canopycms 0.0.67 → 0.0.68-int.94

package/dist/cli/cli.js

@@ -1178,7 +1178,7 @@ CanopyCMS worker run-once (mode: ${mode}, auth: ${authMode})
   }
   console.log("\nDone");
 }
-var __defProp2, __getOwnPropNames2, __esm2, __export2, active, init_logger, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, SENTINEL_BASE, DOT_SEGMENT, init_sanitize_href, uploadTargetUrlSchema, assetMountUrlSchema, init_url, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_mode_env, init_validation, init_helpers, init_config2, init_error2, init_fs2, templates_exports, __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME, init_templates, project_detect_exports, COMMANDS, MAX_WORKSPACE_DEPTH, CDK_DEPENDENCIES, init_project_detect, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, cms_task_queue_exports, debugLogger, cmsTaskQueueLogger, init_cms_task_queue, ProdClientSafeStrategy, DevClientSafeStrategy, warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName, ProdStrategy, DevStrategy, strategyCache;
+var __defProp2, __getOwnPropNames2, __esm2, __export2, active, init_logger, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, SENTINEL_BASE, DOT_SEGMENT, init_sanitize_href, uploadTargetUrlSchema, assetMountUrlSchema, previewPrefixSchema, init_url, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_mode_env, init_validation, init_helpers, init_config2, init_error2, init_fs2, templates_exports, __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME, init_templates, project_detect_exports, COMMANDS, MAX_WORKSPACE_DEPTH, CDK_DEPENDENCIES, init_project_detect, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, cms_task_queue_exports, debugLogger, cmsTaskQueueLogger, init_cms_task_queue, ProdClientSafeStrategy, DevClientSafeStrategy, warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName, ProdStrategy, DevStrategy, strategyCache;
 var init_init = __esm({
   "dist/cli/init.js"() {
     "use strict";
@@ -1285,7 +1285,8 @@ var init_init = __esm({
         });
         objectFieldSchema = fieldBaseSchema.extend({
           type: z.literal("object"),
-          fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+          fields: z.array(z.lazy(() => fieldHolder[0])).min(1),
+          itemTitleField: z.string().min(1).optional()
         });
         inlineGroupFieldSchema = z.object({
           type: z.literal("group"),
@@ -1359,6 +1360,9 @@ var init_init = __esm({
         assetMountUrlSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
           message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
         });
+        previewPrefixSchema = z3.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+          message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+        });
       }
     });
     init_media = __esm2({
@@ -1408,6 +1412,7 @@ var init_init = __esm({
         "use strict";
         init_collection();
         init_media();
+        init_url();
         defaultBranchAccessSchema = z5.enum(["allow", "deny"]).default("deny");
         defaultPathAccessLevelSchema = z5.enum(["allow", "deny"]);
         defaultPathAccessLevelsSchema = z5.object({
@@ -1439,6 +1444,7 @@ var init_init = __esm({
           subtitle: z5.string().optional(),
           theme: z5.unknown().optional(),
           previewBase: z5.record(z5.string()).optional(),
+          previewPrefix: previewPrefixSchema.optional(),
           // UI handler functions (runtime only, don't serialize)
           onAccountClick: z5.function().returns(z5.void()).optional(),
           onLogoutClick: z5.function().returns(z5.void()).optional(),
@@ -1466,6 +1472,9 @@ var init_init = __esm({
           defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
           gitBotAuthorName: gitBotAuthorNameSchema,
           gitBotAuthorEmail: gitBotAuthorEmailSchema,
+          // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+          gitEditedByTrailers: z5.boolean().optional(),
+          gitCoAuthoredByTrailers: z5.boolean().optional(),
           githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
           // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
           // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -1477,7 +1486,6 @@ var init_init = __esm({
           // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
           allowNetworkRemoteInProd: z5.boolean().optional(),
           settingsBranch: z5.string().optional(),
-          autoCreateSettingsPR: z5.boolean().optional(),
           // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
           // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
           // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -1734,6 +1742,10 @@ var init_init = __esm({
               throw new Error(errorMsg);
             }
           }
+          /**
+           * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+           * anything that can run concurrently uses {@link timed}.
+           */
           time(label) {
             this.timers.set(label, Date.now());
           }
@@ -1748,12 +1760,16 @@ var init_init = __esm({
             this.debug(category, `${label} completed`, { durationMs: duration });
             return duration;
           }
+          /**
+           * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+           * call, so concurrent spans with the same label on one logger never overwrite each other.
+           */
           async timed(category, label, fn) {
-            this.time(label);
+            const start = Date.now();
             try {
               return await fn();
             } finally {
-              this.timeEnd(category, label);
+              this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
             }
           }
         };
@@ -1919,9 +1935,6 @@ var init_init = __esm({
           throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
         }
       }
-      shouldCreateSettingsPR(config) {
-        return config.autoCreateSettingsPR ?? true;
-      }
     };
     DevStrategy = class extends DevClientSafeStrategy {
       getWorkspaceRoot(sourceRoot) {
@@ -1968,9 +1981,6 @@ var init_init = __esm({
       }
       validateConfig(_config) {
       }
-      shouldCreateSettingsPR(_config) {
-        return false;
-      }
     };
     strategyCache = /* @__PURE__ */ new Map();
     init_mode_env();
@@ -3058,6 +3068,8 @@ import { promises as fs62 } from "fs";
 import { join as join3 } from "pathe";
 import { z as z8 } from "zod";
 import chokidar from "chokidar";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { simpleGit as simpleGit3 } from "simple-git";
 import fs82 from "node:fs/promises";
 import { sep, resolve, relative } from "node:path";
 import fs9 from "node:fs/promises";
@@ -3079,7 +3091,6 @@ import lockfile2 from "proper-lockfile";
 import fs16 from "node:fs/promises";
 import path17 from "node:path";
 import { simpleGit as simpleGit22 } from "simple-git";
-import { simpleGit as simpleGit3 } from "simple-git";
 import fs17 from "node:fs/promises";
 import path19 from "node:path";
 import matter3 from "gray-matter";
@@ -3145,6 +3156,9 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
+function entryLogicalPath(collectionLogicalPath, slug) {
+  return collectionLogicalPath ? `${collectionLogicalPath}/${slug}` : slug;
+}
 function trimSlashes(path222) {
   let start = 0;
   let end = path222.length;
@@ -3473,12 +3487,14 @@ async function withLock(key, fn) {
       locks.delete(key);
   }
 }
-function provisioningLockOptions(lockPath, retries, onCompromised) {
+function provisioningLockOptions(lockPath, retries, onCompromised, staleMs) {
   return {
     lockfilePath: lockPath,
     realpath: false,
     retries,
-    stale: 3e4,
+    stale: staleMs,
+    // Fixed, not stale/2: every holder refreshes at 15s whatever threshold it judges others by.
+    update: 15e3,
     // proper-lockfile invokes this from inside its refresh timer, so ANY throw escaping here is
     // an uncaught exception that kills the process. Call sites are told not to throw (see
     // OnLockCompromised); this makes it structural rather than a convention, and also covers the
@@ -3514,23 +3530,26 @@ function releaseIgnoringAlreadyReleased(release, lockPath) {
     }
   };
 }
-async function acquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
-  await fs23.mkdir(lockTargetDir2, { recursive: true });
-  const lockPath = path22.join(lockTargetDir2, lockName);
-  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true }, onCompromised));
+function branchProvisioningLockName(dirName) {
+  return `.${dirName}.init.lock`;
+}
+async function acquireProvisioningLock(lockTargetDir22, lockName, onCompromised) {
+  await fs23.mkdir(lockTargetDir22, { recursive: true });
+  const lockPath = path22.join(lockTargetDir22, lockName);
+  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true }, onCompromised, PROVISIONING_LOCK_STALE_MS));
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
-async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
-  await fs23.mkdir(lockTargetDir2, { recursive: true });
-  const lockPath = path22.join(lockTargetDir2, lockName);
-  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised));
+async function tryAcquireProvisioningLock(lockTargetDir22, lockName, onCompromised, staleMs = PROVISIONING_LOCK_STALE_MS) {
+  await fs23.mkdir(lockTargetDir22, { recursive: true });
+  const lockPath = path22.join(lockTargetDir22, lockName);
+  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised, staleMs));
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
 function lockTargetDir(branchRoot) {
   return path32.join(path32.resolve(branchRoot), META_DIR);
 }
 function tryAcquireContentWriteLock(branchRoot, onCompromised) {
-  return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME, onCompromised);
+  return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME, onCompromised, CONTENT_WRITE_LOCK_STALE_MS);
 }
 async function acquireContentWriteLock(branchRoot, waitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, onCompromised) {
   const startedAt = Date.now();
@@ -3561,7 +3580,7 @@ async function withContentWriteLock(branchRoot, fn, waitMs = DEFAULT_CONTENT_WRI
     await release();
   }
   if (compromised) {
-    throw new ContentWriteLockBusyError("This branch was being synced while your change was written, so the change may or may not have been recorded. Reload the entry to see the current state before saving again.");
+    throw new ContentWriteLockBusyError("This branch was being synced while your change was written, so the change may or may not have been recorded. Reload the entry to see the current state before saving again.", "unknown");
   }
   return result;
 }
@@ -3591,8 +3610,62 @@ function buildResolvedReference(data, meta, body) {
   resolved.slug = meta.slug;
   resolved.collection = meta.collection;
   resolved.urlPath = meta.urlPath;
+  delete resolved[RESTRICTED_REFERENCE_MARKER];
   return resolved;
 }
+function buildRestrictedReference(meta, title) {
+  return {
+    id: meta.id,
+    slug: meta.slug,
+    collection: meta.collection,
+    urlPath: meta.urlPath,
+    title,
+    unavailable: true,
+    reason: "restricted"
+  };
+}
+function isGroupField(field) {
+  return field.type === "group";
+}
+function extractTitleFromSchema(fields, data) {
+  return findTitleValue(fields, data);
+}
+function findTitleValue(fields, data) {
+  for (const field of fields) {
+    if (isGroupField(field)) {
+      const result = findTitleValue(field.fields, data);
+      if (result !== void 0)
+        return result;
+    } else if ("isTitle" in field && field.isTitle) {
+      const value = data[field.name];
+      return typeof value === "string" ? value : void 0;
+    } else if (field.type === "object" && "fields" in field && field.fields && !field.list) {
+      const nested = data[field.name];
+      if (nested != null && typeof nested === "object" && !Array.isArray(nested)) {
+        const result = findTitleValue(field.fields, nested);
+        if (result !== void 0)
+          return result;
+      }
+    }
+  }
+  return void 0;
+}
+function humanizeSlug(slug) {
+  return slug.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()).trim();
+}
+function resolveEntryTitle(data, options) {
+  if (options?.schema) {
+    const schemaTitle = extractTitleFromSchema(options.schema, data);
+    if (schemaTitle)
+      return schemaTitle;
+  }
+  const title = data.title ?? data.name;
+  if (typeof title === "string")
+    return title;
+  if (options?.entryTypeLabel)
+    return options.entryTypeLabel;
+  return options?.slug ? humanizeSlug(options.slug) : "Untitled";
+}
 function isIndexSlug(slug) {
   return slug?.toLowerCase() === "index";
 }
@@ -4006,6 +4079,61 @@ function isValidSchema(schema) {
   const hasCollections = !!(schema.collections && schema.collections.length > 0);
   return hasEntries || hasCollections;
 }
+async function timeRequestPhase(phase, fn) {
+  const parent = storage.getStore();
+  if (!parent)
+    return fn();
+  const key = parent.path ? `${parent.path}>${phase}` : phase;
+  let total = parent.phases.get(key);
+  if (!total) {
+    total = { count: 0, ms: 0 };
+    parent.phases.set(key, total);
+  }
+  const start = performance.now();
+  try {
+    return await storage.run({ ...parent, path: key }, fn);
+  } finally {
+    total.count += 1;
+    total.ms += performance.now() - start;
+  }
+}
+function isNetworkRemoteUrl(url) {
+  if (/^file:\/\//i.test(url))
+    return false;
+  if (NETWORK_SCHEME_PATTERN.test(url))
+    return true;
+  if (TRANSPORT_HELPER_PATTERN.test(url))
+    return true;
+  if (LEADING_OPTION_PATTERN.test(url))
+    return true;
+  if (WINDOWS_DRIVE_PATTERN.test(url))
+    return false;
+  return COLON_BEFORE_SLASH_PATTERN.test(url);
+}
+function isMissingRemoteRefFailure(message) {
+  return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
+}
+async function stageAllExceptCanopyState(git) {
+  await git.add(["-A"]);
+  await git.raw(["reset", "-q", "--", CANOPY_META_DIR]);
+}
+async function detectHeadBranch(repoRoot, fallback = "main") {
+  try {
+    const git = simpleGit3({ baseDir: repoRoot });
+    const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
+    return head && head !== "HEAD" ? head : fallback;
+  } catch {
+    return fallback;
+  }
+}
+async function resolveBaseBranch(options) {
+  if (options.defaultBaseBranch)
+    return options.defaultBaseBranch;
+  if (options.mode === "dev") {
+    return detectHeadBranch(options.detectFrom ?? process.cwd());
+  }
+  return "main";
+}
 async function isStaleByMtime(dir, cachedAt) {
   let entries;
   try {
@@ -4027,6 +4155,11 @@ async function isStaleByMtime(dir, cachedAt) {
   }
   return false;
 }
+async function schemaCacheDir(branchRoot) {
+  const gitDir = path82.join(branchRoot, ".git");
+  const isClone = await fs72.stat(gitDir).then((stat) => stat.isDirectory(), () => false);
+  return isClone ? path82.join(gitDir, "canopycms") : path82.join(branchRoot, CANOPY_META_DIR);
+}
 async function bumpContentIndexGeneration(root) {
   return bumpResourceGeneration(root, RESOURCE);
 }
@@ -4080,10 +4213,17 @@ function sanitizeBranchName(branchName) {
   const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
   return trimmedDots || "branch";
 }
+function isSettingsBranchName(branchName, settingsBranchName) {
+  const sanitized = sanitizeBranchName(branchName);
+  return sanitized.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX) || settingsBranchName !== void 0 && sanitized === sanitizeBranchName(settingsBranchName);
+}
 function resolveBranchPath(options) {
   if (options.branchName.includes("..")) {
     throw new BranchPathError("Branch name cannot contain traversal segments");
   }
+  if (isSettingsBranchName(options.branchName)) {
+    throw new BranchPathError("Settings branches are not content branches");
+  }
   const safeBranch = sanitizeBranchName(options.branchName);
   const strategy = operatingStrategy2(options.mode);
   const baseRoot = resolveContentBranchesRoot(options.mode, options.basePathOverride);
@@ -4663,7 +4803,7 @@ function resolveEntryLinksInText(text3, idIndex, contentRoot, customResolver) {
     return part.text.replace(ENTRY_LINK_PATTERN, (_match, id, anchor) => {
       const location = idIndex.findById(id);
       if (!location || location.type !== "entry" || !location.collection || !location.slug) {
-        log22.warn("resolve", `Entry link target not found: entry:${id}`);
+        log3.warn("resolve", `Entry link target not found: entry:${id}`);
         return anchor ?? "#";
       }
       let url;
@@ -5118,7 +5258,7 @@ async function withOccFileLock(filePath, fn) {
         // Our critical sections are short and idempotent-on-conflict (OCC
         // verify inside); log and let the section finish.
