canopycms-cdk 0.0.67-int.90 → 0.0.67

package/worker/dist/index.js

@@ -12515,18 +12515,18 @@ var init_config2 = __esm({
       onAccountClick: external_exports.function().returns(external_exports.void()).optional(),
       onLogoutClick: external_exports.function().returns(external_exports.void()).optional(),
       // Optional: custom account component (e.g., Clerk's UserButton)
-      AccountComponent: external_exports.custom().optional()
+      AccountComponent: external_exports.custom().optional(),
+      // Optional: provider sign-in UI for signed-out users (see EditorSignInProps)
+      SignInComponent: external_exports.custom().optional()
     });
     CanopyConfigSchema = external_exports.object({
       media: mediaSchema.optional(),
-      // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
-      // have .default('deny'), so the field is optional on input but always resolves to
-      // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
-      // before the inner default runs, defeating the fail-closed default (SCH-M1).
-      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
-      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
-      // still resolves to 'deny' and an omitted level inside the object form stays undefined
-      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
+      // No outer .optional(): both schemas already .default('deny'), so the field is optional on
+      // input but always resolves to 'allow'/'deny' (never undefined) on output — an outer
+      // .optional() would short-circuit before the inner default runs, defeating the fail-closed
+      // default (SCH-M1). defaultPathAccessSchema's .default('deny') sits on the OUTER union, not
+      // inside defaultPathAccessLevelsSchema, so an omitted level in the object form stays
+      // undefined (resolved to 'deny' at read time by resolveDefaultPathAccess).
       defaultBranchAccess: defaultBranchAccessSchema,
       defaultPathAccess: defaultPathAccessSchema,
       // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
@@ -12550,16 +12550,11 @@ var init_config2 = __esm({
       allowNetworkRemoteInProd: external_exports.boolean().optional(),
       settingsBranch: external_exports.string().optional(),
       autoCreateSettingsPR: external_exports.boolean().optional(),
-      // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
-      // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
-      // the literal 'prod' instead of staying `undefined` — collapsing the
-      // env > config > modeDefault precedence chain that resolveDeploymentName
-      // (operating-mode/deployment-name.ts) implements: config would then always
-      // "win" over modeDefault (masking dev's real default of 'local'), and the env
-      // var would just be racing config's baked-in 'prod' instead of a true absence.
-      // `.optional()` here is what keeps an omitted deploymentName reaching
-      // resolveDeploymentName as `undefined`, so it can fall through to modeDefault.
-      // Do not "fix" this by removing `.optional()`.
+      // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
+      // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
+      // env > config > modeDefault precedence chain `resolveDeploymentName`
+      // (operating-mode/deployment-name.ts) implements — config would always "win" over
+      // modeDefault, masking dev's real default of 'local'. Do not remove `.optional()`.
       deploymentName: deploymentNameSchema.optional(),
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
@@ -48211,15 +48206,11 @@ var DebugLogger = class {
     return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
   }
   /**
-   * The ISO-8601 timestamp leads the line BARE - not wrapped in brackets as it
-   * once was. `CANOPYCMS_DEBUG=true` can be set on the EC2 worker, whose stdout
-   * appends to /var/log/canopy-worker/worker.log; the CloudWatch agent's
-   * `multi_line_start_pattern` matches the timestamp at the START of a line
-   * (see worker/log.ts's INVARIANT and cms-service.ts's agent config), so a
-   * leading `[` meant every debug line was silently folded into the previous
-   * event instead of starting its own. The bracketed `[prefix:category]` and
-   * `[level]` fields still follow, so the human-readable shape is unchanged
-   * apart from those two characters.
+   * The ISO-8601 timestamp leads the line BARE, never bracketed. `CANOPYCMS_DEBUG=true` can
+   * be set on the EC2 worker, whose stdout appends to /var/log/canopy-worker/worker.log, and
+   * the CloudWatch agent's `multi_line_start_pattern` matches a timestamp at the START of a
+   * line (see worker/log.ts's INVARIANT and cms-service.ts's agent config): any leading
+   * character folds the line into the previous event instead of starting its own.
    */
   formatMessage(level, category, message) {
     const timestamp2 = (/* @__PURE__ */ new Date()).toISOString();
@@ -48252,15 +48243,9 @@ var DebugLogger = class {
       throw new Error(errorMsg);
     }
   }
-  /**
-   * Start timing an operation
-   */
   time(label) {
     this.timers.set(label, Date.now());
   }
-  /**
-   * End timing an operation and log the duration
-   */
   timeEnd(category, label) {
     const start = this.timers.get(label);
     if (start === void 0) {
@@ -48272,9 +48257,6 @@ var DebugLogger = class {
     this.debug(category, `${label} completed`, { durationMs: duration });
     return duration;
   }
-  /**
-   * Wrap an async function with automatic timing
-   */
   async timed(category, label, fn) {
     this.time(label);
     try {
@@ -48614,7 +48596,7 @@ async function moveToCorrupt(taskDir, sourceDir, fileName, reason, logger3) {
   }
 }
 
-// ../canopycms/src/worker/task-queue.ts
+// ../canopycms/src/task-queue/cms-task-queue.ts
 var debugLogger = createDebugLogger({ prefix: "TaskQueue" });
 var cmsTaskQueueLogger = {
   debug(message, data2) {
@@ -48915,7 +48897,7 @@ var RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
 // ../canopycms/src/worker/cms-worker.ts
 init_deployment_name();
 
-// ../canopycms/src/worker/worker-status.ts
+// ../canopycms/src/task-queue/worker-status.ts
 import path4 from "node:path";
 var WORKER_STATUS_FILE = "worker-status.json";
 async function writeWorkerStatus(taskDir, report) {
@@ -49068,15 +49050,12 @@ var BranchRegistry = class {
     return await this.regenerate();
   }
   /**
-   * Returns a single branch by name. Uses cache if available.
+   * Returns a single branch by name, from the cached snapshot when it is fresh.
    *
-   * Suspicious-miss backstop: if `name` isn't in the (possibly cached) list,
-   * that's a signal the snapshot may be stale in the specific direction where
-   * a branch that now exists is missing from it - force one fresh
-   * regeneration and re-search before giving up, throttled per instance so a
-   * genuinely-absent branch costs at most one extra scan per throttle window.
-   * This bounds durable window-E staleness for the "branch exists but
-   * snapshot predates it" direction; see the class doc comment.
+   * Suspicious-miss backstop: a `name` missing from the list is the signal that
+   * the snapshot may predate a branch that now exists, so force one fresh
+   * regeneration and re-search before giving up. Throttled per instance, so a
+   * genuinely-absent branch costs at most one extra scan per window.
