canopycms-cdk 0.0.60 → 0.0.61-int.74

package/worker/dist/index.js

@@ -814,10 +814,10 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault2(require_src());
     var log6 = debug_1.default("@kwsites/file-exists");
-    function check(path12, isFile, isDirectory) {
-      log6(`checking %s`, path12);
+    function check(path13, isFile, isDirectory) {
+      log6(`checking %s`, path13);
       try {
-        const stat = fs_1.statSync(path12);
+        const stat = fs_1.statSync(path13);
         if (stat.isFile() && isFile) {
           log6(`[OK] path represents a file`);
           return true;
@@ -837,8 +837,8 @@ var require_src2 = __commonJS({
         throw e5;
       }
     }
-    function exists2(path12, type = exports.READABLE) {
-      return check(path12, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path13, type = exports.READABLE) {
+      return check(path13, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -953,14 +953,14 @@ var require_polyfills = __commonJS({
       fs9.fstatSync = statFixSync(fs9.fstatSync);
       fs9.lstatSync = statFixSync(fs9.lstatSync);
       if (fs9.chmod && !fs9.lchmod) {
-        fs9.lchmod = function(path12, mode, cb) {
+        fs9.lchmod = function(path13, mode, cb) {
           if (cb) process.nextTick(cb);
         };
         fs9.lchmodSync = function() {
         };
       }
       if (fs9.chown && !fs9.lchown) {
-        fs9.lchown = function(path12, uid, gid, cb) {
+        fs9.lchown = function(path13, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
         fs9.lchownSync = function() {
@@ -1027,9 +1027,9 @@ var require_polyfills = __commonJS({
         };
       })(fs9.readSync);
       function patchLchmod(fs10) {
-        fs10.lchmod = function(path12, mode, callback) {
+        fs10.lchmod = function(path13, mode, callback) {
           fs10.open(
-            path12,
+            path13,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
             function(err, fd) {
@@ -1045,8 +1045,8 @@ var require_polyfills = __commonJS({
             }
           );
         };
-        fs10.lchmodSync = function(path12, mode) {
-          var fd = fs10.openSync(path12, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
+        fs10.lchmodSync = function(path13, mode) {
+          var fd = fs10.openSync(path13, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
@@ -1067,8 +1067,8 @@ var require_polyfills = __commonJS({
       }
       function patchLutimes(fs10) {
         if (constants2.hasOwnProperty("O_SYMLINK") && fs10.futimes) {
-          fs10.lutimes = function(path12, at, mt, cb) {
-            fs10.open(path12, constants2.O_SYMLINK, function(er, fd) {
+          fs10.lutimes = function(path13, at, mt, cb) {
+            fs10.open(path13, constants2.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
@@ -1080,8 +1080,8 @@ var require_polyfills = __commonJS({
               });
             });
           };
-          fs10.lutimesSync = function(path12, at, mt) {
-            var fd = fs10.openSync(path12, constants2.O_SYMLINK);
+          fs10.lutimesSync = function(path13, at, mt) {
+            var fd = fs10.openSync(path13, constants2.O_SYMLINK);
             var ret;
             var threw = true;
             try {
@@ -1199,11 +1199,11 @@ var require_legacy_streams = __commonJS({
         ReadStream,
         WriteStream
       };
-      function ReadStream(path12, options) {
-        if (!(this instanceof ReadStream)) return new ReadStream(path12, options);
+      function ReadStream(path13, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path13, options);
         Stream.call(this);
         var self2 = this;
-        this.path = path12;
+        this.path = path13;
         this.fd = null;
         this.readable = true;
         this.paused = false;
@@ -1248,10 +1248,10 @@ var require_legacy_streams = __commonJS({
           self2._read();
         });
       }
-      function WriteStream(path12, options) {
-        if (!(this instanceof WriteStream)) return new WriteStream(path12, options);
+      function WriteStream(path13, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path13, options);
         Stream.call(this);
-        this.path = path12;
+        this.path = path13;
         this.fd = null;
         this.writable = true;
         this.flags = "w";
@@ -1394,14 +1394,14 @@ var require_graceful_fs = __commonJS({
       fs10.createWriteStream = createWriteStream;
       var fs$readFile = fs10.readFile;
       fs10.readFile = readFile;
-      function readFile(path12, options, cb) {
+      function readFile(path13, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$readFile(path12, options, cb);
-        function go$readFile(path13, options2, cb2, startTime) {
-          return fs$readFile(path13, options2, function(err) {
+        return go$readFile(path13, options, cb);
+        function go$readFile(path14, options2, cb2, startTime) {
+          return fs$readFile(path14, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path13, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$readFile, [path14, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1411,14 +1411,14 @@ var require_graceful_fs = __commonJS({
       }
       var fs$writeFile = fs10.writeFile;
       fs10.writeFile = writeFile;
-      function writeFile(path12, data2, options, cb) {
+      function writeFile(path13, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$writeFile(path12, data2, options, cb);
-        function go$writeFile(path13, data3, options2, cb2, startTime) {
-          return fs$writeFile(path13, data3, options2, function(err) {
+        return go$writeFile(path13, data2, options, cb);
+        function go$writeFile(path14, data3, options2, cb2, startTime) {
+          return fs$writeFile(path14, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path13, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$writeFile, [path14, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1429,14 +1429,14 @@ var require_graceful_fs = __commonJS({
       var fs$appendFile = fs10.appendFile;
       if (fs$appendFile)
         fs10.appendFile = appendFile;
-      function appendFile(path12, data2, options, cb) {
+      function appendFile(path13, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$appendFile(path12, data2, options, cb);
-        function go$appendFile(path13, data3, options2, cb2, startTime) {
-          return fs$appendFile(path13, data3, options2, function(err) {
+        return go$appendFile(path13, data2, options, cb);
+        function go$appendFile(path14, data3, options2, cb2, startTime) {
+          return fs$appendFile(path14, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path13, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$appendFile, [path14, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1467,31 +1467,31 @@ var require_graceful_fs = __commonJS({
       var fs$readdir = fs10.readdir;
       fs10.readdir = readdir;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir(path12, options, cb) {
+      function readdir(path13, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path13, options2, cb2, startTime) {
-          return fs$readdir(path13, fs$readdirCallback(
-            path13,
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path14, options2, cb2, startTime) {
+          return fs$readdir(path14, fs$readdirCallback(
+            path14,
             options2,
             cb2,
             startTime
           ));
