canopycms-cdk 0.0.65 → 0.0.66-int.82

package/worker/dist/index.js

@@ -814,10 +814,10 @@ var require_src2 = __commonJS({
     var fs_1 = __require("fs");
     var debug_1 = __importDefault2(require_src());
     var log7 = debug_1.default("@kwsites/file-exists");
-    function check(path16, isFile, isDirectory) {
-      log7(`checking %s`, path16);
+    function check(path20, isFile, isDirectory) {
+      log7(`checking %s`, path20);
       try {
-        const stat = fs_1.statSync(path16);
+        const stat = fs_1.statSync(path20);
         if (stat.isFile() && isFile) {
           log7(`[OK] path represents a file`);
           return true;
@@ -837,8 +837,8 @@ var require_src2 = __commonJS({
         throw e5;
       }
     }
-    function exists2(path16, type = exports.READABLE) {
-      return check(path16, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path20, type = exports.READABLE) {
+      return check(path20, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -927,54 +927,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module.exports = patch;
-    function patch(fs11) {
+    function patch(fs15) {
       if (constants2.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs11);
-      }
-      if (!fs11.lutimes) {
-        patchLutimes(fs11);
-      }
-      fs11.chown = chownFix(fs11.chown);
-      fs11.fchown = chownFix(fs11.fchown);
-      fs11.lchown = chownFix(fs11.lchown);
-      fs11.chmod = chmodFix(fs11.chmod);
-      fs11.fchmod = chmodFix(fs11.fchmod);
-      fs11.lchmod = chmodFix(fs11.lchmod);
-      fs11.chownSync = chownFixSync(fs11.chownSync);
-      fs11.fchownSync = chownFixSync(fs11.fchownSync);
-      fs11.lchownSync = chownFixSync(fs11.lchownSync);
-      fs11.chmodSync = chmodFixSync(fs11.chmodSync);
-      fs11.fchmodSync = chmodFixSync(fs11.fchmodSync);
-      fs11.lchmodSync = chmodFixSync(fs11.lchmodSync);
-      fs11.stat = statFix(fs11.stat);
-      fs11.fstat = statFix(fs11.fstat);
-      fs11.lstat = statFix(fs11.lstat);
-      fs11.statSync = statFixSync(fs11.statSync);
-      fs11.fstatSync = statFixSync(fs11.fstatSync);
-      fs11.lstatSync = statFixSync(fs11.lstatSync);
-      if (fs11.chmod && !fs11.lchmod) {
-        fs11.lchmod = function(path16, mode, cb) {
+        patchLchmod(fs15);
+      }
+      if (!fs15.lutimes) {
+        patchLutimes(fs15);
+      }
+      fs15.chown = chownFix(fs15.chown);
+      fs15.fchown = chownFix(fs15.fchown);
+      fs15.lchown = chownFix(fs15.lchown);
+      fs15.chmod = chmodFix(fs15.chmod);
+      fs15.fchmod = chmodFix(fs15.fchmod);
+      fs15.lchmod = chmodFix(fs15.lchmod);
+      fs15.chownSync = chownFixSync(fs15.chownSync);
+      fs15.fchownSync = chownFixSync(fs15.fchownSync);
+      fs15.lchownSync = chownFixSync(fs15.lchownSync);
+      fs15.chmodSync = chmodFixSync(fs15.chmodSync);
+      fs15.fchmodSync = chmodFixSync(fs15.fchmodSync);
+      fs15.lchmodSync = chmodFixSync(fs15.lchmodSync);
+      fs15.stat = statFix(fs15.stat);
+      fs15.fstat = statFix(fs15.fstat);
+      fs15.lstat = statFix(fs15.lstat);
+      fs15.statSync = statFixSync(fs15.statSync);
+      fs15.fstatSync = statFixSync(fs15.fstatSync);
+      fs15.lstatSync = statFixSync(fs15.lstatSync);
+      if (fs15.chmod && !fs15.lchmod) {
+        fs15.lchmod = function(path20, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs11.lchmodSync = function() {
+        fs15.lchmodSync = function() {
         };
       }
-      if (fs11.chown && !fs11.lchown) {
-        fs11.lchown = function(path16, uid, gid, cb) {
+      if (fs15.chown && !fs15.lchown) {
+        fs15.lchown = function(path20, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs11.lchownSync = function() {
+        fs15.lchownSync = function() {
         };
       }
       if (platform === "win32") {
-        fs11.rename = typeof fs11.rename !== "function" ? fs11.rename : (function(fs$rename) {
+        fs15.rename = typeof fs15.rename !== "function" ? fs15.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs11.stat(to, function(stater, st) {
+                  fs15.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -990,9 +990,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs11.rename);
+        })(fs15.rename);
       }
-      fs11.read = typeof fs11.read !== "function" ? fs11.read : (function(fs$read) {
+      fs15.read = typeof fs15.read !== "function" ? fs15.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -1000,22 +1000,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _3, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs11, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs15, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs11, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs15, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs11.read);
-      fs11.readSync = typeof fs11.readSync !== "function" ? fs11.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs15.read);
+      fs15.readSync = typeof fs15.readSync !== "function" ? fs15.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs11, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs15, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -1025,11 +1025,11 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs11.readSync);
-      function patchLchmod(fs12) {
-        fs12.lchmod = function(path16, mode, callback) {
-          fs12.open(
-            path16,
+      })(fs15.readSync);
+      function patchLchmod(fs16) {
+        fs16.lchmod = function(path20, mode, callback) {
+          fs16.open(
+            path20,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
             function(err, fd) {
@@ -1037,80 +1037,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs12.fchmod(fd, mode, function(err2) {
-                fs12.close(fd, function(err22) {
+              fs16.fchmod(fd, mode, function(err2) {
+                fs16.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs12.lchmodSync = function(path16, mode) {
-          var fd = fs12.openSync(path16, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
+        fs16.lchmodSync = function(path20, mode) {
+          var fd = fs16.openSync(path20, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs12.fchmodSync(fd, mode);
+            ret = fs16.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs12.closeSync(fd);
+                fs16.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs12.closeSync(fd);
+              fs16.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs12) {
-        if (constants2.hasOwnProperty("O_SYMLINK") && fs12.futimes) {
-          fs12.lutimes = function(path16, at, mt, cb) {
-            fs12.open(path16, constants2.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs16) {
+        if (constants2.hasOwnProperty("O_SYMLINK") && fs16.futimes) {
+          fs16.lutimes = function(path20, at, mt, cb) {
+            fs16.open(path20, constants2.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs12.futimes(fd, at, mt, function(er2) {
-                fs12.close(fd, function(er22) {
+              fs16.futimes(fd, at, mt, function(er2) {
+                fs16.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs12.lutimesSync = function(path16, at, mt) {
-            var fd = fs12.openSync(path16, constants2.O_SYMLINK);
+          fs16.lutimesSync = function(path20, at, mt) {
+            var fd = fs16.openSync(path20, constants2.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs12.futimesSync(fd, at, mt);
+              ret = fs16.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs12.closeSync(fd);
+                  fs16.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs12.closeSync(fd);
+                fs16.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs12.futimes) {
-          fs12.lutimes = function(_a3, _b, _c5, cb) {
+        } else if (fs16.futimes) {
+          fs16.lutimes = function(_a3, _b, _c5, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs12.lutimesSync = function() {
+          fs16.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs11, target, mode, function(er) {
+          return orig.call(fs15, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -1120,7 +1120,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs11, target, mode);
+            return orig.call(fs15, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -1129,7 +1129,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs11, target, uid, gid, function(er) {
+          return orig.call(fs15, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -1139,7 +1139,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs11, target, uid, gid);
+            return orig.call(fs15, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -1159,13 +1159,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs11, target, options, callback) : orig.call(fs11, target, callback);
+          return options ? orig.call(fs15, target, options, callback) : orig.call(fs15, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs11, target, options) : orig.call(fs11, target);
+          var stats = options ? orig.call(fs15, target, options) : orig.call(fs15, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -1194,16 +1194,16 @@ var require_legacy_streams = __commonJS({
   "../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/legacy-streams.js"(exports, module) {
     var Stream = __require("stream").Stream;
     module.exports = legacy;
-    function legacy(fs11) {
+    function legacy(fs15) {
       return {
         ReadStream,
         WriteStream
       };
-      function ReadStream(path16, options) {
-        if (!(this instanceof ReadStream)) return new ReadStream(path16, options);
+      function ReadStream(path20, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path20, options);
         Stream.call(this);
         var self2 = this;
-        this.path = path16;
+        this.path = path20;
         this.fd = null;
         this.readable = true;
         this.paused = false;
@@ -1237,7 +1237,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs11.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs15.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self2.emit("error", err);
             self2.readable = false;
@@ -1248,10 +1248,10 @@ var require_legacy_streams = __commonJS({
           self2._read();
         });
       }
-      function WriteStream(path16, options) {
-        if (!(this instanceof WriteStream)) return new WriteStream(path16, options);
+      function WriteStream(path20, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path20, options);
         Stream.call(this);
-        this.path = path16;
+        this.path = path20;
         this.fd = null;
         this.writable = true;
         this.flags = "w";
@@ -1276,7 +1276,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs11.open;
+          this._open = fs15.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -1311,7 +1311,7 @@ var require_clone = __commonJS({
 // ../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
   "../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js"(exports, module) {
-    var fs11 = __require("fs");
+    var fs15 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -1343,12 +1343,12 @@ var require_graceful_fs = __commonJS({
         m5 = "GFS4: " + m5.split(/\n/).join("\nGFS4: ");
         console.error(m5);
       };
-    if (!fs11[gracefulQueue]) {
+    if (!fs15[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs11, queue);
-      fs11.close = (function(fs$close) {
+      publishQueue(fs15, queue);
+      fs15.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs11, fd, function(err) {
+          return fs$close.call(fs15, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -1360,48 +1360,48 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs11.close);
-      fs11.closeSync = (function(fs$closeSync) {
+      })(fs15.close);
+      fs15.closeSync = (function(fs$closeSync) {
         function closeSync(fd) {
-          fs$closeSync.apply(fs11, arguments);
+          fs$closeSync.apply(fs15, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync;
-      })(fs11.closeSync);
+      })(fs15.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug2(fs11[gracefulQueue]);
-          __require("assert").equal(fs11[gracefulQueue].length, 0);
+          debug2(fs15[gracefulQueue]);
+          __require("assert").equal(fs15[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs11[gracefulQueue]);
-    }
-    module.exports = patch(clone(fs11));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs11.__patched) {
-      module.exports = patch(fs11);
-      fs11.__patched = true;
-    }
-    function patch(fs12) {
-      polyfills(fs12);
-      fs12.gracefulify = patch;
-      fs12.createReadStream = createReadStream;
-      fs12.createWriteStream = createWriteStream;
-      var fs$readFile = fs12.readFile;
-      fs12.readFile = readFile;
-      function readFile(path16, options, cb) {
+      publishQueue(global, fs15[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs15));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs15.__patched) {
+      module.exports = patch(fs15);
+      fs15.__patched = true;
+    }
+    function patch(fs16) {
+      polyfills(fs16);
+      fs16.gracefulify = patch;
+      fs16.createReadStream = createReadStream;
+      fs16.createWriteStream = createWriteStream;
+      var fs$readFile = fs16.readFile;
+      fs16.readFile = readFile;
+      function readFile(path20, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$readFile(path16, options, cb);
-        function go$readFile(path17, options2, cb2, startTime) {
-          return fs$readFile(path17, options2, function(err) {
+        return go$readFile(path20, options, cb);
+        function go$readFile(path21, options2, cb2, startTime) {
+          return fs$readFile(path21, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path17, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$readFile, [path21, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1409,16 +1409,16 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs12.writeFile;
-      fs12.writeFile = writeFile;
-      function writeFile(path16, data2, options, cb) {
+      var fs$writeFile = fs16.writeFile;
+      fs16.writeFile = writeFile;
+      function writeFile(path20, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$writeFile(path16, data2, options, cb);
-        function go$writeFile(path17, data3, options2, cb2, startTime) {
-          return fs$writeFile(path17, data3, options2, function(err) {
+        return go$writeFile(path20, data2, options, cb);
+        function go$writeFile(path21, data3, options2, cb2, startTime) {
+          return fs$writeFile(path21, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path17, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$writeFile, [path21, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1426,17 +1426,17 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs12.appendFile;
+      var fs$appendFile = fs16.appendFile;
       if (fs$appendFile)
-        fs12.appendFile = appendFile;
-      function appendFile(path16, data2, options, cb) {
+        fs16.appendFile = appendFile;
+      function appendFile(path20, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$appendFile(path16, data2, options, cb);
-        function go$appendFile(path17, data3, options2, cb2, startTime) {
-          return fs$appendFile(path17, data3, options2, function(err) {
+        return go$appendFile(path20, data2, options, cb);
+        function go$appendFile(path21, data3, options2, cb2, startTime) {
+          return fs$appendFile(path21, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path17, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$appendFile, [path21, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1444,9 +1444,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs12.copyFile;
+      var fs$copyFile = fs16.copyFile;
       if (fs$copyFile)
-        fs12.copyFile = copyFile;
+        fs16.copyFile = copyFile;
       function copyFile(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -1464,34 +1464,34 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs12.readdir;
-      fs12.readdir = readdir;
+      var fs$readdir = fs16.readdir;
+      fs16.readdir = readdir;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir(path16, options, cb) {
+      function readdir(path20, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path17, options2, cb2, startTime) {
-          return fs$readdir(path17, fs$readdirCallback(
-            path17,
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path21, options2, cb2, startTime) {
+          return fs$readdir(path21, fs$readdirCallback(
+            path21,
             options2,
             cb2,
             startTime
           ));
-        } : function go$readdir2(path17, options2, cb2, startTime) {
-          return fs$readdir(path17, options2, fs$readdirCallback(
-            path17,
+        } : function go$readdir2(path21, options2, cb2, startTime) {
+          return fs$readdir(path21, options2, fs$readdirCallback(
+            path21,
             options2,
             cb2,
             startTime
           ));
         };
-        return go$readdir(path16, options, cb);
-        function fs$readdirCallback(path17, options2, cb2, startTime) {
+        return go$readdir(path20, options, cb);
+        function fs$readdirCallback(path21, options2, cb2, startTime) {
           return function(err, files) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
               enqueue([
                 go$readdir,
-                [path17, options2, cb2],
+                [path21, options2, cb2],
                 err,
                 startTime || Date.now(),
                 Date.now()
@@ -1506,21 +1506,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs12);
+        var legStreams = legacy(fs16);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs12.ReadStream;
+      var fs$ReadStream = fs16.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs12.WriteStream;
+      var fs$WriteStream = fs16.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs12, "ReadStream", {
+      Object.defineProperty(fs16, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -1530,7 +1530,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs12, "WriteStream", {
+      Object.defineProperty(fs16, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -1541,7 +1541,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs12, "FileReadStream", {
+      Object.defineProperty(fs16, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -1552,7 +1552,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs12, "FileWriteStream", {
+      Object.defineProperty(fs16, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -1562,7 +1562,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      function ReadStream(path16, options) {
+      function ReadStream(path20, options) {
         if (this instanceof ReadStream)
           return fs$ReadStream.apply(this, arguments), this;
         else
@@ -1582,7 +1582,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function WriteStream(path16, options) {
+      function WriteStream(path20, options) {
         if (this instanceof WriteStream)
           return fs$WriteStream.apply(this, arguments), this;
         else
@@ -1600,22 +1600,22 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path16, options) {
-        return new fs12.ReadStream(path16, options);
+      function createReadStream(path20, options) {
+        return new fs16.ReadStream(path20, options);
       }
-      function createWriteStream(path16, options) {
-        return new fs12.WriteStream(path16, options);
+      function createWriteStream(path20, options) {
+        return new fs16.WriteStream(path20, options);
       }
-      var fs$open = fs12.open;
-      fs12.open = open;
-      function open(path16, flags, mode, cb) {
+      var fs$open = fs16.open;
+      fs16.open = open;
+      function open(path20, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
-        return go$open(path16, flags, mode, cb);
-        function go$open(path17, flags2, mode2, cb2, startTime) {
-          return fs$open(path17, flags2, mode2, function(err, fd) {
+        return go$open(path20, flags, mode, cb);
+        function go$open(path21, flags2, mode2, cb2, startTime) {
+          return fs$open(path21, flags2, mode2, function(err, fd) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path17, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$open, [path21, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1623,20 +1623,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs12;
+      return fs16;
     }
     function enqueue(elem) {
       debug2("ENQUEUE", elem[0].name, elem[1]);
-      fs11[gracefulQueue].push(elem);
+      fs15[gracefulQueue].push(elem);
       retry2();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i6 = 0; i6 < fs11[gracefulQueue].length; ++i6) {
-        if (fs11[gracefulQueue][i6].length > 2) {
-          fs11[gracefulQueue][i6][3] = now;
-          fs11[gracefulQueue][i6][4] = now;
+      for (var i6 = 0; i6 < fs15[gracefulQueue].length; ++i6) {
+        if (fs15[gracefulQueue][i6].length > 2) {
+          fs15[gracefulQueue][i6][3] = now;
+          fs15[gracefulQueue][i6][4] = now;
         }
       }
       retry2();
@@ -1644,9 +1644,9 @@ var require_graceful_fs = __commonJS({
     function retry2() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs11[gracefulQueue].length === 0)
+      if (fs15[gracefulQueue].length === 0)
         return;
-      var elem = fs11[gracefulQueue].shift();
+      var elem = fs15[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -1668,7 +1668,7 @@ var require_graceful_fs = __commonJS({
           debug2("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs11[gracefulQueue].push(elem);
+          fs15[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -2103,10 +2103,10 @@ var require_mtime_precision = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
     var cacheSymbol = Symbol();
-    function probe(file, fs11, callback) {
-      const cachedPrecision = fs11[cacheSymbol];
+    function probe(file, fs15, callback) {
+      const cachedPrecision = fs15[cacheSymbol];
       if (cachedPrecision) {
-        return fs11.stat(file, (err, stat) => {
+        return fs15.stat(file, (err, stat) => {
           if (err) {
             return callback(err);
           }
@@ -2114,16 +2114,16 @@ var require_mtime_precision = __commonJS({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs11.utimes(file, mtime, mtime, (err) => {
+      fs15.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs11.stat(file, (err2, stat) => {
+        fs15.stat(file, (err2, stat) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs11, cacheSymbol, { value: precision });
+          Object.defineProperty(fs15, cacheSymbol, { value: precision });
           callback(null, stat.mtime, precision);
         });
       });
@@ -2144,8 +2144,8 @@ var require_mtime_precision = __commonJS({
 var require_lockfile = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
-    var path16 = __require("path");
-    var fs11 = require_graceful_fs();
+    var path20 = __require("path");
+    var fs15 = require_graceful_fs();
     var retry2 = require_retry2();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -2155,7 +2155,7 @@ var require_lockfile = __commonJS({
     }
     function resolveCanonicalPath(file, options, callback) {
       if (!options.realpath) {
-        return callback(null, path16.resolve(file));
+        return callback(null, path20.resolve(file));
       }
       options.fs.realpath(file, callback);
     }
@@ -2276,7 +2276,7 @@ var require_lockfile = __commonJS({
         update: null,
         realpath: true,
         retries: 0,
-        fs: fs11,
+        fs: fs15,
         onCompromised: (err) => {
           throw err;
         },
@@ -2320,7 +2320,7 @@ var require_lockfile = __commonJS({
     }
     function unlock(file, options, callback) {
       options = {
-        fs: fs11,
+        fs: fs15,
         realpath: true,
         ...options
       };
@@ -2342,7 +2342,7 @@ var require_lockfile = __commonJS({
       options = {
         stale: 1e4,
         realpath: true,
-        fs: fs11,
+        fs: fs15,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -2381,16 +2381,16 @@ var require_lockfile = __commonJS({
 var require_adapter = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
-    var fs11 = require_graceful_fs();
-    function createSyncFs(fs12) {
+    var fs15 = require_graceful_fs();
+    function createSyncFs(fs16) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs12 };
+      const newFs = { ...fs16 };
       methods.forEach((method) => {
         newFs[method] = (...args) => {
           const callback = args.pop();
           let ret;
           try {
-            ret = fs12[`${method}Sync`](...args);
+            ret = fs16[`${method}Sync`](...args);
           } catch (err) {
             return callback(err);
           }
@@ -2428,7 +2428,7 @@ var require_adapter = __commonJS({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs11);
+      options.fs = createSyncFs(options.fs || fs15);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -3785,15 +3785,15 @@ var require_dist_node9 = __commonJS({
         octokit.log.debug("request", options);
         const start = Date.now();
         const requestOptions = octokit.request.endpoint.parse(options);
-        const path16 = requestOptions.url.replace(options.baseUrl, "");
+        const path20 = requestOptions.url.replace(options.baseUrl, "");
         return request(options).then((response) => {
           octokit.log.info(
-            `${requestOptions.method} ${path16} - ${response.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path20} - ${response.status} in ${Date.now() - start}ms`
           );
           return response;
         }).catch((error2) => {
           octokit.log.info(
-            `${requestOptions.method} ${path16} - ${error2.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path20} - ${error2.status} in ${Date.now() - start}ms`
           );
           throw error2;
         });
@@ -7887,7 +7887,7 @@ var require_dist_node13 = __commonJS({
     ];
     function routeMatcher(paths) {
       const regexes = paths.map(
-        (path16) => path16.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
+        (path20) => path20.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
       );
       const regex2 = `^(?:${regexes.map((r6) => `(?:${r6})`).join("|")})[^/]*$`;
       return new RegExp(regex2, "i");
@@ -8517,8 +8517,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data: data2, path: path16, errorMaps, issueData } = params;
-      const fullPath = [...path16, ...issueData.path || []];
+      const { data: data2, path: path20, errorMaps, issueData } = params;
+      const fullPath = [...path20, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -8826,11 +8826,11 @@ var init_types2 = __esm({
     init_parseUtil();
     init_util2();
     ParseInputLazyPath = class {
-      constructor(parent, value, path16, key) {
+      constructor(parent, value, path20, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path16;
+        this._path = path20;
         this._key = key;
       }
       get path() {
@@ -12517,8 +12517,8 @@ var init_permissions = __esm({
 });
 
