canopycms-cdk 0.0.63 → 0.0.65

package/worker/dist/index.js

@@ -814,10 +814,10 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault2(require_src());
     var log7 = debug_1.default("@kwsites/file-exists");
-    function check(path15, isFile, isDirectory) {
-      log7(`checking %s`, path15);
+    function check(path16, isFile, isDirectory) {
+      log7(`checking %s`, path16);
       try {
-        const stat = fs_1.statSync(path15);
+        const stat = fs_1.statSync(path16);
         if (stat.isFile() && isFile) {
           log7(`[OK] path represents a file`);
           return true;
@@ -837,8 +837,8 @@ var require_src2 = __commonJS({
         throw e5;
       }
     }
-    function exists2(path15, type = exports.READABLE) {
-      return check(path15, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path16, type = exports.READABLE) {
+      return check(path16, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -927,54 +927,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module.exports = patch;
-    function patch(fs10) {
+    function patch(fs11) {
       if (constants2.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs10);
-      }
-      if (!fs10.lutimes) {
-        patchLutimes(fs10);
-      }
-      fs10.chown = chownFix(fs10.chown);
-      fs10.fchown = chownFix(fs10.fchown);
-      fs10.lchown = chownFix(fs10.lchown);
-      fs10.chmod = chmodFix(fs10.chmod);
-      fs10.fchmod = chmodFix(fs10.fchmod);
-      fs10.lchmod = chmodFix(fs10.lchmod);
-      fs10.chownSync = chownFixSync(fs10.chownSync);
-      fs10.fchownSync = chownFixSync(fs10.fchownSync);
-      fs10.lchownSync = chownFixSync(fs10.lchownSync);
-      fs10.chmodSync = chmodFixSync(fs10.chmodSync);
-      fs10.fchmodSync = chmodFixSync(fs10.fchmodSync);
-      fs10.lchmodSync = chmodFixSync(fs10.lchmodSync);
-      fs10.stat = statFix(fs10.stat);
-      fs10.fstat = statFix(fs10.fstat);
-      fs10.lstat = statFix(fs10.lstat);
-      fs10.statSync = statFixSync(fs10.statSync);
-      fs10.fstatSync = statFixSync(fs10.fstatSync);
-      fs10.lstatSync = statFixSync(fs10.lstatSync);
-      if (fs10.chmod && !fs10.lchmod) {
-        fs10.lchmod = function(path15, mode, cb) {
+        patchLchmod(fs11);
+      }
+      if (!fs11.lutimes) {
+        patchLutimes(fs11);
+      }
+      fs11.chown = chownFix(fs11.chown);
+      fs11.fchown = chownFix(fs11.fchown);
+      fs11.lchown = chownFix(fs11.lchown);
+      fs11.chmod = chmodFix(fs11.chmod);
+      fs11.fchmod = chmodFix(fs11.fchmod);
+      fs11.lchmod = chmodFix(fs11.lchmod);
+      fs11.chownSync = chownFixSync(fs11.chownSync);
+      fs11.fchownSync = chownFixSync(fs11.fchownSync);
+      fs11.lchownSync = chownFixSync(fs11.lchownSync);
+      fs11.chmodSync = chmodFixSync(fs11.chmodSync);
+      fs11.fchmodSync = chmodFixSync(fs11.fchmodSync);
+      fs11.lchmodSync = chmodFixSync(fs11.lchmodSync);
+      fs11.stat = statFix(fs11.stat);
+      fs11.fstat = statFix(fs11.fstat);
+      fs11.lstat = statFix(fs11.lstat);
+      fs11.statSync = statFixSync(fs11.statSync);
+      fs11.fstatSync = statFixSync(fs11.fstatSync);
+      fs11.lstatSync = statFixSync(fs11.lstatSync);
+      if (fs11.chmod && !fs11.lchmod) {
+        fs11.lchmod = function(path16, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs10.lchmodSync = function() {
+        fs11.lchmodSync = function() {
         };
       }
-      if (fs10.chown && !fs10.lchown) {
-        fs10.lchown = function(path15, uid, gid, cb) {
+      if (fs11.chown && !fs11.lchown) {
+        fs11.lchown = function(path16, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs10.lchownSync = function() {
+        fs11.lchownSync = function() {
         };
       }
       if (platform === "win32") {
-        fs10.rename = typeof fs10.rename !== "function" ? fs10.rename : (function(fs$rename) {
+        fs11.rename = typeof fs11.rename !== "function" ? fs11.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs10.stat(to, function(stater, st) {
+                  fs11.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -990,9 +990,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs10.rename);
+        })(fs11.rename);
       }
-      fs10.read = typeof fs10.read !== "function" ? fs10.read : (function(fs$read) {
+      fs11.read = typeof fs11.read !== "function" ? fs11.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -1000,22 +1000,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _3, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs10, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs11, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs10, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs11, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs10.read);
-      fs10.readSync = typeof fs10.readSync !== "function" ? fs10.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs11.read);
+      fs11.readSync = typeof fs11.readSync !== "function" ? fs11.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs10, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs11, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -1025,11 +1025,11 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs10.readSync);
-      function patchLchmod(fs11) {
-        fs11.lchmod = function(path15, mode, callback) {
-          fs11.open(
-            path15,
+      })(fs11.readSync);
+      function patchLchmod(fs12) {
+        fs12.lchmod = function(path16, mode, callback) {
+          fs12.open(
+            path16,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
             function(err, fd) {
@@ -1037,80 +1037,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs11.fchmod(fd, mode, function(err2) {
-                fs11.close(fd, function(err22) {
+              fs12.fchmod(fd, mode, function(err2) {
+                fs12.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs11.lchmodSync = function(path15, mode) {
-          var fd = fs11.openSync(path15, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
+        fs12.lchmodSync = function(path16, mode) {
+          var fd = fs12.openSync(path16, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs11.fchmodSync(fd, mode);
+            ret = fs12.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs11.closeSync(fd);
+                fs12.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs11.closeSync(fd);
+              fs12.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs11) {
-        if (constants2.hasOwnProperty("O_SYMLINK") && fs11.futimes) {
-          fs11.lutimes = function(path15, at, mt, cb) {
-            fs11.open(path15, constants2.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs12) {
+        if (constants2.hasOwnProperty("O_SYMLINK") && fs12.futimes) {
+          fs12.lutimes = function(path16, at, mt, cb) {
+            fs12.open(path16, constants2.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs11.futimes(fd, at, mt, function(er2) {
-                fs11.close(fd, function(er22) {
+              fs12.futimes(fd, at, mt, function(er2) {
+                fs12.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs11.lutimesSync = function(path15, at, mt) {
-            var fd = fs11.openSync(path15, constants2.O_SYMLINK);
+          fs12.lutimesSync = function(path16, at, mt) {
+            var fd = fs12.openSync(path16, constants2.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs11.futimesSync(fd, at, mt);
+              ret = fs12.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs11.closeSync(fd);
+                  fs12.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs11.closeSync(fd);
+                fs12.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs11.futimes) {
-          fs11.lutimes = function(_a3, _b, _c5, cb) {
+        } else if (fs12.futimes) {
+          fs12.lutimes = function(_a3, _b, _c5, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs11.lutimesSync = function() {
+          fs12.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs10, target, mode, function(er) {
+          return orig.call(fs11, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -1120,7 +1120,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs10, target, mode);
+            return orig.call(fs11, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -1129,7 +1129,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs10, target, uid, gid, function(er) {
+          return orig.call(fs11, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -1139,7 +1139,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs10, target, uid, gid);
+            return orig.call(fs11, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -1159,13 +1159,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs10, target, options, callback) : orig.call(fs10, target, callback);
+          return options ? orig.call(fs11, target, options, callback) : orig.call(fs11, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs10, target, options) : orig.call(fs10, target);
+          var stats = options ? orig.call(fs11, target, options) : orig.call(fs11, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -1194,16 +1194,16 @@ var require_legacy_streams = __commonJS({
   "../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/legacy-streams.js"(exports, module) {
     var Stream = __require("stream").Stream;
     module.exports = legacy;
-    function legacy(fs10) {
+    function legacy(fs11) {
       return {
         ReadStream,
         WriteStream
       };
-      function ReadStream(path15, options) {
