@contentrain/mcp 3.9.33 → 3.10.1

package/dist/server.mjs

@@ -1,27 +1,27 @@
 import "./contracts-DfL0BfrD.mjs";
-import "./reconcile-C7AaUfCl.mjs";
-import "./context-Cp8b8Nxm.mjs";
-import "./model-manager-BYF2z7qC.mjs";
-import "./ops-CQ_IIedh.mjs";
+import "./reconcile-J-iorvSa.mjs";
+import "./context-D9HXnnGj.mjs";
+import "./model-manager-D0VztE8M.mjs";
+import "./ops-CVI308jA.mjs";
 import "./fs-BFTuXbbw.mjs";
 import "./meta-manager-CSpKtjnP.mjs";
-import "./config-BLwZtwlI.mjs";
-import "./validator-Bz3jnSnb.mjs";
+import "./config-BnNYu128.mjs";
+import "./validator-S19GHR4V.mjs";
 import "./identity-CxAB9Qb8.mjs";
 import "./base-branch-Cw9DWvCC.mjs";
-import "./branch-lifecycle-CcsSyfSw.mjs";
+import "./branch-lifecycle-D4DxPgQg.mjs";
 import "./id-jrHWdtqn.mjs";
-import "./transaction-CcjGiVYg.mjs";
-import "./local-BQVdC9MM.mjs";
+import "./transaction-DnrUATJF.mjs";
+import "./local-CBtRYFH4.mjs";
 import "./detect-B1QHYA0u.mjs";
 import "./annotations-BYkjoj2d.mjs";
-import { n as createServer, t as DEFAULT_INSTRUCTIONS } from "./server-CumICnp3.mjs";
+import { n as createServer, t as DEFAULT_INSTRUCTIONS } from "./server-DvWJelCh.mjs";
 import "./errors-De8Noahk.mjs";
-import "./reconcile-CRAukgae.mjs";
+import "./reconcile-DSflMfhj.mjs";
 import "./scan-config-S5fkzNhL.mjs";
 import "./graph-builder-BPhi-1KH.mjs";
 import "./scanner-0sc_pARB.mjs";
 import "./tsx-parser-DgFdpsea.mjs";
-import "./apply-manager-BenQNb_b.mjs";
-import "./doctor-Qabcb-Z1.mjs";
+import "./apply-manager-B-O3eAbz.mjs";
+import "./doctor-Br1NqEl2.mjs";
 export { DEFAULT_INSTRUCTIONS, createServer };

package/dist/{transaction-CcjGiVYg.mjs → transaction-DnrUATJF.mjs}

@@ -1,8 +1,8 @@
-import { r as writeContext } from "./context-Cp8b8Nxm.mjs";
-import { t as readConfig } from "./config-BLwZtwlI.mjs";
+import { r as writeContext } from "./context-D9HXnnGj.mjs";
+import { t as readConfig } from "./config-BnNYu128.mjs";
 import { n as authorConfig, r as createGit } from "./identity-CxAB9Qb8.mjs";
 import { t as resolveBaseBranch } from "./base-branch-Cw9DWvCC.mjs";
-import { l as networkGit, o as deleteRemoteBranch } from "./branch-lifecycle-CcsSyfSw.mjs";
+import { l as networkGit, o as deleteRemoteBranch, p as pushPolicy } from "./branch-lifecycle-D4DxPgQg.mjs";
 import { t as branchTimestamp } from "./id-jrHWdtqn.mjs";
 import { join } from "node:path";
 import { rm } from "node:fs/promises";
@@ -78,6 +78,7 @@ async function ensureContentBranch(projectRoot) {
 	const baseBranch = await resolveBaseBranch(git, config);
 	await migrateLegacyBranches(git, baseBranch);
 	await git.branch([CONTENTRAIN_BRANCH, baseBranch]);
+	if (!pushPolicy(config).push) return;
 	const remoteName = process.env["CONTENTRAIN_REMOTE"] ?? "origin";
 	try {
 		if ((await git.getRemotes()).some((r) => r.name === remoteName)) await git.push([
@@ -189,6 +190,7 @@ async function createTransaction(projectRoot, branchName, options) {
 	const git = createGit(projectRoot);
 	const config = await readConfig(projectRoot);
 	const workflow = options?.workflowOverride ?? config?.workflow ?? "auto-merge";
+	const push = pushPolicy(config).push;
 	const remoteName = process.env["CONTENTRAIN_REMOTE"] ?? "origin";
 	const [branchResult, remotes] = await Promise.all([git.raw(["branch", "--show-current"]).catch(() => ""), git.getRemotes().catch(() => [])]);
 	const currentBranch = branchResult.trim();
@@ -264,7 +266,7 @@ async function createTransaction(projectRoot, branchName, options) {
 			if (workflow === "review") {
 				pendingReview = true;
 				let warning;
-				if (hasRemote) try {
+				if (hasRemote && push) try {
 					await networkGit(projectRoot, NETWORK_TIMEOUT_MS).push(remoteName, branch);
 				} catch (error) {
 					warning = `Changes are committed locally on "${branch}", but pushing to "${remoteName}" failed: ${(error instanceof Error ? error.message : String(error)).trim()}. The branch is intact — run contentrain_submit once you have push access, or merge it locally with contentrain_merge.`;
@@ -272,7 +274,8 @@ async function createTransaction(projectRoot, branchName, options) {
 				return {
 					action: "pending-review",
 					commit: commitHash,
-					warning
+					warning,
+					...push ? {} : { remote_push: "disabled" }
 				};
 			}
 			await wtGit.checkout(CONTENTRAIN_BRANCH);
@@ -318,8 +321,8 @@ async function createTransaction(projectRoot, branchName, options) {
 				baseAdvance = "blocked_diverged";
 				divergedWarning = `Content is committed and merged into "${CONTENTRAIN_BRANCH}", but "${baseBranch}" has commits that are not in "${CONTENTRAIN_BRANCH}" — the branches have diverged, so "${baseBranch}" was not advanced. Run contentrain_reconcile (CLI: npx contentrain reconcile) to merge them and restore the fast-forward advance.`;
 			}
-			let remotePush = "no-remote";
-			if (hasRemote) remotePush = await pushContentBranches(projectRoot, worktreePath, wtGit, remoteName, baseBranch, baseAdvance === "advanced");
+			let remotePush = push ? "no-remote" : "disabled";
+			if (hasRemote && push) remotePush = await pushContentBranches(projectRoot, worktreePath, wtGit, remoteName, baseBranch, baseAdvance === "advanced");
 			const warnings = [divergedWarning, sync.warning].filter(Boolean);
 			return {
 				action: "auto-merged",
@@ -438,8 +441,9 @@ async function mergeBranch(projectRoot, branchName) {
 			baseAdvance = "blocked_diverged";
 			divergedWarning = `Branch "${branchName}" is merged into "${CONTENTRAIN_BRANCH}", but "${baseBranch}" has commits that are not in "${CONTENTRAIN_BRANCH}" — the branches have diverged, so "${baseBranch}" was not advanced. Run contentrain_reconcile (CLI: npx contentrain reconcile) to merge them and restore the fast-forward advance.`;
 		}
-		let remotePush = "no-remote";
-		if (hasRemote) remotePush = await pushContentBranches(projectRoot, worktreePath, wtGit, remoteName, baseBranch, baseAdvance === "advanced");
+		const push = pushPolicy(config).push;
+		let remotePush = push ? "no-remote" : "disabled";
+		if (hasRemote && push) remotePush = await pushContentBranches(projectRoot, worktreePath, wtGit, remoteName, baseBranch, baseAdvance === "advanced");
 		await safeDeleteBranch(git, branchName);
 		let remote;
 		if (hasRemote) remote = await deleteRemoteBranch(projectRoot, branchName, { config });
@@ -595,4 +599,4 @@ async function regenerateContextOnContentrain(wtGit, worktreePath, contextUpdate
 //#endregion
 export { isAncestor as a, selectiveSync as c, ensureContentBranch as i, buildBranchName as n, mergeBranch as o, createTransaction as r, pushContentBranches as s, NETWORK_TIMEOUT_MS as t };
 
-//# sourceMappingURL=transaction-CcjGiVYg.mjs.map
+//# sourceMappingURL=transaction-DnrUATJF.mjs.map