-        } : function go$readdir2(path13, options2, cb2, startTime) {
-          return fs$readdir(path13, options2, fs$readdirCallback(
-            path13,
+        } : function go$readdir2(path14, options2, cb2, startTime) {
+          return fs$readdir(path14, options2, fs$readdirCallback(
+            path14,
             options2,
             cb2,
             startTime
           ));
         };
-        return go$readdir(path12, options, cb);
-        function fs$readdirCallback(path13, options2, cb2, startTime) {
+        return go$readdir(path13, options, cb);
+        function fs$readdirCallback(path14, options2, cb2, startTime) {
           return function(err, files) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
               enqueue([
                 go$readdir,
-                [path13, options2, cb2],
+                [path14, options2, cb2],
                 err,
                 startTime || Date.now(),
                 Date.now()
@@ -1562,7 +1562,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      function ReadStream(path12, options) {
+      function ReadStream(path13, options) {
         if (this instanceof ReadStream)
           return fs$ReadStream.apply(this, arguments), this;
         else
@@ -1582,7 +1582,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function WriteStream(path12, options) {
+      function WriteStream(path13, options) {
         if (this instanceof WriteStream)
           return fs$WriteStream.apply(this, arguments), this;
         else
@@ -1600,22 +1600,22 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path12, options) {
-        return new fs10.ReadStream(path12, options);
+      function createReadStream(path13, options) {
+        return new fs10.ReadStream(path13, options);
       }
-      function createWriteStream(path12, options) {
-        return new fs10.WriteStream(path12, options);
+      function createWriteStream(path13, options) {
+        return new fs10.WriteStream(path13, options);
       }
       var fs$open = fs10.open;
       fs10.open = open;
-      function open(path12, flags, mode, cb) {
+      function open(path13, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
-        return go$open(path12, flags, mode, cb);
-        function go$open(path13, flags2, mode2, cb2, startTime) {
-          return fs$open(path13, flags2, mode2, function(err, fd) {
+        return go$open(path13, flags, mode, cb);
+        function go$open(path14, flags2, mode2, cb2, startTime) {
+          return fs$open(path14, flags2, mode2, function(err, fd) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path13, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$open, [path14, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -2144,7 +2144,7 @@ var require_mtime_precision = __commonJS({
 var require_lockfile = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
-    var path12 = __require("path");
+    var path13 = __require("path");
     var fs9 = require_graceful_fs();
     var retry2 = require_retry2();
     var onExit = require_signal_exit();
@@ -2155,7 +2155,7 @@ var require_lockfile = __commonJS({
     }
     function resolveCanonicalPath(file, options, callback) {
       if (!options.realpath) {
-        return callback(null, path12.resolve(file));
+        return callback(null, path13.resolve(file));
       }
       options.fs.realpath(file, callback);
     }
@@ -3785,15 +3785,15 @@ var require_dist_node9 = __commonJS({
         octokit.log.debug("request", options);
         const start = Date.now();
         const requestOptions = octokit.request.endpoint.parse(options);
-        const path12 = requestOptions.url.replace(options.baseUrl, "");
+        const path13 = requestOptions.url.replace(options.baseUrl, "");
         return request(options).then((response) => {
           octokit.log.info(
-            `${requestOptions.method} ${path12} - ${response.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path13} - ${response.status} in ${Date.now() - start}ms`
           );
           return response;
         }).catch((error2) => {
           octokit.log.info(
-            `${requestOptions.method} ${path12} - ${error2.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path13} - ${error2.status} in ${Date.now() - start}ms`
           );
           throw error2;
         });
@@ -7887,7 +7887,7 @@ var require_dist_node13 = __commonJS({
     ];
     function routeMatcher(paths) {
       const regexes = paths.map(
-        (path12) => path12.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
+        (path13) => path13.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
       );
       const regex2 = `^(?:${regexes.map((r6) => `(?:${r6})`).join("|")})[^/]*$`;
       return new RegExp(regex2, "i");
@@ -9080,9 +9080,9 @@ var init_createPaginator = __esm({
       command = withCommand(command) ?? command;
       return await client.send(command, ...args);
     };
-    get = (fromObject, path12) => {
+    get = (fromObject, path13) => {
       let cursor2 = fromObject;
-      const pathComponents = path12.split(".");
+      const pathComponents = path13.split(".");
       for (const step of pathComponents) {
         if (!cursor2 || typeof cursor2 !== "object") {
           return void 0;
@@ -10100,12 +10100,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             const password = request.password ?? "";
             auth = `${username}:${password}`;
           }
-          let path12 = request.path;
+          let path13 = request.path;
           if (queryString) {
-            path12 += `?${queryString}`;
+            path13 += `?${queryString}`;
           }
           if (request.fragment) {
-            path12 += `#${request.fragment}`;
+            path13 += `#${request.fragment}`;
           }
           let hostname = request.hostname ?? "";
           if (hostname[0] === "[" && hostname.endsWith("]")) {
@@ -10117,7 +10117,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: request.headers,
             host: hostname,
             method: request.method,
-            path: path12,
+            path: path13,
             port: request.port,
             agent,
             auth
@@ -10400,16 +10400,16 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             reject(err);
           };
           const queryString = querystringBuilder.buildQueryString(query || {});
-          let path12 = request.path;
+          let path13 = request.path;
           if (queryString) {
-            path12 += `?${queryString}`;
+            path13 += `?${queryString}`;
           }
           if (request.fragment) {
-            path12 += `#${request.fragment}`;
+            path13 += `#${request.fragment}`;
           }
           const req = session.request({
             ...request.headers,
-            [http2.constants.HTTP2_HEADER_PATH]: path12,
+            [http2.constants.HTTP2_HEADER_PATH]: path13,
             [http2.constants.HTTP2_HEADER_METHOD]: method
           });
           session.ref();
@@ -10596,13 +10596,13 @@ var require_dist_cjs14 = __commonJS({
           const abortError = buildAbortError(abortSignal);
           return Promise.reject(abortError);
         }
-        let path12 = request.path;
+        let path13 = request.path;
         const queryString = querystringBuilder.buildQueryString(request.query || {});
         if (queryString) {
-          path12 += `?${queryString}`;
+          path13 += `?${queryString}`;
         }
         if (request.fragment) {
-          path12 += `#${request.fragment}`;
