canopycms 0.0.10 → 0.0.12

package/dist/cli/generate-ai-content.js

@@ -1,13 +1,701 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// dist/paths/normalize.js
+function normalizeFilesystemPath(path13) {
+  return path13.split(/[\\/]+/).filter(Boolean).join("/");
+}
+function hasTraversalSequence(path13) {
+  const normalized = normalizeFilesystemPath(path13);
+  return normalized.includes("..");
+}
+function createLogicalPath(...segments) {
+  const normalized = segments.map((s) => normalizeFilesystemPath(s)).filter(Boolean).join("/");
+  if (hasTraversalSequence(normalized)) {
+    throw new Error(`Invalid path: contains traversal sequence: ${normalized}`);
+  }
+  return normalized;
+}
+var init_normalize = __esm({
+  "dist/paths/normalize.js"() {
+    "use strict";
+  }
+});
+
+// dist/operating-mode/client-safe-strategy.js
+function clientOperatingStrategy(mode) {
+  const cached = clientStrategyCache.get(mode);
+  if (cached)
+    return cached;
+  let strategy;
+  switch (mode) {
+    case "prod":
+      strategy = new ProdClientSafeStrategy();
+      break;
+    case "dev":
+      strategy = new DevClientSafeStrategy();
+      break;
+    default: {
+      const _exhaustive = mode;
+      throw new Error(`Unknown operating mode: ${_exhaustive}`);
+    }
+  }
+  clientStrategyCache.set(mode, strategy);
+  return strategy;
+}
+function clearClientStrategyCache() {
+  clientStrategyCache.clear();
+}
+var ProdClientSafeStrategy, DevClientSafeStrategy, clientStrategyCache;
+var init_client_safe_strategy = __esm({
+  "dist/operating-mode/client-safe-strategy.js"() {
+    "use strict";
+    ProdClientSafeStrategy = class {
+      constructor() {
+        this.mode = "prod";
+      }
+      // UI Feature Flags
+      supportsBranching() {
+        return true;
+      }
+      supportsStatusBadge() {
+        return true;
+      }
+      supportsComments() {
+        return true;
+      }
+      supportsPullRequests() {
+        return true;
+      }
+      // Simple Data
+      getPermissionsFileName() {
+        return "permissions.json";
+      }
+      getGroupsFileName() {
+        return "groups.json";
+      }
+      shouldCommit() {
+        return true;
+      }
+      shouldPush() {
+        return true;
+      }
+    };
+    DevClientSafeStrategy = class {
+      constructor() {
+        this.mode = "dev";
+      }
+      // UI Feature Flags
+      supportsBranching() {
+        return true;
+      }
+      supportsStatusBadge() {
+        return true;
+      }
+      supportsComments() {
+        return true;
+      }
+      supportsPullRequests() {
+        return false;
+      }
+      // Simple Data
+      getPermissionsFileName() {
+        return "permissions.json";
+      }
+      getGroupsFileName() {
+        return "groups.json";
+      }
+      shouldCommit() {
+        return true;
+      }
+      shouldPush() {
+        return true;
+      }
+    };
+    clientStrategyCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// dist/config/types.js
+var primitiveFieldTypes, fieldTypes;
+var init_types = __esm({
+  "dist/config/types.js"() {
+    "use strict";
+    primitiveFieldTypes = [
+      "string",
+      "number",
+      "boolean",
+      "datetime",
+      "rich-text",
+      "markdown",
+      "mdx",
+      "image",
+      "code"
+    ];
+    fieldTypes = [
+      ...primitiveFieldTypes,
+      "select",
+      "reference",
+      "object",
+      "block"
+    ];
+  }
+});
+
+// dist/config/schemas/field.js
+import { z } from "zod";
+var fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema;
+var init_field = __esm({
+  "dist/config/schemas/field.js"() {
+    "use strict";
+    init_types();
+    fieldBaseSchema = z.object({
+      name: z.string().min(1),
+      label: z.string().optional(),
+      description: z.string().optional(),
+      required: z.boolean().optional(),
+      list: z.boolean().optional()
+    });
+    selectOptionSchema = z.union([
+      z.string(),
+      z.object({
+        label: z.string().min(1),
+        value: z.string().min(1)
+      })
+    ]);
+    referenceOptionSchema = z.union([
+      z.string(),
+      z.object({
+        label: z.string().min(1),
+        value: z.string().min(1)
+      })
+    ]);
+    primitiveFieldSchema = fieldBaseSchema.extend({
+      type: z.enum(primitiveFieldTypes)
+    });
+    selectFieldSchema = fieldBaseSchema.extend({
+      type: z.literal("select"),
+      options: z.array(selectOptionSchema).min(1)
+    });
+    referenceFieldSchema = fieldBaseSchema.extend({
+      type: z.literal("reference"),
+      collections: z.array(z.string().min(1)).min(1),
+      displayField: z.string().min(1).optional(),
+      options: z.array(referenceOptionSchema).optional()
+    });
+    fieldHolder = [z.never()];
+    blockSchema = z.object({
+      name: z.string().min(1),
+      label: z.string().optional(),
+      description: z.string().optional(),
+      fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+    });
+    blockFieldSchema = fieldBaseSchema.extend({
+      type: z.literal("block"),
+      templates: z.array(blockSchema).min(1)
+    });
+    objectFieldSchema = fieldBaseSchema.extend({
+      type: z.literal("object"),
+      fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+    });
+    customFieldSchema = z.lazy(() => fieldBaseSchema.extend({
+      type: z.string().min(1).refine((val) => !fieldTypes.includes(val), {
+        message: "Custom field types must not conflict with built-in types"
+      })
+    }).passthrough());
+    knownFieldSchema = z.discriminatedUnion("type", [
+      primitiveFieldSchema,
+      selectFieldSchema,
+      referenceFieldSchema,
+      objectFieldSchema,
+      blockFieldSchema
+    ]);
+    fieldSchema = z.lazy(() => z.union([knownFieldSchema, customFieldSchema]));
+    fieldHolder[0] = fieldSchema;
+  }
+});
+
+// dist/config/schemas/collection.js
+import { z as z2 } from "zod";
+import { isAbsolute } from "pathe";
+var relativePathSchema, entryTypeSchema, collectionSchema, rootCollectionSchema;
+var init_collection = __esm({
+  "dist/config/schemas/collection.js"() {
+    "use strict";
+    init_field();
+    relativePathSchema = z2.string().min(1).refine((val) => !isAbsolute(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
+      message: 'Path must not contain ".."'
+    }).transform((val) => val.split(/[\\/]+/).filter(Boolean).join("/"));
+    entryTypeSchema = z2.object({
+      name: z2.string().min(1),
+      format: z2.enum(["md", "mdx", "json"]),
+      schema: z2.array(z2.lazy(() => fieldSchema)).min(1),
+      label: z2.string().optional(),
+      description: z2.string().optional(),
+      default: z2.boolean().optional(),
+      maxItems: z2.number().int().positive().optional()
+    });
+    collectionSchema = z2.lazy(() => z2.object({
+      name: z2.string().min(1),
+      path: relativePathSchema,
+      label: z2.string().optional(),
+      description: z2.string().optional(),
+      entries: z2.array(entryTypeSchema).optional(),
+      collections: z2.array(collectionSchema).optional(),
+      order: z2.array(z2.string()).optional()
+      // Embedded IDs for ordering items
+    }).refine((data) => data.entries || data.collections, {
+      message: "Collection must have entries or collections"
+    }));
+    rootCollectionSchema = z2.object({
+      entries: z2.array(entryTypeSchema).optional(),
+      collections: z2.array(collectionSchema).optional(),
+      order: z2.array(z2.string()).optional()
+      // Embedded IDs for ordering items
+    });
+  }
+});
+
+// dist/config/schemas/media.js
+import { z as z3 } from "zod";
+var mediaSchema;
+var init_media = __esm({
+  "dist/config/schemas/media.js"() {
+    "use strict";
+    mediaSchema = z3.union([
+      z3.object({
+        adapter: z3.literal("local"),
+        publicBaseUrl: z3.string().url().optional()
+      }),
+      z3.object({
+        adapter: z3.literal("s3"),
+        bucket: z3.string().min(1),
+        region: z3.string().min(1),
+        publicBaseUrl: z3.string().url().optional()
+      }),
+      z3.object({
+        adapter: z3.literal("lfs"),
+        publicBaseUrl: z3.string().url().optional()
+      }),
+      z3.object({
+        adapter: z3.string().min(1),
+        publicBaseUrl: z3.string().url().optional()
+      })
+    ]);
+  }
+});
+
+// dist/config/schemas/config.js
+import { z as z4 } from "zod";
+var defaultBranchAccessSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE;
+var init_config = __esm({
+  "dist/config/schemas/config.js"() {
+    "use strict";
+    init_collection();
+    init_media();
+    defaultBranchAccessSchema = z4.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessSchema = z4.enum(["allow", "deny"]).default("deny");
+    defaultBaseBranchSchema = z4.string().default("main");
+    defaultRemoteNameSchema = z4.string().default("origin");
+    defaultRemoteUrlSchema = z4.string().min(1);
+    gitBotAuthorNameSchema = z4.string().min(1);
+    gitBotAuthorEmailSchema = z4.string().email();
+    githubTokenEnvVarSchema = z4.string().default("GITHUB_BOT_TOKEN");
+    operatingModeSchema = z4.enum(["prod", "dev"]).default("dev");
+    deployedAsSchema = z4.enum(["static", "server"]).default("server");
+    contentRootSchema = relativePathSchema.default("content");
+    sourceRootSchema = z4.string().min(1).optional();
+    deploymentNameSchema = z4.string().default("prod");
+    editorConfigSchema = z4.object({
+      title: z4.string().optional(),
+      subtitle: z4.string().optional(),
+      theme: z4.unknown().optional(),
+      previewBase: z4.record(z4.string()).optional(),
+      // UI handler functions (runtime only, don't serialize)
+      onAccountClick: z4.function().returns(z4.void()).optional(),
+      onLogoutClick: z4.function().returns(z4.void()).optional(),
+      // Optional: custom account component (e.g., Clerk's UserButton)
+      AccountComponent: z4.custom().optional()
+    });
+    CanopyConfigSchema = z4.object({
+      schema: rootCollectionSchema.optional(),
+      media: mediaSchema.optional(),
+      defaultBranchAccess: defaultBranchAccessSchema.optional(),
+      defaultPathAccess: defaultPathAccessSchema.optional(),
+      defaultBaseBranch: defaultBaseBranchSchema.optional(),
+      defaultRemoteName: defaultRemoteNameSchema.optional(),
+      defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
+      gitBotAuthorName: gitBotAuthorNameSchema,
+      gitBotAuthorEmail: gitBotAuthorEmailSchema,
+      githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
+      mode: operatingModeSchema,
+      // Has .default(), so not optional in output type
+      deployedAs: deployedAsSchema,
+      // Has .default('server'), so always present after validation
+      settingsBranch: z4.string().optional(),
+      autoCreateSettingsPR: z4.boolean().optional(),
+      deploymentName: deploymentNameSchema.optional(),
+      contentRoot: contentRootSchema.default("content"),
+      sourceRoot: sourceRootSchema.optional(),
+      editor: editorConfigSchema.optional(),