    */
   async get(name) {
     const branches = await this.list();
@@ -49093,14 +49072,11 @@ var BranchRegistry = class {
     return true;
   }
   /**
-   * Marks the cache as stale for every process sharing this root by bumping
-   * the cross-process generation marker, then eager-regenerates on this host
-   * (see class doc comment for why). The bump must succeed: a swallowed
-   * failure here would leave the registry stale indefinitely with no
-   * bounding backstop, unlike a failed eager regen below, which only forgoes
-   * closing window (E) early - the bump alone already restored correctness
-   * for every future reader. A failed eager regen therefore must not fail the
-   * caller's save/delete.
+   * Marks the cache stale for every process sharing this root by bumping the
+   * marker, then eager-regenerates on this host. The bump must succeed —
+   * swallowing that failure leaves the registry stale indefinitely with no
+   * backstop. A failed eager regen must NOT fail the caller's save/delete: the
+   * bump alone already restored correctness for every future reader.
    */
   async invalidate() {
     await bumpResourceGeneration(this.root, RESOURCE, { mustSucceed: true });
@@ -49117,9 +49093,8 @@ var BranchRegistry = class {
   /**
    * Scans branch directories and rebuilds the cache, deduping concurrent
    * callers on this instance to a single underlying scan. Never loops waiting
-   * for the snapshot's embedded token to match the marker - under a bump
-   * storm that could livelock; a caller that wants the very latest state
-   * after a concurrent bump should call list() again after this resolves.
+   * for the embedded token to match the marker — that livelocks under a bump
+   * storm; a caller wanting the very latest state calls list() again.
    */
   async regenerate() {
     if (this.regenInFlight) return this.regenInFlight;
@@ -49371,16 +49346,13 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     this.baseRoot = baseRoot;
     this.settleMs = options?.settleMs;
   }
-  /**
-   * Load branch metadata without requiring baseRoot.
-   * Use this for read-only access (e.g., in registry scanning or loadBranchContext).
-   */
+  /** Read-only load, needing no baseRoot: registry scanning, loadBranchContext. */
   static async loadOnly(branchRoot) {
     return readBranchMetadataFile(branchRoot);
   }
   /**
-   * Get a BranchMetadataFileManager instance configured for registry invalidation.
-   * Use this in API handlers to ensure registry cache is invalidated on updates.
+   * An instance wired for registry invalidation. API handlers use this, so the
+   * registry cache is invalidated on update.
    */
   static get(branchRoot, baseRoot, options) {
     return new _BranchMetadataFileManager(branchRoot, baseRoot, options);
@@ -49399,18 +49371,16 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     }
   }
   /**
-   * Write branch.json via the shared OCC helper, with the schemaVersion
-   * default applied here (payload shaping stays branch-metadata's concern).
+   * Write branch.json via the shared OCC helper, applying the schemaVersion
+   * default here since payload shaping is branch-metadata's concern.
    *
-   * Throws the helper's raw {@link OccWriteConflictError} so the surrounding
-   * {@link withOccRetry} in save() recognizes and retries it; translation to
-   * the public `BranchMetadataConflictError` contract happens at the save()
-   * boundary, after retries are exhausted (translating earlier would make
-   * withOccRetry's default predicate miss it, since it only recognizes the
-   * raw error type).
+   * Throws the helper's raw {@link OccWriteConflictError}, which is what the
+   * surrounding {@link withOccRetry} in save() recognizes and retries;
+   * translating to the public `BranchMetadataConflictError` earlier than the
+   * save() boundary would make withOccRetry's predicate miss it.
    *
-   * branch-metadata historically writes WITH a trailing newline, unlike
-   * comment-store; `trailingNewline: true` preserves that.
+   * branch.json is written WITH a trailing newline (`trailingNewline: true`),
+   * unlike comments.json.
    */
   async write(meta, expectedVersion) {
     const payload2 = {
@@ -49424,28 +49394,22 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     });
   }
   /**
-   * Run a save cycle under the full lock + OCC-retry stack described in the
-   * class doc comment. A conflict that survives every retry surfaces as the
-   * public `BranchMetadataConflictError`.
+   * Run a save cycle under the full lock + OCC-retry stack (class doc). A
+   * conflict surviving every retry surfaces as `BranchMetadataConflictError`.
    *
-   * Guards against a phantom-resurrection race with branch deletion: a
-   * caller's branchContext can be resolved BEFORE a concurrent
-   * deleteBranchHandler removes the branch directory, but this save() call
-   * only reaches here (and its own mkdir({recursive:true}) inside write())
-   * AFTER the removal. Without this check, that mkdir would silently
-   * recreate `.canopy-meta/` (and this save would recreate branch.json from
-   * defaults) inside a directory tree that no longer exists anywhere else --
-   * a registry entry with no clone behind it. Checking BEFORE the lock stack
-   * (rather than after) fails fast without paying for a lock acquisition on
-   * a doomed save.
+   * The stat guards a phantom-resurrection race with branch deletion: a
+   * caller's branchContext can resolve BEFORE a concurrent deleteBranchHandler
+   * removes the branch directory, while the save reaches here after it, and
+   * write()'s `mkdir({recursive:true})` would then recreate `.canopy-meta/` and
+   * branch.json from defaults inside a tree nothing else refers to — a registry
+   * entry with no clone behind it. It runs BEFORE the lock stack so a doomed
+   * save fails fast instead of paying for a lock.
    *
-   * Residual window (accepted): a save that passes this check can still
-   * race a `rm` that starts moments later and is still mid-flight when this
-   * save's write lands, resurrecting the tree. Closing that fully would
-   * need a tombstone OUTSIDE the tree being removed -- the lockfile
-   * (`withOccFileLock`) this save takes next lives INSIDE `branchRoot`, so
-   * it cannot itself provide a wider guarantee than "the directory existed
-   * a moment ago."
+   * Accepted residual window: a save that passes the check can still race a
+   * `rm` that starts moments later and is mid-flight when the write lands.
+   * Closing that needs a tombstone OUTSIDE the tree being removed, and the
+   * lockfile taken next lives INSIDE `branchRoot`, so it can promise no more
+   * than "the directory existed a moment ago".
    */
   async save(incoming) {
     try {
@@ -49489,9 +49453,9 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
                 createdAt: existing?.branch.createdAt ?? defaults.createdAt,
                 // Fork point is recorded once at creation; later saves must not move it
                 baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
-                // Always stamped fresh — the spreads above would otherwise let
-                // the existing (creation-time) value win forever, freezing the
-                // timestamp the editor's Branches panel sorts and displays by
+                // Always stamped fresh; the spreads above would otherwise let
+                // the creation-time value win forever, freezing the timestamp
+                // the editor's Branches panel sorts and displays by
                 updatedAt: now
               }
             };
@@ -49511,9 +49475,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     await this.invalidateRegistry();
     return saved;
   }
-  /**
-   * Invalidates the registry cache so next list() call regenerates from branch.json files.