package/dist/transaction-DnrUATJF.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction-DnrUATJF.mjs","names":["removeFile"],"sources":["../src/providers/local/migration.ts","../src/git/transaction.ts"],"sourcesContent":["import type { SimpleGit } from 'simple-git'\n\n/**\n * Migration: the first MCP release used `contentrain/*` feature branches.\n * Once we introduced the singleton `contentrain` branch (tracking the\n * committed content state), those old feature branches became a ref-\n * namespace conflict — git cannot hold both `contentrain` (a leaf ref)\n * and `contentrain/foo` (implying a directory) simultaneously.\n *\n * `migrateLegacyBranches` removes the old-prefix branches so the\n * singleton `contentrain` ref can be created. It is idempotent and\n * safe to call before every `ensureContentBranch` run.\n *\n * Strategy:\n * 1. Delete merged `contentrain/*` branches first (`-d`). Their commits\n *    are already on the base branch via the old auto-merge flow.\n * 2. Force-delete whatever remains (`-D`). Any unmerged leftover is\n *    from an abandoned or partially-committed legacy branch — content\n *    on `main` always wins, and the singleton `contentrain` branch is\n *    about to be created from `main`/`baseBranch` anyway.\n *\n * Returns the number of branches that were deleted. Callers may log it;\n * the git transaction layer does not need the count for correctness.\n */\nexport async function migrateLegacyBranches(\n  git: SimpleGit,\n  baseBranch: string,\n): Promise<number> {\n  const branches = await git.branchLocal()\n  const oldPrefixBranches = branches.all.filter(b => b.startsWith('contentrain/'))\n  if (oldPrefixBranches.length === 0) return 0\n\n  let deleted = 0\n\n  // 1) Delete merged legacy branches first — the safe path.\n  let mergedLegacy: string[] = []\n  try {\n    const mergedOutput = await git.raw(['branch', '--merged', baseBranch])\n    mergedLegacy = mergedOutput.split('\\n')\n      .map(b => b.trim().replace(/^\\*\\s*/, ''))\n      .filter(b => b.startsWith('contentrain/'))\n  } catch {\n    // `branch --merged` fails before baseBranch exists — fall through.\n  }\n\n  for (const b of mergedLegacy) {\n    try {\n      await git.raw(['branch', '-d', b])\n      deleted++\n    } catch {\n      // Branch may be protected or already gone — safe to skip.\n    }\n  }\n\n  // 2) Force-delete any unmerged legacy branches still present.\n  const remaining = (await git.branchLocal()).all.filter(b => b.startsWith('contentrain/'))\n  for (const b of remaining) {\n    try {\n      await git.raw(['branch', '-D', b])\n      deleted++\n    } catch {\n      // Skip — best-effort cleanup.\n    }\n  }\n\n  return deleted\n}\n","import { type SimpleGit } from 'simple-git'\nimport { createGit } from '../git/identity.js'\nimport { join } from 'node:path'\nimport { rm as removeFile } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { randomUUID } from 'node:crypto'\nimport { readConfig } from '../core/config.js'\nimport { writeContext } from '../core/context.js'\nimport { deleteRemoteBranch, networkGit, type RemoteDeleteResult } from './branch-lifecycle.js'\nimport { authorConfig } from './identity.js'\nimport { branchTimestamp } from '../util/id.js'\nimport { migrateLegacyBranches } from '../providers/local/migration.js'\nimport { resolveBaseBranch } from './base-branch.js'\nimport { pushPolicy } from './push-policy.js'\n\n// Re-exported so hosts of mergeBranch (CLI serve) word local mode the same way.\nexport { LOCAL_MODE_NOTE } from './push-policy.js'\nimport type { BaseAdvance, RemotePush, SyncResult, WorkflowMode } from '@contentrain/types'\nimport { CONTENTRAIN_BRANCH } from '@contentrain/types'\n\n/**\n * Block-timeout for fetch/push inside transactions. These calls inherit the\n * host's credential setup (see networkGit); without a timeout a hung SSH\n * passphrase prompt would hang the MCP call with it.\n */\nexport const NETWORK_TIMEOUT_MS = 10_000\n\nexport interface ContextUpdate {\n  tool: string\n  model: string\n  locale?: string\n  entries?: string[]\n}\n\n/**\n * Result of completing a write transaction.\n *\n * A diverged base branch is NOT an error: the content is committed and merged\n * into the contentrain branch either way — only the base fast-forward is\n * pending. `base_advance: 'blocked_diverged'` reports that truthfully instead\n * of failing a write that in fact landed.\n */\nexport interface CompleteResult {\n  action: 'auto-merged' | 'pending-review'\n  commit: string\n  sync?: SyncResult\n  warning?: string\n  /** Present on `auto-merged`: did the base branch advance to the contentrain tip? */\n  base_advance?: BaseAdvance\n  /** Present on `auto-merged`: outcome of pushing the contentrain branch. */\n  remote_push?: RemotePush\n}\n\n/** Result of landing a feature branch via {@link mergeBranch}. */\nexport interface MergeBranchResult {\n  action: 'merged'\n  commit: string\n  sync: SyncResult\n  base_advance: BaseAdvance\n  remote_push: RemotePush\n  warning?: string\n  remote?: RemoteDeleteResult\n}\n\nexport interface GitTransaction {\n  worktree: string\n  branch: string\n  /** The resolved base branch this transaction advances. */\n  baseBranch: string\n  /** Whether the developer has the base branch checked out. */\n  baseCheckedOut: boolean\n  write(callback: (worktreePath: string) => Promise<void>): Promise<void>\n  commit(message: string, contextUpdate?: ContextUpdate): Promise<string>\n  complete(): Promise<CompleteResult>\n  cleanup(): Promise<void>\n}\n\nexport async function ensureContentBranch(projectRoot: string): Promise<void> {\n  const git = createGit(projectRoot)\n  const config = await readConfig(projectRoot)\n\n  // Check if contentrain branch exists locally\n  const branches = await git.branchLocal()\n  if (branches.all.includes(CONTENTRAIN_BRANCH)) return\n\n  // Detect base branch\n  const baseBranch = await resolveBaseBranch(git, config)\n\n  // Clean up legacy `contentrain/*` feature branches so the singleton\n  // `contentrain` ref can be created. Idempotent — safe to call even\n  // when no legacy branches exist.\n  await migrateLegacyBranches(git, baseBranch)\n\n  // Create contentrain branch from base\n  await git.branch([CONTENTRAIN_BRANCH, baseBranch])\n\n  // Push to remote if exists — unless pushing is off (local mode).\n  if (!pushPolicy(config).push) return\n  const remoteName = process.env['CONTENTRAIN_REMOTE'] ?? 'origin'\n  try {\n    const remotes = await git.getRemotes()\n    if (remotes.some(r => r.name === remoteName)) {\n      await git.push(['-u', remoteName, CONTENTRAIN_BRANCH])\n    }\n  } catch {\n    // Remote push is best-effort\n  }\n}\n\nexport async function selectiveSync(\n  projectRoot: string,\n  _worktreePath: string,\n  contentrainTip: string,\n  _previousBaseRef?: string,\n  dirtyFilesBeforeUpdate?: Set<string>,\n): Promise<SyncResult> {\n  const git = createGit(projectRoot)\n  const synced: string[] = []\n  const skipped: string[] = []\n\n  // Use git plumbing to find ALL files that differ between old and new commits.