+          path13 += `#${request.fragment}`;
         }
         let auth = "";
         if (request.username != null || request.password != null) {
@@ -10611,7 +10611,7 @@ var require_dist_cjs14 = __commonJS({
           auth = `${username}:${password}@`;
         }
         const { port, method } = request;
-        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path12}`;
+        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path13}`;
         const body = method === "GET" || method === "HEAD" ? void 0 : request.body;
         const requestOptions = {
           body,
@@ -12843,13 +12843,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path12, preserveJsx) {
-  if (typeof path12 === "string" && /^\.\.?\//.test(path12)) {
-    return path12.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
+function __rewriteRelativeImportExtension(path13, preserveJsx) {
+  if (typeof path13 === "string" && /^\.\.?\//.test(path13)) {
+    return path13.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d5 && (!ext || !cm) ? m5 : d5 + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path12;
+  return path13;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -13747,11 +13747,11 @@ var init_HttpBindingProtocol = __esm({
           const opTraits = translateTraits(operationSchema.traits);
           if (opTraits.http) {
             request.method = opTraits.http[0];
-            const [path12, search] = opTraits.http[1].split("?");
+            const [path13, search] = opTraits.http[1].split("?");
             if (request.path == "/") {
-              request.path = path12;
+              request.path = path13;
             } else {
-              request.path += path12;
+              request.path += path13;
             }
             const traitSearchParams = new URLSearchParams(search ?? "");
             Object.assign(query, Object.fromEntries(traitSearchParams));
@@ -14154,8 +14154,8 @@ var init_requestBuilder = __esm({
         return this;
       }
       p(memberName, labelValueProvider, uriLabel, isGreedyLabel) {
-        this.resolvePathStack.push((path12) => {
-          this.path = resolvedPath(path12, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
+        this.resolvePathStack.push((path13) => {
+          this.path = resolvedPath(path13, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
         });
         return this;
       }
@@ -14805,18 +14805,18 @@ var require_dist_cjs20 = __commonJS({
       }
     };
     var booleanEquals = (value1, value2) => value1 === value2;
-    var getAttrPathList = (path12) => {
-      const parts = path12.split(".");
+    var getAttrPathList = (path13) => {
+      const parts = path13.split(".");
       const pathList = [];
       for (const part of parts) {
         const squareBracketIndex = part.indexOf("[");
         if (squareBracketIndex !== -1) {
           if (part.indexOf("]") !== part.length - 1) {
-            throw new EndpointError(`Path: '${path12}' does not end with ']'`);
+            throw new EndpointError(`Path: '${path13}' does not end with ']'`);
           }
           const arrayIndex = part.slice(squareBracketIndex + 1, -1);
           if (Number.isNaN(parseInt(arrayIndex))) {
-            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path12}'`);
+            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path13}'`);
           }
           if (squareBracketIndex !== 0) {
             pathList.push(part.slice(0, squareBracketIndex));
@@ -14828,9 +14828,9 @@ var require_dist_cjs20 = __commonJS({
       }
       return pathList;
     };
-    var getAttr = (value, path12) => getAttrPathList(path12).reduce((acc, index) => {
+    var getAttr = (value, path13) => getAttrPathList(path13).reduce((acc, index) => {
       if (typeof acc !== "object") {
-        throw new EndpointError(`Index '${index}' in '${path12}' not found in '${JSON.stringify(value)}'`);
+        throw new EndpointError(`Index '${index}' in '${path13}' not found in '${JSON.stringify(value)}'`);
       } else if (Array.isArray(acc)) {
         return acc[parseInt(index)];
       }
@@ -14849,8 +14849,8 @@ var require_dist_cjs20 = __commonJS({
             return value;
           }
           if (typeof value === "object" && "hostname" in value) {
-            const { hostname: hostname2, port, protocol: protocol2 = "", path: path12 = "", query = {} } = value;
-            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path12}`);
+            const { hostname: hostname2, port, protocol: protocol2 = "", path: path13 = "", query = {} } = value;
+            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path13}`);
             url.search = Object.entries(query).map(([k6, v5]) => `${k6}=${v5}`).join("&");
             return url;
           }
@@ -16295,10 +16295,10 @@ ${longDate}
 ${credentialScope}
 ${utilHexEncoding.toHex(hashedRequest)}`;
       }
-      getCanonicalPath({ path: path12 }) {
+      getCanonicalPath({ path: path13 }) {
         if (this.uriEscapePath) {
           const normalizedPathSegments = [];
-          for (const pathSegment of path12.split("/")) {
+          for (const pathSegment of path13.split("/")) {
             if (pathSegment?.length === 0)
               continue;
             if (pathSegment === ".")
@@ -16309,11 +16309,11 @@ ${utilHexEncoding.toHex(hashedRequest)}`;
               normalizedPathSegments.push(pathSegment);
             }
           }
-          const normalizedPath = `${path12?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path12?.endsWith("/") ? "/" : ""}`;
+          const normalizedPath = `${path13?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path13?.endsWith("/") ? "/" : ""}`;
           const doubleEncoded = utilUriEscape.escapeUri(normalizedPath);
           return doubleEncoded.replace(/%2F/g, "/");
         }
-        return path12;
+        return path13;
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -17617,11 +17617,11 @@ var init_SmithyRpcV2CborProtocol = __esm({
           }
         }
         const { service, operation: operation2 } = (0, import_util_middleware5.getSmithyContext)(context);
-        const path12 = `/service/${service}/operation/${operation2}`;
+        const path13 = `/service/${service}/operation/${operation2}`;
         if (request.path.endsWith("/")) {
-          request.path += path12.slice(1);
+          request.path += path13.slice(1);
         } else {
-          request.path += path12;
+          request.path += path13;
         }
         return request;
       }
@@ -23266,14 +23266,14 @@ var require_readFile = __commonJS({
     var promises_1 = __require("node:fs/promises");
     exports.filePromises = {};
     exports.fileIntercept = {};
-    var readFile = (path12, options) => {
-      if (exports.fileIntercept[path12] !== void 0) {
-        return exports.fileIntercept[path12];
+    var readFile = (path13, options) => {
+      if (exports.fileIntercept[path13] !== void 0) {
+        return exports.fileIntercept[path13];
       }
-      if (!exports.filePromises[path12] || options?.ignoreCache) {
-        exports.filePromises[path12] = (0, promises_1.readFile)(path12, "utf8");
+      if (!exports.filePromises[path13] || options?.ignoreCache) {
+        exports.filePromises[path13] = (0, promises_1.readFile)(path13, "utf8");
       }
-      return exports.filePromises[path12];
+      return exports.filePromises[path13];
     };
     exports.readFile = readFile;
   }