-        if (!(this instanceof ReadStream)) return new ReadStream(path15, options);
+      function ReadStream(path16, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path16, options);
         Stream.call(this);
         var self2 = this;
-        this.path = path15;
+        this.path = path16;
         this.fd = null;
         this.readable = true;
         this.paused = false;
@@ -1237,7 +1237,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs10.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs11.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self2.emit("error", err);
             self2.readable = false;
@@ -1248,10 +1248,10 @@ var require_legacy_streams = __commonJS({
           self2._read();
         });
       }
-      function WriteStream(path15, options) {
-        if (!(this instanceof WriteStream)) return new WriteStream(path15, options);
+      function WriteStream(path16, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path16, options);
         Stream.call(this);
-        this.path = path15;
+        this.path = path16;
         this.fd = null;
         this.writable = true;
         this.flags = "w";
@@ -1276,7 +1276,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs10.open;
+          this._open = fs11.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -1311,7 +1311,7 @@ var require_clone = __commonJS({
 // ../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
   "../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js"(exports, module) {
-    var fs10 = __require("fs");
+    var fs11 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -1343,12 +1343,12 @@ var require_graceful_fs = __commonJS({
         m5 = "GFS4: " + m5.split(/\n/).join("\nGFS4: ");
         console.error(m5);
       };
-    if (!fs10[gracefulQueue]) {
+    if (!fs11[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs10, queue);
-      fs10.close = (function(fs$close) {
+      publishQueue(fs11, queue);
+      fs11.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs10, fd, function(err) {
+          return fs$close.call(fs11, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -1360,48 +1360,48 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs10.close);
-      fs10.closeSync = (function(fs$closeSync) {
+      })(fs11.close);
+      fs11.closeSync = (function(fs$closeSync) {
         function closeSync(fd) {
-          fs$closeSync.apply(fs10, arguments);
+          fs$closeSync.apply(fs11, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync;
-      })(fs10.closeSync);
+      })(fs11.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug2(fs10[gracefulQueue]);
-          __require("assert").equal(fs10[gracefulQueue].length, 0);
+          debug2(fs11[gracefulQueue]);
+          __require("assert").equal(fs11[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs10[gracefulQueue]);
-    }
-    module.exports = patch(clone(fs10));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs10.__patched) {
-      module.exports = patch(fs10);
-      fs10.__patched = true;
-    }
-    function patch(fs11) {
-      polyfills(fs11);
-      fs11.gracefulify = patch;
-      fs11.createReadStream = createReadStream;
-      fs11.createWriteStream = createWriteStream;
-      var fs$readFile = fs11.readFile;
-      fs11.readFile = readFile;
-      function readFile(path15, options, cb) {
+      publishQueue(global, fs11[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs11));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs11.__patched) {
+      module.exports = patch(fs11);
+      fs11.__patched = true;
+    }
+    function patch(fs12) {
+      polyfills(fs12);
+      fs12.gracefulify = patch;
+      fs12.createReadStream = createReadStream;
+      fs12.createWriteStream = createWriteStream;
+      var fs$readFile = fs12.readFile;
+      fs12.readFile = readFile;
+      function readFile(path16, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$readFile(path15, options, cb);
-        function go$readFile(path16, options2, cb2, startTime) {
-          return fs$readFile(path16, options2, function(err) {
+        return go$readFile(path16, options, cb);
+        function go$readFile(path17, options2, cb2, startTime) {
+          return fs$readFile(path17, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path16, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$readFile, [path17, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1409,16 +1409,16 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs11.writeFile;
-      fs11.writeFile = writeFile;
-      function writeFile(path15, data2, options, cb) {
+      var fs$writeFile = fs12.writeFile;
+      fs12.writeFile = writeFile;
+      function writeFile(path16, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$writeFile(path15, data2, options, cb);
-        function go$writeFile(path16, data3, options2, cb2, startTime) {
-          return fs$writeFile(path16, data3, options2, function(err) {
+        return go$writeFile(path16, data2, options, cb);
+        function go$writeFile(path17, data3, options2, cb2, startTime) {
+          return fs$writeFile(path17, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path16, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$writeFile, [path17, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1426,17 +1426,17 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs11.appendFile;
+      var fs$appendFile = fs12.appendFile;
       if (fs$appendFile)
-        fs11.appendFile = appendFile;
-      function appendFile(path15, data2, options, cb) {
+        fs12.appendFile = appendFile;
+      function appendFile(path16, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$appendFile(path15, data2, options, cb);
-        function go$appendFile(path16, data3, options2, cb2, startTime) {
-          return fs$appendFile(path16, data3, options2, function(err) {
+        return go$appendFile(path16, data2, options, cb);
+        function go$appendFile(path17, data3, options2, cb2, startTime) {
+          return fs$appendFile(path17, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path16, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$appendFile, [path17, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1444,9 +1444,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs11.copyFile;
+      var fs$copyFile = fs12.copyFile;
       if (fs$copyFile)
-        fs11.copyFile = copyFile;
+        fs12.copyFile = copyFile;
       function copyFile(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -1464,34 +1464,34 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs11.readdir;
-      fs11.readdir = readdir;
+      var fs$readdir = fs12.readdir;
+      fs12.readdir = readdir;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir(path15, options, cb) {
+      function readdir(path16, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path16, options2, cb2, startTime) {
-          return fs$readdir(path16, fs$readdirCallback(
-            path16,
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path17, options2, cb2, startTime) {
+          return fs$readdir(path17, fs$readdirCallback(
+            path17,
             options2,
             cb2,
             startTime
           ));
-        } : function go$readdir2(path16, options2, cb2, startTime) {
-          return fs$readdir(path16, options2, fs$readdirCallback(
-            path16,
+        } : function go$readdir2(path17, options2, cb2, startTime) {
+          return fs$readdir(path17, options2, fs$readdirCallback(
+            path17,
             options2,
             cb2,
             startTime
           ));
         };
-        return go$readdir(path15, options, cb);
-        function fs$readdirCallback(path16, options2, cb2, startTime) {
+        return go$readdir(path16, options, cb);
+        function fs$readdirCallback(path17, options2, cb2, startTime) {
           return function(err, files) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
               enqueue([
                 go$readdir,
-                [path16, options2, cb2],
+                [path17, options2, cb2],
                 err,
                 startTime || Date.now(),
                 Date.now()
@@ -1506,21 +1506,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs11);
+        var legStreams = legacy(fs12);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs11.ReadStream;
+      var fs$ReadStream = fs12.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs11.WriteStream;
+      var fs$WriteStream = fs12.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs11, "ReadStream", {
+      Object.defineProperty(fs12, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -1530,7 +1530,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs11, "WriteStream", {
+      Object.defineProperty(fs12, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -1541,7 +1541,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs11, "FileReadStream", {
+      Object.defineProperty(fs12, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -1552,7 +1552,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs11, "FileWriteStream", {
+      Object.defineProperty(fs12, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -1562,7 +1562,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      function ReadStream(path15, options) {
+      function ReadStream(path16, options) {
         if (this instanceof ReadStream)
           return fs$ReadStream.apply(this, arguments), this;
         else
@@ -1582,7 +1582,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function WriteStream(path15, options) {
