canopycms 0.0.65 → 0.0.66-int.82

package/dist/cli/generate-ai-content.js

@@ -24,11 +24,11 @@ var init_logger = __esm({
 });
 
 // dist/paths/normalize.js
-function normalizeFilesystemPath(path21) {
-  return path21.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path22) {
+  return path22.split(/[\\/]+/).filter(Boolean).join("/");
 }
-function hasTraversalSequence(path21) {
-  const normalized = normalizeFilesystemPath(path21);
+function hasTraversalSequence(path22) {
+  const normalized = normalizeFilesystemPath(path22);
   return normalized.includes("..");
 }
 function createLogicalPath(...segments) {
@@ -38,14 +38,14 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
-function trimSlashes(path21) {
+function trimSlashes(path22) {
   let start = 0;
-  let end = path21.length;
-  while (start < end && path21[start] === "/")
+  let end = path22.length;
+  while (start < end && path22[start] === "/")
     start++;
-  while (end > start && path21[end - 1] === "/")
+  while (end > start && path22[end - 1] === "/")
     end--;
-  return path21.slice(start, end);
+  return path22.slice(start, end);
 }
 var init_normalize = __esm({
   "dist/paths/normalize.js"() {
@@ -848,12 +848,12 @@ var init_operating_mode = __esm({
 });
 
 // dist/cli/generate-ai-content.js
-import path20 from "node:path";
+import path21 from "node:path";
 import { createJiti } from "jiti";
 
 // dist/build/generate-ai-content.js
-import fs17 from "node:fs/promises";
-import path19 from "node:path";
+import fs18 from "node:fs/promises";
+import path20 from "node:path";
 
 // dist/utils/error.js
 function getErrorMessage(err) {
@@ -1348,8 +1348,8 @@ function computeEntryUrl(collection, slug, contentRoot) {
   if (slug && !isIndexSlug(slug)) {
     segments.push(slug);
   }
-  const path21 = segments.length > 0 ? `/${segments.join("/")}` : "/";
-  return path21.toLowerCase();
+  const path22 = segments.length > 0 ? `/${segments.join("/")}` : "/";
+  return path22.toLowerCase();
 }
 
 // dist/url-collision.js
@@ -1746,13 +1746,13 @@ function extractIdFromFilename(filename) {
   return null;
 }
 async function resolveCollectionPath(root, logicalPath) {
-  const fs18 = await import("node:fs/promises");
-  const path21 = await import("node:path");
+  const fs19 = await import("node:fs/promises");
+  const path22 = await import("node:path");
   const segments = logicalPath.split("/").filter(Boolean);
   let currentPath = root;
   for (const segment of segments) {
     try {
-      const entries = await fs18.readdir(currentPath, { withFileTypes: true });
+      const entries = await fs19.readdir(currentPath, { withFileTypes: true });
       const matchingDir = entries.find((entry) => {
         if (!entry.isDirectory())
           return false;
@@ -1760,7 +1760,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return logicalName === segment.toLowerCase();
       });
       if (matchingDir) {
-        currentPath = path21.join(currentPath, matchingDir.name);
+        currentPath = path22.join(currentPath, matchingDir.name);
       } else {
         return null;
       }
@@ -2918,14 +2918,62 @@ var ContentStore = class {
   getSchemaItems() {
     return this.schemaIndex.values();
   }
-  assertSchemaItem(path21) {
-    const normalized = normalizeFilesystemPath(path21);
+  assertSchemaItem(path22) {
+    const normalized = normalizeFilesystemPath(path22);
     const item = this.schemaIndex.get(normalized);
     if (!item) {
-      throw new ContentStoreError(`Unknown schema item: ${path21}`, "NO_SCHEMA_ITEM");
+      throw new ContentStoreError(`Unknown schema item: ${path22}`, "NO_SCHEMA_ITEM");
     }
     return item;
   }
+  /**
+   * Is this path a COLLECTION schema item?
+   *
+   * The non-throwing form of `assertCollection`, reading the same `schemaIndex` -- which is the
+   * point. A caller that gates on this cannot disagree with what `buildPaths` will then do: the
+   * Map is last-wins, so where a subcollection's path collides with a parent's entry-type name
+   * both this and `buildPaths` see the collection. A `find` over the flat schema LIST is
+   * first-wins and would not.
+   *
+   * Type-only, deliberately -- `resolvePath` additionally requires `entries`, but a collection
+   * with subcollections and no entries of its own is legal, and mirroring that stricter test here
+   * would reject something `buildPaths` accepts.
+   *
+   * Exists for `readByUrlPath`'s URL-addressability gate; see `ReadContentInput`'s
+   * `urlAddressableOnly` and the note on `buildPaths`' entry-type branch below.
+   */
+  isCollectionPath(collectionPath) {
+    return this.schemaIndex.get(normalizeFilesystemPath(collectionPath))?.type === "collection";
+  }
+  /**
+   * Does this collection declare `entryTypeName` in its `entries` config?
+   *
+   * Mirrors `parseTypedFilename(filename, collection.entries)`, which is how `listEntries` decides
+   * whether a file on disk is one of the collection's entries at all. `buildPaths`' own directory
+   * scan deliberately does NOT check this -- it matches on slug alone, so that an entry whose type
+   * was renamed out of the schema stays findable and therefore still editable, renameable and
+   * deletable. Only URL resolution consults this, so what enumeration hides is not served.
+   *
+   * Returns FALSE when the collection declares no `entries` at all, which is stricter than
+   * `parseTypedFilename`'s own `if (entryTypes && ...)` guard and deliberately so: the enumerating
+   * surface is not `parseTypedFilename`, it is `listCollectionEntries`, and that returns `[]`
+   * outright for a collection with no `entries`. A collections-only container therefore publishes
+   * nothing, so a URL read that resolved a file sitting in one would be answering where nothing is
+   * advertised -- the exact disagreement this predicate exists to close. Such a file cannot have
+   * been created by the CMS (there is no entry type to create it as); it arrived by hand, by merge
+   * or by retrofit, and it is invisible to the sitemap and to static params either way.
+   *
+   * Returns true for a path that is not a collection at all, because that is rule 1's question,
+   * not this one's -- and under `urlAddressableOnly` rule 1 has already rejected it.
+   */
+  declaresEntryType(collectionPath, entryTypeName) {
+    const item = this.schemaIndex.get(normalizeFilesystemPath(collectionPath));
+    if (item?.type !== "collection")
+      return true;
+    if (!item.entries)
+      return false;
+    return item.entries.some((e) => e.name === entryTypeName);
+  }
   assertCollection(collectionPath) {
     const item = this.assertSchemaItem(collectionPath);
     if (item.type !== "collection") {
@@ -3182,7 +3230,16 @@ var ContentStore = class {
         collection: schemaItem.logicalPath,
         collectionName: schemaItem.name,
         format,
-        data: parsed.data ?? {},
+        // Copy, never the object gray-matter hands back: its cache is
+        // process-global and keyed by file content, so every caller parsing the
+        // same bytes gets the SAME `data` instance (the hazard content-listing.ts
+        // documents at length). Assigning it straight into `doc.data` was safe
+        // only by accident -- `resolveReferencesInData` spreads its input, so the
+        // shared object got replaced a few lines down. But that only happens when
+        // resolution runs: with `resolveReferences: false` the caller was handed
+        // the shared instance itself, and one mutation would poison every later
+        // parse of those bytes.
+        data: { ...parsed.data ?? {} },
         body: parsed.content,
         bodyFieldName: findBodyFieldName(fields),
         relativePath,
@@ -4492,7 +4549,7 @@ function splitByCodeRegions(text) {
 