 // ../canopycms/src/paths/normalize.ts
-function normalizeFilesystemPath(path16) {
-  return path16.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path20) {
+  return path20.split(/[\\/]+/).filter(Boolean).join("/");
 }
 var init_normalize = __esm({
   "../canopycms/src/paths/normalize.ts"() {
@@ -13668,9 +13668,9 @@ var init_createPaginator = __esm({
       command = withCommand(command) ?? command;
       return await client.send(command, ...args);
     };
-    get = (fromObject, path16) => {
+    get = (fromObject, path20) => {
       let cursor2 = fromObject;
-      const pathComponents = path16.split(".");
+      const pathComponents = path20.split(".");
       for (const step of pathComponents) {
         if (!cursor2 || typeof cursor2 !== "object") {
           return void 0;
@@ -14688,12 +14688,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             const password = request.password ?? "";
             auth = `${username}:${password}`;
           }
-          let path16 = request.path;
+          let path20 = request.path;
           if (queryString) {
-            path16 += `?${queryString}`;
+            path20 += `?${queryString}`;
           }
           if (request.fragment) {
-            path16 += `#${request.fragment}`;
+            path20 += `#${request.fragment}`;
           }
           let hostname = request.hostname ?? "";
           if (hostname[0] === "[" && hostname.endsWith("]")) {
@@ -14705,7 +14705,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: request.headers,
             host: hostname,
             method: request.method,
-            path: path16,
+            path: path20,
             port: request.port,
             agent,
             auth
@@ -14988,16 +14988,16 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             reject(err);
           };
           const queryString = querystringBuilder.buildQueryString(query || {});
-          let path16 = request.path;
+          let path20 = request.path;
           if (queryString) {
-            path16 += `?${queryString}`;
+            path20 += `?${queryString}`;
           }
           if (request.fragment) {
-            path16 += `#${request.fragment}`;
+            path20 += `#${request.fragment}`;
           }
           const req = session.request({
             ...request.headers,
-            [http2.constants.HTTP2_HEADER_PATH]: path16,
+            [http2.constants.HTTP2_HEADER_PATH]: path20,
             [http2.constants.HTTP2_HEADER_METHOD]: method
           });
           session.ref();
@@ -15184,13 +15184,13 @@ var require_dist_cjs14 = __commonJS({
           const abortError = buildAbortError(abortSignal);
           return Promise.reject(abortError);
         }
-        let path16 = request.path;
+        let path20 = request.path;
         const queryString = querystringBuilder.buildQueryString(request.query || {});
         if (queryString) {
-          path16 += `?${queryString}`;
+          path20 += `?${queryString}`;
         }
         if (request.fragment) {
-          path16 += `#${request.fragment}`;
+          path20 += `#${request.fragment}`;
         }
         let auth = "";
         if (request.username != null || request.password != null) {
@@ -15199,7 +15199,7 @@ var require_dist_cjs14 = __commonJS({
           auth = `${username}:${password}@`;
         }
         const { port, method } = request;
-        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path16}`;
+        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path20}`;
         const body = method === "GET" || method === "HEAD" ? void 0 : request.body;
         const requestOptions = {
           body,
@@ -17431,13 +17431,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path16, preserveJsx) {
-  if (typeof path16 === "string" && /^\.\.?\//.test(path16)) {
-    return path16.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
+function __rewriteRelativeImportExtension(path20, preserveJsx) {
+  if (typeof path20 === "string" && /^\.\.?\//.test(path20)) {
+    return path20.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d5 && (!ext || !cm) ? m5 : d5 + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path16;
+  return path20;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -18335,11 +18335,11 @@ var init_HttpBindingProtocol = __esm({
           const opTraits = translateTraits(operationSchema.traits);
           if (opTraits.http) {
             request.method = opTraits.http[0];
-            const [path16, search] = opTraits.http[1].split("?");
+            const [path20, search] = opTraits.http[1].split("?");
             if (request.path == "/") {
-              request.path = path16;
+              request.path = path20;
             } else {
-              request.path += path16;
+              request.path += path20;
             }
             const traitSearchParams = new URLSearchParams(search ?? "");
             Object.assign(query, Object.fromEntries(traitSearchParams));
@@ -18742,8 +18742,8 @@ var init_requestBuilder = __esm({
         return this;
       }
       p(memberName, labelValueProvider, uriLabel, isGreedyLabel) {
-        this.resolvePathStack.push((path16) => {
-          this.path = resolvedPath(path16, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
+        this.resolvePathStack.push((path20) => {
+          this.path = resolvedPath(path20, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
         });
         return this;
       }
@@ -19393,18 +19393,18 @@ var require_dist_cjs20 = __commonJS({
       }
     };
     var booleanEquals = (value1, value2) => value1 === value2;
-    var getAttrPathList = (path16) => {
-      const parts = path16.split(".");
+    var getAttrPathList = (path20) => {
+      const parts = path20.split(".");
       const pathList = [];
       for (const part of parts) {
         const squareBracketIndex = part.indexOf("[");
         if (squareBracketIndex !== -1) {
           if (part.indexOf("]") !== part.length - 1) {
-            throw new EndpointError(`Path: '${path16}' does not end with ']'`);
+            throw new EndpointError(`Path: '${path20}' does not end with ']'`);
           }
           const arrayIndex = part.slice(squareBracketIndex + 1, -1);
           if (Number.isNaN(parseInt(arrayIndex))) {
-            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path16}'`);
+            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path20}'`);
           }
           if (squareBracketIndex !== 0) {
             pathList.push(part.slice(0, squareBracketIndex));
@@ -19416,9 +19416,9 @@ var require_dist_cjs20 = __commonJS({
       }
       return pathList;
     };
-    var getAttr = (value, path16) => getAttrPathList(path16).reduce((acc, index) => {
+    var getAttr = (value, path20) => getAttrPathList(path20).reduce((acc, index) => {
       if (typeof acc !== "object") {
-        throw new EndpointError(`Index '${index}' in '${path16}' not found in '${JSON.stringify(value)}'`);
+        throw new EndpointError(`Index '${index}' in '${path20}' not found in '${JSON.stringify(value)}'`);
       } else if (Array.isArray(acc)) {
         return acc[parseInt(index)];
       }
@@ -19437,8 +19437,8 @@ var require_dist_cjs20 = __commonJS({
             return value;
           }
           if (typeof value === "object" && "hostname" in value) {
-            const { hostname: hostname2, port, protocol: protocol2 = "", path: path16 = "", query = {} } = value;
-            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path16}`);
+            const { hostname: hostname2, port, protocol: protocol2 = "", path: path20 = "", query = {} } = value;
+            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path20}`);
             url.search = Object.entries(query).map(([k6, v5]) => `${k6}=${v5}`).join("&");
             return url;
           }
@@ -20883,10 +20883,10 @@ ${longDate}
 ${credentialScope}
 ${utilHexEncoding.toHex(hashedRequest)}`;
       }
-      getCanonicalPath({ path: path16 }) {
+      getCanonicalPath({ path: path20 }) {
         if (this.uriEscapePath) {
           const normalizedPathSegments = [];
-          for (const pathSegment of path16.split("/")) {
+          for (const pathSegment of path20.split("/")) {
             if (pathSegment?.length === 0)
               continue;
             if (pathSegment === ".")
@@ -20897,11 +20897,11 @@ ${utilHexEncoding.toHex(hashedRequest)}`;
               normalizedPathSegments.push(pathSegment);
             }
           }
-          const normalizedPath = `${path16?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path16?.endsWith("/") ? "/" : ""}`;
+          const normalizedPath = `${path20?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path20?.endsWith("/") ? "/" : ""}`;
           const doubleEncoded = utilUriEscape.escapeUri(normalizedPath);
           return doubleEncoded.replace(/%2F/g, "/");
         }
-        return path16;
+        return path20;
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -22205,11 +22205,11 @@ var init_SmithyRpcV2CborProtocol = __esm({
           }
         }
         const { service, operation: operation2 } = (0, import_util_middleware5.getSmithyContext)(context);
-        const path16 = `/service/${service}/operation/${operation2}`;
+        const path20 = `/service/${service}/operation/${operation2}`;
         if (request.path.endsWith("/")) {
-          request.path += path16.slice(1);
+          request.path += path20.slice(1);
         } else {
-          request.path += path16;
+          request.path += path20;
         }
         return request;
       }
@@ -27854,14 +27854,14 @@ var require_readFile = __commonJS({
     var promises_1 = __require("node:fs/promises");
     exports.filePromises = {};
     exports.fileIntercept = {};
-    var readFile = (path16, options) => {
-      if (exports.fileIntercept[path16] !== void 0) {
-        return exports.fileIntercept[path16];
+    var readFile = (path20, options) => {
+      if (exports.fileIntercept[path20] !== void 0) {
+        return exports.fileIntercept[path20];
       }
-      if (!exports.filePromises[path16] || options?.ignoreCache) {
-        exports.filePromises[path16] = (0, promises_1.readFile)(path16, "utf8");
+      if (!exports.filePromises[path20] || options?.ignoreCache) {
+        exports.filePromises[path20] = (0, promises_1.readFile)(path20, "utf8");
       }
-      return exports.filePromises[path16];
+      return exports.filePromises[path20];
     };
     exports.readFile = readFile;
   }
@@ -27874,7 +27874,7 @@ var require_dist_cjs33 = __commonJS({
     var getHomeDir = require_getHomeDir();
     var getSSOTokenFilepath = require_getSSOTokenFilepath();
     var getSSOTokenFromFile = require_getSSOTokenFromFile();
-    var path16 = __require("path");
+    var path20 = __require("path");
     var types = require_dist_cjs();
     var readFile = require_readFile();
     var ENV_PROFILE = "AWS_PROFILE";
@@ -27896,9 +27896,9 @@ var require_dist_cjs33 = __commonJS({
       ...data2.default && { default: data2.default }
     });
     var ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path16.join(getHomeDir.getHomeDir(), ".aws", "config");
+    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path20.join(getHomeDir.getHomeDir(), ".aws", "config");
     var ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path16.join(getHomeDir.getHomeDir(), ".aws", "credentials");
+    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path20.join(getHomeDir.getHomeDir(), ".aws", "credentials");
     var prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/;
     var profileNameBlockList = ["__proto__", "profile __proto__"];
     var parseIni = (iniData) => {
@@ -27953,11 +27953,11 @@ var require_dist_cjs33 = __commonJS({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = path16.join(homeDir, filepath.slice(2));
+        resolvedFilepath = path20.join(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = path16.join(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = path20.join(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile.readFile(resolvedConfigFilepath, {
@@ -27996,8 +27996,8 @@ var require_dist_cjs33 = __commonJS({
       getFileRecord() {
         return readFile.fileIntercept;
       },
-      interceptFile(path17, contents) {
-        readFile.fileIntercept[path17] = Promise.resolve(contents);
+      interceptFile(path21, contents) {
+        readFile.fileIntercept[path21] = Promise.resolve(contents);
       },
       getTokenRecord() {
         return getSSOTokenFromFile.tokenIntercept;
@@ -28322,8 +28322,8 @@ var require_dist_cjs36 = __commonJS({
               return endpoint.url.href;
             }
             if ("hostname" in endpoint) {
-              const { protocol, hostname, port, path: path16 } = endpoint;
-              return `${protocol}//${hostname}${port ? ":" + port : ""}${path16}`;
+              const { protocol, hostname, port, path: path20 } = endpoint;
+              return `${protocol}//${hostname}${port ? ":" + port : ""}${path20}`;
             }
           }
           return endpoint;
@@ -36520,8 +36520,8 @@ var require_dist_cjs53 = __commonJS({
 });
 
 // ../canopycms/src/worker/cms-worker.ts
-import fs9 from "node:fs/promises";
-import path13 from "node:path";
+import fs13 from "node:fs/promises";
+import path17 from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
@@ -37112,8 +37112,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path16) {
-  return (0, import_file_exists.exists)(path16, import_file_exists.FOLDER);
+function folderExists(path20) {
+  return (0, import_file_exists.exists)(path20, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -37515,8 +37515,8 @@ function checkIsRepoRootTask() {
     commands: commands5,
     format: "utf-8",
     onError,
-    parser(path16) {
-      return /^\.(git)?$/.test(path16.trim());
+    parser(path20) {
+      return /^\.(git)?$/.test(path20.trim());
     }
   };
 }
@@ -37950,11 +37950,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path16, line, preview] = input.split(NULL);
-    paths.add(path16);
-    (results[path16] = results[path16] || []).push({
+    const [path20, line, preview] = input.split(NULL);
+    paths.add(path20);
+    (results[path20] = results[path20] || []).push({
       line: asNumber(line),
-      path: path16,
+      path: path20,
       preview
     });
   });
@@ -38718,14 +38718,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path16, text) {
+function parseInit(bare, path20, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path16, false, result[1]);
+    return new InitSummary(bare, path20, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path16, true, result[1]);
+    return new InitSummary(bare, path20, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -38736,7 +38736,7 @@ function parseInit(bare, path16, text) {
       break;
     }
   }
-  return new InitSummary(bare, path16, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path20, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -38745,9 +38745,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path16, existing, gitDir) {
+      constructor(bare, path20, existing, gitDir) {
         this.bare = bare;
-        this.path = path16;
+        this.path = path20;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -38759,7 +38759,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path16, customArgs) {
+function initTask(bare = false, path20, customArgs) {
   const commands5 = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands5)) {
     commands5.splice(1, 0, bareCommand);
@@ -38768,7 +38768,7 @@ function initTask(bare = false, path16, customArgs) {
     commands: commands5,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands5.includes("--bare"), path16, text);
+      return parseInit(commands5.includes("--bare"), path20, text);
     }
   };
 }
@@ -39583,12 +39583,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path16, index, working_dir) {
-        this.path = path16;
+      constructor(path20, index, working_dir) {
+        this.path = path20;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path16) || [null, path16, path16];
+          const detail = fromPathRegex.exec(path20) || [null, path20, path20];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -39619,14 +39619,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data2(index, workingDir, path16) {
+  function data2(index, workingDir, path20) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path16);
+      handler(result, path20);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path16, index, workingDir));
+      result.files.push(new FileStatusSummary(path20, index, workingDir));
     }
   }
 }
@@ -39977,9 +39977,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path16, write) {
+      hashObject(path20, write) {
         return this._runTask(
-          hashObjectTask(path16, write === true),
+          hashObjectTask(path20, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -40333,8 +40333,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path16 = input.trim().replace(/^["']|["']$/g, "");
-  return path16 && normalize(path16);
+  const path20 = input.trim().replace(/^["']|["']$/g, "");
+  return path20 && normalize(path20);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -40619,8 +40619,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path16) {
-  return subModuleTask(["add", repo, path16]);
+function addSubModuleTask(repo, path20) {
+  return subModuleTask(["add", repo, path20]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -40934,8 +40934,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path16, then) {
-      return this._runTask(addSubModuleTask2(repo, path16), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path20, then) {
+      return this._runTask(addSubModuleTask2(repo, path20), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -42040,23 +42040,97 @@ async function createOrUpdatePullRequest(params) {
   return { number: pr.data.number, url: pr.data.html_url, created: true };
 }
 
+// ../canopycms/src/paths/branch-name.ts
+function sanitizeBranchName(branchName) {
+  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const squashed = replaced.replace(/-+/g, "-");
+  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
+  return trimmedDots || "branch";
+}
+var RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
+
+// ../canopycms/src/worker/cms-worker.ts
+init_deployment_name();
+
+// ../canopycms/src/worker/worker-status.ts
+import path4 from "node:path";
+var WORKER_STATUS_FILE = "worker-status.json";
+async function writeWorkerStatus(taskDir, report) {
+  const filePath = path4.join(taskDir, WORKER_STATUS_FILE);
+  const stamped = { ...report, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+  await atomicWriteFile(filePath, JSON.stringify(stamped, null, 2));
+}
+
+// ../canopycms/src/worker/log.ts
+init_logger();
+function timestamp() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function workerLog(...args) {
+  console.log(timestamp(), "INFO", ...args);
+}
+function workerLogWarn(...args) {
+  console.warn(timestamp(), "WARN", ...args);
+}
+function workerLogError(...args) {
+  console.error(timestamp(), "ERROR", ...args);
+}
+function installWorkerLogger() {
+  setCanopyLogger({ log: workerLog, warn: workerLogWarn, error: workerLogError });
+}
+
+// ../canopycms/src/worker/task-runner.ts
+import fs10 from "node:fs/promises";
+
 // ../canopycms/src/branch-metadata.ts
-import fs6 from "node:fs/promises";
-import path7 from "node:path";
+import fs7 from "node:fs/promises";
+import path9 from "node:path";
 
 // ../canopycms/src/branch-registry.ts
-import fs4 from "node:fs/promises";
+import fs5 from "node:fs/promises";
+import path7 from "node:path";
+
+// ../canopycms/src/branch-metadata-file.ts
+import fs3 from "node:fs/promises";
 import path5 from "node:path";
+var BRANCH_META_DIR = ".canopy-meta";
+var BRANCH_META_FILE = "branch.json";
+var BranchMetadataCorruptError = class extends Error {
+  constructor(branchRoot, cause) {
+    super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
+    this.name = "BranchMetadataCorruptError";
+    this.branchRoot = branchRoot;
+    this.parseCause = cause;
+  }
+};
+var branchMetadataFilePath = (branchRoot) => path5.join(path5.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
+async function readBranchMetadataFile(branchRoot) {
+  const resolvedRoot = path5.resolve(branchRoot);
+  try {
+    const raw = await fs3.readFile(branchMetadataFilePath(resolvedRoot), "utf8");
+    return JSON.parse(raw);
+  } catch (err) {
+    if (isNotFoundError2(err)) {
+      return null;
+    }
+    if (err instanceof SyntaxError) {
+      throw new BranchMetadataCorruptError(resolvedRoot, err.message);
+    }
+    throw err;
+  }
+}
+
+// ../canopycms/src/branch-registry.ts
 init_logger();
 
 // ../canopycms/src/resource-generation.ts
-import fs3 from "node:fs/promises";
-import path4 from "node:path";
+import fs4 from "node:fs/promises";
+import path6 from "node:path";
 import { randomUUID } from "node:crypto";
 var log = createDebugLogger({ prefix: "ResourceGeneration" });
 var META_DIR = ".canopy-meta";
 function resourceGenerationPath(root, resource) {
-  return path4.resolve(root, META_DIR, `${resource}.generation`);
+  return path6.resolve(root, META_DIR, `${resource}.generation`);
 }
 async function bumpResourceGeneration(root, resource, options) {
   const token = randomUUID();
@@ -42073,7 +42147,7 @@ async function bumpResourceGeneration(root, resource, options) {
 }
 async function readResourceGeneration(root, resource) {
   try {
-    const token = await fs3.readFile(resourceGenerationPath(root, resource), "utf-8");
+    const token = await fs4.readFile(resourceGenerationPath(root, resource), "utf-8");
     return { ok: true, token };
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT") return { ok: true, token: null };
@@ -42101,10 +42175,10 @@ var BranchRegistry = class {
     this.regenInFlight = null;
     /** Throttle clock for the get() suspicious-miss backstop. */
     this.lastForcedRefreshMs = 0;
-    this.root = path5.resolve(root);
-    this.registryPath = path5.join(this.root, REGISTRY_FILE);
-    this.stalePath = path5.join(this.root, REGISTRY_STALE_FILE);
-    this.tempPath = path5.join(this.root, REGISTRY_TEMP_FILE);
+    this.root = path7.resolve(root);
+    this.registryPath = path7.join(this.root, REGISTRY_FILE);
+    this.stalePath = path7.join(this.root, REGISTRY_STALE_FILE);
+    this.tempPath = path7.join(this.root, REGISTRY_TEMP_FILE);
   }
   /**
    * Returns all branches. Uses the cached snapshot if its embedded generation
@@ -42113,7 +42187,7 @@ var BranchRegistry = class {
   async list() {
     let parsed;
     try {
-      const raw = await fs4.readFile(this.registryPath, "utf8");
+      const raw = await fs5.readFile(this.registryPath, "utf8");
       parsed = JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError2(err)) {
@@ -42197,7 +42271,7 @@ var BranchRegistry = class {
   async performRegenerate() {
     const read = await readResourceGeneration(this.root, RESOURCE);
     const branches = await this.scanBranchDirectories();
-    await fs4.unlink(this.stalePath).catch(() => {
+    await fs5.unlink(this.stalePath).catch(() => {
     });
     if (!read.ok) {
       return branches;
@@ -42208,12 +42282,12 @@ var BranchRegistry = class {
       generation: read.token
     };
     const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs4.mkdir(this.root, { recursive: true });
-    await fs4.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs5.mkdir(this.root, { recursive: true });
+    await fs5.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
-      await fs4.rename(uniqueTempPath, this.registryPath);
+      await fs5.rename(uniqueTempPath, this.registryPath);
     } catch (err) {
-      await fs4.unlink(uniqueTempPath).catch(() => {
+      await fs5.unlink(uniqueTempPath).catch(() => {
       });
       throw err;
     }
@@ -42227,15 +42301,15 @@ var BranchRegistry = class {
   async scanBranchDirectories() {
     const branches = [];
     try {
-      const entries = await fs4.readdir(this.root, { withFileTypes: true });
+      const entries = await fs5.readdir(this.root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) {
           continue;
         }
-        const branchRoot = path5.join(this.root, entry.name);
+        const branchRoot = path7.join(this.root, entry.name);
         let meta;
         try {
-          meta = await BranchMetadataFileManager.loadOnly(branchRoot);
+          meta = await readBranchMetadataFile(branchRoot);
         } catch (err) {
           canopyLogWarn(
             `CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage2(err)}`
@@ -42275,15 +42349,6 @@ function isValidContentId(id) {
 // ../canopycms/src/paths/branch.ts
 init_operating_mode();
 