\n  // diff-tree is fast and ignores working tree / index state entirely.\n  // Not limited to .contentrain/ — some ops also modify .gitignore, etc.\n  const compareRef = _previousBaseRef ?? contentrainTip\n  let changedFiles: string[] = []\n  try {\n    const diffOutput = await git.raw([\n      'diff-tree', '--name-only', '-r', '--no-commit-id',\n      compareRef, contentrainTip,\n    ])\n    changedFiles = diffOutput.split('\\n').filter(f => f.trim().length > 0)\n  } catch {\n    // Fallback: list .contentrain/ files from the contentrainTip commit\n    try {\n      const lsOutput = await git.raw(['ls-tree', '-r', '--name-only', contentrainTip, '.contentrain/'])\n      changedFiles = lsOutput.split('\\n').filter(f => f.trim().length > 0)\n    } catch {\n      return { synced, skipped }\n    }\n  }\n\n  if (changedFiles.length === 0) return { synced, skipped }\n\n  // Use pre-captured dirty files (before update-ref) to avoid false positives.\n  // After update-ref, files appear as \"modified\" in status even though the developer\n  // didn't touch them. We use the pre-update state to know what was truly dirty.\n  const dirtyFiles = dirtyFilesBeforeUpdate ?? new Set<string>()\n\n  // Which changed files still exist in contentrainTip (HEAD after update-ref)?\n  // ONE `ls-tree` over the changed paths lists exactly the survivors, instead\n  // of a `cat-file -e` spawn per file. Falls back to per-file probing if\n  // ls-tree fails so behavior is preserved on any edge.\n  const filesInTip = new Set<string>()\n  try {\n    const lsOutput = await git.raw(['ls-tree', '-r', '--name-only', contentrainTip, '--', ...changedFiles])\n    for (const f of lsOutput.split('\\n')) {\n      const trimmed = f.trim()\n      if (trimmed) filesInTip.add(trimmed)\n    }\n  } catch {\n    for (const file of changedFiles) {\n      try {\n        await git.raw(['cat-file', '-e', `${contentrainTip}:${file}`])\n        filesInTip.add(file)\n      } catch {\n        // File does not exist in tip (was deleted)\n      }\n    }\n  }\n\n  // Partition: dirty developer files are skipped; survivors get checked out\n  // from HEAD; the rest were deleted in the new HEAD and are removed on disk.\n  const toCheckout: string[] = []\n  const toRemove: string[] = []\n  for (const file of changedFiles) {\n    if (dirtyFiles.has(file)) skipped.push(file)\n    else if (filesInTip.has(file)) toCheckout.push(file)\n    else toRemove.push(file)\n  }\n\n  // ONE `git checkout HEAD -- f1 f2 …` restores every clean survivor at once.\n  // On failure, fall back to per-file so a single unresolvable path still\n  // yields precise skip accounting (dirty files were already excluded).\n  if (toCheckout.length > 0) {\n    try {\n      await git.checkout(['HEAD', '--', ...toCheckout])\n      synced.push(...toCheckout)\n    } catch {\n      for (const file of toCheckout) {\n        try {\n          await git.checkout(['HEAD', '--', file])\n          synced.push(file)\n        } catch {\n          skipped.push(file)\n        }\n      }\n    }\n  }\n\n  // Deletions are working-tree fs removals — no git spawn, safe to parallelize.\n  await Promise.all(toRemove.map(async (file) => {\n    try {\n      await removeFile(join(projectRoot, file), { force: true })\n      synced.push(file)\n    } catch {\n      skipped.push(file)\n    }\n  }))\n\n  const warning = skipped.length > 0\n    ? `${skipped.length} file(s) skipped due to local changes: ${skipped.join(', ')}. Commit your changes, then run: git checkout HEAD -- ${skipped.join(' ')}`\n    : undefined\n\n  return { synced, skipped, warning }\n}\n\nexport async function createTransaction(\n  projectRoot: string,\n  branchName: string,\n  options?: { workflowOverride?: WorkflowMode },\n): Promise<GitTransaction> {\n  const git = createGit(projectRoot)\n  const config = await readConfig(projectRoot)\n  const workflow = options?.workflowOverride ?? config?.workflow ?? 'auto-merge'\n  const push = pushPolicy(config).push\n\n  const remoteName = process.env['CONTENTRAIN_REMOTE'] ?? 'origin'\n\n  // Detect current branch + remote in ONE batch, then the base branch.\n  const [branchResult, remotes] = await Promise.all([\n    git.raw(['branch', '--show-current']).catch(() => ''),\n    git.getRemotes().catch(() => []),\n  ])\n  const currentBranch = branchResult.trim()\n  const baseBranch = await resolveBaseBranch(git, config, { remoteName, currentBranch })\n  const hasRemote = (remotes as { name: string }[]).some(r => r.name === remoteName)\n  // The developer's HEAD moves with an advance only when the base is what\n  // they have checked out. On any other branch their tree stays exactly as\n  // it is — no index refresh, no selective sync.\n  const baseCheckedOut = currentBranch === baseBranch\n\n  // Check if developer is on contentrain branch\n  if (currentBranch === CONTENTRAIN_BRANCH) {\n    throw Object.assign(new Error(\n      `The '${CONTENTRAIN_BRANCH}' branch is checked out in your working directory. `\n      + `Contentrain manages this branch automatically. `\n      + `Switch to your working branch and retry.`,\n    ), {\n      code: 'CONTENT_BRANCH_CHECKED_OUT',\n      agent_hint: 'Ask the developer to switch to their working branch (e.g., main or a feature branch), then retry the operation.',\n      developer_action: `git checkout ${baseBranch}`,\n    })\n  }\n\n  // Ensure contentrain branch exists (with migration for old contentrain/* branches)\n  await ensureContentBranch(projectRoot)\n\n  // Fetch latest from remote (parallel fetch for both branches). Hardened:\n  // no interactive credential prompt, block-timeout on hangs.\n  if (hasRemote) {\n    const net = networkGit(projectRoot, NETWORK_TIMEOUT_MS)\n    await Promise.all([\n      net.fetch(remoteName, baseBranch).catch(() => {}),\n      net.fetch(remoteName, CONTENTRAIN_BRANCH).catch(() => {}),\n    ])\n  }\n\n  const worktreePath = join(tmpdir(), `cr-${randomUUID()}`)\n  const branch = branchName\n\n  // Create worktree on contentrain branch\n  await git.raw(['worktree', 'add', worktreePath, CONTENTRAIN_BRANCH])\n\n  // Commit identity comes from `-c user.*` config (see authorConfig) — passed\n  // as args, never via `.env()`, so simple-git's block-unsafe guard is never\n  // triggered by an inherited EDITOR/GIT_ASKPASS/etc.