 // dist/ai/generate.js
 async function generateAIContent(options) {
-  const { store, flatSchema, contentRoot, config, entryLinkUrl } = options;
+  const { store, flatSchema, contentRoot, config, entryLinkUrl, generatedAt, buildId } = options;
   const files = /* @__PURE__ */ new Map();
   const idIndex = await store.idIndex();
   const collections = flatSchema.filter((item) => item.type === "collection");
@@ -4543,7 +4600,8 @@ async function generateAIContent(options) {
     }
   }
   const manifest = {
-    generated: (/* @__PURE__ */ new Date()).toISOString(),
+    ...buildId ? { buildId } : {},
+    ...generatedAt || !buildId ? { generated: generatedAt || (/* @__PURE__ */ new Date()).toISOString() } : {},
     entries: rootEntries,
     collections: manifestCollections,
     bundles: manifestBundles
@@ -4757,15 +4815,47 @@ function matchesBundleFilter(entry, filter, contentRoot) {
 }
 
 // dist/branch-workspace.js
-import path17 from "node:path";
+import path18 from "node:path";
 
 // dist/branch-metadata.js
-import fs14 from "node:fs/promises";
-import path15 from "node:path";
+import fs15 from "node:fs/promises";
+import path16 from "node:path";
 
 // dist/branch-registry.js
+import fs13 from "node:fs/promises";
+import path14 from "node:path";
+
+// dist/branch-metadata-file.js
 import fs12 from "node:fs/promises";
 import path13 from "node:path";
+var BRANCH_META_DIR = ".canopy-meta";
+var BRANCH_META_FILE = "branch.json";
+var BranchMetadataCorruptError = class extends Error {
+  constructor(branchRoot, cause) {
+    super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
+    this.name = "BranchMetadataCorruptError";
+    this.branchRoot = branchRoot;
+    this.parseCause = cause;
+  }
+};
+var branchMetadataFilePath = (branchRoot) => path13.join(path13.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
+async function readBranchMetadataFile(branchRoot) {
+  const resolvedRoot = path13.resolve(branchRoot);
+  try {
+    const raw = await fs12.readFile(branchMetadataFilePath(resolvedRoot), "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (isNotFoundError(err)) {
+      return null;
+    }
+    if (err instanceof SyntaxError) {
+      throw new BranchMetadataCorruptError(resolvedRoot, err.message);
+    }
+    throw err;
+  }
+}
+
+// dist/branch-registry.js
 init_logger();
 var log3 = createDebugLogger({ prefix: "BranchRegistry" });
 var REGISTRY_FILE = "branches.json";
@@ -4778,10 +4868,10 @@ var BranchRegistry = class {
   constructor(root) {
     this.regenInFlight = null;
     this.lastForcedRefreshMs = 0;
-    this.root = path13.resolve(root);
-    this.registryPath = path13.join(this.root, REGISTRY_FILE);
-    this.stalePath = path13.join(this.root, REGISTRY_STALE_FILE);
-    this.tempPath = path13.join(this.root, REGISTRY_TEMP_FILE);
+    this.root = path14.resolve(root);
+    this.registryPath = path14.join(this.root, REGISTRY_FILE);
+    this.stalePath = path14.join(this.root, REGISTRY_STALE_FILE);
+    this.tempPath = path14.join(this.root, REGISTRY_TEMP_FILE);
   }
   /**
    * Returns all branches. Uses the cached snapshot if its embedded generation
@@ -4790,7 +4880,7 @@ var BranchRegistry = class {
   async list() {
     let parsed;
     try {
-      const raw = await fs12.readFile(this.registryPath, "utf8");
+      const raw = await fs13.readFile(this.registryPath, "utf8");
       parsed = JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError(err)) {
@@ -4879,7 +4969,7 @@ var BranchRegistry = class {
   async performRegenerate() {
     const read = await readResourceGeneration(this.root, RESOURCE2);
     const branches = await this.scanBranchDirectories();
-    await fs12.unlink(this.stalePath).catch(() => {
+    await fs13.unlink(this.stalePath).catch(() => {
     });
     if (!read.ok) {
       return branches;
@@ -4890,12 +4980,12 @@ var BranchRegistry = class {
       generation: read.token
     };
     const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs12.mkdir(this.root, { recursive: true });
-    await fs12.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs13.mkdir(this.root, { recursive: true });
+    await fs13.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
-      await fs12.rename(uniqueTempPath, this.registryPath);
+      await fs13.rename(uniqueTempPath, this.registryPath);
     } catch (err) {
-      await fs12.unlink(uniqueTempPath).catch(() => {
+      await fs13.unlink(uniqueTempPath).catch(() => {
       });
       throw err;
     }
@@ -4909,15 +4999,15 @@ var BranchRegistry = class {
   async scanBranchDirectories() {
     const branches = [];
     try {
-      const entries = await fs12.readdir(this.root, { withFileTypes: true });
+      const entries = await fs13.readdir(this.root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) {
           continue;
         }
-        const branchRoot = path13.join(this.root, entry.name);
+        const branchRoot = path14.join(this.root, entry.name);
         let meta;
         try {
-          meta = await BranchMetadataFileManager.loadOnly(branchRoot);
+          meta = await readBranchMetadataFile(branchRoot);
         } catch (err) {
           canopyLogWarn(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage(err)}`);
           continue;
@@ -4941,8 +5031,8 @@ var BranchRegistry = class {
 };
 