-// ../canopycms/src/paths/branch-name.ts
-function sanitizeBranchName(branchName) {
-  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
-  const squashed = replaced.replace(/-+/g, "-");
-  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
-  return trimmedDots || "branch";
-}
-var RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
-
 // ../canopycms/src/utils/async-mutex.ts
 var locks = /* @__PURE__ */ new Map();
 async function withLock(key, fn) {
@@ -42304,8 +42369,8 @@ async function withLock(key, fn) {
 
 // ../canopycms/src/utils/occ-json-write.ts
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import fs5 from "node:fs/promises";
-import path6 from "node:path";
+import fs6 from "node:fs/promises";
+import path8 from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 var log3 = createDebugLogger({ prefix: "OccJsonWrite" });
 var OccWriteConflictError = class extends Error {
@@ -42320,29 +42385,29 @@ async function writeOccJsonFile(filePath, payload2, options) {
   const writeId = randomUUID2();
   const data2 = { ...payload2, version: newVersion, writeId };
   const content = JSON.stringify(data2, null, 2) + (trailingNewline ? "\n" : "");
-  const dir = path6.dirname(filePath);
-  await fs5.mkdir(dir, { recursive: true });
+  const dir = path8.dirname(filePath);
+  await fs6.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs5.writeFile(tempPath, content, "utf-8");
+  await fs6.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs5.link(tempPath, filePath);
+      await fs6.link(tempPath, filePath);
     } catch (err) {
-      await fs5.unlink(tempPath).catch(() => {
+      await fs6.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError(err)) {
         throw new OccWriteConflictError();
       }
       throw err;
     }
-    await fs5.unlink(tempPath).catch(() => {
+    await fs6.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs5.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs6.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -42350,16 +42415,16 @@ async function writeOccJsonFile(filePath, payload2, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError();
     }
-    await fs5.rename(tempPath, filePath);
+    await fs6.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs5.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs6.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError();
     }
   } catch (err) {
-    await fs5.unlink(tempPath).catch(() => {
+    await fs6.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -42385,8 +42450,8 @@ async function withOccRetry(operation2, options) {
   throw new Error("Unreachable");
 }
 async function withOccFileLock(filePath, fn) {
-  const dir = path6.dirname(filePath);
-  await fs5.mkdir(dir, { recursive: true });
+  const dir = path8.dirname(filePath);
+  await fs6.mkdir(dir, { recursive: true });
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -42429,8 +42494,6 @@ async function withOccFileLock(filePath, fn) {
 }
 
 // ../canopycms/src/branch-metadata.ts
-var BRANCH_META_DIR = ".canopy-meta";
-var BRANCH_META_FILE = "branch.json";
 var CURRENT_SCHEMA_VERSION = 1;
 var BranchMetadataConflictError = class extends Error {
   constructor(message = "Concurrent modification detected in branch metadata") {
@@ -42438,18 +42501,10 @@ var BranchMetadataConflictError = class extends Error {
     this.name = "BranchMetadataConflictError";
   }
 };
-var BranchMetadataCorruptError = class extends Error {
-  constructor(branchRoot, cause) {
-    super(`Corrupt branch metadata in '${branchRoot}': ${cause}`);
-    this.name = "BranchMetadataCorruptError";
-    this.branchRoot = branchRoot;
-    this.parseCause = cause;
-  }
-};
 var BranchMetadataFileManager = class _BranchMetadataFileManager {
   constructor(branchRoot, baseRoot, options) {
-    this.branchRoot = path7.resolve(branchRoot);
-    this.filePath = path7.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
+    this.branchRoot = path9.resolve(branchRoot);
+    this.filePath = path9.join(this.branchRoot, BRANCH_META_DIR, BRANCH_META_FILE);
     this.baseRoot = baseRoot;
     this.settleMs = options?.settleMs;
   }
@@ -42458,20 +42513,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
    */
   static async loadOnly(branchRoot) {
-    const resolvedRoot = path7.resolve(branchRoot);
-    const filePath = path7.join(resolvedRoot, BRANCH_META_DIR, BRANCH_META_FILE);
-    try {
-      const raw = await fs6.readFile(filePath, "utf8");
-      return JSON.parse(raw);
-    } catch (err) {
-      if (isNotFoundError2(err)) {
-        return null;
-      }
-      if (err instanceof SyntaxError) {
-        throw new BranchMetadataCorruptError(resolvedRoot, err.message);
-      }
-      throw err;
-    }
+    return readBranchMetadataFile(branchRoot);
   }
   /**
    * Get a BranchMetadataFileManager instance configured for registry invalidation.
@@ -42482,7 +42524,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   }
   async load() {
     try {
-      const raw = await fs6.readFile(this.filePath, "utf8");
+      const raw = await fs7.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -42544,7 +42586,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    */
   async save(incoming) {
     try {
-      await fs6.stat(this.branchRoot);
+      await fs7.stat(this.branchRoot);
     } catch (err) {
       if (isNotFoundError2(err)) {
         throw new BranchMetadataConflictError("Branch no longer exists");
@@ -42626,30 +42668,8 @@ var getBranchMetadataFileManager = (branchRoot, baseRoot, options) => {
   return BranchMetadataFileManager.get(branchRoot, baseRoot, options);
 };
 
-// ../canopycms/src/id.ts
-var import_short_uuid = __toESM(require_dist3(), 1);
-var isValidId = isValidContentId;
-
-// ../canopycms/src/content-id-index.ts
-init_logger();
-function extractIdFromFilename(filename) {
-  if (filename.startsWith(".")) {
-    return null;
-  }
-  const parts = filename.split(".");
-  if (parts.length >= 3) {
-    const candidate = parts[parts.length - 2];
-    if (isValidId(candidate)) return candidate;
-  }
-  if (parts.length === 2) {
-    const candidate = parts[parts.length - 1];
-    if (isValidId(candidate)) return candidate;
-  }
-  return null;
-}
-
 // ../canopycms/src/content-index-registry.ts
-import path8 from "node:path";
+import path10 from "node:path";
 var registry = /* @__PURE__ */ new Map();
 var finalization = new FinalizationRegistry(({ rootKey, ref }) => {
   const refs = registry.get(rootKey);
@@ -42658,8 +42678,8 @@ var finalization = new FinalizationRegistry(({ rootKey, ref }) => {
   if (refs.size === 0) registry.delete(rootKey);
 });
 function invalidateContentIndexesForRoot(root) {
-  const rootKey = path8.resolve(root);
-  const prefix = rootKey + path8.sep;
+  const rootKey = path10.resolve(root);
+  const prefix = rootKey + path10.sep;
   for (const [storeRoot, refs] of registry) {
     if (storeRoot !== rootKey && !storeRoot.startsWith(prefix)) continue;
     for (const ref of refs) {
@@ -42677,6 +42697,30 @@ function invalidateContentIndexesForRoot(root) {
 // ../canopycms/src/schema/meta-loader.ts
 init_zod();
 init_logger();
+
+// ../canopycms/src/id.ts
+var import_short_uuid = __toESM(require_dist3(), 1);
+var isValidId = isValidContentId;
+
+// ../canopycms/src/content-id-index.ts
+init_logger();
+function extractIdFromFilename(filename) {
+  if (filename.startsWith(".")) {
+    return null;
+  }
+  const parts = filename.split(".");
+  if (parts.length >= 3) {
+    const candidate = parts[parts.length - 2];
+    if (isValidId(candidate)) return candidate;
+  }
+  if (parts.length === 2) {
+    const candidate = parts[parts.length - 1];
+    if (isValidId(candidate)) return candidate;
+  }
+  return null;
+}
+
+// ../canopycms/src/schema/meta-loader.ts
 var entryTypeMetaSchema = external_exports.object({
   name: external_exports.string().min(1),
   format: external_exports.enum(["md", "mdx", "json", "yaml"]),
@@ -42733,13 +42777,9 @@ async function invalidateBranchContentCaches(root) {
   invalidateContentIndexesForRoot(root);
 }
 
-// ../canopycms/src/worker/cms-worker.ts
-init_types3();
-init_normalize();
-
 // ../canopycms/src/utils/git.ts
-import fs7 from "node:fs/promises";
-import path9 from "node:path";
+import fs8 from "node:fs/promises";
+import path11 from "node:path";
 var REJECTED_MARKER = "[rejected]";
 var NON_FAST_FORWARD_REASONS = ["non-fast-forward", "fetch first"];
 var REJECTION_HINT = "Updates were rejected because";
@@ -42752,20 +42792,20 @@ function isStaleLeaseRejection(message) {
   return message.includes(REJECTED_MARKER) && message.includes(STALE_LEASE_REASON);
 }
 async function resolveGitDir(repoPath) {
-  const dotGit = path9.join(repoPath, ".git");
+  const dotGit = path11.join(repoPath, ".git");
   let stat;
   try {
-    stat = await fs7.stat(dotGit);
+    stat = await fs8.stat(dotGit);
   } catch {
     return null;
   }
   if (stat.isDirectory()) return dotGit;
   try {
-    const pointer = await fs7.readFile(dotGit, "utf-8");
+    const pointer = await fs8.readFile(dotGit, "utf-8");
     const match2 = /^gitdir:\s*(.+)$/m.exec(pointer);
     if (!match2) return null;
     const target = match2[1].trim();
-    return path9.isAbsolute(target) ? target : path9.resolve(repoPath, target);
+    return path11.isAbsolute(target) ? target : path11.resolve(repoPath, target);
   } catch {
     return null;
   }
@@ -42775,7 +42815,7 @@ async function isRebaseInProgress(repoPath) {
   if (!gitDir) return false;
   const results = await Promise.all(
     ["rebase-merge", "rebase-apply"].map(
-      (dir) => fs7.stat(path9.join(gitDir, dir)).then(() => true).catch(() => false)
+      (dir) => fs8.stat(path11.join(gitDir, dir)).then(() => true).catch(() => false)
     )
   );
   return results.some(Boolean);
@@ -42783,8 +42823,8 @@ async function isRebaseInProgress(repoPath) {
 
 // ../canopycms/src/utils/provisioning-lock.ts
 var import_proper_lockfile2 = __toESM(require_proper_lockfile(), 1);
-import fs8 from "node:fs/promises";
-import path10 from "node:path";
+import fs9 from "node:fs/promises";
+import path12 from "node:path";
 init_logger();
 function provisioningLockOptions(lockPath, retries, onCompromised) {
   return {
@@ -42836,8 +42876,8 @@ function releaseIgnoringAlreadyReleased(release, lockPath) {
   };
 }
 async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
-  await fs8.mkdir(lockTargetDir2, { recursive: true });
-  const lockPath = path10.join(lockTargetDir2, lockName);
+  await fs9.mkdir(lockTargetDir2, { recursive: true });
+  const lockPath = path12.join(lockTargetDir2, lockName);
   const release = await import_proper_lockfile2.default.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised));
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
@@ -42864,65 +42904,110 @@ function gitNetworkChildEnv() {
 }
 var GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
 
-// ../canopycms/src/worker/cms-worker.ts
-init_deployment_name();
-
-// ../canopycms/src/utils/content-write-lock.ts
-import path11 from "node:path";
-init_logger();
-var META_DIR2 = ".canopy-meta";
-var CONTENT_WRITE_LOCK_NAME = "content-write.lock";
-function lockTargetDir(branchRoot) {
-  return path11.join(path11.resolve(branchRoot), META_DIR2);
-}
-function tryAcquireContentWriteLock(branchRoot, onCompromised) {
-  return tryAcquireProvisioningLock(
-    lockTargetDir(branchRoot),
-    CONTENT_WRITE_LOCK_NAME,
-    onCompromised
-  );
+// ../canopycms/src/worker/history-rewrite.ts
+import path13 from "node:path";
+async function readPublishedSha(ctx, branchRef) {
+  try {
+    const out = await simpleGit().raw([
+      "--git-dir",
+      ctx.remoteGitPath,
+      "rev-parse",
+      "--verify",
+      `refs/heads/${branchRef}`
+    ]);
+    const sha = out.trim();
+    return sha.length > 0 ? sha : null;
+  } catch {
+    return null;
+  }
 }
-
-// ../canopycms/src/worker/worker-status.ts
-import path12 from "node:path";
-var WORKER_STATUS_FILE = "worker-status.json";
-async function writeWorkerStatus(taskDir, report) {
-  const filePath = path12.join(taskDir, WORKER_STATUS_FILE);
-  const stamped = { ...report, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  await atomicWriteFile(filePath, JSON.stringify(stamped, null, 2));
+async function markHistoryRewritten(ctx, branchPath, branchDir, expectedSha) {
+  const current = await BranchMetadataFileManager.loadOnly(branchPath);
+  if (typeof current?.branch.historyRewrittenFrom === "string") return;
+  const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+  await meta.save({ branch: { name: branchDir, historyRewrittenFrom: expectedSha } });
 }
-
-// ../canopycms/src/worker/log.ts
-init_logger();
-function timestamp() {
-  return (/* @__PURE__ */ new Date()).toISOString();
+async function clearHistoryRewrittenMarker(ctx, branchPath, branchDir) {
+  try {
+    const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+    await meta.save({ branch: { name: branchDir, historyRewrittenFrom: void 0 } });
+  } catch (err) {
+    workerLogWarn(
+      `  Failed to clear history-rewrite marker for ${branchDir}: ${getErrorMessage2(err)}`
+    );
+  }
 }
-function workerLog(...args) {
-  console.log(timestamp(), "INFO", ...args);
+async function forcePublishToLocalRemote(ctx, branchPath, branchRef, expectedSha) {
+  const pushGit = simpleGit({ baseDir: branchPath, timeout: { block: ctx.taskTimeoutMs } });
+  pushGit.env(gitChildEnv({}));
+  try {
+    await pushGit.raw([
+      "push",
+      `--force-with-lease=${branchRef}:${expectedSha}`,
+      // Real flags must precede --end-of-options; everything after it is
+      // positional (see GitManager.push() for the same guard).
+      "--end-of-options",
+      "origin",
+      `${branchRef}:${branchRef}`
+    ]);
+    workerLog(`  Published rebased ${branchRef} into remote.git`);
+    return true;
+  } catch (err) {
+    const message = redactCredentials(getErrorMessage2(err));
+    workerLogWarn(
+      isStaleLeaseRejection(message) ? `  Did not publish rebased ${branchRef} into remote.git: it moved since this cycle read it (concurrent submit?) -- retrying next cycle` : `  Failed to publish rebased ${branchRef} into remote.git: ${message}`
+    );
+    return false;
+  }
 }
-function workerLogWarn(...args) {
-  console.warn(timestamp(), "WARN", ...args);
+async function enqueueGitHubPush(ctx, branchRef) {
+  try {
+    for (const status of ["pending", "processing"]) {
+      const inFlight = await listTasks(ctx.taskDir, status);
+      if (inFlight.some((t6) => t6.action === "push-branch" && t6.payload.branch === branchRef)) {
+        return;
+      }
+    }
+    await enqueueTask(ctx.taskDir, { action: "push-branch", payload: { branch: branchRef } });
+    workerLog(`  Queued GitHub push for ${branchRef}`);
+  } catch (err) {
+    workerLogWarn(`  Failed to queue GitHub push for ${branchRef}: ${getErrorMessage2(err)}`);
+  }
 }
-function workerLogError(...args) {
-  console.error(timestamp(), "ERROR", ...args);
+async function reconcilePendingRewrite(ctx, options) {
+  const { branchPath, branchDir, branchRef, headSha, marker } = options;
+  const publishedSha = await readPublishedSha(ctx, branchRef);
+  if (publishedSha === null) {
+    workerLogWarn(
+      `  ${branchDir}: a rewritten history is recorded but ${branchRef} is gone from remote.git -- nothing to publish`
+    );
+    return;
+  }
+  if (publishedSha === headSha) {
+    await enqueueGitHubPush(ctx, branchRef);
+    return;
+  }
+  if (publishedSha === marker) {
+    if (await forcePublishToLocalRemote(ctx, branchPath, branchRef, marker)) {
+      await enqueueGitHubPush(ctx, branchRef);
+    }
+    return;
+  }
+  workerLogWarn(
+    `  ${branchDir}: remote.git is at ${publishedSha} for ${branchRef}, which is neither the rebased tip nor the commit the rewrite replaced -- left untouched`
+  );
 }
-function installWorkerLogger() {
-  setCanopyLogger({ log: workerLog, warn: workerLogWarn, error: workerLogError });
+async function hasPendingHistoryRewrite(ctx, branchName) {
+  try {
+    const branchPath = path13.join(ctx.contentBranchesPath, sanitizeBranchName(branchName));
+    const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
+    return typeof metaFile?.branch.historyRewrittenFrom === "string";
+  } catch {
+    return false;
+  }
 }
 