+      function WriteStream(path16, options) {
         if (this instanceof WriteStream)
           return fs$WriteStream.apply(this, arguments), this;
         else
@@ -1600,22 +1600,22 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path15, options) {
-        return new fs11.ReadStream(path15, options);
+      function createReadStream(path16, options) {
+        return new fs12.ReadStream(path16, options);
       }
-      function createWriteStream(path15, options) {
-        return new fs11.WriteStream(path15, options);
+      function createWriteStream(path16, options) {
+        return new fs12.WriteStream(path16, options);
       }
-      var fs$open = fs11.open;
-      fs11.open = open;
-      function open(path15, flags, mode, cb) {
+      var fs$open = fs12.open;
+      fs12.open = open;
+      function open(path16, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
-        return go$open(path15, flags, mode, cb);
-        function go$open(path16, flags2, mode2, cb2, startTime) {
-          return fs$open(path16, flags2, mode2, function(err, fd) {
+        return go$open(path16, flags, mode, cb);
+        function go$open(path17, flags2, mode2, cb2, startTime) {
+          return fs$open(path17, flags2, mode2, function(err, fd) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path16, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$open, [path17, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1623,20 +1623,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs11;
+      return fs12;
     }
     function enqueue(elem) {
       debug2("ENQUEUE", elem[0].name, elem[1]);
-      fs10[gracefulQueue].push(elem);
+      fs11[gracefulQueue].push(elem);
       retry2();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i6 = 0; i6 < fs10[gracefulQueue].length; ++i6) {
-        if (fs10[gracefulQueue][i6].length > 2) {
-          fs10[gracefulQueue][i6][3] = now;
-          fs10[gracefulQueue][i6][4] = now;
+      for (var i6 = 0; i6 < fs11[gracefulQueue].length; ++i6) {
+        if (fs11[gracefulQueue][i6].length > 2) {
+          fs11[gracefulQueue][i6][3] = now;
+          fs11[gracefulQueue][i6][4] = now;
         }
       }
       retry2();
@@ -1644,9 +1644,9 @@ var require_graceful_fs = __commonJS({
     function retry2() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs10[gracefulQueue].length === 0)
+      if (fs11[gracefulQueue].length === 0)
         return;
-      var elem = fs10[gracefulQueue].shift();
+      var elem = fs11[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -1668,7 +1668,7 @@ var require_graceful_fs = __commonJS({
           debug2("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs10[gracefulQueue].push(elem);
+          fs11[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -2103,10 +2103,10 @@ var require_mtime_precision = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
     var cacheSymbol = Symbol();
-    function probe(file, fs10, callback) {
-      const cachedPrecision = fs10[cacheSymbol];
+    function probe(file, fs11, callback) {
+      const cachedPrecision = fs11[cacheSymbol];
       if (cachedPrecision) {
-        return fs10.stat(file, (err, stat) => {
+        return fs11.stat(file, (err, stat) => {
           if (err) {
             return callback(err);
           }
@@ -2114,16 +2114,16 @@ var require_mtime_precision = __commonJS({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs10.utimes(file, mtime, mtime, (err) => {
+      fs11.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs10.stat(file, (err2, stat) => {
+        fs11.stat(file, (err2, stat) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs10, cacheSymbol, { value: precision });
+          Object.defineProperty(fs11, cacheSymbol, { value: precision });
           callback(null, stat.mtime, precision);
         });
       });
@@ -2144,8 +2144,8 @@ var require_mtime_precision = __commonJS({
 var require_lockfile = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
-    var path15 = __require("path");
-    var fs10 = require_graceful_fs();
+    var path16 = __require("path");
+    var fs11 = require_graceful_fs();
     var retry2 = require_retry2();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -2155,7 +2155,7 @@ var require_lockfile = __commonJS({
     }
     function resolveCanonicalPath(file, options, callback) {
       if (!options.realpath) {
-        return callback(null, path15.resolve(file));
+        return callback(null, path16.resolve(file));
       }
       options.fs.realpath(file, callback);
     }
@@ -2276,7 +2276,7 @@ var require_lockfile = __commonJS({
         update: null,
         realpath: true,
         retries: 0,
-        fs: fs10,
+        fs: fs11,
         onCompromised: (err) => {
           throw err;
         },
@@ -2320,7 +2320,7 @@ var require_lockfile = __commonJS({
     }
     function unlock(file, options, callback) {
       options = {
-        fs: fs10,
+        fs: fs11,
         realpath: true,
         ...options
       };
@@ -2342,7 +2342,7 @@ var require_lockfile = __commonJS({
       options = {
         stale: 1e4,
         realpath: true,
-        fs: fs10,
+        fs: fs11,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -2381,16 +2381,16 @@ var require_lockfile = __commonJS({
 var require_adapter = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
-    var fs10 = require_graceful_fs();
-    function createSyncFs(fs11) {
+    var fs11 = require_graceful_fs();
+    function createSyncFs(fs12) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs11 };
+      const newFs = { ...fs12 };
       methods.forEach((method) => {
         newFs[method] = (...args) => {
           const callback = args.pop();
           let ret;
           try {
-            ret = fs11[`${method}Sync`](...args);
+            ret = fs12[`${method}Sync`](...args);
           } catch (err) {
             return callback(err);
           }
@@ -2428,7 +2428,7 @@ var require_adapter = __commonJS({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs10);
+      options.fs = createSyncFs(options.fs || fs11);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -3785,15 +3785,15 @@ var require_dist_node9 = __commonJS({
         octokit.log.debug("request", options);
         const start = Date.now();
         const requestOptions = octokit.request.endpoint.parse(options);
-        const path15 = requestOptions.url.replace(options.baseUrl, "");
+        const path16 = requestOptions.url.replace(options.baseUrl, "");
         return request(options).then((response) => {
           octokit.log.info(
-            `${requestOptions.method} ${path15} - ${response.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path16} - ${response.status} in ${Date.now() - start}ms`
           );
           return response;
         }).catch((error2) => {
           octokit.log.info(
-            `${requestOptions.method} ${path15} - ${error2.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path16} - ${error2.status} in ${Date.now() - start}ms`
           );
           throw error2;
         });
@@ -7887,7 +7887,7 @@ var require_dist_node13 = __commonJS({
     ];
     function routeMatcher(paths) {
       const regexes = paths.map(
-        (path15) => path15.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
+        (path16) => path16.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
       );
       const regex2 = `^(?:${regexes.map((r6) => `(?:${r6})`).join("|")})[^/]*$`;
       return new RegExp(regex2, "i");
@@ -8517,8 +8517,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data: data2, path: path15, errorMaps, issueData } = params;
-      const fullPath = [...path15, ...issueData.path || []];
+      const { data: data2, path: path16, errorMaps, issueData } = params;
+      const fullPath = [...path16, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -8826,11 +8826,11 @@ var init_types2 = __esm({
     init_parseUtil();
     init_util2();
     ParseInputLazyPath = class {
-      constructor(parent, value, path15, key) {
+      constructor(parent, value, path16, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path15;
+        this._path = path16;
         this._key = key;
       }
       get path() {
@@ -12277,7 +12277,12 @@ var init_field = __esm({
       collections: external_exports.array(external_exports.string().min(1)).min(1).optional(),
       entryTypes: external_exports.array(external_exports.string().min(1)).min(1).optional(),
       displayField: external_exports.string().min(1).optional(),
-      options: external_exports.array(referenceOptionSchema).optional()
+      options: external_exports.array(referenceOptionSchema).optional(),
+      // Must be listed here, not just on ReferenceFieldConfig: zod strips unknown keys by
+      // default, so a consumer that adopts this schema's parse output would silently delete a
+      // runtime-consumed flag and the feature would no-op with no error. (`resolvedSchema` is
+      // absent on purpose — it is type-inference-only and stripping it changes no behavior.)
+      includeBody: external_exports.boolean().optional()
     });
     fieldHolder = [external_exports.never()];
     blockSchema = external_exports.object({
@@ -12392,7 +12397,7 @@ var init_media = __esm({
 });
 
 // ../canopycms/src/config/schemas/config.ts
-var defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema;
+var defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema;
 var init_config2 = __esm({