 // dist/utils/occ-json-write.js
-import fs13 from "node:fs/promises";
-import path14 from "node:path";
+import fs14 from "node:fs/promises";
+import path15 from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import lockfile2 from "proper-lockfile";
 var log4 = createDebugLogger({ prefix: "OccJsonWrite" });
@@ -4958,29 +5048,29 @@ async function writeOccJsonFile(filePath, payload, options) {
   const writeId = randomUUID2();
   const data = { ...payload, version: newVersion, writeId };
   const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
-  const dir = path14.dirname(filePath);
-  await fs13.mkdir(dir, { recursive: true });
+  const dir = path15.dirname(filePath);
+  await fs14.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs13.writeFile(tempPath, content, "utf-8");
+  await fs14.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs13.link(tempPath, filePath);
+      await fs14.link(tempPath, filePath);
     } catch (err) {
-      await fs13.unlink(tempPath).catch(() => {
+      await fs14.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError(err)) {
         throw new OccWriteConflictError();
       }
       throw err;
     }
-    await fs13.unlink(tempPath).catch(() => {
+    await fs14.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs13.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs14.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -4988,16 +5078,16 @@ async function writeOccJsonFile(filePath, payload, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError();
     }
-    await fs13.rename(tempPath, filePath);
+    await fs14.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs13.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs14.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError();
     }
   } catch (err) {
-    await fs13.unlink(tempPath).catch(() => {
+    await fs14.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -5023,8 +5113,8 @@ async function withOccRetry(operation, options) {
   throw new Error("Unreachable");
 }
 async function withOccFileLock(filePath, fn) {
-  const dir = path14.dirname(filePath);
-  await fs13.mkdir(dir, { recursive: true });
+  const dir = path15.dirname(filePath);
+  await fs14.mkdir(dir, { recursive: true });
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -5068,8 +5158,6 @@ async function withOccFileLock(filePath, fn) {
 }
 
 // dist/branch-metadata.js
-var BRANCH_META_DIR = ".canopy-meta";
-var BRANCH_META_FILE = "branch.json";
 var CURRENT_SCHEMA_VERSION = 1;
 var BranchMetadataConflictError = class extends Error {
   constructor(message = "Concurrent modification detected in branch metadata") {
@@ -5077,18 +5165,10 @@ var BranchMetadataConflictError = class extends Error {
     this.name = "BranchMetadataConflictError";
   }
 };
-var BranchMetadataCorruptError = class extends Error {
-  constructor(branchRoot, cause) {
-    super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
-    this.name = "BranchMetadataCorruptError";
-    this.branchRoot = branchRoot;
-    this.parseCause = cause;
-  }
-};
 var BranchMetadataFileManager = class _BranchMetadataFileManager {
   constructor(branchRoot, baseRoot, options) {
-    this.branchRoot = path15.resolve(branchRoot);
-    this.filePath = path15.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
+    this.branchRoot = path16.resolve(branchRoot);
+    this.filePath = path16.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
     this.baseRoot = baseRoot;
     this.settleMs = options?.settleMs;
   }
@@ -5097,20 +5177,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
    */
   static async loadOnly(branchRoot) {
-    const resolvedRoot = path15.resolve(branchRoot);
-    const filePath = path15.join(resolvedRoot, BRANCH_META_DIR, BRANCH_META_FILE);
-    try {
-      const raw = await fs14.readFile(filePath, "utf8");
-      return JSON.parse(raw);
-    } catch (err) {
-      if (isNotFoundError(err)) {
-        return null;
-      }
-      if (err instanceof SyntaxError) {
-        throw new BranchMetadataCorruptError(resolvedRoot, err.message);
-      }
-      throw err;
-    }
+    return readBranchMetadataFile(branchRoot);
   }
   /**
    * Get a BranchMetadataFileManager instance configured for registry invalidation.
@@ -5121,7 +5188,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   }
   async load() {
     try {
-      const raw = await fs14.readFile(this.filePath, "utf8");
+      const raw = await fs15.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -5183,7 +5250,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    */
   async save(incoming) {
     try {
-      await fs14.stat(this.branchRoot);
+      await fs15.stat(this.branchRoot);
     } catch (err) {
       if (isNotFoundError(err)) {
         throw new BranchMetadataConflictError("Branch no longer exists");
@@ -5271,8 +5338,8 @@ var loadBranchContext = async (options) => {
 init_operating_mode();
 