-// ../canopycms/src/worker/cms-worker.ts
-var DEFAULT_TASK_TIMEOUT = 6e4;
-var DEFAULT_MAX_RETRIES2 = 3;
-var DEFAULT_LOCK_STALE_MS = 6e4;
-var TRASH_RETENTION_MS = 30 * 24 * 60 * 6e4;
-var TRASH_DIR_STAMP_RE = /-(\d{8}T\d{6}Z)$/;
-function parseTrashStamp(stamp) {
-  const match2 = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(stamp);
-  if (!match2) return null;
-  const [, year2, month, day, hour, minute, second] = match2;
-  const date2 = /* @__PURE__ */ new Date(`${year2}-${month}-${day}T${hour}:${minute}:${second}.000Z`);
-  return Number.isNaN(date2.getTime()) ? null : date2;
-}
+// ../canopycms/src/worker/task-runner.ts
 var PermanentTaskError = class extends Error {
 };
 function isPermanentTaskFailure(err) {
@@ -42973,6 +43058,1019 @@ function optionalString(payload2, key, fallback) {
   const val = payload2[key];
   return typeof val === "string" ? val : fallback;
 }
+function orphanRecoveryMaxAgeMs(ctx) {
+  return Math.max(5 * 6e4, ctx.taskTimeoutMs * 2);
+}
+async function processTaskQueue(ctx) {
+  if (!ctx.isRunning()) return;
+  const recovered = await recoverOrphanedTasks(ctx.taskDir, orphanRecoveryMaxAgeMs(ctx), ctx.log);
+  if (recovered > 0) {
+    workerLog(`Recovered ${recovered} orphaned task(s)`);
+  }
+  let processed = 0;
+  let task;
+  while (processed < ctx.maxTasksPerCycle && (task = await dequeueTask(ctx.taskDir, ctx.log)) !== null) {
+    try {
+      const result = await executeTaskWithTimeout(ctx, task);
+      await completeTask(ctx.taskDir, task.id, result, ctx.log);
+      await updateBranchMetadata(ctx, task, result);
+    } catch (err) {
+      const message = getErrorMessage2(err);
+      workerLogError(`Task ${task.id} (${task.action}) failed:`, message);
+      const persistedMessage = redactCredentials(message);
+      const permanent = isPermanentTaskFailure(err);
+      const retryCount = task.retryCount ?? 0;
+      const maxRetries = task.maxRetries ?? ctx.maxRetries;
+      if (!permanent && retryCount < maxRetries) {
+        await retryTask(ctx.taskDir, task.id, persistedMessage, ctx.log);
+        workerLog(`  Will retry (attempt ${retryCount + 1}/${maxRetries})`);
+      } else {
+        await failTask(ctx.taskDir, task.id, persistedMessage, ctx.log);
+        await updateBranchMetadataOnFailure(ctx, task, persistedMessage);
+        workerLogError(
+          permanent ? "  Permanently failed (non-retryable error)" : `  Permanently failed after ${maxRetries} retries`
+        );
+      }
+    }
+    processed++;
+  }
+  if (processed > 0) {
+    const report = ctx.ensureStatusReport();
+    report.lastTaskCycleAt = (/* @__PURE__ */ new Date()).toISOString();
+    await writeWorkerStatus(ctx.taskDir, report).catch(
+      (writeErr) => workerLogError("Failed to write worker status:", getErrorMessage2(writeErr))
+    );
+  }
+}
+async function executeTaskWithTimeout(ctx, task) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), ctx.taskTimeoutMs);
+  try {
+    const work = ctx.executeTask(task, controller.signal);
+    work.catch(() => {
+    });
+    const timedOut = new Promise((_3, reject) => {
+      controller.signal.addEventListener(
+        "abort",
+        () => reject(new Error(`Task timed out after ${ctx.taskTimeoutMs}ms`)),
+        { once: true }
+      );
+    });
+    return await Promise.race([work, timedOut]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function executeTask(ctx, task, signal) {
+  const { action, payload: payload2 } = task;
+  switch (action) {
+    case "push-branch": {
+      const branch = requireString(payload2, "branch");
+      await ctx.pushBranchToGitHub(branch);
+      return { pushed: true };
+    }
+    case "push-and-create-pr": {
+      const branch = requireString(payload2, "branch");
+      await ctx.pushBranchToGitHub(branch);
+      const pr = await ctx.octokit().pulls.create({
+        owner: ctx.githubOwner,
+        repo: ctx.githubRepo,
+        head: branch,
+        base: optionalString(payload2, "baseBranch", ctx.baseBranch),
+        title: optionalString(payload2, "title", `Submit ${branch}`),
+        body: optionalString(payload2, "body", ""),
+        request: { signal }
+      });
+      workerLog(`Created PR #${pr.data.number} for ${branch}`);
+      return { prUrl: pr.data.html_url, prNumber: pr.data.number };
+    }
+    case "push-and-update-pr": {
+      const branch = requireString(payload2, "branch");
+      const prNumber = requireNumber(payload2, "pullRequestNumber");
+      await ctx.pushBranchToGitHub(branch);
+      await ctx.octokit().pulls.update({
+        owner: ctx.githubOwner,
+        repo: ctx.githubRepo,
+        pull_number: prNumber,
+        title: optionalString(payload2, "title", `Submit ${branch}`),
+        body: optionalString(payload2, "body", ""),
+        request: { signal }
+      });
+      workerLog(`Updated PR #${prNumber} for ${branch}`);
+      return { prNumber };
+    }
+    case "push-and-create-or-update-pr": {
+      const branch = requireString(payload2, "branch");
+      const base = optionalString(payload2, "baseBranch", ctx.baseBranch);
+      if (sanitizeBranchName(branch) === ctx.sanitizedBaseBranch) {
+        throw new PermanentTaskError(
+          `Refusing to push-and-create-or-update-pr for "${branch}": it is the base branch -- submitting the base branch is never valid`
+        );
+      }
+      await ctx.pushBranchToGitHub(branch);
+      const result = await createOrUpdatePullRequest({
+        octokit: ctx.octokit(),
+        owner: ctx.githubOwner,
+        repo: ctx.githubRepo,
+        head: branch,
+        base,
+        title: optionalString(payload2, "title", `Submit ${branch}`),
+        body: optionalString(payload2, "body", ""),
+        // Content submits (api/github-sync.ts) set this; settings-branch
+        // syncs (services.ts) deliberately don't.
+        markReadyIfDraft: payload2.markReadyIfDraft === true,
+        signal
+      });
+      workerLog(
+        result.created ? `Created PR #${result.number} for ${branch}` : `Updated existing PR #${result.number} for ${branch}`
+      );
+      return { prUrl: result.url, prNumber: result.number };
+    }
+    case "convert-to-draft": {
+      const draftPrNumber = requireNumber(payload2, "pullRequestNumber");
+      const { data: pr } = await ctx.octokit().pulls.get({
+        owner: ctx.githubOwner,
+        repo: ctx.githubRepo,
+        pull_number: draftPrNumber,
+        request: { signal }
+      });
+      await ctx.octokit().graphql(
+        `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`,
+        { id: pr.node_id, request: { signal } }
+      );
+      workerLog(`Converted PR #${draftPrNumber} to draft`);
+      return { prNumber: draftPrNumber, draft: true };
+    }
+    case "close-pr": {
+      const closePrNumber = requireNumber(payload2, "pullRequestNumber");
+      await ctx.octokit().pulls.update({
+        owner: ctx.githubOwner,
+        repo: ctx.githubRepo,
+        pull_number: closePrNumber,
+        state: "closed",
+        request: { signal }
+      });
+      return { closed: true };
+    }
+    case "delete-remote-branch": {
+      const branch = requireString(payload2, "branch");
+      await ctx.octokit().git.deleteRef({
+        owner: ctx.githubOwner,
+        repo: ctx.githubRepo,
+        ref: `heads/${branch}`,
+        request: { signal }
+      });
+      return { deleted: true };
+    }
+    default:
+      throw new PermanentTaskError(`Unknown task action: ${action}`);
+  }
+}
+async function updateBranchMetadata(ctx, task, result) {
+  const branch = typeof task.payload.branch === "string" ? task.payload.branch : null;
+  if (!branch) return;
+  const branchPath = ctx.branchWorkspacePath(branch);
+  try {
+    await fs10.stat(branchPath);
+  } catch {
+    return;
+  }
+  try {
+    const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+    const updates = {
+      name: branch,
+      syncStatus: "synced",
+      // save()'s merge only overwrites keys present in this update (see
+      // BranchMetadataFileManager.save()'s spread order) -- a prior
+      // syncFailureReason from an earlier failed attempt would otherwise
+      // survive forever past this successful sync. Explicitly clear it,
+      // same pattern as rebaseFailure's PR-W2 M2 clearing elsewhere.
+      syncFailureReason: void 0
+    };
+    if (result.prUrl) updates.pullRequestUrl = result.prUrl;
+    if (result.prNumber) {
+      updates.pullRequestNumber = result.prNumber;
+      const current = await BranchMetadataFileManager.loadOnly(branchPath);
+      const terminal = current?.branch.status === "archived" || current?.branch.pullRequestState === "merged" || current?.branch.pullRequestState === "closed";
+      if (!terminal) {
+        updates.pullRequestState = "open";
+      }
+    }
+    await meta.save({ branch: updates });
+  } catch (err) {
+    workerLogError(
+      `Failed to update metadata for ${branch}:`,
+      err instanceof Error ? err.message : err
+    );
+  }
+}
+async function updateBranchMetadataOnFailure(ctx, task, error2) {
+  const branch = typeof task.payload.branch === "string" ? task.payload.branch : null;
+  if (!branch) return;
+  const branchPath = ctx.branchWorkspacePath(branch);
+  try {
+    await fs10.stat(branchPath);
+  } catch {
+    return;
+  }
+  try {
+    const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+    await meta.save({
+      branch: { name: branch, syncStatus: "sync-failed", syncFailureReason: error2 }
+    });
+  } catch (err) {
+    workerLogError(
+      `Failed to update failure metadata for ${branch}:`,
+      err instanceof Error ? err.message : err
+    );
+  }
+}
+async function pushBranchToGitHub(ctx, branch) {
+  const git = simpleGit({
+    baseDir: ctx.remoteGitPath,
+    // DEP-H1: kill the git process if it produces no output for
+    // taskTimeoutMs (network stall, credential prompt) instead of letting
+    // it hang past the task timeout.
+    timeout: { block: ctx.taskTimeoutMs }
+  });
+  git.env(gitNetworkChildEnv());
+  const branchPath = ctx.branchWorkspacePath(branch);
+  const metaFile = await BranchMetadataFileManager.loadOnly(branchPath).catch(() => null);
+  const marker = metaFile?.branch.historyRewrittenFrom;
+  const outgoingSha = await readPublishedSha(ctx, branch);
+  try {
+    if (marker) {
+      await git.raw([
+        "push",
+        `--force-with-lease=${branch}:${marker}`,
+        "--end-of-options",
+        ctx.buildGitHubUrl(),
+        `${branch}:${branch}`
+      ]);
+    } else {
+      await git.push(ctx.buildGitHubUrl(), branch);
+    }
+  } catch (err) {
+    const message = getErrorMessage2(err);
+    if (marker && isStaleLeaseRejection(message)) {
+      try {
+        await git.push(ctx.buildGitHubUrl(), branch);
+      } catch (retryErr) {
+        const retryMessage = getErrorMessage2(retryErr);
+        if (isNonFastForwardRejection(retryMessage)) {
+          throw new PermanentTaskError(
+            `Push rejected for branch "${branch}": GitHub's tip is neither the commit this deployment last published nor an ancestor of what it is pushing, so the branch has genuinely diverged and nothing was overwritten. Something else moved it on GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`
+          );
+        }
+        throw retryErr;
+      }
+      await clearHistoryRewrittenMarker(ctx, branchPath, branch);
+      workerLog(`Pushed ${branch} to GitHub (GitHub had already moved past the rewritten commit)`);
+      return;
+    }
+    if (isNonFastForwardRejection(message)) {
+      throw new PermanentTaskError(
+        `Push rejected for branch "${branch}": GitHub's tip is not what this deployment last published, so the branch has diverged and needs reconciling. Something else moved it on GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`
+      );
+    }
+    throw err;
+  }
+  if (marker && outgoingSha && outgoingSha !== marker) {
+    await clearHistoryRewrittenMarker(ctx, branchPath, branch);
+  }
+  workerLog(`Pushed ${branch} to GitHub`);
+}
+
+// ../canopycms/src/worker/rebase.ts
+import fs11 from "node:fs/promises";
+import path15 from "node:path";
+init_normalize();
+init_types3();
+
+// ../canopycms/src/utils/content-write-lock.ts
+import path14 from "node:path";
+init_logger();
+var META_DIR2 = ".canopy-meta";
+var CONTENT_WRITE_LOCK_NAME = "content-write.lock";
+function lockTargetDir(branchRoot) {
+  return path14.join(path14.resolve(branchRoot), META_DIR2);
+}
+function tryAcquireContentWriteLock(branchRoot, onCompromised) {
+  return tryAcquireProvisioningLock(
+    lockTargetDir(branchRoot),
+    CONTENT_WRITE_LOCK_NAME,
+    onCompromised
+  );
+}
+
+// ../canopycms/src/worker/rebase.ts
+async function pollMergeState(ctx, branchDir, branchPath, metaFile) {
+  const prNumber = metaFile?.branch.pullRequestNumber;
+  if (!prNumber) return;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), ctx.taskTimeoutMs);
+  try {
+    const { data: data2 } = await ctx.octokit().pulls.get({
+      owner: ctx.githubOwner,
+      repo: ctx.githubRepo,
+      pull_number: prNumber,
+      request: { signal: controller.signal }
+    });
+    if (data2.merged) {
+      const meta2 = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+      await meta2.save({
+        branch: buildMergedBranchUpdate(
+          branchDir,
+          data2.merged_at ? new Date(data2.merged_at) : void 0
+        )
+      });
+      workerLog(`  PR #${prNumber} for ${branchDir} is merged -> archived`);
+      return;
+    }
+    const newState = data2.state === "closed" ? "closed" : "open";
+    const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
+    if (currentMeta?.branch.pullRequestState === newState) return;
+    const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+    await meta.save({ branch: { name: branchDir, pullRequestState: newState } });
+    workerLog(`  PR #${prNumber} for ${branchDir}: pullRequestState -> ${newState}`);
+  } catch (err) {
+    workerLogWarn(`  Failed to poll PR #${prNumber} for ${branchDir}: ${getErrorMessage2(err)}`);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function recordRebaseFailure(ctx, branchPath, branchDir, message) {
+  const RECORD_REFRESH_MS = 60 * 60 * 1e3;
+  const redactedMessage = redactCredentials(message);
+  try {
+    const existing = await BranchMetadataFileManager.loadOnly(branchPath);
+    const prior = existing?.branch.rebaseFailure;
+    const sameMessage = prior?.message === redactedMessage;
+    const now = /* @__PURE__ */ new Date();
+    if (sameMessage) {
+      const lastAtMs = Date.parse(prior.lastAt);
+      if (!Number.isNaN(lastAtMs) && now.getTime() - lastAtMs < RECORD_REFRESH_MS) {
+        return;
+      }
+    }
+    const nowIso = now.toISOString();
+    const firstAt = sameMessage ? prior.firstAt : nowIso;
+    const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+    await meta.save({
+      branch: {
+        name: branchDir,
+        rebaseFailure: { message: redactedMessage, firstAt, lastAt: nowIso }
+      }
+    });
+  } catch (err) {
+    workerLogWarn(`  Failed to record rebase failure for ${branchDir}: ${getErrorMessage2(err)}`);
+  }
+}
+var MAX_REBASE_ROUNDS = 50;
+async function runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, isLockCompromised) {
+  const conflictedFiles = [];
+  let nextAction = "start";
+  let completed = false;
+  let failureReason;
+  for (let round = 0; round < MAX_REBASE_ROUNDS && !completed; round++) {
+    if (isLockCompromised()) break;
+    try {
+      if (nextAction === "start") {
+        await branchGit.rebase([fetchedBaseTip]);
+      } else if (nextAction === "continue") {
+        await branchGit.rebase(["--continue"]);
+      } else {
+        await branchGit.rebase(["--skip"]);
+      }
+      completed = true;
+    } catch (rebaseErr) {
+      nextAction = "continue";
+      const st = await branchGit.status();
+      if (st.conflicted.length > 0) {
+        await ctx.afterConflictDetectedForTesting();
+        const conflictKind = new Map(st.files.map((f5) => [f5.path, `${f5.index}${f5.working_dir}`]));
+        let resolutionFailure;
+        for (const file of st.conflicted) {
+          const kind = conflictKind.get(file);
+          try {
+            if (kind === "UD") {
+              await branchGit.raw(["rm", "-f", "--", file]);
+            } else if (kind === "DU") {
+              await branchGit.add(file);
+            } else {
+              await branchGit.raw(["checkout", "--theirs", file]);
+              await branchGit.add(file);
+            }
+          } catch (resolveErr) {
+            resolutionFailure = `failed to resolve conflicted file '${file}' (status ${kind ?? "??"}): ` + getErrorMessage2(resolveErr);
+            break;
+          }
+          conflictedFiles.push(file);
+        }
+        if (resolutionFailure !== void 0) {
+          failureReason = resolutionFailure;
+          break;
+        }
+      } else {
+        const msg = rebaseErr instanceof Error ? rebaseErr.message : "";
+        if (msg.toLowerCase().includes("nothing to commit") || msg.toLowerCase().includes("apply --skip")) {
+          nextAction = "skip";
+        } else {
+          workerLogWarn(`  Unexpected rebase error in ${branchDir}: ${msg || "Unknown error"}`);
+          failureReason = msg || "Unknown error";
+          await branchGit.rebase(["--abort"]).catch(() => {
+          });
+          break;
+        }
+      }
+    }
+  }
+  return { completed, conflictedFiles, failureReason };
+}
+function conflictFilesToContentIds(conflictedFiles, contentRoot) {
+  const normalizedContentRoot = normalizeFilesystemPath(contentRoot);
+  const conflictIds = [...new Set(conflictedFiles)].map((f5) => {
+    const fileId = extractIdFromFilename(path15.basename(f5));
+    if (fileId) return fileId;
+    const parentDir = path15.basename(path15.dirname(f5));
+    const dirId = extractIdFromFilename(parentDir);
+    if (dirId) return dirId;
+    const parentPath = normalizeFilesystemPath(path15.dirname(f5));
+    if (path15.basename(f5) === ".collection.json" && parentPath === normalizedContentRoot) {
+      return ROOT_COLLECTION_ID;
+    }
+    return null;
+  }).filter((id) => id !== null);
+  return [...new Set(conflictIds)];
+}
+async function carryForwardRewrittenHistory(ctx, args) {
+  const { branchPath, branchDir, branchRef, publishedSha, preRebaseHead } = args;
+  if (publishedSha !== null) {
+    if (publishedSha === preRebaseHead) {
+      await markHistoryRewritten(ctx, branchPath, branchDir, publishedSha);
+      if (await forcePublishToLocalRemote(ctx, branchPath, branchRef, publishedSha)) {
+        await enqueueGitHubPush(ctx, branchRef);
+      }
+    } else {
+      const divergence = `rebased locally, but remote.git holds ${publishedSha} for ${branchRef}, which this clone never had (a direct push to the branch?). Left untouched -- reconcile it before submitting again.`;
+      workerLogWarn(`  ${branchDir}: ${divergence}`);
+      await recordRebaseFailure(ctx, branchPath, branchDir, divergence);
+    }
+  }
+}
+async function runRebaseCycle(ctx) {
+  const rebased = [];
+  const skippedDirty = [];
+  const skippedLocked = [];
+  const failed = [];
+  let branchDirs;
+  try {
+    branchDirs = await fs11.readdir(ctx.contentBranchesPath);
+  } catch {
+    return { rebased, skippedDirty, skippedLocked, failed };
+  }
+  for (const branchDir of branchDirs) {
+    if (branchDir.startsWith(".") || branchDir === "branches.json") {
+      continue;
+    }
+    const branchPath = path15.join(ctx.contentBranchesPath, branchDir);
+    const gitDir = path15.join(branchPath, ".git");
+    try {
+      const stat = await fs11.stat(gitDir);
+      if (!stat.isDirectory()) {
+        workerLog(`  Skipping ${branchDir}: .git is not a directory`);
+        continue;
+      }
+    } catch {
+      workerLog(`  Skipping ${branchDir}: no .git directory (not a branch workspace)`);
+      continue;
+    }
+    if (branchDir === ctx.sanitizedBaseBranch) {
+      workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
+      continue;
+    }
+    const outcome = await rebaseOneBranch(ctx, branchDir, branchPath);
+    if (outcome.kind === "rebased") rebased.push(branchDir);
+    else if (outcome.kind === "skippedDirty") skippedDirty.push(branchDir);
+    else if (outcome.kind === "skippedLocked") skippedLocked.push(branchDir);
+    else if (outcome.kind === "failed") {
+      if (outcome.rebased) rebased.push(branchDir);
+      failed.push({ branch: branchDir, error: outcome.error });
+    }
+  }
+  return { rebased, skippedDirty, skippedLocked, failed };
+}
+async function rebaseOneBranch(ctx, branchDir, branchPath) {
+  let didRebase = false;
+  try {
+    const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
+    const branchStatus2 = metaFile?.branch.status;
+    if (branchStatus2 === "submitted" || branchStatus2 === "approved") {
+      workerLog(`  Skipping ${branchDir} (${branchStatus2})`);
+      await pollMergeState(ctx, branchDir, branchPath, metaFile);
+      return { kind: "none" };
+    }
+    if (branchStatus2 === "archived") {
+      workerLog(`  Skipping ${branchDir} (${branchStatus2})`);
+      return { kind: "none" };
+    }
+    const branchGit = simpleGit({
+      baseDir: branchPath,
+      // Keep git non-interactive during rebase/merge so it never blocks on an editor.
+      // simple-git >=3.32 blocks setting core.editor unless explicitly opted in; the
+      // value here is a hardcoded literal ("true", the shell no-op), not user input,
+      // so enabling allowUnsafeEditor carries no injection risk.
+      config: ["core.editor=true"],
+      unsafe: { allowUnsafeEditor: true }
+    });
+    let releaseContentLock;
+    let contentLockCompromised = false;
+    try {
+      releaseContentLock = await tryAcquireContentWriteLock(branchPath, (lockErr) => {
+        contentLockCompromised = true;
+        workerLogWarn(
+          `  Content-write lock compromised mid-rebase for ${branchDir}: ${getErrorMessage2(lockErr)}`
+        );
+      });
+    } catch (lockErr) {
+      if (isNodeError(lockErr) && lockErr.code === "ELOCKED") {
+        workerLog(`  Skipping ${branchDir}: content write in progress (retrying next cycle)`);
+        return { kind: "skippedLocked" };
+      }
+      throw lockErr;
+    }
+    try {
+      if (await isRebaseInProgress(branchPath)) {
+        const preAbort = await branchGit.status().catch(() => null);
+        const collateral = (preAbort?.files ?? []).filter((f5) => !preAbort?.conflicted.includes(f5.path)).filter((f5) => f5.working_dir !== " " && f5.working_dir !== "?").map((f5) => f5.path);
+        if (collateral.length > 0) {
+          workerLogWarn(
+            `  ${branchDir}: aborting the interrupted rebase will DISCARD working-tree changes to ${collateral.length} file(s) saved while the worker was down: ${collateral.join(", ")}`
+          );
+        }
+        workerLogWarn(
+          `  ${branchDir}: found an interrupted rebase (this worker's own abandoned work) -- aborting it to recover the branch`
+        );
+        try {
+          await branchGit.rebase(["--abort"]);
+        } catch (abortErr) {
+          const reason = redactCredentials(
+            `could not abort interrupted rebase: ${getErrorMessage2(abortErr)}`
+          );
+          workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+          await recordRebaseFailure(ctx, branchPath, branchDir, reason);
+          return { kind: "failed", error: reason };
+        }
+      }
+      const dirtyCheck = await branchGit.status();
+      if (dirtyCheck.files.length > 0) {
+        workerLog(`  Skipping ${branchDir}: has uncommitted changes`);
+        return { kind: "skippedDirty" };
+      }
+      const branchRef = (await branchGit.revparse(["--abbrev-ref", "HEAD"])).trim();
+      const canPublish = branchRef.length > 0 && branchRef !== "HEAD";
+      if (canPublish && metaFile?.branch.historyRewrittenFrom) {
+        await reconcilePendingRewrite(ctx, {
+          branchPath,
+          branchDir,
+          branchRef,
+          headSha: (await branchGit.revparse(["HEAD"])).trim(),
+          marker: metaFile.branch.historyRewrittenFrom
+        });
+      }
+      await branchGit.fetch("origin", ctx.baseBranch);
+      const fetchedBaseTip = (await branchGit.revparse(["FETCH_HEAD"])).trim();
+      const behindCount = parseInt(
+        (await branchGit.raw(["rev-list", "--count", `HEAD..${fetchedBaseTip}`])).trim(),
+        10
+      );
+      const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
+      if (behindCount === 0) {
+        const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
+        const conflictStatus = currentMeta?.branch.conflictStatus;
+        const conflictFiles = currentMeta?.branch.conflictFiles;
+        const conflictAlreadyClean = (conflictStatus === void 0 || conflictStatus === "clean") && (conflictFiles === void 0 || conflictFiles.length === 0);
+        const alreadyClean = conflictAlreadyClean && currentMeta?.branch.rebaseFailure === void 0;
+        if (alreadyClean) {
+          return { kind: "none" };
+        }
+        await meta.save({
+          branch: {
+            name: branchDir,
+            conflictStatus: "clean",
+            conflictFiles: [],
+            rebaseFailure: void 0
+          }
+        });
+        return { kind: "none" };
+      }
+      workerLog(`Rebasing ${branchDir} (${behindCount} commits behind)...`);
+      const preRebaseHead = (await branchGit.revparse(["HEAD"])).trim();
+      const publishedSha = canPublish ? await readPublishedSha(ctx, branchRef) : null;
+      const { completed, conflictedFiles, failureReason } = await runRebaseRounds(
+        ctx,
+        branchGit,
+        branchDir,
+        fetchedBaseTip,
+        () => contentLockCompromised
+      );
+      if (completed) await ctx.afterRebaseCompletedForTesting();
+      if (contentLockCompromised && !completed) {
+        workerLogWarn(
+          `  Skipping ${branchDir}: content-write lock was compromised mid-rebase (retrying next cycle)`
+        );
+        await branchGit.rebase(["--abort"]).catch(() => {
+        });
+        return { kind: "skippedLocked" };
+      }
+      if (contentLockCompromised) {
+        workerLogWarn(
+          `  Content-write lock for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`
+        );
+      }
+      if (!completed) {
+        workerLogWarn(
+          failureReason !== void 0 ? `  Rebase of ${branchDir} aborted due to unexpected error: ${failureReason}` : `  Rebase of ${branchDir} did not complete within ${MAX_REBASE_ROUNDS} rounds, aborting`
+        );
+        await branchGit.rebase(["--abort"]).catch(() => {
+        });
+        const rebaseFailureMessage = failureReason ?? `did not complete within ${MAX_REBASE_ROUNDS} rounds`;
+        const redactedRebaseFailureMessage = redactCredentials(rebaseFailureMessage);
+        await recordRebaseFailure(ctx, branchPath, branchDir, redactedRebaseFailureMessage);
+        return { kind: "failed", error: redactedRebaseFailureMessage };
+      }
+      await invalidateBranchContentCaches(branchPath);
+      const conflictIdsDeduped = conflictFilesToContentIds(conflictedFiles, ctx.contentRoot);
+      const hadConflicts = conflictIdsDeduped.length > 0;
+      workerLog(
+        hadConflicts ? `  Rebased ${branchDir} (kept branch version for ${conflictIdsDeduped.length} conflicting file(s))` : `  Rebased ${branchDir} successfully`
+      );
+      await meta.save({
+        branch: {
+          name: branchDir,
+          conflictStatus: hadConflicts ? "conflicts-detected" : "clean",
+          conflictFiles: conflictIdsDeduped,
+          // PR-W2: the cycle completed successfully -- clear any prior
+          // failure record regardless of conflict outcome.
+          rebaseFailure: void 0
+        }
+      });
+      didRebase = true;
+      await carryForwardRewrittenHistory(ctx, {
+        branchPath,
+        branchDir,
+        branchRef,
+        publishedSha,
+        preRebaseHead
+      });
+      return { kind: "rebased" };
+    } finally {
+      try {
+        if (await isRebaseInProgress(branchPath)) {
+          workerLogWarn(
+            `  ${branchDir}: rebase still in progress on exit -- aborting so the clone is not left wedged`
