canopycms-cdk 0.0.67 → 0.0.68-int.94

package/worker/dist/index.js

@@ -624,7 +624,7 @@ var require_node = __commonJS({
     var tty = __require("tty");
     var util2 = __require("util");
     exports.init = init;
-    exports.log = log7;
+    exports.log = log8;
     exports.formatArgs = formatArgs;
     exports.save = save;
     exports.load = load;
@@ -759,7 +759,7 @@ var require_node = __commonJS({
       }
       return (/* @__PURE__ */ new Date()).toISOString() + " ";
     }
-    function log7(...args) {
+    function log8(...args) {
       return process.stderr.write(util2.formatWithOptions(exports.inspectOpts, ...args) + "\n");
     }
     function save(namespaces) {
@@ -813,32 +813,32 @@ var require_src2 = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     var fs_1 = __require("fs");
     var debug_1 = __importDefault2(require_src());
-    var log7 = debug_1.default("@kwsites/file-exists");
-    function check(path20, isFile, isDirectory) {
-      log7(`checking %s`, path20);
+    var log8 = debug_1.default("@kwsites/file-exists");
+    function check(path22, isFile, isDirectory) {
+      log8(`checking %s`, path22);
       try {
-        const stat = fs_1.statSync(path20);
+        const stat = fs_1.statSync(path22);
         if (stat.isFile() && isFile) {
-          log7(`[OK] path represents a file`);
+          log8(`[OK] path represents a file`);
           return true;
         }
         if (stat.isDirectory() && isDirectory) {
-          log7(`[OK] path represents a directory`);
+          log8(`[OK] path represents a directory`);
           return true;
         }
-        log7(`[FAIL] path represents something other than a file or directory`);
+        log8(`[FAIL] path represents something other than a file or directory`);
         return false;
       } catch (e5) {
         if (e5.code === "ENOENT") {
-          log7(`[FAIL] path is not accessible: %o`, e5);
+          log8(`[FAIL] path is not accessible: %o`, e5);
           return false;
         }
-        log7(`[FATAL] %o`, e5);
+        log8(`[FATAL] %o`, e5);
         throw e5;
       }
     }
-    function exists2(path20, type = exports.READABLE) {
-      return check(path20, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
+    function exists2(path22, type = exports.READABLE) {
+      return check(path22, (type & exports.FILE) > 0, (type & exports.FOLDER) > 0);
     }
     exports.exists = exists2;
     exports.FILE = 1;
@@ -927,54 +927,54 @@ var require_polyfills = __commonJS({
     }
     var chdir;
     module.exports = patch;
-    function patch(fs15) {
+    function patch(fs18) {
       if (constants2.hasOwnProperty("O_SYMLINK") && process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)) {
-        patchLchmod(fs15);
-      }
-      if (!fs15.lutimes) {
-        patchLutimes(fs15);
-      }
-      fs15.chown = chownFix(fs15.chown);
-      fs15.fchown = chownFix(fs15.fchown);
-      fs15.lchown = chownFix(fs15.lchown);
-      fs15.chmod = chmodFix(fs15.chmod);
-      fs15.fchmod = chmodFix(fs15.fchmod);
-      fs15.lchmod = chmodFix(fs15.lchmod);
-      fs15.chownSync = chownFixSync(fs15.chownSync);
-      fs15.fchownSync = chownFixSync(fs15.fchownSync);
-      fs15.lchownSync = chownFixSync(fs15.lchownSync);
-      fs15.chmodSync = chmodFixSync(fs15.chmodSync);
-      fs15.fchmodSync = chmodFixSync(fs15.fchmodSync);
-      fs15.lchmodSync = chmodFixSync(fs15.lchmodSync);
-      fs15.stat = statFix(fs15.stat);
-      fs15.fstat = statFix(fs15.fstat);
-      fs15.lstat = statFix(fs15.lstat);
-      fs15.statSync = statFixSync(fs15.statSync);
-      fs15.fstatSync = statFixSync(fs15.fstatSync);
-      fs15.lstatSync = statFixSync(fs15.lstatSync);
-      if (fs15.chmod && !fs15.lchmod) {
-        fs15.lchmod = function(path20, mode, cb) {
+        patchLchmod(fs18);
+      }
+      if (!fs18.lutimes) {
+        patchLutimes(fs18);
+      }
+      fs18.chown = chownFix(fs18.chown);
+      fs18.fchown = chownFix(fs18.fchown);
+      fs18.lchown = chownFix(fs18.lchown);
+      fs18.chmod = chmodFix(fs18.chmod);
+      fs18.fchmod = chmodFix(fs18.fchmod);
+      fs18.lchmod = chmodFix(fs18.lchmod);
+      fs18.chownSync = chownFixSync(fs18.chownSync);
+      fs18.fchownSync = chownFixSync(fs18.fchownSync);
+      fs18.lchownSync = chownFixSync(fs18.lchownSync);
+      fs18.chmodSync = chmodFixSync(fs18.chmodSync);
+      fs18.fchmodSync = chmodFixSync(fs18.fchmodSync);
+      fs18.lchmodSync = chmodFixSync(fs18.lchmodSync);
+      fs18.stat = statFix(fs18.stat);
+      fs18.fstat = statFix(fs18.fstat);
+      fs18.lstat = statFix(fs18.lstat);
+      fs18.statSync = statFixSync(fs18.statSync);
+      fs18.fstatSync = statFixSync(fs18.fstatSync);
+      fs18.lstatSync = statFixSync(fs18.lstatSync);
+      if (fs18.chmod && !fs18.lchmod) {
+        fs18.lchmod = function(path22, mode, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs15.lchmodSync = function() {
+        fs18.lchmodSync = function() {
         };
       }
-      if (fs15.chown && !fs15.lchown) {
-        fs15.lchown = function(path20, uid, gid, cb) {
+      if (fs18.chown && !fs18.lchown) {
+        fs18.lchown = function(path22, uid, gid, cb) {
           if (cb) process.nextTick(cb);
         };
-        fs15.lchownSync = function() {
+        fs18.lchownSync = function() {
         };
       }
       if (platform === "win32") {
-        fs15.rename = typeof fs15.rename !== "function" ? fs15.rename : (function(fs$rename) {
+        fs18.rename = typeof fs18.rename !== "function" ? fs18.rename : (function(fs$rename) {
           function rename(from, to, cb) {
             var start = Date.now();
             var backoff = 0;
             fs$rename(from, to, function CB(er) {
               if (er && (er.code === "EACCES" || er.code === "EPERM" || er.code === "EBUSY") && Date.now() - start < 6e4) {
                 setTimeout(function() {
-                  fs15.stat(to, function(stater, st) {
+                  fs18.stat(to, function(stater, st) {
                     if (stater && stater.code === "ENOENT")
                       fs$rename(from, to, CB);
                     else
@@ -990,9 +990,9 @@ var require_polyfills = __commonJS({
           }
           if (Object.setPrototypeOf) Object.setPrototypeOf(rename, fs$rename);
           return rename;
-        })(fs15.rename);
+        })(fs18.rename);
       }
-      fs15.read = typeof fs15.read !== "function" ? fs15.read : (function(fs$read) {
+      fs18.read = typeof fs18.read !== "function" ? fs18.read : (function(fs$read) {
         function read(fd, buffer, offset, length, position, callback_) {
           var callback;
           if (callback_ && typeof callback_ === "function") {
@@ -1000,22 +1000,22 @@ var require_polyfills = __commonJS({
             callback = function(er, _3, __) {
               if (er && er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
-                return fs$read.call(fs15, fd, buffer, offset, length, position, callback);
+                return fs$read.call(fs18, fd, buffer, offset, length, position, callback);
               }
               callback_.apply(this, arguments);
             };
           }
-          return fs$read.call(fs15, fd, buffer, offset, length, position, callback);
+          return fs$read.call(fs18, fd, buffer, offset, length, position, callback);
         }
         if (Object.setPrototypeOf) Object.setPrototypeOf(read, fs$read);
         return read;
-      })(fs15.read);
-      fs15.readSync = typeof fs15.readSync !== "function" ? fs15.readSync : /* @__PURE__ */ (function(fs$readSync) {
+      })(fs18.read);
+      fs18.readSync = typeof fs18.readSync !== "function" ? fs18.readSync : /* @__PURE__ */ (function(fs$readSync) {
         return function(fd, buffer, offset, length, position) {
           var eagCounter = 0;
           while (true) {
             try {
-              return fs$readSync.call(fs15, fd, buffer, offset, length, position);
+              return fs$readSync.call(fs18, fd, buffer, offset, length, position);
             } catch (er) {
               if (er.code === "EAGAIN" && eagCounter < 10) {
                 eagCounter++;
@@ -1025,11 +1025,11 @@ var require_polyfills = __commonJS({
             }
           }
         };
-      })(fs15.readSync);
-      function patchLchmod(fs16) {
-        fs16.lchmod = function(path20, mode, callback) {
-          fs16.open(
-            path20,
+      })(fs18.readSync);
+      function patchLchmod(fs19) {
+        fs19.lchmod = function(path22, mode, callback) {
+          fs19.open(
+            path22,
             constants2.O_WRONLY | constants2.O_SYMLINK,
             mode,
             function(err, fd) {
@@ -1037,80 +1037,80 @@ var require_polyfills = __commonJS({
                 if (callback) callback(err);
                 return;
               }
-              fs16.fchmod(fd, mode, function(err2) {
-                fs16.close(fd, function(err22) {
+              fs19.fchmod(fd, mode, function(err2) {
+                fs19.close(fd, function(err22) {
                   if (callback) callback(err2 || err22);
                 });
               });
             }
           );
         };
-        fs16.lchmodSync = function(path20, mode) {
-          var fd = fs16.openSync(path20, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
+        fs19.lchmodSync = function(path22, mode) {
+          var fd = fs19.openSync(path22, constants2.O_WRONLY | constants2.O_SYMLINK, mode);
           var threw = true;
           var ret;
           try {
-            ret = fs16.fchmodSync(fd, mode);
+            ret = fs19.fchmodSync(fd, mode);
             threw = false;
           } finally {
             if (threw) {
               try {
-                fs16.closeSync(fd);
+                fs19.closeSync(fd);
               } catch (er) {
               }
             } else {
-              fs16.closeSync(fd);
+              fs19.closeSync(fd);
             }
           }
           return ret;
         };
       }
-      function patchLutimes(fs16) {
-        if (constants2.hasOwnProperty("O_SYMLINK") && fs16.futimes) {
-          fs16.lutimes = function(path20, at, mt, cb) {
-            fs16.open(path20, constants2.O_SYMLINK, function(er, fd) {
+      function patchLutimes(fs19) {
+        if (constants2.hasOwnProperty("O_SYMLINK") && fs19.futimes) {
+          fs19.lutimes = function(path22, at, mt, cb) {
+            fs19.open(path22, constants2.O_SYMLINK, function(er, fd) {
               if (er) {
                 if (cb) cb(er);
                 return;
               }
-              fs16.futimes(fd, at, mt, function(er2) {
-                fs16.close(fd, function(er22) {
+              fs19.futimes(fd, at, mt, function(er2) {
+                fs19.close(fd, function(er22) {
                   if (cb) cb(er2 || er22);
                 });
               });
             });
           };
-          fs16.lutimesSync = function(path20, at, mt) {
-            var fd = fs16.openSync(path20, constants2.O_SYMLINK);
+          fs19.lutimesSync = function(path22, at, mt) {
+            var fd = fs19.openSync(path22, constants2.O_SYMLINK);
             var ret;
             var threw = true;
             try {
-              ret = fs16.futimesSync(fd, at, mt);
+              ret = fs19.futimesSync(fd, at, mt);
               threw = false;
             } finally {
               if (threw) {
                 try {
-                  fs16.closeSync(fd);
+                  fs19.closeSync(fd);
                 } catch (er) {
                 }
               } else {
-                fs16.closeSync(fd);
+                fs19.closeSync(fd);
               }
             }
             return ret;
           };
-        } else if (fs16.futimes) {
-          fs16.lutimes = function(_a3, _b, _c5, cb) {
+        } else if (fs19.futimes) {
+          fs19.lutimes = function(_a3, _b, _c5, cb) {
             if (cb) process.nextTick(cb);
           };
-          fs16.lutimesSync = function() {
+          fs19.lutimesSync = function() {
           };
         }
       }
       function chmodFix(orig) {
         if (!orig) return orig;
         return function(target, mode, cb) {
-          return orig.call(fs15, target, mode, function(er) {
+          return orig.call(fs18, target, mode, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -1120,7 +1120,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, mode) {
           try {
-            return orig.call(fs15, target, mode);
+            return orig.call(fs18, target, mode);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -1129,7 +1129,7 @@ var require_polyfills = __commonJS({
       function chownFix(orig) {
         if (!orig) return orig;
         return function(target, uid, gid, cb) {
-          return orig.call(fs15, target, uid, gid, function(er) {
+          return orig.call(fs18, target, uid, gid, function(er) {
             if (chownErOk(er)) er = null;
             if (cb) cb.apply(this, arguments);
           });
@@ -1139,7 +1139,7 @@ var require_polyfills = __commonJS({
         if (!orig) return orig;
         return function(target, uid, gid) {
           try {
-            return orig.call(fs15, target, uid, gid);
+            return orig.call(fs18, target, uid, gid);
           } catch (er) {
             if (!chownErOk(er)) throw er;
           }
@@ -1159,13 +1159,13 @@ var require_polyfills = __commonJS({
             }
             if (cb) cb.apply(this, arguments);
           }
-          return options ? orig.call(fs15, target, options, callback) : orig.call(fs15, target, callback);
+          return options ? orig.call(fs18, target, options, callback) : orig.call(fs18, target, callback);
         };
       }
       function statFixSync(orig) {
         if (!orig) return orig;
         return function(target, options) {
-          var stats = options ? orig.call(fs15, target, options) : orig.call(fs15, target);
+          var stats = options ? orig.call(fs18, target, options) : orig.call(fs18, target);
           if (stats) {
             if (stats.uid < 0) stats.uid += 4294967296;
             if (stats.gid < 0) stats.gid += 4294967296;
@@ -1194,16 +1194,16 @@ var require_legacy_streams = __commonJS({
   "../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/legacy-streams.js"(exports, module) {
     var Stream = __require("stream").Stream;
     module.exports = legacy;
-    function legacy(fs15) {
+    function legacy(fs18) {
       return {
         ReadStream,
         WriteStream
       };
-      function ReadStream(path20, options) {
-        if (!(this instanceof ReadStream)) return new ReadStream(path20, options);
+      function ReadStream(path22, options) {
+        if (!(this instanceof ReadStream)) return new ReadStream(path22, options);
         Stream.call(this);
         var self2 = this;
-        this.path = path20;
+        this.path = path22;
         this.fd = null;
         this.readable = true;
         this.paused = false;
@@ -1237,7 +1237,7 @@ var require_legacy_streams = __commonJS({
           });
           return;
         }
-        fs15.open(this.path, this.flags, this.mode, function(err, fd) {
+        fs18.open(this.path, this.flags, this.mode, function(err, fd) {
           if (err) {
             self2.emit("error", err);
             self2.readable = false;
@@ -1248,10 +1248,10 @@ var require_legacy_streams = __commonJS({
           self2._read();
         });
       }
-      function WriteStream(path20, options) {
-        if (!(this instanceof WriteStream)) return new WriteStream(path20, options);
+      function WriteStream(path22, options) {
+        if (!(this instanceof WriteStream)) return new WriteStream(path22, options);
         Stream.call(this);
-        this.path = path20;
+        this.path = path22;
         this.fd = null;
         this.writable = true;
         this.flags = "w";
@@ -1276,7 +1276,7 @@ var require_legacy_streams = __commonJS({
         this.busy = false;
         this._queue = [];
         if (this.fd === null) {
-          this._open = fs15.open;
+          this._open = fs18.open;
           this._queue.push([this._open, this.path, this.flags, this.mode, void 0]);
           this.flush();
         }
@@ -1311,7 +1311,7 @@ var require_clone = __commonJS({
 // ../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js
 var require_graceful_fs = __commonJS({
   "../../node_modules/.pnpm/graceful-fs@4.2.11/node_modules/graceful-fs/graceful-fs.js"(exports, module) {
-    var fs15 = __require("fs");
+    var fs18 = __require("fs");
     var polyfills = require_polyfills();
     var legacy = require_legacy_streams();
     var clone = require_clone();
@@ -1343,12 +1343,12 @@ var require_graceful_fs = __commonJS({
         m5 = "GFS4: " + m5.split(/\n/).join("\nGFS4: ");
         console.error(m5);
       };
-    if (!fs15[gracefulQueue]) {
+    if (!fs18[gracefulQueue]) {
       queue = global[gracefulQueue] || [];
-      publishQueue(fs15, queue);
-      fs15.close = (function(fs$close) {
+      publishQueue(fs18, queue);
+      fs18.close = (function(fs$close) {
         function close(fd, cb) {
-          return fs$close.call(fs15, fd, function(err) {
+          return fs$close.call(fs18, fd, function(err) {
             if (!err) {
               resetQueue();
             }
@@ -1360,48 +1360,48 @@ var require_graceful_fs = __commonJS({
           value: fs$close
         });
         return close;
-      })(fs15.close);
-      fs15.closeSync = (function(fs$closeSync) {
+      })(fs18.close);
+      fs18.closeSync = (function(fs$closeSync) {
         function closeSync(fd) {
-          fs$closeSync.apply(fs15, arguments);
+          fs$closeSync.apply(fs18, arguments);
           resetQueue();
         }
         Object.defineProperty(closeSync, previousSymbol, {
           value: fs$closeSync
         });
         return closeSync;
-      })(fs15.closeSync);
+      })(fs18.closeSync);
       if (/\bgfs4\b/i.test(process.env.NODE_DEBUG || "")) {
         process.on("exit", function() {
-          debug2(fs15[gracefulQueue]);
-          __require("assert").equal(fs15[gracefulQueue].length, 0);
+          debug2(fs18[gracefulQueue]);
+          __require("assert").equal(fs18[gracefulQueue].length, 0);
         });
       }
     }
     var queue;
     if (!global[gracefulQueue]) {
-      publishQueue(global, fs15[gracefulQueue]);
-    }
-    module.exports = patch(clone(fs15));
-    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs15.__patched) {
-      module.exports = patch(fs15);
-      fs15.__patched = true;
-    }
-    function patch(fs16) {
-      polyfills(fs16);
-      fs16.gracefulify = patch;
-      fs16.createReadStream = createReadStream;
-      fs16.createWriteStream = createWriteStream;
-      var fs$readFile = fs16.readFile;
-      fs16.readFile = readFile;
-      function readFile(path20, options, cb) {
+      publishQueue(global, fs18[gracefulQueue]);
+    }