         onCompromised: (err) => {
-          log4.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+          log5.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
             error: getErrorMessage3(err)
           });
         }
@@ -5140,43 +5280,10 @@ async function withOccFileLock(filePath, fn) {
     await release().catch((err) => {
       if (isNodeError3(err) && err.code === "ENOENT")
         return;
-      log4.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage3(err) });
+      log5.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage3(err) });
     });
   }
 }
-function isNetworkRemoteUrl(url) {
-  if (/^file:\/\//i.test(url))
-    return false;
-  if (NETWORK_SCHEME_PATTERN.test(url))
-    return true;
-  if (TRANSPORT_HELPER_PATTERN.test(url))
-    return true;
-  if (LEADING_OPTION_PATTERN.test(url))
-    return true;
-  if (WINDOWS_DRIVE_PATTERN.test(url))
-    return false;
-  return COLON_BEFORE_SLASH_PATTERN.test(url);
-}
-function isMissingRemoteRefFailure(message) {
-  return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
-}
-async function detectHeadBranch(repoRoot, fallback = "main") {
-  try {
-    const git = simpleGit3({ baseDir: repoRoot });
-    const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
-    return head && head !== "HEAD" ? head : fallback;
-  } catch {
-    return fallback;
-  }
-}
-async function resolveBaseBranch(options) {
-  if (options.defaultBaseBranch)
-    return options.defaultBaseBranch;
-  if (options.mode === "dev") {
-    return detectHeadBranch(options.detectFrom ?? process.cwd());
-  }
-  return "main";
-}
 function gitChildEnv(overrides) {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
@@ -5197,13 +5304,13 @@ async function ensureGitExcludePattern(repoPath, pattern) {
   }
   const lines = content.split("\n");
   if (lines.some((line) => line.trim() === pattern)) {
-    log5.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    log6.debug("git", "Pattern already in .git/info/exclude", { pattern });
     return;
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
   await fs16.writeFile(excludePath, newContent, "utf-8");
-  log5.debug("git", "Added pattern to .git/info/exclude", { pattern });
+  log6.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
 async function loadOrCreateBranchContext(options) {
   if (readsFromCheckout(options.config)) {
@@ -5266,10 +5373,10 @@ async function listEntries(branchRoot, flatSchema, contentRootName, options, vis
   const collections = flatSchema.filter((item) => item.type === "collection" && item.entries !== void 0 && (item.logicalPath === rootPath || item.logicalPath.startsWith(`${rootPath}/`)));
   const shouldInclude = visibility?.shouldInclude;
   const skippedFiles = [];
-  const resolver = options?.resolveReferences ? createReferenceResolver(branchRoot, flatSchema, contentRootName) : null;
+  const resolver = options?.resolveReferences ? createReferenceResolver(branchRoot, flatSchema, contentRootName, visibility) : null;
   const collectionResults = await Promise.all(collections.map(async (collection) => {
     const entries = await listCollectionEntries(branchRoot, collection, (file) => skippedFiles.push(file));
-    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.physicalPath)) : entries;
+    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.logicalPath)) : entries;
     const resolved = resolver ? await resolveCollectionItemReferences(visible, collection, resolver) : visible;
     return resolved.map((entry) => ({ entry, collection }));
   }));
@@ -5751,7 +5858,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, SENTINEL_BASE2, DOT_SEGMENT2, init_sanitize_href2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, uploadTargetUrlSchema2, assetMountUrlSchema2, init_url2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, DEFAULT_SEO_FIELD_NAMES, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, BRANCH_META_DIR, BRANCH_META_FILE, BranchMetadataCorruptError, branchMetadataFilePath, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, SENTINEL_BASE2, DOT_SEGMENT2, init_sanitize_href2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, uploadTargetUrlSchema2, assetMountUrlSchema2, previewPrefixSchema2, init_url2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, PROVISIONING_LOCK_STALE_MS, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, CONTENT_WRITE_LOCK_STALE_MS, DEFAULT_SEO_FIELD_NAMES, RESTRICTED_REFERENCE_MARKER, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER, storage, log22, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, CANOPY_META_DIR, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_CACHE_FILE, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, RESERVED_SETTINGS_BRANCH_PREFIX, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log3, BASE58_CHAR, ENTRY_LINK_PATTERN, BRANCH_META_DIR, BRANCH_META_FILE, BranchMetadataCorruptError, branchMetadataFilePath, log4, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log5, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, log6, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, RemoteNotReadyError, SettingsRemoteUnreadableError, SettingsBranchDivergedError, SETTINGS_BRANCH_FILES, SettingsBranchHasContentHistoryError, GitManager, log7, workspaceInitLocks, BranchWorkspaceManager, log8, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -5975,7 +6082,8 @@ var init_generate_ai_content = __esm({
         });
         objectFieldSchema2 = fieldBaseSchema2.extend({
           type: z22.literal("object"),
-          fields: z22.array(z22.lazy(() => fieldHolder2[0])).min(1)
+          fields: z22.array(z22.lazy(() => fieldHolder2[0])).min(1),
+          itemTitleField: z22.string().min(1).optional()
         });
         inlineGroupFieldSchema2 = z22.object({
           type: z22.literal("group"),
@@ -6042,6 +6150,9 @@ var init_generate_ai_content = __esm({
         assetMountUrlSchema2 = z42.string().trim().refine((value) => isHttpUrlOrSameOriginPath2(value, { allowProtocolRelative: true }), {
           message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
         });
+        previewPrefixSchema2 = z42.string().trim().refine((value) => isHttpUrlOrSameOriginPath2(value), {
+          message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+        });
       }
     });
     init_media2 = __esm3({
@@ -6091,6 +6202,7 @@ var init_generate_ai_content = __esm({
         "use strict";
         init_collection2();
         init_media2();
+        init_url2();
         defaultBranchAccessSchema2 = z62.enum(["allow", "deny"]).default("deny");
         defaultPathAccessLevelSchema2 = z62.enum(["allow", "deny"]);
         defaultPathAccessLevelsSchema2 = z62.object({
@@ -6122,6 +6234,7 @@ var init_generate_ai_content = __esm({
           subtitle: z62.string().optional(),
           theme: z62.unknown().optional(),
           previewBase: z62.record(z62.string()).optional(),
+          previewPrefix: previewPrefixSchema2.optional(),
           // UI handler functions (runtime only, don't serialize)
           onAccountClick: z62.function().returns(z62.void()).optional(),
           onLogoutClick: z62.function().returns(z62.void()).optional(),
@@ -6149,6 +6262,9 @@ var init_generate_ai_content = __esm({
           defaultRemoteUrl: defaultRemoteUrlSchema2.optional(),
           gitBotAuthorName: gitBotAuthorNameSchema2,
           gitBotAuthorEmail: gitBotAuthorEmailSchema2,
+          // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+          gitEditedByTrailers: z62.boolean().optional(),
+          gitCoAuthoredByTrailers: z62.boolean().optional(),
           githubTokenEnvVar: githubTokenEnvVarSchema2.optional(),
           // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
           // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -6160,7 +6276,6 @@ var init_generate_ai_content = __esm({
           // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
           allowNetworkRemoteInProd: z62.boolean().optional(),
           settingsBranch: z62.string().optional(),
-          autoCreateSettingsPR: z62.boolean().optional(),
           // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
           // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
           // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -6377,9 +6492,6 @@ var init_generate_ai_content = __esm({
               throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
             }
           }
-          shouldCreateSettingsPR(config) {
-            return config.autoCreateSettingsPR ?? true;
-          }
         };
         DevStrategy2 = class extends DevClientSafeStrategy2 {
           getWorkspaceRoot(sourceRoot) {
@@ -6426,9 +6538,6 @@ var init_generate_ai_content = __esm({
           }
           validateConfig(_config) {
           }
-          shouldCreateSettingsPR(_config) {
-            return false;
-          }
         };
         strategyCache2 = /* @__PURE__ */ new Map();
       }
@@ -6458,18 +6567,21 @@ var init_generate_ai_content = __esm({
     locks = /* @__PURE__ */ new Map();
     init_logger2();
     init_logger2();
+    PROVISIONING_LOCK_STALE_MS = 9e4;
     META_DIR = ".canopy-meta";
     CONTENT_WRITE_LOCK_NAME = "content-write.lock";
     DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS = 2e3;
     ContentWriteLockBusyError = class extends Error {
-      constructor(message = "This branch is busy (syncing with the base branch, or another save is in flight); the change was not saved. Try again in a moment.") {
+      constructor(message = "This branch is busy (syncing with the base branch, or another save is in flight); the change was not saved. Try again in a moment.", outcome = "not-run") {
         super(message);
+        this.outcome = outcome;
         this.name = "ContentWriteLockBusyError";
       }
     };
     sleep = (ms) => new Promise((resolve2) => {
       setTimeout(resolve2, ms);
     });
+    CONTENT_WRITE_LOCK_STALE_MS = 3e4;
     init_sanitize_href2();
     DEFAULT_SEO_FIELD_NAMES = {
       title: "metaTitle",
@@ -6480,6 +6592,7 @@ var init_generate_ai_content = __esm({
       noindex: "noindex",
       twitterCard: "twitterCard"
     };
+    RESTRICTED_REFERENCE_MARKER = "unavailable";
     SEO_GROUP_FIELDS = [
       {
         name: DEFAULT_SEO_FIELD_NAMES.title,
@@ -6915,6 +7028,10 @@ var init_generate_ai_content = __esm({
           throw new Error(errorMsg);
         }
       }
+      /**
+       * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+       * anything that can run concurrently uses {@link timed}.
+       */
       time(label) {
         this.timers.set(label, Date.now());
       }
@@ -6929,12 +7046,16 @@ var init_generate_ai_content = __esm({
         this.debug(category, `${label} completed`, { durationMs: duration });
         return duration;
       }
+      /**
+       * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+       * call, so concurrent spans with the same label on one logger never overwrite each other.
+       */
       async timed(category, label, fn) {
-        this.time(label);
+        const start = Date.now();
         try {
           return await fn();
         } finally {
-          this.timeEnd(category, label);
+          this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
         }
       }
     };
@@ -7059,8 +7180,18 @@ var init_generate_ai_content = __esm({
       email: "static-deploy@canopycms",
       name: "Static Deploy"
     });
+    storage = new AsyncLocalStorage();
+    log22 = createDebugLogger2({ prefix: "CanopyCMS" });
+    NETWORK_SCHEME_PATTERN = /^(https?|ssh|git):\/\//i;
+    TRANSPORT_HELPER_PATTERN = /^[a-z][a-z0-9+.-]*::/i;
+    LEADING_OPTION_PATTERN = /^-/;
+    WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:[\\/]/;
+    COLON_BEFORE_SLASH_PATTERN = /^[^/\\\s]+:/;
+    MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find remote ref"];
+    CANOPY_META_DIR = ".canopy-meta";
     SCHEMA_CACHE_VERSION = 3;
     MTIME_CHECK_DEBOUNCE_MS = 1e3;
+    SCHEMA_CACHE_FILE = "schema-cache.json";
     SCHEMA_GENERATION_RESOURCE = "schema";
     BranchSchemaCache = class {
       constructor(mode = "prod") {
@@ -7070,7 +7201,7 @@ var init_generate_ai_content = __esm({
       /**
        * Whether to skip the on-disk cache for this branchRoot.
        *
-       * Never write `.canopy-meta/` at the project root, whichever entrypoint
+       * Never write a schema cache at the project root, whichever entrypoint
        * produced the cwd branchRoot. branchRoot equals process.cwd() only in the
        * synthetic contexts static deployments and build phases use; a real branch
        * root is always nested under the workspace.
@@ -7080,7 +7211,7 @@ var init_generate_ai_content = __esm({
       }
       /** Get schema for a branch, from the cache when fresh, else resolved fresh. */
       async getSchema(branchRoot, entrySchemaRegistry, contentRootName = "content") {
-        return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
+        return timeRequestPhase("schema", () => this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName));
       }
       /**
        * Resolve the schema from disk. Protected rather than a direct resolveSchema
@@ -7094,8 +7225,7 @@ var init_generate_ai_content = __esm({
         const contentRoot = path82.join(branchRoot, contentRootName);
         const skipDiskCache = this.skipDiskCache(branchRoot);
         if (!skipDiskCache) {
-          const cacheDir = path82.join(branchRoot, ".canopy-meta");
-          const cachePath = path82.join(cacheDir, "schema-cache.json");
+          const cachePath = path82.join(await schemaCacheDir(branchRoot), SCHEMA_CACHE_FILE);
           let cacheData = null;
           try {
             const cacheContent = await fs72.readFile(cachePath, "utf-8");
@@ -7137,7 +7267,7 @@ var init_generate_ai_content = __esm({
         const { skipDiskCache } = options;
         const contentRoot = path82.join(branchRoot, contentRootName);
         const read = skipDiskCache ? null : await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
-        const result = await this.resolveFresh(contentRoot, entrySchemaRegistry);
+        const result = await timeRequestPhase("resolve", () => this.resolveFresh(contentRoot, entrySchemaRegistry));
         if (!isValidSchema(result.schema)) {
           throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
         }
@@ -7148,9 +7278,9 @@ var init_generate_ai_content = __esm({
         }
         const flatSchema = flattenSchema(result.schema, contentRootName);
         if (!skipDiskCache) {
-          const cacheDir = path82.join(branchRoot, ".canopy-meta");
-          const cachePath = path82.join(cacheDir, "schema-cache.json");
-          await fs72.unlink(path82.join(cacheDir, "schema-cache.stale")).catch(() => {
+          const cacheDir = await schemaCacheDir(branchRoot);
+          const cachePath = path82.join(cacheDir, SCHEMA_CACHE_FILE);
+          await fs72.unlink(path82.join(branchRoot, CANOPY_META_DIR, "schema-cache.stale")).catch(() => {
           });
           if (read && read.ok) {
             const newCache = {
@@ -7217,6 +7347,7 @@ var init_generate_ai_content = __esm({
     asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
     init_normalize2();
     init_operating_mode();
+    RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
     BranchPathError = class extends Error {
     };
     resolveContentBranchesRoot = (mode, override) => {
@@ -7643,6 +7774,7 @@ var init_generate_ai_content = __esm({
           return {
             absolutePath: resolved,
             relativePath: path11.relative(this.root, resolved),
+            logicalPath: entryLogicalPath(schemaItem.logicalPath, safeSlug),
             id,
             entryTypeName: finalEntryTypeName,
             existed
@@ -7672,6 +7804,10 @@ var init_generate_ai_content = __esm({
         const schemaItem = this.assertSchemaItem(schemaPath);
         return await this.buildPaths(schemaItem, slug);
       }
+      /**
+       * Read one entry. References resolve unless `resolveReferences: false`; a target that
+       * `referenceAccess` denies resolves to a `RestrictedReference` rather than its data.
+       */
       async read(collectionPath, slug = "", options = {}) {
         const schemaItem = this.assertSchemaItem(collectionPath);
         const { absolutePath, relativePath, entryTypeName: resolvedEntryTypeName } = await this.buildPaths(schemaItem, slug);
@@ -7733,7 +7869,7 @@ var init_generate_ai_content = __esm({
           };
         }
         if (options.resolveReferences !== false) {
-          doc.data = await this.resolveReferencesInData(doc.data, fields);
+          doc.data = await this.resolveReferencesInData(doc.data, fields, void 0, options.referenceAccess);
         }
         doc.version = stat.mtimeMs;
         return doc;
@@ -8187,20 +8323,25 @@ var init_generate_ai_content = __esm({
        * a target referenced by many entries is read once; omit `cache` for exactly `read()`'s
        * unmemoized behavior.
        *
-       * **Path ACLs are not consulted for the targets.** Resolution goes through this store's own
-       * `read()`, below the per-entry permission check in content-reader.ts, so a resolved target
-       * may be an entry the caller could not `read()` directly -- pre-existing `read()` behavior,
-       * matched here on purpose so one rule covers both.
+       * `access` applies to every target exactly as in `read()`; see {@link ReferenceTargetAccess}.