\n  const wtGit = createGit(worktreePath, { config: authorConfig() })\n\n  // Sync contentrain with base branch (bring main changes into contentrain)\n  try {\n    await wtGit.merge([baseBranch, '--no-edit'])\n  } catch {\n    try { await wtGit.merge(['--abort']) } catch { /* not in merge state */ }\n    if (hasRemote) {\n      try {\n        await wtGit.merge([`${remoteName}/${baseBranch}`, '--no-edit'])\n      } catch {\n        try { await wtGit.merge(['--abort']) } catch { /* ignore */ }\n      }\n    }\n  }\n\n  // Sync with remote contentrain if exists\n  if (hasRemote) {\n    try {\n      await wtGit.merge([`${remoteName}/${CONTENTRAIN_BRANCH}`, '--no-edit'])\n    } catch {\n      try { await wtGit.merge(['--abort']) } catch { /* ignore */ }\n    }\n  }\n\n  // Create feature branch from contentrain\n  await wtGit.checkout(['-b', branch])\n\n  let commitHash = ''\n  let pendingReview = false\n  // Set once the feature branch has been merged into the contentrain branch,\n  // which is what makes deleting it in cleanup() safe — the work is reachable\n  // from contentrain at that point.\n  let mergedIntoContentrain = false\n  let savedContextUpdate: ContextUpdate | undefined\n\n  return {\n    worktree: worktreePath,\n    branch,\n    baseBranch,\n    baseCheckedOut,\n\n    async write(callback) {\n      await callback(worktreePath)\n    },\n\n    async commit(message, contextUpdate?) {\n      // context.json is intentionally NOT committed on the feature branch — it\n      // is regenerated on the contentrain branch after the merge (see\n      // complete()). Committing it per-branch caused cross-branch merge\n      // conflicts on a single mutable file. `--no-verify` keeps the repo's\n      // commit-msg / pre-commit hooks (commitlint, lefthook, husky) from\n      // rejecting these machine-generated infra commits.\n      savedContextUpdate = contextUpdate\n      await wtGit.add('.')\n      const result = await wtGit.commit(message, { '--allow-empty': null, '--no-verify': null })\n      commitHash = result.commit || ''\n      return commitHash\n    },\n\n    async complete() {\n      if (workflow === 'review') {\n        // Mark the branch as surviving BEFORE attempting the push. The commit\n        // already exists at this point, so a push failure (no write access,\n        // offline, expired credentials) must not make cleanup() treat this as\n        // a failed transaction and delete the branch — that silently discards\n        // committed work. Pushing is a convenience here; contentrain_submit is\n        // the documented way to publish a review branch.\n        pendingReview = true\n\n        let warning: string | undefined\n        if (hasRemote && push) {\n          try {\n            await networkGit(projectRoot, NETWORK_TIMEOUT_MS).push(remoteName, branch)\n          } catch (error) {\n            const detail = error instanceof Error ? error.message : String(error)\n            warning = `Changes are committed locally on \"${branch}\", but pushing to \"${remoteName}\" failed: ${detail.trim()}. `\n              + `The branch is intact — run contentrain_submit once you have push access, or merge it locally with contentrain_merge.`\n          }\n        }\n\n        return { action: 'pending-review', commit: commitHash, warning, ...(push ? {} : { remote_push: 'disabled' as const }) }\n      }\n\n      // auto-merge: merge feature branch into contentrain, then advance base\n\n      // Switch to contentrain branch in worktree\n      await wtGit.checkout(CONTENTRAIN_BRANCH)\n\n      // Merge feature branch into contentrain\n      try {\n        await wtGit.merge([branch, '--no-edit'])\n      } catch {\n        try {\n          await wtGit.merge(['--abort'])\n        } catch { /* not in merge state */ }\n        throw Object.assign(new Error(\n          `Merge conflict when merging branch \"${branch}\" into \"${CONTENTRAIN_BRANCH}\". `\n          + `The branch still exists with your changes intact. `\n          + `Resolve the conflict manually, or delete the branch and retry.`,\n        ), {\n          code: 'CONTENT_BRANCH_MERGE_CONFLICT',\n          agent_hint: 'The feature branch could not be merged into the contentrain branch. Ask the developer to resolve the conflict.',\n          developer_action: `git checkout ${CONTENTRAIN_BRANCH} && git merge ${branch}`,\n        })\n      }\n      // The commit is now reachable from contentrain, so cleanup() may prune\n      // the feature branch. Anything that fails after this point still leaves\n      // the work safe.\n      mergedIntoContentrain = true\n\n      // Regenerate context.json on the contentrain branch (post-merge,\n      // single-threaded) and fold it into the tip before advancing the base.\n      if (savedContextUpdate) {\n        await regenerateContextOnContentrain(wtGit, worktreePath, savedContextUpdate)\n      }\n\n      // Get contentrain tip + old base ref + dirty files in parallel\n      const [contentrainTip, previousBaseRef, statusBeforeUpdate] = await Promise.all([\n        wtGit.raw(['rev-parse', 'HEAD']).then(s => s.trim()),\n        git.raw(['rev-parse', baseBranch]).then(s => s.trim()),\n        git.status(),\n      ])\n      const dirtyFilesBeforeUpdate = new Set(statusBeforeUpdate.files.map(f => f.path))\n\n      // Fast-forward check: baseBranch must be an ancestor of contentrainTip.\n      // `rev-list --count` instead of `merge-base --is-ancestor`: the latter\n      // signals via exit code with empty stderr, which simple-git reports as\n      // success — the check would silently pass on divergence.\n      //\n      // Divergence is NOT an error here. The content is already committed and\n      // merged into contentrain (the CDN's source of truth) — only the base\n      // fast-forward is impossible. Throwing at this point used to report a\n      // failure for a write that had in fact landed, while cleanup() deleted\n      // the cr/* branch. Report the truth instead.\n      let sync: SyncResult = { synced: [], skipped: [] }\n      let baseAdvance: BaseAdvance\n      let divergedWarning: string | undefined\n      if (await isAncestor(git, previousBaseRef, contentrainTip)) {\n        baseAdvance = 'advanced'\n\n        sync = await advanceBase(git, {\n          projectRoot, worktreePath, baseBranch, currentBranch, baseCheckedOut,\n          contentrainTip, previousBaseRef, dirtyFilesBeforeUpdate,\n        })\n      } else {\n        baseAdvance = 'blocked_diverged'\n        divergedWarning = `Content is committed and merged into \"${CONTENTRAIN_BRANCH}\", but \"${baseBranch}\" has commits that are not in \"${CONTENTRAIN_BRANCH}\" — the branches have diverged, so \"${baseBranch}\" was not advanced. Run contentrain_reconcile (CLI: npx contentrain reconcile) to merge them and restore the fast-forward advance.`\n      }\n\n      // Push contentrain (with retry) and, when advanced, the base branch.\n      let remotePush: RemotePush = push ? 'no-remote' : 'disabled'\n      if (hasRemote && push) {\n        remotePush = await pushContentBranches(projectRoot, worktreePath, wtGit, remoteName, baseBranch, baseAdvance === 'advanced')\n      }\n\n      const warnings = [divergedWarning, sync.warning].filter(Boolean)\n      return {\n        action: 'auto-merged' as const,\n        commit: commitHash,\n        sync,\n        base_advance: baseAdvance,\n        remote_push: remotePush,\n        ...