+    module.exports = patch(clone(fs18));
+    if (process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH && !fs18.__patched) {
+      module.exports = patch(fs18);
+      fs18.__patched = true;
+    }
+    function patch(fs19) {
+      polyfills(fs19);
+      fs19.gracefulify = patch;
+      fs19.createReadStream = createReadStream;
+      fs19.createWriteStream = createWriteStream;
+      var fs$readFile = fs19.readFile;
+      fs19.readFile = readFile;
+      function readFile(path22, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$readFile(path20, options, cb);
-        function go$readFile(path21, options2, cb2, startTime) {
-          return fs$readFile(path21, options2, function(err) {
+        return go$readFile(path22, options, cb);
+        function go$readFile(path23, options2, cb2, startTime) {
+          return fs$readFile(path23, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$readFile, [path21, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$readFile, [path23, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1409,16 +1409,16 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$writeFile = fs16.writeFile;
-      fs16.writeFile = writeFile;
-      function writeFile(path20, data2, options, cb) {
+      var fs$writeFile = fs19.writeFile;
+      fs19.writeFile = writeFile;
+      function writeFile(path22, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$writeFile(path20, data2, options, cb);
-        function go$writeFile(path21, data3, options2, cb2, startTime) {
-          return fs$writeFile(path21, data3, options2, function(err) {
+        return go$writeFile(path22, data2, options, cb);
+        function go$writeFile(path23, data3, options2, cb2, startTime) {
+          return fs$writeFile(path23, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$writeFile, [path21, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$writeFile, [path23, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1426,17 +1426,17 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$appendFile = fs16.appendFile;
+      var fs$appendFile = fs19.appendFile;
       if (fs$appendFile)
-        fs16.appendFile = appendFile;
-      function appendFile(path20, data2, options, cb) {
+        fs19.appendFile = appendFile;
+      function appendFile(path22, data2, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        return go$appendFile(path20, data2, options, cb);
-        function go$appendFile(path21, data3, options2, cb2, startTime) {
-          return fs$appendFile(path21, data3, options2, function(err) {
+        return go$appendFile(path22, data2, options, cb);
+        function go$appendFile(path23, data3, options2, cb2, startTime) {
+          return fs$appendFile(path23, data3, options2, function(err) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$appendFile, [path21, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$appendFile, [path23, data3, options2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1444,9 +1444,9 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$copyFile = fs16.copyFile;
+      var fs$copyFile = fs19.copyFile;
       if (fs$copyFile)
-        fs16.copyFile = copyFile;
+        fs19.copyFile = copyFile;
       function copyFile(src, dest, flags, cb) {
         if (typeof flags === "function") {
           cb = flags;
@@ -1464,34 +1464,34 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      var fs$readdir = fs16.readdir;
-      fs16.readdir = readdir;
+      var fs$readdir = fs19.readdir;
+      fs19.readdir = readdir;
       var noReaddirOptionVersions = /^v[0-5]\./;
-      function readdir(path20, options, cb) {
+      function readdir(path22, options, cb) {
         if (typeof options === "function")
           cb = options, options = null;
-        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path21, options2, cb2, startTime) {
-          return fs$readdir(path21, fs$readdirCallback(
-            path21,
+        var go$readdir = noReaddirOptionVersions.test(process.version) ? function go$readdir2(path23, options2, cb2, startTime) {
+          return fs$readdir(path23, fs$readdirCallback(
+            path23,
             options2,
             cb2,
             startTime
           ));
-        } : function go$readdir2(path21, options2, cb2, startTime) {
-          return fs$readdir(path21, options2, fs$readdirCallback(
-            path21,
+        } : function go$readdir2(path23, options2, cb2, startTime) {
+          return fs$readdir(path23, options2, fs$readdirCallback(
+            path23,
             options2,
             cb2,
             startTime
           ));
         };
-        return go$readdir(path20, options, cb);
-        function fs$readdirCallback(path21, options2, cb2, startTime) {
+        return go$readdir(path22, options, cb);
+        function fs$readdirCallback(path23, options2, cb2, startTime) {
           return function(err, files) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
               enqueue([
                 go$readdir,
-                [path21, options2, cb2],
+                [path23, options2, cb2],
                 err,
                 startTime || Date.now(),
                 Date.now()
@@ -1506,21 +1506,21 @@ var require_graceful_fs = __commonJS({
         }
       }
       if (process.version.substr(0, 4) === "v0.8") {
-        var legStreams = legacy(fs16);
+        var legStreams = legacy(fs19);
         ReadStream = legStreams.ReadStream;
         WriteStream = legStreams.WriteStream;
       }
-      var fs$ReadStream = fs16.ReadStream;
+      var fs$ReadStream = fs19.ReadStream;
       if (fs$ReadStream) {
         ReadStream.prototype = Object.create(fs$ReadStream.prototype);
         ReadStream.prototype.open = ReadStream$open;
       }
-      var fs$WriteStream = fs16.WriteStream;
+      var fs$WriteStream = fs19.WriteStream;
       if (fs$WriteStream) {
         WriteStream.prototype = Object.create(fs$WriteStream.prototype);
         WriteStream.prototype.open = WriteStream$open;
       }
-      Object.defineProperty(fs16, "ReadStream", {
+      Object.defineProperty(fs19, "ReadStream", {
         get: function() {
           return ReadStream;
         },
@@ -1530,7 +1530,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      Object.defineProperty(fs16, "WriteStream", {
+      Object.defineProperty(fs19, "WriteStream", {
         get: function() {
           return WriteStream;
         },
@@ -1541,7 +1541,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileReadStream = ReadStream;
-      Object.defineProperty(fs16, "FileReadStream", {
+      Object.defineProperty(fs19, "FileReadStream", {
         get: function() {
           return FileReadStream;
         },
@@ -1552,7 +1552,7 @@ var require_graceful_fs = __commonJS({
         configurable: true
       });
       var FileWriteStream = WriteStream;
-      Object.defineProperty(fs16, "FileWriteStream", {
+      Object.defineProperty(fs19, "FileWriteStream", {
         get: function() {
           return FileWriteStream;
         },
@@ -1562,7 +1562,7 @@ var require_graceful_fs = __commonJS({
         enumerable: true,
         configurable: true
       });
-      function ReadStream(path20, options) {
+      function ReadStream(path22, options) {
         if (this instanceof ReadStream)
           return fs$ReadStream.apply(this, arguments), this;
         else
@@ -1582,7 +1582,7 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function WriteStream(path20, options) {
+      function WriteStream(path22, options) {
         if (this instanceof WriteStream)
           return fs$WriteStream.apply(this, arguments), this;
         else
@@ -1600,22 +1600,22 @@ var require_graceful_fs = __commonJS({
           }
         });
       }
-      function createReadStream(path20, options) {
-        return new fs16.ReadStream(path20, options);
+      function createReadStream(path22, options) {
+        return new fs19.ReadStream(path22, options);
       }
-      function createWriteStream(path20, options) {
-        return new fs16.WriteStream(path20, options);
+      function createWriteStream(path22, options) {
+        return new fs19.WriteStream(path22, options);
       }
-      var fs$open = fs16.open;
-      fs16.open = open;
-      function open(path20, flags, mode, cb) {
+      var fs$open = fs19.open;
+      fs19.open = open;
+      function open(path22, flags, mode, cb) {
         if (typeof mode === "function")
           cb = mode, mode = null;
-        return go$open(path20, flags, mode, cb);
-        function go$open(path21, flags2, mode2, cb2, startTime) {
-          return fs$open(path21, flags2, mode2, function(err, fd) {
+        return go$open(path22, flags, mode, cb);
+        function go$open(path23, flags2, mode2, cb2, startTime) {
+          return fs$open(path23, flags2, mode2, function(err, fd) {
             if (err && (err.code === "EMFILE" || err.code === "ENFILE"))
-              enqueue([go$open, [path21, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
+              enqueue([go$open, [path23, flags2, mode2, cb2], err, startTime || Date.now(), Date.now()]);
             else {
               if (typeof cb2 === "function")
                 cb2.apply(this, arguments);
@@ -1623,20 +1623,20 @@ var require_graceful_fs = __commonJS({
           });
         }
       }
-      return fs16;
+      return fs19;
     }
     function enqueue(elem) {
       debug2("ENQUEUE", elem[0].name, elem[1]);
-      fs15[gracefulQueue].push(elem);
+      fs18[gracefulQueue].push(elem);
       retry2();
     }
     var retryTimer;
     function resetQueue() {
       var now = Date.now();
-      for (var i6 = 0; i6 < fs15[gracefulQueue].length; ++i6) {
-        if (fs15[gracefulQueue][i6].length > 2) {
-          fs15[gracefulQueue][i6][3] = now;
-          fs15[gracefulQueue][i6][4] = now;
+      for (var i6 = 0; i6 < fs18[gracefulQueue].length; ++i6) {
+        if (fs18[gracefulQueue][i6].length > 2) {
+          fs18[gracefulQueue][i6][3] = now;
+          fs18[gracefulQueue][i6][4] = now;
         }
       }
       retry2();
@@ -1644,9 +1644,9 @@ var require_graceful_fs = __commonJS({
     function retry2() {
       clearTimeout(retryTimer);
       retryTimer = void 0;
-      if (fs15[gracefulQueue].length === 0)
+      if (fs18[gracefulQueue].length === 0)
         return;
-      var elem = fs15[gracefulQueue].shift();
+      var elem = fs18[gracefulQueue].shift();
       var fn = elem[0];
       var args = elem[1];
       var err = elem[2];
@@ -1668,7 +1668,7 @@ var require_graceful_fs = __commonJS({
           debug2("RETRY", fn.name, args);
           fn.apply(null, args.concat([startTime]));
         } else {
-          fs15[gracefulQueue].push(elem);
+          fs18[gracefulQueue].push(elem);
         }
       }
       if (retryTimer === void 0) {
@@ -2103,10 +2103,10 @@ var require_mtime_precision = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/mtime-precision.js"(exports, module) {
     "use strict";
     var cacheSymbol = Symbol();
-    function probe(file, fs15, callback) {
-      const cachedPrecision = fs15[cacheSymbol];
+    function probe(file, fs18, callback) {
+      const cachedPrecision = fs18[cacheSymbol];
       if (cachedPrecision) {
-        return fs15.stat(file, (err, stat) => {
+        return fs18.stat(file, (err, stat) => {
           if (err) {
             return callback(err);
           }
@@ -2114,16 +2114,16 @@ var require_mtime_precision = __commonJS({
         });
       }
       const mtime = new Date(Math.ceil(Date.now() / 1e3) * 1e3 + 5);
-      fs15.utimes(file, mtime, mtime, (err) => {
+      fs18.utimes(file, mtime, mtime, (err) => {
         if (err) {
           return callback(err);
         }
-        fs15.stat(file, (err2, stat) => {
+        fs18.stat(file, (err2, stat) => {
           if (err2) {
             return callback(err2);
           }
           const precision = stat.mtime.getTime() % 1e3 === 0 ? "s" : "ms";
-          Object.defineProperty(fs15, cacheSymbol, { value: precision });
+          Object.defineProperty(fs18, cacheSymbol, { value: precision });
           callback(null, stat.mtime, precision);
         });
       });
@@ -2144,8 +2144,8 @@ var require_mtime_precision = __commonJS({
 var require_lockfile = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/lockfile.js"(exports, module) {
     "use strict";
-    var path20 = __require("path");
-    var fs15 = require_graceful_fs();
+    var path22 = __require("path");
+    var fs18 = require_graceful_fs();
     var retry2 = require_retry2();
     var onExit = require_signal_exit();
     var mtimePrecision = require_mtime_precision();
@@ -2155,7 +2155,7 @@ var require_lockfile = __commonJS({
     }
     function resolveCanonicalPath(file, options, callback) {
       if (!options.realpath) {
-        return callback(null, path20.resolve(file));
+        return callback(null, path22.resolve(file));
       }
       options.fs.realpath(file, callback);
     }
@@ -2276,7 +2276,7 @@ var require_lockfile = __commonJS({
         update: null,
         realpath: true,
         retries: 0,
-        fs: fs15,
+        fs: fs18,
         onCompromised: (err) => {
           throw err;
         },
@@ -2320,7 +2320,7 @@ var require_lockfile = __commonJS({
     }
     function unlock(file, options, callback) {
       options = {
-        fs: fs15,
+        fs: fs18,
         realpath: true,
         ...options
       };
@@ -2342,7 +2342,7 @@ var require_lockfile = __commonJS({
       options = {
         stale: 1e4,
         realpath: true,
-        fs: fs15,
+        fs: fs18,
         ...options
       };
       options.stale = Math.max(options.stale || 0, 2e3);
@@ -2381,16 +2381,16 @@ var require_lockfile = __commonJS({
 var require_adapter = __commonJS({
   "../../node_modules/.pnpm/proper-lockfile@4.1.2/node_modules/proper-lockfile/lib/adapter.js"(exports, module) {
     "use strict";
-    var fs15 = require_graceful_fs();
-    function createSyncFs(fs16) {
+    var fs18 = require_graceful_fs();
+    function createSyncFs(fs19) {
       const methods = ["mkdir", "realpath", "stat", "rmdir", "utimes"];
-      const newFs = { ...fs16 };
+      const newFs = { ...fs19 };
       methods.forEach((method) => {
         newFs[method] = (...args) => {
           const callback = args.pop();
           let ret;
           try {
-            ret = fs16[`${method}Sync`](...args);
+            ret = fs19[`${method}Sync`](...args);
           } catch (err) {
             return callback(err);
           }
@@ -2428,7 +2428,7 @@ var require_adapter = __commonJS({
     }
     function toSyncOptions(options) {
       options = { ...options };
-      options.fs = createSyncFs(options.fs || fs15);
+      options.fs = createSyncFs(options.fs || fs18);
       if (typeof options.retries === "number" && options.retries > 0 || options.retries && typeof options.retries.retries === "number" && options.retries.retries > 0) {
         throw Object.assign(new Error("Cannot use retries with the sync api"), { code: "ESYNC" });
       }
@@ -3215,7 +3215,7 @@ var require_dist_node5 = __commonJS({
     }
     function fetchWrapper(requestOptions) {
       var _a3, _b, _c5, _d;
-      const log7 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
+      const log8 = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
       const parseSuccessResponseBody = ((_a3 = requestOptions.request) == null ? void 0 : _a3.parseSuccessResponseBody) !== false;
       if (isPlainObject(requestOptions.body) || Array.isArray(requestOptions.body)) {
         requestOptions.body = JSON.stringify(requestOptions.body);
@@ -3250,7 +3250,7 @@ var require_dist_node5 = __commonJS({
         if ("deprecation" in headers) {
           const matches2 = headers.link && headers.link.match(/<([^<>]+)>; rel="deprecation"/);
           const deprecationLink = matches2 && matches2.pop();
-          log7.warn(
+          log8.warn(
             `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${headers.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
           );
         }
@@ -3785,15 +3785,15 @@ var require_dist_node9 = __commonJS({
         octokit.log.debug("request", options);
         const start = Date.now();
         const requestOptions = octokit.request.endpoint.parse(options);
-        const path20 = requestOptions.url.replace(options.baseUrl, "");
+        const path22 = requestOptions.url.replace(options.baseUrl, "");
         return request(options).then((response) => {
           octokit.log.info(
-            `${requestOptions.method} ${path20} - ${response.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path22} - ${response.status} in ${Date.now() - start}ms`
           );
           return response;
         }).catch((error2) => {
           octokit.log.info(
-            `${requestOptions.method} ${path20} - ${error2.status} in ${Date.now() - start}ms`
+            `${requestOptions.method} ${path22} - ${error2.status} in ${Date.now() - start}ms`
           );
           throw error2;
         });
@@ -7887,7 +7887,7 @@ var require_dist_node13 = __commonJS({
     ];
     function routeMatcher(paths) {
       const regexes = paths.map(
-        (path20) => path20.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
+        (path22) => path22.split("/").map((c7) => c7.startsWith("{") ? "(?:.+?)" : c7).join("/")
       );
       const regex2 = `^(?:${regexes.map((r6) => `(?:${r6})`).join("|")})[^/]*$`;
       return new RegExp(regex2, "i");
@@ -8517,8 +8517,8 @@ var init_parseUtil = __esm({
     init_errors();
     init_en();
     makeIssue = (params) => {
-      const { data: data2, path: path20, errorMaps, issueData } = params;
-      const fullPath = [...path20, ...issueData.path || []];
+      const { data: data2, path: path22, errorMaps, issueData } = params;
+      const fullPath = [...path22, ...issueData.path || []];
       const fullIssue = {
         ...issueData,
         path: fullPath
@@ -8826,11 +8826,11 @@ var init_types2 = __esm({
     init_parseUtil();
     init_util2();
     ParseInputLazyPath = class {
-      constructor(parent, value, path20, key) {
+      constructor(parent, value, path22, key) {
         this._cachedPath = [];
         this.parent = parent;
         this.data = value;
-        this._path = path20;
+        this._path = path22;
         this._key = key;
       }
       get path() {
@@ -12297,7 +12297,8 @@ var init_field = __esm({
     });
     objectFieldSchema = fieldBaseSchema.extend({
       type: external_exports.literal("object"),
-      fields: external_exports.array(external_exports.lazy(() => fieldHolder[0])).min(1)
+      fields: external_exports.array(external_exports.lazy(() => fieldHolder[0])).min(1),
+      itemTitleField: external_exports.string().min(1).optional()
     });
     inlineGroupFieldSchema = external_exports.object({
       type: external_exports.literal("group"),
@@ -12411,7 +12412,7 @@ var init_sanitize_href = __esm({
 });
 