+       */
+      async resolveReferences(data, fields, cache, access) {
+        return this.resolveReferencesInData(data, fields, cache, access);
+      }
+      /**
+       * Resolve one reference id the way a reference field resolves it, for the editor's
+       * live-preview endpoint (api/resolve-references.ts), which has ids but no field to walk. Null
+       * when the id names no entry. No body is embedded, since there is no field to ask for one.
        */
-      async resolveReferences(data, fields, cache) {
-        return this.resolveReferencesInData(data, fields, cache);
+      async resolveReferenceTarget(id, access) {
+        return this.resolveSingleReference(id, await this.idIndex(), false, void 0, access);
       }
-      async resolveReferencesInData(data, fields, cache) {
+      async resolveReferencesInData(data, fields, cache, access) {
         const resolved = { ...data };
         const idIndex = await this.idIndex();
         for (const field of fields) {
           if (field.type === "group") {
-            const groupResolved = await this.resolveReferencesInData(resolved, field.fields, cache);
+            const groupResolved = await this.resolveReferencesInData(resolved, field.fields, cache, access);
             Object.assign(resolved, groupResolved);
             continue;
           }
@@ -8208,18 +8349,18 @@ var init_generate_ai_content = __esm({
           if (field.type === "reference") {
             const includeBody = field.includeBody === true;
             if (typeof value === "string" && value) {
-              resolved[field.name] = await this.resolveSingleReference(value, idIndex, includeBody, cache);
+              resolved[field.name] = await this.resolveSingleReference(value, idIndex, includeBody, cache, access);
             } else if (field.list && Array.isArray(value)) {
-              resolved[field.name] = await Promise.all(value.map((id) => typeof id === "string" ? this.resolveSingleReference(id, idIndex, includeBody, cache) : null));
+              resolved[field.name] = await Promise.all(value.map((id) => typeof id === "string" ? this.resolveSingleReference(id, idIndex, includeBody, cache, access) : null));
             }
           } else if (field.type === "object" && value) {
             const objectField = field;
             if (!objectField.fields)
               continue;
             if (objectField.list && Array.isArray(value)) {
-              resolved[field.name] = await Promise.all(value.map((item) => typeof item === "object" && item !== null ? this.resolveReferencesInData(item, objectField.fields, cache) : item));
+              resolved[field.name] = await Promise.all(value.map((item) => typeof item === "object" && item !== null ? this.resolveReferencesInData(item, objectField.fields, cache, access) : item));
             } else if (typeof value === "object") {
-              resolved[field.name] = await this.resolveReferencesInData(value, objectField.fields, cache);
+              resolved[field.name] = await this.resolveReferencesInData(value, objectField.fields, cache, access);
             }
           } else if (field.type === "block" && Array.isArray(value)) {
             const blockField = field;
@@ -8232,7 +8373,7 @@ var init_generate_ai_content = __esm({
                 return block;
               return {
                 ...b,
-                value: await this.resolveReferencesInData(b.value, template.fields, cache)
+                value: await this.resolveReferencesInData(b.value, template.fields, cache, access)
               };
             }));
           }
@@ -8263,13 +8404,13 @@ var init_generate_ai_content = __esm({
        * `includeBody` is opt-in per field: an embedded body sits inside the memoized object and is
        * cloned once per referencing entry.
        */
-      resolveSingleReference(id, idIndex, includeBody, cache) {
+      resolveSingleReference(id, idIndex, includeBody, cache, access) {
         if (!cache)
-          return this.resolveSingleReferenceUncached(id, idIndex, includeBody);
+          return this.resolveSingleReferenceUncached(id, idIndex, includeBody, access);
         const key = includeBody ? `${id}:body` : id;
         let pending = cache.get(key);
         if (!pending) {
-          pending = this.resolveSingleReferenceUncached(id, idIndex, includeBody);
+          pending = this.resolveSingleReferenceUncached(id, idIndex, includeBody, access);
           cache.set(key, pending);
         }
         return pending.then((resolved) => resolved === null ? null : structuredClone(resolved));
@@ -8287,15 +8428,27 @@ var init_generate_ai_content = __esm({
        * A {@link ReferenceResolveCache} sits ABOVE this, never inside it, so every distinct id
        * still runs the full refresh-and-retry; a cache only makes repeats of the SAME id share it.
        */
-      async resolveSingleReferenceUncached(id, idIndex, includeBody) {
-        const first = await this.resolveSingleReferenceOnce(id, idIndex, includeBody);
+      async resolveSingleReferenceUncached(id, idIndex, includeBody, access) {
+        const first = await this.resolveSingleReferenceOnce(id, idIndex, includeBody, access);
         if (first !== STALE_LOOKUP)
           return first;
         await this.refreshIndexForSuspiciousLookup();
-        const second = await this.resolveSingleReferenceOnce(id, await this.idIndex(), includeBody);
+        const second = await this.resolveSingleReferenceOnce(id, await this.idIndex(), includeBody, access);
         return second === STALE_LOOKUP ? null : second;
       }
-      async resolveSingleReferenceOnce(id, idIndex, includeBody) {
+      /**
+       * The entry type an entry file was written as, by its filename's type token, falling back to
+       * the collection's default the way `read()` does for a legacy untyped file.
+       */
+      entryTypeOf(collectionPath, relativePath) {
+        const schemaItem = this.assertSchemaItem(collectionPath);
+        if (schemaItem.type === "entry-type")
+          return schemaItem;
+        const entries = schemaItem.entries;
+        const typeName = extractEntryTypeFromFilename(path11.basename(relativePath));
+        return entries?.find((e) => e.name === typeName) ?? getDefaultEntryType(schemaItem.entries);
+      }
+      async resolveSingleReferenceOnce(id, idIndex, includeBody, access) {
         try {
           const location = idIndex.findById(id);
           if (!location)
@@ -8306,13 +8459,22 @@ var init_generate_ai_content = __esm({
           const doc = await this.read(location.collection, location.slug, {
             resolveReferences: false
           });
-          const bodyForEmbed = includeBody && "body" in doc ? { fieldName: doc.bodyFieldName, value: doc.body } : void 0;
-          return buildResolvedReference(doc.data, {
+          const meta = {
             id,
             slug: location.slug,
             collection: location.collection,
             urlPath: computeEntryUrl(location.collection, location.slug, this.contentRootName)
-          }, bodyForEmbed);
+          };
+          if (access && !access(entryLogicalPath(location.collection, location.slug))) {
+            const entryType = this.entryTypeOf(location.collection, location.relativePath);
+            return buildRestrictedReference(meta, resolveEntryTitle(doc.data, {
+              schema: entryType?.schema,
+              entryTypeLabel: entryType?.label,
+              slug: location.slug
+            }));
+          }
+          const bodyForEmbed = includeBody && "body" in doc ? { fieldName: doc.bodyFieldName, value: doc.body } : void 0;
+          return buildResolvedReference(doc.data, meta, bodyForEmbed);
         } catch (error) {
           if (isNodeError3(error) && error.code === "ENOENT")
             return STALE_LOOKUP;
@@ -8337,7 +8499,7 @@ var init_generate_ai_content = __esm({
       "reference",
       "image"
     ]);
-    log22 = createDebugLogger2({ prefix: "EntryLinks" });
+    log3 = createDebugLogger2({ prefix: "EntryLinks" });
     BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
     ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
     BRANCH_META_DIR = ".canopy-meta";
@@ -8352,7 +8514,7 @@ var init_generate_ai_content = __esm({
     };
     branchMetadataFilePath = (branchRoot) => path13.join(path13.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
     init_logger2();
-    log3 = createDebugLogger2({ prefix: "BranchRegistry" });
+    log4 = createDebugLogger2({ prefix: "BranchRegistry" });
     REGISTRY_FILE = "branches.json";
     REGISTRY_STALE_FILE = "branches.stale.json";
     REGISTRY_TEMP_FILE = "branches.tmp.json";
@@ -8432,7 +8594,7 @@ var init_generate_ai_content = __esm({
             });
           await this.regenerate();
         } catch (err) {
-          log3.warn("invalidate", "Eager regeneration after invalidate() failed", {
+          log4.warn("invalidate", "Eager regeneration after invalidate() failed", {
             error: getErrorMessage3(err)
           });
         }
@@ -8517,7 +8679,7 @@ var init_generate_ai_content = __esm({
         return branches;
       }
     };
-    log4 = createDebugLogger2({ prefix: "OccJsonWrite" });
+    log5 = createDebugLogger2({ prefix: "OccJsonWrite" });
     OccWriteConflictError = class extends Error {
       constructor(message = "Concurrent modification detected") {
         super(message);
@@ -8687,13 +8849,7 @@ var init_generate_ai_content = __esm({
       };
     };
     init_operating_mode();
-    NETWORK_SCHEME_PATTERN = /^(https?|ssh|git):\/\//i;
-    TRANSPORT_HELPER_PATTERN = /^[a-z][a-z0-9+.-]*::/i;
-    LEADING_OPTION_PATTERN = /^-/;
-    WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:[\\/]/;
-    COLON_BEFORE_SLASH_PATTERN = /^[^/\\\s]+:/;
-    MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find remote ref"];
-    log5 = createDebugLogger2({ prefix: "GitManager" });
+    log6 = createDebugLogger2({ prefix: "GitManager" });
     GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
     FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
     remoteInitLocks = /* @__PURE__ */ new Map();
@@ -8714,6 +8870,41 @@ var init_generate_ai_content = __esm({
         this.name = "GitRemoteRefMissingError";
       }
     };
+    RemoteNotReadyError = class extends Error {
+      constructor(expectedRemotePath) {
+        super(`CanopyCMS: no git remote is available yet. defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is not set and the CMS worker has not created ${expectedRemotePath}; the worker may still be starting.`);
+        this.expectedRemotePath = expectedRemotePath;
+        this.name = "RemoteNotReadyError";
+      }
+    };
+    SettingsRemoteUnreadableError = class extends Error {
+      constructor(branch, remote, gitError) {
+        super(`CanopyCMS: could not read settings branch '${branch}' from remote '${remote}', so the settings workspace was not provisioned: ${getErrorMessage3(gitError)}`);
+        this.branch = branch;
+        this.remote = remote;
+        this.gitError = gitError;
+        this.name = "SettingsRemoteUnreadableError";
+      }
+    };
+    SettingsBranchDivergedError = class extends Error {
+      constructor(branch, workspacePath, localWork) {
+        super(`CanopyCMS: settings branch '${branch}' in ${workspacePath} shares no history with the remote's '${branch}', and holds ${localWork}. Settings saves cannot pull until one copy is chosen. To keep the remote's settings: copy anything you need out of ${workspacePath}, move it aside, and restart; the next start checks out the remote's '${branch}', and copied changes can then be re-applied in the editor.`);
+        this.branch = branch;
+        this.workspacePath = workspacePath;
+        this.localWork = localWork;
+        this.name = "SettingsBranchDivergedError";
+      }
+    };
+    SETTINGS_BRANCH_FILES = /* @__PURE__ */ new Set(["permissions.json", "groups.json"]);
+    SettingsBranchHasContentHistoryError = class extends Error {
+      constructor(branch, remote, evidence) {
+        super(`CanopyCMS: the settings branch '${branch}' on remote '${remote}' holds content, not settings (${evidence}), so it was not checked out. Restore '${branch}' on the remote from a copy of the settings (it may hold only permissions.json and groups.json), then restart.`);
+        this.branch = branch;
+        this.remote = remote;
+        this.evidence = evidence;
+        this.name = "SettingsBranchHasContentHistoryError";
+      }
+    };
     GitManager = class _GitManager {
       constructor(options, gitOptions) {
         this.repoPath = path17.resolve(options.repoPath);
@@ -8724,14 +8915,14 @@ var init_generate_ai_content = __esm({
         this.git.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(this.repoPath) }));
       }
       static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
-        log5.debug("git", "Cloning repository", {
+        log6.debug("git", "Cloning repository", {
           remoteUrl,
           targetPath,
           baseBranch
         });
         const git = simpleGit22();
         await git.clone(remoteUrl, targetPath, ["--branch", baseBranch, "--single-branch"]);
-        log5.debug("git", "Clone complete");
+        log6.debug("git", "Clone complete");
       }
       /**
        * Initializes a local bare git repository to simulate a remote for dev mode,
@@ -8745,15 +8936,15 @@ var init_generate_ai_content = __esm({
       static async ensureLocalSimulatedRemote(options) {
         const existingLock = remoteInitLocks.get(options.remotePath);
         if (existingLock) {
-          log5.debug("git", "Waiting for existing remote initialization", {
+          log6.debug("git", "Waiting for existing remote initialization", {
             remotePath: options.remotePath
           });
           await existingLock;
         }
-        const lockPromise = log5.timed("git", "ensureLocalSimulatedRemote", async () => {
+        const lockPromise = log6.timed("git", "ensureLocalSimulatedRemote", async () => {
           let releaseLock;
           try {
-            log5.debug("git", "Initializing local simulated remote", {
+            log6.debug("git", "Initializing local simulated remote", {
               remotePath: options.remotePath,
               baseBranch: options.baseBranch
             });
@@ -8768,7 +8959,7 @@ var init_generate_ai_content = __esm({
                 throw err;
             }
             if (remoteExists && await _GitManager.bareRemoteHasBranch(options.remotePath, options.baseBranch)) {
-              log5.debug("git", "Remote already has base branch, skipping");
+              log6.debug("git", "Remote already has base branch, skipping");
               return;
             }
             let gitRoot = options.sourcePath;
@@ -8787,8 +8978,8 @@ var init_generate_ai_content = __esm({
             }
             let hasCommits = false;
             try {
-              const log82 = await sourceGit.log(["-1"]);
-              hasCommits = log82.total > 0;
+              const log92 = await sourceGit.log(["-1"]);
+              hasCommits = log92.total > 0;
             } catch {
               hasCommits = false;
             }
@@ -8800,12 +8991,12 @@ var init_generate_ai_content = __esm({
               throw new Error(`Cannot initialize local simulated remote: base branch '${options.baseBranch}' does not exist locally. Please checkout '${options.baseBranch}' first or provide an explicit remoteUrl.`);
             }
             if (remoteExists) {
-              log5.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
+              log6.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
                 remotePath: options.remotePath,
                 baseBranch: options.baseBranch
               });
             } else {
-              log5.debug("git", "Creating bare remote repository");
+              log6.debug("git", "Creating bare remote repository");
               await simpleGit22().raw([
                 "init",
                 "--bare",
@@ -8819,13 +9010,13 @@ var init_generate_ai_content = __esm({
               baseBranch: options.baseBranch,
               subdirectory: options.subdirectory
             });
-            log5.debug("git", "Remote initialization complete");
+            log6.debug("git", "Remote initialization complete");
           } finally {
             if (releaseLock) {
               try {
                 await releaseLock();
               } catch (err) {
-                log5.debug("git", "Failed to release remote-init lock", { err });
+                log6.debug("git", "Failed to release remote-init lock", { err });
               }
             }
             remoteInitLocks.delete(options.remotePath);
@@ -8893,7 +9084,7 @@ var init_generate_ai_content = __esm({
        * deleteBranchHandler: a head left in `remote.git` forever makes the
        * create -> publish -> squash-merge -> delete -> reuse-the-name cycle reject
        * the reused branch's first publish non-fast-forward against the stale head
-       * (`GitManager.push()` pushes `branch:branch`, and a squash-merged old tip is
+       * (`GitManager.push()` pushes the branch to the same name, and a squash-merged old tip is
        * not an ancestor of the new branch), and a retried submit then skips the
        * local push on a clean tree and enqueues the worker push of the STALE head,
        * resurrecting the deleted branch's content on GitHub as an apparent success.