+          );
+          await branchGit.rebase(["--abort"]);
+        }
+      } catch (abortErr) {
+        workerLogWarn(
+          `  Failed to abort in-progress rebase for ${branchDir}: ${getErrorMessage2(abortErr)}`
+        );
+      }
+      await releaseContentLock?.().catch((releaseErr) => {
+        workerLogWarn(
+          `  Failed to release content-write lock for ${branchDir}: ${getErrorMessage2(releaseErr)}`
+        );
+      });
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    workerLogWarn(`  Failed to sync ${branchDir}: ${message}`);
+    const redactedMessage = redactCredentials(message);
+    await recordRebaseFailure(ctx, branchPath, branchDir, redactedMessage);
+    return { kind: "failed", error: redactedMessage, rebased: didRebase };
+  }
+}
+
+// ../canopycms/src/worker/git-sync.ts
+import fs12 from "node:fs/promises";
+import path16 from "node:path";
+var TRASH_RETENTION_MS = 30 * 24 * 60 * 6e4;
+var TRASH_DIR_STAMP_RE = /-(\d{8}T\d{6}Z)$/;
+function parseTrashStamp(stamp) {
+  const match2 = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(stamp);
+  if (!match2) return null;
+  const [, year2, month, day, hour, minute, second] = match2;
+  const date2 = /* @__PURE__ */ new Date(`${year2}-${month}-${day}T${hour}:${minute}:${second}.000Z`);
+  return Number.isNaN(date2.getTime()) ? null : date2;
+}
+async function pushSettingsBranches(ctx, git, trackedNames) {
+  try {
+    const settingsBranch = ctx.ensureSettingsBranch();
+    const branches = await git.branch();
+    const settingsBranches = branches.all.filter(
+      (b6) => b6.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX)
+    );
+    const foreign = settingsBranches.filter((b6) => b6 !== settingsBranch);
+    if (foreign.length > 0) {
+      workerLogWarn(
+        `Found settings branch(es) not owned by this deployment (${settingsBranch}): ${foreign.join(", ")}. Another CanopyCMS deployment may share this GitHub repo. Not pushing them.`
+      );
+    }
+    const ownBranchMissing = !branches.all.includes(settingsBranch);
+    const strandedLocal = foreign.filter((b6) => !trackedNames.has(b6));
+    if (strandedLocal.length > 0) {
+      workerLogWarn(
+        ownBranchMissing ? `Settings branch mismatch: this worker owns "${settingsBranch}", which does not exist in remote.git, while ${strandedLocal.join(", ")} exist(s) here and has never been pushed to GitHub. The API and this worker disagree about deploymentName, so settings changes are NOT reaching GitHub. Set CANOPYCMS_DEPLOYMENT_NAME (or settingsBranch) on this worker to match what the API resolves.` : `Settings branch(es) ${strandedLocal.join(", ")} exist in remote.git but not on GitHub, and are not owned by this deployment (${settingsBranch}) -- nothing will ever push them onward. Check that deploymentName matches across this deployment's API and worker.`
+      );
+    }
+    if (ownBranchMissing) {
+      return;
+    }
+    try {
+      await git.push(ctx.buildGitHubUrl(), settingsBranch);
+      workerLog(`Pushed settings branch ${settingsBranch} to GitHub`);
+    } catch (err) {
+      const message = getErrorMessage2(err);
+      if (isNonFastForwardRejection(message)) {
+        workerLogWarn(
+          `Settings push for ${settingsBranch} was rejected (non-fast-forward): another CanopyCMS deployment appears to own this settings branch on GitHub. Settings from that deployment will NOT be overwritten; this deployment's local settings changes were not pushed. Rename this deployment's settings branch (config.settingsBranch or deploymentName) to resolve the collision.`
+        );
+      } else {
+        workerLogWarn(`Settings push for ${settingsBranch}:`, message);
+      }
+    }
+  } catch (err) {
+    workerLogWarn(
+      "Failed to list branches for settings push:",
+      err instanceof Error ? err.message : err
+    );
+  }
+}
+async function reconcileTrackedBranches(ctx, git) {
+  const GIT_ZERO_OID = "0000000000000000000000000000000000000000";
+  const created = [];
+  const fastForwarded = [];
+  const ahead = [];
+  const diverged = [];
+  const rewritten = [];
+  const raw = await git.raw([
+    "for-each-ref",
+    "--format=%(refname) %(objectname)",
+    "refs/heads/",
+    GITHUB_TRACKING_REF_PREFIX
+  ]);
+  const heads = /* @__PURE__ */ new Map();
+  const tracked = /* @__PURE__ */ new Map();
+  for (const line of raw.split("\n")) {
+    const trimmed2 = line.trim();
+    if (!trimmed2) continue;
+    const [refname, sha] = trimmed2.split(" ");
+    if (refname.startsWith("refs/heads/")) {
+      heads.set(refname.slice("refs/heads/".length), sha);
+    } else if (refname.startsWith(GITHUB_TRACKING_REF_PREFIX)) {
+      tracked.set(refname.slice(GITHUB_TRACKING_REF_PREFIX.length), sha);
+    }
+  }
+  for (const [name, trackedSha] of tracked) {
+    const localSha = heads.get(name);
+    const localRef = `refs/heads/${name}`;
+    if (!localSha) {
+      try {
+        await git.raw(["update-ref", localRef, trackedSha, GIT_ZERO_OID]);
+        created.push(name);
+      } catch (err) {
+        workerLogWarn(
+          `  Tracked-branch reconcile: failed to create local ref for ${name} (concurrent update?): ${getErrorMessage2(err)}`
+        );
+      }
+      continue;
+    }
+    if (localSha === trackedSha) continue;
+    try {
+      const counts = (await git.raw(["rev-list", "--left-right", "--count", `${localSha}...${trackedSha}`])).trim();
+      const [leftStr, rightStr] = counts.split(/\s+/);
+      const localAheadCount = parseInt(leftStr, 10);
+      const localBehindCount = parseInt(rightStr, 10);
+      if (!Number.isInteger(localAheadCount) || !Number.isInteger(localBehindCount)) {
+        workerLogWarn(
+          `  Tracked-branch reconcile: skipping ${name}: unparseable rev-list output ${JSON.stringify(counts)}`
+        );
+        continue;
+      }
+      if (localAheadCount === 0 && localBehindCount > 0) {
+        try {
+          await git.raw(["update-ref", localRef, trackedSha, localSha]);
+          fastForwarded.push(name);
+        } catch (err) {
+          workerLogWarn(
+            `  Tracked-branch reconcile: failed to fast-forward ${name} (concurrent update?): ${getErrorMessage2(err)}`
+          );
+        }
+      } else if (localBehindCount === 0 && localAheadCount > 0) {
+        ahead.push(name);
+      } else if (await hasPendingHistoryRewrite(ctx, name)) {
+        rewritten.push(name);
+      } else {
+        diverged.push(name);
+      }
+    } catch (err) {
+      workerLogWarn(
+        `  Tracked-branch reconcile: skipping ${name} (unreadable ref or object?): ${getErrorMessage2(err)}`
+      );
+      continue;
+    }
+  }
+  if (diverged.length > 0) {
+    workerLogWarn(
+      `  Tracked-branch reconcile: ${diverged.length} branch(es) diverged from GitHub and were left untouched: ${diverged.join(", ")}`
+    );
+  }
+  if (rewritten.length > 0) {
+    workerLog(
+      `  Tracked-branch reconcile: ${rewritten.length} branch(es) rebased locally with the GitHub push still pending: ${rewritten.join(", ")}`
+    );
+  }
+  return {
+    summary: { created, fastForwarded, ahead, diverged, rewritten },
+    trackedNames: new Set(tracked.keys())
+  };
+}
+async function syncGit(ctx) {
+  if (!ctx.isRunning()) return;
+  workerLog("Syncing git...");
+  const cycleStartedAt = Date.now();
+  const git = simpleGit({
+    baseDir: ctx.remoteGitPath,
+    // DEP-H1: a hung fetch/push would stall the sync loop forever
+    // (scheduleLoop only reschedules after completion). The block timeout
+    // is inactivity-based, so a slow-but-flowing transfer is unaffected.
+    timeout: { block: ctx.taskTimeoutMs }
+  });
+  git.env(gitNetworkChildEnv());
+  try {
+    await git.raw([
+      "fetch",
+      ctx.buildGitHubUrl(),
+      "--prune",
+      `+refs/heads/*:${GITHUB_TRACKING_REF_PREFIX}*`
+    ]);
+    workerLog("Fetched from GitHub");
+    const { summary: trackedSummary, trackedNames } = await reconcileTrackedBranches(ctx, git);
+    await pushSettingsBranches(ctx, git, trackedNames);
+    await refreshBaseBranchWorkspace(ctx);
+    const rebaseSummary = await runRebaseCycle(ctx);
+    await cleanupOldTasks(ctx.taskDir, void 0, ctx.log);
+    const trashRemoved = await cleanupTrashedBranchDirs(ctx);
+    if (trashRemoved > 0) {
+      workerLog(`Removed ${trashRemoved} expired trashed branch dir(s)`);
+    }
+    const report = ctx.ensureStatusReport();
+    report.lastGitSyncAt = (/* @__PURE__ */ new Date()).toISOString();
+    delete report.lastGitSyncError;
+    report.lastGitSync = {
+      durationMs: Date.now() - cycleStartedAt,
+      rebased: rebaseSummary.rebased,
+      skippedDirty: rebaseSummary.skippedDirty,
+      skippedLocked: rebaseSummary.skippedLocked,
+      failed: rebaseSummary.failed,
+      tracked: trackedSummary
+    };
+    await writeWorkerStatus(ctx.taskDir, report).catch(
+      (writeErr) => workerLogError("Failed to write worker status:", getErrorMessage2(writeErr))
+    );
+  } catch (err) {
+    const report = ctx.ensureStatusReport();
+    report.lastGitSyncError = {
+      message: redactCredentials(getErrorMessage2(err)),
+      at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await writeWorkerStatus(ctx.taskDir, report).catch(
+      (writeErr) => workerLogError("Failed to write worker status:", getErrorMessage2(writeErr))
+    );
+    throw err;
+  }
+}
+async function cleanupTrashedBranchDirs(ctx) {
+  let entries;
+  try {
+    entries = await fs12.readdir(ctx.contentBranchesPath);
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT") return 0;
+    throw err;
+  }
+  const now = Date.now();
+  let removed = 0;
+  let loggedUnparseable = false;
+  for (const name of entries) {
+    if (!name.startsWith(".trash-")) continue;
+    const stampMatch = TRASH_DIR_STAMP_RE.exec(name);
+    const stampDate = stampMatch ? parseTrashStamp(stampMatch[1]) : null;
+    if (!stampDate) {
+      if (!loggedUnparseable) {
+        workerLog(`CanopyCMS: Skipping trash dir with unparseable stamp: ${name}`);
+        loggedUnparseable = true;
+      }
+      continue;
+    }
+    if (now - stampDate.getTime() < TRASH_RETENTION_MS) continue;
+    try {
+      await fs12.rm(path16.join(ctx.contentBranchesPath, name), {
+        recursive: true,
+        force: true,
+        maxRetries: 3,
+        retryDelay: 100
+      });
+      removed++;
+    } catch (err) {
+      workerLogError(
+        `CanopyCMS: Failed to remove trashed branch dir ${name}:`,
+        getErrorMessage2(err)
+      );
+    }
+  }
+  return removed;
+}
+async function refreshBaseBranchWorkspace(ctx) {
+  const basePath32 = path16.join(ctx.contentBranchesPath, ctx.sanitizedBaseBranch);
+  const gitDir = path16.join(basePath32, ".git");
+  try {
+    let gitDirStat;
+    try {
+      gitDirStat = await fs12.stat(gitDir);
+    } catch {
+      gitDirStat = null;
+    }
+    if (!gitDirStat || !gitDirStat.isDirectory()) {
+      workerLog(`Base branch workspace (${ctx.baseBranch}): not yet provisioned, skipping refresh`);
+      return;
+    }
+    const baseGit = simpleGit({
+      baseDir: basePath32,
+      // Keep git non-interactive during the merge so it never blocks on an
+      // editor. simple-git >=3.32 blocks setting core.editor unless
+      // explicitly opted in; the value here is a hardcoded literal
+      // ("true", the shell no-op), not user input, so enabling
+      // allowUnsafeEditor carries no injection risk (same as the rebase
+      // loop's git config below).
+      config: ["core.editor=true"],
+      unsafe: { allowUnsafeEditor: true },
+      // DEP-H1: a hung fetch/merge against this EFS-backed clone would
+      // stall the sync loop forever (scheduleLoop only reschedules after
+      // completion). The block timeout is inactivity-based, so a
+      // slow-but-flowing transfer is unaffected -- same as syncGit()'s
+      // remote handle.
+      timeout: { block: ctx.taskTimeoutMs }
+    });
+    const status = await baseGit.status();
+    const trackedDirty = status.files.filter((f5) => f5.index !== "?" || f5.working_dir !== "?");
+    if (trackedDirty.length > 0) {
+      workerLogError(
+        `Base branch workspace (${ctx.baseBranch}) has uncommitted changes -- skipping refresh. Dirty files: ${trackedDirty.map((f5) => f5.path).join(", ")}`
+      );
+      return;
+    }
+    await baseGit.fetch("origin", ctx.baseBranch);
+    const fetchedTip = (await baseGit.revparse(["FETCH_HEAD"])).trim();
+    const behindCount = parseInt(
+      (await baseGit.raw(["rev-list", "--count", `HEAD..${fetchedTip}`])).trim(),
+      10
+    );
+    if (behindCount > 0) {
+      try {
+        await baseGit.merge(["--ff-only", fetchedTip]);
+      } catch (err) {
+        workerLogError(
+          `Base branch workspace (${ctx.baseBranch}) failed to fast-forward (diverged local history?): ${getErrorMessage2(err)}`
+        );
+        return;
+      }
+      await invalidateBranchContentCaches(basePath32);
+    }
+    const currentMeta = await BranchMetadataFileManager.loadOnly(basePath32);
+    const conflictStatus = currentMeta?.branch.conflictStatus;
+    const conflictFiles = currentMeta?.branch.conflictFiles;
+    const alreadyClean = (conflictStatus === void 0 || conflictStatus === "clean") && (conflictFiles === void 0 || conflictFiles.length === 0);
+    if (!alreadyClean) {
+      const meta = getBranchMetadataFileManager(basePath32, ctx.contentBranchesPath);
+      await meta.save({
+        branch: { name: ctx.baseBranch, conflictStatus: "clean", conflictFiles: [] }
+      });
+    }
+    workerLog(
+      behindCount > 0 ? `Base branch workspace (${ctx.baseBranch}): fast-forwarded ${behindCount} commit(s)` : `Base branch workspace (${ctx.baseBranch}): up to date`
+    );
+  } catch (err) {
+    workerLogError(
+      `Base branch workspace (${ctx.baseBranch}) refresh failed: ${getErrorMessage2(err)}`
+    );
+  }
+}
+
+// ../canopycms/src/worker/cms-worker.ts
+var DEFAULT_TASK_TIMEOUT = 6e4;
+var DEFAULT_MAX_RETRIES2 = 3;
+var DEFAULT_LOCK_STALE_MS = 6e4;
 var CmsWorker = class {
   constructor(config) {
     this.config = config;
@@ -42982,15 +44080,15 @@ var CmsWorker = class {
     this.releaseLockFn = null;
     this.log = cmsTaskQueueLogger;
     this.octokit = createCanopyOctokit({ auth: config.githubToken });
-    this.taskDir = path13.join(config.workspacePath, ".tasks");
-    this.remoteGitPath = path13.join(config.workspacePath, "remote.git");
-    this.contentBranchesPath = path13.join(config.workspacePath, "content-branches");
+    this.taskDir = path17.join(config.workspacePath, ".tasks");
+    this.remoteGitPath = path17.join(config.workspacePath, "remote.git");
+    this.contentBranchesPath = path17.join(config.workspacePath, "content-branches");
     this.baseBranch = config.baseBranch ?? "main";
     this.sanitizedBaseBranch = sanitizeBranchName(this.baseBranch);
     this.maxTasksPerCycle = config.maxTasksPerCycle ?? 10;
     this.taskTimeoutMs = config.taskTimeoutMs ?? DEFAULT_TASK_TIMEOUT;
     this.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES2;
-    this.lockFilePath = path13.join(config.workspacePath, ".tasks", ".worker-lock");
+    this.lockFilePath = path17.join(config.workspacePath, ".tasks", ".worker-lock");
     this.lockStaleMs = config.lockStaleMs ?? DEFAULT_LOCK_STALE_MS;
     this.contentRoot = config.contentRoot ?? "content";
   }
@@ -43043,6 +44141,46 @@ var CmsWorker = class {
     }
     return this.settingsBranchResolved;
   }
+  /**
+   * Build the {@link WorkerContext} handed to the extracted clusters
+   * (task-runner.ts, git-sync.ts, rebase.ts, history-rewrite.ts).
+   *
+   * Built FRESH on every call rather than once in the constructor, and the
+   * instance-backed members are functions rather than copied values. Both
+   * choices exist for the same reason: the test suite drives this class by
+   * replacing `octokit` and `buildGitHubUrl` ON THE INSTANCE, by setting
+   * `running` directly, and by subclassing to override the two rebase test
+   * hooks. A context that captured any of those at construction time would hand
+   * the extracted code the pre-test value -- which for `buildGitHubUrl` means a
+   * test's push going to github.com for real instead of its local fixture repo.
+   * See WorkerContext's doc comment for the full list.
+   */
+  ctx() {
+    return {
+      githubOwner: this.config.githubOwner,
+      githubRepo: this.config.githubRepo,
+      baseBranch: this.baseBranch,
+      sanitizedBaseBranch: this.sanitizedBaseBranch,
+      taskDir: this.taskDir,
+      remoteGitPath: this.remoteGitPath,
+      contentBranchesPath: this.contentBranchesPath,
+      contentRoot: this.contentRoot,
+      taskTimeoutMs: this.taskTimeoutMs,
+      maxTasksPerCycle: this.maxTasksPerCycle,
+      maxRetries: this.maxRetries,
+      log: this.log,
+      octokit: () => this.octokit,
+      buildGitHubUrl: () => this.buildGitHubUrl(),
+      branchWorkspacePath: (branchRefName) => this.branchWorkspacePath(branchRefName),
+      executeTask: (task, signal) => this.executeTask(task, signal),
+      pushBranchToGitHub: (branch) => this.pushBranchToGitHub(branch),
+      isRunning: () => this.running,
+      ensureStatusReport: () => this.ensureStatusReport(),
+      ensureSettingsBranch: () => this.ensureSettingsBranch(),
+      afterConflictDetectedForTesting: () => this.afterConflictDetectedForTesting(),
+      afterRebaseCompletedForTesting: () => this.afterRebaseCompletedForTesting()
+    };
+  }
   async start() {
     this.running = true;
     workerLog("CMS Worker starting...");
@@ -43053,7 +44191,7 @@ var CmsWorker = class {
       await this.ensureRemoteGit();
       const recovered = await recoverOrphanedTasks(
         this.taskDir,
-        this.orphanRecoveryMaxAgeMs(),
+        orphanRecoveryMaxAgeMs(this.ctx()),
         this.log
       );
       if (recovered > 0) {
@@ -43067,7 +44205,7 @@ var CmsWorker = class {
     } catch (err) {
       const report = this.ensureStatusReport();
       report.lastFatalError = {
-        // [HIGH-1] Persisted to worker-status.json and served to the
+        // [REDACT] Persisted to worker-status.json and served to the
         // browser by the admin panel -- must never carry the bot token
         // that a poisoned/failed git URL (buildGitHubUrl()) can embed.
         message: redactCredentials(getErrorMessage2(err)),
@@ -43141,7 +44279,7 @@ var CmsWorker = class {
    * negligible, but a host with a badly wrong clock could misjudge liveness.
    */
   async acquireLock() {
-    await fs9.mkdir(this.taskDir, { recursive: true });
+    await fs13.mkdir(this.taskDir, { recursive: true });
     try {
       this.releaseLockFn = await import_proper_lockfile3.default.lock(this.taskDir, {
         lockfilePath: this.lockFilePath,
@@ -43287,7 +44425,7 @@ var CmsWorker = class {
   async ensureRemoteGit() {
     let exists2;
     try {
-      await fs9.stat(this.remoteGitPath);
+      await fs13.stat(this.remoteGitPath);
       exists2 = true;
     } catch {
       exists2 = false;
@@ -43307,286 +44445,52 @@ var CmsWorker = class {
     workerLog("Initializing remote.git from GitHub...");
     const git = simpleGit();
     const stagingPath = `${this.remoteGitPath}.cloning`;
-    await fs9.rm(stagingPath, { recursive: true, force: true });
+    await fs13.rm(stagingPath, { recursive: true, force: true });
     try {
       await git.clone(this.buildGitHubUrl(), stagingPath, ["--bare"]);
       await this.scrubPersistedRemote(stagingPath);
       await this.verifyBaseBranchExists(stagingPath);
     } catch (err) {
       workerLogError(`remote.git clone failed: ${redactCredentials(getErrorMessage2(err))}`);
-      await fs9.rm(stagingPath, { recursive: true, force: true });
+      await fs13.rm(stagingPath, { recursive: true, force: true });
       throw new Error(
         `remote.git clone of ${this.config.githubOwner}/${this.config.githubRepo} failed or has no branch '${this.baseBranch}' - the GitHub repository may be empty, or the base branch may not exist. Push an initial commit to '${this.baseBranch}' and restart the worker (systemd will retry automatically).`
       );
     }
-    await fs9.rename(stagingPath, this.remoteGitPath);
+    await fs13.rename(stagingPath, this.remoteGitPath);
     workerLog("remote.git initialized");
   }
-  /**
-   * Staleness threshold for recoverOrphanedTasks, derived from the
-   * configured task timeout rather than fixed: the safety argument for
-   * running recovery on every poll cycle is "no legitimately in-flight task
-   * can be this old, because executeTaskWithTimeout bounds every attempt by
-   * taskTimeoutMs" -- which is only true if this threshold scales with
-   * taskTimeoutMs. 2x leaves the same comfortable margin the defaults have
-   * (60s timeout vs 5min threshold); the 5-minute floor preserves the
-   * long-standing default for a replacement instance's boot window.
-   */
-  orphanRecoveryMaxAgeMs() {
-    return Math.max(5 * 6e4, this.taskTimeoutMs * 2);
-  }
-  /**
-   * Process queued tasks from Lambda.
-   * Polls .tasks/pending/ directory and executes each task.
-   * Processes up to maxTasksPerCycle tasks per invocation.
-   * Retries transient failures with exponential backoff.
-   */
+  // --- Task-queue cluster (worker/task-runner.ts) ------------------------
+  //
+  // READ THIS BEFORE STUBBING ANY DELEGATOR BELOW. They are not all the same,
+  // and the difference is invisible from here.
+  //
+  // `processTaskQueue` is the public loop entry `scheduleLoop` drives, so it IS
+  // on the production path. The other three exist ONLY so the existing test
+  // files can reach the implementations through the instance; production never
+  // dispatches through them, because the extracted modules call each other
+  // directly at module level.
+  //
+  // The consequence: replacing one of these on an instance only affects
+  // production behaviour if the context also routes it. Two do --
+  // `executeTask` and `pushBranchToGitHub` are on `WorkerContext` precisely
+  // because cms-worker.test.ts assigns over them and then asserts on the
+  // replacement. `updateBranchMetadata` is NOT: the test calls it directly and
+  // never stubs it, so a stub installed there today would be a silent no-op.
+  // If you need to stub a method that isn't on the context, add it to
+  // WorkerContext and route the internal caller through `ctx` -- do not assume
+  // the delegator's existence means the stub takes effect.
   async processTaskQueue() {
-    if (!this.running) return;
-    const recovered = await recoverOrphanedTasks(
-      this.taskDir,
-      this.orphanRecoveryMaxAgeMs(),
-      this.log
-    );
-    if (recovered > 0) {
-      workerLog(`Recovered ${recovered} orphaned task(s)`);
-    }
-    let processed = 0;
-    let task;
-    while (processed < this.maxTasksPerCycle && (task = await dequeueTask(this.taskDir, this.log)) !== null) {
-      try {
-        const result = await this.executeTaskWithTimeout(task);
-        await completeTask(this.taskDir, task.id, result, this.log);
-        await this.updateBranchMetadata(task, result);
-      } catch (err) {
-        const message = getErrorMessage2(err);
-        workerLogError(`Task ${task.id} (${task.action}) failed:`, message);
-        const persistedMessage = redactCredentials(message);
-        const permanent = isPermanentTaskFailure(err);
-        const retryCount = task.retryCount ?? 0;
-        const maxRetries = task.maxRetries ?? this.maxRetries;
-        if (!permanent && retryCount < maxRetries) {
-          await retryTask(this.taskDir, task.id, persistedMessage, this.log);
-          workerLog(`  Will retry (attempt ${retryCount + 1}/${maxRetries})`);
-        } else {
-          await failTask(this.taskDir, task.id, persistedMessage, this.log);
-          await this.updateBranchMetadataOnFailure(task, persistedMessage);
-          workerLogError(
-            permanent ? "  Permanently failed (non-retryable error)" : `  Permanently failed after ${maxRetries} retries`
-          );
-        }
-      }
-      processed++;
-    }
-    if (processed > 0) {
-      const report = this.ensureStatusReport();
-      report.lastTaskCycleAt = (/* @__PURE__ */ new Date()).toISOString();
-      await writeWorkerStatus(this.taskDir, report).catch(
-        (writeErr) => workerLogError("Failed to write worker status:", getErrorMessage2(writeErr))
-      );
-    }
-  }
-  /**
-   * Execute a task bounded by taskTimeoutMs (DEP-H1). Two layers:
-   * - An AbortSignal cancels Octokit HTTP calls promptly.
-   * - A Promise.race rejects when the timeout fires, so work that cannot
-   *   observe the signal (git subprocesses via simple-git) still fails the
-   *   attempt and the worker moves on instead of stalling forever.
-   * pushBranchToGitHub additionally kills stalled git processes via
-   * simple-git's block timeout, so a hung push doesn't leak a process.
-   */
-  async executeTaskWithTimeout(task) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.taskTimeoutMs);
-    try {
-      const work = this.executeTask(task, controller.signal);
-      work.catch(() => {
-      });
-      const timedOut = new Promise((_3, reject) => {
-        controller.signal.addEventListener(
-          "abort",
-          () => reject(new Error(`Task timed out after ${this.taskTimeoutMs}ms`)),
-          { once: true }
-        );
-      });
-      return await Promise.race([work, timedOut]);
-    } finally {
-      clearTimeout(timer);
-    }
+    return processTaskQueue(this.ctx());
   }
   async executeTask(task, signal) {
-    const { action, payload: payload2 } = task;
-    switch (action) {
-      case "push-branch": {
-        const branch = requireString(payload2, "branch");
-        await this.pushBranchToGitHub(branch);
-        return { pushed: true };
-      }
-      case "push-and-create-pr": {
-        const branch = requireString(payload2, "branch");
-        await this.pushBranchToGitHub(branch);
-        const pr = await this.octokit.pulls.create({
-          owner: this.config.githubOwner,
-          repo: this.config.githubRepo,
-          head: branch,
-          base: optionalString(payload2, "baseBranch", this.baseBranch),
-          title: optionalString(payload2, "title", `Submit ${branch}`),
-          body: optionalString(payload2, "body", ""),
-          request: { signal }
-        });
-        workerLog(`Created PR #${pr.data.number} for ${branch}`);
-        return { prUrl: pr.data.html_url, prNumber: pr.data.number };
-      }
-      case "push-and-update-pr": {
-        const branch = requireString(payload2, "branch");
-        const prNumber = requireNumber(payload2, "pullRequestNumber");
-        await this.pushBranchToGitHub(branch);
-        await this.octokit.pulls.update({
-          owner: this.config.githubOwner,
-          repo: this.config.githubRepo,
-          pull_number: prNumber,
-          title: optionalString(payload2, "title", `Submit ${branch}`),
-          body: optionalString(payload2, "body", ""),
-          request: { signal }
-        });
-        workerLog(`Updated PR #${prNumber} for ${branch}`);
-        return { prNumber };
-      }
-      case "push-and-create-or-update-pr": {
-        const branch = requireString(payload2, "branch");
-        const base = optionalString(payload2, "baseBranch", this.baseBranch);
-        if (sanitizeBranchName(branch) === this.sanitizedBaseBranch) {
-          throw new PermanentTaskError(
-            `Refusing to push-and-create-or-update-pr for "${branch}": it is the base branch -- submitting the base branch is never valid`
-          );
-        }
-        await this.pushBranchToGitHub(branch);
-        const result = await createOrUpdatePullRequest({
-          octokit: this.octokit,
-          owner: this.config.githubOwner,
-          repo: this.config.githubRepo,
-          head: branch,
-          base,
-          title: optionalString(payload2, "title", `Submit ${branch}`),
-          body: optionalString(payload2, "body", ""),
-          // Content submits (api/github-sync.ts) set this; settings-branch
-          // syncs (services.ts) deliberately don't.
-          markReadyIfDraft: payload2.markReadyIfDraft === true,
-          signal
