@ -9054,7 +9154,7 @@ async function loadCollectionMetaFiles2(contentRoot) {
   let root = null;
   const rootMetaPath = join4(contentRoot, ".collection.json");
   try {
-    await fs20.access(rootMetaPath);
+    await fs21.access(rootMetaPath);
   } catch (err) {
     if (err.code === "ENOENT") {
     } else {
@@ -9062,7 +9162,7 @@ async function loadCollectionMetaFiles2(contentRoot) {
     }
   }
   try {
-    const content = await fs20.readFile(rootMetaPath, "utf-8");
+    const content = await fs21.readFile(rootMetaPath, "utf-8");
     const parsed = JSON.parse(content);
     root = rootCollectionMetaSchema2.parse(parsed);
   } catch (err) {
@@ -9500,13 +9600,13 @@ var init_content_index_generation = __esm({
 });
 
 // dist/sync-core.js
-import fs21 from "node:fs/promises";
-import path25 from "node:path";
+import fs24 from "node:fs/promises";
+import path26 from "node:path";
 import { simpleGit as simpleGit4 } from "simple-git";
 function assertWithinDir(resolved, parent, label) {
-  const normalizedResolved = path25.resolve(resolved);
-  const normalizedParent = path25.resolve(parent);
-  if (!normalizedResolved.startsWith(normalizedParent + path25.sep) && normalizedResolved !== normalizedParent) {
+  const normalizedResolved = path26.resolve(resolved);
+  const normalizedParent = path26.resolve(parent);
+  if (!normalizedResolved.startsWith(normalizedParent + path26.sep) && normalizedResolved !== normalizedParent) {
     throw new Error(`${label} escapes the expected directory: ${resolved}`);
   }
 }
@@ -9514,19 +9614,19 @@ async function safeReplaceDir(oldDir, newDir) {
   const backupDir = `${oldDir}.sync-backup-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   const oldExists = await filePathExists(oldDir);
   if (oldExists) {
-    await fs21.rename(oldDir, backupDir);
+    await fs24.rename(oldDir, backupDir);
   }
   try {
-    await fs21.rename(newDir, oldDir);
+    await fs24.rename(newDir, oldDir);
   } catch (err) {
     if (oldExists) {
-      await fs21.rename(backupDir, oldDir).catch(() => {
+      await fs24.rename(backupDir, oldDir).catch(() => {
       });
     }
     throw err;
   }
   if (oldExists) {
-    await fs21.rm(backupDir, { recursive: true, force: true }).catch(() => {
+    await fs24.rm(backupDir, { recursive: true, force: true }).catch(() => {
     });
   }
 }
@@ -9534,7 +9634,7 @@ async function listFilesRecursive(dir, prefix = "") {
   const results = [];
   let entries;
   try {
-    entries = await fs21.readdir(dir, { withFileTypes: true });
+    entries = await fs24.readdir(dir, { withFileTypes: true });
   } catch {
     return results;
   }
@@ -9545,7 +9645,7 @@ async function listFilesRecursive(dir, prefix = "") {
       continue;
     const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
-      results.push(...await listFilesRecursive(path25.join(dir, entry.name), rel));
+      results.push(...await listFilesRecursive(path26.join(dir, entry.name), rel));
     } else {
       results.push(rel);
     }
@@ -9553,19 +9653,19 @@ async function listFilesRecursive(dir, prefix = "") {
   return results;
 }
 async function copyDir(src, dest) {
-  await fs21.mkdir(dest, { recursive: true });
-  const entries = await fs21.readdir(src, { withFileTypes: true });
+  await fs24.mkdir(dest, { recursive: true });
+  const entries = await fs24.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git")
       continue;
     if (entry.isSymbolicLink())
       continue;
-    const srcPath = path25.join(src, entry.name);
-    const destPath = path25.join(dest, entry.name);
+    const srcPath = path26.join(src, entry.name);
+    const destPath = path26.join(dest, entry.name);
     if (entry.isDirectory()) {
       await copyDir(srcPath, destPath);
     } else {
-      await fs21.copyFile(srcPath, destPath);
+      await fs24.copyFile(srcPath, destPath);
     }
   }
 }
@@ -9574,14 +9674,14 @@ async function pushContentToWorkspace(options) {
   if (!await filePathExists(srcContentDir)) {
     return { fileCount: 0 };
   }
-  const wsContentDir = path25.join(branchPath, contentRoot);
+  const wsContentDir = path26.join(branchPath, contentRoot);
   assertWithinDir(wsContentDir, branchPath, "content-root");
   const tmpDir = `${wsContentDir}.sync-tmp-${Date.now()}`;
   try {
     await copyDir(srcContentDir, tmpDir);
     await safeReplaceDir(wsContentDir, tmpDir);
   } catch (err) {
-    await fs21.rm(tmpDir, { recursive: true, force: true }).catch(() => {
+    await fs24.rm(tmpDir, { recursive: true, force: true }).catch(() => {
     });
     throw err;
   }