 // ../canopycms/src/config/schemas/url.ts
-var uploadTargetUrlSchema, assetMountUrlSchema;
+var uploadTargetUrlSchema, assetMountUrlSchema, previewPrefixSchema;
 var init_url = __esm({
   "../canopycms/src/config/schemas/url.ts"() {
     "use strict";
@@ -12423,6 +12424,9 @@ var init_url = __esm({
     assetMountUrlSchema = external_exports.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
       message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
     });
+    previewPrefixSchema = external_exports.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+      message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
+    });
   }
 });
 
@@ -12480,6 +12484,7 @@ var init_config2 = __esm({
     init_zod();
     init_collection();
     init_media();
+    init_url();
     defaultBranchAccessSchema = external_exports.enum(["allow", "deny"]).default("deny");
     defaultPathAccessLevelSchema = external_exports.enum(["allow", "deny"]);
     defaultPathAccessLevelsSchema = external_exports.object({
@@ -12511,6 +12516,7 @@ var init_config2 = __esm({
       subtitle: external_exports.string().optional(),
       theme: external_exports.unknown().optional(),
       previewBase: external_exports.record(external_exports.string()).optional(),
+      previewPrefix: previewPrefixSchema.optional(),
       // UI handler functions (runtime only, don't serialize)
       onAccountClick: external_exports.function().returns(external_exports.void()).optional(),
       onLogoutClick: external_exports.function().returns(external_exports.void()).optional(),
@@ -12538,6 +12544,9 @@ var init_config2 = __esm({
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
       gitBotAuthorEmail: gitBotAuthorEmailSchema,
+      // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+      gitEditedByTrailers: external_exports.boolean().optional(),
+      gitCoAuthoredByTrailers: external_exports.boolean().optional(),
       githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
       // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
       // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -12549,7 +12558,6 @@ var init_config2 = __esm({
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
       allowNetworkRemoteInProd: external_exports.boolean().optional(),
       settingsBranch: external_exports.string().optional(),
-      autoCreateSettingsPR: external_exports.boolean().optional(),
       // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
       // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
       // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -12588,8 +12596,8 @@ var init_permissions = __esm({
 });
 