(warnings.length > 0 ? { warning: warnings.join(' ') } : {}),\n      }\n    },\n\n    async cleanup() {\n      try {\n        await git.raw(['worktree', 'remove', worktreePath, '--force'])\n      } catch {\n        // worktree may already be cleaned up\n      }\n      // Prune the feature branch only when doing so cannot lose work:\n      //   - pendingReview: must survive for a later contentrain_submit/merge\n      //   - commitHash === '': nothing was ever committed, safe to drop\n      //   - mergedIntoContentrain: the work is reachable from contentrain\n      // Anything else means the branch holds a commit that is reachable from\n      // nowhere else, and deleting it would silently discard the user's work\n      // while the caller reports success. Keeping it may leave a stray cr/*\n      // ref after a failure — that is recoverable; a deleted commit is not.\n      const holdsUnreachableWork = commitHash !== '' && !mergedIntoContentrain\n      if (!pendingReview && !holdsUnreachableWork) {\n        await safeDeleteBranch(git, branch)\n      }\n    },\n  }\n}\n\nexport async function mergeBranch(\n  projectRoot: string,\n  branchName: string,\n): Promise<MergeBranchResult> {\n  const git = createGit(projectRoot)\n  const config = await readConfig(projectRoot)\n  const remoteName = process.env['CONTENTRAIN_REMOTE'] ?? 'origin'\n\n  // Detect base branch\n  const currentBranch = (await git.raw(['branch', '--show-current']).catch(() => '')).trim()\n  const baseBranch = await resolveBaseBranch(git, config, { remoteName, currentBranch })\n  const baseCheckedOut = currentBranch === baseBranch\n\n  // Ensure contentrain branch exists\n  await ensureContentBranch(projectRoot)\n\n  // Check remote\n  let hasRemote = false\n  try {\n    const remotes = await git.getRemotes()\n    hasRemote = remotes.some(r => r.name === remoteName)\n  } catch {\n    hasRemote = false\n  }\n\n  // Fetch latest from remote before merging — an approve against stale\n  // remote-tracking refs is how an already-reconciled divergence keeps\n  // reporting itself. Hardened: no credential prompt, block-timeout.\n  if (hasRemote) {\n    const net = networkGit(projectRoot, NETWORK_TIMEOUT_MS)\n    await Promise.all([\n      net.fetch(remoteName, baseBranch).catch(() => {}),\n      net.fetch(remoteName, CONTENTRAIN_BRANCH).catch(() => {}),\n    ])\n  }\n\n  // Create temp worktree on contentrain branch\n  const worktreePath = join(tmpdir(), `cr-merge-${randomUUID()}`)\n  await git.raw(['worktree', 'add', worktreePath, CONTENTRAIN_BRANCH])\n\n  // Commit identity from `-c user.*` config (see authorConfig) — guard-safe,\n  // no `.env()` spread.\n  const wtGit = createGit(worktreePath, { config: authorConfig() })\n\n  try {\n    // Sync contentrain with the base branch (and remotes) BEFORE landing the\n    // feature branch — the counterpart of the pre-fork sync in\n    // createTransaction. Without it, one base commit that is not in\n    // contentrain makes every merge report a diverged base forever. A\n    // conflicting sync is aborted silently; the fast-forward check below then\n    // reports the divergence truthfully instead of this call guessing at it.\n    try {\n      await wtGit.merge([baseBranch, '--no-edit'])\n    } catch {\n      try { await wtGit.merge(['--abort']) } catch { /* not in merge state */ }\n      if (hasRemote) {\n        try {\n          await wtGit.merge([`${remoteName}/${baseBranch}`, '--no-edit'])\n        } catch {\n          try { await wtGit.merge(['--abort']) } catch { /* ignore */ }\n        }\n      }\n    }\n    if (hasRemote) {\n      try {\n        await wtGit.merge([`${remoteName}/${CONTENTRAIN_BRANCH}`, '--no-edit'])\n      } catch {\n        try { await wtGit.merge(['--abort']) } catch { /* ignore */ }\n      }\n    }\n\n    // Merge the feature branch into contentrain\n    try {\n      await wtGit.merge([branchName, '--no-edit'])\n    } catch {\n      try { await wtGit.merge(['--abort']) } catch { /* not in merge state */ }\n      throw Object.assign(new Error(\n        `Merge conflict when merging branch \"${branchName}\" into \"${CONTENTRAIN_BRANCH}\". `\n        + `The branch still exists with your changes intact. `\n        + `Resolve the conflict manually, or delete the branch and retry.`,\n      ), {\n        code: 'CONTENT_BRANCH_MERGE_CONFLICT',\n        agent_hint: 'The feature branch could not be merged into the contentrain branch. Ask the developer to resolve the conflict.',\n        developer_action: `git checkout ${CONTENTRAIN_BRANCH} && git merge ${branchName}`,\n      })\n    }\n\n    // Regenerate context.json on contentrain post-merge (deterministic,\n    // single-threaded) so review-mode branches — which carry no context.json —\n    // still produce up-to-date stats once landed.\n    await regenerateContextOnContentrain(wtGit, worktreePath, { tool: 'contentrain_merge', model: '*' })\n\n    // Get contentrain tip + old base ref + dirty files in parallel\n    const [contentrainTip, previousBaseRef, statusBeforeUpdate] = await Promise.all([\n      wtGit.raw(['rev-parse', 'HEAD']).then(s => s.trim()),\n      git.raw(['rev-parse', baseBranch]).then(s => s.trim()),\n      git.status(),\n    ])\n    const dirtyFilesBeforeUpdate = new Set(statusBeforeUpdate.files.map(f => f.path))\n\n    // Fast-forward check: baseBranch must be an ancestor of contentrainTip.\n    // (See complete() — merge-base --is-ancestor is unusable via simple-git.)\n    // Divergence is NOT an error: the feature branch is already merged into\n    // contentrain; only the base advance is pending until the branches are\n    // reconciled. Throwing here used to strand the cr/* branch as a phantom\n    // \"pending review\" while its content was already on contentrain.\n    let sync: SyncResult = { synced: [], skipped: [] }\n    let baseAdvance: BaseAdvance\n    let divergedWarning: string | undefined\n    if (await isAncestor(git, previousBaseRef, contentrainTip)) {\n      baseAdvance = 'advanced'\n\n      sync = await advanceBase(git, {\n        projectRoot, worktreePath, baseBranch, currentBranch, baseCheckedOut,\n        contentrainTip, previousBaseRef, dirtyFilesBeforeUpdate,\n      })\n    } else {\n      baseAdvance = 'blocked_diverged'\n      divergedWarning = `Branch \"${branchName}\" is merged into \"${CONTENTRAIN_BRANCH}\", but \"${baseBranch}\" has commits that are not in \"${CONTENTRAIN_BRANCH}\" — the branches have diverged, so \"${baseBranch}\" was not advanced. Run contentrain_reconcile (CLI: npx contentrain reconcile) to merge them and restore the fast-forward advance.