@@ -9024,6 +9215,12 @@ var init_generate_ai_content = __esm({
           return;
         throw new Error(`CanopyCMS: refusing to use a network remote URL in prod mode (from ${source}: "${url}"). The standard AWS Lambda+EC2-worker topology runs the CMS Lambda with no internet access \u2014 the EC2 worker owns all network git I/O, and the Lambda is expected to reach the EFS-local bare repo ({workspace}/remote.git) via auto-detect instead. Pointing a network URL here would make the internet-less Lambda try to clone/fetch/push it directly and hang until timeout. If this prod host genuinely has internet access and intentionally runs git against a network remote (e.g. a single-VM deployment), set config.allowNetworkRemoteInProd: true to acknowledge this.`);
       }
+      /** The not-ready error for a mode whose remote is auto-detected, or `undefined` for other modes. */
+      static async remoteNotReadyError(mode) {
+        const { operatingStrategy: operatingStrategy22 } = await Promise.resolve().then(() => (init_operating_mode(), operating_mode_exports));
+        const { autoDetectRemotePath } = operatingStrategy22(mode).getRemoteUrlConfig();
+        return autoDetectRemotePath ? new RemoteNotReadyError(autoDetectRemotePath) : void 0;
+      }
       /**
        * Resolves the remote URL for git operations following the priority:
        * 1. Explicit remoteUrl parameter
@@ -9060,7 +9257,7 @@ var init_generate_ai_content = __esm({
           try {
             const stat = await fs16.stat(config.autoDetectRemotePath);
             if (stat.isDirectory()) {
-              log5.debug("git", "Auto-detected local remote", {
+              log6.debug("git", "Auto-detected local remote", {
                 path: config.autoDetectRemotePath
               });
               return config.autoDetectRemotePath;
@@ -9124,7 +9321,7 @@ var init_generate_ai_content = __esm({
           try {
             const stat = await fs16.stat(gitPath);
             if (stat.isDirectory()) {
-              log5.debug("git", "Removing corrupt .git directory", {
+              log6.debug("git", "Removing corrupt .git directory", {
                 workspacePath: options.workspacePath
               });
               await fs16.rm(gitPath, { recursive: true });
@@ -9135,6 +9332,7 @@ var init_generate_ai_content = __esm({
           }
         }
         let justCloned = false;
+        let resolvedRemoteUrl;
         if (!repoExists) {
           const remoteUrl = await _GitManager.resolveRemoteUrl({
             mode: options.mode,
@@ -9145,6 +9343,9 @@ var init_generate_ai_content = __esm({
             allowNetworkRemoteInProd: options.allowNetworkRemoteInProd
           });
           if (!remoteUrl) {
+            const notReady = await _GitManager.remoteNotReadyError(options.mode);
+            if (notReady)
+              throw notReady;
             throw new Error("CanopyCMS: defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is required to initialize workspace");
           }
           try {
@@ -9153,6 +9354,7 @@ var init_generate_ai_content = __esm({
             throw new Error(`Failed to clone branch workspace at ${options.workspacePath} from ${remoteUrl} (base branch '${baseBranch}'): ${getErrorMessage3(err)}`);
           }
           justCloned = true;
+          resolvedRemoteUrl = remoteUrl;
           const freshGit = simpleGit22({ baseDir: options.workspacePath });
           freshGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(options.workspacePath) }));
           await freshGit.addConfig("canopycms.managed", "true");
@@ -9168,7 +9370,7 @@ var init_generate_ai_content = __esm({
         await git.git.addConfig("canopycms.managed", "true");
         await git.git.addConfig("user.name", options.gitBotAuthorName);
         await git.git.addConfig("user.email", options.gitBotAuthorEmail);
-        log5.debug("git", "Marked workspace as CanopyCMS-managed", {
+        log6.debug("git", "Marked workspace as CanopyCMS-managed", {
           workspacePath: options.workspacePath
         });
         if (!justCloned) {
@@ -9183,9 +9385,17 @@ var init_generate_ai_content = __esm({
           if (remoteUrl) {
             await git.ensureRemote(remoteUrl);
           }
+          resolvedRemoteUrl = remoteUrl;
         }
         if (options.branchType === "orphan") {
-          await git.createOrphanSettingsBranch(options.branchName, {});
+          try {
+            await git.createOrphanSettingsBranch(options.branchName, {});
+          } catch (err) {
+            if (err instanceof SettingsRemoteUnreadableError && !resolvedRemoteUrl) {
+              throw await _GitManager.remoteNotReadyError(options.mode) ?? err;
+            }
+            throw err;
+          }
           await git.ensureGitExclude("*.lock");
         } else {
           await git.checkoutBranch(options.branchName);
@@ -9294,7 +9504,7 @@ var init_generate_ai_content = __esm({
         const branches = await this.git.branch();
         const currentBranch = branches.current;
         try {
-          await this.git.fetch(this.remote, currentBranch);
+          await this.git.fetch(this.remote, `refs/heads/${currentBranch}`);
         } catch (err) {
           if (!isMissingRemoteRefFailure(getErrorMessage3(err)))
             throw err;
@@ -9351,19 +9561,34 @@ var init_generate_ai_content = __esm({
         const fileArray = Array.isArray(files) ? files : [files];
         await this.git.add(fileArray);
       }
+      /** Stage every working-tree change except canopycms's own state. See {@link stageAllExceptCanopyState}. */
+      async addAllExceptCanopyState() {
+        await stageAllExceptCanopyState(this.git);
+      }
       async commit(message) {
         await this.git.commit(message);
       }
       async push(branch) {
-        const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
+        const target = branch ?? await this.currentBranchName();
         await this.git.raw([
           "push",
           "--set-upstream",
           "--end-of-options",
           this.remote,
-          `${target}:${target}`
+          `refs/heads/${target}:refs/heads/${target}`
         ]);
       }
+      /**
+       * The checked-out branch's plain name. `rev-parse --abbrev-ref HEAD` prints
+       * `heads/<name>` when a same-named tag exists, which is not a branch name.
+       */
+      async currentBranchName() {
+        const branches = await this.git.branch();
+        if (branches.detached || !branches.current) {
+          throw new Error(`CanopyCMS: no branch is checked out (detached HEAD) in ${this.repoPath}`);
+        }
+        return branches.current;
+      }
       /**
        * Whether the local branch has commits the remote mirror doesn't -- i.e.
        * whether push() would move the remote ref forward.
@@ -9382,12 +9607,12 @@ var init_generate_ai_content = __esm({
        * ("couldn't find remote ref"); that counts as "ahead", not an error.
        */
       async hasUnpushedCommits(branch) {
-        const target = branch ?? await this.git.revparse(["--abbrev-ref", "--end-of-options", "HEAD"]);
-        const localSha = (await this.git.revparse(["--end-of-options", target])).trim();
+        const target = branch ?? await this.git.revparse(["--verify", "--abbrev-ref", "--end-of-options", "HEAD"]);
+        const localSha = (await this.git.revparse(["--verify", "--end-of-options", target])).trim();
         let fetchedTip;
         try {
           await this.git.raw(["fetch", "--end-of-options", this.remote, target]);
-          fetchedTip = (await this.git.revparse(["--end-of-options", "FETCH_HEAD"])).trim();
+          fetchedTip = (await this.git.revparse(["--verify", "--end-of-options", "FETCH_HEAD"])).trim();
         } catch {
           return true;
         }
@@ -9396,6 +9621,25 @@ var init_generate_ai_content = __esm({
         const aheadCount = (await this.git.raw(["rev-list", "--count", `${fetchedTip}..${localSha}`])).trim();
         return aheadCount !== "0";
       }
+      /**
+       * Repo-relative paths that differ between HEAD and its merge base with the
+       * base branch: everything the branch changes, across all of its commits.
+       * Diffs against the just-fetched base tip pinned to a SHA — the pullBaseInner
+       * constraint.
+       */
+      async listChangedPathsSinceBase() {
+        await this.git.raw(["fetch", "--end-of-options", this.remote, this.baseBranch]);
+        const baseTip = (await this.git.revparse(["--verify", "--end-of-options", "FETCH_HEAD"])).trim();
+        const output = await this.git.raw([
+          "diff",
+          "--name-only",
+          "-z",
+          "--no-renames",
+          `${baseTip}...HEAD`,
+          "--"
+        ]);
+        return output.split("\0").filter((p5) => p5.length > 0);
+      }
       async ensureAuthor(author) {
         const config = await this.git.listConfig();
         const isManaged = config.all["canopycms.managed"] === "true";
@@ -9449,10 +9693,24 @@ var init_generate_ai_content = __esm({
         await ensureGitExcludePattern(this.repoPath, pattern);
       }
       /**
-       * Create an orphan branch (no shared history) for settings, so
-       * deployment-specific settings never pollute content history. It holds only
-       * settings files committed by explicit path (permissions.json, groups.json at
-       * the workspace root).
+       * Put the workspace on the settings branch: an orphan (no shared history),
+       * so deployment-specific settings never pollute content history. It holds
+       * only settings files committed by explicit path (permissions.json,
+       * groups.json at the workspace root).
+       *
+       * The remote is the settings branch's durable copy, and the workspace clone
+       * is `--single-branch` at the base branch, so the remote is asked first:
+       * - no local branch: check out the remote's, or create an empty orphan only
+       *   when the remote has none. An unreadable remote throws
+       *   {@link SettingsRemoteUnreadableError} rather than guess "none".
+       * - local branch present: a history unrelated to the remote's is repaired
+       *   onto the remote's when the local branch is still its empty initial
+       *   commit with a clean working tree, and otherwise throws
+       *   {@link SettingsBranchDivergedError}; local commits are never discarded.
+       *   An unreadable remote throws only for that empty branch, since one that
+       *   holds settings can serve them and the next save surfaces the remote error.
+       * Either way a remote branch holding content is never adopted:
+       * {@link SettingsBranchHasContentHistoryError}.
        */
       async createOrphanSettingsBranch(branchName, initialFiles) {
         try {
@@ -9462,11 +9720,31 @@ var init_generate_ai_content = __esm({
         }
       }
       async createOrphanSettingsBranchInner(branchName, initialFiles) {
-        log5.debug("git", "Creating orphan settings branch", { branchName });
+        log6.debug("git", "Ensuring settings branch", { branchName });
         const branches = await this.git.branch();
-        if (branches.all.includes(branchName)) {
-          log5.debug("git", "Orphan branch already exists", { branchName });
+        const localExists = branches.all.includes(branchName);
+        if (localExists) {
           await this.git.checkout(branchName);
+        }
+        let remoteTip;
+        try {
+          remoteTip = await this.remoteBranchTip(branchName);
+        } catch (err) {
+          if (localExists && !await this.isEmptyInitialBranch(branchName)) {
+            log6.debug("git", "Remote unreadable; serving the local settings branch", { branchName });
+            return;
+          }
+          throw new SettingsRemoteUnreadableError(branchName, this.remote, err);
+        }
+        if (localExists) {
+          await this.reconcileLocalSettingsBranch(branchName, remoteTip);
+          return;
+        }
+        if (remoteTip) {
+          const fetchedTip = await this.fetchBranchTip(branchName);
+          await this.assertNotContentHistory(branchName, fetchedTip);
+          await this.git.raw(["checkout", "-b", branchName, fetchedTip]);
+          log6.debug("git", "Checked out the remote settings branch", { branchName });
           return;
         }
         await this.git.raw(["checkout", "--orphan", branchName]);
@@ -9481,17 +9759,127 @@ var init_generate_ai_content = __esm({
           await this.git.add(filePath);
         }
         await this.git.commit("Initialize settings branch", ["--allow-empty"]);
-        log5.debug("git", "Orphan settings branch created", { branchName });
+        log6.debug("git", "Orphan settings branch created", { branchName });
+      }
+      /**
+       * Compares the checked-out local settings branch with the remote's tip.
+       * Related histories are left for the next settings pull to reconcile; only
+       * an unrelated one is acted on here.
+       */
+      async reconcileLocalSettingsBranch(branchName, remoteTip) {
+        if (!remoteTip)
+          return;
+        const localTip = (await this.git.revparse([`refs/heads/${branchName}`])).trim();
+        if (localTip === remoteTip)
+          return;
+        const fetchedTip = await this.fetchBranchTip(branchName);
+        const [localRoots, remoteRoots] = await Promise.all([
+          this.rootCommits(localTip),
+          this.rootCommits(fetchedTip)
+        ]);
+        if (localRoots.some((root) => remoteRoots.includes(root)))
+          return;
+        const localWork = [];
+        if (!await this.isEmptyInitialBranch(branchName)) {
+          localWork.push("commits beyond its empty initial commit");
+        }
+        const uncommitted = await this.getUncommittedFiles();
+        if (uncommitted.length > 0) {
+          localWork.push(`uncommitted changes to ${uncommitted.join(", ")}`);
+        }
+        if (localWork.length > 0) {
+          throw new SettingsBranchDivergedError(branchName, this.repoPath, localWork.join(" and "));
+        }
+        await this.assertNotContentHistory(branchName, fetchedTip);
+        await this.git.raw(["checkout", "-B", branchName, fetchedTip]);
+        log6.debug("git", "Replaced an empty settings branch with the remote one", { branchName });
+      }
+      /**
+       * The remote's tip for `branch`, or `undefined` when the remote has no such
+       * branch. A remote that cannot be read throws: `ls-remote` exits 0 with no
+       * output only for a reachable remote without the ref.
+       */
+      async remoteBranchTip(branch) {
+        const ref = `refs/heads/${branch}`;
+        const output = await this.git.raw(["ls-remote", "--heads", this.remote, ref]);
+        for (const line of output.split("\n")) {
+          const [sha, name] = line.trim().split("	");
+          if (sha && name === ref)
+            return sha;
+        }
+        return void 0;
+      }
+      /**
+       * Fetch `branch` from the remote and return the fetched commit, pinned as
+       * pullBaseInner explains. The full ref: a bare name resolves to a
+       * same-named tag first.
+       */
+      async fetchBranchTip(branch) {
+        await this.git.fetch(this.remote, `refs/heads/${branch}`);
+        return (await this.git.revparse(["FETCH_HEAD"])).trim();
+      }
+      /**
+       * Refuse to adopt a remote settings branch that holds content: its tip has a file other than
+       * the settings files, or its roots include the base branch's (a settings branch is an orphan).
+       * Neither alone suffices: a base can have a root of its own, and a content tree can be pruned.
+       * The base comes from the remote when the clone lacks it (it was cloned at an earlier base).
+       */
+      async assertNotContentHistory(branchName, tip) {
+        const tree = await this.git.raw(["ls-tree", "-r", "--name-only", tip]);
+        const strays = tree.split("\n").filter((file) => file && !SETTINGS_BRANCH_FILES.has(file));
+        if (strays.length > 0) {
+          const shown = strays.slice(0, 3).join(", ") + (strays.length > 3 ? ", \u2026" : "");
+          throw new SettingsBranchHasContentHistoryError(branchName, this.remote, `it holds ${shown}`);
+        }
+        const [tipRoots, baseRoots] = await Promise.all([
+          this.rootCommits(tip),
+          this.baseBranchRev(branchName).then((rev) => this.rootCommits(rev))
+        ]);
+        if (tipRoots.some((root) => baseRoots.includes(root))) {
+          throw new SettingsBranchHasContentHistoryError(branchName, this.remote, `it shares history with the base branch '${this.baseBranch}'`);
+        }
+      }
+      async baseBranchRev(settingsBranch) {
+        for (const ref of [
+          `refs/heads/${this.baseBranch}`,
+          `refs/remotes/${this.remote}/${this.baseBranch}`
+        ]) {
+          const sha = await this.git.raw(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).catch(() => "");
+          if (sha.trim())
+            return sha.trim();
+        }
+        try {
+          return await this.fetchBranchTip(this.baseBranch);
+        } catch (err) {
+          throw new Error(`CanopyCMS: could not read base branch '${this.baseBranch}' from remote '${this.remote}', so settings branch '${settingsBranch}' was not checked out: ${getErrorMessage3(err)}`);
+        }
+      }
+      async rootCommits(rev) {
+        const output = await this.git.raw(["rev-list", "--max-parents=0", rev]);
+        return output.split("\n").filter(Boolean);
+      }
+      /**
+       * Whether `branch` is a single parentless commit with an empty tree, as
+       * orphan creation leaves it. Full refs throughout: a bare name resolves to a
+       * same-named tag first, and clones fetch tags.