 // ../canopycms/src/paths/normalize.ts
-function normalizeFilesystemPath(path20) {
-  return path20.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path22) {
+  return path22.split(/[\\/]+/).filter(Boolean).join("/");
 }
 var init_normalize = __esm({
   "../canopycms/src/paths/normalize.ts"() {
@@ -13739,9 +13747,9 @@ var init_createPaginator = __esm({
       command = withCommand(command) ?? command;
       return await client.send(command, ...args);
     };
-    get = (fromObject, path20) => {
+    get = (fromObject, path22) => {
       let cursor2 = fromObject;
-      const pathComponents = path20.split(".");
+      const pathComponents = path22.split(".");
       for (const step of pathComponents) {
         if (!cursor2 || typeof cursor2 !== "object") {
           return void 0;
@@ -14759,12 +14767,12 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             const password = request.password ?? "";
             auth = `${username}:${password}`;
           }
-          let path20 = request.path;
+          let path22 = request.path;
           if (queryString) {
-            path20 += `?${queryString}`;
+            path22 += `?${queryString}`;
           }
           if (request.fragment) {
-            path20 += `#${request.fragment}`;
+            path22 += `#${request.fragment}`;
           }
           let hostname = request.hostname ?? "";
           if (hostname[0] === "[" && hostname.endsWith("]")) {
@@ -14776,7 +14784,7 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             headers: request.headers,
             host: hostname,
             method: request.method,
-            path: path20,
+            path: path22,
             port: request.port,
             agent,
             auth
@@ -15059,16 +15067,16 @@ or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler conf
             reject(err);
           };
           const queryString = querystringBuilder.buildQueryString(query || {});
-          let path20 = request.path;
+          let path22 = request.path;
           if (queryString) {
-            path20 += `?${queryString}`;
+            path22 += `?${queryString}`;
           }
           if (request.fragment) {
-            path20 += `#${request.fragment}`;
+            path22 += `#${request.fragment}`;
           }
           const req = session.request({
             ...request.headers,
-            [http2.constants.HTTP2_HEADER_PATH]: path20,
+            [http2.constants.HTTP2_HEADER_PATH]: path22,
             [http2.constants.HTTP2_HEADER_METHOD]: method
           });
           session.ref();
@@ -15255,13 +15263,13 @@ var require_dist_cjs14 = __commonJS({
           const abortError = buildAbortError(abortSignal);
           return Promise.reject(abortError);
         }
-        let path20 = request.path;
+        let path22 = request.path;
         const queryString = querystringBuilder.buildQueryString(request.query || {});
         if (queryString) {
-          path20 += `?${queryString}`;
+          path22 += `?${queryString}`;
         }
         if (request.fragment) {
-          path20 += `#${request.fragment}`;
+          path22 += `#${request.fragment}`;
         }
         let auth = "";
         if (request.username != null || request.password != null) {
@@ -15270,7 +15278,7 @@ var require_dist_cjs14 = __commonJS({
           auth = `${username}:${password}@`;
         }
         const { port, method } = request;
-        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path20}`;
+        const url = `${request.protocol}//${auth}${request.hostname}${port ? `:${port}` : ""}${path22}`;
         const body = method === "GET" || method === "HEAD" ? void 0 : request.body;
         const requestOptions = {
           body,
@@ -17502,13 +17510,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path20, preserveJsx) {
-  if (typeof path20 === "string" && /^\.\.?\//.test(path20)) {
-    return path20.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
+function __rewriteRelativeImportExtension(path22, preserveJsx) {
+  if (typeof path22 === "string" && /^\.\.?\//.test(path22)) {
+    return path22.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m5, tsx, d5, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d5 && (!ext || !cm) ? m5 : d5 + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path20;
+  return path22;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -18406,11 +18414,11 @@ var init_HttpBindingProtocol = __esm({
           const opTraits = translateTraits(operationSchema.traits);
           if (opTraits.http) {
             request.method = opTraits.http[0];
-            const [path20, search] = opTraits.http[1].split("?");
+            const [path22, search] = opTraits.http[1].split("?");
             if (request.path == "/") {
-              request.path = path20;
+              request.path = path22;
             } else {
-              request.path += path20;
+              request.path += path22;
             }
             const traitSearchParams = new URLSearchParams(search ?? "");
             Object.assign(query, Object.fromEntries(traitSearchParams));
@@ -18813,8 +18821,8 @@ var init_requestBuilder = __esm({
         return this;
       }
       p(memberName, labelValueProvider, uriLabel, isGreedyLabel) {
-        this.resolvePathStack.push((path20) => {
-          this.path = resolvedPath(path20, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
+        this.resolvePathStack.push((path22) => {
+          this.path = resolvedPath(path22, this.input, memberName, labelValueProvider, uriLabel, isGreedyLabel);
         });
         return this;
       }
@@ -19464,18 +19472,18 @@ var require_dist_cjs20 = __commonJS({
       }
     };
     var booleanEquals = (value1, value2) => value1 === value2;
-    var getAttrPathList = (path20) => {
-      const parts = path20.split(".");
+    var getAttrPathList = (path22) => {
+      const parts = path22.split(".");
       const pathList = [];
       for (const part of parts) {
         const squareBracketIndex = part.indexOf("[");
         if (squareBracketIndex !== -1) {
           if (part.indexOf("]") !== part.length - 1) {
-            throw new EndpointError(`Path: '${path20}' does not end with ']'`);
+            throw new EndpointError(`Path: '${path22}' does not end with ']'`);
           }
           const arrayIndex = part.slice(squareBracketIndex + 1, -1);
           if (Number.isNaN(parseInt(arrayIndex))) {
-            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path20}'`);
+            throw new EndpointError(`Invalid array index: '${arrayIndex}' in path: '${path22}'`);
           }
           if (squareBracketIndex !== 0) {
             pathList.push(part.slice(0, squareBracketIndex));
@@ -19487,9 +19495,9 @@ var require_dist_cjs20 = __commonJS({
       }
       return pathList;
     };
-    var getAttr = (value, path20) => getAttrPathList(path20).reduce((acc, index) => {
+    var getAttr = (value, path22) => getAttrPathList(path22).reduce((acc, index) => {
       if (typeof acc !== "object") {
-        throw new EndpointError(`Index '${index}' in '${path20}' not found in '${JSON.stringify(value)}'`);
+        throw new EndpointError(`Index '${index}' in '${path22}' not found in '${JSON.stringify(value)}'`);
       } else if (Array.isArray(acc)) {
         return acc[parseInt(index)];
       }
@@ -19508,8 +19516,8 @@ var require_dist_cjs20 = __commonJS({
             return value;
           }
           if (typeof value === "object" && "hostname" in value) {
-            const { hostname: hostname2, port, protocol: protocol2 = "", path: path20 = "", query = {} } = value;
-            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path20}`);
+            const { hostname: hostname2, port, protocol: protocol2 = "", path: path22 = "", query = {} } = value;
+            const url = new URL(`${protocol2}//${hostname2}${port ? `:${port}` : ""}${path22}`);
             url.search = Object.entries(query).map(([k6, v5]) => `${k6}=${v5}`).join("&");
             return url;
           }
@@ -20954,10 +20962,10 @@ ${longDate}
 ${credentialScope}
 ${utilHexEncoding.toHex(hashedRequest)}`;
       }
-      getCanonicalPath({ path: path20 }) {
+      getCanonicalPath({ path: path22 }) {
         if (this.uriEscapePath) {
           const normalizedPathSegments = [];
-          for (const pathSegment of path20.split("/")) {
+          for (const pathSegment of path22.split("/")) {
             if (pathSegment?.length === 0)
               continue;
             if (pathSegment === ".")
@@ -20968,11 +20976,11 @@ ${utilHexEncoding.toHex(hashedRequest)}`;
               normalizedPathSegments.push(pathSegment);
             }
           }
-          const normalizedPath = `${path20?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path20?.endsWith("/") ? "/" : ""}`;
+          const normalizedPath = `${path22?.startsWith("/") ? "/" : ""}${normalizedPathSegments.join("/")}${normalizedPathSegments.length > 0 && path22?.endsWith("/") ? "/" : ""}`;
           const doubleEncoded = utilUriEscape.escapeUri(normalizedPath);
           return doubleEncoded.replace(/%2F/g, "/");
         }
-        return path20;
+        return path22;
       }
       validateResolvedCredentials(credentials) {
         if (typeof credentials !== "object" || typeof credentials.accessKeyId !== "string" || typeof credentials.secretAccessKey !== "string") {
@@ -22276,11 +22284,11 @@ var init_SmithyRpcV2CborProtocol = __esm({
           }
         }
         const { service, operation: operation2 } = (0, import_util_middleware5.getSmithyContext)(context);
-        const path20 = `/service/${service}/operation/${operation2}`;
+        const path22 = `/service/${service}/operation/${operation2}`;
         if (request.path.endsWith("/")) {
-          request.path += path20.slice(1);
+          request.path += path22.slice(1);
         } else {
-          request.path += path20;
+          request.path += path22;
         }
         return request;
       }
@@ -27925,14 +27933,14 @@ var require_readFile = __commonJS({
     var promises_1 = __require("node:fs/promises");
     exports.filePromises = {};
     exports.fileIntercept = {};
-    var readFile = (path20, options) => {
-      if (exports.fileIntercept[path20] !== void 0) {
-        return exports.fileIntercept[path20];
+    var readFile = (path22, options) => {
+      if (exports.fileIntercept[path22] !== void 0) {
+        return exports.fileIntercept[path22];
       }
-      if (!exports.filePromises[path20] || options?.ignoreCache) {
-        exports.filePromises[path20] = (0, promises_1.readFile)(path20, "utf8");
+      if (!exports.filePromises[path22] || options?.ignoreCache) {
+        exports.filePromises[path22] = (0, promises_1.readFile)(path22, "utf8");
       }
-      return exports.filePromises[path20];
+      return exports.filePromises[path22];
     };
     exports.readFile = readFile;
   }
@@ -27945,7 +27953,7 @@ var require_dist_cjs33 = __commonJS({
     var getHomeDir = require_getHomeDir();
     var getSSOTokenFilepath = require_getSSOTokenFilepath();
     var getSSOTokenFromFile = require_getSSOTokenFromFile();
-    var path20 = __require("path");
+    var path22 = __require("path");
     var types = require_dist_cjs();
     var readFile = require_readFile();
     var ENV_PROFILE = "AWS_PROFILE";
@@ -27967,9 +27975,9 @@ var require_dist_cjs33 = __commonJS({
       ...data2.default && { default: data2.default }
     });
     var ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path20.join(getHomeDir.getHomeDir(), ".aws", "config");
+    var getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || path22.join(getHomeDir.getHomeDir(), ".aws", "config");
     var ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path20.join(getHomeDir.getHomeDir(), ".aws", "credentials");
+    var getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || path22.join(getHomeDir.getHomeDir(), ".aws", "credentials");
     var prefixKeyRegex = /^([\w-]+)\s(["'])?([\w-@\+\.%:/]+)\2$/;
     var profileNameBlockList = ["__proto__", "profile __proto__"];
     var parseIni = (iniData) => {
@@ -28024,11 +28032,11 @@ var require_dist_cjs33 = __commonJS({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = path20.join(homeDir, filepath.slice(2));
+        resolvedFilepath = path22.join(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = path20.join(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = path22.join(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile.readFile(resolvedConfigFilepath, {
@@ -28067,8 +28075,8 @@ var require_dist_cjs33 = __commonJS({
       getFileRecord() {
         return readFile.fileIntercept;
       },
-      interceptFile(path21, contents) {
-        readFile.fileIntercept[path21] = Promise.resolve(contents);
+      interceptFile(path23, contents) {
+        readFile.fileIntercept[path23] = Promise.resolve(contents);
       },
       getTokenRecord() {
         return getSSOTokenFromFile.tokenIntercept;
@@ -28393,8 +28401,8 @@ var require_dist_cjs36 = __commonJS({
               return endpoint.url.href;
             }
             if ("hostname" in endpoint) {
-              const { protocol, hostname, port, path: path20 } = endpoint;
-              return `${protocol}//${hostname}${port ? ":" + port : ""}${path20}`;
+              const { protocol, hostname, port, path: path22 } = endpoint;
+              return `${protocol}//${hostname}${port ? ":" + port : ""}${path22}`;
             }
           }
           return endpoint;
@@ -43186,9 +43194,9 @@ var require_dist_node20 = __commonJS({
           "[@octokit/auth-app] installationId is set to a falsy value"
         );
       }
-      const log7 = options.log || {};
-      if (typeof log7.warn !== "function") {
-        log7.warn = console.warn.bind(console);
+      const log8 = options.log || {};
+      if (typeof log8.warn !== "function") {
+        log8.warn = console.warn.bind(console);
       }
       const request = options.request || import_request.request.defaults({
         headers: {
@@ -43203,7 +43211,7 @@ var require_dist_node20 = __commonJS({
         options,
         options.installationId ? { installationId: Number(options.installationId) } : {},
         {
-          log: log7,
+          log: log8,
           oauthApp: (0, import_auth_oauth_app.createOAuthAppAuth)({
             clientType: "github-app",
             clientId: options.clientId || "",
@@ -43220,8 +43228,8 @@ var require_dist_node20 = __commonJS({
 });
 
 // ../canopycms/src/worker/cms-worker.ts
-import fs13 from "node:fs/promises";
-import path17 from "node:path";
+import fs16 from "node:fs/promises";
+import path19 from "node:path";
 
 // ../../node_modules/.pnpm/simple-git@3.36.0/node_modules/simple-git/dist/esm/index.js
 var import_file_exists = __toESM(require_dist(), 1);
@@ -43812,8 +43820,8 @@ function toLinesWithContent(input = "", trimmed2 = true, separator = "\n") {
 function forEachLineWithContent(input, callback) {
   return toLinesWithContent(input, true).map((line) => callback(line));
 }
-function folderExists(path20) {
-  return (0, import_file_exists.exists)(path20, import_file_exists.FOLDER);
+function folderExists(path22) {
+  return (0, import_file_exists.exists)(path22, import_file_exists.FOLDER);
 }
 function append(target, item) {
   if (Array.isArray(target)) {
@@ -44215,8 +44223,8 @@ function checkIsRepoRootTask() {
     commands: commands5,
     format: "utf-8",
     onError,
-    parser(path20) {
-      return /^\.(git)?$/.test(path20.trim());
+    parser(path22) {
+      return /^\.(git)?$/.test(path22.trim());
     }
   };
 }
@@ -44650,11 +44658,11 @@ function parseGrep(grep) {
   const paths = /* @__PURE__ */ new Set();
   const results = {};
   forEachLineWithContent(grep, (input) => {
-    const [path20, line, preview] = input.split(NULL);
-    paths.add(path20);
-    (results[path20] = results[path20] || []).push({
+    const [path22, line, preview] = input.split(NULL);
+    paths.add(path22);
+    (results[path22] = results[path22] || []).push({
       line: asNumber(line),
-      path: path20,
+      path: path22,
       preview
     });
   });
@@ -45164,11 +45172,11 @@ function taskCallback(task, response, callback = NOOP) {
   response.then(onSuccess, onError2);
 }
 function addDeprecationNoticeToError(err) {
-  let log7 = (name) => {
+  let log8 = (name) => {
     console.warn(
       `simple-git deprecation notice: accessing GitResponseError.${name} should be GitResponseError.git.${name}, this will no longer be available in version 3`
     );
-    log7 = NOOP;
+    log8 = NOOP;
   };
   return Object.create(err, Object.getOwnPropertyNames(err.git).reduce(descriptorReducer, {}));
   function descriptorReducer(all, name) {
@@ -45179,7 +45187,7 @@ function addDeprecationNoticeToError(err) {
       enumerable: false,
       configurable: false,
       get() {
-        log7(name);
+        log8(name);
         return err.git[name];
       }
     };
@@ -45418,14 +45426,14 @@ var init_hash_object = __esm2({
     init_task();
   }
 });
-function parseInit(bare, path20, text) {
+function parseInit(bare, path22, text) {
   const response = String(text).trim();
   let result;
   if (result = initResponseRegex.exec(response)) {
-    return new InitSummary(bare, path20, false, result[1]);
+    return new InitSummary(bare, path22, false, result[1]);
   }
   if (result = reInitResponseRegex.exec(response)) {
-    return new InitSummary(bare, path20, true, result[1]);
+    return new InitSummary(bare, path22, true, result[1]);
   }
   let gitDir = "";
   const tokens = response.split(" ");
@@ -45436,7 +45444,7 @@ function parseInit(bare, path20, text) {
       break;
     }
   }
-  return new InitSummary(bare, path20, /^re/i.test(response), gitDir);
+  return new InitSummary(bare, path22, /^re/i.test(response), gitDir);
 }
 var InitSummary;
 var initResponseRegex;
@@ -45445,9 +45453,9 @@ var init_InitSummary = __esm2({
   "src/lib/responses/InitSummary.ts"() {
     "use strict";
     InitSummary = class {
-      constructor(bare, path20, existing, gitDir) {
+      constructor(bare, path22, existing, gitDir) {
         this.bare = bare;
-        this.path = path20;
+        this.path = path22;
         this.existing = existing;
         this.gitDir = gitDir;
       }
@@ -45459,7 +45467,7 @@ var init_InitSummary = __esm2({
 function hasBareCommand(command) {
   return command.includes(bareCommand);
 }
-function initTask(bare = false, path20, customArgs) {
+function initTask(bare = false, path22, customArgs) {
   const commands5 = ["init", ...customArgs];
   if (bare && !hasBareCommand(commands5)) {
     commands5.splice(1, 0, bareCommand);
@@ -45468,7 +45476,7 @@ function initTask(bare = false, path20, customArgs) {
     commands: commands5,
     format: "utf-8",
     parser(text) {
-      return parseInit(commands5.includes("--bare"), path20, text);
+      return parseInit(commands5.includes("--bare"), path22, text);
     }
   };
 }
@@ -46283,12 +46291,12 @@ var init_FileStatusSummary = __esm2({
     "use strict";
     fromPathRegex = /^(.+)\0(.+)$/;
     FileStatusSummary = class {
-      constructor(path20, index, working_dir) {
-        this.path = path20;
+      constructor(path22, index, working_dir) {
+        this.path = path22;
         this.index = index;
         this.working_dir = working_dir;
         if (index === "R" || working_dir === "R") {
-          const detail = fromPathRegex.exec(path20) || [null, path20, path20];
+          const detail = fromPathRegex.exec(path22) || [null, path22, path22];
           this.from = detail[2] || "";
           this.path = detail[1] || "";
         }
@@ -46319,14 +46327,14 @@ function splitLine(result, lineStr) {
     default:
       return;
   }
-  function data2(index, workingDir, path20) {
+  function data2(index, workingDir, path22) {
     const raw = `${index}${workingDir}`;
     const handler = parsers6.get(raw);
     if (handler) {
-      handler(result, path20);
+      handler(result, path22);
     }
     if (raw !== "##" && raw !== "!!") {
-      result.files.push(new FileStatusSummary(path20, index, workingDir));
+      result.files.push(new FileStatusSummary(path22, index, workingDir));
     }
   }
 }
@@ -46677,9 +46685,9 @@ var init_simple_git_api = __esm2({
           next
         );
       }
-      hashObject(path20, write) {
+      hashObject(path22, write) {
         return this._runTask(
-          hashObjectTask(path20, write === true),
+          hashObjectTask(path22, write === true),
           trailingFunctionArgument(arguments)
         );
       }
@@ -47033,8 +47041,8 @@ var init_branch = __esm2({
   }
 });
 function toPath(input) {
-  const path20 = input.trim().replace(/^["']|["']$/g, "");
-  return path20 && normalize(path20);
+  const path22 = input.trim().replace(/^["']|["']$/g, "");
+  return path22 && normalize(path22);
 }
 var parseCheckIgnore;
 var init_CheckIgnore = __esm2({
@@ -47319,8 +47327,8 @@ __export2(sub_module_exports, {
   subModuleTask: () => subModuleTask,
   updateSubModuleTask: () => updateSubModuleTask
 });
-function addSubModuleTask(repo, path20) {
-  return subModuleTask(["add", repo, path20]);
+function addSubModuleTask(repo, path22) {
+  return subModuleTask(["add", repo, path22]);
 }
 function initSubModuleTask(customArgs) {
   return subModuleTask(["init", ...customArgs]);
@@ -47634,8 +47642,8 @@ var require_git = __commonJS2({
       }
       return this._runTask(straightThroughStringTask2(command, this._trimmed), next);
     };
-    Git2.prototype.submoduleAdd = function(repo, path20, then) {
-      return this._runTask(addSubModuleTask2(repo, path20), trailingFunctionArgument2(arguments));
+    Git2.prototype.submoduleAdd = function(repo, path22, then) {
+      return this._runTask(addSubModuleTask2(repo, path22), trailingFunctionArgument2(arguments));
     };
     Git2.prototype.submoduleUpdate = function(args, then) {
       return this._runTask(
@@ -48243,6 +48251,10 @@ var DebugLogger = class {
       throw new Error(errorMsg);
     }
   }
+  /**
+   * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+   * anything that can run concurrently uses {@link timed}.
+   */
   time(label) {
     this.timers.set(label, Date.now());
   }
@@ -48257,12 +48269,16 @@ var DebugLogger = class {
     this.debug(category, `${label} completed`, { durationMs: duration });
     return duration;
   }
+  /**
+   * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+   * call, so concurrent spans with the same label on one logger never overwrite each other.
+   */
   async timed(category, label, fn) {
-    this.time(label);
+    const start = Date.now();
     try {
       return await fn();
     } finally {
-      this.timeEnd(category, label);
+      this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
     }
   }
 };
@@ -48643,6 +48659,27 @@ function isFileExistsError(err) {
 