+      authPlugin: z4.custom().optional()
+    });
+    DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
+  }
+});
+
+// dist/config/schemas/permissions.js
+import { z as z5 } from "zod";
+var permissionTargetSchema, pathPermissionSchema;
+var init_permissions = __esm({
+  "dist/config/schemas/permissions.js"() {
+    "use strict";
+    permissionTargetSchema = z5.object({
+      allowedUsers: z5.array(z5.string()).optional(),
+      allowedGroups: z5.array(z5.string()).optional()
+    });
+    pathPermissionSchema = z5.object({
+      path: z5.string().min(1),
+      read: permissionTargetSchema.optional(),
+      edit: permissionTargetSchema.optional(),
+      review: permissionTargetSchema.optional()
+    });
+  }
+});
+
+// dist/paths/types.js
+var ROOT_COLLECTION_ID;
+var init_types2 = __esm({
+  "dist/paths/types.js"() {
+    "use strict";
+    ROOT_COLLECTION_ID = "__rootcoll__";
+  }
+});
+
+// dist/config/flatten.js
+import { join, normalize } from "pathe";
+var normalizePathValue, flattenSchema;
+var init_flatten = __esm({
+  "dist/config/flatten.js"() {
+    "use strict";
+    init_normalize();
+    init_types2();
+    normalizePathValue = (val) => normalize(val).split("/").filter(Boolean).join("/");
+    flattenSchema = (root, basePath = "") => {
+      const flat = [];
+      const base = normalizePathValue(basePath || "");
+      const walkCollection = (collection, parentPath) => {
+        const normalizedPath = normalizePathValue(collection.path);
+        let logicalPath;
+        if (parentPath && parentPath !== base) {
+          logicalPath = join(parentPath, collection.name);
+        } else if (parentPath === base) {
+          logicalPath = join(base, normalizedPath);
+        } else {
+          logicalPath = normalizedPath;
+        }
+        const normalizedFull = normalizePathValue(logicalPath);
+        flat.push({
+          type: "collection",
+          logicalPath: createLogicalPath(normalizedFull),
+          name: collection.name,
+          label: collection.label,
+          description: collection.description,
+          contentId: collection.contentId,
+          parentPath: parentPath ? createLogicalPath(parentPath) : void 0,
+          entries: collection.entries,
+          collections: collection.collections,
+          order: collection.order
+        });
+        if (collection.entries) {
+          for (const entryType of collection.entries) {
+            const entryTypePath = join(normalizedFull, entryType.name);
+            flat.push({
+              type: "entry-type",
+              logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
+              name: entryType.name,
+              label: entryType.label,
+              description: entryType.description,
+              parentPath: createLogicalPath(normalizedFull),
+              format: entryType.format,
+              schema: entryType.schema,
+              schemaRef: entryType.schemaRef,
+              default: entryType.default,
+              maxItems: entryType.maxItems
+            });
+          }
+        }
+        if (collection.collections) {
+          for (const child of collection.collections) {
+            walkCollection(child, normalizedFull);
+          }
+        }
+      };
+      if (base) {
+        flat.push({
+          type: "collection",
+          logicalPath: createLogicalPath(base),
+          name: base,
+          // Use base path as the name (e.g., 'content')
+          label: void 0,
+          // Root collection has no label
+          contentId: ROOT_COLLECTION_ID,
+          // Sentinel — root dir has no embedded ID
+          parentPath: void 0,
+          // No parent - this is the root
+          entries: root.entries,
+          collections: root.collections,
+          order: root.order
+        });
+      }
+      if (root.entries) {
+        for (const entryType of root.entries) {
+          const entryTypePath = base ? join(base, entryType.name) : entryType.name;
+          flat.push({
+            type: "entry-type",
+            logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
+            name: entryType.name,
+            label: entryType.label,
+            description: entryType.description,
+            parentPath: base ? createLogicalPath(base) : createLogicalPath(""),
+            // Now references the root collection (e.g., 'content')
+            format: entryType.format,
+            schema: entryType.schema,
+            schemaRef: entryType.schemaRef,
+            default: entryType.default,
+            maxItems: entryType.maxItems
+          });
+        }
+      }
+      if (root.collections) {
+        for (const collection of root.collections) {
+          walkCollection(collection, base || "");
+        }
+      }
+      return flat;
+    };
+  }
+});
+
+// dist/config/validation.js
+var init_validation = __esm({
+  "dist/config/validation.js"() {
+    "use strict";
+    init_config();
+    init_flatten();
+  }
+});
+
+// dist/config/helpers.js
+var init_helpers = __esm({
+  "dist/config/helpers.js"() {
+    "use strict";
+    init_validation();
+  }
+});
+
+// dist/config/index.js
+var init_config2 = __esm({
+  "dist/config/index.js"() {
+    "use strict";
+    init_types();
+    init_config();
+    init_field();
+    init_collection();
+    init_permissions();
+    init_media();
+    init_flatten();
+    init_validation();
+    init_helpers();
+  }
+});
+
+// dist/config.js
+var init_config3 = __esm({
+  "dist/config.js"() {
+    "use strict";
+    init_config2();
+  }
+});
+
+// dist/operating-mode/client-unsafe-strategy.js
+import path3 from "node:path";
+function operatingStrategy(mode) {
+  const cached = strategyCache.get(mode);
+  if (cached)
+    return cached;
+  let strategy;
+  switch (mode) {
+    case "prod":
+      strategy = new ProdStrategy();
+      break;
+    case "dev":
+      strategy = new DevStrategy();
+      break;
+    default: {
+      const _exhaustive = mode;
+      throw new Error(`Unknown operating mode: ${_exhaustive}`);
+    }
+  }
+  strategyCache.set(mode, strategy);
+  return strategy;
+}
+function clearStrategyCache() {
+  strategyCache.clear();
+}
+var ProdStrategy, DevStrategy, strategyCache;
+var init_client_unsafe_strategy = __esm({
+  "dist/operating-mode/client-unsafe-strategy.js"() {
+    "use strict";
+    init_client_safe_strategy();
+    init_config3();
+    ProdStrategy = class extends ProdClientSafeStrategy {
+      // All client-safe methods inherited automatically from ProdClientSafeStrategy:
+      // - mode, supportsBranching(), supportsStatusBadge(), supportsComments()
+      // - supportsPullRequests(), getPermissionsFileName(), getGroupsFileName()
+      // - shouldCommit(), shouldPush()
+      // Add client-unsafe methods (use Node.js APIs)
+      getWorkspaceRoot(_sourceRoot) {
+        return path3.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
+      }
+      getContentRoot(sourceRoot) {
+        return path3.resolve(sourceRoot ?? process.cwd(), "content");
+      }
+      getContentBranchesRoot(sourceRoot) {
+        return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+      }
+      getContentBranchRoot(branchName, sourceRoot) {
+        return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+      }
+      getGitExcludePattern() {
+        return ".canopy-meta/";
+      }
+      getPermissionsFilePath(root) {
+        return path3.join(root, this.getPermissionsFileName());
+      }
+      getGroupsFilePath(root) {
+        return path3.join(root, this.getGroupsFileName());
+      }
+      getRemoteUrlConfig() {
+        return {
+          shouldAutoInitLocal: false,
+          defaultRemotePath: "",
+          envVarName: "CANOPYCMS_REMOTE_URL",
+          autoDetectRemotePath: path3.join(this.getWorkspaceRoot(), "remote.git")
+        };
+      }
+      requiresExistingRepo() {
+        return false;
+      }
+      getSettingsBranchName(config) {
+        if (config.settingsBranch)
+          return config.settingsBranch;
+        const deploymentName = config.deploymentName ?? "prod";
+        return `canopycms-settings-${deploymentName}`;
+      }
+      getSettingsRoot(sourceRoot) {
+        return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
+      }
+      usesSeparateSettingsBranch() {
+        return true;
+      }
+      validateConfig(config) {
+        if (!config.gitBotAuthorName || !config.gitBotAuthorEmail) {
+          throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
+        }
+      }
+      shouldCreateSettingsPR(config) {
+        return config.autoCreateSettingsPR ?? true;
+      }
+    };
+    DevStrategy = class extends DevClientSafeStrategy {
+      // Inherits client-safe methods from DevClientSafeStrategy
+      getWorkspaceRoot(sourceRoot) {
+        return path3.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
+      }
+      getContentRoot(sourceRoot) {
+        return path3.resolve(sourceRoot ?? process.cwd(), "content");
+      }
+      getContentBranchesRoot(sourceRoot) {
+        return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+      }
+      getContentBranchRoot(branchName, sourceRoot) {
+        return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+      }
+      getGitExcludePattern() {
+        return ".canopy-meta/";
+      }
+      getPermissionsFilePath(root) {
+        return path3.join(root, this.getPermissionsFileName());
+      }
+      getGroupsFilePath(root) {
+        return path3.join(root, this.getGroupsFileName());
+      }
+      getRemoteUrlConfig() {
+        return {
+          shouldAutoInitLocal: true,
+          defaultRemotePath: ".canopy-dev/remote.git",
+          envVarName: "CANOPYCMS_REMOTE_URL"
+        };
+      }
+      requiresExistingRepo() {
+        return false;
+      }
+      getSettingsBranchName(config) {
+        if (config.settingsBranch)
+          return config.settingsBranch;
+        const deploymentName = config.deploymentName ?? "local";
+        return `canopycms-settings-${deploymentName}`;
+      }
+      getSettingsRoot(sourceRoot) {
+        return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
+      }
+      usesSeparateSettingsBranch() {
+        return true;
+      }
+      validateConfig(_config) {
+      }
+      shouldCreateSettingsPR(_config) {
+        return false;
+      }
+    };
+    strategyCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// dist/operating-mode/index.js
+var operating_mode_exports = {};
+__export(operating_mode_exports, {
+  clearClientStrategyCache: () => clearClientStrategyCache,
+  clearStrategyCache: () => clearStrategyCache,
+  clientOperatingStrategy: () => clientOperatingStrategy,
+  operatingStrategy: () => operatingStrategy
+});
+var init_operating_mode = __esm({
+  "dist/operating-mode/index.js"() {
+    "use strict";
+    init_client_safe_strategy();
+    init_client_unsafe_strategy();
+  }
+});
+
 // dist/cli/generate-ai-content.js
-import path11 from "node:path";
+import path12 from "node:path";
 import { createJiti } from "jiti";
 