   "../canopycms/src/config/schemas/config.ts"() {
     "use strict";
@@ -12417,6 +12422,9 @@ var init_config2 = __esm({
     deployedAsSchema = external_exports.enum(["static", "server"]).default("server");
     contentRootSchema = relativePathSchema.default("content");
     sourceRootSchema = external_exports.string().min(1).optional();
+    basePathSchema = external_exports.string().transform((value) => value.trim()).refine((value) => value.length > 0, {
+      message: "basePath must not be empty or only whitespace"
+    }).optional();
     deploymentNameSchema = external_exports.string().default("prod");
     devContentSyncSchema = external_exports.enum(["off", "warn"]).default("warn");
     devConfigSchema = external_exports.object({
@@ -12479,6 +12487,7 @@ var init_config2 = __esm({
       deploymentName: deploymentNameSchema.optional(),
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
+      basePath: basePathSchema,
       editor: editorConfigSchema.optional(),
       authPlugin: external_exports.custom().optional(),
       entryLinkUrl: external_exports.custom().optional(),
@@ -12508,8 +12517,8 @@ var init_permissions = __esm({
 });
 
 // ../canopycms/src/paths/normalize.ts
-function normalizeFilesystemPath(path15) {
-  return path15.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path16) {
+  return path16.split(/[\\/]+/).filter(Boolean).join("/");
 }
 var init_normalize = __esm({
   "../canopycms/src/paths/normalize.ts"() {
@@ -13659,9 +13668,9 @@ var init_createPaginator = __esm({
       command = withCommand(command) ?? command;
       return await client.send(command, ...args);
     };
-    get = (fromObject, path15) => {
+    get = (fromObject, path16) => {
       let cursor2 = fromObject;
-      const pathComponents = path15.split(".");
+      const pathComponents = path16.split(".");
       for (const step of pathComponents) {
         if (!cursor2 || typeof cursor2 !== "object") {
           return void 0;
@@ -14679,12 +14688,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             const password = request.password ?? "";
             auth = `${username}:${password}`;
           }
-          let path15 = request.path;
+          let path16 = request.path;
           if (queryString) {
-            path15 += `?${queryString}`;
+            path16 += `?${queryString}`;
           }
           if (request.fragment) {
-            path15 += `#${request.fragment}`;
+            path16 += `#${request.fragment}`;
           }
           let hostname = request.hostname ?? "";
           if (hostname[0] === "[" && hostname.endsWith("]")) {
@@ -14696,7 +14705,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: request.headers,
             host: hostname,
             method: request.method,
-            path: path15,
+            path: path16,
             port: request.port,
             agent,
             auth
@@ -14979,16 +14988,16 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             reject(err);
           };
           const queryString = querystringBuilder.buildQueryString(query || {});
-          let path15 = request.path;
+          let path16 = request.path;
           if (queryString) {
-            path15 += `?${queryString}`;
+            path16 += `?${queryString}`;
           }
           if (request.fragment) {
-            path15 += `#${request.fragment}`;
+            path16 += `#${request.fragment}`;
           }
           const req = session.request({
             ...request.headers,
-            [http2.constants.HTTP2_HEADER_PATH]: path15,
+            [http2.constants.HTTP2_HEADER_PATH]: path16,
             [http2.constants.HTTP2_HEADER_METHOD]: method
           });
           session.ref();
@@ -15175,13 +15184,13 @@ var require_dist_cjs14 = __commonJS({
           const abortError = buildAbortError(abortSignal);
           return Promise.reject(abortError);
         }
-        let path15 = request.path;
+        let path16 = request.path;
         const queryString = querystringBuilder.buildQueryString(request.query || {});
         if (queryString) {
-          path15 += `?${queryString}`;
+          path16 += `?${queryString}`;
         }
         if (request.fragment) {
-          path15 += `#${request.fragment}`;
+          path16 += `#${request.fragment}`;
         }
         let auth = "";
         if (request.username != null || request.password != null) {
@@ -15190,7 +15199,7 @@ var require_dist_cjs14 = __commonJS({
           auth = `${username}:${password}@`;
         }
         const { port, method } = request;
-        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path15}`;
+        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path16}`;
         const body = method === "GET" || method === "HEAD" ? void 0 : request.body;
         const requestOptions = {
           body,
@@ -17422,13 +17431,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path15, preserveJsx) {
-  if (typeof path15 === "string" && /^\.\.?\//.test(path15)) {
-    return path15.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
+function __rewriteRelativeImportExtension(path16, preserveJsx) {
+  if (typeof path16 === "string" && /^\.\.?\//.test(path16)) {
+    return path16.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d5 && (!ext || !cm) ? m5 : d5 + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path15;
+  return path16;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -18326,11 +18335,11 @@ var init_HttpBindingProtocol = __esm({
           const opTraits = translateTraits(operationSchema.traits);
           if (opTraits.http) {
             request.method = opTraits.http[0];
-            const [path15, search] = opTraits.http[1].split("?");
+            const [path16, search] = opTraits.http[1].split("?");
             if (request.path == "/") {
-              request.path = path15;
+              request.path = path16;
             } else {
-              request.path += path15;
+              request.path += path16;
             }
             const traitSearchParams = new URLSearchParams(search ?? "");
             Object.assign(query, Object.fromEntries(traitSearchParams));
@@ -18733,8 +18742,8 @@ var init_requestBuilder = __esm({
         return this;
       }
       p(memberName, labelValueProvider, uriLabel, isGreedyLabel) {
-        this.resolvePathStack.push((path15) => {
-          this.path = resolvedPath(path15, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
+        this.resolvePathStack.push((path16) => {
+          this.path = resolvedPath(path16, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
         });
         return this;
       }
@@ -19384,18 +19393,18 @@ var require_dist_cjs20 = __commonJS({
       }
     };
     var booleanEquals = (value1, value2) => value1 === value2;
-    var getAttrPathList = (path15) => {
-      const parts = path15.split(".");
+    var getAttrPathList = (path16) => {
+      const parts = path16.split(".");
       const pathList = [];
       for (const part of parts) {
         const squareBracketIndex = part.indexOf("[");
         if (squareBracketIndex !== -1) {
           if (part.indexOf("]") !== part.length - 1) {
-            throw new EndpointError(`Path: '${path15}' does not end with ']'`);
+            throw new EndpointError(`Path: '${path16}' does not end with ']'`);
           }
           const arrayIndex = part.slice(squareBracketIndex + 1, -1);
           if (Number.isNaN(parseInt(arrayIndex))) {
-            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path15}'`);
+            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path16}'`);
           }
           if (squareBracketIndex !== 0) {
             pathList.push(part.slice(0, squareBracketIndex));
@@ -19407,9 +19416,9 @@ var require_dist_cjs20 = __commonJS({
       }
       return pathList;
     };
-    var getAttr = (value, path15) => getAttrPathList(path15).reduce((acc, index) => {
+    var getAttr = (value, path16) => getAttrPathList(path16).reduce((acc, index) => {
       if (typeof acc !== "object") {
-        throw new EndpointError(`Index '${index}' in '${path15}' not found in '${JSON.stringify(value)}'`);
+        throw new EndpointError(`Index '${index}' in '${path16}' not found in '${JSON.stringify(value)}'`);
       } else if (Array.isArray(acc)) {
         return acc[parseInt(index)];
       }
@@ -19428,8 +19437,8 @@ var require_dist_cjs20 = __commonJS({
             return value;
           }
           if (typeof value === "object" && "hostname" in value) {
-            const { hostname: hostname2, port, protocol: protocol2 = "", path: path15 = "", query = {} } = value;
-            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path15}`);
+            const { hostname: hostname2, port, protocol: protocol2 = "", path: path16 = "", query = {} } = value;
+            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path16}`);
             url.search = Object.entries(query).map(([k6, v5]) => `${k6}=${v5}`).join("&");
             return url;
           }
@@ -20874,10 +20883,10 @@ ${longDate}
 ${credentialScope}
 ${utilHexEncoding.toHex(hashedRequest)}`;
       }
-      getCanonicalPath({ path: path15 }) {
+      getCanonicalPath({ path: path16 }) {
         if (this.uriEscapePath) {
           const normalizedPathSegments = [];
-          for (const pathSegment of path15.split("/")) {
+          for (const pathSegment of path16.split("/")) {
             if (pathSegment?.length === 0)
               continue;
             if (pathSegment === ".")