 // ../canopycms/src/github-service.ts
 init_logger();
+
+// ../canopycms/src/submission-attribution.ts
+init_logger();
+var PR_SECTION_START = "<!-- canopycms:submission:start -->";
+var PR_SECTION_END = "<!-- canopycms:submission:end -->";
+function mergePrSection(existing, section) {
+  const body = existing ?? "";
+  for (let end = body.indexOf(PR_SECTION_END); end >= 0; ) {
+    const start = body.lastIndexOf(PR_SECTION_START, end - PR_SECTION_START.length);
+    if (start >= 0) {
+      return body.slice(0, start) + section + body.slice(end + PR_SECTION_END.length);
+    }
+    end = body.indexOf(PR_SECTION_END, end + PR_SECTION_END.length);
+  }
+  const human = body.split(PR_SECTION_START).join("").split(PR_SECTION_END).join("").trimEnd();
+  return human ? `${human}
+
+${section}` : section;
+}
+
+// ../canopycms/src/github-service.ts
 var ThrottledOctokit = import_rest.Octokit.plugin(import_plugin_throttling.throttling);
 var shouldRetryRateLimit = (retryAfter, retryCount) => retryCount < 2 && retryAfter <= 60;
 var shouldRetrySecondaryRateLimit = (retryAfter, retryCount) => retryCount < 1 && retryAfter <= 60;
@@ -48668,6 +48705,7 @@ function createCanopyOctokit(options) {
 }
 async function createOrUpdatePullRequest(params) {
   const { octokit, owner, repo, head, base, title, body, markReadyIfDraft, signal } = params;
+  const mergeSection = params.mergeSectionIntoBody === true;
   const requestOption = signal ? { request: { signal } } : {};
   const existingPRs = await octokit.pulls.list({
     owner,
@@ -48692,7 +48730,7 @@ async function createOrUpdatePullRequest(params) {
       repo,
       pull_number: existing.number,
       title,
-      body,
+      body: mergeSection ? mergePrSection(existing.body, body) : body,
       ...requestOption
     });
     if (markReadyIfDraft && existing.draft) {
@@ -48893,19 +48931,35 @@ function sanitizeBranchName(branchName) {
   return trimmedDots || "branch";
 }
 var RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
+function isSettingsBranchName(branchName, settingsBranchName) {
+  const sanitized = sanitizeBranchName(branchName);
+  return sanitized.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX) || settingsBranchName !== void 0 && sanitized === sanitizeBranchName(settingsBranchName);
+}
 
 // ../canopycms/src/worker/cms-worker.ts
 init_deployment_name();
 
 // ../canopycms/src/task-queue/worker-status.ts
+import fs3 from "node:fs/promises";
 import path4 from "node:path";
 var WORKER_STATUS_FILE = "worker-status.json";
+async function readLastFatalError(taskDir) {
+  try {
+    const content = await fs3.readFile(path4.join(taskDir, WORKER_STATUS_FILE), "utf-8");
+    return JSON.parse(content).lastFatalError;
+  } catch {
+    return void 0;
+  }
+}
 async function writeWorkerStatus(taskDir, report) {
   const filePath = path4.join(taskDir, WORKER_STATUS_FILE);
   const stamped = { ...report, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   await atomicWriteFile(filePath, JSON.stringify(stamped, null, 2));
 }
 
+// ../canopycms/src/version.ts
+var CANOPYCMS_VERSION = "0.0.68-int.94";
+
 // ../canopycms/src/worker/log.ts
 init_logger();
 function timestamp() {
@@ -48925,18 +48979,18 @@ function installWorkerLogger() {
 }
 
 // ../canopycms/src/worker/task-runner.ts
-import fs10 from "node:fs/promises";
+import fs12 from "node:fs/promises";
 
 // ../canopycms/src/branch-metadata.ts
-import fs7 from "node:fs/promises";
+import fs8 from "node:fs/promises";
 import path9 from "node:path";
 
 // ../canopycms/src/branch-registry.ts
-import fs5 from "node:fs/promises";
+import fs6 from "node:fs/promises";
 import path7 from "node:path";
 
 // ../canopycms/src/branch-metadata-file.ts
-import fs3 from "node:fs/promises";
+import fs4 from "node:fs/promises";
 import path5 from "node:path";
 var BRANCH_META_DIR = ".canopy-meta";
 var BRANCH_META_FILE = "branch.json";
@@ -48952,7 +49006,7 @@ var branchMetadataFilePath = (branchRoot) => path5.join(path5.resolve(branchRoot
 async function readBranchMetadataFile(branchRoot) {
   const resolvedRoot = path5.resolve(branchRoot);
   try {
-    const raw = await fs3.readFile(branchMetadataFilePath(resolvedRoot), "utf8");
+    const raw = await fs4.readFile(branchMetadataFilePath(resolvedRoot), "utf8");
     return JSON.parse(raw);
   } catch (err) {
     if (isNotFoundError2(err)) {
@@ -48969,7 +49023,7 @@ async function readBranchMetadataFile(branchRoot) {
 init_logger();
 
 // ../canopycms/src/resource-generation.ts
-import fs4 from "node:fs/promises";
+import fs5 from "node:fs/promises";
 import path6 from "node:path";
 import { randomUUID } from "node:crypto";
 var log = createDebugLogger({ prefix: "ResourceGeneration" });
@@ -48992,7 +49046,7 @@ async function bumpResourceGeneration(root, resource, options) {
 }
 async function readResourceGeneration(root, resource) {
   try {
-    const token = await fs4.readFile(resourceGenerationPath(root, resource), "utf-8");
+    const token = await fs5.readFile(resourceGenerationPath(root, resource), "utf-8");
     return { ok: true, token };
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT") return { ok: true, token: null };
@@ -49032,7 +49086,7 @@ var BranchRegistry = class {
   async list() {
     let parsed;
     try {
-      const raw = await fs5.readFile(this.registryPath, "utf8");
+      const raw = await fs6.readFile(this.registryPath, "utf8");
       parsed = JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError2(err)) {
@@ -49109,7 +49163,7 @@ var BranchRegistry = class {
   async performRegenerate() {
     const read = await readResourceGeneration(this.root, RESOURCE);
     const branches = await this.scanBranchDirectories();
-    await fs5.unlink(this.stalePath).catch(() => {
+    await fs6.unlink(this.stalePath).catch(() => {
     });
     if (!read.ok) {
       return branches;
@@ -49120,12 +49174,12 @@ var BranchRegistry = class {
       generation: read.token
     };
     const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs5.mkdir(this.root, { recursive: true });
-    await fs5.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs6.mkdir(this.root, { recursive: true });
+    await fs6.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
-      await fs5.rename(uniqueTempPath, this.registryPath);
+      await fs6.rename(uniqueTempPath, this.registryPath);
     } catch (err) {
-      await fs5.unlink(uniqueTempPath).catch(() => {
+      await fs6.unlink(uniqueTempPath).catch(() => {
       });
       throw err;
     }
@@ -49139,7 +49193,7 @@ var BranchRegistry = class {
   async scanBranchDirectories() {
     const branches = [];
     try {
-      const entries = await fs5.readdir(this.root, { withFileTypes: true });
+      const entries = await fs6.readdir(this.root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) {
           continue;
@@ -49207,7 +49261,7 @@ async function withLock(key, fn) {
 
 // ../canopycms/src/utils/occ-json-write.ts
 var import_proper_lockfile = __toESM(require_proper_lockfile(), 1);
-import fs6 from "node:fs/promises";
+import fs7 from "node:fs/promises";
 import path8 from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 var log3 = createDebugLogger({ prefix: "OccJsonWrite" });
@@ -49224,28 +49278,28 @@ async function writeOccJsonFile(filePath, payload2, options) {
   const data2 = { ...payload2, version: newVersion, writeId };
   const content = JSON.stringify(data2, null, 2) + (trailingNewline ? "\n" : "");
   const dir = path8.dirname(filePath);
-  await fs6.mkdir(dir, { recursive: true });
+  await fs7.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs6.writeFile(tempPath, content, "utf-8");
+  await fs7.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs6.link(tempPath, filePath);
+      await fs7.link(tempPath, filePath);
     } catch (err) {
-      await fs6.unlink(tempPath).catch(() => {
+      await fs7.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError(err)) {
         throw new OccWriteConflictError();
       }
       throw err;
     }
-    await fs6.unlink(tempPath).catch(() => {
+    await fs7.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs6.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs7.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -49253,16 +49307,16 @@ async function writeOccJsonFile(filePath, payload2, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError();
     }
-    await fs6.rename(tempPath, filePath);
+    await fs7.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs6.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs7.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError();
     }
   } catch (err) {
-    await fs6.unlink(tempPath).catch(() => {
+    await fs7.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -49289,7 +49343,7 @@ async function withOccRetry(operation2, options) {
 }
 async function withOccFileLock(filePath, fn) {
   const dir = path8.dirname(filePath);
-  await fs6.mkdir(dir, { recursive: true });
+  await fs7.mkdir(dir, { recursive: true });
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -49359,7 +49413,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   }
   async load() {
     try {
-      const raw = await fs7.readFile(this.filePath, "utf8");
+      const raw = await fs8.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -49413,7 +49467,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    */
   async save(incoming) {
     try {
-      await fs7.stat(this.branchRoot);
+      await fs8.stat(this.branchRoot);
     } catch (err) {
       if (isNotFoundError2(err)) {
         throw new BranchMetadataConflictError("Branch no longer exists");
@@ -49493,6 +49547,10 @@ var getBranchMetadataFileManager = (branchRoot, baseRoot, options) => {
   return BranchMetadataFileManager.get(branchRoot, baseRoot, options);
 };
 
+// ../canopycms/src/git-manager.ts
+import fs11 from "node:fs/promises";
+import path13 from "node:path";
+
 // ../canopycms/src/content-index-registry.ts
 import path10 from "node:path";
 var registry = /* @__PURE__ */ new Map();
@@ -49588,22 +49646,13 @@ var STATIC_DEPLOY_USER = Object.freeze({
   name: "Static Deploy"
 });
 
-// ../canopycms/src/branch-schema-cache.ts
-var SCHEMA_GENERATION_RESOURCE = "schema";
-
-// ../canopycms/src/content-index-generation.ts
-var RESOURCE2 = "content-index";
-async function bumpContentIndexGeneration(root) {
-  return bumpResourceGeneration(root, RESOURCE2);
-}
-async function invalidateBranchContentCaches(root) {
-  await bumpContentIndexGeneration(root);
-  await bumpResourceGeneration(root, SCHEMA_GENERATION_RESOURCE);
-  invalidateContentIndexesForRoot(root);
-}
+// ../canopycms/src/utils/request-timing.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+var log4 = createDebugLogger({ prefix: "CanopyCMS" });
 