-        });
-        workerLog(
-          result.created ? `Created PR #${result.number} for ${branch}` : `Updated existing PR #${result.number} for ${branch}`
-        );
-        return { prUrl: result.url, prNumber: result.number };
-      }
-      case "convert-to-draft": {
-        const draftPrNumber = requireNumber(payload2, "pullRequestNumber");
-        const { data: pr } = await this.octokit.pulls.get({
-          owner: this.config.githubOwner,
-          repo: this.config.githubRepo,
-          pull_number: draftPrNumber,
-          request: { signal }
-        });
-        await this.octokit.graphql(
-          `mutation($id: ID!) { convertPullRequestToDraft(input: { pullRequestId: $id }) { pullRequest { isDraft } } }`,
-          { id: pr.node_id, request: { signal } }
-        );
-        workerLog(`Converted PR #${draftPrNumber} to draft`);
-        return { prNumber: draftPrNumber, draft: true };
-      }
-      case "close-pr": {
-        const closePrNumber = requireNumber(payload2, "pullRequestNumber");
-        await this.octokit.pulls.update({
-          owner: this.config.githubOwner,
-          repo: this.config.githubRepo,
-          pull_number: closePrNumber,
-          state: "closed",
-          request: { signal }
-        });
-        return { closed: true };
-      }
-      case "delete-remote-branch": {
-        const branch = requireString(payload2, "branch");
-        await this.octokit.git.deleteRef({
-          owner: this.config.githubOwner,
-          repo: this.config.githubRepo,
-          ref: `heads/${branch}`,
-          request: { signal }
-        });
-        return { deleted: true };
-      }
-      default:
-        throw new PermanentTaskError(`Unknown task action: ${action}`);
-    }
+    return executeTask(this.ctx(), task, signal);
   }
-  /**
-   * Update branch metadata after successful task completion.
-   * Writes PR URL/number and sets syncStatus to 'synced'.
-   */
   async updateBranchMetadata(task, result) {
-    const branch = typeof task.payload.branch === "string" ? task.payload.branch : null;
-    if (!branch) return;
-    const branchPath = this.branchWorkspacePath(branch);
-    try {
-      await fs9.stat(branchPath);
-    } catch {
-      return;
-    }
-    try {
-      const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-      const updates = {
-        name: branch,
-        syncStatus: "synced",
-        // save()'s merge only overwrites keys present in this update (see
-        // BranchMetadataFileManager.save()'s spread order) -- a prior
-        // syncFailureReason from an earlier failed attempt would otherwise
-        // survive forever past this successful sync. Explicitly clear it,
-        // same pattern as rebaseFailure's PR-W2 M2 clearing elsewhere.
-        syncFailureReason: void 0
-      };
-      if (result.prUrl) updates.pullRequestUrl = result.prUrl;
-      if (result.prNumber) {
-        updates.pullRequestNumber = result.prNumber;
-        const current = await BranchMetadataFileManager.loadOnly(branchPath);
-        const terminal = current?.branch.status === "archived" || current?.branch.pullRequestState === "merged" || current?.branch.pullRequestState === "closed";
-        if (!terminal) {
-          updates.pullRequestState = "open";
-        }
-      }
-      await meta.save({ branch: updates });
-    } catch (err) {
-      workerLogError(
-        `Failed to update metadata for ${branch}:`,
-        err instanceof Error ? err.message : err
-      );
-    }
+    return updateBranchMetadata(this.ctx(), task, result);
   }
-  /**
-   * Update branch metadata after permanent task failure.
-   * Sets syncStatus to 'sync-failed' and records `error` (already redacted
-   * by the caller, processTaskQueue -- see [HIGH-1] there) as
-   * syncFailureReason, so the editor can show WHY, not just that it failed.
-   */
-  async updateBranchMetadataOnFailure(task, error2) {
-    const branch = typeof task.payload.branch === "string" ? task.payload.branch : null;
-    if (!branch) return;
-    const branchPath = this.branchWorkspacePath(branch);
-    try {
-      await fs9.stat(branchPath);
-    } catch {
-      return;
-    }
-    try {
-      const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-      await meta.save({
-        branch: { name: branch, syncStatus: "sync-failed", syncFailureReason: error2 }
-      });
-    } catch (err) {
-      workerLogError(
-        `Failed to update failure metadata for ${branch}:`,
-        err instanceof Error ? err.message : err
-      );
-    }
+  async pushBranchToGitHub(branch) {
+    return pushBranchToGitHub(this.ctx(), branch);
   }
   buildGitHubUrl() {
     return `https://x-access-token:${this.config.githubToken}@github.com/${this.config.githubOwner}/${this.config.githubRepo}.git`;
@@ -43608,732 +44512,7 @@ var CmsWorker = class {
    * is sanitized.
    */
   branchWorkspacePath(branchRefName) {
-    return path13.join(this.contentBranchesPath, sanitizeBranchName(branchRefName));
-  }
-  /**
-   * What `remote.git` currently holds for `branchRef`, or null when this
-   * branch was never published there (never submitted) or the ref is
-   * unreadable.
-   *
-   * Uses the same explicit `--git-dir` shape as verifyBaseBranchExists()
-   * above: reading a bare repo that way does not depend on
-   * `safe.bareRepository` being permissive, which is why prod code takes
-   * this route rather than the config override the test-only `openBareRepo`
-   * helper uses.
-   */
-  async readPublishedSha(branchRef) {
-    try {
-      const out = await simpleGit().raw([
-        "--git-dir",
-        this.remoteGitPath,
-        "rev-parse",
-        "--verify",
-        `refs/heads/${branchRef}`
-      ]);
-      const sha = out.trim();
-      return sha.length > 0 ? sha : null;
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * Record that this worker rewrote `expectedSha` out of a branch's already
-   * published history (see BranchMetadata.historyRewrittenFrom).
-   *
-   * Set-once: if a marker is already present it is LEFT ALONE. Across two
-   * rebases before any GitHub push lands, GitHub still holds the commit the
-   * FIRST rebase replaced, so advancing the marker would aim the lease at a
-   * commit GitHub never had and permanently wedge the branch.
-   *
-   * Re-reads metadata rather than trusting the caller's loop-top snapshot:
-   * the task loop runs concurrently with syncGit() (see scheduleLoop) and may
-   * have cleared the marker while this branch was rebasing.
-   */
-  async markHistoryRewritten(branchPath, branchDir, expectedSha) {
-    const current = await BranchMetadataFileManager.loadOnly(branchPath);
-    if (typeof current?.branch.historyRewrittenFrom === "string") return;
-    const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-    await meta.save({ branch: { name: branchDir, historyRewrittenFrom: expectedSha } });
-  }
-  /**
-   * Clear the marker once GitHub is confirmed to hold the rewritten history.
-   *
-   * Best-effort only in the sense that a failure here destroys nothing: the
-   * lease still refuses anything unexpected, and the plain-push fallback only
-   * ever fast-forwards. It is NOT harmless. A marker that outlives its
-   * episode can wedge the NEXT one -- if the base advances before the stale
-   * marker is revisited, the queued push leases a commit GitHub has already
-   * moved off, falls back to a plain push of a rebased (non-ancestor)
-   * history, and fails permanently with a "something else moved it on
-   * GitHub" diagnosis that is false: we did.
-   *
-   * Tracked, with the concurrent-clear race that can drop a marker
-   * mid-arming, in
-   * .claude/future-tasks/worker-history-rewrite-marker-races.md.
-   */
-  async clearHistoryRewrittenMarker(branchPath, branchDir) {
-    try {
-      const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-      await meta.save({ branch: { name: branchDir, historyRewrittenFrom: void 0 } });
-    } catch (err) {
-      workerLogWarn(
-        `  Failed to clear history-rewrite marker for ${branchDir}: ${getErrorMessage2(err)}`
-      );
-    }
-  }
-  /**
-   * Publish a branch clone's rebased history into `remote.git`, replacing
-   * EXACTLY `expectedSha` and nothing else.
-   *
-   * The lease is the entire safety argument. `--force-with-lease=<ref>:<sha>`
-   * refuses unless `remote.git` still stands at `<sha>`, so this can only
-   * ever undo the commit our own rebase rewrote away. Callers must never pass
-   * "whatever remote.git currently holds" -- see the arming guard in
-   * rebaseActiveBranches() for the interleaving where that would silently
-   * delete a reviewer's direct push.
-   *
-   * Returns whether the push landed. A refused lease means a concurrent
-   * Lambda push moved the ref; that is logged and retried by the self-heal
-   * pass on a later cycle, never thrown.
-   */
-  async forcePublishToLocalRemote(branchPath, branchRef, expectedSha) {
-    const pushGit = simpleGit({ baseDir: branchPath, timeout: { block: this.taskTimeoutMs } });
-    pushGit.env(gitChildEnv({}));
-    try {
-      await pushGit.raw([
-        "push",
-        `--force-with-lease=${branchRef}:${expectedSha}`,
-        // Real flags must precede --end-of-options; everything after it is
-        // positional (see GitManager.push() for the same guard).
-        "--end-of-options",
-        "origin",
-        `${branchRef}:${branchRef}`
-      ]);
-      workerLog(`  Published rebased ${branchRef} into remote.git`);
-      return true;
-    } catch (err) {
-      const message = redactCredentials(getErrorMessage2(err));
-      workerLogWarn(
-        isStaleLeaseRejection(message) ? `  Did not publish rebased ${branchRef} into remote.git: it moved since this cycle read it (concurrent submit?) -- retrying next cycle` : `  Failed to publish rebased ${branchRef} into remote.git: ${message}`
-      );
-      return false;
-    }
-  }
-  /**
-   * Queue the GitHub hop for a branch whose rewritten history now sits in
-   * `remote.git`, so an open PR's head follows the rebase within a cycle
-   * instead of waiting for the editor's next submit.
-   *
-   * Deliberately NOT skipped when a marker is already set: inferring "a task
-   * must already be queued" from the marker starves this hop whenever a task
-   * was lost, failed permanently, or was never written. Duplicate push tasks
-   * are bounded by base-branch advances and are idempotent (a repeat push is
-   * a no-op once GitHub holds the tip).
-   */
-  async enqueueGitHubPush(branchRef) {
-    try {
-      for (const status of ["pending", "processing"]) {
-        const inFlight = await listTasks(this.taskDir, status);
-        if (inFlight.some((t6) => t6.action === "push-branch" && t6.payload.branch === branchRef)) {
-          return;
-        }
-      }
-      await enqueueTask(this.taskDir, { action: "push-branch", payload: { branch: branchRef } });
-      workerLog(`  Queued GitHub push for ${branchRef}`);
-    } catch (err) {
-      workerLogWarn(`  Failed to queue GitHub push for ${branchRef}: ${getErrorMessage2(err)}`);
-    }
-  }
-  /**
-   * Complete a rewrite this worker started but did not finish: get the
-   * rebased history into `remote.git` and queued for GitHub.
-   *
-   * Runs from the rebase loop for any branch carrying a marker, whether or
-   * not it is behind base this cycle, so an interrupted publish converges
-   * without waiting for the next base-branch advance.
-   *
-   * Always leases on the MARKER, never on remote.git's current tip -- the
-   * marker is the one commit we know our own rebase replaced.
-   */
-  async reconcilePendingRewrite(options) {
-    const { branchPath, branchDir, branchRef, headSha, marker } = options;
-    const publishedSha = await this.readPublishedSha(branchRef);
-    if (publishedSha === null) {
-      workerLogWarn(
-        `  ${branchDir}: a rewritten history is recorded but ${branchRef} is gone from remote.git -- nothing to publish`
-      );
-      return;
-    }
-    if (publishedSha === headSha) {
-      await this.enqueueGitHubPush(branchRef);
-      return;
-    }
-    if (publishedSha === marker) {
-      if (await this.forcePublishToLocalRemote(branchPath, branchRef, marker)) {
-        await this.enqueueGitHubPush(branchRef);
-      }
-      return;
-    }
-    workerLogWarn(
-      `  ${branchDir}: remote.git is at ${publishedSha} for ${branchRef}, which is neither the rebased tip nor the commit the rewrite replaced -- left untouched`
-    );
-  }
-  async pushBranchToGitHub(branch) {
-    const git = simpleGit({
-      baseDir: this.remoteGitPath,
-      // DEP-H1: kill the git process if it produces no output for
-      // taskTimeoutMs (network stall, credential prompt) instead of letting
-      // it hang past the task timeout.
-      timeout: { block: this.taskTimeoutMs }
-    });
-    git.env(gitNetworkChildEnv());
-    const branchPath = this.branchWorkspacePath(branch);
-    const metaFile = await BranchMetadataFileManager.loadOnly(branchPath).catch(() => null);
-    const marker = metaFile?.branch.historyRewrittenFrom;
-    const outgoingSha = await this.readPublishedSha(branch);
-    try {
-      if (marker) {
-        await git.raw([
-          "push",
-          `--force-with-lease=${branch}:${marker}`,
-          "--end-of-options",
-          this.buildGitHubUrl(),
-          `${branch}:${branch}`
-        ]);
-      } else {
-        await git.push(this.buildGitHubUrl(), branch);
-      }
-    } catch (err) {
-      const message = getErrorMessage2(err);
-      if (marker && isStaleLeaseRejection(message)) {
-        try {
-          await git.push(this.buildGitHubUrl(), branch);
-        } catch (retryErr) {
-          const retryMessage = getErrorMessage2(retryErr);
-          if (isNonFastForwardRejection(retryMessage)) {
-            throw new PermanentTaskError(
-              `Push rejected for branch "${branch}": GitHub's tip is neither the commit this deployment last published nor an ancestor of what it is pushing, so the branch has genuinely diverged and nothing was overwritten. Something else moved it on GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`
-            );
-          }
-          throw retryErr;
-        }
-        await this.clearHistoryRewrittenMarker(branchPath, branch);
-        workerLog(`Pushed ${branch} to GitHub (GitHub had already moved past the rewritten commit)`);
-        return;
-      }
-      if (isNonFastForwardRejection(message)) {
-        throw new PermanentTaskError(
-          `Push rejected for branch "${branch}": GitHub's tip is not what this deployment last published, so the branch has diverged and needs reconciling. Something else moved it on GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`
-        );
-      }
-      throw err;
-    }
-    if (marker && outgoingSha && outgoingSha !== marker) {
-      await this.clearHistoryRewrittenMarker(branchPath, branch);
-    }
-    workerLog(`Pushed ${branch} to GitHub`);
-  }
-  /**
-   * Push THIS deployment's own settings branch (`ensureSettingsBranch()`) from
-   * remote.git to GitHub. Non-fatal: a no-op push for an up-to-date branch
-   * just succeeds quietly.
-   *
-   * Deliberately narrowed to one branch — this used to push EVERY local
-   * branch matching `canopycms-settings-*`. With the tracking-namespace fetch
-   * fix (GITHUB_TRACKING_REF_PREFIX), `reconcileTrackedBranches` creates local
-   * heads for branches that exist on GitHub, so ANOTHER deployment's settings
-   * branch (sharing this same GitHub repo) can legitimately show up as a
-   * local head here too. Pushing it would be this deployment shipping
-   * settings state it doesn't own.
-   */
-  async pushSettingsBranches(git, trackedNames) {
-    try {
-      const settingsBranch = this.ensureSettingsBranch();
-      const branches = await git.branch();
-      const settingsBranches = branches.all.filter(
-        (b6) => b6.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX)
-      );
-      const foreign = settingsBranches.filter((b6) => b6 !== settingsBranch);
-      if (foreign.length > 0) {
-        workerLogWarn(
-          `Found settings branch(es) not owned by this deployment (${settingsBranch}): ${foreign.join(", ")}. Another CanopyCMS deployment may share this GitHub repo. Not pushing them.`
-        );
-      }
-      const ownBranchMissing = !branches.all.includes(settingsBranch);
-      const strandedLocal = foreign.filter((b6) => !trackedNames.has(b6));
-      if (strandedLocal.length > 0) {
-        workerLogWarn(
-          ownBranchMissing ? `Settings branch mismatch: this worker owns "${settingsBranch}", which does not exist in remote.git, while ${strandedLocal.join(", ")} exist(s) here and has never been pushed to GitHub. The API and this worker disagree about deploymentName, so settings changes are NOT reaching GitHub. Set CANOPYCMS_DEPLOYMENT_NAME (or settingsBranch) on this worker to match what the API resolves.` : `Settings branch(es) ${strandedLocal.join(", ")} exist in remote.git but not on GitHub, and are not owned by this deployment (${settingsBranch}) -- nothing will ever push them onward. Check that deploymentName matches across this deployment's API and worker.`
-        );
-      }
-      if (ownBranchMissing) {
-        return;
-      }
-      try {
-        await git.push(this.buildGitHubUrl(), settingsBranch);
-        workerLog(`Pushed settings branch ${settingsBranch} to GitHub`);
-      } catch (err) {
-        const message = getErrorMessage2(err);
-        if (isNonFastForwardRejection(message)) {
-          workerLogWarn(
-            `Settings push for ${settingsBranch} was rejected (non-fast-forward): another CanopyCMS deployment appears to own this settings branch on GitHub. Settings from that deployment will NOT be overwritten; this deployment's local settings changes were not pushed. Rename this deployment's settings branch (config.settingsBranch or deploymentName) to resolve the collision.`
-          );
-        } else {
-          workerLogWarn(`Settings push for ${settingsBranch}:`, message);
-        }
-      }
-    } catch (err) {
-      workerLogWarn(
-        "Failed to list branches for settings push:",
-        err instanceof Error ? err.message : err
-      );
-    }
-  }
-  /**
-   * Bring `refs/heads/*` in `remote.git` toward what was just fetched into
-   * `GITHUB_TRACKING_REF_PREFIX` -- WITHOUT ever force-rewinding or deleting
-   * a local head. This is the non-destructive replacement for what the old
-   * `+refs/heads/*:refs/heads/*` fetch refspec used to do implicitly (and
-   * destructively) as part of the fetch itself; see
-   * `GITHUB_TRACKING_REF_PREFIX`'s doc comment for the two failure modes
-   * that refspec caused.
-   *
-   * Per tracked branch:
-   * - no local `refs/heads/<name>` yet -> create it at the tracked commit
-   *   (a branch created on GitHub, or by another deployment sharing this
-   *   GitHub repo, becomes visible locally).
-   * - local is a strict ancestor of tracked (behind) -> fast-forward it.
-   * - local === tracked -> nothing to do.
-   * - tracked is a strict ancestor of local (ahead) -> LEAVE IT ALONE. This
-   *   is unpushed editor/settings work; the queued push task (or
-   *   pushSettingsBranches) ships it. This is exactly the branch state the
-   *   old refspec used to destroy.
-   * - neither is an ancestor of the other (diverged) -> LEAVE IT ALONE and
-   *   count/log it. A real collision (e.g. another deployment moved the
-   *   same branch name on GitHub); the next push attempt will be rejected
-   *   non-fast-forward, which is the correct, visible outcome -- this
-   *   method must never silently pick a winner. The one expected, benign
-   *   form of this -- our own rebase loop having published a rewrite into
-   *   remote.git with the GitHub push still queued -- is split out into the
-   *   `rewritten` bucket so the collision warning stays meaningful.
-   *
-   * Never deletes a local head: a branch removed on GitHub simply stops
-   * being tracked here; the local ref persists until removed through its
-   * own explicit path (the sync loop must not be one of them).
-   *
-   * `remote.git` is bare, so there is no worktree to invalidate by moving
-   * these refs -- unlike a non-bare repo, updating the ref that happens to
-   * be "checked out" is a non-issue here.
-   *
-   * Concurrency: `remote.git` is bare and on EFS, and the Lambda pushes into
-   * it concurrently (`GitManager.push()`'s `target:target` refspec) while
-   * this runs. Every `update-ref` below passes the expected old value (the
-   * all-zeros OID for "must not exist yet" on creation, the previously-read
-   * SHA for the fast-forward case) so a concurrent Lambda write landing in
-   * the gap between the read and the write loses the ref update instead of
-   * being silently clobbered -- the branch is simply revisited next cycle.
-   */
-  async reconcileTrackedBranches(git) {
-    const GIT_ZERO_OID = "0000000000000000000000000000000000000000";
-    const created = [];
-    const fastForwarded = [];
-    const ahead = [];
-    const diverged = [];
-    const rewritten = [];
-    const raw = await git.raw([
-      "for-each-ref",
-      "--format=%(refname) %(objectname)",
-      "refs/heads/",
-      GITHUB_TRACKING_REF_PREFIX
-    ]);
-    const heads = /* @__PURE__ */ new Map();
-    const tracked = /* @__PURE__ */ new Map();
-    for (const line of raw.split("\n")) {
-      const trimmed2 = line.trim();
-      if (!trimmed2) continue;
-      const [refname, sha] = trimmed2.split(" ");
-      if (refname.startsWith("refs/heads/")) {
-        heads.set(refname.slice("refs/heads/".length), sha);
-      } else if (refname.startsWith(GITHUB_TRACKING_REF_PREFIX)) {
-        tracked.set(refname.slice(GITHUB_TRACKING_REF_PREFIX.length), sha);
-      }
-    }
-    for (const [name, trackedSha] of tracked) {
-      const localSha = heads.get(name);
-      const localRef = `refs/heads/${name}`;
-      if (!localSha) {
-        try {
-          await git.raw(["update-ref", localRef, trackedSha, GIT_ZERO_OID]);
-          created.push(name);
-        } catch (err) {
-          workerLogWarn(
-            `  Tracked-branch reconcile: failed to create local ref for ${name} (concurrent update?): ${getErrorMessage2(err)}`
-          );
-        }
-        continue;
-      }
-      if (localSha === trackedSha) continue;
-      try {
-        const counts = (await git.raw(["rev-list", "--left-right", "--count", `${localSha}...${trackedSha}`])).trim();
-        const [leftStr, rightStr] = counts.split(/\s+/);
-        const localAheadCount = parseInt(leftStr, 10);
-        const localBehindCount = parseInt(rightStr, 10);
-        if (!Number.isInteger(localAheadCount) || !Number.isInteger(localBehindCount)) {
-          workerLogWarn(
-            `  Tracked-branch reconcile: skipping ${name}: unparseable rev-list output ${JSON.stringify(counts)}`
-          );
-          continue;
-        }
-        if (localAheadCount === 0 && localBehindCount > 0) {
-          try {
-            await git.raw(["update-ref", localRef, trackedSha, localSha]);
-            fastForwarded.push(name);
-          } catch (err) {
-            workerLogWarn(
-              `  Tracked-branch reconcile: failed to fast-forward ${name} (concurrent update?): ${getErrorMessage2(err)}`
-            );
-          }
-        } else if (localBehindCount === 0 && localAheadCount > 0) {
-          ahead.push(name);
-        } else if (await this.hasPendingHistoryRewrite(name)) {
-          rewritten.push(name);
-        } else {
-          diverged.push(name);
-        }
-      } catch (err) {
-        workerLogWarn(
-          `  Tracked-branch reconcile: skipping ${name} (unreadable ref or object?): ${getErrorMessage2(err)}`
-        );
-        continue;
-      }
-    }
-    if (diverged.length > 0) {
-      workerLogWarn(
-        `  Tracked-branch reconcile: ${diverged.length} branch(es) diverged from GitHub and were left untouched: ${diverged.join(", ")}`
-      );
-    }
-    if (rewritten.length > 0) {
-      workerLog(
-        `  Tracked-branch reconcile: ${rewritten.length} branch(es) rebased locally with the GitHub push still pending: ${rewritten.join(", ")}`
-      );
-    }
-    return {
-      summary: { created, fastForwarded, ahead, diverged, rewritten },
-      trackedNames: new Set(tracked.keys())
-    };
-  }
-  /**
-   * Whether this branch carries a pending history rewrite -- the rebase loop
-   * rewrote already-published history and the GitHub push has not landed yet
-   * (see BranchMetadata.historyRewrittenFrom).
-   *
-   * `branchName` is a git ref name; branch workspaces are directories named
-   * with the sanitized form, hence the conversion. Best-effort: a settings
-   * branch (no workspace at all), a missing directory or an unreadable
-   * branch.json all mean "no known rewrite", which is the conservative
-   * answer -- it keeps the branch in the louder `diverged` bucket.
-   */
-  async hasPendingHistoryRewrite(branchName) {
-    try {
-      const branchPath = path13.join(this.contentBranchesPath, sanitizeBranchName(branchName));
-      const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
-      return typeof metaFile?.branch.historyRewrittenFrom === "string";
-    } catch {
-      return false;
-    }
-  }
-  async syncGit() {
-    if (!this.running) return;
-    workerLog("Syncing git...");
-    const cycleStartedAt = Date.now();
-    const git = simpleGit({
-      baseDir: this.remoteGitPath,
-      // DEP-H1: a hung fetch/push would stall the sync loop forever
-      // (scheduleLoop only reschedules after completion). The block timeout
-      // is inactivity-based, so a slow-but-flowing transfer is unaffected.
-      timeout: { block: this.taskTimeoutMs }
-    });
-    git.env(gitNetworkChildEnv());
-    try {
-      await git.raw([
-        "fetch",
-        this.buildGitHubUrl(),
-        "--prune",
-        `+refs/heads/*:${GITHUB_TRACKING_REF_PREFIX}*`
-      ]);
-      workerLog("Fetched from GitHub");
-      const { summary: trackedSummary, trackedNames } = await this.reconcileTrackedBranches(git);
-      await this.pushSettingsBranches(git, trackedNames);
-      await this.refreshBaseBranchWorkspace();
-      const rebaseSummary = await this.rebaseActiveBranches();
-      await cleanupOldTasks(this.taskDir, void 0, this.log);
-      const trashRemoved = await this.cleanupTrashedBranchDirs();
-      if (trashRemoved > 0) {
-        workerLog(`Removed ${trashRemoved} expired trashed branch dir(s)`);
-      }
-      const report = this.ensureStatusReport();
-      report.lastGitSyncAt = (/* @__PURE__ */ new Date()).toISOString();
-      delete report.lastGitSyncError;
-      report.lastGitSync = {
-        durationMs: Date.now() - cycleStartedAt,
-        rebased: rebaseSummary.rebased,
-        skippedDirty: rebaseSummary.skippedDirty,
-        skippedLocked: rebaseSummary.skippedLocked,
-        failed: rebaseSummary.failed,
-        tracked: trackedSummary
-      };
-      await writeWorkerStatus(this.taskDir, report).catch(
-        (writeErr) => workerLogError("Failed to write worker status:", getErrorMessage2(writeErr))
-      );
-    } catch (err) {
-      const report = this.ensureStatusReport();
-      report.lastGitSyncError = {
-        message: redactCredentials(getErrorMessage2(err)),
-        at: (/* @__PURE__ */ new Date()).toISOString()
-      };
-      await writeWorkerStatus(this.taskDir, report).catch(
-        (writeErr) => workerLogError("Failed to write worker status:", getErrorMessage2(writeErr))
-      );
-      throw err;
-    }
-  }
-  /**
-   * [C1] Remove `.trash-*` branch directories (created by the admin purge
-   * action, api/admin-branch-health.ts) whose name-embedded stamp is older
-   * than {@link TRASH_RETENTION_MS}. Names that don't match the expected
-   * `.trash-{dirName}-{STAMP}` shape, or whose stamp fails to parse, are
-   * left alone (logged once per cycle, not per file, to avoid flooding logs
-   * if something odd accumulates) -- purge is the only writer of this
-   * naming scheme, so an unparseable name is unexpected and worth a human
-   * looking rather than a silent skip.
-   */
-  async cleanupTrashedBranchDirs() {