 // dist/git-manager.js
-import fs15 from "node:fs/promises";
-import path16 from "node:path";
+import fs16 from "node:fs/promises";
+import path17 from "node:path";
 import { simpleGit as simpleGit2 } from "simple-git";
 
 // dist/utils/git.js
@@ -5332,11 +5399,11 @@ function gitChildEnv(overrides) {
 var remoteInitLocks = /* @__PURE__ */ new Map();
 var GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
 async function ensureGitExcludePattern(repoPath, pattern) {
-  const excludePath = path16.join(repoPath, ".git", "info", "exclude");
-  await fs15.mkdir(path16.dirname(excludePath), { recursive: true });
+  const excludePath = path17.join(repoPath, ".git", "info", "exclude");
+  await fs16.mkdir(path17.dirname(excludePath), { recursive: true });
   let content = "";
   try {
-    content = await fs15.readFile(excludePath, "utf-8");
+    content = await fs16.readFile(excludePath, "utf-8");
   } catch (err) {
     if (!isNotFoundError(err))
       throw err;
@@ -5348,7 +5415,7 @@ async function ensureGitExcludePattern(repoPath, pattern) {
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-  await fs15.writeFile(excludePath, newContent, "utf-8");
+  await fs16.writeFile(excludePath, newContent, "utf-8");
   log5.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
 var GitConflictError = class extends Error {
@@ -5369,12 +5436,12 @@ var GitRemoteRefMissingError = class extends Error {
 };
 var GitManager = class _GitManager {
   constructor(options, gitOptions) {
-    this.repoPath = path16.resolve(options.repoPath);
+    this.repoPath = path17.resolve(options.repoPath);
     this.baseBranch = options.baseBranch ?? "main";
     this.remote = options.remote ?? "origin";
     this.skipIndexMarker = options.skipIndexMarker ?? false;
     this.git = simpleGit2({ baseDir: this.repoPath, ...gitOptions });
-    this.git.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path16.dirname(this.repoPath) }));
+    this.git.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(this.repoPath) }));
   }
   static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
     log5.debug("git", "Cloning repository", {
@@ -5416,11 +5483,11 @@ var GitManager = class _GitManager {
           remotePath: options.remotePath,
           baseBranch: options.baseBranch
         });
-        const remoteParent = path16.dirname(options.remotePath);
+        const remoteParent = path17.dirname(options.remotePath);
         releaseLock = await acquireProvisioningLock(remoteParent, ".remote-init.lock");
         let remoteExists = false;
         try {
-          const stat = await fs15.stat(options.remotePath);
+          const stat = await fs16.stat(options.remotePath);
           remoteExists = stat.isDirectory();
         } catch (err) {
           if (!isNotFoundError(err))
@@ -5505,7 +5572,7 @@ var GitManager = class _GitManager {
    * guard, which also needs the tracking namespace: `syncGit()` fetches
    * GitHub into `GITHUB_TRACKING_REF_PREFIX*` rather than `refs/heads/*`
    * directly (see that constant's doc comment above), and
-   * `reconcileTrackedBranches()` (worker/cms-worker.ts) only
+   * `reconcileTrackedBranches()` (worker/git-sync.ts) only
    * non-destructively brings `refs/heads/*` toward what's tracked there — so
    * a branch that another CanopyCMS deployment sharing this repo (or a
    * direct push to GitHub) just created can sit in the tracking namespace
@@ -5580,7 +5647,7 @@ var GitManager = class _GitManager {
    * "absent" deterministic instead of parsing update-ref's locale-dependent
    * failure text, and its captured SHA is passed to `update-ref -d` as the
    * expected old value -- same pattern as reconcileTrackedBranches'
-   * guarded updates (worker/cms-worker.ts): a concurrent Lambda push
+   * guarded updates (worker/git-sync.ts): a concurrent Lambda push
    * re-creating/moving this branch between the read and the delete makes
    * update-ref throw (surfaced as the caller's best-effort warning) instead
    * of silently deleting a commit that was just pushed. No
@@ -5672,7 +5739,7 @@ var GitManager = class _GitManager {
    */
   static async validateGitRepoExists(repoPath) {
     try {
-      const stat = await fs15.stat(path16.join(repoPath, ".git"));
+      const stat = await fs16.stat(path17.join(repoPath, ".git"));
       if (!stat.isDirectory()) {
         throw new Error(`Expected git repo at ${repoPath}`);
       }
@@ -5750,7 +5817,7 @@ var GitManager = class _GitManager {
     }
     if (config.autoDetectRemotePath) {
       try {
-        const stat = await fs15.stat(config.autoDetectRemotePath);
+        const stat = await fs16.stat(config.autoDetectRemotePath);
         if (stat.isDirectory()) {