-   */
+  /** Invalidate the registry cache so the next list() regenerates. */
   async invalidateRegistry() {
     const registry2 = new BranchRegistry(this.baseRoot);
     await registry2.invalidate();
@@ -49695,12 +49657,11 @@ function provisioningLockOptions(lockPath, retries, onCompromised) {
     realpath: false,
     retries,
     stale: 3e4,
-    // proper-lockfile invokes this from inside its refresh timer, so ANY throw
-    // escaping here is an uncaught exception that kills the process -- the very
-    // failure the handler exists to prevent. Call sites are told not to throw
-    // (see OnLockCompromised); this makes it structural rather than a
-    // convention, and also covers the LOGGER throwing: under `CI=true`,
-    // vitest's `onConsoleLog` turns any console write into a throw.
+    // proper-lockfile invokes this from inside its refresh timer, so ANY throw escaping here is
+    // an uncaught exception that kills the process. Call sites are told not to throw (see
+    // OnLockCompromised); this makes it structural rather than a convention, and also covers the
+    // LOGGER throwing -- under `CI=true`, vitest's `onConsoleLog` turns a console write into a
+    // throw.
     onCompromised: (err) => {
       try {
         if (onCompromised) {
@@ -50104,11 +50065,9 @@ async function updateBranchMetadata(ctx, task, result) {
     const updates = {
       name: branch,
       syncStatus: "synced",
-      // save()'s merge only overwrites keys present in this update (see
-      // BranchMetadataFileManager.save()'s spread order) -- a prior
-      // syncFailureReason from an earlier failed attempt would otherwise
-      // survive forever past this successful sync. Explicitly clear it,
-      // same pattern as rebaseFailure's PR-W2 M2 clearing elsewhere.
+      // save()'s merge only overwrites keys present in this update, so a prior
+      // syncFailureReason would survive this successful sync forever unless
+      // cleared explicitly (same pattern as rebaseFailure elsewhere).
       syncFailureReason: void 0
     };
     if (result.prUrl) updates.pullRequestUrl = result.prUrl;
@@ -50152,9 +50111,9 @@ async function updateBranchMetadataOnFailure(ctx, task, error2) {
 async function pushBranchToGitHub(ctx, branch) {
   const git = simpleGit({
     baseDir: ctx.remoteGitPath,
-    // DEP-H1: kill the git process if it produces no output for
-    // taskTimeoutMs (network stall, credential prompt) instead of letting
-    // it hang past the task timeout.
+    // DEP-H1: kill the git process if it produces no output for taskTimeoutMs
+    // (network stall, credential prompt) instead of letting it hang past the
+    // task timeout.
     timeout: { block: ctx.taskTimeoutMs }
   });
   git.env(gitNetworkChildEnv());
@@ -50441,10 +50400,10 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
     }
     const branchGit = simpleGit({
       baseDir: branchPath,
-      // Keep git non-interactive during rebase/merge so it never blocks on an editor.
-      // simple-git >=3.32 blocks setting core.editor unless explicitly opted in; the
-      // value here is a hardcoded literal ("true", the shell no-op), not user input,
-      // so enabling allowUnsafeEditor carries no injection risk.
+      // Keep git non-interactive during rebase/merge so it never blocks on an
+      // editor. simple-git >=3.32 requires opting in to set core.editor; the
+      // value is a hardcoded literal ("true", the shell no-op), not user input,
+      // so allowUnsafeEditor carries no injection risk here.
       config: ["core.editor=true"],
       unsafe: { allowUnsafeEditor: true }
     });
@@ -50575,8 +50534,8 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
           name: branchDir,
           conflictStatus: hadConflicts ? "conflicts-detected" : "clean",
           conflictFiles: conflictIdsDeduped,
-          // PR-W2: the cycle completed successfully -- clear any prior
-          // failure record regardless of conflict outcome.
+          // The cycle completed, so clear any prior failure record regardless
+          // of the conflict outcome.
           rebaseFailure: void 0
         }
       });
@@ -50873,18 +50832,14 @@ async function refreshBaseBranchWorkspace(ctx) {
     const baseGit = simpleGit({
       baseDir: basePath37,
       // Keep git non-interactive during the merge so it never blocks on an
-      // editor. simple-git >=3.32 blocks setting core.editor unless
-      // explicitly opted in; the value here is a hardcoded literal
-      // ("true", the shell no-op), not user input, so enabling
-      // allowUnsafeEditor carries no injection risk (same as the rebase
-      // loop's git config below).
+      // editor. simple-git >=3.32 requires opting in to set core.editor; the
+      // value is a hardcoded literal ("true", the shell no-op), not user input,
+      // so allowUnsafeEditor carries no injection risk here.
       config: ["core.editor=true"],
       unsafe: { allowUnsafeEditor: true },
-      // DEP-H1: a hung fetch/merge against this EFS-backed clone would
-      // stall the sync loop forever (scheduleLoop only reschedules after
-      // completion). The block timeout is inactivity-based, so a
-      // slow-but-flowing transfer is unaffected -- same as syncGit()'s
-      // remote handle.
+      // DEP-H1: a hung fetch/merge against this EFS-backed clone would stall
+      // the sync loop forever (scheduleLoop only reschedules after completion).
+      // Inactivity-based, so a slow-but-flowing transfer is unaffected.
       timeout: { block: ctx.taskTimeoutMs }
     });
     const status = await baseGit.status();
@@ -50957,12 +50912,10 @@ var CmsWorker = class {
     this.contentRoot = config.contentRoot ?? "content";
   }
   /**
-   * Lazily get (and initialize if necessary) this worker's self-reported
-   * status object (PR-W1). Normally set once, up front, at the top of
-   * start(). The lazy fallback here covers two cases: (1) something in
-   * start() reaching a status-write point before that normal init runs
-   * (defensive -- see start()'s catch), and (2) unit tests that exercise
-   * syncGit()/processTaskQueue() directly without calling start() first.
+   * This worker's self-reported status object, initialized on first use.
+   * Normally set at the top of start(); the lazy fallback covers something in
+   * start() reaching a status-write point before that (see start()'s catch) and
+   * unit tests driving syncGit()/processTaskQueue() without calling start().
    */
   ensureStatusReport() {
     if (!this.statusReport) {
@@ -50975,28 +50928,23 @@ var CmsWorker = class {
    * Resolve this deployment's settings branch, throwing if the infra-stamped
    * deployment name is not a valid git ref component.