@@ -20888,11 +20897,11 @@ ${utilHexEncoding.toHex(hashedRequest)}`;
               normalizedPathSegments.push(pathSegment);
             }
           }
-          const normalizedPath = `${path15?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path15?.endsWith("/") ? "/" : ""}`;
+          const normalizedPath = `${path16?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path16?.endsWith("/") ? "/" : ""}`;
           const doubleEncoded = utilUriEscape.escapeUri(normalizedPath);
           return doubleEncoded.replace(/%2F/g, "/");
         }
-        return path15;
+        return path16;
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -22196,11 +22205,11 @@ var init_SmithyRpcV2CborProtocol = __esm({
           }
         }
         const { service, operation: operation2 } = (0, import_util_middleware5.getSmithyContext)(context);
-        const path15 = `/service/${service}/operation/${operation2}`;
+        const path16 = `/service/${service}/operation/${operation2}`;
         if (request.path.endsWith("/")) {
-          request.path += path15.slice(1);
+          request.path += path16.slice(1);
         } else {
-          request.path += path15;
+          request.path += path16;
         }
         return request;
       }
@@ -27845,14 +27854,14 @@ var require_readFile = __commonJS({
     var promises_1 = __require("node:fs/promises");
     exports.filePromises = {};
     exports.fileIntercept = {};
-    var readFile = (path15, options) => {
-      if (exports.fileIntercept[path15] !== void 0) {
-        return exports.fileIntercept[path15];
+    var readFile = (path16, options) => {
+      if (exports.fileIntercept[path16] !== void 0) {
+        return exports.fileIntercept[path16];
       }
-      if (!exports.filePromises[path15] || options?.ignoreCache) {
-        exports.filePromises[path15] = (0, promises_1.readFile)(path15, "utf8");
+      if (!exports.filePromises[path16] || options?.ignoreCache) {
+        exports.filePromises[path16] = (0, promises_1.readFile)(path16, "utf8");
       }
-      return exports.filePromises[path15];
+      return exports.filePromises[path16];
     };
     exports.readFile = readFile;
   }
@@ -27865,7 +27874,7 @@ var require_dist_cjs33 = __commonJS({
     var getHomeDir = require_getHomeDir();
     var getSSOTokenFilepath = require_getSSOTokenFilepath();
     var getSSOTokenFromFile = require_getSSOTokenFromFile();
-    var path15 = __require("path");
+    var path16 = __require("path");
     var types = require_dist_cjs();
     var readFile = require_readFile();
     var ENV_PROFILE = "AWS_PROFILE";
@@ -27887,9 +27896,9 @@ var require_dist_cjs33 = __commonJS({
       ...data2.default && { default: data2.default }
     });
     var ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path15.join(getHomeDir.getHomeDir(), ".aws", "config");
+    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path16.join(getHomeDir.getHomeDir(), ".aws", "config");
     var ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path15.join(getHomeDir.getHomeDir(), ".aws", "credentials");
+    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path16.join(getHomeDir.getHomeDir(), ".aws", "credentials");
     var prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/;
     var profileNameBlockList = ["__proto__", "profile __proto__"];
     var parseIni = (iniData) => {
@@ -27944,11 +27953,11 @@ var require_dist_cjs33 = __commonJS({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = path15.join(homeDir, filepath.slice(2));
+        resolvedFilepath = path16.join(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = path15.join(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = path16.join(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile.readFile(resolvedConfigFilepath, {
@@ -27987,8 +27996,8 @@ var require_dist_cjs33 = __commonJS({
       getFileRecord() {
         return readFile.fileIntercept;
       },
-      interceptFile(path16, contents) {
-        readFile.fileIntercept[path16] = Promise.resolve(contents);
+      interceptFile(path17, contents) {
+        readFile.fileIntercept[path17] = Promise.resolve(contents);
       },
       getTokenRecord() {
         return getSSOTokenFromFile.tokenIntercept;
@@ -28313,8 +28322,8 @@ var require_dist_cjs36 = __commonJS({
               return endpoint.url.href;
             }
             if ("hostname" in endpoint) {
-              const { protocol, hostname, port, path: path15 } = endpoint;
-              return `${protocol}//${hostname}${port ? ":" + port : ""}${path15}`;
+              const { protocol, hostname, port, path: path16 } = endpoint;
+              return `${protocol}//${hostname}${port ? ":" + port : ""}${path16}`;
             }
           }
           return endpoint;
@@ -36511,8 +36520,8 @@ var require_dist_cjs53 = __commonJS({
 });
 
 // ../canopycms/src/worker/cms-worker.ts
-import fs8 from "node:fs/promises";
-import path12 from "node:path";
+import fs9 from "node:fs/promises";
+import path13 from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
@@ -37103,8 +37112,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path15) {
-  return (0, import_file_exists.exists)(path15, import_file_exists.FOLDER);
+function folderExists(path16) {
+  return (0, import_file_exists.exists)(path16, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -37506,8 +37515,8 @@ function checkIsRepoRootTask() {
     commands: commands5,
     format: "utf-8",
     onError,
-    parser(path15) {
-      return /^\.(git)?$/.test(path15.trim());
+    parser(path16) {
+      return /^\.(git)?$/.test(path16.trim());
     }
   };
 }
@@ -37941,11 +37950,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path15, line, preview] = input.split(NULL);
-    paths.add(path15);
-    (results[path15] = results[path15] || []).push({
+    const [path16, line, preview] = input.split(NULL);
+    paths.add(path16);
+    (results[path16] = results[path16] || []).push({
       line: asNumber(line),
-      path: path15,
+      path: path16,
       preview
     });
   });
@@ -38709,14 +38718,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path15, text) {
+function parseInit(bare, path16, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path15, false, result[1]);
+    return new InitSummary(bare, path16, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path15, true, result[1]);
+    return new InitSummary(bare, path16, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -38727,7 +38736,7 @@ function parseInit(bare, path15, text) {
       break;
     }
   }
-  return new InitSummary(bare, path15, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path16, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -38736,9 +38745,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path15, existing, gitDir) {
+      constructor(bare, path16, existing, gitDir) {
         this.bare = bare;
-        this.path = path15;
+        this.path = path16;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -38750,7 +38759,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path15, customArgs) {
+function initTask(bare = false, path16, customArgs) {
   const commands5 = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands5)) {
     commands5.splice(1, 0, bareCommand);
@@ -38759,7 +38768,7 @@ function initTask(bare = false, path15, customArgs) {
     commands: commands5,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands5.includes("--bare"), path15, text);
+      return parseInit(commands5.includes("--bare"), path16, text);
     }
   };
 }
@@ -39574,12 +39583,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path15, index, working_dir) {
-        this.path = path15;
+      constructor(path16, index, working_dir) {
+        this.path = path16;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path15) || [null, path15, path15];
+          const detail = fromPathRegex.exec(path16) || [null, path16, path16];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -39610,14 +39619,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data2(index, workingDir, path15) {
+  function data2(index, workingDir, path16) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path15);
+      handler(result, path16);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path15, index, workingDir));
+      result.files.push(new FileStatusSummary(path16, index, workingDir));
     }
   }
 }
@@ -39968,9 +39977,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path15, write) {
+      hashObject(path16, write) {
         return this._runTask(
-          hashObjectTask(path15, write === true),
+          hashObjectTask(path16, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -40324,8 +40333,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path15 = input.trim().replace(/^["']|["']$/g, "");
-  return path15 && normalize(path15);
+  const path16 = input.trim().replace(/^["']|["']$/g, "");
+  return path16 && normalize(path16);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -40610,8 +40619,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path15) {
-  return subModuleTask(["add", repo, path15]);
+function addSubModuleTask(repo, path16) {
+  return subModuleTask(["add", repo, path16]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -40925,8 +40934,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path15, then) {
-      return this._runTask(addSubModuleTask2(repo, path15), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path16, then) {
+      return this._runTask(addSubModuleTask2(repo, path16), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -41820,7 +41829,7 @@ async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger2 = nullL
 async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 6e4, logger2 = nullLogger) {
   const now = Date.now();
   let cleaned = 0;
-  for (const subdir of ["completed", "failed"]) {
+  for (const subdir of ["completed", "failed", "corrupt"]) {
     const dir = path2.join(taskDir, subdir);
     let files;
     try {
@@ -42729,6 +42738,8 @@ init_types3();
 init_normalize();
 
 // ../canopycms/src/utils/git.ts
+import fs7 from "node:fs/promises";
+import path9 from "node:path";
 var REJECTED_MARKER = "[rejected]";
 var NON_FAST_FORWARD_REASONS = ["non-fast-forward", "fetch first"];
 var REJECTION_HINT = "Updates were rejected because";
@@ -42740,18 +42751,95 @@ var STALE_LEASE_REASON = "stale info";
 function isStaleLeaseRejection(message) {
   return message.includes(REJECTED_MARKER) && message.includes(STALE_LEASE_REASON);
 }
+async function resolveGitDir(repoPath) {
+  const dotGit = path9.join(repoPath, ".git");
+  let stat;
+  try {
+    stat = await fs7.stat(dotGit);
+  } catch {
+    return null;
+  }
+  if (stat.isDirectory()) return dotGit;
+  try {
+    const pointer = await fs7.readFile(dotGit, "utf-8");
+    const match2 = /^gitdir:\s*(.+)$/m.exec(pointer);
+    if (!match2) return null;
+    const target = match2[1].trim();
+    return path9.isAbsolute(target) ? target : path9.resolve(repoPath, target);
+  } catch {
+    return null;
+  }
+}
+async function isRebaseInProgress(repoPath) {
+  const gitDir = await resolveGitDir(repoPath);
+  if (!gitDir) return false;
+  const results = await Promise.all(
+    ["rebase-merge", "rebase-apply"].map(
+      (dir) => fs7.stat(path9.join(gitDir, dir)).then(() => true).catch(() => false)
+    )
+  );
+  return results.some(Boolean);
+}
 
 // ../canopycms/src/utils/provisioning-lock.ts
 var import_proper_lockfile2 = __toESM(require_proper_lockfile(), 1);
-import fs7 from "node:fs/promises";
-import path9 from "node:path";
-async function tryAcquireProvisioningLock(lockTargetDir2, lockName) {
-  await fs7.mkdir(lockTargetDir2, { recursive: true });
-  return import_proper_lockfile2.default.lock(lockTargetDir2, {
-    lockfilePath: path9.join(lockTargetDir2, lockName),
-    retries: 0,
-    stale: 3e4
-  });
+import fs8 from "node:fs/promises";
+import path10 from "node:path";
+init_logger();
+function provisioningLockOptions(lockPath, retries, onCompromised) {
+  return {
+    lockfilePath: lockPath,
+    realpath: false,
+    retries,
+    stale: 3e4,
+    // proper-lockfile invokes this from inside its refresh timer, so ANY throw
+    // escaping here is an uncaught exception that kills the process -- the very
+    // failure the handler exists to prevent. Call sites are told not to throw
+    // (see OnLockCompromised); this makes it structural rather than a
+    // convention, and also covers the LOGGER throwing: under `CI=true`,
+    // vitest's `onConsoleLog` turns any console write into a throw.