 // ../canopycms/src/utils/git.ts
-import fs8 from "node:fs/promises";
+import fs9 from "node:fs/promises";
 import path11 from "node:path";
 var REJECTED_MARKER = "[rejected]";
 var NON_FAST_FORWARD_REASONS = ["non-fast-forward", "fetch first"];
@@ -49616,17 +49665,21 @@ var STALE_LEASE_REASON = "stale info";
 function isStaleLeaseRejection(message) {
   return message.includes(REJECTED_MARKER) && message.includes(STALE_LEASE_REASON);
 }
+var WORKFLOW_REFUSAL_PATTERN = /refusing to allow an? [^`\n]+? to create or update workflow `([^`\n]+)`/;
+function workflowPushRefusalFile(message) {
+  return WORKFLOW_REFUSAL_PATTERN.exec(message)?.[1] ?? null;
+}
 async function resolveGitDir(repoPath) {
   const dotGit = path11.join(repoPath, ".git");
   let stat;
   try {
-    stat = await fs8.stat(dotGit);
+    stat = await fs9.stat(dotGit);
   } catch {
     return null;
   }
   if (stat.isDirectory()) return dotGit;
   try {
-    const pointer = await fs8.readFile(dotGit, "utf-8");
+    const pointer = await fs9.readFile(dotGit, "utf-8");
     const match2 = /^gitdir:\s*(.+)$/m.exec(pointer);
     if (!match2) return null;
     const target = match2[1].trim();
@@ -49635,28 +49688,50 @@ async function resolveGitDir(repoPath) {
     return null;
   }
 }
+var CANOPY_META_DIR = ".canopy-meta";
+function isCanopyInternalPath(repoRelativePath) {
+  return repoRelativePath === CANOPY_META_DIR || repoRelativePath.startsWith(`${CANOPY_META_DIR}/`);
+}
 async function isRebaseInProgress(repoPath) {
   const gitDir = await resolveGitDir(repoPath);
   if (!gitDir) return false;
   const results = await Promise.all(
     ["rebase-merge", "rebase-apply"].map(
-      (dir) => fs8.stat(path11.join(gitDir, dir)).then(() => true).catch(() => false)
+      (dir) => fs9.stat(path11.join(gitDir, dir)).then(() => true).catch(() => false)
     )
   );
   return results.some(Boolean);
 }
 
+// ../canopycms/src/branch-schema-cache.ts
+var SCHEMA_CACHE_FILE = "schema-cache.json";
+var SCHEMA_GENERATION_RESOURCE = "schema";
+
+// ../canopycms/src/content-index-generation.ts
+var RESOURCE2 = "content-index";
+async function bumpContentIndexGeneration(root) {
+  return bumpResourceGeneration(root, RESOURCE2);
+}
+async function invalidateBranchContentCaches(root) {
+  await bumpContentIndexGeneration(root);
+  await bumpResourceGeneration(root, SCHEMA_GENERATION_RESOURCE);
+  invalidateContentIndexesForRoot(root);
+}
+
 // ../canopycms/src/utils/provisioning-lock.ts
 var import_proper_lockfile2 = __toESM(require_proper_lockfile(), 1);
-import fs9 from "node:fs/promises";
+import fs10 from "node:fs/promises";
 import path12 from "node:path";
 init_logger();
-function provisioningLockOptions(lockPath, retries, onCompromised) {
+var PROVISIONING_LOCK_STALE_MS = 9e4;
+function provisioningLockOptions(lockPath, retries, onCompromised, staleMs) {
   return {
     lockfilePath: lockPath,
     realpath: false,
     retries,
-    stale: 3e4,
+    stale: staleMs,
+    // Fixed, not stale/2: every holder refreshes at 15s whatever threshold it judges others by.
+    update: 15e3,
     // proper-lockfile invokes this from inside its refresh timer, so ANY throw escaping here is
     // an uncaught exception that kills the process. Call sites are told not to throw (see
     // OnLockCompromised); this makes it structural rather than a convention, and also covers the
@@ -49699,15 +49774,21 @@ function releaseIgnoringAlreadyReleased(release, lockPath) {
     }
   };
 }
-async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
-  await fs9.mkdir(lockTargetDir2, { recursive: true });
+function branchProvisioningLockName(dirName) {
+  return `.${dirName}.init.lock`;
+}
+async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised, staleMs = PROVISIONING_LOCK_STALE_MS) {
+  await fs10.mkdir(lockTargetDir2, { recursive: true });
   const lockPath = path12.join(lockTargetDir2, lockName);
-  const release = await import_proper_lockfile2.default.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised));
+  const release = await import_proper_lockfile2.default.lock(
+    lockPath,
+    provisioningLockOptions(lockPath, 0, onCompromised, staleMs)
+  );
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
 
 // ../canopycms/src/git-manager.ts
-var log4 = createDebugLogger({ prefix: "GitManager" });
+var log5 = createDebugLogger({ prefix: "GitManager" });
 var GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
 var FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
 function gitChildEnv(overrides) {
@@ -49727,9 +49808,28 @@ function gitNetworkChildEnv() {
   return { ...env, ...FORCE_C_LOCALE };
 }
 var GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
+async function ensureGitExcludePattern(repoPath, pattern) {
+  const excludePath = path13.join(repoPath, ".git", "info", "exclude");
+  await fs11.mkdir(path13.dirname(excludePath), { recursive: true });
+  let content = "";
+  try {
+    content = await fs11.readFile(excludePath, "utf-8");
+  } catch (err) {
+    if (!isNotFoundError2(err)) throw err;
+  }
+  const lines = content.split("\n");
+  if (lines.some((line) => line.trim() === pattern)) {
+    log5.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    return;
+  }
+  const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
+  const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
+  await fs11.writeFile(excludePath, newContent, "utf-8");
+  log5.debug("git", "Added pattern to .git/info/exclude", { pattern });
+}
 
 // ../canopycms/src/worker/history-rewrite.ts
-import path13 from "node:path";
+import path14 from "node:path";
 async function readPublishedSha(ctx, branchRef) {
   try {
     const out = await simpleGit().raw([
@@ -49823,7 +49923,7 @@ async function reconcilePendingRewrite(ctx, options) {
 }
 async function hasPendingHistoryRewrite(ctx, branchName) {
   try {
-    const branchPath = path13.join(ctx.contentBranchesPath, sanitizeBranchName(branchName));
+    const branchPath = path14.join(ctx.contentBranchesPath, sanitizeBranchName(branchName));
     const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
     return typeof metaFile?.branch.historyRewrittenFrom === "string";
   } catch {
@@ -49866,6 +49966,9 @@ function isRateLimitSignal403(err) {
   if (err instanceof Error && /rate limit/i.test(err.message)) return true;
   return false;
 }
+function isSettingsBranch(branch) {
+  return branch.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX);
+}
 function requireString(payload2, key) {
   const val = payload2[key];
   if (typeof val !== "string")
@@ -49992,6 +50095,11 @@ async function executeTask(ctx, task, signal) {
           `Refusing to push-and-create-or-update-pr for "${branch}": it is the base branch -- submitting the base branch is never valid`
         );
       }
+      if (isSettingsBranch(branch)) {
+        await ctx.pushBranchToGitHub(branch);
+        workerLog(`Pushed settings branch ${branch}; settings branches never get a PR`);
+        return { pushed: true };
+      }
       await ctx.pushBranchToGitHub(branch);
       const result = await createOrUpdatePullRequest({
         octokit: ctx.octokit(),
@@ -50001,9 +50109,9 @@ async function executeTask(ctx, task, signal) {
         base,
         title: optionalString(payload2, "title", `Submit ${branch}`),
         body: optionalString(payload2, "body", ""),
-        // Content submits (api/github-sync.ts) set this; settings-branch
-        // syncs (services.ts) deliberately don't.
+        // Content submits (api/github-sync.ts) set both.
         markReadyIfDraft: payload2.markReadyIfDraft === true,
+        mergeSectionIntoBody: payload2.mergeSectionIntoBody === true,
         signal
       });
       workerLog(
@@ -50056,7 +50164,7 @@ async function updateBranchMetadata(ctx, task, result) {
   if (!branch) return;
   const branchPath = ctx.branchWorkspacePath(branch);
   try {
-    await fs10.stat(branchPath);
+    await fs12.stat(branchPath);
   } catch {
     return;
   }
@@ -50092,7 +50200,7 @@ async function updateBranchMetadataOnFailure(ctx, task, error2) {
   if (!branch) return;
   const branchPath = ctx.branchWorkspacePath(branch);
   try {
-    await fs10.stat(branchPath);
+    await fs12.stat(branchPath);
   } catch {
     return;
   }
@@ -50108,6 +50216,13 @@ async function updateBranchMetadataOnFailure(ctx, task, error2) {
     );
   }
 }
+function throwIfWorkflowRefusal(branch, message) {
+  const file = workflowPushRefusalFile(message);
+  if (file === null) return;
+  throw new PermanentTaskError(
+    `Push refused for branch "${branch}": it would put a version of ${file} on GitHub that GitHub does not already have, and this deployment's GitHub credential is deliberately not allowed to change workflow files. Such a change usually comes from outside the editor, such as a direct push to this branch. Nothing was pushed, and retrying will not help until a developer with permission to change workflow files resolves it on GitHub.`
+  );
+}
 async function pushBranchToGitHub(ctx, branch) {
   const git = simpleGit({
     baseDir: ctx.remoteGitPath,
@@ -50136,11 +50251,13 @@ async function pushBranchToGitHub(ctx, branch) {
     }
   } catch (err) {
     const message = getErrorMessage2(err);
+    throwIfWorkflowRefusal(branch, message);
     if (marker && isStaleLeaseRejection(message)) {
       try {
         await git.push(githubUrl, branch);
       } catch (retryErr) {
         const retryMessage = getErrorMessage2(retryErr);
+        throwIfWorkflowRefusal(branch, retryMessage);
         if (isNonFastForwardRejection(retryMessage)) {
           throw new PermanentTaskError(
             `Push rejected for branch "${branch}": GitHub's tip is neither the commit this deployment last published nor an ancestor of what it is pushing, so the branch has genuinely diverged and nothing was overwritten. Something else moved it on GitHub -- a direct push, or another CanopyCMS deployment sharing this repository.`
@@ -50166,25 +50283,108 @@ async function pushBranchToGitHub(ctx, branch) {
 }
 
 // ../canopycms/src/worker/rebase.ts
-import fs11 from "node:fs/promises";
-import path15 from "node:path";
+import fs14 from "node:fs/promises";
+import path17 from "node:path";
 init_normalize();
 init_types3();
 
 // ../canopycms/src/utils/content-write-lock.ts
-import path14 from "node:path";
+import path15 from "node:path";
 init_logger();
 var META_DIR2 = ".canopy-meta";
 var CONTENT_WRITE_LOCK_NAME = "content-write.lock";
 function lockTargetDir(branchRoot) {
-  return path14.join(path14.resolve(branchRoot), META_DIR2);
+  return path15.join(path15.resolve(branchRoot), META_DIR2);
 }
+var CONTENT_WRITE_LOCK_STALE_MS = 3e4;
 function tryAcquireContentWriteLock(branchRoot, onCompromised) {
   return tryAcquireProvisioningLock(
     lockTargetDir(branchRoot),
     CONTENT_WRITE_LOCK_NAME,
-    onCompromised
+    onCompromised,
+    CONTENT_WRITE_LOCK_STALE_MS
+  );
+}
+
+// ../canopycms/src/worker/provisioned-workspace.ts
+import fs13 from "node:fs/promises";
+import path16 from "node:path";
+async function holdProvisionedWorkspace(contentBranchesPath, dirName) {
+  let release;
+  let compromised = false;
+  try {
+    release = await tryAcquireProvisioningLock(
+      contentBranchesPath,
+      branchProvisioningLockName(dirName),
+      (err) => {
+        compromised = true;
+        workerLogWarn(
+          `  Provisioning lock for ${dirName} was compromised mid-hold: ${getErrorMessage2(err)}`
+        );
+      }
+    );
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ELOCKED") return { kind: "locked" };
+    throw err;
+  }
+  const root = path16.join(contentBranchesPath, dirName);
+  const [gitIsDir, hasMetadata] = await Promise.all([
+    fs13.stat(path16.join(root, ".git")).then(
+      (stat) => stat.isDirectory(),
+      () => false
+    ),
+    fs13.stat(path16.join(root, BRANCH_META_DIR, BRANCH_META_FILE)).then(
+      () => true,
+      () => false
+    )
+  ]);
+  if (gitIsDir && hasMetadata) return { kind: "held", release, isCompromised: () => compromised };
+  await releaseProvisionedWorkspace(release, dirName);
+  return { kind: "not-provisioned" };
+}
+async function releaseProvisionedWorkspace(release, dirName) {
+  await release().catch((err) => {
+    workerLogWarn(
+      `  Failed to release the provisioning lock for ${dirName}: ${getErrorMessage2(err)}`
+    );
+  });
+}
+
+// ../canopycms/src/worker/canopy-state.ts
+var TRACKED_CANOPY_STATE_FIX = "run `git rm -r --cached .canopy-meta` in the site repo, add `.canopy-meta/` to its .gitignore, and commit";
+var MAX_REPORTED_PATHS = 10;
+var RETIRED_SCHEMA_CACHE_PATH = `${CANOPY_META_DIR}/${SCHEMA_CACHE_FILE}`;
+function isUntracked(file) {
+  return file.index === "?" && file.working_dir === "?";
+}
+function splitNul(out) {
+  return out.split("\0").filter((entry) => entry.length > 0);
+}
+async function listTrackedCanopyState(git) {
+  return splitNul(await git.raw(["ls-files", "-z", "--", CANOPY_META_DIR]));
+}
+async function restoreRetiredSchemaCache(git, status) {
+  const entry = status.files.find((f5) => f5.path === RETIRED_SCHEMA_CACHE_PATH);
+  if (!entry || entry.index === "?" || entry.index === "A") return false;
+  await git.raw(["checkout", "HEAD", "--", RETIRED_SCHEMA_CACHE_PATH]);
+  return true;
+}
+function trackedCanopyStateChanges(status) {
+  return status.files.filter((f5) => isCanopyInternalPath(f5.path) && !isUntracked(f5)).map((f5) => f5.path);
+}
+async function splitByUpstreamTracking(git, paths, tip) {
+  if (paths.length === 0) return { droppedUpstream: [], stillTracked: [] };
+  const tracked = new Set(
+    splitNul(await git.raw(["ls-tree", "-r", "-z", "--name-only", tip, "--", CANOPY_META_DIR]))
   );
+  return {
+    droppedUpstream: paths.filter((p6) => !tracked.has(p6)),
+    stillTracked: paths.filter((p6) => tracked.has(p6))
+  };
+}
+async function untrackInIndex(git, paths) {
+  if (paths.length === 0) return;
+  await git.raw(["rm", "--cached", "--ignore-unmatch", "-q", "--", ...paths]);
 }
 