-    let entries;
-    try {
-      entries = await fs9.readdir(this.contentBranchesPath);
-    } catch (err) {
-      if (isNodeError(err) && err.code === "ENOENT") return 0;
-      throw err;
-    }
-    const now = Date.now();
-    let removed = 0;
-    let loggedUnparseable = false;
-    for (const name of entries) {
-      if (!name.startsWith(".trash-")) continue;
-      const stampMatch = TRASH_DIR_STAMP_RE.exec(name);
-      const stampDate = stampMatch ? parseTrashStamp(stampMatch[1]) : null;
-      if (!stampDate) {
-        if (!loggedUnparseable) {
-          workerLog(`CanopyCMS: Skipping trash dir with unparseable stamp: ${name}`);
-          loggedUnparseable = true;
-        }
-        continue;
-      }
-      if (now - stampDate.getTime() < TRASH_RETENTION_MS) continue;
-      try {
-        await fs9.rm(path13.join(this.contentBranchesPath, name), {
-          recursive: true,
-          force: true,
-          maxRetries: 3,
-          retryDelay: 100
-        });
-        removed++;
-      } catch (err) {
-        workerLogError(
-          `CanopyCMS: Failed to remove trashed branch dir ${name}:`,
-          getErrorMessage2(err)
-        );
-      }
-    }
-    return removed;
-  }
-  /**
-   * Fast-forward the base branch's own working-tree clone
-   * (content-branches/<baseBranch>) to match origin/<baseBranch>.
-   *
-   * Previously this clone was refreshed only incidentally, by the generic
-   * rebase loop below (rebaseActiveBranches): for a branch with status
-   * 'editing', rebasing onto origin/<baseBranch> degenerates to a
-   * fast-forward when the clone IS the base branch. But that loop's skip
-   * paths -- a dirty tree, a missing .git -- are silent, which is the
-   * suspected live failure mode: a wedged base clone with no diagnosable
-   * signal in the logs. This dedicated step makes the refresh explicit,
-   * ff-only, and loud, so a stuck base view (an editor forking a new branch
-   * "from base" that's actually a stale snapshot) is diagnosable from logs.
-   * This runs every sync cycle so the drift window is bounded by
-   * gitSyncInterval.
-   *
-   * ff-only on purpose: this clone must stay a linear mirror of
-   * origin/<baseBranch>, so a merge that isn't a fast-forward (diverged
-   * local history) is treated as a should-never-happen condition and left
-   * untouched rather than force-resolved.
-   */
-  async refreshBaseBranchWorkspace() {
-    const basePath32 = path13.join(this.contentBranchesPath, this.sanitizedBaseBranch);
-    const gitDir = path13.join(basePath32, ".git");
-    try {
-      let gitDirStat;
-      try {
-        gitDirStat = await fs9.stat(gitDir);
-      } catch {
-        gitDirStat = null;
-      }
-      if (!gitDirStat || !gitDirStat.isDirectory()) {
-        workerLog(
-          `Base branch workspace (${this.baseBranch}): not yet provisioned, skipping refresh`
-        );
-        return;
-      }
-      const baseGit = simpleGit({
-        baseDir: basePath32,
-        // Keep git non-interactive during the merge so it never blocks on an
-        // editor. simple-git >=3.32 blocks setting core.editor unless
-        // explicitly opted in; the value here is a hardcoded literal
-        // ("true", the shell no-op), not user input, so enabling
-        // allowUnsafeEditor carries no injection risk (same as the rebase
-        // loop's git config below).
-        config: ["core.editor=true"],
-        unsafe: { allowUnsafeEditor: true },
-        // DEP-H1: a hung fetch/merge against this EFS-backed clone would
-        // stall the sync loop forever (scheduleLoop only reschedules after
-        // completion). The block timeout is inactivity-based, so a
-        // slow-but-flowing transfer is unaffected -- same as syncGit()'s
-        // remote handle.
-        timeout: { block: this.taskTimeoutMs }
-      });
-      const status = await baseGit.status();
-      const trackedDirty = status.files.filter((f5) => f5.index !== "?" || f5.working_dir !== "?");
-      if (trackedDirty.length > 0) {
-        workerLogError(
-          `Base branch workspace (${this.baseBranch}) has uncommitted changes -- skipping refresh. Dirty files: ${trackedDirty.map((f5) => f5.path).join(", ")}`
-        );
-        return;
-      }
-      await baseGit.fetch("origin", this.baseBranch);
-      const fetchedTip = (await baseGit.revparse(["FETCH_HEAD"])).trim();
-      const behindCount = parseInt(
-        (await baseGit.raw(["rev-list", "--count", `HEAD..${fetchedTip}`])).trim(),
-        10
-      );
-      if (behindCount > 0) {
-        try {
-          await baseGit.merge(["--ff-only", fetchedTip]);
-        } catch (err) {
-          workerLogError(
-            `Base branch workspace (${this.baseBranch}) failed to fast-forward (diverged local history?): ${getErrorMessage2(err)}`
-          );
-          return;
-        }
-        await invalidateBranchContentCaches(basePath32);
-      }
-      const currentMeta = await BranchMetadataFileManager.loadOnly(basePath32);
-      const conflictStatus = currentMeta?.branch.conflictStatus;
-      const conflictFiles = currentMeta?.branch.conflictFiles;
-      const alreadyClean = (conflictStatus === void 0 || conflictStatus === "clean") && (conflictFiles === void 0 || conflictFiles.length === 0);
-      if (!alreadyClean) {
-        const meta = getBranchMetadataFileManager(basePath32, this.contentBranchesPath);
-        await meta.save({
-          branch: { name: this.baseBranch, conflictStatus: "clean", conflictFiles: [] }
-        });
-      }
-      workerLog(
-        behindCount > 0 ? `Base branch workspace (${this.baseBranch}): fast-forwarded ${behindCount} commit(s)` : `Base branch workspace (${this.baseBranch}): up to date`
-      );
-    } catch (err) {
-      workerLogError(
-        `Base branch workspace (${this.baseBranch}) refresh failed: ${getErrorMessage2(err)}`
-      );
-    }
-  }
-  /**
-   * Poll GitHub for a submitted/approved branch's PR resolution.
-   *
-   * submitted/approved branches sit outside the rebase loop and get no
-   * other signal that their PR resolved on GitHub -- nothing pushes a
-   * merge/close webhook back into the branch workspace. merged ->
-   * auto-archive via buildMergedBranchUpdate (shared with the manual
-   * markAsMerged API so both paths produce identical archived-branch
-   * metadata). closed-without-merge -> record pullRequestState only; an
-   * admin decides the workflow transition from there. Best-effort: any
-   * failure here is logged and swallowed, retried next sync cycle.
-   */
-  async pollMergeState(branchDir, branchPath, metaFile) {
-    const prNumber = metaFile?.branch.pullRequestNumber;
-    if (!prNumber) return;
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), this.taskTimeoutMs);
-    try {
-      const { data: data2 } = await this.octokit.pulls.get({
-        owner: this.config.githubOwner,
-        repo: this.config.githubRepo,
-        pull_number: prNumber,
-        request: { signal: controller.signal }
-      });
-      if (data2.merged) {
-        const meta2 = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-        await meta2.save({
-          branch: buildMergedBranchUpdate(
-            branchDir,
-            data2.merged_at ? new Date(data2.merged_at) : void 0
-          )
-        });
-        workerLog(`  PR #${prNumber} for ${branchDir} is merged -> archived`);
-        return;
-      }
-      const newState = data2.state === "closed" ? "closed" : "open";
-      const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
-      if (currentMeta?.branch.pullRequestState === newState) return;
-      const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-      await meta.save({ branch: { name: branchDir, pullRequestState: newState } });
-      workerLog(`  PR #${prNumber} for ${branchDir}: pullRequestState -> ${newState}`);
-    } catch (err) {
-      workerLogWarn(`  Failed to poll PR #${prNumber} for ${branchDir}: ${getErrorMessage2(err)}`);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  /**
-   * Persist a per-branch rebase failure to branch.json (PR-W2), bounded to
-   * roughly one save per failing branch per hour: a branch stuck failing
-   * every cycle must not turn into unbounded save-per-cycle x N-failing-
-   * branches write amplification -- save() eager-regenerates the branch
-   * registry (branch-metadata.ts's invalidateRegistry(), O(branch count) EFS
-   * reads), the same concern the `alreadyClean` no-op guard above exists
-   * for.
-   *
-   * Best-effort and non-fatal like every other metadata write in this
-   * loop's error paths: a corrupt branch.json, a lock-contention error, or
-   * any other save failure here must never abort the per-branch iteration.
-   * This matters doubly at the two call sites -- one is inside the outer
-   * per-branch catch, with no further catch of its own around this call --
-   * so the whole method is wrapped, not just the load.
-   */
-  async recordRebaseFailure(branchPath, branchDir, message) {
-    const RECORD_REFRESH_MS = 60 * 60 * 1e3;
-    const redactedMessage = redactCredentials(message);
-    try {
-      const existing = await BranchMetadataFileManager.loadOnly(branchPath);
-      const prior = existing?.branch.rebaseFailure;
-      const sameMessage = prior?.message === redactedMessage;
-      const now = /* @__PURE__ */ new Date();
-      if (sameMessage) {
-        const lastAtMs = Date.parse(prior.lastAt);
-        if (!Number.isNaN(lastAtMs) && now.getTime() - lastAtMs < RECORD_REFRESH_MS) {
-          return;
-        }
-      }
-      const nowIso = now.toISOString();
-      const firstAt = sameMessage ? prior.firstAt : nowIso;
-      const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-      await meta.save({
-        branch: {
-          name: branchDir,
-          rebaseFailure: { message: redactedMessage, firstAt, lastAt: nowIso }
-        }
-      });
-    } catch (err) {
-      workerLogWarn(`  Failed to record rebase failure for ${branchDir}: ${getErrorMessage2(err)}`);
-    }
+    return path17.join(this.contentBranchesPath, sanitizeBranchName(branchRefName));
   }
   /**
    * Test-only seam: awaited inside `rebaseActiveBranches()`'s conflict round,
@@ -44358,307 +44537,48 @@ var CmsWorker = class {
    */
   async afterRebaseCompletedForTesting() {
   }
+  // --- Rebase loop (worker/rebase.ts) ------------------------------------
+  //
+  // Both are TEST-ONLY entry points -- see the task-queue block above. Nothing
+  // in production dispatches through either; `syncGit` calls `runRebaseCycle`
+  // directly and that calls `pollMergeState` directly. Four test files call
+  // `rebaseActiveBranches` (it is the single entry point the whole rebase suite
+  // drives), and cms-worker-merge-poll.test.ts calls `pollMergeState` with a
+  // mocked `octokit`. Neither is on WorkerContext, so a stub installed on
+  // either is a no-op as far as a production code path is concerned.
+  //
+  // `rebaseActiveBranches` also has a consumer outside the test files:
+  // apps/test-app/app/api/e2e-test/rebase/route.ts drives it from an e2e
+  // fixture route. Do not delete it as unused.
   async rebaseActiveBranches() {
-    const rebased = [];
-    const skippedDirty = [];
-    const skippedLocked = [];
-    const failed = [];
-    let branchDirs;
-    try {
-      branchDirs = await fs9.readdir(this.contentBranchesPath);
-    } catch {
-      return { rebased, skippedDirty, skippedLocked, failed };
-    }
-    for (const branchDir of branchDirs) {
-      if (branchDir.startsWith(".") || branchDir === "branches.json") {
-        continue;
-      }
-      const branchPath = path13.join(this.contentBranchesPath, branchDir);
-      const gitDir = path13.join(branchPath, ".git");
-      try {
-        const stat = await fs9.stat(gitDir);
-        if (!stat.isDirectory()) {
-          workerLog(`  Skipping ${branchDir}: .git is not a directory`);
-          continue;
-        }
-      } catch {
-        workerLog(`  Skipping ${branchDir}: no .git directory (not a branch workspace)`);
-        continue;
-      }
-      if (branchDir === this.sanitizedBaseBranch) {
-        workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
-        continue;
-      }
-      try {
-        const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
-        const branchStatus2 = metaFile?.branch.status;
-        if (branchStatus2 === "submitted" || branchStatus2 === "approved") {
-          workerLog(`  Skipping ${branchDir} (${branchStatus2})`);
-          await this.pollMergeState(branchDir, branchPath, metaFile);
-          continue;
-        }
-        if (branchStatus2 === "archived") {
-          workerLog(`  Skipping ${branchDir} (${branchStatus2})`);
-          continue;
-        }
-        const branchGit = simpleGit({
-          baseDir: branchPath,
-          // Keep git non-interactive during rebase/merge so it never blocks on an editor.
-          // simple-git >=3.32 blocks setting core.editor unless explicitly opted in; the
-          // value here is a hardcoded literal ("true", the shell no-op), not user input,
-          // so enabling allowUnsafeEditor carries no injection risk.
-          config: ["core.editor=true"],
-          unsafe: { allowUnsafeEditor: true }
-        });
-        let releaseContentLock;
-        let contentLockCompromised = false;
-        try {
-          releaseContentLock = await tryAcquireContentWriteLock(branchPath, (lockErr) => {
-            contentLockCompromised = true;
-            workerLogWarn(
-              `  Content-write lock compromised mid-rebase for ${branchDir}: ${getErrorMessage2(lockErr)}`
-            );
-          });
-        } catch (lockErr) {
-          if (isNodeError(lockErr) && lockErr.code === "ELOCKED") {
-            workerLog(`  Skipping ${branchDir}: content write in progress (retrying next cycle)`);
-            skippedLocked.push(branchDir);
-            continue;
-          }
-          throw lockErr;
-        }
-        try {
-          if (await isRebaseInProgress(branchPath)) {
-            const preAbort = await branchGit.status().catch(() => null);
-            const collateral = (preAbort?.files ?? []).filter((f5) => !preAbort?.conflicted.includes(f5.path)).filter((f5) => f5.working_dir !== " " && f5.working_dir !== "?").map((f5) => f5.path);
-            if (collateral.length > 0) {
-              workerLogWarn(
-                `  ${branchDir}: aborting the interrupted rebase will DISCARD working-tree changes to ${collateral.length} file(s) saved while the worker was down: ${collateral.join(", ")}`
-              );
-            }
-            workerLogWarn(
-              `  ${branchDir}: found an interrupted rebase (this worker's own abandoned work) -- aborting it to recover the branch`
-            );
-            try {
-              await branchGit.rebase(["--abort"]);
-            } catch (abortErr) {
-              const reason = redactCredentials(
-                `could not abort interrupted rebase: ${getErrorMessage2(abortErr)}`
-              );
-              workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
-              failed.push({ branch: branchDir, error: reason });
-              await this.recordRebaseFailure(branchPath, branchDir, reason);
-              continue;
-            }
-          }
-          const dirtyCheck = await branchGit.status();
-          if (dirtyCheck.files.length > 0) {
-            workerLog(`  Skipping ${branchDir}: has uncommitted changes`);
-            skippedDirty.push(branchDir);
-            continue;
-          }
-          const branchRef = (await branchGit.revparse(["--abbrev-ref", "HEAD"])).trim();
-          const canPublish = branchRef.length > 0 && branchRef !== "HEAD";
-          if (canPublish && metaFile?.branch.historyRewrittenFrom) {
-            await this.reconcilePendingRewrite({
-              branchPath,
-              branchDir,
-              branchRef,
-              headSha: (await branchGit.revparse(["HEAD"])).trim(),
-              marker: metaFile.branch.historyRewrittenFrom
-            });
-          }
-          await branchGit.fetch("origin", this.baseBranch);
-          const fetchedBaseTip = (await branchGit.revparse(["FETCH_HEAD"])).trim();
-          const behindCount = parseInt(
-            (await branchGit.raw(["rev-list", "--count", `HEAD..${fetchedBaseTip}`])).trim(),
-            10
-          );
-          const meta = getBranchMetadataFileManager(branchPath, this.contentBranchesPath);
-          if (behindCount === 0) {
-            const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
-            const conflictStatus = currentMeta?.branch.conflictStatus;
-            const conflictFiles = currentMeta?.branch.conflictFiles;
-            const conflictAlreadyClean = (conflictStatus === void 0 || conflictStatus === "clean") && (conflictFiles === void 0 || conflictFiles.length === 0);
-            const alreadyClean = conflictAlreadyClean && currentMeta?.branch.rebaseFailure === void 0;
-            if (alreadyClean) {
-              continue;
-            }
-            await meta.save({
-              branch: {
-                name: branchDir,
-                conflictStatus: "clean",
-                conflictFiles: [],
-                rebaseFailure: void 0
-              }
-            });
-            continue;
-          }
-          workerLog(`Rebasing ${branchDir} (${behindCount} commits behind)...`);
-          const preRebaseHead = (await branchGit.revparse(["HEAD"])).trim();
-          const publishedSha = canPublish ? await this.readPublishedSha(branchRef) : null;
-          const conflictedFiles = [];
-          let nextAction = "start";
-          let completed = false;
-          let failureReason;
-          const MAX_ROUNDS = 50;
-          for (let round = 0; round < MAX_ROUNDS && !completed; round++) {
-            if (contentLockCompromised) break;
-            try {
-              if (nextAction === "start") {
-                await branchGit.rebase([fetchedBaseTip]);
-              } else if (nextAction === "continue") {
-                await branchGit.rebase(["--continue"]);
-              } else {
-                await branchGit.rebase(["--skip"]);
-              }
-              completed = true;
-            } catch (rebaseErr) {
-              nextAction = "continue";
-              const st = await branchGit.status();
-              if (st.conflicted.length > 0) {
-                await this.afterConflictDetectedForTesting();
-                const conflictKind = new Map(
-                  st.files.map((f5) => [f5.path, `${f5.index}${f5.working_dir}`])
-                );
-                let resolutionFailure;
-                for (const file of st.conflicted) {
-                  const kind = conflictKind.get(file);
-                  try {
-                    if (kind === "UD") {
-                      await branchGit.raw(["rm", "-f", "--", file]);
-                    } else if (kind === "DU") {
-                      await branchGit.add(file);
-                    } else {
-                      await branchGit.raw(["checkout", "--theirs", file]);
-                      await branchGit.add(file);
-                    }
-                  } catch (resolveErr) {
-                    resolutionFailure = `failed to resolve conflicted file '${file}' (status ${kind ?? "??"}): ` + getErrorMessage2(resolveErr);
-                    break;
-                  }
-                  conflictedFiles.push(file);
-                }
-                if (resolutionFailure !== void 0) {
-                  failureReason = resolutionFailure;
-                  break;
-                }
-              } else {
-                const msg = rebaseErr instanceof Error ? rebaseErr.message : "";
-                if (msg.toLowerCase().includes("nothing to commit") || msg.toLowerCase().includes("apply --skip")) {
-                  nextAction = "skip";
-                } else {
-                  workerLogWarn(
-                    `  Unexpected rebase error in ${branchDir}: ${msg || "Unknown error"}`
-                  );
-                  failureReason = msg || "Unknown error";
-                  await branchGit.rebase(["--abort"]).catch(() => {
-                  });
-                  break;
-                }
-              }
-            }
-          }
-          if (completed) await this.afterRebaseCompletedForTesting();
-          if (contentLockCompromised && !completed) {
-            workerLogWarn(
-              `  Skipping ${branchDir}: content-write lock was compromised mid-rebase (retrying next cycle)`
-            );
-            await branchGit.rebase(["--abort"]).catch(() => {
-            });
-            skippedLocked.push(branchDir);
-            continue;
-          }
-          if (contentLockCompromised) {
-            workerLogWarn(
-              `  Content-write lock for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`
-            );
-          }
-          if (!completed) {
-            workerLogWarn(
-              failureReason !== void 0 ? `  Rebase of ${branchDir} aborted due to unexpected error: ${failureReason}` : `  Rebase of ${branchDir} did not complete within ${MAX_ROUNDS} rounds, aborting`
-            );
-            await branchGit.rebase(["--abort"]).catch(() => {
-            });
-            const rebaseFailureMessage = failureReason ?? `did not complete within ${MAX_ROUNDS} rounds`;
-            const redactedRebaseFailureMessage = redactCredentials(rebaseFailureMessage);
-            failed.push({
-              branch: branchDir,
-              error: redactedRebaseFailureMessage
-            });
-            await this.recordRebaseFailure(branchPath, branchDir, redactedRebaseFailureMessage);
-            continue;
-          }
-          await invalidateBranchContentCaches(branchPath);
-          const normalizedContentRoot = normalizeFilesystemPath(this.contentRoot);
-          const conflictIds = [...new Set(conflictedFiles)].map((f5) => {
-            const fileId = extractIdFromFilename(path13.basename(f5));
-            if (fileId) return fileId;
-            const parentDir = path13.basename(path13.dirname(f5));
-            const dirId = extractIdFromFilename(parentDir);
-            if (dirId) return dirId;
-            const parentPath = normalizeFilesystemPath(path13.dirname(f5));
-            if (path13.basename(f5) === ".collection.json" && parentPath === normalizedContentRoot) {
-              return ROOT_COLLECTION_ID;
-            }
-            return null;
-          }).filter((id) => id !== null);
-          const conflictIdsDeduped = [...new Set(conflictIds)];
-          const hadConflicts = conflictIdsDeduped.length > 0;
-          workerLog(
-            hadConflicts ? `  Rebased ${branchDir} (kept branch version for ${conflictIdsDeduped.length} conflicting file(s))` : `  Rebased ${branchDir} successfully`
-          );
-          await meta.save({
-            branch: {
-              name: branchDir,
-              conflictStatus: hadConflicts ? "conflicts-detected" : "clean",
-              conflictFiles: conflictIdsDeduped,
-              // PR-W2: the cycle completed successfully -- clear any prior
-              // failure record regardless of conflict outcome.
-              rebaseFailure: void 0
-            }
-          });
-          rebased.push(branchDir);
-          if (publishedSha !== null) {
-            if (publishedSha === preRebaseHead) {
-              await this.markHistoryRewritten(branchPath, branchDir, publishedSha);
-              if (await this.forcePublishToLocalRemote(branchPath, branchRef, publishedSha)) {
-                await this.enqueueGitHubPush(branchRef);
-              }
-            } else {
-              const divergence = `rebased locally, but remote.git holds ${publishedSha} for ${branchRef}, which this clone never had (a direct push to the branch?). Left untouched -- reconcile it before submitting again.`;
-              workerLogWarn(`  ${branchDir}: ${divergence}`);
-              await this.recordRebaseFailure(branchPath, branchDir, divergence);
-            }
-          }
-        } finally {
-          try {
-            if (await isRebaseInProgress(branchPath)) {
-              workerLogWarn(
-                `  ${branchDir}: rebase still in progress on exit -- aborting so the clone is not left wedged`
-              );
-              await branchGit.rebase(["--abort"]);
-            }
-          } catch (abortErr) {
-            workerLogWarn(
-              `  Failed to abort in-progress rebase for ${branchDir}: ${getErrorMessage2(abortErr)}`
-            );
-          }
-          await releaseContentLock?.().catch((releaseErr) => {
-            workerLogWarn(
-              `  Failed to release content-write lock for ${branchDir}: ${getErrorMessage2(releaseErr)}`
-            );
-          });
-        }
-      } catch (err) {
-        const message = err instanceof Error ? err.message : "Unknown error";
-        workerLogWarn(`  Failed to sync ${branchDir}: ${message}`);
-        const redactedMessage = redactCredentials(message);
-        failed.push({ branch: branchDir, error: redactedMessage });
-        await this.recordRebaseFailure(branchPath, branchDir, redactedMessage);
-      }
-    }
-    return { rebased, skippedDirty, skippedLocked, failed };
+    return runRebaseCycle(this.ctx());
+  }
+  // --- Git-sync cluster (worker/git-sync.ts) -----------------------------
+  //
+  // `syncGit` is the public loop entry `scheduleLoop` drives. The three private
+  // ones below it are TEST-ONLY entry points -- see the task-queue block above
+  // -- each called directly by one test file (cms-worker-sync-reconcile for the
+  // settings push, cms-worker-base-refresh for the base workspace,
+  // cms-worker.test.ts for the trash sweep). `syncGit` reaches all three as
+  // module-level calls, so a stub installed on one of these is a no-op.
+  //
+  // `reconcileTrackedBranches` deliberately has NO delegator: no test reaches
+  // it through the instance. Comments elsewhere that point at it as living in
+  // this file are stale by definition -- it is in git-sync.ts.
+  async syncGit() {
+    return syncGit(this.ctx());
+  }
+  async pushSettingsBranches(git, trackedNames) {
+    return pushSettingsBranches(this.ctx(), git, trackedNames);
+  }
+  async refreshBaseBranchWorkspace() {
+    return refreshBaseBranchWorkspace(this.ctx());
+  }
+  async cleanupTrashedBranchDirs() {
+    return cleanupTrashedBranchDirs(this.ctx());
+  }
+  async pollMergeState(branchDir, branchPath, metaFile) {
+    return pollMergeState(this.ctx(), branchDir, branchPath, metaFile);
   }
   async refreshAuthCache() {
     if (!this.running || !this.config.refreshAuthCache) return;
@@ -47853,10 +47773,10 @@ var SessionAPI = class extends AbstractAPI {
    */
   async getToken(sessionId, template, expiresInSeconds) {
     this.requireId(sessionId);
-    const path16 = template ? joinPaths(basePath24, sessionId, "tokens", template) : joinPaths(basePath24, sessionId, "tokens");
+    const path20 = template ? joinPaths(basePath24, sessionId, "tokens", template) : joinPaths(basePath24, sessionId, "tokens");
     const requestOptions = {
       method: "POST",
-      path: path16
+      path: path20
     };
     if (expiresInSeconds !== void 0) {
       requestOptions.bodyParams = { expires_in_seconds: expiresInSeconds };
@@ -49978,12 +49898,12 @@ function buildRequest(options) {
       userAgent = USER_AGENT,
       skipApiVersionInUrl = false
     } = options;
-    const { path: path16, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
+    const { path: path20, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
     const { deepSnakecaseBodyParamKeys = false } = opts || {};
     if (requireSecretKey) {
       assertValidSecretKey(secretKey);
     }
-    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path16) : joinPaths(apiUrl, apiVersion, path16);
+    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path20) : joinPaths(apiUrl, apiVersion, path20);
     const finalUrl = new URL(url);
     if (queryParams) {
       const snakecasedQueryParams = snakecase_keys_default({ ...queryParams });
@@ -52045,38 +51965,38 @@ function createClerkClient(options) {
 }
 