+    onCompromised: (err) => {
+      try {
+        if (onCompromised) {
+          onCompromised(err);
+          return;
+        }
+        canopyLogWarn(
+          `[canopy] Provisioning lock compromised mid-hold for ${lockPath}:`,
+          getErrorMessage2(err)
+        );
+      } catch {
+        try {
+          process.stderr.write(
+            `[canopy] lock compromised for ${lockPath}; its handler or logger threw
+`
+          );
+        } catch {
+        }
+      }
+    }
+  };
+}
+function releaseIgnoringAlreadyReleased(release, lockPath) {
+  return async () => {
+    try {
+      await release();
+    } catch (err) {
+      if (isNodeError(err) && err.code === "ERELEASED") {
+        canopyLogWarn(
+          `[canopy] Lock at ${lockPath} was already released (compromised mid-hold, or released twice); nothing to release`
+        );
+        return;
+      }
+      throw err;
+    }
+  };
+}
+async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
+  await fs8.mkdir(lockTargetDir2, { recursive: true });
+  const lockPath = path10.join(lockTargetDir2, lockName);
+  const release = await import_proper_lockfile2.default.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised));
+  return releaseIgnoringAlreadyReleased(release, lockPath);
 }
 
 // ../canopycms/src/git-manager.ts
@@ -42780,21 +42868,26 @@ var GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
 init_deployment_name();
 
 // ../canopycms/src/utils/content-write-lock.ts
-import path10 from "node:path";
+import path11 from "node:path";
+init_logger();
 var META_DIR2 = ".canopy-meta";
 var CONTENT_WRITE_LOCK_NAME = "content-write.lock";
 function lockTargetDir(branchRoot) {
-  return path10.join(path10.resolve(branchRoot), META_DIR2);
+  return path11.join(path11.resolve(branchRoot), META_DIR2);
 }
-function tryAcquireContentWriteLock(branchRoot) {
-  return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME);
+function tryAcquireContentWriteLock(branchRoot, onCompromised) {
+  return tryAcquireProvisioningLock(
+    lockTargetDir(branchRoot),
+    CONTENT_WRITE_LOCK_NAME,
+    onCompromised
+  );
 }
 
 // ../canopycms/src/worker/worker-status.ts
-import path11 from "node:path";
+import path12 from "node:path";
 var WORKER_STATUS_FILE = "worker-status.json";
 async function writeWorkerStatus(taskDir, report) {
-  const filePath = path11.join(taskDir, WORKER_STATUS_FILE);
+  const filePath = path12.join(taskDir, WORKER_STATUS_FILE);
   const stamped = { ...report, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   await atomicWriteFile(filePath, JSON.stringify(stamped, null, 2));
 }
@@ -42889,15 +42982,15 @@ var CmsWorker = class {
     this.releaseLockFn = null;
     this.log = cmsTaskQueueLogger;
     this.octokit = createCanopyOctokit({ auth: config.githubToken });
-    this.taskDir = path12.join(config.workspacePath, ".tasks");
-    this.remoteGitPath = path12.join(config.workspacePath, "remote.git");
-    this.contentBranchesPath = path12.join(config.workspacePath, "content-branches");
+    this.taskDir = path13.join(config.workspacePath, ".tasks");
+    this.remoteGitPath = path13.join(config.workspacePath, "remote.git");
+    this.contentBranchesPath = path13.join(config.workspacePath, "content-branches");
     this.baseBranch = config.baseBranch ?? "main";
     this.sanitizedBaseBranch = sanitizeBranchName(this.baseBranch);
     this.maxTasksPerCycle = config.maxTasksPerCycle ?? 10;
     this.taskTimeoutMs = config.taskTimeoutMs ?? DEFAULT_TASK_TIMEOUT;
     this.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES2;
-    this.lockFilePath = path12.join(config.workspacePath, ".tasks", ".worker-lock");
+    this.lockFilePath = path13.join(config.workspacePath, ".tasks", ".worker-lock");
     this.lockStaleMs = config.lockStaleMs ?? DEFAULT_LOCK_STALE_MS;
     this.contentRoot = config.contentRoot ?? "content";
   }
@@ -43048,7 +43141,7 @@ var CmsWorker = class {
    * negligible, but a host with a badly wrong clock could misjudge liveness.
    */
   async acquireLock() {
-    await fs8.mkdir(this.taskDir, { recursive: true });
+    await fs9.mkdir(this.taskDir, { recursive: true });
     try {
       this.releaseLockFn = await import_proper_lockfile3.default.lock(this.taskDir, {
         lockfilePath: this.lockFilePath,
@@ -43124,6 +43217,58 @@ var CmsWorker = class {
       `refs/heads/${this.baseBranch}`
     ]);
   }
+  /**
+   * Guarantee a bare repo's config carries NO `remote.origin.url`, and so no
+   * embedded bot token.
+   *
+   * `git clone https://x-access-token:<token>@github.com/...` records that URL
+   * verbatim as `remote.origin.url`, and for `remote.git` that config lives on
+   * shared EFS. The security model in docs/deploying-to-aws.md -- "If Lambda is
+   * compromised, an attacker can read/write content on EFS but cannot push to
+   * GitHub", "Secrets stay on the worker" -- is false while that string is
+   * there: a compromised Lambda could read the token off EFS and, despite
+   * having no egress of its own, exfiltrate it by writing it into branch
+   * content the worker then pushes to GitHub.
+   *
+   * Nothing needs the remote: every push passes the URL explicitly as an
+   * argument (see the `git.push(this.buildGitHubUrl(), ...)` call sites), and
+   * `verifyBaseBranchExists` reads local refs.
+   *
+   * VERIFIES rather than assuming: it re-reads the config and throws if the URL
+   * survives, because the previous code's `.catch(() => {})` meant a failed
+   * scrub was indistinguishable from a successful one.
+   */
+  async scrubPersistedRemote(gitDir) {
+    const git = simpleGit({ baseDir: gitDir });
+    const readOriginUrl = async () => {
+      try {
+        const url = (await git.raw(["config", "--get", "remote.origin.url"])).trim();
+        return url === "" ? null : url;
+      } catch {
+        return "unreadable";
+      }
+    };
+    const before = await readOriginUrl();
+    if (before === null) return;
+    if (before === "unreadable") {
+      workerLogWarn(
+        `  Could not read remote.origin.url in ${gitDir}; attempting the scrub anyway rather than assuming it is absent`
+      );
+    }
+    try {
+      await git.removeRemote("origin");
+    } catch (err) {
+      workerLogWarn(
+        `  removeRemote('origin') failed in ${gitDir}: ${getErrorMessage2(err)} -- verifying directly`
+      );
+    }
+    const remaining = await readOriginUrl();
+    if (remaining !== null) {
+      throw new Error(
+        `Could not confirm the 'origin' remote is gone from ${gitDir} (${remaining === "unreadable" ? "its config was unreadable" : "its config still records a URL"}). For a token-bearing clone URL that means the GitHub bot token may be persisted on shared storage. Refusing to continue.`
+      );
+    }
+  }
   /**
    * Ensure remote.git bare repo exists.
    * On first run, clone from GitHub as a bare repo.