@@ -9631,15 +9731,15 @@ var init_provisioning_lock = __esm({
 });
 
 // dist/git-manager.js
-import fs24 from "node:fs/promises";
-import path26 from "node:path";
+import fs25 from "node:fs/promises";
+import path27 from "node:path";
 import { simpleGit as simpleGit6 } from "simple-git";
 async function ensureGitExcludePattern2(repoPath, pattern) {
-  const excludePath = path26.join(repoPath, ".git", "info", "exclude");
-  await fs24.mkdir(path26.dirname(excludePath), { recursive: true });
+  const excludePath = path27.join(repoPath, ".git", "info", "exclude");
+  await fs25.mkdir(path27.dirname(excludePath), { recursive: true });
   let content = "";
   try {
-    content = await fs24.readFile(excludePath, "utf-8");
+    content = await fs25.readFile(excludePath, "utf-8");
   } catch (err) {
     if (!isNotFoundError(err))
       throw err;
@@ -9651,7 +9751,7 @@ async function ensureGitExcludePattern2(repoPath, pattern) {
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-  await fs24.writeFile(excludePath, newContent, "utf-8");
+  await fs25.writeFile(excludePath, newContent, "utf-8");
   log9.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
 var log9;
@@ -9808,7 +9908,7 @@ var init_config5 = __esm({
 });
 
 // dist/operating-mode/client-unsafe-strategy.js
-import path27 from "node:path";
+import path28 from "node:path";
 function operatingStrategy3(mode) {
   const cached = strategyCache3.get(mode);
   if (cached)
@@ -9843,32 +9943,32 @@ var init_client_unsafe_strategy2 = __esm({
       // - shouldCommit(), shouldPush()
       // Add client-unsafe methods (use Node.js APIs)
       getWorkspaceRoot(_sourceRoot) {
-        return path27.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE3);
+        return path28.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE3);
       }
       getContentRoot(contentRoot, sourceRoot) {
-        return path27.resolve(sourceRoot ?? process.cwd(), contentRoot);
+        return path28.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
-        return path27.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path28.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path27.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path28.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path27.join(root, this.getPermissionsFileName());
+        return path28.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path27.join(root, this.getGroupsFileName());
+        return path28.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
           shouldAutoInitLocal: false,
           defaultRemotePath: "",
           envVarName: "CANOPYCMS_REMOTE_URL",
-          autoDetectRemotePath: path27.join(this.getWorkspaceRoot(), "remote.git")
+          autoDetectRemotePath: path28.join(this.getWorkspaceRoot(), "remote.git")
         };
       }
       requiresExistingRepo() {
@@ -9880,7 +9980,7 @@ var init_client_unsafe_strategy2 = __esm({
         return `canopycms-settings-${resolveDeploymentName3(config, "prod")}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path27.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path28.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -9897,25 +9997,25 @@ var init_client_unsafe_strategy2 = __esm({
     DevStrategy3 = class extends DevClientSafeStrategy3 {
       // Inherits client-safe methods from DevClientSafeStrategy
       getWorkspaceRoot(sourceRoot) {
-        return path27.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
+        return path28.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
       getContentRoot(contentRoot, sourceRoot) {
-        return path27.resolve(sourceRoot ?? process.cwd(), contentRoot);
+        return path28.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
-        return path27.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path28.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path27.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path28.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path27.join(root, this.getPermissionsFileName());
+        return path28.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path27.join(root, this.getGroupsFileName());
+        return path28.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
@@ -9933,7 +10033,7 @@ var init_client_unsafe_strategy2 = __esm({
         return `canopycms-settings-${resolveDeploymentName3(config, "local")}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path27.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path28.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -9965,8 +10065,8 @@ __export(sync_exports, {