           log5.debug("git", "Auto-detected local remote", {
             path: config.autoDetectRemotePath
@@ -5763,8 +5830,8 @@ var GitManager = class _GitManager {
     if (config.shouldAutoInitLocal) {
       const gitRoot = await this.findGitRoot();
       const sourceRoot = options.sourceRoot;
-      const sourcePath = sourceRoot ? path16.resolve(gitRoot, sourceRoot) : gitRoot;
-      const localRemotePath = path16.join(sourcePath, config.defaultRemotePath);
+      const sourcePath = sourceRoot ? path17.resolve(gitRoot, sourceRoot) : gitRoot;
+      const localRemotePath = path17.join(sourcePath, config.defaultRemotePath);
       await this.ensureLocalSimulatedRemote({
         remotePath: localRemotePath,
         sourcePath: gitRoot,
@@ -5792,7 +5859,7 @@ var GitManager = class _GitManager {
   static async repoExistsAt(workspacePath) {
     try {
       const checkGit = simpleGit2({ baseDir: workspacePath });
-      checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path16.dirname(workspacePath) }));
+      checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(workspacePath) }));
       await checkGit.raw(["rev-parse", "--git-dir"]);
       return true;
     } catch {
@@ -5814,19 +5881,19 @@ var GitManager = class _GitManager {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: options.baseBranch,
       mode: options.mode,
-      detectFrom: options.sourceRoot ? path16.resolve(process.cwd(), options.sourceRoot) : process.cwd()
+      detectFrom: options.sourceRoot ? path17.resolve(process.cwd(), options.sourceRoot) : process.cwd()
     });
     const remoteName = options.remoteName ?? "origin";
     const repoExists = await _GitManager.repoExistsAt(options.workspacePath);
     if (!repoExists) {
-      const gitPath = path16.join(options.workspacePath, ".git");
+      const gitPath = path17.join(options.workspacePath, ".git");
       try {
-        const stat = await fs15.stat(gitPath);
+        const stat = await fs16.stat(gitPath);
         if (stat.isDirectory()) {
           log5.debug("git", "Removing corrupt .git directory", {
             workspacePath: options.workspacePath
           });
-          await fs15.rm(gitPath, { recursive: true });
+          await fs16.rm(gitPath, { recursive: true });
         }
       } catch (cleanupErr) {
         if (!isNotFoundError(cleanupErr))
@@ -5853,7 +5920,7 @@ var GitManager = class _GitManager {
       }
       justCloned = true;
       const freshGit = simpleGit2({ baseDir: options.workspacePath });
-      freshGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path16.dirname(options.workspacePath) }));
+      freshGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(options.workspacePath) }));
       await freshGit.addConfig("canopycms.managed", "true");
       await freshGit.addConfig("user.name", options.gitBotAuthorName);
       await freshGit.addConfig("user.email", options.gitBotAuthorEmail);
@@ -6204,9 +6271,9 @@ var GitManager = class _GitManager {
     } catch {
     }
     for (const [filePath, content] of Object.entries(initialFiles)) {
-      const absolutePath = path16.join(this.repoPath, filePath);
-      await fs15.mkdir(path16.dirname(absolutePath), { recursive: true });
-      await fs15.writeFile(absolutePath, content, "utf-8");
+      const absolutePath = path17.join(this.repoPath, filePath);
+      await fs16.mkdir(path17.dirname(absolutePath), { recursive: true });
+      await fs16.writeFile(absolutePath, content, "utf-8");
       await this.git.add(filePath);
     }
     await this.git.commit("Initialize settings branch", ["--allow-empty"]);
@@ -6235,7 +6302,7 @@ var BranchWorkspaceManager = class {
             branchName: options.branchName,
             mode: options.mode
           });
-          releaseLock = await acquireProvisioningLock(path17.dirname(options.branchRoot), `.${path17.basename(options.branchRoot)}.init.lock`);
+          releaseLock = await acquireProvisioningLock(path18.dirname(options.branchRoot), `.${path18.basename(options.branchRoot)}.init.lock`);
           await GitManager.initializeWorkspace({
             workspacePath: options.branchRoot,
             branchName: options.branchName,
@@ -6276,7 +6343,7 @@ var BranchWorkspaceManager = class {
     const baseBranch = await resolveBaseBranch({
       defaultBaseBranch: this.config.defaultBaseBranch,
       mode,
-      detectFrom: this.config.sourceRoot ? path17.resolve(process.cwd(), this.config.sourceRoot) : void 0
+      detectFrom: this.config.sourceRoot ? path18.resolve(process.cwd(), this.config.sourceRoot) : void 0
     });
     await this.ensureGitWorkspace({
       branchRoot,
@@ -6360,8 +6427,8 @@ async function resolveBranchRoot(config) {
 }
 