`\n    }\n\n    // Push contentrain (with retry) and, when advanced, the base branch.\n    const push = pushPolicy(config).push\n    let remotePush: RemotePush = push ? 'no-remote' : 'disabled'\n    if (hasRemote && push) {\n      remotePush = await pushContentBranches(projectRoot, worktreePath, wtGit, remoteName, baseBranch, baseAdvance === 'advanced')\n    }\n\n    // Prune the now-merged feature branch so merged cr/* refs don't accumulate.\n    await safeDeleteBranch(git, branchName)\n\n    // Delete the remote copy too (review-mode branches were pushed on save).\n    // Best-effort and config-gated inside the helper: a failure surfaces as\n    // `remote.warning`, never as a failed merge.\n    let remote: RemoteDeleteResult | undefined\n    if (hasRemote) {\n      remote = await deleteRemoteBranch(projectRoot, branchName, { config })\n    }\n\n    const warnings = [divergedWarning, sync.warning].filter(Boolean)\n    return {\n      action: 'merged' as const,\n      commit: contentrainTip,\n      sync,\n      base_advance: baseAdvance,\n      remote_push: remotePush,\n      ...(warnings.length > 0 ? { warning: warnings.join(' ') } : {}),\n      ...(remote ? { remote } : {}),\n    }\n  } finally {\n    // Cleanup worktree\n    try {\n      await git.raw(['worktree', 'remove', worktreePath, '--force'])\n    } catch {\n      // worktree may already be cleaned up\n    }\n  }\n}\n\nexport function buildBranchName(scope: string, target: string, locale?: string): string {\n  const ts = branchTimestamp()\n  const parts = ['cr', scope, target]\n  if (locale) parts.push(locale)\n  parts.push(ts)\n  return parts.join('/')\n}\n\n/**\n * Fast-forward the base branch to the contentrain tip with `update-ref`, then\n * bring the developer's working tree along — but only when the base is the\n * branch they have checked out.\n *\n * When it is, `update-ref` moved their HEAD: the index is refreshed and the\n * changed files are synced (dirty files skipped). When it is not — a feature\n * branch is checked out — their HEAD did not move, so there is nothing to\n * refresh: `read-tree HEAD` would only drop what they have staged, and a\n * \"sync\" from HEAD would restore or delete files against the wrong branch.\n * Their tree is left exactly as it is, and the result says where the content\n * went.\n */\nasync function advanceBase(git: SimpleGit, input: {\n  projectRoot: string\n  worktreePath: string\n  baseBranch: string\n  currentBranch: string\n  baseCheckedOut: boolean\n  contentrainTip: string\n  previousBaseRef: string\n  dirtyFilesBeforeUpdate: Set<string>\n}): Promise<SyncResult> {\n  await git.raw(['update-ref', `refs/heads/${input.baseBranch}`, input.contentrainTip])\n\n  if (!input.baseCheckedOut) {\n    const where = input.currentBranch ? `\"${input.currentBranch}\"` : 'a detached HEAD'\n    return {\n      synced: [],\n      skipped: [],\n      warning: `Content landed on \"${CONTENTRAIN_BRANCH}\" and \"${input.baseBranch}\". Your working tree is on ${where}, which was not touched — merge or rebase \"${input.baseBranch}\" to see the change there.`,\n    }\n  }\n\n  // update-ref moves the branch pointer but leaves the index stale.\n  // read-tree updates the index to match HEAD without touching the working tree.\n  try {\n    await git.raw(['read-tree', 'HEAD'])\n  } catch {\n    // fallback: try reset for older git versions\n    try { await git.raw(['reset', 'HEAD']) } catch { /* ignore */ }\n  }\n\n  // Selective sync: copy the changed files to the developer's working tree.\n  // Only after an advance — when the base did not move, the developer's HEAD\n  // did not change, and syncing files from the contentrain tip would desync\n  // their working tree from their own HEAD.\n  return selectiveSync(input.projectRoot, input.worktreePath, input.contentrainTip, input.previousBaseRef, input.dirtyFilesBeforeUpdate)\n}\n\n/**\n * True when `ancestor` is an ancestor of (or equal to) `descendant`.\n * Implemented with `rev-list --count` because `merge-base --is-ancestor`\n * signals via exit code with empty stderr — simple-git reports that as\n * success, so it cannot express a negative verdict.\n */\nexport async function isAncestor(git: SimpleGit, ancestor: string, descendant: string): Promise<boolean> {\n  try {\n    const count = Number((await git.raw(['rev-list', '--count', ancestor, `^${descendant}`])).trim())\n    return count === 0\n  } catch {\n    return false\n  }\n}\n\n/**\n * Push the contentrain branch (with one fetch-merge-retry) and, when the base\n * advanced, the base branch. Returns the push outcome for contentrain; the\n * base push is best-effort and never demotes the outcome, because the\n * contentrain branch is the content SSOT — it is what the CDN reads.\n *\n * The retry absorbs a concurrent remote advance (another writer pushed\n * contentrain first): fetch, merge the remote tip into the local worktree's\n * contentrain, push again. A conflicting retry-merge is aborted and reported\n * as `rejected` — that is a real divergence, not a race.\n */\nexport async function pushContentBranches(\n  projectRoot: string,\n  worktreePath: string,\n  wtGit: SimpleGit,\n  remoteName: string,\n  baseBranch: string,\n  baseAdvanced: boolean,\n): Promise<RemotePush> {\n  const net = networkGit(projectRoot, NETWORK_TIMEOUT_MS)\n  let outcome: RemotePush = 'pushed'\n  try {\n    await net.push(remoteName, CONTENTRAIN_BRANCH)\n  } catch {\n    try {\n      await networkGit(worktreePath, NETWORK_TIMEOUT_MS).fetch(remoteName, CONTENTRAIN_BRANCH)\n      await wtGit.merge([`${remoteName}/${CONTENTRAIN_BRANCH}`, '--no-edit'])\n      await net.push(remoteName, CONTENTRAIN_BRANCH)\n    } catch {\n      try { await wtGit.merge(['--abort']) } catch { /* not in merge state */ }\n      outcome = 'rejected'\n    }\n  }\n  if (baseAdvanced) {\n    try {\n      await net.push(remoteName, baseBranch)\n    } catch {\n      // Best-effort: a failed base push alone does not demote the outcome.\n    }\n  }\n  return outcome\n}\n\n/**\n * Force-delete a local branch, swallowing all errors. Never deletes the\n * singleton `contentrain` branch. Used to prune feature branches after they\n * are merged (auto-merge / contentrain_merge) or when a transaction fails\n * before completing — so failed/merged `cr/*` refs do not accumulate.\n */\nasync function safeDeleteBranch(git: SimpleGit, branch: string): Promise<void> {\n  if (!branch || branch === CONTENTRAIN_BRANCH) return\n  try {\n    await git.raw(['branch', '-D', branch])\n  } catch {\n    // Branch may not exist, be checked out, or already be deleted — ignore.\n  }\n}\n\n/**\n * Regenerate `.contentrain/context.json` deterministically inside a worktree\n * that is currently on the `contentrain` branch, then commit it (hooks\n * bypassed). Called AFTER a feature branch is merged so context.json is only\n * ever written on `contentrain`, single-threaded — eliminating the per-branch\n * merge conflicts that came from committing it on every feature branch.