   SyncError: () => SyncError,
   sync: () => sync
 });
-import fs25 from "node:fs/promises";
-import path28 from "node:path";
+import fs26 from "node:fs/promises";
+import path29 from "node:path";
 import { simpleGit as simpleGit7 } from "simple-git";
 import * as p2 from "@clack/prompts";
 async function detectCurrentBranch(projectDir) {
@@ -9979,7 +10079,7 @@ async function detectCurrentBranch(projectDir) {
 async function selectBranch(options, branchesDir) {
   let branches = [];
   if (await filePathExists(branchesDir)) {
-    const entries = await fs25.readdir(branchesDir, { withFileTypes: true });
+    const entries = await fs26.readdir(branchesDir, { withFileTypes: true });
     branches = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
   }
   let branchName = options.branch;
@@ -10007,11 +10107,11 @@ async function selectBranch(options, branchesDir) {
       branchName = result;
     }
   }
-  const branchPath = path28.join(branchesDir, branchName);
+  const branchPath = path29.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
   if (!branches.includes(branchName)) {
     if (options.autoCreate) {
-      await fs25.mkdir(branchPath, { recursive: true });
+      await fs26.mkdir(branchPath, { recursive: true });
       const wsGit = simpleGit7({ baseDir: branchPath });
       await wsGit.init();
       await wsGit.checkoutLocalBranch(branchName);
@@ -10028,8 +10128,8 @@ async function selectBranch(options, branchesDir) {
 async function syncPush(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
-  const branchesDir = path28.join(projectDir, ".canopy-dev", "content-branches");
-  const srcContentDir = path28.join(projectDir, contentRoot);
+  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
+  const srcContentDir = path29.join(projectDir, contentRoot);
   assertWithinDir(srcContentDir, projectDir, "--content-root");
   if (!await filePathExists(srcContentDir)) {
     throw new SyncError(`Content directory not found: ${contentRoot}/ (expected at ${srcContentDir})`);
@@ -10037,7 +10137,7 @@ async function syncPush(options) {
   const branchName = await selectBranch({ ...options, projectDir, autoCreate: true }, branchesDir);
   if (!branchName)
     return { fileCount: 0 };
-  const branchPath = path28.join(branchesDir, branchName);
+  const branchPath = path29.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
   const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
@@ -10095,19 +10195,19 @@ async function syncPush(options) {
 async function syncPull(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
-  const branchesDir = path28.join(projectDir, ".canopy-dev", "content-branches");
+  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
   const branchName = await selectBranch({ ...options, projectDir }, branchesDir);
   if (!branchName)
     return { fileCount: 0 };
-  const branchPath = path28.join(branchesDir, branchName);
+  const branchPath = path29.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
-  const branchContentDir = path28.join(branchPath, contentRoot);
+  const branchContentDir = path29.join(branchPath, contentRoot);
   assertWithinDir(branchContentDir, branchPath, "--content-root");
   if (!await filePathExists(branchContentDir)) {
     throw new SyncError(`Content directory not found in branch workspace: ${branchName}/${contentRoot}`);
   }
   p2.log.step(`Pulling content from branch: ${branchName}`);
-  const destContentDir = path28.join(projectDir, contentRoot);
+  const destContentDir = path29.join(projectDir, contentRoot);
   assertWithinDir(destContentDir, projectDir, "--content-root");
   const sourceGit = simpleGit7({ baseDir: projectDir });
   const status = await sourceGit.status();
@@ -10159,7 +10259,7 @@ async function syncPull(options) {
     await copyDir(branchContentDir, tmpDestDir);
     await safeReplaceDir(destContentDir, tmpDestDir);
   } catch (err) {
-    await fs25.rm(tmpDestDir, { recursive: true, force: true }).catch(() => {
+    await fs26.rm(tmpDestDir, { recursive: true, force: true }).catch(() => {
     });
     throw err;
   }
@@ -10183,8 +10283,8 @@ async function syncPull(options) {
 async function syncBoth(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
-  const branchesDir = path28.join(projectDir, ".canopy-dev", "content-branches");
-  const srcContentDir = path28.join(projectDir, contentRoot);
+  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
+  const srcContentDir = path29.join(projectDir, contentRoot);
   assertWithinDir(srcContentDir, projectDir, "--content-root");
   if (!await filePathExists(srcContentDir)) {