    *
-   * Routed through the shared resolver, not a local `?? 'prod'`: it is the
+   * Routed through the shared resolver, not a local `?? 'prod'`: that is the
    * single definition of the env > config > mode-default precedence the Lambda
-   * already follows, and the only place the resolved value is validated.
-   * Without it the worker could silently own a different settings branch than
-   * the Lambda writing to the same workspace -- and pushSettingsBranches would
-   * then report the real branch as foreign and never push it.
+   * follows, and the only place the resolved value is validated. Without it the
+   * worker can silently own a different settings branch than the Lambda writing
+   * to the same workspace, and pushSettingsBranches then reports the real branch
+   * as foreign and never pushes it.
    *
-   * DEFERRED out of the constructor deliberately, and this is the whole point
-   * of the method existing. Resolving there made the throw land during `new
-   * CmsWorker(...)` (canopycms-cdk/worker/index.ts constructs before it calls
-   * start()), which is BEFORE the only code that writes `lastFatalError` --
-   * start()'s catch. The result was billed as "a loud startup exit" but was
-   * nothing of the kind: with systemd `Type=simple` + `Restart=always` and no
-   * cfn-signal, an invalid deployment name produced an invisible ~5s
-   * crash-loop that `cdk deploy` reported as success while the admin panel
-   * showed the worker as 'absent' with no fatal error to explain it. Resolving
-   * inside start()'s try block instead means the same throw is recorded to
-   * worker-status.json and surfaces in the admin panel.
+   * DEFERRED out of the constructor deliberately, which is the whole point of
+   * the method existing: canopycms-cdk/worker/index.ts constructs the worker
+   * before calling start(), so a throw during `new CmsWorker(...)` lands BEFORE
+   * the only code that writes `lastFatalError` -- start()'s catch. Under
+   * systemd `Type=simple` + `Restart=always` with no cfn-signal, that is an
+   * invisible ~5s crash-loop that `cdk deploy` reports as success while the
+   * admin panel shows the worker 'absent' with no fatal error to explain it.
    *
-   * Lazy rather than start()-only so the value is still available to unit tests
-   * that drive pushSettingsBranches() directly without calling start() -- the
-   * same reason ensureStatusReport() above is shaped this way. Idempotent: the
+   * Lazy rather than start()-only so unit tests driving pushSettingsBranches()
+   * still see the value, exactly as ensureStatusReport() above. Idempotent: the
    * resolver is pure, so a later call returns the identical string.
    */
   ensureSettingsBranch() {
@@ -51009,15 +50957,11 @@ var CmsWorker = class {
    * Build the {@link WorkerContext} handed to the extracted clusters
    * (task-runner.ts, git-sync.ts, rebase.ts, history-rewrite.ts).
    *
-   * Built FRESH on every call rather than once in the constructor, and the
-   * instance-backed members are functions rather than copied values. Both
-   * choices exist for the same reason: the test suite drives this class by
-   * replacing `octokit` and `buildGitHubUrl` ON THE INSTANCE, by setting
-   * `running` directly, and by subclassing to override the two rebase test
-   * hooks. A context that captured any of those at construction time would hand
-   * the extracted code the pre-test value -- which for `buildGitHubUrl` means a
-   * test's push going to github.com for real instead of its local fixture repo.
-   * See WorkerContext's doc comment for the full list.
+   * Built FRESH on every call, with instance-backed members as functions rather
+   * than copied values. See WorkerContext's INVARIANT: a context that captured
+   * any of them at construction time would hand the extracted code the pre-test
+   * value, which for `buildGitHubUrl` means a test's push going to github.com
+   * for real instead of its local fixture repo.
    */
   ctx() {
     return {
@@ -51072,9 +51016,9 @@ var CmsWorker = class {
     } catch (err) {
       const report = this.ensureStatusReport();
       report.lastFatalError = {
-        // [REDACT] Persisted to worker-status.json and served to the
-        // browser by the admin panel -- must never carry the bot token
-        // that a poisoned/failed git URL (buildGitHubUrl()) can embed.
+        // [REDACT] Persisted to worker-status.json and served to the browser by
+        // the admin panel -- must never carry the bot token a poisoned or
+        // failed git URL (buildGitHubUrl()) can embed.
         message: redactCredentials(getErrorMessage2(err)),
         at: (/* @__PURE__ */ new Date()).toISOString(),
         phase: "startup"
@@ -51124,26 +51068,23 @@ var CmsWorker = class {
    * Acquire the cross-host worker lock (DEP-C2).
    *
    * The task queue is single-consumer (see task-queue/task-queue.ts): two
-   * concurrent workers would double-process tasks (duplicate pushes, duplicate
-   * PRs). The workspace lives on a shared filesystem (EFS), so mutual
-   * exclusion must be sound ACROSS HOSTS — a PID liveness probe
-   * (`process.kill(pid, 0)`) only means something on the holder's own machine
-   * and must never participate in staleness decisions.
+   * concurrent workers would double-process tasks, duplicating pushes and PRs.
+   * The workspace lives on EFS, so mutual exclusion must be sound ACROSS HOSTS
+   * — a PID liveness probe (`process.kill(pid, 0)`) means something only on the
+   * holder's own machine and must NEVER participate in staleness decisions.
    *
    * proper-lockfile provides a heartbeat lease with no PID involved: the lock
    * is a directory created atomically (mkdir — atomic on NFS/EFS), the holder
-   * refreshes its mtime every lockStaleMs/2, and the lock is considered
-   * abandoned — and taken over — only when that heartbeat is older than
-   * lockStaleMs. Liveness is judged purely by heartbeat freshness.
+   * refreshes its mtime every lockStaleMs/2, and the lock is abandoned, and
+   * taken over, only once that heartbeat is older than lockStaleMs.
    *
    * No acquire retries: a second worker exits immediately, matching daemon
-   * semantics (the supervisor restarts it later). After a crash, the dead
-   * holder's heartbeat expires within lockStaleMs and the next start succeeds.
+   * semantics. After a crash the dead holder's heartbeat expires within
+   * lockStaleMs and the next start succeeds.
    *
-   * Staleness is judged by comparing the lock's mtime against the local
-   * clock, so correct cross-host takeover assumes reasonable clock agreement
-   * between hosts (e.g. NTP); with the default TTL, ordinary clock skew is
-   * negligible, but a host with a badly wrong clock could misjudge liveness.
+   * Staleness compares the lock's mtime against the LOCAL clock, so correct
+   * cross-host takeover assumes reasonable clock agreement (NTP). Ordinary skew
+   * is negligible at the default TTL; a badly wrong clock misjudges liveness.