+       */
+      async isEmptyInitialBranch(branch) {
+        const ref = `refs/heads/${branch}`;
+        const commits = await this.git.raw(["rev-list", "--max-count=2", ref]);
+        if (commits.split("\n").filter(Boolean).length !== 1)
+          return false;
+        const tree = await this.git.raw(["ls-tree", ref]);
+        return tree.trim() === "";
       }
     };
-    log6 = createDebugLogger2({ prefix: "BranchWorkspace" });
+    log7 = createDebugLogger2({ prefix: "BranchWorkspace" });
     workspaceInitLocks = /* @__PURE__ */ new Map();
     BranchWorkspaceManager = class {
       constructor(config) {
         this.config = config;
       }
       async ensureGitWorkspace(options) {
-        return log6.timed("workspace", "ensureGitWorkspace", async () => {
+        return log7.timed("workspace", "ensureGitWorkspace", async () => {
           const existingLock = workspaceInitLocks.get(options.branchRoot);
           if (existingLock) {
             await existingLock;
@@ -9500,11 +9888,11 @@ var init_generate_ai_content = __esm({
           const lockPromise = (async () => {
             let releaseLock;
             try {
-              log6.debug("workspace", "Ensuring git workspace", {
+              log7.debug("workspace", "Ensuring git workspace", {
                 branchName: options.branchName,
                 mode: options.mode
               });
-              releaseLock = await acquireProvisioningLock(path18.dirname(options.branchRoot), `.${path18.basename(options.branchRoot)}.init.lock`);
+              releaseLock = await acquireProvisioningLock(path18.dirname(options.branchRoot), branchProvisioningLockName(path18.basename(options.branchRoot)));
               await GitManager.initializeWorkspace({
                 workspacePath: options.branchRoot,
                 branchName: options.branchName,
@@ -9525,7 +9913,7 @@ var init_generate_ai_content = __esm({
                 try {
                   await releaseLock();
                 } catch (err) {
-                  log6.debug("workspace", "Failed to release workspace-init lock", { err });
+                  log7.debug("workspace", "Failed to release workspace-init lock", { err });
                 }
               }
               workspaceInitLocks.delete(options.branchRoot);
@@ -9537,6 +9925,9 @@ var init_generate_ai_content = __esm({
       }
       async openOrCreateBranch(options) {
         const { branchName, mode, basePathOverride, title, description, access, createdBy, remoteUrl } = options;
+        if (isSettingsBranchName(branchName, operatingStrategy2(mode).getSettingsBranchName(this.config))) {
+          throw new BranchPathError("Settings branches are not content branches");
+        }
         const { branchRoot, baseRoot, branchName: safeName } = await ensureBranchRoot({
           mode,
           branchName,
@@ -9572,7 +9963,7 @@ var init_generate_ai_content = __esm({
         };
       }
     };
-    log7 = createDebugLogger2({ prefix: "ContentListing" });
+    log8 = createDebugLogger2({ prefix: "ContentListing" });
     normalizePath = (root, target) => {
       const result = validateAndNormalizePath(root, target);
       if (!result.valid) {
@@ -9598,13 +9989,17 @@ var init_generate_ai_content = __esm({
       } catch (err) {
         if (isNotFoundError3(err))
           return {};
-        log7.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage3(err)}`);
+        log8.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage3(err)}`);
         return {};
       }
     };
-    createReferenceResolver = (branchRoot, flatSchema, contentRootName) => ({
+    createReferenceResolver = (branchRoot, flatSchema, contentRootName, visibility) => ({
       store: new ContentStore(branchRoot, flatSchema, { contentRootName }),
-      cache: createReferenceResolveCache()
+      cache: createReferenceResolveCache(),
+      // The predicate that hides an entry from the listing is the one that restricts it as a
+      // reference target, so a target is never shown in a sibling's data that its own listing
+      // row would have hidden.
+      access: visibility?.shouldInclude
     });
     resolveCollectionItemReferences = async (items, collection, resolver) => Promise.all(items.map(async (item) => {
       const fields = collection.entries?.find((e) => e.name === item.entryType)?.schema;
@@ -9612,7 +10007,7 @@ var init_generate_ai_content = __esm({
         return item;
       return {
         ...item,
-        data: await resolver.store.resolveReferences(item.data, fields, resolver.cache)
+        data: await resolver.store.resolveReferences(item.data, fields, resolver.cache, resolver.access)
       };
     }));
     looksLikeMalformedEntry = (filename, entryTypes) => {
@@ -9655,7 +10050,7 @@ var init_generate_ai_content = __esm({
         const relativePath = normalizePath(root, absolutePath);
         const parsed = parseTypedFilename(file.name, entryTypes);
         if (!parsed) {
-          log7.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
+          log8.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
           if (looksLikeMalformedEntry(file.name, entryTypes)) {
             onSkip?.({ filename: file.name, collectionPath: collection.logicalPath });
           }
@@ -9670,7 +10065,7 @@ var init_generate_ai_content = __esm({
           readEntryData(absolutePath, format, bodyField)
         ]);
         const item = {
-          logicalPath: `${collection.logicalPath}/${slug}`,
+          logicalPath: entryLogicalPath(collection.logicalPath, slug),
           contentId,
           slug,
           collectionPath: collection.logicalPath,
@@ -9697,6 +10092,23 @@ var init_generate_ai_content = __esm({
   }
 });
 
+// dist/utils/git.js
+import { simpleGit as simpleGit4 } from "simple-git";
+function isCanopyInternalPath(repoRelativePath) {
+  return repoRelativePath === CANOPY_META_DIR2 || repoRelativePath.startsWith(`${CANOPY_META_DIR2}/`);
+}
+async function stageAllExceptCanopyState2(git) {
+  await git.add(["-A"]);
+  await git.raw(["reset", "-q", "--", CANOPY_META_DIR2]);
+}
+var CANOPY_META_DIR2;
+var init_git = __esm({
+  "dist/utils/git.js"() {
+    "use strict";
+    CANOPY_META_DIR2 = ".canopy-meta";
+  }
+});
+
 // dist/utils/atomic-write.js
 import fs19 from "node:fs/promises";
 import path23 from "node:path";
@@ -9783,6 +10195,10 @@ var init_debug2 = __esm({
           throw new Error(errorMsg);
         }
       }
+      /**
+       * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+       * anything that can run concurrently uses {@link timed}.
+       */
       time(label) {
         this.timers.set(label, Date.now());
       }
@@ -9797,12 +10213,16 @@ var init_debug2 = __esm({
         this.debug(category, `${label} completed`, { durationMs: duration });
         return duration;
       }
+      /**
+       * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+       * call, so concurrent spans with the same label on one logger never overwrite each other.
+       */
       async timed(category, label, fn) {
-        this.time(label);
+        const start = Date.now();
         try {
           return await fn();
         } finally {
-          this.timeEnd(category, label);
+          this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
         }
       }
     };
@@ -9827,7 +10247,7 @@ async function bumpResourceGeneration2(root, resource, options) {
     await atomicWriteFile3(resourceGenerationPath2(root, resource), token);
     return token;
   } catch (err) {
-    log8.warn("generation", `Failed to bump ${resource} generation for ${root}`, {
+    log9.warn("generation", `Failed to bump ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
     if (options?.mustSucceed)
@@ -9842,7 +10262,7 @@ async function readResourceGeneration2(root, resource) {
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT")
       return { ok: true, token: null };
-    log8.warn("generation", `Failed to read ${resource} generation for ${root}`, {
+    log9.warn("generation", `Failed to read ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
     return { ok: false };
@@ -9851,14 +10271,14 @@ async function readResourceGeneration2(root, resource) {
 function isGenerationCurrent2(snapshotToken, read) {
   return read.ok && read.token === snapshotToken;
 }
-var log8, META_DIR3;
+var log9, META_DIR3;
 var init_resource_generation = __esm({
   "dist/resource-generation.js"() {
     "use strict";
     init_atomic_write2();
     init_error();
     init_debug2();
-    log8 = createDebugLogger3({ prefix: "ResourceGeneration" });
+    log9 = createDebugLogger3({ prefix: "ResourceGeneration" });
     META_DIR3 = ".canopy-meta";
   }
 });
@@ -10263,7 +10683,8 @@ var init_field3 = __esm({
     });
     objectFieldSchema3 = fieldBaseSchema3.extend({
       type: z10.literal("object"),
-      fields: z10.array(z10.lazy(() => fieldHolder3[0])).min(1)
+      fields: z10.array(z10.lazy(() => fieldHolder3[0])).min(1),
+      itemTitleField: z10.string().min(1).optional()
     });
     inlineGroupFieldSchema3 = z10.object({
       type: z10.literal("group"),
@@ -10379,7 +10800,7 @@ var init_sanitize_href3 = __esm({
 
 // dist/config/schemas/url.js
 import { z as z12 } from "zod";
-var uploadTargetUrlSchema3, assetMountUrlSchema3;
+var uploadTargetUrlSchema3, assetMountUrlSchema3, previewPrefixSchema3;
 var init_url3 = __esm({
   "dist/config/schemas/url.js"() {
     "use strict";
@@ -10390,6 +10811,9 @@ var init_url3 = __esm({
     assetMountUrlSchema3 = z12.string().trim().refine((value) => isHttpUrlOrSameOriginPath3(value, { allowProtocolRelative: true }), {
       message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
     });
+    previewPrefixSchema3 = z12.string().trim().refine((value) => isHttpUrlOrSameOriginPath3(value), {
+      message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+    });
   }
 });
 
@@ -10447,6 +10871,7 @@ var init_config4 = __esm({
     "use strict";
     init_collection3();
     init_media3();
+    init_url3();
     defaultBranchAccessSchema3 = z14.enum(["allow", "deny"]).default("deny");
     defaultPathAccessLevelSchema3 = z14.enum(["allow", "deny"]);
     defaultPathAccessLevelsSchema3 = z14.object({
@@ -10478,6 +10903,7 @@ var init_config4 = __esm({
       subtitle: z14.string().optional(),
       theme: z14.unknown().optional(),
       previewBase: z14.record(z14.string()).optional(),
+      previewPrefix: previewPrefixSchema3.optional(),
       // UI handler functions (runtime only, don't serialize)
       onAccountClick: z14.function().returns(z14.void()).optional(),
       onLogoutClick: z14.function().returns(z14.void()).optional(),
@@ -10505,6 +10931,9 @@ var init_config4 = __esm({
       defaultRemoteUrl: defaultRemoteUrlSchema3.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema3,
       gitBotAuthorEmail: gitBotAuthorEmailSchema3,
+      // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+      gitEditedByTrailers: z14.boolean().optional(),
+      gitCoAuthoredByTrailers: z14.boolean().optional(),
       githubTokenEnvVar: githubTokenEnvVarSchema3.optional(),
       // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
       // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -10516,7 +10945,6 @@ var init_config4 = __esm({
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
       allowNetworkRemoteInProd: z14.boolean().optional(),
       settingsBranch: z14.string().optional(),
-      autoCreateSettingsPR: z14.boolean().optional(),
       // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
       // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
       // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -10577,6 +11005,18 @@ var init_build_mode = __esm({
   }
 });
 
+// dist/utils/request-timing.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2, log10;
+var init_request_timing = __esm({
+  "dist/utils/request-timing.js"() {
+    "use strict";
+    init_debug2();
+    storage2 = new AsyncLocalStorage2();
+    log10 = createDebugLogger3({ prefix: "CanopyCMS" });
+  }
+});
+
 // dist/branch-schema-cache.js
 var SCHEMA_GENERATION_RESOURCE2;
 var init_branch_schema_cache = __esm({
@@ -10587,6 +11027,8 @@ var init_branch_schema_cache = __esm({
     init_entry_type_reference_validator();
     init_build_mode();
     init_resource_generation();
+    init_request_timing();
+    init_git();
     SCHEMA_GENERATION_RESOURCE2 = "schema";
   }
 });
@@ -10611,14 +11053,142 @@ var init_content_index_generation = __esm({
   }
 });
 
-// dist/sync-core.js
+// dist/utils/provisioning-lock.js
 import fs24 from "node:fs/promises";
 import path26 from "node:path";
-import { simpleGit as simpleGit4 } from "simple-git";
+import lockfile3 from "proper-lockfile";
+function provisioningLockOptions2(lockPath, retries, onCompromised, staleMs) {
+  return {
+    lockfilePath: lockPath,
+    realpath: false,
+    retries,
+    stale: staleMs,
+    // Fixed, not stale/2: every holder refreshes at 15s whatever threshold it judges others by.
+    update: 15e3,
+    // proper-lockfile invokes this from inside its refresh timer, so ANY throw escaping here is
+    // an uncaught exception that kills the process. Call sites are told not to throw (see
+    // OnLockCompromised); this makes it structural rather than a convention, and also covers the
+    // LOGGER throwing -- under `CI=true`, vitest's `onConsoleLog` turns a console write into a
+    // throw.