     throw new SyncError(`Content directory not found: ${contentRoot}/ (expected at ${srcContentDir})`);
@@ -10192,7 +10292,7 @@ async function syncBoth(options) {
   const branchName = await selectBranch({ ...options, projectDir, autoCreate: true }, branchesDir);
   if (!branchName)
     return { pushed: 0, pulled: 0 };
-  const branchPath = path28.join(branchesDir, branchName);
+  const branchPath = path29.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
   const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
@@ -10227,14 +10327,14 @@ async function syncBoth(options) {
   try {
     const incomingBranch = `sync-incoming-${Date.now()}`;
     await wsGit.raw(["checkout", "-b", incomingBranch, baseRef]);
-    const wsContentDir = path28.join(branchPath, contentRoot);
+    const wsContentDir = path29.join(branchPath, contentRoot);
     assertWithinDir(wsContentDir, branchPath, "--content-root");
     const tmpDir = `${wsContentDir}.sync-tmp-${Date.now()}`;
     try {
       await copyDir(srcContentDir, tmpDir);
       await safeReplaceDir(wsContentDir, tmpDir);
     } catch (err) {
-      await fs25.rm(tmpDir, { recursive: true, force: true }).catch(() => {
+      await fs26.rm(tmpDir, { recursive: true, force: true }).catch(() => {
       });
       await wsGit.checkout(currentBranch);
       await wsGit.raw(["branch", "-D", incomingBranch]).catch(() => {
@@ -10291,11 +10391,11 @@ async function syncBoth(options) {
 }
 async function syncAbort(options) {
   const { projectDir } = options;
-  const branchesDir = path28.join(projectDir, ".canopy-dev", "content-branches");
+  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
   const branchName = await selectBranch({ ...options, projectDir }, branchesDir);
   if (!branchName)
     return;
-  const branchPath = path28.join(branchesDir, branchName);
+  const branchPath = path29.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
   const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
@@ -10423,8 +10523,8 @@ var init_async_mutex = __esm({
 });
 
 // dist/utils/occ-json-write.js
-import fs26 from "node:fs/promises";
-import path29 from "node:path";
+import fs27 from "node:fs/promises";
+import path30 from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import lockfile4 from "proper-lockfile";
 async function writeOccJsonFile2(filePath, payload, options) {
@@ -10433,29 +10533,29 @@ async function writeOccJsonFile2(filePath, payload, options) {
   const writeId = randomUUID4();
   const data = { ...payload, version: newVersion, writeId };
   const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
-  const dir = path29.dirname(filePath);
-  await fs26.mkdir(dir, { recursive: true });
+  const dir = path30.dirname(filePath);
+  await fs27.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs26.writeFile(tempPath, content, "utf-8");
+  await fs27.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs26.link(tempPath, filePath);
+      await fs27.link(tempPath, filePath);
     } catch (err) {
-      await fs26.unlink(tempPath).catch(() => {
+      await fs27.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError(err)) {
         throw new OccWriteConflictError2();
       }
       throw err;
     }
-    await fs26.unlink(tempPath).catch(() => {
+    await fs27.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs26.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs27.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -10463,16 +10563,16 @@ async function writeOccJsonFile2(filePath, payload, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError2();
     }
-    await fs26.rename(tempPath, filePath);
+    await fs27.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs26.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs27.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError2();
     }
   } catch (err) {
-    await fs26.unlink(tempPath).catch(() => {
+    await fs27.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -10498,8 +10598,8 @@ async function withOccRetry2(operation, options) {
   throw new Error("Unreachable");
 }
 async function withOccFileLock2(filePath, fn) {
-  const dir = path29.dirname(filePath);
-  await fs26.mkdir(dir, { recursive: true });
+  const dir = path30.dirname(filePath);
+  await fs27.mkdir(dir, { recursive: true });
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -10557,14 +10657,51 @@ var init_occ_json_write = __esm({
   }
 });
 
+// dist/branch-metadata-file.js
+import fs28 from "node:fs/promises";
+import path31 from "node:path";
+async function readBranchMetadataFile2(branchRoot) {