 // ../canopycms/src/worker/rebase.ts
@@ -50314,13 +50514,13 @@ async function runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, isLock
 function conflictFilesToContentIds(conflictedFiles, contentRoot) {
   const normalizedContentRoot = normalizeFilesystemPath(contentRoot);
   const conflictIds = [...new Set(conflictedFiles)].map((f5) => {
-    const fileId = extractIdFromFilename(path15.basename(f5));
+    const fileId = extractIdFromFilename(path17.basename(f5));
     if (fileId) return fileId;
-    const parentDir = path15.basename(path15.dirname(f5));
+    const parentDir = path17.basename(path17.dirname(f5));
     const dirId = extractIdFromFilename(parentDir);
     if (dirId) return dirId;
-    const parentPath = normalizeFilesystemPath(path15.dirname(f5));
-    if (path15.basename(f5) === ".collection.json" && parentPath === normalizedContentRoot) {
+    const parentPath = normalizeFilesystemPath(path17.dirname(f5));
+    if (path17.basename(f5) === ".collection.json" && parentPath === normalizedContentRoot) {
       return ROOT_COLLECTION_ID;
     }
     return null;
@@ -50349,7 +50549,7 @@ async function runRebaseCycle(ctx) {
   const failed = [];
   let branchDirs;
   try {
-    branchDirs = await fs11.readdir(ctx.contentBranchesPath);
+    branchDirs = await fs14.readdir(ctx.contentBranchesPath);
   } catch {
     return { rebased, skippedDirty, skippedLocked, failed };
   }
@@ -50357,10 +50557,10 @@ async function runRebaseCycle(ctx) {
     if (branchDir.startsWith(".") || branchDir === "branches.json") {
       continue;
     }
-    const branchPath = path15.join(ctx.contentBranchesPath, branchDir);
-    const gitDir = path15.join(branchPath, ".git");
+    const branchPath = path17.join(ctx.contentBranchesPath, branchDir);
+    const gitDir = path17.join(branchPath, ".git");
     try {
-      const stat = await fs11.stat(gitDir);
+      const stat = await fs14.stat(gitDir);
       if (!stat.isDirectory()) {
         workerLog(`  Skipping ${branchDir}: .git is not a directory`);
         continue;
@@ -50373,7 +50573,11 @@ async function runRebaseCycle(ctx) {
       workerLog(`  Skipping ${branchDir}: base branch (refreshed separately)`);
       continue;
     }
-    const outcome = await rebaseOneBranch(ctx, branchDir, branchPath);
+    if (isSettingsBranchName(branchDir, ctx.ensureSettingsBranch())) {
+      workerLogWarn(`  Skipping ${branchDir}: settings branch, never a content workspace`);
+      continue;
+    }
+    const outcome = await holdAndRebaseOneBranch(ctx, branchDir, branchPath);
     if (outcome.kind === "rebased") rebased.push(branchDir);
     else if (outcome.kind === "skippedDirty") skippedDirty.push(branchDir);
     else if (outcome.kind === "skippedLocked") skippedLocked.push(branchDir);
@@ -50384,7 +50588,30 @@ async function runRebaseCycle(ctx) {
   }
   return { rebased, skippedDirty, skippedLocked, failed };
 }
-async function rebaseOneBranch(ctx, branchDir, branchPath) {
+async function holdAndRebaseOneBranch(ctx, branchDir, branchPath) {
+  let hold;
+  try {
+    hold = await holdProvisionedWorkspace(ctx.contentBranchesPath, branchDir);
+  } catch (err) {
+    const error2 = redactCredentials(`could not take the provisioning lock: ${getErrorMessage2(err)}`);
+    workerLogWarn(`  Skipping ${branchDir}: ${error2}`);
+    return { kind: "failed", error: error2 };
+  }
+  if (hold.kind === "locked") {
+    workerLog(`  Skipping ${branchDir}: provisioning lock held elsewhere (retrying next cycle)`);
+    return { kind: "skippedLocked" };
+  }
+  if (hold.kind === "not-provisioned") {
+    workerLog(`  Skipping ${branchDir}: not yet provisioned (no branch.json)`);
+    return { kind: "none" };
+  }
+  try {
+    return await rebaseOneBranch(ctx, branchDir, branchPath, hold.isCompromised);
+  } finally {
+    await releaseProvisionedWorkspace(hold.release, branchDir);
+  }
+}
+async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCompromised) {
   let didRebase = false;
   try {
     const metaFile = await BranchMetadataFileManager.loadOnly(branchPath);
@@ -50409,6 +50636,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
     });
     let releaseContentLock;
     let contentLockCompromised = false;
+    const lockCompromised = () => contentLockCompromised || isProvisioningLockCompromised();
     try {
       releaseContentLock = await tryAcquireContentWriteLock(branchPath, (lockErr) => {
         contentLockCompromised = true;
@@ -50446,11 +50674,26 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
           return { kind: "failed", error: reason };
         }
       }
-      const dirtyCheck = await branchGit.status();
-      if (dirtyCheck.files.length > 0) {
+      let dirtyCheck = await branchGit.status();
+      if (await restoreRetiredSchemaCache(branchGit, dirtyCheck)) {
+        workerLog(`  ${branchDir}: restored the retired in-tree schema cache`);
+        dirtyCheck = await branchGit.status();
+      }
+      const editorDirt = dirtyCheck.files.filter((f5) => !isCanopyInternalPath(f5.path));
+      if (editorDirt.length > 0) {
         workerLog(`  Skipping ${branchDir}: has uncommitted changes`);
         return { kind: "skippedDirty" };
       }
+      const trackedState = trackedCanopyStateChanges(dirtyCheck);
+      if (trackedState.length > 0) {
+        await branchGit.fetch("origin", ctx.baseBranch);
+        const baseTip = (await branchGit.revparse(["FETCH_HEAD"])).trim();
+        const { stillTracked } = await splitByUpstreamTracking(branchGit, trackedState, baseTip);
+        const reason = stillTracked.length > 0 ? `git cannot rebase over modified canopycms state the repo tracks (${trackedState.join(", ")}). To fix, ${TRACKED_CANOPY_STATE_FIX}.` : `git cannot rebase over modified canopycms state this clone still tracks (${trackedState.join(", ")}), though the base branch no longer does; the clone needs manual repair`;
+        workerLogWarn(`  Skipping ${branchDir}: ${reason}`);
+        await recordRebaseFailure(ctx, branchPath, branchDir, reason);
+        return { kind: "failed", error: reason };
+      }
       const branchRef = (await branchGit.revparse(["--abbrev-ref", "HEAD"])).trim();
       const canPublish = branchRef.length > 0 && branchRef !== "HEAD";
       if (canPublish && metaFile?.branch.historyRewrittenFrom) {
@@ -50496,20 +50739,20 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
         branchGit,
         branchDir,
         fetchedBaseTip,
-        () => contentLockCompromised
+        lockCompromised
       );
       if (completed) await ctx.afterRebaseCompletedForTesting();
-      if (contentLockCompromised && !completed) {
+      if (lockCompromised() && !completed) {
         workerLogWarn(
-          `  Skipping ${branchDir}: content-write lock was compromised mid-rebase (retrying next cycle)`
+          `  Skipping ${branchDir}: a lock it held was compromised mid-rebase (retrying next cycle)`
         );
         await branchGit.rebase(["--abort"]).catch(() => {
         });
         return { kind: "skippedLocked" };
       }
-      if (contentLockCompromised) {
+      if (lockCompromised()) {
         workerLogWarn(
-          `  Content-write lock for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`
+          `  A lock held for ${branchDir} was compromised, but its rebase had already completed -- finishing the sync (history is rewritten; skipping now would strand the history-rewrite marker and wedge the branch)`
         );
       }
       if (!completed) {
@@ -50577,8 +50820,8 @@ async function rebaseOneBranch(ctx, branchDir, branchPath) {
 }
 
 // ../canopycms/src/worker/git-sync.ts
-import fs12 from "node:fs/promises";
-import path16 from "node:path";
+import fs15 from "node:fs/promises";
+import path18 from "node:path";
 var TRASH_RETENTION_MS = 30 * 24 * 60 * 6e4;
 var TRASH_DIR_STAMP_RE = /-(\d{8}T\d{6}Z)$/;
 function parseTrashStamp(stamp) {
@@ -50742,7 +50985,7 @@ async function syncGit(ctx) {
     workerLog("Fetched from GitHub");
     const { summary: trackedSummary, trackedNames } = await reconcileTrackedBranches(ctx, git);
     await pushSettingsBranches(ctx, git, trackedNames);
-    await refreshBaseBranchWorkspace(ctx);
+    const baseRefresh = await refreshBaseBranchWorkspace(ctx);
     const rebaseSummary = await runRebaseCycle(ctx);
     await cleanupOldTasks(ctx.taskDir, void 0, ctx.log);
     const trashRemoved = await cleanupTrashedBranchDirs(ctx);
@@ -50755,9 +50998,10 @@ async function syncGit(ctx) {
     report.lastGitSync = {
       durationMs: Date.now() - cycleStartedAt,
       rebased: rebaseSummary.rebased,
-      skippedDirty: rebaseSummary.skippedDirty,
-      skippedLocked: rebaseSummary.skippedLocked,
+      skippedDirty: baseRefresh.outcome === "skipped-dirty" ? [ctx.sanitizedBaseBranch, ...rebaseSummary.skippedDirty] : rebaseSummary.skippedDirty,
+      skippedLocked: baseRefresh.outcome === "skipped-locked" ? [ctx.sanitizedBaseBranch, ...rebaseSummary.skippedLocked] : rebaseSummary.skippedLocked,
       failed: rebaseSummary.failed,
+      baseRefresh,
       tracked: trackedSummary
     };
     await writeWorkerStatus(ctx.taskDir, report).catch(
@@ -50778,7 +51022,7 @@ async function syncGit(ctx) {
 async function cleanupTrashedBranchDirs(ctx) {
   let entries;
   try {
-    entries = await fs12.readdir(ctx.contentBranchesPath);
+    entries = await fs15.readdir(ctx.contentBranchesPath);
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT") return 0;
     throw err;
@@ -50799,7 +51043,7 @@ async function cleanupTrashedBranchDirs(ctx) {
     }
     if (now - stampDate.getTime() < TRASH_RETENTION_MS) continue;
     try {
-      await fs12.rm(path16.join(ctx.contentBranchesPath, name), {
+      await fs15.rm(path18.join(ctx.contentBranchesPath, name), {
         recursive: true,
         force: true,
         maxRetries: 3,
@@ -50815,20 +51059,51 @@ async function cleanupTrashedBranchDirs(ctx) {
   }
   return removed;
 }
+var warnedTrackedCanopyState = /* @__PURE__ */ new Set();
 async function refreshBaseBranchWorkspace(ctx) {
-  const basePath37 = path16.join(ctx.contentBranchesPath, ctx.sanitizedBaseBranch);
-  const gitDir = path16.join(basePath37, ".git");
+  const basePath37 = path18.join(ctx.contentBranchesPath, ctx.sanitizedBaseBranch);
+  let trackedCanopyMeta;
+  let releaseProvisioning;
+  let releaseContentLock;
   try {
-    let gitDirStat;
-    try {
-      gitDirStat = await fs12.stat(gitDir);
-    } catch {
-      gitDirStat = null;
+    const hold = await holdProvisionedWorkspace(ctx.contentBranchesPath, ctx.sanitizedBaseBranch);
+    if (hold.kind === "locked") {
+      workerLog(
+        `Base branch workspace (${ctx.baseBranch}): provisioning lock held elsewhere, skipping refresh`
+      );
+      return { outcome: "skipped-locked" };
     }
-    if (!gitDirStat || !gitDirStat.isDirectory()) {
+    if (hold.kind === "not-provisioned") {
       workerLog(`Base branch workspace (${ctx.baseBranch}): not yet provisioned, skipping refresh`);
-      return;
+      return { outcome: "skipped-not-provisioned" };
     }
+    releaseProvisioning = hold.release;
+    let contentLockCompromised = false;
+    try {
+      releaseContentLock = await tryAcquireContentWriteLock(basePath37, (lockErr) => {
+        contentLockCompromised = true;
+        workerLogWarn(
+          `Base branch workspace (${ctx.baseBranch}): content-write lock compromised mid-refresh: ${getErrorMessage2(lockErr)}`
+        );
+      });
+    } catch (lockErr) {
+      if (isNodeError(lockErr) && lockErr.code === "ELOCKED") {
+        workerLog(
+          `Base branch workspace (${ctx.baseBranch}): content write in progress, skipping refresh`
+        );
+        return { outcome: "skipped-locked" };
+      }
+      throw lockErr;
+    }
+    const lockLost = () => {
+      if (!hold.isCompromised() && !contentLockCompromised) return null;
+      const lost = hold.isCompromised() ? "provisioning" : "content-write";
+      workerLogWarn(
+        `Base branch workspace (${ctx.baseBranch}): ${lost} lock lost mid-refresh, stopping`
+      );
+      return { outcome: "skipped-locked", trackedCanopyMeta };
+    };
+    await ensureGitExcludePattern(basePath37, `${CANOPY_META_DIR}/`);
     const baseGit = simpleGit({
       baseDir: basePath37,
       // Keep git non-interactive during the merge so it never blocks on an
@@ -50842,13 +51117,37 @@ async function refreshBaseBranchWorkspace(ctx) {
       // Inactivity-based, so a slow-but-flowing transfer is unaffected.
       timeout: { block: ctx.taskTimeoutMs }
     });
-    const status = await baseGit.status();
-    const trackedDirty = status.files.filter((f5) => f5.index !== "?" || f5.working_dir !== "?");
+    const trackedState = await listTrackedCanopyState(baseGit);
+    if (trackedState.length > 0) {
+      trackedCanopyMeta = trackedState.slice(0, MAX_REPORTED_PATHS);
+      const warnKey = `${basePath37}\0${trackedState.join("\0")}`;
+      if (!warnedTrackedCanopyState.has(warnKey)) {
+        warnedTrackedCanopyState.add(warnKey);
+        workerLogWarn(
+          `Base branch (${ctx.baseBranch}) tracks canopycms state that must not be committed: ${trackedState.join(", ")}. To fix, ${TRACKED_CANOPY_STATE_FIX}.`
+        );
+      }
+    }
+    let status = await baseGit.status();
+    const lostBeforeRestore = lockLost();
+    if (lostBeforeRestore) return lostBeforeRestore;
+    if (await restoreRetiredSchemaCache(baseGit, status)) {
+      workerLog(
+        `Base branch workspace (${ctx.baseBranch}): restored the retired in-tree schema cache`
+      );
+      status = await baseGit.status();
+    }
+    const trackedDirty = status.files.filter((f5) => !isUntracked(f5) && !isCanopyInternalPath(f5.path)).map((f5) => f5.path);
     if (trackedDirty.length > 0) {
       workerLogError(
-        `Base branch workspace (${ctx.baseBranch}) has uncommitted changes -- skipping refresh. Dirty files: ${trackedDirty.map((f5) => f5.path).join(", ")}`
+        `Base branch workspace (${ctx.baseBranch}) has uncommitted changes -- skipping refresh. Dirty files: ${trackedDirty.join(", ")}`
       );
-      return;
+      return {
+        outcome: "skipped-dirty",
+        dirtyFiles: trackedDirty.slice(0, MAX_REPORTED_PATHS),
+        message: `${trackedDirty.length} uncommitted tracked file(s) in the base branch workspace`,
+        trackedCanopyMeta
+      };
     }
     await baseGit.fetch("origin", ctx.baseBranch);
     const fetchedTip = (await baseGit.revparse(["FETCH_HEAD"])).trim();
@@ -50857,13 +51156,27 @@ async function refreshBaseBranchWorkspace(ctx) {
       10
     );
     if (behindCount > 0) {
+      const lostBeforeMerge = lockLost();
+      if (lostBeforeMerge) return lostBeforeMerge;
+      const { droppedUpstream } = await splitByUpstreamTracking(baseGit, trackedState, fetchedTip);
+      if (droppedUpstream.length > 0) {
+        await untrackInIndex(baseGit, droppedUpstream);
+        workerLog(
+          `Base branch workspace (${ctx.baseBranch}): stopped tracking ${droppedUpstream.join(", ")}, as upstream has`
+        );
+      }
       try {
         await baseGit.merge(["--ff-only", fetchedTip]);
       } catch (err) {
         workerLogError(
           `Base branch workspace (${ctx.baseBranch}) failed to fast-forward (diverged local history?): ${getErrorMessage2(err)}`
         );
-        return;
+        return {
+          outcome: "failed",
+          // [REDACT] Served to the browser by the admin panel.
+          message: redactCredentials(`failed to fast-forward: ${getErrorMessage2(err)}`),
+          trackedCanopyMeta
+        };
       }
       await invalidateBranchContentCaches(basePath37);
     }
@@ -50880,10 +51193,31 @@ async function refreshBaseBranchWorkspace(ctx) {
     workerLog(
       behindCount > 0 ? `Base branch workspace (${ctx.baseBranch}): fast-forwarded ${behindCount} commit(s)` : `Base branch workspace (${ctx.baseBranch}): up to date`
     );
+    if (trackedCanopyMeta && behindCount > 0) {
+      const stillTracked = await listTrackedCanopyState(baseGit);
+      trackedCanopyMeta = stillTracked.length > 0 ? stillTracked.slice(0, MAX_REPORTED_PATHS) : void 0;
+    }
+    return { outcome: behindCount > 0 ? "refreshed" : "up-to-date", trackedCanopyMeta };
   } catch (err) {
     workerLogError(
       `Base branch workspace (${ctx.baseBranch}) refresh failed: ${getErrorMessage2(err)}`
     );
+    return {
+      outcome: "failed",
+      message: redactCredentials(getErrorMessage2(err)),
+      trackedCanopyMeta
+    };
+  } finally {
+    if (releaseContentLock) {
+      await releaseContentLock().catch((err) => {
+        workerLogWarn(
+          `Base branch workspace (${ctx.baseBranch}): failed to release content-write lock: ${getErrorMessage2(err)}`
+        );
+      });
+    }
+    if (releaseProvisioning) {
+      await releaseProvisionedWorkspace(releaseProvisioning, ctx.sanitizedBaseBranch);
+    }
   }
 }
 