 // dist/build/generate-ai-content.js
-import fs8 from "node:fs/promises";
-import path10 from "node:path";
+import fs10 from "node:fs/promises";
+import path11 from "node:path";
 
 // dist/content-store.js
-import fs3 from "node:fs/promises";
+import fs4 from "node:fs/promises";
 import path5 from "node:path";
 import matter from "gray-matter";
 
@@ -35,23 +723,8 @@ import path2 from "node:path";
 // dist/id.js
 import { generate } from "short-uuid";
 
-// dist/paths/normalize.js
-function normalizeFilesystemPath(path12) {
-  return path12.split(/[\\/]+/).filter(Boolean).join("/");
-}
-function hasTraversalSequence(path12) {
-  const normalized = normalizeFilesystemPath(path12);
-  return normalized.includes("..");
-}
-function createLogicalPath(...segments) {
-  const normalized = segments.map((s) => normalizeFilesystemPath(s)).filter(Boolean).join("/");
-  if (hasTraversalSequence(normalized)) {
-    throw new Error(`Invalid path: contains traversal sequence: ${normalized}`);
-  }
-  return normalized;
-}
-
 // dist/paths/validation.js
+init_normalize();
 var BASE58_PATTERN = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
 var CONTENT_ID_PATTERN = new RegExp(`^${BASE58_PATTERN}{12}$`);
 var PHYSICAL_SEGMENT_PATTERN = new RegExp(`\\.${BASE58_PATTERN}{12}(?:\\.[a-z]+)?$`);
@@ -301,13 +974,13 @@ function extractIdFromFilename(filename) {
   return null;
 }
 async function resolveCollectionPath(root, logicalPath) {
-  const fs9 = await import("node:fs/promises");
-  const path12 = await import("node:path");
+  const fs11 = await import("node:fs/promises");
+  const path13 = await import("node:path");
   const segments = logicalPath.split("/").filter(Boolean);
   let currentPath = root;
   for (const segment of segments) {
     try {
-      const entries = await fs9.readdir(currentPath, { withFileTypes: true });
+      const entries = await fs11.readdir(currentPath, { withFileTypes: true });
       const matchingDir = entries.find((entry) => {
         if (!entry.isDirectory())
           return false;
@@ -315,7 +988,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return logicalName === segment;
       });
       if (matchingDir) {
-        currentPath = path12.join(currentPath, matchingDir.name);
+        currentPath = path13.join(currentPath, matchingDir.name);
       } else {
         return null;
       }
@@ -362,617 +1035,25 @@ function extractSlugFromFilename(filename, entryTypeName) {
   if (parts.length > 1) {
     return parts.slice(0, -1).join(".");
   }
-  return filename;
-}
-
-// dist/utils/format.js
-var getFormatExtension = (format) => {
-  if (format === "md")
-    return ".md";
-  if (format === "mdx")
-    return ".mdx";
-  return ".json";
-};
-
-// dist/paths/branch.js
-import path4 from "node:path";
-
-// dist/operating-mode/client-safe-strategy.js
-var ProdClientSafeStrategy = class {
-  constructor() {
-    this.mode = "prod";
-  }
-  // UI Feature Flags
-  supportsBranching() {
-    return true;
-  }
-  supportsStatusBadge() {
-    return true;
-  }
-  supportsComments() {
-    return true;
-  }
-  supportsPullRequests() {
-    return true;
-  }
-  // Simple Data
-  getPermissionsFileName() {
-    return "permissions.json";
-  }
-  getGroupsFileName() {
-    return "groups.json";
-  }
-  shouldCommit() {
-    return true;
-  }
-  shouldPush() {
-    return true;
-  }
-};
-var LocalProdSimClientSafeStrategy = class {
-  constructor() {
-    this.mode = "prod-sim";
-  }
-  // UI Feature Flags
-  supportsBranching() {
-    return true;
-  }
-  supportsStatusBadge() {
-    return true;
-  }
-  supportsComments() {
-    return true;
-  }
-  supportsPullRequests() {
-    return false;
-  }
-  // Simple Data
-  getPermissionsFileName() {
-    return "permissions.json";
-  }
-  getGroupsFileName() {
-    return "groups.json";
-  }
-  shouldCommit() {
-    return true;
-  }
-  shouldPush() {
-    return true;
-  }
-};
-var LocalSimpleClientSafeStrategy = class {
-  constructor() {
-    this.mode = "dev";
-  }
-  // UI Feature Flags
-  supportsBranching() {
-    return false;
-  }
-  supportsStatusBadge() {
-    return false;
-  }
-  supportsComments() {
-    return false;
-  }
-  supportsPullRequests() {
-    return false;
-  }
-  // Simple Data
-  getPermissionsFileName() {
-    return "permissions.json";
-  }
-  getGroupsFileName() {
-    return "groups.json";
-  }
-  shouldCommit() {
-    return false;
-  }
-  shouldPush() {
-    return false;
-  }
-};
-
-// dist/operating-mode/client-unsafe-strategy.js
-import path3 from "node:path";
-
-// dist/config/types.js
-var primitiveFieldTypes = [
-  "string",
-  "number",
-  "boolean",
-  "datetime",
-  "rich-text",
-  "markdown",
-  "mdx",
-  "image",
-  "code"
-];
-var fieldTypes = [
-  ...primitiveFieldTypes,
-  "select",
-  "reference",
-  "object",
-  "block"
-];
-
-// dist/config/schemas/config.js
-import { z as z4 } from "zod";
-
-// dist/config/schemas/collection.js
-import { z as z2 } from "zod";
-import { isAbsolute } from "pathe";
-
-// dist/config/schemas/field.js
-import { z } from "zod";
-var fieldBaseSchema = z.object({
-  name: z.string().min(1),
-  label: z.string().optional(),
-  description: z.string().optional(),
-  required: z.boolean().optional(),
-  list: z.boolean().optional()
-});
-var selectOptionSchema = z.union([
-  z.string(),
-  z.object({
-    label: z.string().min(1),
-    value: z.string().min(1)
-  })
-]);
-var referenceOptionSchema = z.union([
-  z.string(),
-  z.object({
-    label: z.string().min(1),
-    value: z.string().min(1)
-  })
-]);
-var primitiveFieldSchema = fieldBaseSchema.extend({
-  type: z.enum(primitiveFieldTypes)
-});
-var selectFieldSchema = fieldBaseSchema.extend({
-  type: z.literal("select"),
-  options: z.array(selectOptionSchema).min(1)
-});
-var referenceFieldSchema = fieldBaseSchema.extend({
-  type: z.literal("reference"),
-  collections: z.array(z.string().min(1)).min(1),
-  displayField: z.string().min(1).optional(),
-  options: z.array(referenceOptionSchema).optional()
-});
-var fieldHolder = [z.never()];
-var blockSchema = z.object({
-  name: z.string().min(1),
-  label: z.string().optional(),
-  description: z.string().optional(),
-  fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
-});
-var blockFieldSchema = fieldBaseSchema.extend({
-  type: z.literal("block"),
-  templates: z.array(blockSchema).min(1)
-});
-var objectFieldSchema = fieldBaseSchema.extend({
-  type: z.literal("object"),
-  fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
-});
-var customFieldSchema = z.lazy(() => fieldBaseSchema.extend({
-  type: z.string().min(1).refine((val) => !fieldTypes.includes(val), {
-    message: "Custom field types must not conflict with built-in types"
-  })
-}).passthrough());
-var knownFieldSchema = z.discriminatedUnion("type", [
-  primitiveFieldSchema,
-  selectFieldSchema,
-  referenceFieldSchema,
-  objectFieldSchema,
-  blockFieldSchema
-]);
-var fieldSchema = z.lazy(() => z.union([knownFieldSchema, customFieldSchema]));
-fieldHolder[0] = fieldSchema;
-