+  const resolvedRoot = path31.resolve(branchRoot);
+  try {
+    const raw = await fs28.readFile(branchMetadataFilePath2(resolvedRoot), "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (isNotFoundError(err)) {
+      return null;
+    }
+    if (err instanceof SyntaxError) {
+      throw new BranchMetadataCorruptError2(resolvedRoot, err.message);
+    }
+    throw err;
+  }
+}
+var BRANCH_META_DIR2, BRANCH_META_FILE2, BranchMetadataCorruptError2, branchMetadataFilePath2;
+var init_branch_metadata_file = __esm({
+  "dist/branch-metadata-file.js"() {
+    "use strict";
+    init_error();
+    BRANCH_META_DIR2 = ".canopy-meta";
+    BRANCH_META_FILE2 = "branch.json";
+    BranchMetadataCorruptError2 = class extends Error {
+      constructor(branchRoot, cause) {
+        super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
+        this.name = "BranchMetadataCorruptError";
+        this.branchRoot = branchRoot;
+        this.parseCause = cause;
+      }
+    };
+    branchMetadataFilePath2 = (branchRoot) => path31.join(path31.resolve(branchRoot), BRANCH_META_DIR2, BRANCH_META_FILE2);
+  }
+});
+
 // dist/branch-registry.js
-import fs27 from "node:fs/promises";
-import path30 from "node:path";
+import fs29 from "node:fs/promises";
+import path33 from "node:path";
 var log12, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
 var init_branch_registry = __esm({
   "dist/branch-registry.js"() {
     "use strict";
-    init_branch_metadata();
+    init_branch_metadata_file();
     init_error();
     init_debug2();
     init_logger3();
@@ -10580,10 +10717,10 @@ var init_branch_registry = __esm({
       constructor(root) {
         this.regenInFlight = null;
         this.lastForcedRefreshMs = 0;
-        this.root = path30.resolve(root);
-        this.registryPath = path30.join(this.root, REGISTRY_FILE2);
-        this.stalePath = path30.join(this.root, REGISTRY_STALE_FILE2);
-        this.tempPath = path30.join(this.root, REGISTRY_TEMP_FILE2);
+        this.root = path33.resolve(root);
+        this.registryPath = path33.join(this.root, REGISTRY_FILE2);
+        this.stalePath = path33.join(this.root, REGISTRY_STALE_FILE2);
+        this.tempPath = path33.join(this.root, REGISTRY_TEMP_FILE2);
       }
       /**
        * Returns all branches. Uses the cached snapshot if its embedded generation
@@ -10592,7 +10729,7 @@ var init_branch_registry = __esm({
       async list() {
         let parsed;
         try {
-          const raw = await fs27.readFile(this.registryPath, "utf8");
+          const raw = await fs29.readFile(this.registryPath, "utf8");
           parsed = JSON.parse(raw);
         } catch (err) {
           if (isNotFoundError(err)) {
@@ -10681,7 +10818,7 @@ var init_branch_registry = __esm({
       async performRegenerate() {
         const read = await readResourceGeneration2(this.root, RESOURCE4);
         const branches = await this.scanBranchDirectories();
-        await fs27.unlink(this.stalePath).catch(() => {
+        await fs29.unlink(this.stalePath).catch(() => {
         });
         if (!read.ok) {
           return branches;
@@ -10692,12 +10829,12 @@ var init_branch_registry = __esm({
           generation: read.token
         };
         const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-        await fs27.mkdir(this.root, { recursive: true });
-        await fs27.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+        await fs29.mkdir(this.root, { recursive: true });
+        await fs29.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
         try {
-          await fs27.rename(uniqueTempPath, this.registryPath);
+          await fs29.rename(uniqueTempPath, this.registryPath);
         } catch (err) {
-          await fs27.unlink(uniqueTempPath).catch(() => {
+          await fs29.unlink(uniqueTempPath).catch(() => {
           });
           throw err;
         }
@@ -10711,15 +10848,15 @@ var init_branch_registry = __esm({
       async scanBranchDirectories() {
         const branches = [];
         try {
-          const entries = await fs27.readdir(this.root, { withFileTypes: true });
+          const entries = await fs29.readdir(this.root, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory() || entry.name.startsWith(".")) {
               continue;
             }
-            const branchRoot = path30.join(this.root, entry.name);
+            const branchRoot = path33.join(this.root, entry.name);
             let meta;
             try {
-              meta = await BranchMetadataFileManager2.loadOnly(branchRoot);