+    onCompromised: (err) => {
+      try {
+        if (onCompromised) {
+          onCompromised(err);
+          return;
+        }
+        canopyLogWarn3(`[canopy] Provisioning lock compromised mid-hold for ${lockPath}:`, getErrorMessage(err));
+      } catch {
+        try {
+          process.stderr.write(`[canopy] lock compromised for ${lockPath}; its handler or logger threw
+`);
+        } catch {
+        }
+      }
+    }
+  };
+}
+function releaseIgnoringAlreadyReleased2(release, lockPath) {
+  return async () => {
+    try {
+      await release();
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ERELEASED") {
+        canopyLogWarn3(`[canopy] Lock at ${lockPath} was already released (compromised mid-hold, or released twice); nothing to release`);
+        return;
+      }
+      throw err;
+    }
+  };
+}
+async function tryAcquireProvisioningLock2(lockTargetDir3, lockName, onCompromised, staleMs = PROVISIONING_LOCK_STALE_MS2) {
+  await fs24.mkdir(lockTargetDir3, { recursive: true });
+  const lockPath = path26.join(lockTargetDir3, lockName);
+  const release = await lockfile3.lock(lockPath, provisioningLockOptions2(lockPath, 0, onCompromised, staleMs));
+  return releaseIgnoringAlreadyReleased2(release, lockPath);
+}
+var PROVISIONING_LOCK_STALE_MS2;
+var init_provisioning_lock = __esm({
+  "dist/utils/provisioning-lock.js"() {
+    "use strict";
+    init_error();
+    init_logger3();
+    PROVISIONING_LOCK_STALE_MS2 = 9e4;
+  }
+});
+
+// dist/utils/content-write-lock.js
+import path27 from "node:path";
+function lockTargetDir2(branchRoot) {
+  return path27.join(path27.resolve(branchRoot), META_DIR4);
+}
+function tryAcquireContentWriteLock2(branchRoot, onCompromised) {
+  return tryAcquireProvisioningLock2(lockTargetDir2(branchRoot), CONTENT_WRITE_LOCK_NAME2, onCompromised, CONTENT_WRITE_LOCK_STALE_MS2);
+}
+async function acquireContentWriteLock2(branchRoot, waitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS2, onCompromised) {
+  const startedAt = Date.now();
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await tryAcquireContentWriteLock2(branchRoot, onCompromised);
+    } catch (err) {
+      if (!isNodeError(err) || err.code !== "ELOCKED")
+        throw err;
+      const remaining = waitMs - (Date.now() - startedAt);
+      if (remaining <= 0)
+        throw new ContentWriteLockBusyError2();
+      const base = Math.min(40 * 2 ** attempt, 250);
+      await sleep2(Math.min(base * (0.5 + Math.random()), remaining));
+    }
+  }
+}
+async function withContentWriteLock2(branchRoot, fn, waitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS2) {
+  let compromised = false;
+  const release = await acquireContentWriteLock2(branchRoot, waitMs, (err) => {
+    compromised = true;
+    canopyLogWarn3(`[canopy] Content-write lock compromised mid-hold for ${branchRoot}:`, getErrorMessage(err));
+  });
+  let result;
+  try {
+    result = await fn();
+  } finally {
+    await release();
+  }
+  if (compromised) {
+    throw new ContentWriteLockBusyError2("This branch was being synced while your change was written, so the change may or may not have been recorded. Reload the entry to see the current state before saving again.", "unknown");
+  }
+  return result;
+}
+var META_DIR4, CONTENT_WRITE_LOCK_NAME2, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS2, ContentWriteLockBusyError2, sleep2, CONTENT_WRITE_LOCK_STALE_MS2;
+var init_content_write_lock = __esm({
+  "dist/utils/content-write-lock.js"() {
+    "use strict";
+    init_error();
+    init_logger3();
+    init_provisioning_lock();
+    META_DIR4 = ".canopy-meta";
+    CONTENT_WRITE_LOCK_NAME2 = "content-write.lock";
+    DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS2 = 2e3;
+    ContentWriteLockBusyError2 = class extends Error {
+      constructor(message = "This branch is busy (syncing with the base branch, or another save is in flight); the change was not saved. Try again in a moment.", outcome = "not-run") {
+        super(message);
+        this.outcome = outcome;
+        this.name = "ContentWriteLockBusyError";
+      }
+    };
+    sleep2 = (ms) => new Promise((resolve2) => {
+      setTimeout(resolve2, ms);
+    });
+    CONTENT_WRITE_LOCK_STALE_MS2 = 3e4;
+  }
+});
+
+// dist/sync-core.js
+import fs25 from "node:fs/promises";
+import path28 from "node:path";
+import { simpleGit as simpleGit5 } from "simple-git";
 function assertWithinDir(resolved, parent, label) {
-  const normalizedResolved = path26.resolve(resolved);
-  const normalizedParent = path26.resolve(parent);
-  if (!normalizedResolved.startsWith(normalizedParent + path26.sep) && normalizedResolved !== normalizedParent) {
+  const normalizedResolved = path28.resolve(resolved);
+  const normalizedParent = path28.resolve(parent);
+  if (!normalizedResolved.startsWith(normalizedParent + path28.sep) && normalizedResolved !== normalizedParent) {
     throw new Error(`${label} escapes the expected directory: ${resolved}`);
   }
 }
@@ -10626,19 +11196,19 @@ async function safeReplaceDir(oldDir, newDir) {
   const backupDir = `${oldDir}.sync-backup-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   const oldExists = await filePathExists(oldDir);
   if (oldExists) {
-    await fs24.rename(oldDir, backupDir);
+    await fs25.rename(oldDir, backupDir);
   }
   try {
-    await fs24.rename(newDir, oldDir);
+    await fs25.rename(newDir, oldDir);
   } catch (err) {
     if (oldExists) {
-      await fs24.rename(backupDir, oldDir).catch(() => {
+      await fs25.rename(backupDir, oldDir).catch(() => {
       });
     }
     throw err;
   }
   if (oldExists) {
-    await fs24.rm(backupDir, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(backupDir, { recursive: true, force: true }).catch(() => {
     });
   }
 }
@@ -10646,7 +11216,7 @@ async function listFilesRecursive(dir, prefix = "") {
   const results = [];
   let entries;
   try {
-    entries = await fs24.readdir(dir, { withFileTypes: true });
+    entries = await fs25.readdir(dir, { withFileTypes: true });
   } catch {
     return results;
   }
@@ -10657,7 +11227,7 @@ async function listFilesRecursive(dir, prefix = "") {
       continue;
     const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
     if (entry.isDirectory()) {
-      results.push(...await listFilesRecursive(path26.join(dir, entry.name), rel));
+      results.push(...await listFilesRecursive(path28.join(dir, entry.name), rel));
     } else {
       results.push(rel);
     }
@@ -10665,51 +11235,64 @@ async function listFilesRecursive(dir, prefix = "") {
   return results;
 }
 async function copyDir(src, dest) {
-  await fs24.mkdir(dest, { recursive: true });
-  const entries = await fs24.readdir(src, { withFileTypes: true });
+  await fs25.mkdir(dest, { recursive: true });
+  const entries = await fs25.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
     if (entry.name === ".git")
       continue;
     if (entry.isSymbolicLink())
       continue;
-    const srcPath = path26.join(src, entry.name);
-    const destPath = path26.join(dest, entry.name);
+    const srcPath = path28.join(src, entry.name);
+    const destPath = path28.join(dest, entry.name);
     if (entry.isDirectory()) {
       await copyDir(srcPath, destPath);
     } else {
-      await fs24.copyFile(srcPath, destPath);
+      await fs25.copyFile(srcPath, destPath);
     }
   }
 }
 async function pushContentToWorkspace(options) {
-  const { srcContentDir, branchPath, contentRoot, commitMessage, baseTag } = options;
+  const { srcContentDir, branchPath, contentRoot } = options;
   if (!await filePathExists(srcContentDir)) {
-    return { fileCount: 0 };
+    return { fileCount: 0, savedEditorState: false };
   }
-  const wsContentDir = path26.join(branchPath, contentRoot);
+  const wsContentDir = path28.join(branchPath, contentRoot);
   assertWithinDir(wsContentDir, branchPath, "content-root");
+  return withContentWriteLock2(branchPath, () => replaceWorkspaceContent(options, wsContentDir));
+}
+async function replaceWorkspaceContent(options, wsContentDir) {
+  const { srcContentDir, branchPath, commitMessage, baseTag, saveEditorStateMessage } = options;
+  const wsGit = simpleGit5({ baseDir: branchPath });
+  let savedEditorState = false;
+  if (saveEditorStateMessage) {
+    const editorChanges = (await wsGit.status()).files.filter((f) => !isCanopyInternalPath(f.path));
+    if (editorChanges.length > 0) {
+      await stageAllExceptCanopyState2(wsGit);
+      await wsGit.commit(saveEditorStateMessage);
+      savedEditorState = true;
+    }
+  }
   const tmpDir = `${wsContentDir}.sync-tmp-${Date.now()}`;
   try {
     await copyDir(srcContentDir, tmpDir);
     await safeReplaceDir(wsContentDir, tmpDir);
   } catch (err) {
-    await fs24.rm(tmpDir, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(tmpDir, { recursive: true, force: true }).catch(() => {
     });
     throw err;
   }
   try {
-    const wsGit = simpleGit4({ baseDir: branchPath });
-    await wsGit.add("-A");
-    const postStatus = await wsGit.status();
-    if (postStatus.files.length === 0) {
+    await stageAllExceptCanopyState2(wsGit);
+    const staged = (await wsGit.status()).files.filter((f) => !isCanopyInternalPath(f.path));
+    if (staged.length === 0) {
       if (baseTag)
         await wsGit.tag(["-f", baseTag]);
-      return { fileCount: 0 };
+      return { fileCount: 0, savedEditorState };
     }
     await wsGit.commit(commitMessage ?? "sync: update content from working tree");
     if (baseTag)
       await wsGit.tag(["-f", baseTag]);
-    return { fileCount: postStatus.files.length };
+    return { fileCount: staged.length, savedEditorState };
   } finally {
     await invalidateBranchContentCaches2(branchPath);
   }
@@ -10719,54 +11302,38 @@ var init_sync_core = __esm({
   "dist/sync-core.js"() {
     "use strict";
     init_content_index_generation();
+    init_content_write_lock();
     init_fs();
+    init_git();
     SYNC_BASE_TAG = "canopycms-sync-base";
   }
 });
 
-// dist/utils/git.js
-import { simpleGit as simpleGit5 } from "simple-git";
-var init_git = __esm({
-  "dist/utils/git.js"() {
-    "use strict";
-  }
-});
-
-// dist/utils/provisioning-lock.js
-import lockfile3 from "proper-lockfile";
-var init_provisioning_lock = __esm({
-  "dist/utils/provisioning-lock.js"() {
-    "use strict";
-    init_error();
-    init_logger3();
-  }
-});
-
 // dist/git-manager.js
-import fs25 from "node:fs/promises";
-import path27 from "node:path";
+import fs26 from "node:fs/promises";
+import path29 from "node:path";
 import { simpleGit as simpleGit6 } from "simple-git";
 async function ensureGitExcludePattern2(repoPath, pattern) {
-  const excludePath = path27.join(repoPath, ".git", "info", "exclude");
-  await fs25.mkdir(path27.dirname(excludePath), { recursive: true });
+  const excludePath = path29.join(repoPath, ".git", "info", "exclude");
+  await fs26.mkdir(path29.dirname(excludePath), { recursive: true });
   let content = "";
   try {
-    content = await fs25.readFile(excludePath, "utf-8");
+    content = await fs26.readFile(excludePath, "utf-8");
   } catch (err) {
     if (!isNotFoundError(err))
       throw err;
   }
   const lines = content.split("\n");
   if (lines.some((line) => line.trim() === pattern)) {
-    log9.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    log11.debug("git", "Pattern already in .git/info/exclude", { pattern });
     return;
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-  await fs25.writeFile(excludePath, newContent, "utf-8");
-  log9.debug("git", "Added pattern to .git/info/exclude", { pattern });
+  await fs26.writeFile(excludePath, newContent, "utf-8");
+  log11.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
-var log9;
+var log11;
 var init_git_manager = __esm({
   "dist/git-manager.js"() {
     "use strict";
@@ -10776,7 +11343,7 @@ var init_git_manager = __esm({
     init_error();
     init_git();
     init_provisioning_lock();
-    log9 = createDebugLogger3({ prefix: "GitManager" });
+    log11 = createDebugLogger3({ prefix: "GitManager" });
   }
 });
 
@@ -10916,7 +11483,7 @@ var init_config5 = __esm({
 });
 
 // dist/operating-mode/client-unsafe-strategy.js
-import path28 from "node:path";
+import path30 from "node:path";
 function operatingStrategy3(mode) {
   const cached = strategyCache3.get(mode);
   if (cached)
@@ -10946,32 +11513,32 @@ var init_client_unsafe_strategy2 = __esm({
     init_config5();
     ProdStrategy3 = class extends ProdClientSafeStrategy3 {
       getWorkspaceRoot(_sourceRoot) {
-        return path28.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE3);
+        return path30.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE3);
       }
       getContentRoot(contentRoot, sourceRoot) {
-        return path28.resolve(sourceRoot ?? process.cwd(), contentRoot);
+        return path30.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
-        return path28.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path30.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path28.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path30.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path28.join(root, this.getPermissionsFileName());
+        return path30.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path28.join(root, this.getGroupsFileName());
+        return path30.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
           shouldAutoInitLocal: false,
           defaultRemotePath: "",
           envVarName: "CANOPYCMS_REMOTE_URL",
-          autoDetectRemotePath: path28.join(this.getWorkspaceRoot(), "remote.git")
+          autoDetectRemotePath: path30.join(this.getWorkspaceRoot(), "remote.git")
         };
       }
       requiresExistingRepo() {
@@ -10983,7 +11550,7 @@ var init_client_unsafe_strategy2 = __esm({
         return `canopycms-settings-${resolveDeploymentName3(config, "prod")}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path28.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path30.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -10993,31 +11560,28 @@ var init_client_unsafe_strategy2 = __esm({
           throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
         }
       }
-      shouldCreateSettingsPR(config) {
-        return config.autoCreateSettingsPR ?? true;
-      }
     };
     DevStrategy3 = class extends DevClientSafeStrategy3 {
       getWorkspaceRoot(sourceRoot) {
-        return path28.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
+        return path30.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
       getContentRoot(contentRoot, sourceRoot) {
-        return path28.resolve(sourceRoot ?? process.cwd(), contentRoot);
+        return path30.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
-        return path28.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path30.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path28.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path30.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path28.join(root, this.getPermissionsFileName());
+        return path30.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path28.join(root, this.getGroupsFileName());
+        return path30.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
@@ -11035,16 +11599,13 @@ var init_client_unsafe_strategy2 = __esm({
         return `canopycms-settings-${resolveDeploymentName3(config, "local")}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path28.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path30.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
       }
       validateConfig(_config) {
       }
-      shouldCreateSettingsPR(_config) {
-        return false;
-      }
     };
     strategyCache3 = /* @__PURE__ */ new Map();
   }
@@ -11066,10 +11627,32 @@ var sync_exports = {};
 __export(sync_exports, {
   sync: () => sync
 });
-import fs26 from "node:fs/promises";
-import path29 from "node:path";
+import fs27 from "node:fs/promises";
+import path31 from "node:path";
 import { simpleGit as simpleGit7 } from "simple-git";
 import * as p2 from "@clack/prompts";
+function lockBusyAsSyncError(err, branchName) {
+  if (!(err instanceof ContentWriteLockBusyError2))
+    return err;