@@ -50899,15 +51233,15 @@ var CmsWorker = class {
     this.activeOperations = /* @__PURE__ */ new Set();
     this.releaseLockFn = null;
     this.log = cmsTaskQueueLogger;
-    this.taskDir = path17.join(config.workspacePath, ".tasks");
-    this.remoteGitPath = path17.join(config.workspacePath, "remote.git");
-    this.contentBranchesPath = path17.join(config.workspacePath, "content-branches");
+    this.taskDir = path19.join(config.workspacePath, ".tasks");
+    this.remoteGitPath = path19.join(config.workspacePath, "remote.git");
+    this.contentBranchesPath = path19.join(config.workspacePath, "content-branches");
     this.baseBranch = config.baseBranch ?? "main";
     this.sanitizedBaseBranch = sanitizeBranchName(this.baseBranch);
     this.maxTasksPerCycle = config.maxTasksPerCycle ?? 10;
     this.taskTimeoutMs = config.taskTimeoutMs ?? DEFAULT_TASK_TIMEOUT;
     this.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES2;
-    this.lockFilePath = path17.join(config.workspacePath, ".tasks", ".worker-lock");
+    this.lockFilePath = path19.join(config.workspacePath, ".tasks", ".worker-lock");
     this.lockStaleMs = config.lockStaleMs ?? DEFAULT_LOCK_STALE_MS;
     this.contentRoot = config.contentRoot ?? "content";
   }
@@ -50920,7 +51254,12 @@ var CmsWorker = class {
   ensureStatusReport() {
     if (!this.statusReport) {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      this.statusReport = { version: 1, startedAt: now, updatedAt: now };
+      this.statusReport = {
+        version: 1,
+        workerVersion: CANOPYCMS_VERSION,
+        startedAt: now,
+        updatedAt: now
+      };
     }
     return this.statusReport;
   }
@@ -50995,6 +51334,18 @@ var CmsWorker = class {
     workerLog("CMS Worker starting...");
     this.ensureStatusReport();
     await this.acquireLock();
+    try {
+      const lastFatalError = await readLastFatalError(this.taskDir);
+      await writeWorkerStatus(this.taskDir, {
+        ...this.ensureStatusReport(),
+        ...lastFatalError ? { lastFatalError } : {}
+      });
+    } catch (err) {
+      workerLogError(
+        "Failed to write worker status after acquiring the lock:",
+        getErrorMessage2(err)
+      );
+    }
     try {
       this.ensureSettingsBranch();
       this.ensureGitHubAuth();
@@ -51087,7 +51438,7 @@ var CmsWorker = class {
    * is negligible at the default TTL; a badly wrong clock misjudges liveness.
    */
   async acquireLock() {
-    await fs13.mkdir(this.taskDir, { recursive: true });
+    await fs16.mkdir(this.taskDir, { recursive: true });
     try {
       this.releaseLockFn = await import_proper_lockfile3.default.lock(this.taskDir, {
         lockfilePath: this.lockFilePath,
@@ -51226,7 +51577,7 @@ var CmsWorker = class {
   async ensureRemoteGit() {
     let exists2;
     try {
-      await fs13.stat(this.remoteGitPath);
+      await fs16.stat(this.remoteGitPath);
       exists2 = true;
     } catch {
       exists2 = false;
@@ -51246,19 +51597,19 @@ var CmsWorker = class {
     workerLog("Initializing remote.git from GitHub...");
     const git = simpleGit();
     const stagingPath = `${this.remoteGitPath}.cloning`;
-    await fs13.rm(stagingPath, { recursive: true, force: true });
+    await fs16.rm(stagingPath, { recursive: true, force: true });
     try {
       await git.clone(await this.buildGitHubUrl(), stagingPath, ["--bare"]);
       await this.scrubPersistedRemote(stagingPath);
       await this.verifyBaseBranchExists(stagingPath);
     } catch (err) {
       workerLogError(`remote.git clone failed: ${redactCredentials(getErrorMessage2(err))}`);
-      await fs13.rm(stagingPath, { recursive: true, force: true });
+      await fs16.rm(stagingPath, { recursive: true, force: true });
       throw new Error(
         `remote.git clone of ${this.config.githubOwner}/${this.config.githubRepo} failed or has no branch '${this.baseBranch}' - the GitHub repository may be empty, or the base branch may not exist. Push an initial commit to '${this.baseBranch}' and restart the worker (systemd will retry automatically).`
       );
     }
-    await fs13.rename(stagingPath, this.remoteGitPath);
+    await fs16.rename(stagingPath, this.remoteGitPath);
     workerLog("remote.git initialized");
   }
   // --- Task-queue cluster (worker/task-runner.ts) ------------------------
@@ -51407,7 +51758,7 @@ var CmsWorker = class {
    * sanitized.
    */
   branchWorkspacePath(branchRefName) {
-    return path17.join(this.contentBranchesPath, sanitizeBranchName(branchRefName));
+    return path19.join(this.contentBranchesPath, sanitizeBranchName(branchRefName));
   }
   /**
    * Test-only seam: awaited inside `rebaseActiveBranches()`'s conflict round,
@@ -51550,7 +51901,7 @@ var CmsWorker = class {
 };
 
 // worker/index.ts
-import path19 from "node:path";
+import path21 from "node:path";
 
 // worker/secrets.ts
 function secretsManagerClientConfig(timeouts = {}) {
@@ -56057,10 +56408,10 @@ var SessionAPI = class extends AbstractAPI {
    */
   async getToken(sessionId, template, expiresInSeconds) {
     this.requireId(sessionId);
-    const path20 = template ? joinPaths(basePath29, sessionId, "tokens", template) : joinPaths(basePath29, sessionId, "tokens");
+    const path22 = template ? joinPaths(basePath29, sessionId, "tokens", template) : joinPaths(basePath29, sessionId, "tokens");
     const requestOptions = {
       method: "POST",
-      path: path20
+      path: path22
     };
     if (expiresInSeconds !== void 0) {
       requestOptions.bodyParams = { expires_in_seconds: expiresInSeconds };
@@ -58810,12 +59161,12 @@ function buildRequest(options) {
       userAgent = USER_AGENT,
       skipApiVersionInUrl = false
     } = options;
-    const { path: path20, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
+    const { path: path22, method, queryParams, headerParams, bodyParams, formData, options: opts } = requestOptions;
     const { deepSnakecaseBodyParamKeys = false } = opts || {};
     if (requireSecretKey) {
       assertValidSecretKey(secretKey);
     }
-    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path20) : joinPaths(apiUrl, apiVersion, path20);
+    const url = skipApiVersionInUrl ? joinPaths(apiUrl, path22) : joinPaths(apiUrl, apiVersion, path22);
     const finalUrl = new URL(url);
     if (queryParams) {
       const snakecasedQueryParams = snakecase_keys_default({ ...queryParams });
@@ -60996,38 +61347,38 @@ function createClerkClient(options) {
 }
 
 // ../canopycms/src/auth/file-based-auth-cache.ts
-import fs14 from "node:fs/promises";
-import path18 from "node:path";
-var log5 = createDebugLogger({ prefix: "FileBasedAuthCache" });
+import fs17 from "node:fs/promises";
+import path20 from "node:path";
+var log6 = createDebugLogger({ prefix: "FileBasedAuthCache" });
 async function writeAuthCacheSnapshot(cachePath, files) {
-  await fs14.mkdir(cachePath, { recursive: true });
+  await fs17.mkdir(cachePath, { recursive: true });
   const timestamp2 = Date.now();
-  const snapshotDir = path18.join(cachePath, `snapshot-${timestamp2}`);
-  await fs14.mkdir(snapshotDir, { recursive: true });
+  const snapshotDir = path20.join(cachePath, `snapshot-${timestamp2}`);
+  await fs17.mkdir(snapshotDir, { recursive: true });
   for (const [fileName, data2] of Object.entries(files)) {
-    const tmpPath = path18.join(snapshotDir, `${fileName}.tmp`);
-    const finalPath = path18.join(snapshotDir, fileName);
-    await fs14.writeFile(tmpPath, JSON.stringify(data2, null, 2), "utf-8");
-    await fs14.rename(tmpPath, finalPath);
-  }
-  const currentLink = path18.join(cachePath, "current");
-  const tmpLink = path18.join(cachePath, `current-${timestamp2}`);
-  await fs14.symlink(path18.basename(snapshotDir), tmpLink);
-  await fs14.rename(tmpLink, currentLink);
+    const tmpPath = path20.join(snapshotDir, `${fileName}.tmp`);
+    const finalPath = path20.join(snapshotDir, fileName);
+    await fs17.writeFile(tmpPath, JSON.stringify(data2, null, 2), "utf-8");
+    await fs17.rename(tmpPath, finalPath);
+  }
+  const currentLink = path20.join(cachePath, "current");
+  const tmpLink = path20.join(cachePath, `current-${timestamp2}`);
+  await fs17.symlink(path20.basename(snapshotDir), tmpLink);
+  await fs17.rename(tmpLink, currentLink);
   await cleanupOldSnapshots(cachePath, 2);
   return snapshotDir;
 }
 async function cleanupOldSnapshots(cachePath, keepCount) {
   let entries;
   try {
-    entries = await fs14.readdir(cachePath);
+    entries = await fs17.readdir(cachePath);
   } catch {
     return;
   }
   const snapshots = entries.filter((e5) => e5.startsWith("snapshot-")).sort().reverse();
   for (const snapshot of snapshots.slice(keepCount)) {
     try {
-      await fs14.rm(path18.join(cachePath, snapshot), {
+      await fs17.rm(path20.join(cachePath, snapshot), {
         recursive: true,
         force: true
       });
@@ -61037,7 +61388,7 @@ async function cleanupOldSnapshots(cachePath, keepCount) {
 }
 
 // ../canopycms/src/auth/caching-auth-plugin.ts
-var log6 = createDebugLogger({ prefix: "CachingAuthPlugin" });
+var log7 = createDebugLogger({ prefix: "CachingAuthPlugin" });
 
 // ../canopycms-auth-clerk/src/cache-writer.ts
 function unwrapClerkResponse(response) {
@@ -61238,7 +61589,7 @@ async function main() {
   });
   const refreshAuthCache = createClerkAuthCacheRefresher({
     secret: clerkSecret,
-    cachePath: path19.join(workspacePath, ".cache")
+    cachePath: path21.join(workspacePath, ".cache")
   });
   const worker = new CmsWorker({
     workspacePath,