+              meta = await readBranchMetadataFile2(branchRoot);
             } catch (err) {
               canopyLogWarn3(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage(err)}`);
               continue;
@@ -10745,19 +10882,18 @@ var init_branch_registry = __esm({
 });
 
 // dist/branch-metadata.js
-import fs28 from "node:fs/promises";
-import path31 from "node:path";
-var BRANCH_META_DIR2, BRANCH_META_FILE2, CURRENT_SCHEMA_VERSION2, BranchMetadataConflictError2, BranchMetadataCorruptError2, BranchMetadataFileManager2;
+import fs30 from "node:fs/promises";
+import path34 from "node:path";
+var CURRENT_SCHEMA_VERSION2, BranchMetadataConflictError2, BranchMetadataFileManager2;
 var init_branch_metadata = __esm({
   "dist/branch-metadata.js"() {
     "use strict";
     init_branch_registry();
+    init_branch_metadata_file();
     init_paths();
     init_error();
     init_async_mutex();
     init_occ_json_write();
-    BRANCH_META_DIR2 = ".canopy-meta";
-    BRANCH_META_FILE2 = "branch.json";
     CURRENT_SCHEMA_VERSION2 = 1;
     BranchMetadataConflictError2 = class extends Error {
       constructor(message = "Concurrent modification detected in branch metadata") {
@@ -10765,18 +10901,10 @@ var init_branch_metadata = __esm({
         this.name = "BranchMetadataConflictError";
       }
     };
-    BranchMetadataCorruptError2 = class extends Error {
-      constructor(branchRoot, cause) {
-        super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
-        this.name = "BranchMetadataCorruptError";
-        this.branchRoot = branchRoot;
-        this.parseCause = cause;
-      }
-    };
     BranchMetadataFileManager2 = class _BranchMetadataFileManager2 {
       constructor(branchRoot, baseRoot, options) {
-        this.branchRoot = path31.resolve(branchRoot);
-        this.filePath = path31.join(this.branchRoot, BRANCH_META_DIR2, BRANCH_META_FILE2);
+        this.branchRoot = path34.resolve(branchRoot);
+        this.filePath = path34.join(this.branchRoot, BRANCH_META_DIR2, BRANCH_META_FILE2);
         this.baseRoot = baseRoot;
         this.settleMs = options?.settleMs;
       }
@@ -10785,20 +10913,7 @@ var init_branch_metadata = __esm({
        * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
        */
       static async loadOnly(branchRoot) {
-        const resolvedRoot = path31.resolve(branchRoot);
-        const filePath = path31.join(resolvedRoot, BRANCH_META_DIR2, BRANCH_META_FILE2);
-        try {
-          const raw = await fs28.readFile(filePath, "utf8");
-          return JSON.parse(raw);
-        } catch (err) {
-          if (isNotFoundError(err)) {
-            return null;
-          }
-          if (err instanceof SyntaxError) {
-            throw new BranchMetadataCorruptError2(resolvedRoot, err.message);
-          }
-          throw err;
-        }
+        return readBranchMetadataFile2(branchRoot);
       }
       /**
        * Get a BranchMetadataFileManager instance configured for registry invalidation.
@@ -10809,7 +10924,7 @@ var init_branch_metadata = __esm({
       }
       async load() {
         try {
-          const raw = await fs28.readFile(this.filePath, "utf8");
+          const raw = await fs30.readFile(this.filePath, "utf8");
           const parsed = JSON.parse(raw);
           const version = parsed.version ?? 0;
           return { meta: parsed, version };
@@ -10871,7 +10986,7 @@ var init_branch_metadata = __esm({
        */
       async save(incoming) {
         try {
-          await fs28.stat(this.branchRoot);
+          await fs30.stat(this.branchRoot);
         } catch (err) {
           if (isNotFoundError(err)) {
             throw new BranchMetadataConflictError2("Branch no longer exists");
@@ -10946,8 +11061,8 @@ __export(migrate_exports, {
   migrate: () => migrate,
   slugifyName: () => slugifyName
 });
-import fs29 from "node:fs/promises";
-import path33 from "node:path";
+import fs31 from "node:fs/promises";
+import path35 from "node:path";
 import * as p3 from "@clack/prompts";
 function slugifyName(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
@@ -10972,7 +11087,7 @@ function stripDirIdSuffix(dirName) {
   return dirName;
 }
 async function planDirectory(dirPath, isRoot, ctx) {
-  const entries = await fs29.readdir(dirPath, { withFileTypes: true });
+  const entries = await fs31.readdir(dirPath, { withFileTypes: true });
   entries.sort((a, b) => a.name.localeCompare(b.name));
   const ops = [];
   let hasOwnFiles = false;
@@ -10981,7 +11096,7 @@ async function planDirectory(dirPath, isRoot, ctx) {
     if (entry.name.startsWith("."))