    */
   async acquireLock() {
     await fs13.mkdir(this.taskDir, { recursive: true });
@@ -51176,9 +51117,9 @@ var CmsWorker = class {
     }
   }
   /**
-   * Schedule a function to run repeatedly with setTimeout chaining.
-   * The next invocation starts `interval` ms after the previous one completes,
-   * preventing overlapping executions.
+   * Run `fn` repeatedly, the next invocation starting `interval` ms after the
+   * previous one COMPLETES. setTimeout chaining rather than setInterval, so
+   * executions cannot overlap when one runs longer than the interval.
    */
   scheduleLoop(fn, interval) {
     const run = () => {
@@ -51200,18 +51141,16 @@ var CmsWorker = class {
   /**
    * Whether the bare repo at `gitDir` has a local `refs/heads/<baseBranch>`.
    *
-   * Uses an explicit `--git-dir` invocation rather than `simpleGit({ baseDir
-   * })` so this also works in sandboxed/CI git environments that set
-   * `safe.bareRepository=explicit` (which refuses cwd-based discovery of
-   * bare repos but expressly allows `--git-dir` — see
-   * GitManager.bareRemoteHasBranch for the same pattern).
+   * Explicit `--git-dir` rather than `simpleGit({ baseDir })`, so this also
+   * works where `safe.bareRepository=explicit` refuses cwd-based discovery of
+   * bare repos but expressly allows `--git-dir` (same pattern as
+   * GitManager.bareRemoteHasBranch).
    *
-   * Deliberately omits `--quiet`: simple-git only treats a task as failed
-   * when the process both exits non-zero AND writes to stderr
-   * (isTaskError), so a quiet, silent-on-failure `--verify` would leave a
-   * missing branch indistinguishable from success. Without `--quiet`,
-   * `rev-parse --verify` writes its "fatal: ..." to stderr on failure, which
-   * is what makes simple-git reject the promise here.
+   * Deliberately omits `--quiet`: simple-git treats a task as failed only when
+   * the process exits non-zero AND writes to stderr, so a silent-on-failure
+   * `--verify` would leave a missing branch indistinguishable from success.
+   * Without `--quiet`, `rev-parse --verify` writes "fatal: ..." to stderr,
+   * which is what makes simple-git reject the promise here.
    */
   async verifyBaseBranchExists(gitDir) {
     await simpleGit().raw([
@@ -51228,20 +51167,17 @@ var CmsWorker = class {
    *
    * `git clone https://x-access-token:<token>@github.com/...` records that URL
    * verbatim as `remote.origin.url`, and for `remote.git` that config lives on
-   * shared EFS. The security model in docs/deploying-to-aws.md -- "If Lambda is
-   * compromised, an attacker can read/write content on EFS but cannot push to
-   * GitHub", "Secrets stay on the worker" -- is false while that string is
-   * there: a compromised Lambda could read the token off EFS and, despite
-   * having no egress of its own, exfiltrate it by writing it into branch
-   * content the worker then pushes to GitHub.
+   * shared EFS. The security model in docs/deploying-to-aws.md -- a compromised
+   * Lambda can read/write EFS content but cannot push to GitHub, secrets stay
+   * on the worker -- is false while that string is there: the Lambda could read
+   * the token off EFS and, with no egress of its own, exfiltrate it by writing
+   * it into branch content the worker then pushes to GitHub.
    *
    * Nothing needs the remote: every push passes the URL explicitly as an
-   * argument (see the `git.push(this.buildGitHubUrl(), ...)` call sites), and
-   * `verifyBaseBranchExists` reads local refs.
+   * argument, and `verifyBaseBranchExists` reads local refs.
    *
    * VERIFIES rather than assuming: it re-reads the config and throws if the URL
-   * survives, because the previous code's `.catch(() => {})` meant a failed
-   * scrub was indistinguishable from a successful one.
+   * survives, so a failed scrub is never indistinguishable from a clean one.
    */
   async scrubPersistedRemote(gitDir) {
     const git = simpleGit({ baseDir: gitDir });
@@ -51275,19 +51211,17 @@ var CmsWorker = class {
     }
   }
   /**
-   * Ensure remote.git bare repo exists.
-   * On first run, clone from GitHub as a bare repo.
+   * Ensure the remote.git bare repo exists, cloning it from GitHub on first
+   * run.
    *
    * Empty-remote guard: simple-git's bare clone of an EMPTY GitHub repo (no
-   * commits, or a base branch that's never been pushed) exits 0 and produces
-   * a refs-less bare repo — HEAD points at an unborn branch. `fs.stat`
-   * cannot distinguish this from a healthy clone, so left unchecked it
-   * silently poisons remote.git: every later branch operation (Lambda-side
-   * clone provisioning, worker pushes) breaks, and the fs.stat short-circuit
-   * means it never heals on its own. We verify the base branch exists right
-   * after cloning and again on the already-exists fast path, since a
-   * previous run could have left a poisoned remote.git behind before this
-   * guard existed.
+   * commits, or a base branch never pushed) exits 0 and produces a refs-less
+   * bare repo whose HEAD points at an unborn branch. `fs.stat` cannot tell that
+   * from a healthy clone, so left unchecked it silently poisons remote.git —
+   * every later branch operation breaks and the fs.stat short-circuit means it
+   * never heals. The base branch is therefore verified right after cloning AND
+   * on the already-exists fast path, since a previous run can have left a
+   * poisoned remote.git behind.
    */
   async ensureRemoteGit() {
     let exists2;
@@ -51329,24 +51263,18 @@ var CmsWorker = class {
   }
   // --- Task-queue cluster (worker/task-runner.ts) ------------------------
   //
-  // READ THIS BEFORE STUBBING ANY DELEGATOR BELOW. They are not all the same,
-  // and the difference is invisible from here.
+  // READ THIS BEFORE STUBBING ANY DELEGATOR BELOW: they are not all the same,
+  // and the difference is invisible from here. `processTaskQueue` is the public
+  // loop entry `scheduleLoop` drives, so it IS on the production path; the
+  // other three exist ONLY so test files can reach the implementations through
+  // the instance, since the extracted modules call each other at module level.
   //
-  // `processTaskQueue` is the public loop entry `scheduleLoop` drives, so it IS
-  // on the production path. The other three exist ONLY so the existing test
-  // files can reach the implementations through the instance; production never
-  // dispatches through them, because the extracted modules call each other
-  // directly at module level.
-  //
-  // The consequence: replacing one of these on an instance only affects
-  // production behaviour if the context also routes it. Two do --
-  // `executeTask` and `pushBranchToGitHub` are on `WorkerContext` precisely
-  // because cms-worker.test.ts assigns over them and then asserts on the
-  // replacement. `updateBranchMetadata` is NOT: the test calls it directly and
-  // never stubs it, so a stub installed there today would be a silent no-op.