@@ -23286,7 +23286,7 @@ var require_dist_cjs33 = __commonJS({
     var getHomeDir = require_getHomeDir();
     var getSSOTokenFilepath = require_getSSOTokenFilepath();
     var getSSOTokenFromFile = require_getSSOTokenFromFile();
-    var path12 = __require("path");
+    var path13 = __require("path");
     var types = require_dist_cjs();
     var readFile = require_readFile();
     var ENV_PROFILE = "AWS_PROFILE";
@@ -23308,9 +23308,9 @@ var require_dist_cjs33 = __commonJS({
       ...data2.default && { default: data2.default }
     });
     var ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path12.join(getHomeDir.getHomeDir(), ".aws", "config");
+    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path13.join(getHomeDir.getHomeDir(), ".aws", "config");
     var ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path12.join(getHomeDir.getHomeDir(), ".aws", "credentials");
+    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path13.join(getHomeDir.getHomeDir(), ".aws", "credentials");
     var prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/;
     var profileNameBlockList = ["__proto__", "profile __proto__"];
     var parseIni = (iniData) => {
@@ -23365,11 +23365,11 @@ var require_dist_cjs33 = __commonJS({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = path12.join(homeDir, filepath.slice(2));
+        resolvedFilepath = path13.join(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = path12.join(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = path13.join(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile.readFile(resolvedConfigFilepath, {
@@ -23408,8 +23408,8 @@ var require_dist_cjs33 = __commonJS({
       getFileRecord() {
         return readFile.fileIntercept;
       },
-      interceptFile(path13, contents) {
-        readFile.fileIntercept[path13] = Promise.resolve(contents);
+      interceptFile(path14, contents) {
+        readFile.fileIntercept[path14] = Promise.resolve(contents);
       },
       getTokenRecord() {
         return getSSOTokenFromFile.tokenIntercept;
@@ -23734,8 +23734,8 @@ var require_dist_cjs36 = __commonJS({
               return endpoint.url.href;
             }
             if ("hostname" in endpoint) {
-              const { protocol, hostname, port, path: path12 } = endpoint;
-              return `${protocol}//${hostname}${port ? ":" + port : ""}${path12}`;
+              const { protocol, hostname, port, path: path13 } = endpoint;
+              return `${protocol}//${hostname}${port ? ":" + port : ""}${path13}`;
             }
           }
           return endpoint;
@@ -31933,7 +31933,7 @@ var require_dist_cjs53 = __commonJS({
 
 // ../canopycms/src/worker/cms-worker.ts
 import fs7 from "node:fs/promises";
-import path9 from "node:path";
+import path10 from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
@@ -32524,8 +32524,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path12) {
-  return (0, import_file_exists.exists)(path12, import_file_exists.FOLDER);
+function folderExists(path13) {
+  return (0, import_file_exists.exists)(path13, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -32927,8 +32927,8 @@ function checkIsRepoRootTask() {
     commands: commands5,
     format: "utf-8",
     onError,
-    parser(path12) {
-      return /^\.(git)?$/.test(path12.trim());
+    parser(path13) {
+      return /^\.(git)?$/.test(path13.trim());
     }
   };
 }
@@ -33362,11 +33362,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path12, line, preview] = input.split(NULL);
-    paths.add(path12);
-    (results[path12] = results[path12] || []).push({
+    const [path13, line, preview] = input.split(NULL);
+    paths.add(path13);
+    (results[path13] = results[path13] || []).push({
       line: asNumber(line),
-      path: path12,
+      path: path13,
       preview
     });
   });
@@ -34130,14 +34130,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path12, text) {
+function parseInit(bare, path13, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path12, false, result[1]);
+    return new InitSummary(bare, path13, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path12, true, result[1]);
+    return new InitSummary(bare, path13, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -34148,7 +34148,7 @@ function parseInit(bare, path12, text) {
       break;
     }
   }
-  return new InitSummary(bare, path12, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path13, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -34157,9 +34157,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path12, existing, gitDir) {
+      constructor(bare, path13, existing, gitDir) {
         this.bare = bare;
-        this.path = path12;
+        this.path = path13;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -34171,7 +34171,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path12, customArgs) {
+function initTask(bare = false, path13, customArgs) {
   const commands5 = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands5)) {
     commands5.splice(1, 0, bareCommand);
@@ -34180,7 +34180,7 @@ function initTask(bare = false, path12, customArgs) {
     commands: commands5,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands5.includes("--bare"), path12, text);
+      return parseInit(commands5.includes("--bare"), path13, text);
     }
   };
 }
@@ -34995,12 +34995,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path12, index, working_dir) {
-        this.path = path12;
+      constructor(path13, index, working_dir) {
+        this.path = path13;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path12) || [null, path12, path12];
+          const detail = fromPathRegex.exec(path13) || [null, path13, path13];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -35031,14 +35031,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data2(index, workingDir, path12) {
+  function data2(index, workingDir, path13) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path12);
+      handler(result, path13);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path12, index, workingDir));
+      result.files.push(new FileStatusSummary(path13, index, workingDir));
     }
   }
 }
@@ -35389,9 +35389,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path12, write) {
+      hashObject(path13, write) {
         return this._runTask(
-          hashObjectTask(path12, write === true),
+          hashObjectTask(path13, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -35745,8 +35745,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path12 = input.trim().replace(/^["']|["']$/g, "");
-  return path12 && normalize(path12);
+  const path13 = input.trim().replace(/^["']|["']$/g, "");
+  return path13 && normalize(path13);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -36031,8 +36031,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path12) {
-  return subModuleTask(["add", repo, path12]);
+function addSubModuleTask(repo, path13) {
+  return subModuleTask(["add", repo, path13]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -36346,8 +36346,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path12, then) {
-      return this._runTask(addSubModuleTask2(repo, path12), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path13, then) {
+      return this._runTask(addSubModuleTask2(repo, path13), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -37780,8 +37780,8 @@ function getErrorMap() {
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/parseUtil.js
 var makeIssue = (params) => {