\n */\nasync function regenerateContextOnContentrain(\n  wtGit: SimpleGit,\n  worktreePath: string,\n  contextUpdate: ContextUpdate,\n): Promise<void> {\n  await writeContext(worktreePath, contextUpdate)\n  await wtGit.add('.contentrain/context.json')\n  try {\n    await wtGit.commit('[contentrain] context: update', { '--no-verify': null })\n  } catch {\n    // Nothing staged (context.json unchanged) — fine.\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwBA,eAAsB,sBACpB,KACA,YACiB;AAGjB,MAFiB,MAAM,IAAI,aAAa,EACL,IAAI,QAAO,MAAK,EAAE,WAAW,eAAe,CAAC,CAC1D,WAAW,EAAG,QAAO;CAE3C,IAAI,UAAU;CAGd,IAAI,eAAyB,EAAE;AAC/B,KAAI;AAEF,kBADqB,MAAM,IAAI,IAAI;GAAC;GAAU;GAAY;GAAW,CAAC,EAC1C,MAAM,KAAK,CACpC,KAAI,MAAK,EAAE,MAAM,CAAC,QAAQ,UAAU,GAAG,CAAC,CACxC,QAAO,MAAK,EAAE,WAAW,eAAe,CAAC;SACtC;AAIR,MAAK,MAAM,KAAK,aACd,KAAI;AACF,QAAM,IAAI,IAAI;GAAC;GAAU;GAAM;GAAE,CAAC;AAClC;SACM;CAMV,MAAM,aAAa,MAAM,IAAI,aAAa,EAAE,IAAI,QAAO,MAAK,EAAE,WAAW,eAAe,CAAC;AACzF,MAAK,MAAM,KAAK,UACd,KAAI;AACF,QAAM,IAAI,IAAI;GAAC;GAAU;GAAM;GAAE,CAAC;AAClC;SACM;AAKV,QAAO;;;;;;;;;ACxCT,MAAa,qBAAqB;AAoDlC,eAAsB,oBAAoB,aAAoC;CAC5E,MAAM,MAAM,UAAU,YAAY;CAClC,MAAM,SAAS,MAAM,WAAW,YAAY;AAI5C,MADiB,MAAM,IAAI,aAAa,EAC3B,IAAI,SAAS,mBAAmB,CAAE;CAG/C,MAAM,aAAa,MAAM,kBAAkB,KAAK,OAAO;AAKvD,OAAM,sBAAsB,KAAK,WAAW;AAG5C,OAAM,IAAI,OAAO,CAAC,oBAAoB,WAAW,CAAC;AAGlD,KAAI,CAAC,WAAW,OAAO,CAAC,KAAM;CAC9B,MAAM,aAAa,QAAQ,IAAI,yBAAyB;AACxD,KAAI;AAEF,OADgB,MAAM,IAAI,YAAY,EAC1B,MAAK,MAAK,EAAE,SAAS,WAAW,CAC1C,OAAM,IAAI,KAAK;GAAC;GAAM;GAAY;GAAmB,CAAC;SAElD;;AAKV,eAAsB,cACpB,aACA,eACA,gBACA,kBACA,wBACqB;CACrB,MAAM,MAAM,UAAU,YAAY;CAClC,MAAM,SAAmB,EAAE;CAC3B,MAAM,UAAoB,EAAE;CAK5B,MAAM,aAAa,oBAAoB;CACvC,IAAI,eAAyB,EAAE;AAC/B,KAAI;AAKF,kBAJmB,MAAM,IAAI,IAAI;GAC/B;GAAa;GAAe;GAAM;GAClC;GAAY;GACb,CAAC,EACwB,MAAM,KAAK,CAAC,QAAO,MAAK,EAAE,MAAM,CAAC,SAAS,EAAE;SAChE;AAEN,MAAI;AAEF,mBADiB,MAAM,IAAI,IAAI;IAAC;IAAW;IAAM;IAAe;IAAgB;IAAgB,CAAC,EACzE,MAAM,KAAK,CAAC,QAAO,MAAK,EAAE,MAAM,CAAC,SAAS,EAAE;UAC9D;AACN,UAAO;IAAE;IAAQ;IAAS;;;AAI9B,KAAI,aAAa,WAAW,EAAG,QAAO;EAAE;EAAQ;EAAS;CAKzD,MAAM,aAAa,0CAA0B,IAAI,KAAa;CAM9D,MAAM,6BAAa,IAAI,KAAa;AACpC,KAAI;EACF,MAAM,WAAW,MAAM,IAAI,IAAI;GAAC;GAAW;GAAM;GAAe;GAAgB;GAAM,GAAG;GAAa,CAAC;AACvG,OAAK,MAAM,KAAK,SAAS,MAAM,KAAK,EAAE;GACpC,MAAM,UAAU,EAAE,MAAM;AACxB,OAAI,QAAS,YAAW,IAAI,QAAQ;;SAEhC;AACN,OAAK,MAAM,QAAQ,aACjB,KAAI;AACF,SAAM,IAAI,IAAI;IAAC;IAAY;IAAM,GAAG,eAAe,GAAG;IAAO,CAAC;AAC9D,cAAW,IAAI,KAAK;UACd;;CAQZ,MAAM,aAAuB,EAAE;CAC/B,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,QAAQ,aACjB,KAAI,WAAW,IAAI,KAAK,CAAE,SAAQ,KAAK,KAAK;UACnC,WAAW,IAAI,KAAK,CAAE,YAAW,KAAK,KAAK;KAC/C,UAAS,KAAK,KAAK;AAM1B,KAAI,WAAW,SAAS,EACtB,KAAI;AACF,QAAM,IAAI,SAAS;GAAC;GAAQ;GAAM,GAAG;GAAW,CAAC;AACjD,SAAO,KAAK,GAAG,WAAW;SACpB;AACN,OAAK,MAAM,QAAQ,WACjB,KAAI;AACF,SAAM,IAAI,SAAS;IAAC;IAAQ;IAAM;IAAK,CAAC;AACxC,UAAO,KAAK,KAAK;UACX;AACN,WAAQ,KAAK,KAAK;;;AAO1B,OAAM,QAAQ,IAAI,SAAS,IAAI,OAAO,SAAS;AAC7C,MAAI;AACF,SAAMA,GAAW,KAAK,aAAa,KAAK,EAAE,EAAE,OAAO,MAAM,CAAC;AAC1D,UAAO,KAAK,KAAK;UACX;AACN,WAAQ,KAAK,KAAK;;GAEpB,CAAC;AAMH,QAAO;EAAE;EAAQ;EAAS,SAJV,QAAQ,SAAS,IAC7B,GAAG,QAAQ,OAAO,yCAAyC,QAAQ,KAAK,KAAK,CAAC,wDAAwD,QAAQ,KAAK,IAAI,KACvJ,KAAA;EAE+B;;AAGrC,eAAsB,kBACpB,aACA,YACA,SACyB;CACzB,MAAM,MAAM,UAAU,YAAY;CAClC,MAAM,SAAS,MAAM,WAAW,YAAY;CAC5C,MAAM,WAAW,SAAS,oBAAoB,QAAQ,YAAY;CAClE,MAAM,OAAO,WAAW,OAAO,CAAC;CAEhC,MAAM,aAAa,QAAQ,IAAI,yBAAyB;CAGxD,MAAM,CAAC,cAAc,WAAW,MAAM,QAAQ,IAAI,CAChD,IAAI,IAAI,CAAC,UAAU,iBAAiB,CAAC,CAAC,YAAY,GAAG,EACrD,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC,CACjC,CAAC;CACF,MAAM,gBAAgB,aAAa,MAAM;CACzC,MAAM,aAAa,MAAM,kBAAkB,KAAK,QAAQ;EAAE;EAAY;EAAe,CAAC;CACtF,MAAM,YAAa,QAA+B,MAAK,MAAK,EAAE,SAAS,WAAW;CAIlF,MAAM,iBAAiB,kBAAkB;AAGzC,KAAI,kBAAkB,mBACpB,OAAM,OAAO,uBAAO,IAAI,MACtB,QAAQ,mBAAmB,4IAG5B,EAAE;EACD,MAAM;EACN,YAAY;EACZ,kBAAkB,gBAAgB;EACnC,CAAC;AAIJ,OAAM,oBAAoB,YAAY;AAItC,KAAI,WAAW;EACb,MAAM,MAAM,WAAW,aAAa,mBAAmB;AACvD,QAAM,QAAQ,IAAI,CAChB,IAAI,MAAM,YAAY,WAAW,CAAC,YAAY,GAAG,EACjD,IAAI,MAAM,YAAY,mBAAmB,CAAC,YAAY,GAAG,CAC1D,CAAC;;CAGJ,MAAM,eAAe,KAAK,QAAQ,EAAE,MAAM,YAAY,GAAG;CACzD,MAAM,SAAS;AAGf,OAAM,IAAI,IAAI;EAAC;EAAY;EAAO;EAAc;EAAmB,CAAC;CAKpE,MAAM,QAAQ,UAAU,cAAc,EAAE,QAAQ,cAAc,EAAE,CAAC;AAGjE,KAAI;AACF,QAAM,MAAM,MAAM,CAAC,YAAY,YAAY,CAAC;SACtC;AACN,MAAI;AAAE,SAAM,MAAM,MAAM,CAAC,UAAU,CAAC;UAAS;AAC7C,MAAI,UACF,KAAI;AACF,SAAM,MAAM,MAAM,CAAC,GAAG,WAAW,GAAG,cAAc,YAAY,CAAC;UACzD;AACN,OAAI;AAAE,UAAM,MAAM,MAAM,CAAC,UAAU,CAAC;WAAS;;;AAMnD,KAAI,UACF,KAAI;AACF,QAAM,MAAM,MAAM,CAAC,GAAG,WAAW,GAAG,sBAAsB,YAAY,CAAC;SACjE;AACN,MAAI;AAAE,SAAM,MAAM,MAAM,CAAC,UAAU,CAAC;UAAS;;AAKjD,OAAM,MAAM,SAAS,CAAC,MAAM,OAAO,CAAC;CAEpC,IAAI,aAAa;CACjB,IAAI,gBAAgB;CAIpB,IAAI,wBAAwB;CAC5B,IAAI;AAEJ,QAAO;EACL,UAAU;EACV;EACA;EACA;EAEA,MAAM,MAAM,UAAU;AACpB,SAAM,SAAS,aAAa;;EAG9B,MAAM,OAAO,SAAS,eAAgB;AAOpC,wBAAqB;AACrB,SAAM,MAAM,IAAI,IAAI;AAEpB,iBADe,MAAM,MAAM,OAAO,SAAS;IAAE,iBAAiB;IAAM,eAAe;IAAM,CAAC,EACtE,UAAU;AAC9B,UAAO;;EAGT,MAAM,WAAW;AACf,OAAI,aAAa,UAAU;AAOzB,oBAAgB;IAEhB,IAAI;AACJ,QAAI,aAAa,KACf,KAAI;AACF,WAAM,WAAW,aAAa,mBAAmB,CAAC,KAAK,YAAY,OAAO;aACnE,OAAO;AAEd,eAAU,qCAAqC,OAAO,qBAAqB,WAAW,aADvE,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,EACoC,MAAM,CAAC;;AAKpH,WAAO;KAAE,QAAQ;KAAkB,QAAQ;KAAY;KAAS,GAAI,OAAO,EAAE,GAAG,EAAE,aAAa,YAAqB;KAAG;;AAMzH,SAAM,MAAM,SAAS,mBAAmB;AAGxC,OAAI;AACF,UAAM,MAAM,MAAM,CAAC,QAAQ,YAAY,CAAC;WAClC;AACN,QAAI;AACF,WAAM,MAAM,MAAM,CAAC,UAAU,CAAC;YACxB;AACR,UAAM,OAAO,uBAAO,IAAI,MACtB,uCAAuC,OAAO,UAAU,mBAAmB,qHAG5E,EAAE;KACD,MAAM;KACN,YAAY;KACZ,kBAAkB,gBAAgB,mBAAmB,gBAAgB;KACtE,CAAC;;AAKJ,2BAAwB;AAIxB,OAAI,mBACF,OAAM,+BAA+B,OAAO,cAAc,mBAAmB;GAI/E,MAAM,CAAC,gBAAgB,iBAAiB,sBAAsB,MAAM,QAAQ,IAAI;IAC9E,MAAM,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,MAAK,MAAK,EAAE,MAAM,CAAC;IACpD,IAAI,IAAI,CAAC,aAAa,WAAW,CAAC,CAAC,MAAK,MAAK,EAAE,MAAM,CAAC;IACtD,IAAI,QAAQ;IACb,CAAC;GACF,MAAM,yBAAyB,IAAI,IAAI,mBAAmB,MAAM,KAAI,MAAK,EAAE,KAAK,CAAC;GAYjF,IAAI,OAAmB;IAAE,QAAQ,EAAE;IAAE,SAAS,EAAE;IAAE;GAClD,IAAI;GACJ,IAAI;AACJ,OAAI,MAAM,WAAW,KAAK,iBAAiB,eAAe,EAAE;AAC1D,kBAAc;AAEd,WAAO,MAAM,YAAY,KAAK;KAC5B;KAAa;KAAc;KAAY;KAAe;KACtD;KAAgB;KAAiB;KAClC,CAAC;UACG;AACL,kBAAc;AACd,sBAAkB,yCAAyC,mBAAmB,UAAU,WAAW,iCAAiC,mBAAmB,sCAAsC,WAAW;;GAI1M,IAAI,aAAyB,OAAO,cAAc;AAClD,OAAI,aAAa,KACf,cAAa,MAAM,oBAAoB,aAAa,cAAc,OAAO,YAAY,YAAY,gBAAgB,WAAW;GAG9H,MAAM,WAAW,CAAC,iBAAiB,KAAK,QAAQ,CAAC,OAAO,QAAQ;AAChE,UAAO;IACL,QAAQ;IACR,QAAQ;IACR;IACA,cAAc;IACd,aAAa;IACb,GAAI,SAAS,SAAS,IAAI,EAAE,SAAS,SAAS,KAAK,IAAI,EAAE,GAAG,EAAE;IAC/D;;EAGH,MAAM,UAAU;AACd,OAAI;AACF,UAAM,IAAI,IAAI;KAAC;KAAY;KAAU;KAAc;KAAU,CAAC;WACxD;AAYR,OAAI,CAAC,iBAAiB,EADO,eAAe,MAAM,CAAC,uBAEjD,OAAM,iBAAiB,KAAK,OAAO;;EAGxC;;AAGH,eAAsB,YACpB,aACA,YAC4B;CAC5B,MAAM,MAAM,UAAU,YAAY;CAClC,MAAM,SAAS,MAAM,WAAW,YAAY;CAC5C,MAAM,aAAa,QAAQ,IAAI,yBAAyB;CAGxD,MAAM,iBAAiB,MAAM,IAAI,IAAI,CAAC,UAAU,iBAAiB,CAAC,CAAC,YAAY,GAAG,EAAE,MAAM;CAC1F,MAAM,aAAa,MAAM,kBAAkB,KAAK,QAAQ;EAAE;EAAY;EAAe,CAAC;CACtF,MAAM,iBAAiB,kBAAkB;AAGzC,OAAM,oBAAoB,YAAY;CAGtC,IAAI,YAAY;AAChB,KAAI;AAEF,eADgB,MAAM,IAAI,YAAY,EAClB,MAAK,MAAK,EAAE,SAAS,WAAW;SAC9C;AACN,cAAY;;AAMd,KAAI,WAAW;EACb,MAAM,MAAM,WAAW,aAAa,mBAAmB;AACvD,QAAM,QAAQ,IAAI,CAChB,IAAI,MAAM,YAAY,WAAW,CAAC,YAAY,GAAG,EACjD,IAAI,MAAM,YAAY,mBAAmB,CAAC,YAAY,GAAG,CAC1D,CAAC;;CAIJ,MAAM,eAAe,KAAK,QAAQ,EAAE,YAAY,YAAY,GAAG;AAC/D,OAAM,IAAI,IAAI;EAAC;EAAY;EAAO;EAAc;EAAmB,CAAC;CAIpE,MAAM,QAAQ,UAAU,cAAc,EAAE,QAAQ,cAAc,EAAE,CAAC;AAEjE,KAAI;AAOF,MAAI;AACF,SAAM,MAAM,MAAM,CAAC,YAAY,YAAY,CAAC;UACtC;AACN,OAAI;AAAE,UAAM,MAAM,MAAM,CAAC,UAAU,CAAC;WAAS;AAC7C,OAAI,UACF,KAAI;AACF,UAAM,MAAM,MAAM,CAAC,GAAG,WAAW,GAAG,cAAc,YAAY,CAAC;WACzD;AACN,QAAI;AAAE,WAAM,MAAM,MAAM,CAAC,UAAU,CAAC;YAAS;;;AAInD,MAAI,UACF,KAAI;AACF,SAAM,MAAM,MAAM,CAAC,GAAG,WAAW,GAAG,sBAAsB,YAAY,CAAC;UACjE;AACN,OAAI;AAAE,UAAM,MAAM,MAAM,CAAC,UAAU,CAAC;WAAS;;AAKjD,MAAI;AACF,SAAM,MAAM,MAAM,CAAC,YAAY,YAAY,CAAC;UACtC;AACN,OAAI;AAAE,UAAM,MAAM,MAAM,CAAC,UAAU,CAAC;WAAS;AAC7C,SAAM,OAAO,uBAAO,IAAI,MACtB,uCAAuC,WAAW,UAAU,mBAAmB,qHAGhF,EAAE;IACD,MAAM;IACN,YAAY;IACZ,kBAAkB,gBAAgB,mBAAmB,gBAAgB;IACtE,CAAC;;AAMJ,QAAM,+BAA+B,OAAO,cAAc;GAAE,MAAM;GAAqB,OAAO;GAAK,CAAC;EAGpG,MAAM,CAAC,gBAAgB,iBAAiB,sBAAsB,MAAM,QAAQ,IAAI;GAC9E,MAAM,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,MAAK,MAAK,EAAE,MAAM,CAAC;GACpD,IAAI,IAAI,CAAC,aAAa,WAAW,CAAC,CAAC,MAAK,MAAK,EAAE,MAAM,CAAC;GACtD,IAAI,QAAQ;GACb,CAAC;EACF,MAAM,yBAAyB,IAAI,IAAI,mBAAmB,MAAM,KAAI,MAAK,EAAE,KAAK,CAAC;EAQjF,IAAI,OAAmB;GAAE,QAAQ,EAAE;GAAE,SAAS,EAAE;GAAE;EAClD,IAAI;EACJ,IAAI;AACJ,MAAI,MAAM,WAAW,KAAK,iBAAiB,eAAe,EAAE;AAC1D,iBAAc;AAEd,UAAO,MAAM,YAAY,KAAK;IAC5B;IAAa;IAAc;IAAY;IAAe;IACtD;IAAgB;IAAiB;IAClC,CAAC;SACG;AACL,iBAAc;AACd,qBAAkB,WAAW,WAAW,oBAAoB,mBAAmB,UAAU,WAAW,iCAAiC,mBAAmB,sCAAsC,WAAW;;EAI3M,MAAM,OAAO,WAAW,OAAO,CAAC;EAChC,IAAI,aAAyB,OAAO,cAAc;AAClD,MAAI,aAAa,KACf,cAAa,MAAM,oBAAoB,aAAa,cAAc,OAAO,YAAY,YAAY,gBAAgB,WAAW;AAI9H,QAAM,iBAAiB,KAAK,WAAW;EAKvC,IAAI;AACJ,MAAI,UACF,UAAS,MAAM,mBAAmB,aAAa,YAAY,EAAE,QAAQ,CAAC;EAGxE,MAAM,WAAW,CAAC,iBAAiB,KAAK,QAAQ,CAAC,OAAO,QAAQ;AAChE,SAAO;GACL,QAAQ;GACR,QAAQ;GACR;GACA,cAAc;GACd,aAAa;GACb,GAAI,SAAS,SAAS,IAAI,EAAE,SAAS,SAAS,KAAK,IAAI,EAAE,GAAG,EAAE;GAC9D,GAAI,SAAS,EAAE,QAAQ,GAAG,EAAE;GAC7B;WACO;AAER,MAAI;AACF,SAAM,IAAI,IAAI;IAAC;IAAY;IAAU;IAAc;IAAU,CAAC;UACxD;;;AAMZ,SAAgB,gBAAgB,OAAe,QAAgB,QAAyB;CACtF,MAAM,KAAK,iBAAiB;CAC5B,MAAM,QAAQ;EAAC;EAAM;EAAO;EAAO;AACnC,KAAI,OAAQ,OAAM,KAAK,OAAO;AAC9B,OAAM,KAAK,GAAG;AACd,QAAO,MAAM,KAAK,IAAI;;;;;;;;;;;;;;;AAgBxB,eAAe,YAAY,KAAgB,OASnB;AACtB,OAAM,IAAI,IAAI;EAAC;EAAc,cAAc,MAAM;EAAc,MAAM;EAAe,CAAC;AAErF,KAAI,CAAC,MAAM,gBAAgB;EACzB,MAAM,QAAQ,MAAM,gBAAgB,IAAI,MAAM,cAAc,KAAK;AACjE,SAAO;GACL,QAAQ,EAAE;GACV,SAAS,EAAE;GACX,SAAS,sBAAsB,mBAAmB,SAAS,MAAM,WAAW,6BAA6B,MAAM,6CAA6C,MAAM,WAAW;GAC9K;;AAKH,KAAI;AACF,QAAM,IAAI,IAAI,CAAC,aAAa,OAAO,CAAC;SAC9B;AAEN,MAAI;AAAE,SAAM,IAAI,IAAI,CAAC,SAAS,OAAO,CAAC;UAAS;;AAOjD,QAAO,cAAc,MAAM,aAAa,MAAM,cAAc,MAAM,gBAAgB,MAAM,iBAAiB,MAAM,uBAAuB;;;;;;;;AASxI,eAAsB,WAAW,KAAgB,UAAkB,YAAsC;AACvG,KAAI;AAEF,SADc,QAAQ,MAAM,IAAI,IAAI;GAAC;GAAY;GAAW;GAAU,IAAI;GAAa,CAAC,EAAE,MAAM,CAAC,KAChF;SACX;AACN,SAAO;;;;;;;;;;;;;;AAeX,eAAsB,oBACpB,aACA,cACA,OACA,YACA,YACA,cACqB;CACrB,MAAM,MAAM,WAAW,aAAa,mBAAmB;CACvD,IAAI,UAAsB;AAC1B,KAAI;AACF,QAAM,IAAI,KAAK,YAAY,mBAAmB;SACxC;AACN,MAAI;AACF,SAAM,WAAW,cAAc,mBAAmB,CAAC,MAAM,YAAY,mBAAmB;AACxF,SAAM,MAAM,MAAM,CAAC,GAAG,WAAW,GAAG,sBAAsB,YAAY,CAAC;AACvE,SAAM,IAAI,KAAK,YAAY,mBAAmB;UACxC;AACN,OAAI;AAAE,UAAM,MAAM,MAAM,CAAC,UAAU,CAAC;WAAS;AAC7C,aAAU;;;AAGd,KAAI,aACF,KAAI;AACF,QAAM,IAAI,KAAK,YAAY,WAAW;SAChC;AAIV,QAAO;;;;;;;;AAST,eAAe,iBAAiB,KAAgB,QAA+B;AAC7E,KAAI,CAAC,UAAU,WAAW,mBAAoB;AAC9C,KAAI;AACF,QAAM,IAAI,IAAI;GAAC;GAAU;GAAM;GAAO,CAAC;SACjC;;;;;;;;;AAYV,eAAe,+BACb,OACA,cACA,eACe;AACf,OAAM,aAAa,cAAc,cAAc;AAC/C,OAAM,MAAM,IAAI,4BAA4B;AAC5C,KAAI;AACF,QAAM,MAAM,OAAO,iCAAiC,EAAE,eAAe,MAAM,CAAC;SACtE"}

package/dist/{validator-Bz3jnSnb.mjs → validator-S19GHR4V.mjs}

@@ -1,7 +1,7 @@
-import { A as contentDirPath, M as documentFilePath, N as metaFilePath, S as resolveLocaleStrategy, c as inferTitleField, d as readModel, f as titleFieldIssues, j as contentFilePath, k as LocalReader, l as legacyFieldNames, p as titleFieldOptions, u as listModels, v as parseFrontmatter, w as serializeFrontmatter } from "./model-manager-BYF2z7qC.mjs";
+import { A as contentDirPath, M as documentFilePath, N as metaFilePath, S as resolveLocaleStrategy, c as inferTitleField, d as readModel, f as titleFieldIssues, j as contentFilePath, k as LocalReader, l as legacyFieldNames, p as titleFieldOptions, u as listModels, v as parseFrontmatter, w as serializeFrontmatter } from "./model-manager-D0VztE8M.mjs";
 import { c as writeText, s as writeJson } from "./fs-BFTuXbbw.mjs";
 import { a as writeMeta, r as mergeEntryMeta } from "./meta-manager-CSpKtjnP.mjs";
-import { t as readConfig } from "./config-BLwZtwlI.mjs";
+import { t as readConfig } from "./config-BnNYu128.mjs";
 import { join } from "node:path";
 import { rm } from "node:fs/promises";
 import { MODEL_FIELD_ORDER, describeModelLocaleScope, detectSecrets, resolveModelLocales, validateFieldValue, validateModelLocales } from "@contentrain/types";
@@ -924,7 +924,18 @@ async function validateDocumentModel(reader, projectRoot, model, config, issues,
 				continue;
 			}
 			entriesChecked++;
-			const { frontmatter, body } = parseFrontmatter(raw);
+			const { frontmatter, body, preserved } = parseFrontmatter(raw);
+			for (const block of preserved?.blocks ?? []) {
+				if (block.key === void 0) continue;
+				issues.push({
+					severity: "warning",
+					model: model.id,
+					locale,
+					slug,
+					field: block.key,
+					message: `Frontmatter key "${block.key}" is in a shape Contentrain does not read (a nested map, a block value, or a name with a space or a non-ASCII letter). It is kept exactly as written when the document is saved, but it is not validated.`
+				});
+			}
 			scanUndeclaredFieldsForSecrets(frontmatter, {
 				...model.fields,
 				body: true
@@ -954,7 +965,7 @@ async function validateDocumentModel(reader, projectRoot, model, config, issues,
 				});
 				if (fix && projectRoot) {
 					const cleaned = Object.fromEntries(Object.entries(frontmatter).filter(([k]) => !leaked.includes(k)));
-					await writeText(join(projectRoot, filePath), serializeFrontmatter(cleaned, body));
+					await writeText(join(projectRoot, filePath), serializeFrontmatter(cleaned, body, preserved));
 					fixed++;
 				}
 			}
@@ -1111,4 +1122,4 @@ async function validateProject(input, options) {
 //#endregion
 export { validateContent as i, validateScheduleFields as n, checkRelationIntegrity as r, validateProject as t };
 
-//# sourceMappingURL=validator-Bz3jnSnb.mjs.map
+//# sourceMappingURL=validator-S19GHR4V.mjs.map