-// dist/config/schemas/collection.js
-var relativePathSchema = z2.string().min(1).refine((val) => !isAbsolute(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
-  message: 'Path must not contain ".."'
-}).transform((val) => val.split(/[\\/]+/).filter(Boolean).join("/"));
-var entryTypeSchema = z2.object({
-  name: z2.string().min(1),
-  format: z2.enum(["md", "mdx", "json"]),
-  schema: z2.array(z2.lazy(() => fieldSchema)).min(1),
-  label: z2.string().optional(),
-  description: z2.string().optional(),
-  default: z2.boolean().optional(),
-  maxItems: z2.number().int().positive().optional()
-});
-var collectionSchema = z2.lazy(() => z2.object({
-  name: z2.string().min(1),
-  path: relativePathSchema,
-  label: z2.string().optional(),
-  description: z2.string().optional(),
-  entries: z2.array(entryTypeSchema).optional(),
-  collections: z2.array(collectionSchema).optional(),
-  order: z2.array(z2.string()).optional()
-  // Embedded IDs for ordering items
-}).refine((data) => data.entries || data.collections, {
-  message: "Collection must have entries or collections"
-}));
-var rootCollectionSchema = z2.object({
-  entries: z2.array(entryTypeSchema).optional(),
-  collections: z2.array(collectionSchema).optional(),
-  order: z2.array(z2.string()).optional()
-  // Embedded IDs for ordering items
-});
-
-// dist/config/schemas/media.js
-import { z as z3 } from "zod";
-var mediaSchema = z3.union([
-  z3.object({
-    adapter: z3.literal("local"),
-    publicBaseUrl: z3.string().url().optional()
-  }),
-  z3.object({
-    adapter: z3.literal("s3"),
-    bucket: z3.string().min(1),
-    region: z3.string().min(1),
-    publicBaseUrl: z3.string().url().optional()
-  }),
-  z3.object({
-    adapter: z3.literal("lfs"),
-    publicBaseUrl: z3.string().url().optional()
-  }),
-  z3.object({
-    adapter: z3.string().min(1),
-    publicBaseUrl: z3.string().url().optional()
-  })
-]);
-
-// dist/config/schemas/config.js
-var defaultBranchAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-var defaultPathAccessSchema = z4.enum(["allow", "deny"]).default("deny");
-var defaultBaseBranchSchema = z4.string().default("main");
-var defaultRemoteNameSchema = z4.string().default("origin");
-var defaultRemoteUrlSchema = z4.string().min(1);
-var gitBotAuthorNameSchema = z4.string().min(1);
-var gitBotAuthorEmailSchema = z4.string().email();
-var githubTokenEnvVarSchema = z4.string().default("GITHUB_BOT_TOKEN");
-var operatingModeSchema = z4.enum(["prod", "prod-sim", "dev"]).default("dev");
-var deployedAsSchema = z4.enum(["static", "server"]).default("server");
-var contentRootSchema = relativePathSchema.default("content");
-var sourceRootSchema = z4.string().min(1).optional();
-var deploymentNameSchema = z4.string().default("prod");
-var editorConfigSchema = z4.object({
-  title: z4.string().optional(),
-  subtitle: z4.string().optional(),
-  theme: z4.unknown().optional(),
-  previewBase: z4.record(z4.string()).optional(),
-  // UI handler functions (runtime only, don't serialize)
-  onAccountClick: z4.function().returns(z4.void()).optional(),
-  onLogoutClick: z4.function().returns(z4.void()).optional(),
-  // Optional: custom account component (e.g., Clerk's UserButton)
-  AccountComponent: z4.custom().optional()
-});
-var CanopyConfigSchema = z4.object({
-  schema: rootCollectionSchema.optional(),
-  media: mediaSchema.optional(),
-  defaultBranchAccess: defaultBranchAccessSchema.optional(),
-  defaultPathAccess: defaultPathAccessSchema.optional(),
-  defaultBaseBranch: defaultBaseBranchSchema.optional(),
-  defaultRemoteName: defaultRemoteNameSchema.optional(),
-  defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
-  gitBotAuthorName: gitBotAuthorNameSchema,
-  gitBotAuthorEmail: gitBotAuthorEmailSchema,
-  githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
-  mode: operatingModeSchema,
-  // Has .default(), so not optional in output type
-  deployedAs: deployedAsSchema,
-  // Has .default('server'), so always present after validation
-  settingsBranch: z4.string().optional(),
-  autoCreateSettingsPR: z4.boolean().optional(),
-  deploymentName: deploymentNameSchema.optional(),
-  contentRoot: contentRootSchema.default("content"),
-  sourceRoot: sourceRootSchema.optional(),
-  editor: editorConfigSchema.optional(),
-  authPlugin: z4.custom().optional()
-});
-var DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
-
-// dist/config/schemas/permissions.js
-import { z as z5 } from "zod";
-var permissionTargetSchema = z5.object({
-  allowedUsers: z5.array(z5.string()).optional(),
-  allowedGroups: z5.array(z5.string()).optional()
-});
-var pathPermissionSchema = z5.object({
-  path: z5.string().min(1),
-  read: permissionTargetSchema.optional(),
-  edit: permissionTargetSchema.optional(),
-  review: permissionTargetSchema.optional()
-});
-
-// dist/config/flatten.js
-import { join, normalize } from "pathe";
-
-// dist/paths/types.js
-var ROOT_COLLECTION_ID = "__rootcoll__";
-
-// dist/config/flatten.js
-var normalizePathValue = (val) => normalize(val).split("/").filter(Boolean).join("/");
-var flattenSchema = (root, basePath = "") => {
-  const flat = [];
-  const base = normalizePathValue(basePath || "");
-  const walkCollection = (collection, parentPath) => {
-    const normalizedPath = normalizePathValue(collection.path);
-    let logicalPath;
-    if (parentPath && parentPath !== base) {
-      logicalPath = join(parentPath, collection.name);
-    } else if (parentPath === base) {
-      logicalPath = join(base, normalizedPath);
-    } else {
-      logicalPath = normalizedPath;
-    }
-    const normalizedFull = normalizePathValue(logicalPath);
-    flat.push({
-      type: "collection",
-      logicalPath: createLogicalPath(normalizedFull),
-      name: collection.name,
-      label: collection.label,
-      description: collection.description,
-      contentId: collection.contentId,
-      parentPath: parentPath ? createLogicalPath(parentPath) : void 0,
-      entries: collection.entries,
-      collections: collection.collections,
-      order: collection.order
-    });
-    if (collection.entries) {
-      for (const entryType of collection.entries) {
-        const entryTypePath = join(normalizedFull, entryType.name);
-        flat.push({
-          type: "entry-type",
-          logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
-          name: entryType.name,
-          label: entryType.label,
-          description: entryType.description,
-          parentPath: createLogicalPath(normalizedFull),
-          format: entryType.format,
-          schema: entryType.schema,
-          schemaRef: entryType.schemaRef,
-          default: entryType.default,
-          maxItems: entryType.maxItems
-        });
-      }
-    }
-    if (collection.collections) {
-      for (const child of collection.collections) {
-        walkCollection(child, normalizedFull);
-      }
-    }
-  };
-  if (base) {
-    flat.push({
-      type: "collection",
-      logicalPath: createLogicalPath(base),