+  return new SyncError(err.outcome === "not-run" ? `Branch workspace "${branchName}" is busy (the worker is syncing it, or an editor save is in flight); nothing was changed. Try again in a moment.` : `Branch workspace "${branchName}" was being synced during this run, so it may be partly updated. Check its state before running sync again.`);
+}
+async function withWorkspaceLock(branchPath, branchName, fn) {
+  try {
+    return await withContentWriteLock2(branchPath, fn);
+  } catch (err) {
+    throw lockBusyAsSyncError(err, branchName);
+  }
+}
+async function abortWorkspaceMerge(branchPath, branchName) {
+  return withWorkspaceLock(branchPath, branchName, async () => {
+    const wsGit = simpleGit7({ baseDir: branchPath });
+    if ((await wsGit.status()).conflicted.length === 0)
+      return false;
+    await wsGit.merge(["--abort"]);
+    await invalidateBranchContentCaches2(branchPath);
+    return true;
+  });
+}
 async function detectCurrentBranch(projectDir) {
   const git = simpleGit7({ baseDir: projectDir });
   const branch = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
@@ -11080,7 +11663,7 @@ async function detectCurrentBranch(projectDir) {
 async function selectBranch(options, branchesDir) {
   let branches = [];
   if (await filePathExists(branchesDir)) {
-    const entries = await fs26.readdir(branchesDir, { withFileTypes: true });
+    const entries = await fs27.readdir(branchesDir, { withFileTypes: true });
     branches = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
   }
   let branchName = options.branch;
@@ -11108,11 +11691,11 @@ async function selectBranch(options, branchesDir) {
       branchName = result;
     }
   }
-  const branchPath = path29.join(branchesDir, branchName);
+  const branchPath = path31.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
   if (!branches.includes(branchName)) {
     if (options.autoCreate) {
-      await fs26.mkdir(branchPath, { recursive: true });
+      await fs27.mkdir(branchPath, { recursive: true });
       const wsGit = simpleGit7({ baseDir: branchPath });
       await wsGit.init();
       await wsGit.checkoutLocalBranch(branchName);
@@ -11129,8 +11712,8 @@ async function selectBranch(options, branchesDir) {
 async function syncPush(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
-  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
-  const srcContentDir = path29.join(projectDir, contentRoot);
+  const branchesDir = path31.join(projectDir, ".canopy-dev", "content-branches");
+  const srcContentDir = path31.join(projectDir, contentRoot);
   assertWithinDir(srcContentDir, projectDir, "--content-root");
   if (!await filePathExists(srcContentDir)) {
     throw new SyncError(`Content directory not found: ${contentRoot}/ (expected at ${srcContentDir})`);
@@ -11138,7 +11721,7 @@ async function syncPush(options) {
   const branchName = await selectBranch({ ...options, projectDir, autoCreate: true }, branchesDir);
   if (!branchName)
     return { fileCount: 0 };
-  const branchPath = path29.join(branchesDir, branchName);
+  const branchPath = path31.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
   const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
@@ -11150,20 +11733,21 @@ async function syncPush(options) {
         initialValue: false
       });
       if (!p2.isCancel(shouldAbort) && shouldAbort) {
-        await wsGit.merge(["--abort"]);
-        await invalidateBranchContentCaches2(branchPath);
-        p2.log.success("Merge aborted. Workspace restored to pre-merge state.");
+        if (await abortWorkspaceMerge(branchPath, branchName)) {
+          p2.log.success("Merge aborted. Workspace restored to pre-merge state.");
+        }
       }
     }
     return { fileCount: 0 };
   }
-  if (status.files.length > 0 && !options.force) {
-    p2.log.warn(`Branch workspace has ${status.files.length} uncommitted change(s) that will be committed to history then overwritten:`);
-    for (const file of status.files.slice(0, 10)) {
+  const editorChanges = status.files.filter((f) => !isCanopyInternalPath(f.path));
+  if (editorChanges.length > 0 && !options.force) {
+    p2.log.warn(`Branch workspace has ${editorChanges.length} uncommitted change(s) that will be committed to history then overwritten:`);
+    for (const file of editorChanges.slice(0, 10)) {
       p2.log.warn(`  ${file.path}`);
     }
-    if (status.files.length > 10) {
-      p2.log.warn(`  ... and ${status.files.length - 10} more`);
+    if (editorChanges.length > 10) {
+      p2.log.warn(`  ... and ${editorChanges.length - 10} more`);
     }
     const confirm5 = await p2.confirm({
       message: "Continue? Editor changes will be preserved in git history.",
@@ -11174,18 +11758,22 @@ async function syncPush(options) {
       return { fileCount: 0 };
     }
   }
-  if (status.files.length > 0) {
-    await wsGit.add("-A");
-    await wsGit.commit("sync: save editor state before push");
-    p2.log.info("Committed editor changes to history before push");
-  }
   p2.log.step(`Pushing content to branch workspace: ${branchName}`);
-  const { fileCount } = await pushContentToWorkspace({
-    srcContentDir,
-    branchPath,
-    contentRoot,
-    baseTag: SYNC_BASE_TAG
-  });
+  let fileCount;
+  try {
+    const result = await pushContentToWorkspace({
+      srcContentDir,
+      branchPath,
+      contentRoot,
+      baseTag: SYNC_BASE_TAG,
+      saveEditorStateMessage: "sync: save editor state before push"
+    });
+    fileCount = result.fileCount;
+    if (result.savedEditorState)
+      p2.log.info("Committed editor changes to history before push");
+  } catch (err) {
+    throw lockBusyAsSyncError(err, branchName);
+  }
   if (fileCount === 0) {
     p2.log.info("Content is already up to date \u2014 nothing to push");
   } else {
@@ -11196,19 +11784,19 @@ async function syncPush(options) {
 async function syncPull(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
-  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
+  const branchesDir = path31.join(projectDir, ".canopy-dev", "content-branches");
   const branchName = await selectBranch({ ...options, projectDir }, branchesDir);
   if (!branchName)
     return { fileCount: 0 };
-  const branchPath = path29.join(branchesDir, branchName);
+  const branchPath = path31.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
-  const branchContentDir = path29.join(branchPath, contentRoot);
+  const branchContentDir = path31.join(branchPath, contentRoot);
   assertWithinDir(branchContentDir, branchPath, "--content-root");
   if (!await filePathExists(branchContentDir)) {
     throw new SyncError(`Content directory not found in branch workspace: ${branchName}/${contentRoot}`);
   }
   p2.log.step(`Pulling content from branch: ${branchName}`);
-  const destContentDir = path29.join(projectDir, contentRoot);
+  const destContentDir = path31.join(projectDir, contentRoot);
   assertWithinDir(destContentDir, projectDir, "--content-root");
   const sourceGit = simpleGit7({ baseDir: projectDir });
   const status = await sourceGit.status();
@@ -11260,7 +11848,7 @@ async function syncPull(options) {
     await copyDir(branchContentDir, tmpDestDir);
     await safeReplaceDir(destContentDir, tmpDestDir);
   } catch (err) {
-    await fs26.rm(tmpDestDir, { recursive: true, force: true }).catch(() => {
+    await fs27.rm(tmpDestDir, { recursive: true, force: true }).catch(() => {
     });
     throw err;
   }
@@ -11284,8 +11872,8 @@ async function syncPull(options) {
 async function syncBoth(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
-  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
-  const srcContentDir = path29.join(projectDir, contentRoot);
+  const branchesDir = path31.join(projectDir, ".canopy-dev", "content-branches");
+  const srcContentDir = path31.join(projectDir, contentRoot);
   assertWithinDir(srcContentDir, projectDir, "--content-root");
   if (!await filePathExists(srcContentDir)) {
     throw new SyncError(`Content directory not found: ${contentRoot}/ (expected at ${srcContentDir})`);
@@ -11293,7 +11881,7 @@ async function syncBoth(options) {
   const branchName = await selectBranch({ ...options, projectDir, autoCreate: true }, branchesDir);
   if (!branchName)
     return { pushed: 0, pulled: 0 };
-  const branchPath = path29.join(branchesDir, branchName);
+  const branchPath = path31.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
   const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
@@ -11305,15 +11893,21 @@ async function syncBoth(options) {
         initialValue: false
       });
       if (!p2.isCancel(shouldAbort) && shouldAbort) {
-        await wsGit.merge(["--abort"]);
-        await invalidateBranchContentCaches2(branchPath);
-        p2.log.success("Merge aborted. Workspace restored to pre-merge state.");
+        if (await abortWorkspaceMerge(branchPath, branchName)) {
+          p2.log.success("Merge aborted. Workspace restored to pre-merge state.");
+        }
       }
     }
     return { pushed: 0, pulled: 0 };
   }
-  if (status.files.length > 0) {
-    await wsGit.add("-A");
+  return withWorkspaceLock(branchPath, branchName, () => mergeIntoWorkspace(options, { branchName, branchPath, srcContentDir, contentRoot }));
+}
+async function mergeIntoWorkspace(options, ws) {
+  const { branchName, branchPath, srcContentDir, contentRoot } = ws;
+  const wsGit = simpleGit7({ baseDir: branchPath });
+  const status = await wsGit.status();
+  if (status.files.some((f) => !isCanopyInternalPath(f.path))) {
+    await stageAllExceptCanopyState2(wsGit);
     await wsGit.commit("sync: save editor state before merge");
     p2.log.info("Committed editor changes before merge");
   }
@@ -11328,23 +11922,23 @@ async function syncBoth(options) {
   try {
     const incomingBranch = `sync-incoming-${Date.now()}`;
     await wsGit.raw(["checkout", "-b", incomingBranch, baseRef]);
-    const wsContentDir = path29.join(branchPath, contentRoot);
+    const wsContentDir = path31.join(branchPath, contentRoot);
     assertWithinDir(wsContentDir, branchPath, "--content-root");
     const tmpDir = `${wsContentDir}.sync-tmp-${Date.now()}`;
     try {
       await copyDir(srcContentDir, tmpDir);
       await safeReplaceDir(wsContentDir, tmpDir);
     } catch (err) {
-      await fs26.rm(tmpDir, { recursive: true, force: true }).catch(() => {
+      await fs27.rm(tmpDir, { recursive: true, force: true }).catch(() => {
       });
       await wsGit.checkout(currentBranch);
       await wsGit.raw(["branch", "-D", incomingBranch]).catch(() => {
       });
       throw err;
     }
-    await wsGit.add("-A");
-    const incomingStatus = await wsGit.status();
-    if (incomingStatus.files.length === 0) {
+    await stageAllExceptCanopyState2(wsGit);
+    const incomingFiles = (await wsGit.status()).files.filter((f) => !isCanopyInternalPath(f.path));
+    if (incomingFiles.length === 0) {
       await wsGit.checkout(currentBranch);
       await wsGit.raw(["branch", "-D", incomingBranch]);
       p2.log.info("No working-tree changes to merge \u2014 pulling editor changes only");
@@ -11385,27 +11979,23 @@ async function syncBoth(options) {
     await wsGit.tag(["-f", SYNC_BASE_TAG]);
     p2.log.success("Merged working-tree changes with editor changes");
     const pullResult = await syncPull({ ...options, branch: branchName, force: true });
-    return { pushed: incomingStatus.files.length, pulled: pullResult.fileCount };
+    return { pushed: incomingFiles.length, pulled: pullResult.fileCount };
   } finally {
     await invalidateBranchContentCaches2(branchPath);
   }
 }
 async function syncAbort(options) {
   const { projectDir } = options;
-  const branchesDir = path29.join(projectDir, ".canopy-dev", "content-branches");
+  const branchesDir = path31.join(projectDir, ".canopy-dev", "content-branches");
   const branchName = await selectBranch({ ...options, projectDir }, branchesDir);
   if (!branchName)
     return;
-  const branchPath = path29.join(branchesDir, branchName);
+  const branchPath = path31.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
-  const wsGit = simpleGit7({ baseDir: branchPath });
-  const status = await wsGit.status();
-  if (status.conflicted.length === 0) {
+  if (!await abortWorkspaceMerge(branchPath, branchName)) {
     p2.log.info(`Branch workspace "${branchName}" is not in a merge state \u2014 nothing to abort.`);
     return;
   }
-  await wsGit.merge(["--abort"]);
-  await invalidateBranchContentCaches2(branchPath);
   p2.log.success(`Merge aborted in branch workspace "${branchName}". Workspace restored to pre-merge state.`);
 }
 async function sync(options) {
@@ -11433,8 +12023,10 @@ var init_sync = __esm({
   "dist/cli/sync.js"() {
     "use strict";
     init_fs();
+    init_git();
     init_sync_core();
     init_content_index_generation();
+    init_content_write_lock();
     init_git_manager();
     init_operating_mode2();
     SyncError = class extends Error {
@@ -11472,6 +12064,7 @@ var init_branch = __esm({
   "dist/paths/branch.js"() {
     "use strict";
     init_operating_mode2();
+    init_error();
     init_branch_name();
   }
 });
@@ -11498,34 +12091,9 @@ var init_schema = __esm({
   }
 });
 
-// dist/utils/async-mutex.js
-async function withLock2(key, fn) {
-  const prev = locks2.get(key) ?? Promise.resolve();
-  let resolve2;
-  const next = new Promise((r) => {
-    resolve2 = r;
-  });
-  locks2.set(key, next);
-  await prev;
-  try {
-    return await fn();
-  } finally {
-    resolve2();
-    if (locks2.get(key) === next)
-      locks2.delete(key);
-  }
-}
-var locks2;
-var init_async_mutex = __esm({
-  "dist/utils/async-mutex.js"() {
-    "use strict";
-    locks2 = /* @__PURE__ */ new Map();
-  }
-});
-
 // dist/utils/occ-json-write.js
-import fs27 from "node:fs/promises";
-import path30 from "node:path";
+import fs28 from "node:fs/promises";
+import path33 from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import lockfile4 from "proper-lockfile";
 async function writeOccJsonFile2(filePath, payload, options) {
@@ -11534,29 +12102,29 @@ async function writeOccJsonFile2(filePath, payload, options) {
   const writeId = randomUUID4();
   const data = { ...payload, version: newVersion, writeId };
   const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
-  const dir = path30.dirname(filePath);
-  await fs27.mkdir(dir, { recursive: true });
+  const dir = path33.dirname(filePath);
+  await fs28.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs27.writeFile(tempPath, content, "utf-8");
+  await fs28.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs27.link(tempPath, filePath);
+      await fs28.link(tempPath, filePath);
     } catch (err) {
-      await fs27.unlink(tempPath).catch(() => {
+      await fs28.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError(err)) {
         throw new OccWriteConflictError2();
       }
       throw err;
     }
-    await fs27.unlink(tempPath).catch(() => {
+    await fs28.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs27.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs28.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -11564,16 +12132,16 @@ async function writeOccJsonFile2(filePath, payload, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError2();
     }
-    await fs27.rename(tempPath, filePath);
+    await fs28.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs27.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs28.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError2();
     }
   } catch (err) {
-    await fs27.unlink(tempPath).catch(() => {
+    await fs28.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -11599,8 +12167,8 @@ async function withOccRetry2(operation, options) {
   throw new Error("Unreachable");
 }
 async function withOccFileLock2(filePath, fn) {
-  const dir = path30.dirname(filePath);
-  await fs27.mkdir(dir, { recursive: true });
+  const dir = path33.dirname(filePath);
+  await fs28.mkdir(dir, { recursive: true });
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -11616,7 +12184,7 @@ async function withOccFileLock2(filePath, fn) {
         // Our critical sections are short and idempotent-on-conflict (OCC
         // verify inside); log and let the section finish.