-  // If you need to stub a method that isn't on the context, add it to
-  // WorkerContext and route the internal caller through `ctx` -- do not assume
-  // the delegator's existence means the stub takes effect.
+  // So replacing one of these on an instance affects production behaviour only
+  // if the context also routes it. `executeTask` and `pushBranchToGitHub` are
+  // on `WorkerContext` for exactly that reason; `updateBranchMetadata` is NOT,
+  // so a stub installed there is a silent no-op. To stub a method that is not
+  // on the context, add it to WorkerContext and route the internal caller
+  // through `ctx` -- a delegator's existence does not make a stub take effect.
   async processTaskQueue() {
     return processTaskQueue(this.ctx());
   }
@@ -51364,16 +51292,11 @@ var CmsWorker = class {
    * Octokit client from it.
    *
    * DEFERRED out of the constructor deliberately, exactly as
-   * `ensureSettingsBranch()` is, and for the same reason that method records:
+   * `ensureSettingsBranch()` is and for the reason that method records:
    * `resolveWorkerGitHubAuth` throws for a half-configured credential (both
-   * set, neither set, an unusable mint timeout or refresh interval), and a throw during
-   * `new CmsWorker(...)` lands BEFORE the only code that writes
-   * `lastFatalError` — start()'s catch. The AWS entrypoint constructs the
-   * worker and calls start() separately, and its `main().catch()` only logs
-   * and exits, so a constructor throw is an invisible ~5s systemd crash-loop
-   * that `cdk deploy` reports as success while the admin panel shows the
-   * worker 'absent' with no fatal error to explain it. That is a shipped
-   * regression this codebase has already paid for once (#198).
+   * set, neither set, an unusable mint timeout or refresh interval), and a
+   * throw during `new CmsWorker(...)` lands BEFORE the only code that writes
+   * `lastFatalError` — start()'s catch.
    *
    * Idempotent, and it does NOT replace an `octokit` a test has already
    * assigned onto the instance — see the field's comment.
@@ -51388,34 +51311,29 @@ var CmsWorker = class {
     return this.githubAuth;
   }
   /**
-   * The Octokit client, built on first use.
-   *
-   * Every read goes through here rather than touching the field, because the
-   * field is no longer populated by the constructor: a method reached without
-   * start() would otherwise see `undefined`. `rebaseActiveBranches()` is
-   * exactly that case — apps/test-app's e2e route calls it directly, and its
-   * `pollMergeState` dispatch reads `ctx.octokit()`.
+   * The Octokit client, built on first use. Every read goes through here rather
+   * than touching the field, which the constructor does not populate: a method
+   * reached without start() would otherwise see `undefined`.
+   * `rebaseActiveBranches()` is exactly that case — apps/test-app's e2e route
+   * calls it directly, and its `pollMergeState` dispatch reads `ctx.octokit()`.
    */
   octokitClient() {
     this.ensureGitHubAuth();
     return this.octokit;
   }
   /**
-   * The single seam through which every git-over-HTTPS credential reaches a
-   * git command. The only other consumer of the credential is Octokit, built
-   * from the same resolution by `ensureGitHubAuth()` above.
+   * The single seam through which every git-over-HTTPS credential reaches a git
+   * command. The only other consumer is Octokit, built from the same resolution
+   * by `ensureGitHubAuth()` above.
    *
-   * Async because the credential need not be a value the worker already
-   * holds: under GitHub App auth `resolveGitToken` mints an installation
-   * token, which lasts about an hour. Nothing may cache what this returns —
-   * a URL built from an installation token goes stale with it. Resolving per
-   * use is cheap: `@octokit/auth-app` answers from its own cache until the
-   * token is near expiry, so the usual cost is a resolved microtask, and the
-   * token path is a bare `async` return.
+   * Async because under GitHub App auth `resolveGitToken` mints an installation
+   * token lasting about an hour. NOTHING may cache what this returns — a URL
+   * built from an installation token goes stale with it — and resolving per use
+   * is cheap, since `@octokit/auth-app` answers from its own cache until the
+   * token is near expiry.
    *
    * A mint failure propagates AS THROWN, carrying the `.status` that
-   * `isPermanentTaskFailure` (task-runner.ts:92) classifies on — see
-   * github-auth.ts.
+   * `isPermanentTaskFailure` classifies on — see github-auth.ts.
    *
    * Do NOT add a parallel token accessor alongside it. Every instance-backed
    * WorkerContext member stays a function precisely so tests can replace it
@@ -51429,36 +51347,31 @@ var CmsWorker = class {
   /**
    * Prove the GitHub App credential works before anything depends on it.
    *
-   * Without this the first failure comes out of `ensureRemoteGit`'s bare
-   * clone below, whose catch reads "the GitHub repository may be empty, or
-   * the base branch may not exist" — which would send an operator holding a
-   * bad private key to go looking for a repository problem that does not
-   * exist. Called from start()'s try, so the failure is also recorded as
-   * `lastFatalError` in worker-status.json and reaches the admin panel.
+   * Without this the first failure comes out of `ensureRemoteGit`'s bare clone
+   * below, whose catch blames the repository ("may be empty, or the base branch
+   * may not exist") and sends an operator holding a bad private key looking for
+   * a problem that does not exist. Called from start()'s try, so the failure is
+   * also recorded as `lastFatalError` and reaches the admin panel. No-op on the
+   * token path: a PAT is a literal, so the first real request checks everything
+   * this could.
    *
-   * No-op on the token path: a PAT is a literal, so there is nothing to
-   * check that the first real request would not check anyway.
-   *
-   * FATAL UNLESS THE FAILURE POSITIVELY LOOKS TRANSIENT. Both halves of that
-   * are load-bearing.
-   *
-   * Not always fatal, because the two credential paths must degrade alike: on
-   * the token path a GitHub 502 during boot is absorbed (a warm `remote.git`
-   * short-circuits `ensureRemoteGit`, and `Promise.allSettled` swallows the
-   * initial `syncGit`), so the worker starts and its loops retry. Rethrowing
-   * every error class would make the App path exit instead, and systemd
-   * (Restart=always) would crash-loop it until GitHub recovered — each
-   * iteration telling the operator to go and check their private key.
+   * FATAL UNLESS THE FAILURE POSITIVELY LOOKS TRANSIENT. Both halves are
+   * load-bearing. Not always fatal, because the two credential paths must
+   * degrade alike: on the token path a GitHub 502 during boot is absorbed (a
+   * warm `remote.git` short-circuits `ensureRemoteGit`, `Promise.allSettled`
+   * swallows the initial `syncGit`) so the worker starts and its loops retry,
+   * while rethrowing every error class would make the App path exit and systemd
+   * crash-loop it until GitHub recovered — each iteration telling the operator
+   * to check their private key.