-      name: base,
-      // Use base path as the name (e.g., 'content')
-      label: void 0,
-      // Root collection has no label
-      contentId: ROOT_COLLECTION_ID,
-      // Sentinel — root dir has no embedded ID
-      parentPath: void 0,
-      // No parent - this is the root
-      entries: root.entries,
-      collections: root.collections,
-      order: root.order
-    });
-  }
-  if (root.entries) {
-    for (const entryType of root.entries) {
-      const entryTypePath = base ? join(base, entryType.name) : entryType.name;
-      flat.push({
-        type: "entry-type",
-        logicalPath: createLogicalPath(normalizePathValue(entryTypePath)),
-        name: entryType.name,
-        label: entryType.label,
-        description: entryType.description,
-        parentPath: base ? createLogicalPath(base) : createLogicalPath(""),
-        // Now references the root collection (e.g., 'content')
-        format: entryType.format,
-        schema: entryType.schema,
-        schemaRef: entryType.schemaRef,
-        default: entryType.default,
-        maxItems: entryType.maxItems
-      });
-    }
-  }
-  if (root.collections) {
-    for (const collection of root.collections) {
-      walkCollection(collection, base || "");
-    }
-  }
-  return flat;
-};
-
-// dist/operating-mode/client-unsafe-strategy.js
-var ProdStrategy = class extends ProdClientSafeStrategy {
-  // All client-safe methods inherited automatically from ProdClientSafeStrategy:
-  // - mode, supportsBranching(), supportsStatusBadge(), supportsComments()
-  // - supportsPullRequests(), getPermissionsFileName(), getGroupsFileName()
-  // - shouldCommit(), shouldPush()
-  // Add client-unsafe methods (use Node.js APIs)
-  getWorkspaceRoot(_sourceRoot) {
-    return path3.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
-  }
-  getContentRoot(sourceRoot) {
-    return path3.resolve(sourceRoot ?? process.cwd(), "content");
-  }
-  getContentBranchesRoot(sourceRoot) {
-    return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
-  }
-  getContentBranchRoot(branchName, sourceRoot) {
-    return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
-  }
-  getGitExcludePattern() {
-    return ".canopy-meta/";
-  }
-  getPermissionsFilePath(root) {
-    return path3.join(root, this.getPermissionsFileName());
-  }
-  getGroupsFilePath(root) {
-    return path3.join(root, this.getGroupsFileName());
-  }
-  getRemoteUrlConfig() {
-    return {
-      shouldAutoInitLocal: false,
-      defaultRemotePath: "",
-      envVarName: "CANOPYCMS_REMOTE_URL",
-      autoDetectRemotePath: path3.join(this.getWorkspaceRoot(), "remote.git")
-    };
-  }
-  requiresExistingRepo() {
-    return false;
-  }
-  getSettingsBranchName(config) {
-    if (config.settingsBranch)
-      return config.settingsBranch;
-    const deploymentName = config.deploymentName ?? "prod";
-    return `canopycms-settings-${deploymentName}`;
-  }
-  getSettingsRoot(sourceRoot) {
-    return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
-  }
-  usesSeparateSettingsBranch() {
-    return true;
-  }
-  validateConfig(config) {
-    if (!config.gitBotAuthorName || !config.gitBotAuthorEmail) {
-      throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
-    }
-  }
-  shouldCreateSettingsPR(config) {
-    return config.autoCreateSettingsPR ?? true;
-  }
-};
-var LocalProdSimStrategy = class extends LocalProdSimClientSafeStrategy {
-  // Inherits client-safe methods from LocalProdSimClientSafeStrategy
-  getWorkspaceRoot(sourceRoot) {
-    return path3.resolve(sourceRoot ?? process.cwd(), ".canopy-prod-sim");
-  }
-  getContentRoot(sourceRoot) {
-    return path3.resolve(sourceRoot ?? process.cwd(), "content");
-  }
-  getContentBranchesRoot(sourceRoot) {
-    return path3.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
-  }
-  getContentBranchRoot(branchName, sourceRoot) {
-    return path3.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
-  }
-  getGitExcludePattern() {
-    return ".canopy-meta/";
-  }
-  getPermissionsFilePath(root) {
-    return path3.join(root, this.getPermissionsFileName());
-  }
-  getGroupsFilePath(root) {
-    return path3.join(root, this.getGroupsFileName());
-  }
-  getRemoteUrlConfig() {
-    return {
-      shouldAutoInitLocal: true,
-      defaultRemotePath: ".canopy-prod-sim/remote.git",
-      envVarName: "CANOPYCMS_REMOTE_URL"
-    };
-  }
-  requiresExistingRepo() {
-    return false;
-  }
-  getSettingsBranchName(config) {
-    if (config.settingsBranch)
-      return config.settingsBranch;
-    const deploymentName = config.deploymentName ?? "prod";
-    return `canopycms-settings-${deploymentName}`;
-  }
-  getSettingsRoot(sourceRoot) {
-    return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
-  }
-  usesSeparateSettingsBranch() {
-    return true;
-  }
-  validateConfig(_config) {
-  }
-  shouldCreateSettingsPR(_config) {
-    return false;
-  }
-};
-var LocalSimpleStrategy = class extends LocalSimpleClientSafeStrategy {
-  // Inherits: supportsBranching() returns false, getPermissionsFileName() returns 'permissions.local.json'
-  getWorkspaceRoot(sourceRoot) {
-    return path3.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
-  }
-  getContentRoot(sourceRoot) {
-    return path3.resolve(sourceRoot ?? process.cwd(), "content");
-  }
-  getContentBranchesRoot(_sourceRoot) {
-    throw new Error("No branching in dev mode");
-  }
-  getContentBranchRoot(_branchName, _sourceRoot) {
-    throw new Error("No branching in dev mode");
-  }
-  getGitExcludePattern() {
-    return ".canopy-meta/";
-  }
-  getPermissionsFilePath(root) {
-    return path3.join(this.getWorkspaceRoot(root), "settings", "permissions.json");
-  }
-  getGroupsFilePath(root) {
-    return path3.join(this.getWorkspaceRoot(root), "settings", "groups.json");
-  }
-  getRemoteUrlConfig() {
-    return {
-      shouldAutoInitLocal: false,
-      defaultRemotePath: "",
-      envVarName: "CANOPYCMS_REMOTE_URL"
-    };
-  }
-  requiresExistingRepo() {
-    return true;
-  }
-  getSettingsBranchName(config) {
-    return config.defaultBaseBranch ?? "main";
-  }
-  getSettingsRoot(sourceRoot) {
-    return path3.join(this.getWorkspaceRoot(sourceRoot), "settings");
-  }
-  usesSeparateSettingsBranch() {
-    return false;
-  }
-  validateConfig(_config) {
-  }
-  shouldCreateSettingsPR(_config) {
-    return false;
-  }
-};
-var strategyCache = /* @__PURE__ */ new Map();
-function operatingStrategy(mode) {
-  const cached = strategyCache.get(mode);
-  if (cached)
-    return cached;
-  let strategy;
-  switch (mode) {
-    case "prod":
-      strategy = new ProdStrategy();
-      break;
-    case "prod-sim":
-      strategy = new LocalProdSimStrategy();
-      break;
-    case "dev":
-      strategy = new LocalSimpleStrategy();
-      break;
-    default: {
-      const _exhaustive = mode;
-      throw new Error(`Unknown operating mode: ${_exhaustive}`);
-    }
-  }
-  strategyCache.set(mode, strategy);
-  return strategy;
+  return filename;
 }
 