-  const { data: data2, path: path12, errorMaps, issueData } = params;
-  const fullPath = [...path12, ...issueData.path || []];
+  const { data: data2, path: path13, errorMaps, issueData } = params;
+  const fullPath = [...path13, ...issueData.path || []];
   const fullIssue = {
     ...issueData,
     path: fullPath
@@ -37897,11 +37897,11 @@ var errorUtil;
 
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/types.js
 var ParseInputLazyPath = class {
-  constructor(parent, value, path12, key) {
+  constructor(parent, value, path13, key) {
     this._cachedPath = [];
     this.parent = parent;
     this.data = value;
-    this._path = path12;
+    this._path = path13;
     this._key = key;
   }
   get path() {
@@ -41589,6 +41589,13 @@ function getErrorMessage2(err) {
   }
   return String(err);
 }
+function redactCredentials(message) {
+  let result = message;
+  result = result.replace(/(:\/\/)[^/\s@]+@/g, "$1***@");
+  result = result.replace(/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{8,}/g, "***");
+  result = result.replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/g, "$1***");
+  return result;
+}
 function isNodeError(err) {
   return err instanceof Error && "code" in err;
 }
@@ -41881,7 +41888,15 @@ var BranchRegistry = class {
           continue;
         }
         const branchRoot = path5.join(this.root, entry.name);
-        const meta = await BranchMetadataFileManager.loadOnly(branchRoot);
+        let meta;
+        try {
+          meta = await BranchMetadataFileManager.loadOnly(branchRoot);
+        } catch (err) {
+          console.warn(
+            `CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage2(err)}`
+          );
+          continue;
+        }
         if (meta) {
           branches.push({
             branch: meta.branch,
@@ -41908,7 +41923,7 @@ function isValidContentId(id) {
   return CONTENT_ID_PATTERN.test(id);
 }
 
-// ../canopycms/src/paths/branch.ts
+// ../canopycms/src/paths/branch-name.ts
 function sanitizeBranchName(branchName) {
   const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
   const squashed = replaced.replace(/-+/g, "-");
@@ -42054,6 +42069,7 @@ async function withOccFileLock(filePath, fn) {
     return await fn();
   } finally {
     await release().catch((err) => {
+      if (isNodeError(err) && err.code === "ENOENT") return;
       log3.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage2(err) });
     });
   }
@@ -42069,6 +42085,14 @@ var BranchMetadataConflictError = class extends Error {
     this.name = "BranchMetadataConflictError";
   }
 };
+var BranchMetadataCorruptError = class extends Error {
+  constructor(branchRoot, cause) {
+    super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
+    this.name = "BranchMetadataCorruptError";
+    this.branchRoot = branchRoot;
+    this.parseCause = cause;
+  }
+};
 var BranchMetadataFileManager = class _BranchMetadataFileManager {
   constructor(branchRoot, baseRoot, options) {
     this.branchRoot = path7.resolve(branchRoot);
@@ -42081,7 +42105,8 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
    */
   static async loadOnly(branchRoot) {
-    const filePath = path7.join(path7.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
+    const resolvedRoot = path7.resolve(branchRoot);
+    const filePath = path7.join(resolvedRoot, BRANCH_META_DIR, BRANCH_META_FILE);
     try {
       const raw = await fs6.readFile(filePath, "utf8");
       return JSON.parse(raw);
@@ -42089,6 +42114,9 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
       if (isNotFoundError2(err)) {
         return null;
       }
+      if (err instanceof SyntaxError) {
+        throw new BranchMetadataCorruptError(resolvedRoot, err.message);
+      }
       throw err;
     }
   }
@@ -42343,10 +42371,28 @@ async function invalidateBranchContentCaches(root) {
   invalidateContentIndexesForRoot(root);
 }
 
+// ../canopycms/src/worker/worker-status.ts
+import path9 from "node:path";
+var WORKER_STATUS_FILE = "worker-status.json";
+async function writeWorkerStatus(taskDir, report) {
+  const filePath = path9.join(taskDir, WORKER_STATUS_FILE);
+  const stamped = { ...report, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await atomicWriteFile(filePath, JSON.stringify(stamped, null, 2));
+}
+
 // ../canopycms/src/worker/cms-worker.ts
 var DEFAULT_TASK_TIMEOUT = 6e4;
 var DEFAULT_MAX_RETRIES = 3;
 var DEFAULT_LOCK_STALE_MS = 6e4;
+var TRASH_RETENTION_MS = 30 * 24 * 60 * 6e4;
+var TRASH_DIR_STAMP_RE = /-(\d{8}T\d{6}Z)$/;
+function parseTrashStamp(stamp) {
+  const match2 = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(stamp);
+  if (!match2) return null;
+  const [, year2, month, day, hour, minute, second] = match2;
+  const date2 = /* @__PURE__ */ new Date(`${year2}-${month}-${day}T${hour}:${minute}:${second}.000Z`);
+  return Number.isNaN(date2.getTime()) ? null : date2;
+}
 var PermanentTaskError = class extends Error {
 };
 function isPermanentTaskFailure(err) {
@@ -42406,21 +42452,37 @@ var CmsWorker = class {
     this.releaseLockFn = null;
     this.log = cmsTaskQueueLogger;
     this.octokit = createCanopyOctokit({ auth: config.githubToken });
-    this.taskDir = path9.join(config.workspacePath, ".tasks");
-    this.remoteGitPath = path9.join(config.workspacePath, "remote.git");
-    this.contentBranchesPath = path9.join(config.workspacePath, "content-branches");
+    this.taskDir = path10.join(config.workspacePath, ".tasks");
+    this.remoteGitPath = path10.join(config.workspacePath, "remote.git");
+    this.contentBranchesPath = path10.join(config.workspacePath, "content-branches");
     this.baseBranch = config.baseBranch ?? "main";
     this.sanitizedBaseBranch = sanitizeBranchName(this.baseBranch);
     this.maxTasksPerCycle = config.maxTasksPerCycle ?? 10;
     this.taskTimeoutMs = config.taskTimeoutMs ?? DEFAULT_TASK_TIMEOUT;
     this.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;
-    this.lockFilePath = path9.join(config.workspacePath, ".tasks", ".worker-lock");
+    this.lockFilePath = path10.join(config.workspacePath, ".tasks", ".worker-lock");
     this.lockStaleMs = config.lockStaleMs ?? DEFAULT_LOCK_STALE_MS;
     this.contentRoot = config.contentRoot ?? "content";
   }
+  /**
+   * Lazily get (and initialize if necessary) this worker's self-reported
+   * status object (PR-W1). Normally set once, up front, at the top of
+   * start(). The lazy fallback here covers two cases: (1) something in
+   * start() reaching a status-write point before that normal init runs
+   * (defensive -- see start()'s catch), and (2) unit tests that exercise
+   * syncGit()/processTaskQueue() directly without calling start() first.
+   */
+  ensureStatusReport() {
+    if (!this.statusReport) {
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      this.statusReport = { version: 1, startedAt: now, updatedAt: now };
+    }
+    return this.statusReport;
+  }
   async start() {
     this.running = true;
     console.log("CMS Worker starting...");
+    this.ensureStatusReport();
     await this.acquireLock();
     try {
       await this.ensureRemoteGit();
@@ -42434,6 +42496,23 @@ var CmsWorker = class {
       }
       await Promise.allSettled(initialTasks);
     } catch (err) {
+      const report = this.ensureStatusReport();
+      report.lastFatalError = {
+        // [HIGH-1] Persisted to worker-status.json and served to the
+        // browser by the admin panel -- must never carry the bot token
+        // that a poisoned/failed git URL (buildGitHubUrl()) can embed.