    *
    * But fail CLOSED, via `isTransientAuthFailure` rather than the inverse of
-   * `isPermanentTaskFailure`. That classifier defaults an error with no HTTP
-   * status to transient, which is right on the task path (bounded by
-   * `maxRetries`) and wrong here (bounded by nothing): a key that never
-   * reaches GitHub at all — the wrong key type, or one too mangled to sign
-   * with — fails locally and status-lessly, so "default to transient" would
-   * boot a worker with a dead credential, record no `lastFatalError`, and show
-   * healthy in the admin panel while every task and every sync failed. See
-   * isTransientAuthFailure in github-auth.ts.
+   * `isPermanentTaskFailure`: that classifier defaults a status-less error to
+   * transient, which is right on the task path (bounded by `maxRetries`) and
+   * wrong here (bounded by nothing). A key that never reaches GitHub at all —
+   * the wrong type, or too mangled to sign with — fails locally and
+   * status-lessly, so defaulting to transient would boot a worker with a dead
+   * credential, record no `lastFatalError`, and show healthy in the admin panel
+   * while every task and every sync failed.
    */
   async preflightGitHubAppAuth() {
     if (!this.config.githubAppAuth) return;
@@ -51479,20 +51392,19 @@ var CmsWorker = class {
     workerLog("GitHub App authentication verified");
   }
   /**
-   * The workspace directory for a branch named by its GIT REF name -- the
-   * form task payloads carry (`context.branch.name`), not the directory form.
+   * The workspace directory for a branch named by its GIT REF name -- the form
+   * task payloads carry (`context.branch.name`), not the directory form.
    *
    * These differ for any name outside `[A-Za-z0-9._-]`, `/` being the obvious
    * one: workspaces are provisioned under `sanitizeBranchName(...)` (see
    * paths/branch.ts's `resolveBranchPaths`), so `feature/x` lives in
-   * `feature-x`. Joining the raw name instead silently addresses a directory
-   * that does not exist -- which for the metadata writers below meant the
-   * update was quietly dropped, and for the leased push meant the
-   * history-rewrite marker read as absent and the push went out unleased,
-   * wedging exactly the branch this workstream exists to unwedge.
+   * `feature-x`. Joining the RAW name instead silently addresses a directory
+   * that does not exist -- which drops the metadata writers' updates, and makes
+   * the leased push read the history-rewrite marker as absent and go out
+   * unleased, wedging the branch.
    *
-   * `name` inside the metadata itself stays the raw ref name; only the path
-   * is sanitized.
+   * `name` inside the metadata itself stays the raw ref name; only the path is
+   * sanitized.
    */
   branchWorkspacePath(branchRefName) {
     return path17.join(this.contentBranchesPath, sanitizeBranchName(branchRefName));
@@ -51503,32 +51415,28 @@ var CmsWorker = class {
    * `checkout --theirs` resolution loop overwrites them. No-op in production.
    *
    * A test subclass overrides this to land a real `ContentStore` write at
-   * exactly the instant the rebase is mid-flight -- the window the old TOCTOU
-   * comment above the dirty check wrongly called safe -- without any sleeps or
-   * shell rendezvous. See the "Deterministic interleavings" testing pattern in
+   * exactly the instant the rebase is mid-flight, with no sleeps or shell
+   * rendezvous. See the "Deterministic interleavings" pattern in
    * docs/concurrency.md, and `ContentStore.afterPrePassForTesting()` for the
    * same idiom on the write side.
    */
   async afterConflictDetectedForTesting() {
   }
   /**
-   * Test seam, sibling of {@link afterConflictDetectedForTesting}: runs at the
+   * Test seam, sibling of {@link afterConflictDetectedForTesting}: runs the
    * instant a rebase round has succeeded, before the completion path (cache
-   * invalidation, conflict metadata, [SYNC-H1] marker) executes. Exists so a
-   * test can lose the content-write lock at exactly the point where bailing out
-   * would strand a rewritten history.
+   * invalidation, conflict metadata, [SYNC-H1] marker) executes, so a test can
+   * lose the content-write lock at exactly the point where bailing out would
+   * strand a rewritten history.
    */
   async afterRebaseCompletedForTesting() {
   }
   // --- Rebase loop (worker/rebase.ts) ------------------------------------
   //
   // Both are TEST-ONLY entry points -- see the task-queue block above. Nothing
-  // in production dispatches through either; `syncGit` calls `runRebaseCycle`
-  // directly and that calls `pollMergeState` directly. Four test files call
-  // `rebaseActiveBranches` (it is the single entry point the whole rebase suite
-  // drives), and cms-worker-merge-poll.test.ts calls `pollMergeState` with a
-  // mocked `octokit`. Neither is on WorkerContext, so a stub installed on
-  // either is a no-op as far as a production code path is concerned.
+  // in production dispatches through either: `syncGit` calls `runRebaseCycle`
+  // directly and that calls `pollMergeState` directly. Neither is on
+  // WorkerContext, so a stub installed on either is a no-op for production.
   //
   // `rebaseActiveBranches` also has a consumer outside the test files:
   // apps/test-app/app/api/e2e-test/rebase/route.ts drives it from an e2e
@@ -51540,14 +51448,11 @@ var CmsWorker = class {
   //
   // `syncGit` is the public loop entry `scheduleLoop` drives. The three private
   // ones below it are TEST-ONLY entry points -- see the task-queue block above
-  // -- each called directly by one test file (cms-worker-sync-reconcile for the
-  // settings push, cms-worker-base-refresh for the base workspace,
-  // cms-worker.test.ts for the trash sweep). `syncGit` reaches all three as
+  // -- each called directly by one test file. `syncGit` reaches all three as
   // module-level calls, so a stub installed on one of these is a no-op.
   //
   // `reconcileTrackedBranches` deliberately has NO delegator: no test reaches
-  // it through the instance. Comments elsewhere that point at it as living in
-  // this file are stale by definition -- it is in git-sync.ts.
+  // it through the instance.
   async syncGit() {
     return syncGit(this.ctx());
   }
@@ -51556,10 +51461,10 @@ var CmsWorker = class {
    *
    * One of `refreshGitHubCredential`'s two call sites, and the one that works
    * when nobody is publishing: it fetches from GitHub every `gitSyncInterval`
-   * (default 5 minutes) whether or not anyone is editing, so a credential that
-   * has stopped working surfaces here even with no push queued for days.
+   * whether or not anyone is editing, so a credential that has stopped working
+   * surfaces here even with no push queued for days.