+// dist/utils/format.js
+var getFormatExtension = (format) => {
+  if (format === "md")
+    return ".md";
+  if (format === "mdx")
+    return ".mdx";
+  return ".json";
+};
+
+// dist/paths/index.js
+init_normalize();
+
 // dist/paths/branch.js
+init_operating_mode();
+import fs3 from "node:fs/promises";
+import path4 from "node:path";
 var BranchPathError = class extends Error {
 };
 function sanitizeBranchName(branchName) {
@@ -1003,6 +1084,11 @@ function resolveBranchPath(options) {
   }
   return { branchRoot, baseRoot: normalizedBase, branchName: safeBranch };
 }
+async function ensureBranchRoot(options) {
+  const result = resolveBranchPath(options);
+  await fs3.mkdir(result.branchRoot, { recursive: true });
+  return result;
+}
 
 // dist/content-store.js
 var ContentStoreError = class extends Error {
@@ -1045,11 +1131,11 @@ var ContentStore = class {
   getSchemaItems() {
     return this.schemaIndex.values();
   }
-  assertSchemaItem(path12) {
-    const normalized = normalizeFilesystemPath(path12);
+  assertSchemaItem(path13) {
+    const normalized = normalizeFilesystemPath(path13);
     const item = this.schemaIndex.get(normalized);
     if (!item) {
-      throw new ContentStoreError(`Unknown schema item: ${path12}`);
+      throw new ContentStoreError(`Unknown schema item: ${path13}`);
     }
     return item;
   }
@@ -1118,7 +1204,7 @@ var ContentStore = class {
       let existingFilename;
       let existingEntryType;
       if (!id) {
-        const entries = await fs3.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+        const entries = await fs4.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
         const existingFile = entries.find((entry) => {
           if (entry.isDirectory())
             return false;
@@ -1183,7 +1269,7 @@ var ContentStore = class {
   async read(collectionPath, slug = "", options = {}) {
     const schemaItem = this.assertSchemaItem(collectionPath);
     const { absolutePath, relativePath } = await this.buildPaths(schemaItem, slug);
-    const raw = await fs3.readFile(absolutePath, "utf8");
+    const raw = await fs4.readFile(absolutePath, "utf8");
     let doc;
     let format;
     let fields;
@@ -1246,7 +1332,7 @@ var ContentStore = class {
     const { absolutePath, relativePath, id } = await this.buildPaths(schemaItem, slug, {
       entryTypeName
     });
-    await fs3.mkdir(path5.dirname(absolutePath), { recursive: true });
+    await fs4.mkdir(path5.dirname(absolutePath), { recursive: true });
     if (input.format === "json") {
       const json = JSON.stringify(input.data ?? {}, null, 2);
       await atomicWriteFile(absolutePath, `${json}
@@ -1330,7 +1416,7 @@ var ContentStore = class {
     const collection = this.assertCollection(collectionPath);
     const { absolutePath, relativePath } = await this.buildPaths(collection, slug);
     const id = idIndex.findByPath(relativePath);
-    await fs3.unlink(absolutePath);
+    await fs4.unlink(absolutePath);
     if (id) {
       idIndex.remove(id);
     }
@@ -1358,7 +1444,7 @@ var ContentStore = class {
     }
     const { absolutePath: currentPath, relativePath: currentRelPath } = await this.buildPaths(collection, currentSlug);
     try {
-      await fs3.access(currentPath);
+      await fs4.access(currentPath);
     } catch {
       throw new ContentStoreError(`Entry not found: ${currentSlug}`);
     }
@@ -1377,7 +1463,7 @@ var ContentStore = class {
     const parentDir = path5.dirname(currentPath);
     const newPath = path5.join(parentDir, newFilename);
     try {
-      const entries = await fs3.readdir(parentDir, { withFileTypes: true });
+      const entries = await fs4.readdir(parentDir, { withFileTypes: true });
       for (const entry of entries) {
         if (entry.isDirectory())
           continue;
@@ -1391,7 +1477,7 @@ var ContentStore = class {
         throw err;
       }
     }
-    await fs3.rename(currentPath, newPath);
+    await fs4.rename(currentPath, newPath);
     const newRelativePath = path5.relative(this.root, newPath);
     const entryId = idIndex.findByPath(currentRelPath);
     if (entryId) {
@@ -1509,11 +1595,11 @@ var ContentStore = class {
 };
 