+        message: redactCredentials(getErrorMessage2(err)),
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        phase: "startup"
+      };
+      try {
+        await writeWorkerStatus(this.taskDir, report);
+      } catch (writeErr) {
+        console.error(
+          "Failed to write worker status on startup failure:",
+          getErrorMessage2(writeErr)
+        );
+      }
       await this.releaseLock();
       throw err;
     }
@@ -42640,15 +42719,16 @@ var CmsWorker = class {
       } catch (err) {
         const message = getErrorMessage2(err);
         console.error(`Task ${task.id} (${task.action}) failed:`, message);
+        const persistedMessage = redactCredentials(message);
         const permanent = isPermanentTaskFailure(err);
         const retryCount = task.retryCount ?? 0;
         const maxRetries = task.maxRetries ?? this.maxRetries;
         if (!permanent && retryCount < maxRetries) {
-          await retryTask(this.taskDir, task.id, message, this.log);
+          await retryTask(this.taskDir, task.id, persistedMessage, this.log);
           console.log(`  Will retry (attempt ${retryCount + 1}/${maxRetries})`);
         } else {
-          await failTask(this.taskDir, task.id, message, this.log);
-          await this.updateBranchMetadataOnFailure(task, message);
+          await failTask(this.taskDir, task.id, persistedMessage, this.log);
+          await this.updateBranchMetadataOnFailure(task, persistedMessage);
           console.error(
             permanent ? "  Permanently failed (non-retryable error)" : `  Permanently failed after ${maxRetries} retries`
           );
@@ -42656,6 +42736,13 @@ var CmsWorker = class {
       }
       processed++;
     }
+    if (processed > 0) {
+      const report = this.ensureStatusReport();
+      report.lastTaskCycleAt = (/* @__PURE__ */ new Date()).toISOString();
+      await writeWorkerStatus(this.taskDir, report).catch(
+        (writeErr) => console.error("Failed to write worker status:", getErrorMessage2(writeErr))
+      );
+    }
   }
   /**
    * Execute a task bounded by taskTimeoutMs (DEP-H1). Two layers:
@@ -42725,13 +42812,19 @@ var CmsWorker = class {
       }
       case "push-and-create-or-update-pr": {
         const branch = requireString(payload2, "branch");
+        const base = optionalString(payload2, "baseBranch", this.baseBranch);
+        if (sanitizeBranchName(branch) === this.sanitizedBaseBranch) {
+          throw new PermanentTaskError(
+            `Refusing to push-and-create-or-update-pr for "${branch}": it is the base branch -- submitting the base branch is never valid`
+          );
+        }
         await this.pushBranchToGitHub(branch);
         const result = await createOrUpdatePullRequest({
           octokit: this.octokit,
           owner: this.config.githubOwner,
           repo: this.config.githubRepo,
           head: branch,
-          base: optionalString(payload2, "baseBranch", this.baseBranch),
+          base,
           title: optionalString(payload2, "title", `Submit ${branch}`),
           body: optionalString(payload2, "body", ""),
           // Content submits (api/github-sync.ts) set this; settings-branch
@@ -42791,7 +42884,7 @@ var CmsWorker = class {
   async updateBranchMetadata(task, result) {
     const branch = typeof task.payload.branch === "string" ? task.payload.branch : null;
     if (!branch) return;
-    const branchPath = path9.join(this.contentBranchesPath, branch);
+    const branchPath = path10.join(this.contentBranchesPath, branch);
     try {
       await fs7.stat(branchPath);
     } catch {
@@ -42827,7 +42920,7 @@ var CmsWorker = class {
   async updateBranchMetadataOnFailure(task, _error) {
     const branch = typeof task.payload.branch === "string" ? task.payload.branch : null;
     if (!branch) return;
-    const branchPath = path9.join(this.contentBranchesPath, branch);
+    const branchPath = path10.join(this.contentBranchesPath, branch);
     try {
       await fs7.stat(branchPath);
     } catch {
@@ -42883,6 +42976,7 @@ var CmsWorker = class {
   async syncGit() {
     if (!this.running) return;
     console.log("Syncing git...");
+    const cycleStartedAt = Date.now();
     const git = simpleGit({
       baseDir: this.remoteGitPath,
       // DEP-H1: a hung fetch/push would stall the sync loop forever
@@ -42890,12 +42984,90 @@ var CmsWorker = class {
       // is inactivity-based, so a slow-but-flowing transfer is unaffected.
       timeout: { block: this.taskTimeoutMs }
     });
-    await git.raw(["fetch", this.buildGitHubUrl(), "--prune", "+refs/heads/*:refs/heads/*"]);
-    console.log("Fetched from GitHub");
-    await this.pushSettingsBranches(git);
-    await this.refreshBaseBranchWorkspace();
-    await this.rebaseActiveBranches();
-    await cleanupOldTasks(this.taskDir, void 0, this.log);
+    try {
+      await git.raw(["fetch", this.buildGitHubUrl(), "--prune", "+refs/heads/*:refs/heads/*"]);
+      console.log("Fetched from GitHub");
+      await this.pushSettingsBranches(git);
+      await this.refreshBaseBranchWorkspace();
+      const rebaseSummary = await this.rebaseActiveBranches();
+      await cleanupOldTasks(this.taskDir, void 0, this.log);
+      const trashRemoved = await this.cleanupTrashedBranchDirs();
+      if (trashRemoved > 0) {
+        console.log(`Removed ${trashRemoved} expired trashed branch dir(s)`);
+      }
+      const report = this.ensureStatusReport();
+      report.lastGitSyncAt = (/* @__PURE__ */ new Date()).toISOString();
+      delete report.lastGitSyncError;
+      report.lastGitSync = {
+        durationMs: Date.now() - cycleStartedAt,
+        rebased: rebaseSummary.rebased,
+        skippedDirty: rebaseSummary.skippedDirty,
+        failed: rebaseSummary.failed
+      };
+      await writeWorkerStatus(this.taskDir, report).catch(
+        (writeErr) => console.error("Failed to write worker status:", getErrorMessage2(writeErr))
+      );
+    } catch (err) {
+      const report = this.ensureStatusReport();
+      report.lastGitSyncError = {
+        message: redactCredentials(getErrorMessage2(err)),
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      await writeWorkerStatus(this.taskDir, report).catch(
+        (writeErr) => console.error("Failed to write worker status:", getErrorMessage2(writeErr))
+      );
+      throw err;
+    }
+  }
+  /**
+   * [C1] Remove `.trash-*` branch directories (created by the admin purge
+   * action, api/admin-branch-health.ts) whose name-embedded stamp is older
+   * than {@link TRASH_RETENTION_MS}. Names that don't match the expected
+   * `.trash-{dirName}-{STAMP}` shape, or whose stamp fails to parse, are
+   * left alone (logged once per cycle, not per file, to avoid flooding logs
+   * if something odd accumulates) -- purge is the only writer of this
+   * naming scheme, so an unparseable name is unexpected and worth a human
+   * looking rather than a silent skip.
+   */
+  async cleanupTrashedBranchDirs() {
+    let entries;
+    try {
+      entries = await fs7.readdir(this.contentBranchesPath);
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ENOENT") return 0;
+      throw err;
+    }
+    const now = Date.now();
+    let removed = 0;
+    let loggedUnparseable = false;
+    for (const name of entries) {
+      if (!name.startsWith(".trash-")) continue;
+      const stampMatch = TRASH_DIR_STAMP_RE.exec(name);
+      const stampDate = stampMatch ? parseTrashStamp(stampMatch[1]) : null;
+      if (!stampDate) {
+        if (!loggedUnparseable) {
+          console.log(`CanopyCMS: Skipping trash dir with unparseable stamp: ${name}`);
+          loggedUnparseable = true;
+        }
+        continue;
+      }
+      if (now - stampDate.getTime() < TRASH_RETENTION_MS) continue;
+      try {
+        await fs7.rm(path10.join(this.contentBranchesPath, name), {
+          recursive: true,
+          force: true,
+          maxRetries: 3,
+          retryDelay: 100
+        });
+        removed++;
+      } catch (err) {
+        console.error(
+          `CanopyCMS: Failed to remove trashed branch dir ${name}:`,
+          getErrorMessage2(err)
+        );
+      }
+    }
+    return removed;
   }
   /**
    * Fast-forward the base branch's own working-tree clone
@@ -42919,8 +43091,8 @@ var CmsWorker = class {
    * untouched rather than force-resolved.