 // ../canopycms/src/auth/file-based-auth-cache.ts
-import fs10 from "node:fs/promises";
-import path14 from "node:path";
+import fs14 from "node:fs/promises";
+import path18 from "node:path";
 var log5 = createDebugLogger({ prefix: "FileBasedAuthCache" });
 async function writeAuthCacheSnapshot(cachePath, files) {
-  await fs10.mkdir(cachePath, { recursive: true });
+  await fs14.mkdir(cachePath, { recursive: true });
   const timestamp2 = Date.now();
-  const snapshotDir = path14.join(cachePath, `snapshot-${timestamp2}`);
-  await fs10.mkdir(snapshotDir, { recursive: true });
+  const snapshotDir = path18.join(cachePath, `snapshot-${timestamp2}`);
+  await fs14.mkdir(snapshotDir, { recursive: true });
   for (const [fileName, data2] of Object.entries(files)) {
-    const tmpPath = path14.join(snapshotDir, `${fileName}.tmp`);
-    const finalPath = path14.join(snapshotDir, fileName);
-    await fs10.writeFile(tmpPath, JSON.stringify(data2, null, 2), "utf-8");
-    await fs10.rename(tmpPath, finalPath);
-  }
-  const currentLink = path14.join(cachePath, "current");
-  const tmpLink = path14.join(cachePath, `current-${timestamp2}`);
-  await fs10.symlink(path14.basename(snapshotDir), tmpLink);
-  await fs10.rename(tmpLink, currentLink);
+    const tmpPath = path18.join(snapshotDir, `${fileName}.tmp`);
+    const finalPath = path18.join(snapshotDir, fileName);
+    await fs14.writeFile(tmpPath, JSON.stringify(data2, null, 2), "utf-8");
+    await fs14.rename(tmpPath, finalPath);
+  }
+  const currentLink = path18.join(cachePath, "current");
+  const tmpLink = path18.join(cachePath, `current-${timestamp2}`);
+  await fs14.symlink(path18.basename(snapshotDir), tmpLink);
+  await fs14.rename(tmpLink, currentLink);
   await cleanupOldSnapshots(cachePath, 2);
   return snapshotDir;
 }
 async function cleanupOldSnapshots(cachePath, keepCount) {
   let entries;
   try {
-    entries = await fs10.readdir(cachePath);
+    entries = await fs14.readdir(cachePath);
   } catch {
     return;
   }
   const snapshots = entries.filter((e5) => e5.startsWith("snapshot-")).sort().reverse();
   for (const snapshot of snapshots.slice(keepCount)) {
     try {
-      await fs10.rm(path14.join(cachePath, snapshot), {
+      await fs14.rm(path18.join(cachePath, snapshot), {
         recursive: true,
         force: true
       });
@@ -52170,7 +52090,7 @@ async function refreshClerkCache(options) {
 }
 
 // worker/index.ts
-import path15 from "node:path";
+import path19 from "node:path";
 async function getSecret(secretArn, retries = 3) {
   const { SecretsManagerClient, GetSecretValueCommand } = await Promise.resolve().then(() => __toESM(require_dist_cjs53(), 1));
   const client = new SecretsManagerClient({});
@@ -52209,7 +52129,7 @@ async function main() {
   if (!clerkSecretKey && process.env.CLERK_SECRET_KEY_SECRET_ARN) {
     clerkSecretKey = await getSecret(process.env.CLERK_SECRET_KEY_SECRET_ARN);
   }
-  const cachePath = path15.join(workspacePath, ".cache");
+  const cachePath = path19.join(workspacePath, ".cache");
   const refreshAuthCache = clerkSecretKey ? async () => {
     const result = await refreshClerkCache({
       secretKey: clerkSecretKey,