@@ -43142,12 +43287,13 @@ var CmsWorker = class {
   async ensureRemoteGit() {
     let exists2;
     try {
-      await fs8.stat(this.remoteGitPath);
+      await fs9.stat(this.remoteGitPath);
       exists2 = true;
     } catch {
       exists2 = false;
     }
     if (exists2) {
+      await this.scrubPersistedRemote(this.remoteGitPath);
       try {
         await this.verifyBaseBranchExists(this.remoteGitPath);
       } catch (err) {
@@ -43160,21 +43306,20 @@ var CmsWorker = class {
     }
     workerLog("Initializing remote.git from GitHub...");
     const git = simpleGit();
-    await git.clone(this.buildGitHubUrl(), this.remoteGitPath, ["--bare"]);
+    const stagingPath = `${this.remoteGitPath}.cloning`;
+    await fs9.rm(stagingPath, { recursive: true, force: true });
     try {
-      await this.verifyBaseBranchExists(this.remoteGitPath);
+      await git.clone(this.buildGitHubUrl(), stagingPath, ["--bare"]);
+      await this.scrubPersistedRemote(stagingPath);
+      await this.verifyBaseBranchExists(stagingPath);
     } catch (err) {
-      workerLogError(
-        `remote.git base branch verification failed after clone: ${getErrorMessage2(err)}`
-      );
-      await fs8.rm(this.remoteGitPath, { recursive: true, force: true });
+      workerLogError(`remote.git clone failed: ${redactCredentials(getErrorMessage2(err))}`);
+      await fs9.rm(stagingPath, { recursive: true, force: true });
       throw new Error(
-        `remote.git clone of ${this.config.githubOwner}/${this.config.githubRepo} has no branch '${this.baseBranch}' - the GitHub repository is empty or the base branch does not exist. Push an initial commit to '${this.baseBranch}' and restart the worker (systemd will retry automatically).`
+        `remote.git clone of ${this.config.githubOwner}/${this.config.githubRepo} failed or has no branch '${this.baseBranch}' - the GitHub repository may be empty, or the base branch may not exist. Push an initial commit to '${this.baseBranch}' and restart the worker (systemd will retry automatically).`
       );
     }
-    const bareGit = simpleGit({ baseDir: this.remoteGitPath });
-    await bareGit.removeRemote("origin").catch(() => {
-    });
+    await fs9.rename(stagingPath, this.remoteGitPath);
     workerLog("remote.git initialized");
   }
   /**
@@ -43383,7 +43528,7 @@ var CmsWorker = class {
     if (!branch) return;
     const branchPath = this.branchWorkspacePath(branch);
     try {
-      await fs8.stat(branchPath);
+      await fs9.stat(branchPath);
     } catch {
       return;
     }
@@ -43427,7 +43572,7 @@ var CmsWorker = class {
     if (!branch) return;
     const branchPath = this.branchWorkspacePath(branch);
     try {
-      await fs8.stat(branchPath);
+      await fs9.stat(branchPath);
     } catch {
       return;
     }
@@ -43463,7 +43608,7 @@ var CmsWorker = class {
    * is sanitized.
    */
   branchWorkspacePath(branchRefName) {
-    return path12.join(this.contentBranchesPath, sanitizeBranchName(branchRefName));
+    return path13.join(this.contentBranchesPath, sanitizeBranchName(branchRefName));
   }
   /**
    * What `remote.git` currently holds for `branchRef`, or null when this
@@ -43890,7 +44035,7 @@ var CmsWorker = class {
    */
   async hasPendingHistoryRewrite(branchName) {
     try {
-      const branchPath = path12.join(this.contentBranchesPath, sanitizeBranchName(branchName));
+      const branchPath = path13.join(this.contentBranchesPath, sanitizeBranchName(branchName));
       const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
       return typeof metaFile?.branch.historyRewrittenFrom === "string";
     } catch {
@@ -43965,7 +44110,7 @@ var CmsWorker = class {
   async cleanupTrashedBranchDirs() {
     let entries;
     try {
-      entries = await fs8.readdir(this.contentBranchesPath);
+      entries = await fs9.readdir(this.contentBranchesPath);
     } catch (err) {
       if (isNodeError(err) && err.code === "ENOENT") return 0;
       throw err;
@@ -43986,7 +44131,7 @@ var CmsWorker = class {
       }
       if (now - stampDate.getTime() < TRASH_RETENTION_MS) continue;
       try {
-        await fs8.rm(path12.join(this.contentBranchesPath, name), {
+        await fs9.rm(path13.join(this.contentBranchesPath, name), {
           recursive: true,
           force: true,
           maxRetries: 3,
@@ -44024,12 +44169,12 @@ var CmsWorker = class {
    * untouched rather than force-resolved.
    */
   async refreshBaseBranchWorkspace() {
-    const basePath32 = path12.join(this.contentBranchesPath, this.sanitizedBaseBranch);
-    const gitDir = path12.join(basePath32, ".git");
+    const basePath32 = path13.join(this.contentBranchesPath, this.sanitizedBaseBranch);
+    const gitDir = path13.join(basePath32, ".git");
     try {
       let gitDirStat;
       try {
-        gitDirStat = await fs8.stat(gitDir);
+        gitDirStat = await fs9.stat(gitDir);
       } catch {
         gitDirStat = null;
       }
@@ -44204,6 +44349,15 @@ var CmsWorker = class {
    */
   async afterConflictDetectedForTesting() {
   }
+  /**
+   * Test seam, sibling of {@link afterConflictDetectedForTesting}: runs at the
+   * instant a rebase round has succeeded, before the completion path (cache
+   * invalidation, conflict metadata, [SYNC-H1] marker) executes. Exists so a
+   * test can lose the content-write lock at exactly the point where bailing out
+   * would strand a rewritten history.
+   */
+  async afterRebaseCompletedForTesting() {
+  }
   async rebaseActiveBranches() {
     const rebased = [];
     const skippedDirty = [];
@@ -44211,7 +44365,7 @@ var CmsWorker = class {
     const failed = [];
     let branchDirs;
     try {
-      branchDirs = await fs8.readdir(this.contentBranchesPath);
+      branchDirs = await fs9.readdir(this.contentBranchesPath);
     } catch {
       return { rebased, skippedDirty, skippedLocked, failed };
     }
@@ -44219,10 +44373,10 @@ var CmsWorker = class {
       if (branchDir.startsWith(".") || branchDir === "branches.json") {
         continue;
       }
-      const branchPath = path12.join(this.contentBranchesPath, branchDir);
-      const gitDir = path12.join(branchPath, ".git");
+      const branchPath = path13.join(this.contentBranchesPath, branchDir);
+      const gitDir = path13.join(branchPath, ".git");
       try {
-        const stat = await fs8.stat(gitDir);
+        const stat = await fs9.stat(gitDir);
         if (!stat.isDirectory()) {
           workerLog(`  Skipping ${branchDir}: .git is not a directory`);
           continue;
@@ -44257,8 +44411,14 @@ var CmsWorker = class {
           unsafe: { allowUnsafeEditor: true }
         });
         let releaseContentLock;
+        let contentLockCompromised = false;
         try {
-          releaseContentLock = await tryAcquireContentWriteLock(branchPath);
+          releaseContentLock = await tryAcquireContentWriteLock(branchPath, (lockErr) => {
+            contentLockCompromised = true;
+            workerLogWarn(
+              `  Content-write lock compromised mid-rebase for ${branchDir}: ${getErrorMessage2(lockErr)}`
+            );
+          });
         } catch (lockErr) {
           if (isNodeError(lockErr) && lockErr.code === "ELOCKED") {
             workerLog(`  Skipping ${branchDir}: content write in progress (retrying next cycle)`);
@@ -44268,6 +44428,29 @@ var CmsWorker = class {
           throw lockErr;
         }
         try {
+          if (await isRebaseInProgress(branchPath)) {
+            const preAbort = await branchGit.status().catch(() => null);
+            const collateral = (preAbort?.files ?? []).filter((f5) => !preAbort?.conflicted.includes(f5.path)).filter((f5) => f5.working_dir !== " " && f5.working_dir !== "?").map((f5) => f5.path);
+            if (collateral.length > 0) {
+              workerLogWarn(
+                `  ${branchDir}: aborting the interrupted rebase will DISCARD working-tree changes to ${collateral.length} file(s) saved while the worker was down: ${collateral.join(", ")}`
+              );
+            }
+            workerLogWarn(
+              `  ${branchDir}: found an interrupted rebase (this worker's own abandoned work) -- aborting it to recover the branch`
+            );
+            try {
+              await branchGit.rebase(["--abort"]);
+            } catch (abortErr) {
+              const reason = redactCredentials(
+                `could not abort interrupted rebase: ${getErrorMessage2(abortErr)}`
+              );
+              workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+              failed.push({ branch: branchDir, error: reason });
+              await this.recordRebaseFailure(branchPath, branchDir, reason);
+              continue;
+            }
+          }
           const dirtyCheck = await branchGit.status();
           if (dirtyCheck.files.length > 0) {
             workerLog(`  Skipping ${branchDir}: has uncommitted changes`);
@@ -44320,6 +44503,7 @@ var CmsWorker = class {
           let failureReason;
           const MAX_ROUNDS = 50;
           for (let round = 0; round < MAX_ROUNDS && !completed; round++) {
+            if (contentLockCompromised) break;
             try {
               if (nextAction === "start") {
                 await branchGit.rebase([fetchedBaseTip]);