    */
   async refreshBaseBranchWorkspace() {
-    const basePath32 = path9.join(this.contentBranchesPath, this.sanitizedBaseBranch);
-    const gitDir = path9.join(basePath32, ".git");
+    const basePath32 = path10.join(this.contentBranchesPath, this.sanitizedBaseBranch);
+    const gitDir = path10.join(basePath32, ".git");
     try {
       let gitDirStat;
       try {
@@ -42960,13 +43132,14 @@ var CmsWorker = class {
         return;
       }
       await baseGit.fetch("origin", this.baseBranch);
+      const fetchedTip = (await baseGit.revparse(["FETCH_HEAD"])).trim();
       const behindCount = parseInt(
-        (await baseGit.raw(["rev-list", "--count", `HEAD..origin/${this.baseBranch}`])).trim(),
+        (await baseGit.raw(["rev-list", "--count", `HEAD..${fetchedTip}`])).trim(),
         10
       );
       if (behindCount > 0) {
         try {
-          await baseGit.merge(["--ff-only", `origin/${this.baseBranch}`]);
+          await baseGit.merge(["--ff-only", fetchedTip]);
         } catch (err) {
           console.error(
             `Base branch workspace (${this.baseBranch}) failed to fast-forward (diverged local history?): ${getErrorMessage2(err)}`
@@ -43041,19 +43214,65 @@ var CmsWorker = class {
       clearTimeout(timer);
     }
   }
+  /**
+   * Persist a per-branch rebase failure to branch.json (PR-W2), bounded to
+   * roughly one save per failing branch per hour: a branch stuck failing
+   * every cycle must not turn into unbounded save-per-cycle x N-failing-
+   * branches write amplification -- save() eager-regenerates the branch
+   * registry (branch-metadata.ts's invalidateRegistry(), O(branch count) EFS
+   * reads), the same concern the `alreadyClean` no-op guard above exists
+   * for.
+   *
+   * Best-effort and non-fatal like every other metadata write in this
+   * loop's error paths: a corrupt branch.json, a lock-contention error, or
+   * any other save failure here must never abort the per-branch iteration.
+   * This matters doubly at the two call sites -- one is inside the outer
+   * per-branch catch, with no further catch of its own around this call --
+   * so the whole method is wrapped, not just the load.
+   */
+  async recordRebaseFailure(branchPath, branchDir, message) {
+    const RECORD_REFRESH_MS = 60 * 60 * 1e3;
+    const redactedMessage = redactCredentials(message);
+    try {
+      const existing = await BranchMetadataFileManager.loadOnly(branchPath);
+      const prior = existing?.branch.rebaseFailure;
+      const sameMessage = prior?.message === redactedMessage;
+      const now = /* @__PURE__ */ new Date();
+      if (sameMessage) {
+        const lastAtMs = Date.parse(prior.lastAt);
+        if (!Number.isNaN(lastAtMs) && now.getTime() - lastAtMs < RECORD_REFRESH_MS) {
+          return;
+        }
+      }
+      const nowIso = now.toISOString();
+      const firstAt = sameMessage ? prior.firstAt : nowIso;
+      const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
+      await meta.save({
+        branch: {
+          name: branchDir,
+          rebaseFailure: { message: redactedMessage, firstAt, lastAt: nowIso }
+        }
+      });
+    } catch (err) {
+      console.warn(`  Failed to record rebase failure for ${branchDir}: ${getErrorMessage2(err)}`);
+    }
+  }
   async rebaseActiveBranches() {
+    const rebased = [];
+    const skippedDirty = [];
+    const failed = [];
     let branchDirs;
     try {
       branchDirs = await fs7.readdir(this.contentBranchesPath);
     } catch {
-      return;
+      return { rebased, skippedDirty, failed };
     }
     for (const branchDir of branchDirs) {
       if (branchDir.startsWith(".") || branchDir === "branches.json") {
         continue;
       }
-      const branchPath = path9.join(this.contentBranchesPath, branchDir);
-      const gitDir = path9.join(branchPath, ".git");
+      const branchPath = path10.join(this.contentBranchesPath, branchDir);
+      const gitDir = path10.join(branchPath, ".git");
       try {
         const stat = await fs7.stat(gitDir);
         if (!stat.isDirectory()) {
@@ -43092,11 +43311,13 @@ var CmsWorker = class {
         const dirtyCheck = await branchGit.status();
         if (dirtyCheck.files.length > 0) {
           console.log(`  Skipping ${branchDir}: has uncommitted changes`);
+          skippedDirty.push(branchDir);
           continue;
         }
         await branchGit.fetch("origin", this.baseBranch);
+        const fetchedBaseTip = (await branchGit.revparse(["FETCH_HEAD"])).trim();
         const behindCount = parseInt(
-          (await branchGit.raw(["rev-list", "--count", `HEAD..origin/${this.baseBranch}`])).trim(),
+          (await branchGit.raw(["rev-list", "--count", `HEAD..${fetchedBaseTip}`])).trim(),
           10
         );
         const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
@@ -43104,7 +43325,8 @@ var CmsWorker = class {
           const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
           const conflictStatus = currentMeta?.branch.conflictStatus;
           const conflictFiles = currentMeta?.branch.conflictFiles;
-          const alreadyClean = (conflictStatus === void 0 || conflictStatus === "clean") && (conflictFiles === void 0 || conflictFiles.length === 0);
+          const conflictAlreadyClean = (conflictStatus === void 0 || conflictStatus === "clean") && (conflictFiles === void 0 || conflictFiles.length === 0);
+          const alreadyClean = conflictAlreadyClean && currentMeta?.branch.rebaseFailure === void 0;
           if (alreadyClean) {
             continue;
           }
@@ -43112,7 +43334,8 @@ var CmsWorker = class {
             branch: {
               name: branchDir,
               conflictStatus: "clean",
-              conflictFiles: []
+              conflictFiles: [],
+              rebaseFailure: void 0
             }
           });
           continue;
@@ -43121,11 +43344,12 @@ var CmsWorker = class {
         const conflictedFiles = [];
         let nextAction = "start";
         let completed = false;
+        let failureReason;
         const MAX_ROUNDS = 50;
         for (let round = 0; round < MAX_ROUNDS && !completed; round++) {
           try {
             if (nextAction === "start") {
-              await branchGit.rebase([`origin/${this.baseBranch}`]);
+              await branchGit.rebase([fetchedBaseTip]);
             } else if (nextAction === "continue") {
               await branchGit.rebase(["--continue"]);
             } else {
@@ -43147,6 +43371,7 @@ var CmsWorker = class {
                 nextAction = "skip";
               } else {
                 console.warn(`  Unexpected rebase error in ${branchDir}: ${msg || "Unknown error"}`);
+                failureReason = msg || "Unknown error";
                 await branchGit.rebase(["--abort"]).catch(() => {
                 });
                 break;
@@ -43156,20 +43381,27 @@ var CmsWorker = class {
         }
         if (!completed) {
           console.warn(
-            `  Rebase of ${branchDir} did not complete within ${MAX_ROUNDS} rounds, aborting`
+            failureReason !== void 0 ? `  Rebase of ${branchDir} aborted due to unexpected error: ${failureReason}` : `  Rebase of ${branchDir} did not complete within ${MAX_ROUNDS} rounds, aborting`
           );
           await branchGit.rebase(["--abort"]).catch(() => {
           });
+          const rebaseFailureMessage = failureReason ?? `did not complete within ${MAX_ROUNDS} rounds`;
+          const redactedRebaseFailureMessage = redactCredentials(rebaseFailureMessage);
+          failed.push({
+            branch: branchDir,
+            error: redactedRebaseFailureMessage
+          });
+          await this.recordRebaseFailure(branchPath, branchDir, redactedRebaseFailureMessage);
           continue;
         }
         await invalidateBranchContentCaches(branchPath);
         const conflictIds = [...new Set(conflictedFiles)].map((f5) => {
-          const fileId = extractIdFromFilename(path9.basename(f5));
+          const fileId = extractIdFromFilename(path10.basename(f5));
           if (fileId) return fileId;
-          const parentDir = path9.basename(path9.dirname(f5));
+          const parentDir = path10.basename(path10.dirname(f5));
           const dirId = extractIdFromFilename(parentDir);
           if (dirId) return dirId;
-          if (path9.basename(f5) === ".collection.json" && parentDir === this.contentRoot) {
+          if (path10.basename(f5) === ".collection.json" && parentDir === this.contentRoot) {
             return ROOT_COLLECTION_ID;
           }
           return null;
@@ -43183,14 +43415,22 @@ var CmsWorker = class {
           branch: {
             name: branchDir,
             conflictStatus: hadConflicts ? "conflicts-detected" : "clean",
-            conflictFiles: conflictIdsDeduped
+            conflictFiles: conflictIdsDeduped,
+            // PR-W2: the cycle completed successfully -- clear any prior
+            // failure record regardless of conflict outcome.