 // dist/content-listing.js
-import fs16 from "node:fs/promises";
-import path18 from "node:path";
+import fs17 from "node:fs/promises";
+import path19 from "node:path";
 import matter3 from "gray-matter";
 import { parse as yamlParse2 } from "yaml";
 var log7 = createDebugLogger({ prefix: "ContentListing" });
@@ -6374,7 +6441,7 @@ var normalizePath = (root, target) => {
 };
 var readEntryData = async (filePath, format, bodyFieldName = "body") => {
   try {
-    const raw = await fs16.readFile(filePath, "utf8");
+    const raw = await fs17.readFile(filePath, "utf8");
     if (format === "json") {
       return asRecord(JSON.parse(raw));
     }
@@ -6496,7 +6563,7 @@ var listCollectionEntries = async (root, collection, onSkip) => {
   normalizePath(root, collectionRoot);
   let dirents;
   try {
-    dirents = await fs16.readdir(collectionRoot, { withFileTypes: true });
+    dirents = await fs17.readdir(collectionRoot, { withFileTypes: true });
   } catch (err) {
     if (isNotFoundError(err))
       return [];
@@ -6504,7 +6571,7 @@ var listCollectionEntries = async (root, collection, onSkip) => {
   }
   const files = dirents.filter((d) => d.isFile() && validExts.some((ext) => d.name.endsWith(ext)) && d.name !== ".collection.json").sort((a, b) => a.name.localeCompare(b.name));
   const entries = await Promise.all(files.map(async (file) => {
-    const absolutePath = path18.join(collectionRoot, file.name);
+    const absolutePath = path19.join(collectionRoot, file.name);
     const relativePath = normalizePath(root, absolutePath);
     const parsed = parseTypedFilename(file.name, entryTypes);
     if (!parsed) {
@@ -6519,7 +6586,7 @@ var listCollectionEntries = async (root, collection, onSkip) => {
     const format = entryType?.format || "json";
     const bodyField = entryType?.schema ? findBodyFieldName(entryType.schema) : "body";
     const [stats, data] = await Promise.all([
-      fs16.stat(absolutePath),
+      fs17.stat(absolutePath),
       readEntryData(absolutePath, format, bodyField)
     ]);
     const item = {
@@ -6589,30 +6656,30 @@ function isValidImageCropValue(value) {
   }
   return isValidCropRect(x, y, w, h);
 }
-function validateImageValue(field, value, path21) {
+function validateImageValue(field, value, path22) {
   if (!isPlainRecord3(value)) {
-    return [{ fieldPath: path21, message: "Expected an image object with { src, alt }" }];
+    return [{ fieldPath: path22, message: "Expected an image object with { src, alt }" }];
   }
   const errors = [];
   if (typeof value.src !== "string" || value.src.trim() === "") {
-    errors.push({ fieldPath: `${path21}.src`, message: "Image src is required" });
+    errors.push({ fieldPath: `${path22}.src`, message: "Image src is required" });
   }
   if (typeof value.alt !== "string") {
-    errors.push({ fieldPath: `${path21}.alt`, message: "Image alt text is required" });
+    errors.push({ fieldPath: `${path22}.alt`, message: "Image alt text is required" });
   } else if (value.alt.trim() === "" && field.altOptional !== true) {
-    errors.push({ fieldPath: `${path21}.alt`, message: "Image alt text is required" });
+    errors.push({ fieldPath: `${path22}.alt`, message: "Image alt text is required" });
   }
   if (value.width !== void 0 && !isPositiveInt(value.width)) {
-    errors.push({ fieldPath: `${path21}.width`, message: "Image width must be a positive integer" });
+    errors.push({ fieldPath: `${path22}.width`, message: "Image width must be a positive integer" });
   }
   if (value.height !== void 0 && !isPositiveInt(value.height)) {
     errors.push({
-      fieldPath: `${path21}.height`,
+      fieldPath: `${path22}.height`,
       message: "Image height must be a positive integer"
     });
   }
   if (value.crop !== void 0 && !isValidImageCropValue(value.crop)) {
-    errors.push({ fieldPath: `${path21}.crop`, message: "Invalid image crop rect" });
+    errors.push({ fieldPath: `${path22}.crop`, message: "Invalid image crop rect" });
   }
   return errors;
 }
@@ -6624,44 +6691,44 @@ function referenceValueId(value) {
   return void 0;
 }
 var selectOptionValues = (field) => (field.options ?? []).map((opt) => typeof opt === "string" ? opt : opt.value);
-function validateScalar(field, value, path21) {
+function validateScalar(field, value, path22) {
   switch (field.type) {
     case "number":
       if (typeof value !== "number" || !Number.isFinite(value)) {
-        return [{ fieldPath: path21, message: "Expected a number" }];
+        return [{ fieldPath: path22, message: "Expected a number" }];
       }
       return [];
     case "boolean":
       if (typeof value !== "boolean") {
-        return [{ fieldPath: path21, message: "Expected true or false" }];
+        return [{ fieldPath: path22, message: "Expected true or false" }];
       }
       return [];
     case "datetime":
       if (typeof value !== "string" || value !== "" && Number.isNaN(Date.parse(value))) {
-        return [{ fieldPath: path21, message: "Expected a valid date/time string" }];
+        return [{ fieldPath: path22, message: "Expected a valid date/time string" }];
       }
       return [];
     case "select": {
       if (typeof value !== "string") {
-        return [{ fieldPath: path21, message: "Expected a selection" }];
+        return [{ fieldPath: path22, message: "Expected a selection" }];
       }
       const options = selectOptionValues(field);
       if (value !== "" && !options.includes(value)) {
-        return [{ fieldPath: path21, message: `Must be one of: ${options.join(", ")}` }];
+        return [{ fieldPath: path22, message: `Must be one of: ${options.join(", ")}` }];
       }
       return [];
     }
     case "reference":
       if (referenceValueId(value) === void 0) {