 // dist/branch-schema-cache.js
-import fs5 from "node:fs/promises";
+import fs6 from "node:fs/promises";
 import path6 from "node:path";
 
 // dist/schema/meta-loader.js
-import { promises as fs4 } from "fs";
+import { promises as fs5 } from "fs";
 import { join as join2 } from "pathe";
 import { z as z6 } from "zod";
 import chokidar from "chokidar";
@@ -1547,7 +1633,7 @@ function stripEmbeddedIdFromName(name) {
 async function scanForCollectionMeta(baseDir, relativePath = "") {
   const collections = [];
   try {
-    const entries = await fs4.readdir(baseDir, { withFileTypes: true });
+    const entries = await fs5.readdir(baseDir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
@@ -1558,8 +1644,8 @@ async function scanForCollectionMeta(baseDir, relativePath = "") {
       const absolutePath = join2(baseDir, folderName);
       const metaPath = join2(absolutePath, ".collection.json");
       try {
-        await fs4.access(metaPath);
-        const content = await fs4.readFile(metaPath, "utf-8");
+        await fs5.access(metaPath);
+        const content = await fs5.readFile(metaPath, "utf-8");
         const parsed = JSON.parse(content);
         const meta = collectionMetaSchema.parse(parsed);
         collections.push({
@@ -1591,7 +1677,7 @@ async function loadCollectionMetaFiles(contentRoot) {
   let root = null;
   const rootMetaPath = join2(contentRoot, ".collection.json");
   try {
-    await fs4.access(rootMetaPath);
+    await fs5.access(rootMetaPath);
   } catch (err) {
     if (err.code === "ENOENT") {
     } else {
@@ -1599,7 +1685,7 @@ async function loadCollectionMetaFiles(contentRoot) {
     }
   }
   try {
-    const content = await fs4.readFile(rootMetaPath, "utf-8");
+    const content = await fs5.readFile(rootMetaPath, "utf-8");
     const parsed = JSON.parse(content);
     root = rootCollectionMetaSchema.parse(parsed);
   } catch (err) {
@@ -1690,35 +1776,44 @@ function isValidSchema(schema) {
 }
 
 // dist/branch-schema-cache.js
+init_flatten();
 var SCHEMA_CACHE_VERSION = 2;
+var MTIME_CHECK_DEBOUNCE_MS = 1e3;
+async function isStaleByMtime(dir, cachedAt) {
+  let entries;
+  try {
+    entries = await fs6.readdir(dir, { recursive: true, encoding: "utf-8" });
+  } catch {
+    return true;
+  }
+  for (const entry of entries) {
+    if (!entry.endsWith(".collection.json"))
+      continue;
+    const full = path6.join(dir, entry);
+    try {
+      const stat = await fs6.stat(full);
+      if (stat.mtimeMs > cachedAt.getTime())
+        return true;
+    } catch {
+      return true;
+    }
+  }
+  return false;
+}
 var BranchSchemaCache = class {
-  constructor(mode) {
-    this.mode = mode;
+  constructor(mode = "prod") {
+    this.lastMtimeCheck = /* @__PURE__ */ new Map();
+    this.devMode = mode === "dev";
   }
   /**
    * Get schema for a branch (loads from cache or resolves fresh).
    *
-   * @param branchRoot - Root directory of the branch (e.g., .canopy-prod-sim/content-branches/main)
+   * @param branchRoot - Root directory of the branch (e.g., .canopy-dev/content-branches/main)
    * @param entrySchemaRegistry - Map of schema names to field definitions
    * @param contentRootName - Name of content directory (e.g., "content") from config
    * @returns Resolved schema tree and flattened schema
    */
   async getSchema(branchRoot, entrySchemaRegistry, contentRootName = "content") {
-    if (this.mode === "dev") {
-      if (!this.devModeCache) {
-        const contentRoot = path6.join(branchRoot, contentRootName);
-        const result = await resolveSchema(contentRoot, entrySchemaRegistry);
-        if (!isValidSchema(result.schema)) {
-          throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
-        }
-        const flatSchema = flattenSchema(result.schema, contentRootName);
-        this.devModeCache = {
-          schema: result.schema,
-          flatSchema
-        };
-      }
-      return this.devModeCache;
-    }
     return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
   }
   /**
@@ -1731,23 +1826,32 @@ var BranchSchemaCache = class {
     const stalePath = path6.join(cacheDir, "schema-cache.stale");
     let cacheData = null;
     try {
-      const staleExists = await fs5.access(stalePath).then(() => true).catch(() => false);
+      const staleExists = await fs6.access(stalePath).then(() => true).catch(() => false);
       if (!staleExists) {
-        const cacheContent = await fs5.readFile(cachePath, "utf-8");
+        const cacheContent = await fs6.readFile(cachePath, "utf-8");
         cacheData = JSON.parse(cacheContent);
       }
     } catch {
       cacheData = null;
     }
     if (cacheData && cacheData.version === SCHEMA_CACHE_VERSION) {
-      return { schema: cacheData.schema, flatSchema: cacheData.flatSchema };
+      const now = Date.now();
+      const lastCheck = this.lastMtimeCheck.get(contentRoot) ?? 0;
+      if (this.devMode && now - lastCheck >= MTIME_CHECK_DEBOUNCE_MS && await isStaleByMtime(contentRoot, new Date(cacheData.cachedAt))) {
+        this.lastMtimeCheck.set(contentRoot, now);
+        cacheData = null;
+      } else {
+        if (this.devMode)
+          this.lastMtimeCheck.set(contentRoot, now);
+        return { schema: cacheData.schema, flatSchema: cacheData.flatSchema };
+      }
     }
     const result = await resolveSchema(contentRoot, entrySchemaRegistry);
     if (!isValidSchema(result.schema)) {
       throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
     }
     const flatSchema = flattenSchema(result.schema, contentRootName);
-    await fs5.mkdir(cacheDir, { recursive: true });
+    await fs6.mkdir(cacheDir, { recursive: true });
     const newCache = {
       version: SCHEMA_CACHE_VERSION,
       schema: result.schema,
@@ -1755,10 +1859,10 @@ var BranchSchemaCache = class {
       cachedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const tmpPath = path6.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
-    await fs5.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
-    await fs5.rename(tmpPath, cachePath);
+    await fs6.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
+    await fs6.rename(tmpPath, cachePath);
     try {
-      await fs5.unlink(stalePath);
+      await fs6.unlink(stalePath);
     } catch {
     }
     return { schema: result.schema, flatSchema };
@@ -1769,24 +1873,10 @@ var BranchSchemaCache = class {
    * @param branchRoot - Root directory of the branch
    */
   async invalidate(branchRoot) {
-    if (this.mode === "dev") {
-      this.devModeCache = void 0;
-      return;
-    }
     const cacheDir = path6.join(branchRoot, ".canopy-meta");
     const stalePath = path6.join(cacheDir, "schema-cache.stale");
-    await fs5.mkdir(cacheDir, { recursive: true });
-    await fs5.writeFile(stalePath, "", "utf-8");
-  }
-  /**
-   * Clear all caches (for testing).
-   * In dev mode, clears in-memory cache.
-   * In prod/prod-sim modes, this would need to traverse all branch directories.
-   */
-  async clearAll() {
-    if (this.mode === "dev") {
-      this.devModeCache = void 0;
-    }
+    await fs6.mkdir(cacheDir, { recursive: true });
+    await fs6.writeFile(stalePath, "", "utf-8");
   }
 };
 