@@ -44334,11 +44518,31 @@ var CmsWorker = class {
               const st = await branchGit.status();
               if (st.conflicted.length > 0) {
                 await this.afterConflictDetectedForTesting();
+                const conflictKind = new Map(
+                  st.files.map((f5) => [f5.path, `${f5.index}${f5.working_dir}`])
+                );
+                let resolutionFailure;
                 for (const file of st.conflicted) {
-                  await branchGit.raw(["checkout", "--theirs", file]);
-                  await branchGit.add(file);
+                  const kind = conflictKind.get(file);
+                  try {
+                    if (kind === "UD") {
+                      await branchGit.raw(["rm", "-f", "--", file]);
+                    } else if (kind === "DU") {
+                      await branchGit.add(file);
+                    } else {
+                      await branchGit.raw(["checkout", "--theirs", file]);
+                      await branchGit.add(file);
+                    }
+                  } catch (resolveErr) {
+                    resolutionFailure = `failed to resolve conflicted file '${file}' (status ${kind ?? "??"}): ` + getErrorMessage2(resolveErr);
+                    break;
+                  }
                   conflictedFiles.push(file);
                 }
+                if (resolutionFailure !== void 0) {
+                  failureReason = resolutionFailure;
+                  break;
+                }
               } else {
                 const msg = rebaseErr instanceof Error ? rebaseErr.message : "";
                 if (msg.toLowerCase().includes("nothing to commit") || msg.toLowerCase().includes("apply --skip")) {
@@ -44355,6 +44559,21 @@ var CmsWorker = class {
               }
             }
           }
+          if (completed) await this.afterRebaseCompletedForTesting();
+          if (contentLockCompromised && !completed) {
+            workerLogWarn(
+              `  Skipping ${branchDir}: content-write lock was compromised mid-rebase (retrying next cycle)`
+            );
+            await branchGit.rebase(["--abort"]).catch(() => {
+            });
+            skippedLocked.push(branchDir);
+            continue;
+          }
+          if (contentLockCompromised) {
+            workerLogWarn(
+              `  Content-write lock for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`
+            );
+          }
           if (!completed) {
             workerLogWarn(
               failureReason !== void 0 ? `  Rebase of ${branchDir} aborted due to unexpected error: ${failureReason}` : `  Rebase of ${branchDir} did not complete within ${MAX_ROUNDS} rounds, aborting`
@@ -44373,13 +44592,13 @@ var CmsWorker = class {
           await invalidateBranchContentCaches(branchPath);
           const normalizedContentRoot = normalizeFilesystemPath(this.contentRoot);
           const conflictIds = [...new Set(conflictedFiles)].map((f5) => {
-            const fileId = extractIdFromFilename(path12.basename(f5));
+            const fileId = extractIdFromFilename(path13.basename(f5));
             if (fileId) return fileId;
-            const parentDir = path12.basename(path12.dirname(f5));
+            const parentDir = path13.basename(path13.dirname(f5));
             const dirId = extractIdFromFilename(parentDir);
             if (dirId) return dirId;
-            const parentPath = normalizeFilesystemPath(path12.dirname(f5));
-            if (path12.basename(f5) === ".collection.json" && parentPath === normalizedContentRoot) {
+            const parentPath = normalizeFilesystemPath(path13.dirname(f5));
+            if (path13.basename(f5) === ".collection.json" && parentPath === normalizedContentRoot) {
               return ROOT_COLLECTION_ID;
             }
             return null;
@@ -44413,6 +44632,18 @@ var CmsWorker = class {
             }
           }
         } finally {
+          try {
+            if (await isRebaseInProgress(branchPath)) {
+              workerLogWarn(
+                `  ${branchDir}: rebase still in progress on exit -- aborting so the clone is not left wedged`
+              );
+              await branchGit.rebase(["--abort"]);
+            }
+          } catch (abortErr) {
+            workerLogWarn(
+              `  Failed to abort in-progress rebase for ${branchDir}: ${getErrorMessage2(abortErr)}`
+            );
+          }
           await releaseContentLock?.().catch((releaseErr) => {
             workerLogWarn(
               `  Failed to release content-write lock for ${branchDir}: ${getErrorMessage2(releaseErr)}`
@@ -47622,10 +47853,10 @@ var SessionAPI = class extends AbstractAPI {
    */
   async getToken(sessionId, template, expiresInSeconds) {
     this.requireId(sessionId);
-    const path15 = template ? joinPaths(basePath24, sessionId, "tokens", template) : joinPaths(basePath24, sessionId, "tokens");
+    const path16 = template ? joinPaths(basePath24, sessionId, "tokens", template) : joinPaths(basePath24, sessionId, "tokens");
     const requestOptions = {
       method: "POST",
-      path: path15
+      path: path16
     };
     if (expiresInSeconds !== void 0) {
       requestOptions.bodyParams = { expires_in_seconds: expiresInSeconds };
@@ -49747,12 +49978,12 @@ function buildRequest(options) {
       userAgent = USER_AGENT,
       skipApiVersionInUrl = false
     } = options;
-    const { path: path15, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
+    const { path: path16, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
     const { deepSnakecaseBodyParamKeys = false } = opts || {};
     if (requireSecretKey) {
       assertValidSecretKey(secretKey);
     }
-    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path15) : joinPaths(apiUrl, apiVersion, path15);
+    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path16) : joinPaths(apiUrl, apiVersion, path16);
     const finalUrl = new URL(url);
     if (queryParams) {
       const snakecasedQueryParams = snakecase_keys_default({ ...queryParams });
@@ -51814,38 +52045,38 @@ function createClerkClient(options) {
 }
 
 // ../canopycms/src/auth/file-based-auth-cache.ts
-import fs9 from "node:fs/promises";
-import path13 from "node:path";
+import fs10 from "node:fs/promises";
+import path14 from "node:path";
 var log5 = createDebugLogger({ prefix: "FileBasedAuthCache" });
 async function writeAuthCacheSnapshot(cachePath, files) {
-  await fs9.mkdir(cachePath, { recursive: true });
+  await fs10.mkdir(cachePath, { recursive: true });
   const timestamp2 = Date.now();
-  const snapshotDir = path13.join(cachePath, `snapshot-${timestamp2}`);
-  await fs9.mkdir(snapshotDir, { recursive: true });
+  const snapshotDir = path14.join(cachePath, `snapshot-${timestamp2}`);
+  await fs10.mkdir(snapshotDir, { recursive: true });
   for (const [fileName, data2] of Object.entries(files)) {
-    const tmpPath = path13.join(snapshotDir, `${fileName}.tmp`);
-    const finalPath = path13.join(snapshotDir, fileName);
-    await fs9.writeFile(tmpPath, JSON.stringify(data2, null, 2), "utf-8");
-    await fs9.rename(tmpPath, finalPath);
-  }
-  const currentLink = path13.join(cachePath, "current");
-  const tmpLink = path13.join(cachePath, `current-${timestamp2}`);
-  await fs9.symlink(snapshotDir, tmpLink);
-  await fs9.rename(tmpLink, currentLink);
+    const tmpPath = path14.join(snapshotDir, `${fileName}.tmp`);
+    const finalPath = path14.join(snapshotDir, fileName);
+    await fs10.writeFile(tmpPath, JSON.stringify(data2, null, 2), "utf-8");
+    await fs10.rename(tmpPath, finalPath);
+  }
+  const currentLink = path14.join(cachePath, "current");
+  const tmpLink = path14.join(cachePath, `current-${timestamp2}`);
+  await fs10.symlink(path14.basename(snapshotDir), tmpLink);
+  await fs10.rename(tmpLink, currentLink);
   await cleanupOldSnapshots(cachePath, 2);
   return snapshotDir;
 }
 async function cleanupOldSnapshots(cachePath, keepCount) {
   let entries;
   try {
-    entries = await fs9.readdir(cachePath);
+    entries = await fs10.readdir(cachePath);
   } catch {
     return;
   }
   const snapshots = entries.filter((e5) => e5.startsWith("snapshot-")).sort().reverse();
   for (const snapshot of snapshots.slice(keepCount)) {
     try {
-      await fs9.rm(path13.join(cachePath, snapshot), {
+      await fs10.rm(path14.join(cachePath, snapshot), {
         recursive: true,
         force: true
       });
@@ -51939,7 +52170,7 @@ async function refreshClerkCache(options) {
 }
 
 // worker/index.ts
-import path14 from "node:path";
+import path15 from "node:path";
 async function getSecret(secretArn, retries = 3) {
   const { SecretsManagerClient, GetSecretValueCommand } = await Promise.resolve().then(() => __toESM(require_dist_cjs53(), 1));
   const client = new SecretsManagerClient({});
@@ -51978,7 +52209,7 @@ async function main() {
   if (!clerkSecretKey && process.env.CLERK_SECRET_KEY_SECRET_ARN) {
     clerkSecretKey = await getSecret(process.env.CLERK_SECRET_KEY_SECRET_ARN);
   }
-  const cachePath = path14.join(workspacePath, ".cache");
+  const cachePath = path15.join(workspacePath, ".cache");
   const refreshAuthCache = clerkSecretKey ? async () => {
     const result = await refreshClerkCache({
       secretKey: clerkSecretKey,