-        return [{ fieldPath: path21, message: "Expected a reference id" }];
+        return [{ fieldPath: path22, message: "Expected a reference id" }];
       }
       return [];
     case "image":
-      return validateImageValue(field, value, path21);
+      return validateImageValue(field, value, path22);
     default:
       if (STRING_FIELD_TYPES.has(field.type)) {
         if (typeof value !== "string") {
-          return [{ fieldPath: path21, message: "Expected text" }];
+          return [{ fieldPath: path22, message: "Expected text" }];
         }
       }
       return [];
@@ -6684,12 +6751,12 @@ function validateEntryData(fields, data, pathPrefix = "") {
       errors.push(...validateEntryData(field.fields, data, pathPrefix));
       continue;
     }
-    const path21 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
+    const path22 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
     const value = data[field.name];
     const isRequired = "required" in field && field.required === true;
     if (isRequired && isEmptyForRequired(field, value)) {
       const message = Array.isArray(value) ? "At least one item is required" : "This field is required";
-      errors.push({ fieldPath: path21, message });
+      errors.push({ fieldPath: path22, message });
       continue;
     }
     if (value === void 0 || value === null)
@@ -6697,11 +6764,11 @@ function validateEntryData(fields, data, pathPrefix = "") {
     if (field.type === "block") {
       const blockField = field;
       if (!Array.isArray(value)) {
-        errors.push({ fieldPath: path21, message: "Expected a list of blocks" });
+        errors.push({ fieldPath: path22, message: "Expected a list of blocks" });
         continue;
       }
       value.forEach((item, index) => {
-        const itemPath = `${path21}[${index}]`;
+        const itemPath = `${path22}[${index}]`;
         if (!isPlainRecord3(item)) {
           errors.push({ fieldPath: itemPath, message: "Expected a block object" });
           return;
@@ -6723,11 +6790,11 @@ function validateEntryData(fields, data, pathPrefix = "") {
       const objectField = field;
       if (objectField.list) {
         if (!Array.isArray(value)) {
-          errors.push({ fieldPath: path21, message: "Expected a list of items" });
+          errors.push({ fieldPath: path22, message: "Expected a list of items" });
           continue;
         }
         value.forEach((item, index) => {
-          const itemPath = `${path21}[${index}]`;
+          const itemPath = `${path22}[${index}]`;
           if (!isPlainRecord3(item)) {
             errors.push({ fieldPath: itemPath, message: "Expected an object" });
             return;
@@ -6737,27 +6804,27 @@ function validateEntryData(fields, data, pathPrefix = "") {
           }
         });
       } else if (!isPlainRecord3(value)) {
-        errors.push({ fieldPath: path21, message: "Expected an object" });
+        errors.push({ fieldPath: path22, message: "Expected an object" });
       } else if (objectField.fields) {
-        errors.push(...validateEntryData(objectField.fields, value, path21));
+        errors.push(...validateEntryData(objectField.fields, value, path22));
       }
       continue;
     }
     if ("list" in field && field.list) {
       if (!Array.isArray(value)) {
-        errors.push({ fieldPath: path21, message: "Expected a list of values" });
+        errors.push({ fieldPath: path22, message: "Expected a list of values" });
         continue;
       }
       value.forEach((item, index) => {
-        errors.push(...validateScalar(field, item, `${path21}[${index}]`));
+        errors.push(...validateScalar(field, item, `${path22}[${index}]`));
       });
       continue;
     }
     if (Array.isArray(value) && KNOWN_FIELD_TYPES.has(field.type)) {
-      errors.push({ fieldPath: path21, message: "Expected a single value, not a list" });
+      errors.push({ fieldPath: path22, message: "Expected a single value, not a list" });
       continue;
     }
-    errors.push(...validateScalar(field, value, path21));
+    errors.push(...validateScalar(field, value, path22));
   }
   return errors;
 }
@@ -6808,7 +6875,7 @@ These are likely abandoned create-scaffolds (empty entries left behind when a cr
 var GENERATED_RECORD_FILENAME = ".canopy-generated.json";
 async function readGeneratedRecord(outputDir) {
   try {
-    const raw = await fs17.readFile(path19.join(outputDir, GENERATED_RECORD_FILENAME), "utf-8");
+    const raw = await fs18.readFile(path20.join(outputDir, GENERATED_RECORD_FILENAME), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || !("files" in parsed))
       return [];
@@ -6822,20 +6889,56 @@ async function readGeneratedRecord(outputDir) {
 }
 async function writeGeneratedRecord(outputDir, files) {
   const record = { files: [...files].sort() };
-  await fs17.mkdir(outputDir, { recursive: true });
-  await fs17.writeFile(path19.join(outputDir, GENERATED_RECORD_FILENAME), `${JSON.stringify(record, null, 2)}
+  await fs18.mkdir(outputDir, { recursive: true });
+  await fs18.writeFile(path20.join(outputDir, GENERATED_RECORD_FILENAME), `${JSON.stringify(record, null, 2)}
 `, "utf-8");
 }
 async function removeEmptyDirsUpward(startDir, stopAt) {
   let current = startDir;
   while (current.startsWith(stopAt) && current !== stopAt) {
     try {
-      await fs17.rmdir(current);
+      await fs18.rmdir(current);
     } catch {
       return;
     }
-    current = path19.dirname(current);
+    current = path20.dirname(current);
+  }
+}
+var SAFE_BUILD_ID = /^[A-Za-z0-9._-]{1,255}$/;
+var BUILD_ID_RULE = 'must be 1-255 characters of [A-Za-z0-9._-] and not "." or ".."';
+function isUsableBuildId(value) {