    *
-   * The sync failure is what propagates to `scheduleLoop`'s catch.
+   * The SYNC failure is what propagates to `scheduleLoop`'s catch;
    * `refreshGitHubCredential` never throws, so nothing it does can replace it.
    */
   async syncGitWithCredentialRefresh() {
@@ -51576,42 +51481,29 @@ var CmsWorker = class {
    * **Two call sites, each covering what the other cannot.** The git-sync loop
    * (`syncGitWithCredentialRefresh`) notices a dead credential when nobody is
    * publishing. `processTaskQueue`'s per-task catch is what saves a publish: a
-   * push task spends its retry budget on a 5s/10s/20s backoff
-   * (task-queue/task-queue.ts), well inside one 5-minute sync interval, so with
-   * the sync loop as the only trigger a publish that met a rotated token failed
-   * permanently while the working one was already in the secret store.
-   *
-   * Every consumer reaches the credential through `ensureGitHubAuth()`, which
-   * reads it per use — the sync fetch, `pushBranchToGitHub`,
-   * `pushSettingsBranches`, `ensureRemoteGit`'s clone, and every Octokit call —
-   * so a refresh from either site repairs all of them for their NEXT use, with
-   * nothing to invalidate. It cannot rescue an attempt that has already failed,
-   * so a task `isPermanentTaskFailure` fails fast is not saved; the task after
-   * it is.
-   *
-   * NOT gated on the error looking auth-shaped, at either site. There is nothing
-   * to classify on: a `git fetch` or `git push` rejected for a dead token throws
-   * a plain simple-git error — exit 128, no HTTP `.status` — which
-   * `isPermanentTaskFailure` reads as transient, so a gate keyed on it would
-   * never fire. Two floors bound the cost instead: core's own
-   * `refreshGitHubTokenMinIntervalMs` (default 60s, enforced by
-   * `refreshCredential` in github-auth.ts), and whatever floor the provider
-   * keeps — the AWS one reads at most once per five minutes and returns
-   * `undefined` for an unchanged value (canopycms-cdk/worker/credential-refresh.ts).
-   * On the GitHub App path the refresh is a no-op. Both call sites share both
-   * floors, so a read issued by one throttles the other.
+   * push task spends its retry budget on a 5s/10s/20s backoff, well inside one
+   * 5-minute sync interval, so with the sync loop as the only trigger a publish
+   * meeting a rotated token fails permanently while the working one is already
+   * in the secret store. Every consumer reaches the credential through
+   * `ensureGitHubAuth()`, which reads it per use, so a refresh from either site
+   * repairs all of them for their NEXT use — but not an attempt already failed.
    *
-   * **Never throws.** Both callers are already reporting a failure, and that
-   * failure is the one that must reach the log.
+   * NOT gated on the error looking auth-shaped, at either site: a `git
+   * fetch`/`push` rejected for a dead token throws a plain simple-git error
+   * (exit 128, no HTTP `.status`) that `isPermanentTaskFailure` reads as
+   * transient, so a gate keyed on it would never fire. Two floors bound the
+   * cost instead — core's `refreshGitHubTokenMinIntervalMs` (default 60s,
+   * enforced by `refreshCredential` in github-auth.ts) and whatever floor the
+   * provider keeps (the AWS one reads at most once per five minutes) — and both
+   * call sites share both, so a read issued by one throttles the other. On the
+   * GitHub App path the refresh is a no-op.
    *
-   * **Bounded by `taskTimeoutMs`**, because the task loop awaits it, and a read
-   * that never settled would stop every publish queued behind it. An adopter's
-   * provider may have no bound at all, and the AWS one, bounded as it is
-   * (canopycms-cdk/worker/secrets.ts), can still take up to 87s for one
-   * `getSecret` — longer than the 60s default here. A read that loses the race
-   * is not cancelled, and
-   * may still land later; `refreshCredential` discards a result older than one
-   * it has already applied, so a late landing cannot put a stale token back.
+   * **Never throws**: both callers are already reporting the failure that must
+   * reach the log. **Bounded by `taskTimeoutMs`**, because the task loop awaits
+   * it and a read that never settled would stop every publish queued behind it
+   * (an adopter's provider may have no bound at all; the AWS one can take 87s
+   * for one `getSecret`). A losing read is not cancelled and may land later, but
+   * `refreshCredential` discards a result older than one already applied.
    */
   async refreshGitHubCredential() {
     let timer;
@@ -61321,12 +61213,9 @@ async function main() {
   const githubAppAuth = githubAppId && githubAppInstallationId && githubAppPrivateKeySecretArn ? buildGitHubAppAuth({
     appId: githubAppId,
     installationId: githubAppInstallationId,
-    // An App private key is the credential most likely to live inside a
-    // JSON document rather than alone in a secret -- which is why the
-    // JSON-field option exists at all. Same `|| undefined` as the other
-    // two `getSecret` call sites in this file (the GitHub token above and
-    // the Clerk key below), and for the same reason: a blank var means
-    // "not configured", not "read the field named ''".
+    // Same `|| undefined` as the other two `getSecret` call sites in this
+    // file, for the same reason: a blank var means "not configured", not
+    // "read the field named ''".
     privateKey: await getSecret(githubAppPrivateKeySecretArn, {
       jsonField: process.env.CANOPYCMS_GITHUB_APP_PRIVATE_KEY_SECRET_JSON_FIELD || void 0,
       jsonFieldEnvVar: "CANOPYCMS_GITHUB_APP_PRIVATE_KEY_SECRET_JSON_FIELD"
@@ -61363,12 +61252,10 @@ async function main() {
     refreshAuthCache,
     baseBranch: process.env.CANOPYCMS_BASE_BRANCH ?? "main",
     // deploymentName is deliberately NOT passed: CmsWorker resolves it through
-    // resolveDeploymentName, which reads CANOPYCMS_DEPLOYMENT_NAME itself
-    // (CanopyCmsService stamps that env var from
-    // CanopyCmsServiceProps.deploymentName), applies the same env > config >
-    // 'prod' precedence as the Lambda, and validates the result as a git ref
-    // component. Reading the env var here instead would re-implement the
-    // outer half of that chain and skip the validation.
+    // resolveDeploymentName, which reads CANOPYCMS_DEPLOYMENT_NAME itself,
+    // applies the same env > config > 'prod' precedence as the Lambda, and
+    // validates the result as a git ref component. Reading the env var here
+    // would re-implement the outer half of that chain and skip the validation.
     // Explicit override, matching the strategy's own precedence: an adopter who
     // sets `settingsBranch` in canopycms.config.ts must set this too, or the
     // worker would own a branch name the Lambda never writes to.