       continue;
     if (entry.isDirectory()) {
-      const subPath = path33.join(dirPath, entry.name);
+      const subPath = path35.join(dirPath, entry.name);
       const sub = await planDirectory(subPath, false, ctx);
       if (!sub.hasContent)
         continue;
@@ -10989,10 +11104,10 @@ async function planDirectory(dirPath, isRoot, ctx) {
       ops.push(...sub.ops);
       if (!extractIdFromFilename2(entry.name)) {
         const newName = `${toValidSlug(entry.name)}.${generateId2()}`;
-        ops.push({ kind: "rename", from: subPath, to: path33.join(dirPath, newName) });
+        ops.push({ kind: "rename", from: subPath, to: path35.join(dirPath, newName) });
       }
     } else if (entry.isFile()) {
-      const ext = path33.extname(entry.name).slice(1);
+      const ext = path35.extname(entry.name).slice(1);
       const matchesFormat = ext === ctx.format || ctx.format === "yaml" && ext === "yml";
       if (!matchesFormat)
         continue;
@@ -11003,17 +11118,17 @@ async function planDirectory(dirPath, isRoot, ctx) {
         const newName = `${ctx.entryType}.${toValidSlug(base)}.${generateId2()}.${ext}`;
         ops.push({
           kind: "rename",
-          from: path33.join(dirPath, entry.name),
-          to: path33.join(dirPath, newName)
+          from: path35.join(dirPath, entry.name),
+          to: path35.join(dirPath, newName)
         });
       }
     }
   }
   const needsMeta = isRoot ? hasOwnFiles : hasContent;
-  const metaPath = path33.join(dirPath, ".collection.json");
+  const metaPath = path35.join(dirPath, ".collection.json");
   if (needsMeta && !await filePathExists(metaPath)) {
     const entryTypeMeta = { name: ctx.entryType, format: ctx.format, schema: ctx.schema };
-    const meta = isRoot ? { entries: [entryTypeMeta] } : { name: toValidSlug(stripDirIdSuffix(path33.basename(dirPath))), entries: [entryTypeMeta] };
+    const meta = isRoot ? { entries: [entryTypeMeta] } : { name: toValidSlug(stripDirIdSuffix(path35.basename(dirPath))), entries: [entryTypeMeta] };
     ops.push({ kind: "write", filePath: metaPath, content: JSON.stringify(meta, null, 2) + "\n" });
   }
   return { ops, hasContent };
@@ -11022,7 +11137,7 @@ async function migrate(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
   p3.intro("CanopyCMS migrate");
-  const contentDir = path33.join(projectDir, contentRoot);
+  const contentDir = path35.join(projectDir, contentRoot);
   if (!await filePathExists(contentDir)) {
     throw new MigrateError(`Content directory not found: ${contentRoot}/ (expected at ${contentDir})`);
   }
@@ -11099,14 +11214,14 @@ async function migrate(options) {
   const applyOps = async () => {
     for (const op of ops) {
       if (op.kind === "rename") {
-        await fs29.rename(op.from, op.to);
+        await fs31.rename(op.from, op.to);
       } else {
-        await fs29.writeFile(op.filePath, op.content, "utf-8");
+        await fs31.writeFile(op.filePath, op.content, "utf-8");
       }
     }
   };
   if (isBranchClone) {
-    const lockPath = path33.join(projectDir, ".canopy-meta", "schema");
+    const lockPath = path35.join(projectDir, ".canopy-meta", "schema");
     try {
       await withLock2(lockPath, () => withOccFileLock2(lockPath, applyOps));
     } catch (err) {
@@ -11154,7 +11269,7 @@ var init_migrate = __esm({
         this.name = "MigrateError";
       }
     };
-    describeOp = (op, baseDir) => op.kind === "rename" ? `rename  ${path33.relative(baseDir, op.from)} \u2192 ${path33.basename(op.to)}` : `create  ${path33.relative(baseDir, op.filePath)}`;
+    describeOp = (op, baseDir) => op.kind === "rename" ? `rename  ${path35.relative(baseDir, op.from)} \u2192 ${path35.basename(op.to)}` : `create  ${path35.relative(baseDir, op.filePath)}`;
   }
 });