         onCompromised: (err) => {
-          log11.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+          log13.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
             error: getErrorMessage(err)
           });
         }
@@ -11638,17 +12206,17 @@ async function withOccFileLock2(filePath, fn) {
     await release().catch((err) => {
       if (isNodeError(err) && err.code === "ENOENT")
         return;
-      log11.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
+      log13.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
     });
   }
 }
-var log11, OccWriteConflictError2;
+var log13, OccWriteConflictError2;
 var init_occ_json_write = __esm({
   "dist/utils/occ-json-write.js"() {
     "use strict";
     init_error();
     init_debug2();
-    log11 = createDebugLogger3({ prefix: "OccJsonWrite" });
+    log13 = createDebugLogger3({ prefix: "OccJsonWrite" });
     OccWriteConflictError2 = class extends Error {
       constructor(message = "Concurrent modification detected") {
         super(message);
@@ -11658,13 +12226,124 @@ var init_occ_json_write = __esm({
   }
 });
 
+// dist/utils/async-mutex.js
+async function withLock2(key, fn) {
+  const prev = locks2.get(key) ?? Promise.resolve();
+  let resolve2;
+  const next = new Promise((r) => {
+    resolve2 = r;
+  });
+  locks2.set(key, next);
+  await prev;
+  try {
+    return await fn();
+  } finally {
+    resolve2();
+    if (locks2.get(key) === next)
+      locks2.delete(key);
+  }
+}
+var locks2;
+var init_async_mutex = __esm({
+  "dist/utils/async-mutex.js"() {
+    "use strict";
+    locks2 = /* @__PURE__ */ new Map();
+  }
+});
+
+// dist/utils/entry-url.js
+var init_entry_url = __esm({
+  "dist/utils/entry-url.js"() {
+    "use strict";
+    init_normalize3();
+  }
+});
+
+// dist/utils/typed-filename.js
+var init_typed_filename = __esm({
+  "dist/utils/typed-filename.js"() {
+    "use strict";
+    init_id();
+  }
+});
+
+// dist/url-collision.js
+var init_url_collision = __esm({
+  "dist/url-collision.js"() {
+    "use strict";
+    init_content_id_index();
+    init_entry_url();
+    init_error();
+    init_typed_filename();
+  }
+});
+
+// dist/schema/schema-store.js
+import path34 from "node:path";
+import { z as z16 } from "zod";
+async function withBranchSchemaLock(branchRoot, fn, contentWriteLockWaitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS2) {
+  const schemaLockPath = path34.join(path34.resolve(branchRoot), ".canopy-meta", "schema");
+  return withContentWriteLock2(branchRoot, () => withLock2(schemaLockPath, () => withOccFileLock2(schemaLockPath, fn)), contentWriteLockWaitMs);
+}
+var MAX_NAME_LENGTH, MAX_LABEL_LENGTH, SAFE_NAME_PATTERN, SAFE_NAME_MESSAGE, entryTypeInputSchema, createCollectionInputSchema, updateCollectionInputSchema, updateEntryTypeInputSchema, log14;
+var init_schema_store = __esm({
+  "dist/schema/schema-store.js"() {
+    "use strict";
+    init_atomic_write2();
+    init_async_mutex();
+    init_debug2();
+    init_content_write_lock();
+    init_error();
+    init_occ_json_write();
+    init_content_id_index();
+    init_url_collision();
+    init_entry_url();
+    init_content_index_generation();
+    init_id();
+    init_paths();
+    MAX_NAME_LENGTH = 64;
+    MAX_LABEL_LENGTH = 128;
+    SAFE_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+    SAFE_NAME_MESSAGE = "must start with a letter and contain only lowercase letters, numbers, and hyphens";
+    entryTypeInputSchema = z16.object({
+      name: z16.string().min(1).max(MAX_NAME_LENGTH).regex(SAFE_NAME_PATTERN, `Entry type name ${SAFE_NAME_MESSAGE}`),
+      label: z16.string().max(MAX_LABEL_LENGTH).optional(),
+      format: z16.enum(["md", "mdx", "json", "yaml"]),
+      schema: z16.string().min(1),
+      default: z16.boolean().optional(),
+      maxItems: z16.number().int().positive().optional()
+    });
+    createCollectionInputSchema = z16.object({
+      name: z16.string().min(1).max(MAX_NAME_LENGTH).regex(SAFE_NAME_PATTERN, `Collection name ${SAFE_NAME_MESSAGE}`),
+      label: z16.string().max(MAX_LABEL_LENGTH).optional(),
+      parentPath: z16.string().optional(),
+      entries: z16.array(entryTypeInputSchema).min(1, "Collection must have at least one entry type")
+    });
+    updateCollectionInputSchema = z16.object({
+      name: z16.string().min(1).max(MAX_NAME_LENGTH).regex(SAFE_NAME_PATTERN, `Collection name ${SAFE_NAME_MESSAGE}`).optional(),
+      label: z16.string().max(MAX_LABEL_LENGTH).optional(),
+      // Directory name (e.g., "posts" in "posts.{id}/")
+      slug: z16.string().min(1).max(MAX_NAME_LENGTH).regex(SAFE_NAME_PATTERN, `Slug ${SAFE_NAME_MESSAGE}`).optional(),
+      order: z16.array(z16.string()).optional()
+    });
+    updateEntryTypeInputSchema = z16.object({
+      label: z16.string().max(MAX_LABEL_LENGTH).optional(),
+      format: z16.enum(["md", "mdx", "json", "yaml"]).optional(),
+      schema: z16.string().min(1).optional(),
+      default: z16.boolean().optional(),
+      maxItems: z16.number().int().positive().optional()
+    });
+    log14 = createDebugLogger3({ prefix: "SchemaOps" });
+  }
+});
+
 // dist/branch-metadata-file.js
-import fs28 from "node:fs/promises";
-import path31 from "node:path";
+import fs29 from "node:fs/promises";
+import path35 from "node:path";
 async function readBranchMetadataFile2(branchRoot) {
-  const resolvedRoot = path31.resolve(branchRoot);
+  const resolvedRoot = path35.resolve(branchRoot);
   try {
-    const raw = await fs28.readFile(branchMetadataFilePath2(resolvedRoot), "utf8");
+    const raw = await fs29.readFile(branchMetadataFilePath2(resolvedRoot), "utf8");
     return JSON.parse(raw);
   } catch (err) {
     if (isNotFoundError(err)) {
@@ -11691,14 +12370,14 @@ var init_branch_metadata_file = __esm({
         this.parseCause = cause;
       }
     };
-    branchMetadataFilePath2 = (branchRoot) => path31.join(path31.resolve(branchRoot), BRANCH_META_DIR2, BRANCH_META_FILE2);
+    branchMetadataFilePath2 = (branchRoot) => path35.join(path35.resolve(branchRoot), BRANCH_META_DIR2, BRANCH_META_FILE2);
   }
 });
 
 // dist/branch-registry.js
-import fs29 from "node:fs/promises";
-import path33 from "node:path";
-var log12, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
+import fs30 from "node:fs/promises";
+import path36 from "node:path";
+var log15, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
 var init_branch_registry = __esm({
   "dist/branch-registry.js"() {
     "use strict";
@@ -11707,7 +12386,7 @@ var init_branch_registry = __esm({
     init_debug2();
     init_logger3();
     init_resource_generation();
-    log12 = createDebugLogger3({ prefix: "BranchRegistry" });
+    log15 = createDebugLogger3({ prefix: "BranchRegistry" });
     REGISTRY_FILE2 = "branches.json";
     REGISTRY_STALE_FILE2 = "branches.stale.json";
     REGISTRY_TEMP_FILE2 = "branches.tmp.json";
@@ -11718,10 +12397,10 @@ var init_branch_registry = __esm({
       constructor(root) {
         this.regenInFlight = null;
         this.lastForcedRefreshMs = 0;
-        this.root = path33.resolve(root);
-        this.registryPath = path33.join(this.root, REGISTRY_FILE2);
-        this.stalePath = path33.join(this.root, REGISTRY_STALE_FILE2);
-        this.tempPath = path33.join(this.root, REGISTRY_TEMP_FILE2);
+        this.root = path36.resolve(root);
+        this.registryPath = path36.join(this.root, REGISTRY_FILE2);
+        this.stalePath = path36.join(this.root, REGISTRY_STALE_FILE2);
+        this.tempPath = path36.join(this.root, REGISTRY_TEMP_FILE2);
       }
       /**
        * Returns all branches. Uses the cached snapshot if its embedded generation
@@ -11730,7 +12409,7 @@ var init_branch_registry = __esm({
       async list() {
         let parsed;
         try {
-          const raw = await fs29.readFile(this.registryPath, "utf8");
+          const raw = await fs30.readFile(this.registryPath, "utf8");
           parsed = JSON.parse(raw);
         } catch (err) {
           if (isNotFoundError(err)) {
@@ -11787,7 +12466,7 @@ var init_branch_registry = __esm({
             });
           await this.regenerate();
         } catch (err) {
-          log12.warn("invalidate", "Eager regeneration after invalidate() failed", {
+          log15.warn("invalidate", "Eager regeneration after invalidate() failed", {
             error: getErrorMessage(err)
           });
         }
@@ -11812,7 +12491,7 @@ var init_branch_registry = __esm({
       async performRegenerate() {
         const read = await readResourceGeneration2(this.root, RESOURCE4);
         const branches = await this.scanBranchDirectories();
-        await fs29.unlink(this.stalePath).catch(() => {
+        await fs30.unlink(this.stalePath).catch(() => {
         });
         if (!read.ok) {
           return branches;
@@ -11823,12 +12502,12 @@ var init_branch_registry = __esm({
           generation: read.token
         };
         const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-        await fs29.mkdir(this.root, { recursive: true });
-        await fs29.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+        await fs30.mkdir(this.root, { recursive: true });
+        await fs30.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
         try {
-          await fs29.rename(uniqueTempPath, this.registryPath);
+          await fs30.rename(uniqueTempPath, this.registryPath);
         } catch (err) {
-          await fs29.unlink(uniqueTempPath).catch(() => {
+          await fs30.unlink(uniqueTempPath).catch(() => {
           });
           throw err;
         }
@@ -11842,12 +12521,12 @@ var init_branch_registry = __esm({
       async scanBranchDirectories() {
         const branches = [];
         try {
-          const entries = await fs29.readdir(this.root, { withFileTypes: true });
+          const entries = await fs30.readdir(this.root, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory() || entry.name.startsWith(".")) {
               continue;
             }
-            const branchRoot = path33.join(this.root, entry.name);
+            const branchRoot = path36.join(this.root, entry.name);
             let meta;
             try {
               meta = await readBranchMetadataFile2(branchRoot);
@@ -11876,8 +12555,8 @@ var init_branch_registry = __esm({
 });
 
 // dist/branch-metadata.js
-import fs30 from "node:fs/promises";
-import path34 from "node:path";
+import fs31 from "node:fs/promises";
+import path37 from "node:path";
 var CURRENT_SCHEMA_VERSION2, BranchMetadataConflictError2, BranchMetadataFileManager2;
 var init_branch_metadata = __esm({
   "dist/branch-metadata.js"() {
@@ -11897,8 +12576,8 @@ var init_branch_metadata = __esm({
     };
     BranchMetadataFileManager2 = class _BranchMetadataFileManager2 {
       constructor(branchRoot, baseRoot, options) {
-        this.branchRoot = path34.resolve(branchRoot);
-        this.filePath = path34.join(this.branchRoot, BRANCH_META_DIR2, BRANCH_META_FILE2);
+        this.branchRoot = path37.resolve(branchRoot);
+        this.filePath = path37.join(this.branchRoot, BRANCH_META_DIR2, BRANCH_META_FILE2);
         this.baseRoot = baseRoot;
         this.settleMs = options?.settleMs;
       }
@@ -11915,7 +12594,7 @@ var init_branch_metadata = __esm({
       }
       async load() {
         try {
-          const raw = await fs30.readFile(this.filePath, "utf8");
+          const raw = await fs31.readFile(this.filePath, "utf8");
           const parsed = JSON.parse(raw);
           const version = parsed.version ?? 0;
           return { meta: parsed, version };
@@ -11969,7 +12648,7 @@ var init_branch_metadata = __esm({
        */
       async save(incoming) {
         try {
-          await fs30.stat(this.branchRoot);
+          await fs31.stat(this.branchRoot);
         } catch (err) {
           if (isNotFoundError(err)) {
             throw new BranchMetadataConflictError2("Branch no longer exists");
@@ -12041,8 +12720,8 @@ __export(migrate_exports, {
   migrate: () => migrate,
   slugifyName: () => slugifyName
 });
-import fs31 from "node:fs/promises";
-import path35 from "node:path";
+import fs33 from "node:fs/promises";
+import path38 from "node:path";
 import * as p3 from "@clack/prompts";
 function slugifyName(name) {
   const slug = name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-+|-+$/g, "");
@@ -12067,7 +12746,7 @@ function stripDirIdSuffix(dirName) {
   return dirName;
 }
 async function planDirectory(dirPath, isRoot, ctx) {
-  const entries = await fs31.readdir(dirPath, { withFileTypes: true });
+  const entries = await fs33.readdir(dirPath, { withFileTypes: true });
   entries.sort((a, b) => a.name.localeCompare(b.name));
   const ops = [];
   let hasOwnFiles = false;
@@ -12076,7 +12755,7 @@ async function planDirectory(dirPath, isRoot, ctx) {
     if (entry.name.startsWith("."))
       continue;
     if (entry.isDirectory()) {
-      const subPath = path35.join(dirPath, entry.name);
+      const subPath = path38.join(dirPath, entry.name);
       const sub = await planDirectory(subPath, false, ctx);
       if (!sub.hasContent)
         continue;
@@ -12084,10 +12763,10 @@ async function planDirectory(dirPath, isRoot, ctx) {
       ops.push(...sub.ops);
       if (!extractIdFromFilename2(entry.name)) {
         const newName = `${toValidSlug(entry.name)}.${generateId2()}`;
-        ops.push({ kind: "rename", from: subPath, to: path35.join(dirPath, newName) });
+        ops.push({ kind: "rename", from: subPath, to: path38.join(dirPath, newName) });
       }
     } else if (entry.isFile()) {
-      const ext = path35.extname(entry.name).slice(1);
+      const ext = path38.extname(entry.name).slice(1);
       const matchesFormat = ext === ctx.format || ctx.format === "yaml" && ext === "yml";
       if (!matchesFormat)
         continue;
@@ -12098,17 +12777,17 @@ async function planDirectory(dirPath, isRoot, ctx) {
         const newName = `${ctx.entryType}.${toValidSlug(base)}.${generateId2()}.${ext}`;
         ops.push({
           kind: "rename",
-          from: path35.join(dirPath, entry.name),
-          to: path35.join(dirPath, newName)
+          from: path38.join(dirPath, entry.name),
+          to: path38.join(dirPath, newName)
         });
       }
     }
   }
   const needsMeta = isRoot ? hasOwnFiles : hasContent;
-  const metaPath = path35.join(dirPath, ".collection.json");
+  const metaPath = path38.join(dirPath, ".collection.json");
   if (needsMeta && !await filePathExists(metaPath)) {
     const entryTypeMeta = { name: ctx.entryType, format: ctx.format, schema: ctx.schema };
-    const meta = isRoot ? { entries: [entryTypeMeta] } : { name: toValidSlug(stripDirIdSuffix(path35.basename(dirPath))), entries: [entryTypeMeta] };
+    const meta = isRoot ? { entries: [entryTypeMeta] } : { name: toValidSlug(stripDirIdSuffix(path38.basename(dirPath))), entries: [entryTypeMeta] };
     ops.push({ kind: "write", filePath: metaPath, content: JSON.stringify(meta, null, 2) + "\n" });
   }
   return { ops, hasContent };
@@ -12117,7 +12796,7 @@ async function migrate(options) {
   const { projectDir } = options;
   const contentRoot = options.contentRoot || "content";
   p3.intro("CanopyCMS migrate");
-  const contentDir = path35.join(projectDir, contentRoot);
+  const contentDir = path38.join(projectDir, contentRoot);
   if (!await filePathExists(contentDir)) {
     throw new MigrateError(`Content directory not found: ${contentRoot}/ (expected at ${contentDir})`);
   }
@@ -12194,20 +12873,22 @@ async function migrate(options) {
   const applyOps = async () => {
     for (const op of ops) {
       if (op.kind === "rename") {
-        await fs31.rename(op.from, op.to);
+        await fs33.rename(op.from, op.to);
       } else {
-        await fs31.writeFile(op.filePath, op.content, "utf-8");
+        await fs33.writeFile(op.filePath, op.content, "utf-8");
       }
     }
   };
   if (isBranchClone) {
-    const lockPath = path35.join(projectDir, ".canopy-meta", "schema");
     try {
-      await withLock2(lockPath, () => withOccFileLock2(lockPath, applyOps));
+      await withBranchSchemaLock(projectDir, applyOps);
     } catch (err) {
       if (err instanceof OccWriteConflictError2) {
         throw new MigrateError("Another process is modifying the schema, try again.");
       }
+      if (err instanceof ContentWriteLockBusyError2) {
+        throw new MigrateError(err.outcome === "unknown" ? "The branch was being synced while migrate ran, so it may be partly applied. Check its state before running migrate again." : err.message);
+      }
       throw err;
     }
   } else {
@@ -12238,8 +12919,9 @@ var init_migrate = __esm({
     init_fs();
     init_schema();
     init_error();
-    init_async_mutex();
+    init_content_write_lock();
     init_occ_json_write();
+    init_schema_store();
     init_branch_metadata();
     init_content_index_generation();
     MIGRATE_FORMATS = ["md", "mdx", "json", "yaml"];
@@ -12249,7 +12931,7 @@ var init_migrate = __esm({
         this.name = "MigrateError";
       }
     };
-    describeOp = (op, baseDir) => op.kind === "rename" ? `rename  ${path35.relative(baseDir, op.from)} \u2192 ${path35.basename(op.to)}` : `create  ${path35.relative(baseDir, op.filePath)}`;
+    describeOp = (op, baseDir) => op.kind === "rename" ? `rename  ${path38.relative(baseDir, op.from)} \u2192 ${path38.basename(op.to)}` : `create  ${path38.relative(baseDir, op.filePath)}`;
   }
 });