+  return SAFE_BUILD_ID.test(value) && value !== "." && value !== "..";
+}
+function unpinnedConsequence(buildId) {
+  return buildId ? "omitting `generated` from the manifest entirely (a build id is set, so no build clock is recorded)." : "recording the current time in `generated` instead.";
+}
+function resolveBuildStamp() {
+  const rawBuildId = process.env.CANOPY_BUILD_ID;
+  const trimmedBuildId = rawBuildId?.trim();
+  let buildId;
+  if (rawBuildId === void 0) {
+    buildId = void 0;
+  } else if (!trimmedBuildId) {
+    console.warn("CanopyCMS: CANOPY_BUILD_ID is set but blank \u2014 recording no buildId in the manifest.");
+  } else if (!isUsableBuildId(trimmedBuildId)) {
+    console.warn(`CanopyCMS: ignoring CANOPY_BUILD_ID="${trimmedBuildId}": it ${BUILD_ID_RULE}, so that the manifest's buildId can match the build id Next stores for the same artifact.`);
+  } else {
+    buildId = trimmedBuildId;
+  }
+  const rawEpoch = process.env.SOURCE_DATE_EPOCH;
+  const trimmedEpoch = rawEpoch?.trim();
+  if (rawEpoch !== void 0 && !trimmedEpoch) {
+    console.warn(`CanopyCMS: SOURCE_DATE_EPOCH is set but blank \u2014 ${unpinnedConsequence(buildId)}`);
+  }
+  if (!trimmedEpoch)
+    return { buildId };
+  const seconds = /^\d+$/.test(trimmedEpoch) ? Number(trimmedEpoch) : Number.NaN;
+  const date = new Date(seconds * 1e3);
+  if (Number.isNaN(date.getTime())) {
+    console.warn(`CanopyCMS: ignoring SOURCE_DATE_EPOCH="${trimmedEpoch}" (expected decimal seconds since the Unix epoch) \u2014 ${unpinnedConsequence(buildId)}`);
+    return { buildId };
   }
+  return { generatedAt: date.toISOString(), buildId };
 }
 async function generateAIContentFiles(options) {
   const { config, entrySchemaRegistry, outputDir, aiConfig, _testFlatSchema } = options;
@@ -6857,11 +6960,12 @@ async function generateAIContentFiles(options) {
     flatSchema,
     contentRoot: contentRootName,
     config: aiConfig,
-    entryLinkUrl: config.entryLinkUrl
+    entryLinkUrl: config.entryLinkUrl,
+    ...resolveBuildStamp()
   });
-  const absoluteOutputDir = path19.resolve(outputDir) + path19.sep;
+  const absoluteOutputDir = path20.resolve(outputDir) + path20.sep;
   const resolveOutputPath = (filePath) => {
-    const absolutePath = path19.resolve(path19.join(absoluteOutputDir, filePath));
+    const absolutePath = path20.resolve(path20.join(absoluteOutputDir, filePath));
     if (!absolutePath.startsWith(absoluteOutputDir)) {
       throw new Error(`Path traversal detected in AI content output: ${filePath}`);
     }
@@ -6873,8 +6977,8 @@ async function generateAIContentFiles(options) {
   let fileCount = 0;
   for (const [filePath, content] of result.files) {
     const absolutePath = resolveOutputPath(filePath);
-    await fs17.mkdir(path19.dirname(absolutePath), { recursive: true });
-    await fs17.writeFile(absolutePath, content, "utf-8");
+    await fs18.mkdir(path20.dirname(absolutePath), { recursive: true });
+    await fs18.writeFile(absolutePath, content, "utf-8");
     fileCount++;
   }
   const currentSet = new Set(currentFiles);
@@ -6883,13 +6987,13 @@ async function generateAIContentFiles(options) {
   for (const filePath of stale) {
     const absolutePath = resolveOutputPath(filePath);
     try {
-      await fs17.unlink(absolutePath);
+      await fs18.unlink(absolutePath);
       removedCount++;
     } catch (err) {
       if (!isNodeError(err) || err.code !== "ENOENT")
         throw err;
     }
-    await removeEmptyDirsUpward(path19.dirname(absolutePath), absoluteOutputDir);
+    await removeEmptyDirsUpward(path20.dirname(absolutePath), absoluteOutputDir);
   }
   await writeGeneratedRecord(absoluteOutputDir, currentFiles);
   return { fileCount, removedCount, outputDir: absoluteOutputDir };
@@ -6900,7 +7004,7 @@ var jiti = createJiti(import.meta.url);
 async function generateAIContentCLI(options) {
   const { projectDir, outputDir = "public/ai", configPath, appDir = "app" } = options;
   console.log("\nCanopyCMS generate-ai-content\n");
-  const canopyConfigPath = path20.join(projectDir, "canopycms.config.ts");
+  const canopyConfigPath = path21.join(projectDir, "canopycms.config.ts");
   let canopyConfigModule;
   try {
     canopyConfigModule = await jiti.import(canopyConfigPath);
@@ -6911,7 +7015,7 @@ async function generateAIContentCLI(options) {
   }
   const configExport = canopyConfigModule.default ?? canopyConfigModule.config ?? canopyConfigModule;
   const serverConfig = typeof configExport === "object" && configExport !== null && "server" in configExport ? configExport.server : configExport;
-  const schemasPath = path20.join(projectDir, appDir, "schemas.ts");
+  const schemasPath = path21.join(projectDir, appDir, "schemas.ts");
   let entrySchemaRegistry = {};
   try {
     const schemasModule = await jiti.import(schemasPath);
@@ -6922,7 +7026,7 @@ async function generateAIContentCLI(options) {
   let aiConfig;
   if (configPath) {
     try {
-      const aiConfigModule = await jiti.import(path20.resolve(configPath));
+      const aiConfigModule = await jiti.import(path21.resolve(configPath));
       aiConfig = aiConfigModule.aiContentConfig ?? aiConfigModule.default ?? aiConfigModule.config;
     } catch (err) {
       console.error(`Could not load AI config from ${configPath}`);
@@ -6939,7 +7043,7 @@ async function generateAIContentCLI(options) {
     console.error("Make sure canopycms.config.ts uses defineCanopyConfig().");
     process.exit(1);
   }
-  const resolvedOutput = path20.resolve(projectDir, outputDir);
+  const resolvedOutput = path21.resolve(projectDir, outputDir);
   console.log(`  Output: ${resolvedOutput}`);
   console.log(`  Mode: ${serverConfig.mode ?? "dev"}`);
   const result = await generateAIContentFiles({