+            rebaseFailure: void 0
           }
         });
+        rebased.push(branchDir);
       } catch (err) {
         const message = err instanceof Error ? err.message : "Unknown error";
         console.warn(`  Failed to sync ${branchDir}: ${message}`);
+        const redactedMessage = redactCredentials(message);
+        failed.push({ branch: branchDir, error: redactedMessage });
+        await this.recordRebaseFailure(branchPath, branchDir, redactedMessage);
       }
     }
+    return { rebased, skippedDirty, failed };
   }
   async refreshAuthCache() {
     if (!this.running || !this.config.refreshAuthCache) return;
@@ -46385,10 +46625,10 @@ var SessionAPI = class extends AbstractAPI {
    */
   async getToken(sessionId, template, expiresInSeconds) {
     this.requireId(sessionId);
-    const path12 = template ? joinPaths(basePath24, sessionId, "tokens", template) : joinPaths(basePath24, sessionId, "tokens");
+    const path13 = template ? joinPaths(basePath24, sessionId, "tokens", template) : joinPaths(basePath24, sessionId, "tokens");
     const requestOptions = {
       method: "POST",
-      path: path12
+      path: path13
     };
     if (expiresInSeconds !== void 0) {
       requestOptions.bodyParams = { expires_in_seconds: expiresInSeconds };
@@ -48510,12 +48750,12 @@ function buildRequest(options) {
       userAgent = USER_AGENT,
       skipApiVersionInUrl = false
     } = options;
-    const { path: path12, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
+    const { path: path13, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
     const { deepSnakecaseBodyParamKeys = false } = opts || {};
     if (requireSecretKey) {
       assertValidSecretKey(secretKey);
     }
-    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path12) : joinPaths(apiUrl, apiVersion, path12);
+    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path13) : joinPaths(apiUrl, apiVersion, path13);
     const finalUrl = new URL(url);
     if (queryParams) {
       const snakecasedQueryParams = snakecase_keys_default({ ...queryParams });
@@ -50578,21 +50818,21 @@ function createClerkClient(options) {
 
 // ../canopycms/src/auth/file-based-auth-cache.ts
 import fs8 from "node:fs/promises";
-import path10 from "node:path";
+import path11 from "node:path";
 var log4 = createDebugLogger({ prefix: "FileBasedAuthCache" });
 async function writeAuthCacheSnapshot(cachePath, files) {
   await fs8.mkdir(cachePath, { recursive: true });
   const timestamp = Date.now();
-  const snapshotDir = path10.join(cachePath, `snapshot-${timestamp}`);
+  const snapshotDir = path11.join(cachePath, `snapshot-${timestamp}`);
   await fs8.mkdir(snapshotDir, { recursive: true });
   for (const [fileName, data2] of Object.entries(files)) {
-    const tmpPath = path10.join(snapshotDir, `${fileName}.tmp`);
-    const finalPath = path10.join(snapshotDir, fileName);
+    const tmpPath = path11.join(snapshotDir, `${fileName}.tmp`);
+    const finalPath = path11.join(snapshotDir, fileName);
     await fs8.writeFile(tmpPath, JSON.stringify(data2, null, 2), "utf-8");
     await fs8.rename(tmpPath, finalPath);
   }
-  const currentLink = path10.join(cachePath, "current");
-  const tmpLink = path10.join(cachePath, `current-${timestamp}`);
+  const currentLink = path11.join(cachePath, "current");
+  const tmpLink = path11.join(cachePath, `current-${timestamp}`);
   await fs8.symlink(snapshotDir, tmpLink);
   await fs8.rename(tmpLink, currentLink);
   await cleanupOldSnapshots(cachePath, 2);
@@ -50608,7 +50848,7 @@ async function cleanupOldSnapshots(cachePath, keepCount) {
   const snapshots = entries.filter((e5) => e5.startsWith("snapshot-")).sort().reverse();
   for (const snapshot of snapshots.slice(keepCount)) {
     try {
-      await fs8.rm(path10.join(cachePath, snapshot), {
+      await fs8.rm(path11.join(cachePath, snapshot), {
         recursive: true,
         force: true
       });
@@ -50697,7 +50937,7 @@ async function refreshClerkCache(options) {
 }
 
 // worker/index.ts
-import path11 from "node:path";
+import path12 from "node:path";
 async function getSecret(secretArn, retries = 3) {
   const { SecretsManagerClient, GetSecretValueCommand } = await Promise.resolve().then(() => __toESM(require_dist_cjs53(), 1));
   const client = new SecretsManagerClient({});
@@ -50735,7 +50975,7 @@ async function main() {
   if (!clerkSecretKey && process.env.CLERK_SECRET_KEY_SECRET_ARN) {
     clerkSecretKey = await getSecret(process.env.CLERK_SECRET_KEY_SECRET_ARN);
   }
-  const cachePath = path11.join(workspacePath, ".cache");
+  const cachePath = path12.join(workspacePath, ".cache");
   const refreshAuthCache = clerkSecretKey ? async () => {
     const result = await refreshClerkCache({
       secretKey: clerkSecretKey,