@@ -2287,11 +2377,11 @@ function matchesBundleFilter(entry, filter, contentRoot) {
 
 // dist/branch-metadata.js
 import { randomUUID } from "node:crypto";
-import fs7 from "node:fs/promises";
+import fs8 from "node:fs/promises";
 import path9 from "node:path";
 
 // dist/branch-registry.js
-import fs6 from "node:fs/promises";
+import fs7 from "node:fs/promises";
 import path8 from "node:path";
 var REGISTRY_FILE = "branches.json";
 var REGISTRY_STALE_FILE = "branches.stale.json";
@@ -2309,7 +2399,7 @@ var BranchRegistry = class {
    */
   async list() {
     try {
-      const raw = await fs6.readFile(this.registryPath, "utf8");
+      const raw = await fs7.readFile(this.registryPath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed.version || !Array.isArray(parsed.branches)) {
         return await this.regenerate();
@@ -2335,7 +2425,7 @@ var BranchRegistry = class {
    */
   async invalidate() {
     try {
-      await fs6.rename(this.registryPath, this.stalePath);
+      await fs7.rename(this.registryPath, this.stalePath);
     } catch (err) {
       if (!isNotFoundError(err)) {
         throw err;
@@ -2349,20 +2439,20 @@ var BranchRegistry = class {
   async regenerate() {
     const branches = await this.scanBranchDirectories();
     const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs6.mkdir(this.root, { recursive: true });
+    await fs7.mkdir(this.root, { recursive: true });
     const snapshot = {
       version: REGISTRY_VERSION,
       branches
     };
-    await fs6.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs7.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
-      await fs6.rename(uniqueTempPath, this.registryPath);
+      await fs7.rename(uniqueTempPath, this.registryPath);
     } catch (err) {
-      await fs6.unlink(uniqueTempPath).catch(() => {
+      await fs7.unlink(uniqueTempPath).catch(() => {
       });
       throw err;
     }
-    await fs6.unlink(this.stalePath).catch(() => {
+    await fs7.unlink(this.stalePath).catch(() => {
     });
     return branches;
   }
@@ -2372,7 +2462,7 @@ var BranchRegistry = class {
   async scanBranchDirectories() {
     const branches = [];
     try {
-      const entries = await fs6.readdir(this.root, { withFileTypes: true });
+      const entries = await fs7.readdir(this.root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) {
           continue;
@@ -2437,7 +2527,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   static async loadOnly(branchRoot) {
     const filePath = path9.join(path9.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
     try {
-      const raw = await fs7.readFile(filePath, "utf8");
+      const raw = await fs8.readFile(filePath, "utf8");
       return JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError(err)) {
@@ -2455,7 +2545,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   }
   async load() {
     try {
-      const raw = await fs7.readFile(this.filePath, "utf8");
+      const raw = await fs8.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -2479,11 +2569,11 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
       version: newVersion,
       writeId
     };
-    await fs7.mkdir(path9.dirname(this.filePath), { recursive: true });
+    await fs8.mkdir(path9.dirname(this.filePath), { recursive: true });
     const content = JSON.stringify(payload, null, 2) + "\n";
     if (expectedVersion === null) {
       try {
-        await fs7.writeFile(this.filePath, content, { flag: "wx" });
+        await fs8.writeFile(this.filePath, content, { flag: "wx" });
         return { version: newVersion, writeId };
       } catch (err) {
         if (isFileExistsError(err)) {
@@ -2493,11 +2583,11 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
       }
     }
     const tempPath = `${this.filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-    await fs7.writeFile(tempPath, content, "utf-8");
+    await fs8.writeFile(tempPath, content, "utf-8");
     try {
       let currentVersion = null;
       try {
-        const current = JSON.parse(await fs7.readFile(this.filePath, "utf-8"));
+        const current = JSON.parse(await fs8.readFile(this.filePath, "utf-8"));
         currentVersion = current.version ?? 0;
       } catch {
         currentVersion = null;
@@ -2505,13 +2595,13 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
       if (currentVersion !== expectedVersion) {
         throw new BranchMetadataConflictError();
       }
-      await fs7.rename(tempPath, this.filePath);
-      const afterWrite = JSON.parse(await fs7.readFile(this.filePath, "utf-8"));
+      await fs8.rename(tempPath, this.filePath);
+      const afterWrite = JSON.parse(await fs8.readFile(this.filePath, "utf-8"));
       if (afterWrite.writeId !== writeId) {
         throw new BranchMetadataConflictError();
       }
     } catch (err) {
-      await fs7.unlink(tempPath).catch(() => {
+      await fs8.unlink(tempPath).catch(() => {
       });
       throw err;
     }
@@ -2576,6 +2666,9 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     await registry.invalidate();
   }
 };
+var getBranchMetadataFileManager = (branchRoot, baseRoot) => {
+  return BranchMetadataFileManager.get(branchRoot, baseRoot);
+};
 var loadBranchContext = async (options) => {
   const { branchRoot, baseRoot } = resolveBranchPath({
     branchName: options.branchName,
@@ -2605,19 +2698,704 @@ var STATIC_DEPLOY_USER = Object.freeze({
   name: "Static Deploy"
 });
 
+// dist/git-manager.js
+import fs9 from "node:fs/promises";
+import path10 from "node:path";
+import { simpleGit as simpleGit2 } from "simple-git";
+
+// dist/utils/debug.js
+var LOG_LEVELS = {
+  DEBUG: 0,
+  INFO: 1,
+  WARN: 2,
+  ERROR: 3
+};
+var DebugLogger = class {
+  constructor(options = {}) {
+    this.timers = /* @__PURE__ */ new Map();
+    this.options = options;
+  }
+  shouldLog(level) {
+    const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
+    if (!enabled)
+      return false;
+    const minLevel = this.options.minLevel ?? "DEBUG";
+    return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
+  }
+  formatMessage(level, category, message) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const prefix = this.options.prefix ?? "CanopyCMS";
+    return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+  }
+  debug(category, message, data) {
+    if (this.shouldLog("DEBUG")) {
+      console.log(this.formatMessage("DEBUG", category, message), data ?? "");
+    }
+  }
+  info(category, message, data) {
+    if (this.shouldLog("INFO")) {
+      console.log(this.formatMessage("INFO", category, message), data ?? "");
+    }
+  }
+  warn(category, message, data) {
+    if (this.shouldLog("WARN")) {
+      console.warn(this.formatMessage("WARN", category, message), data ?? "");
+    }
+  }
+  error(category, message, data) {
+    const msg = this.formatMessage("ERROR", category, message);
+    if (this.shouldLog("ERROR")) {
+      console.error(msg, data ?? "");
+    }
+    const throwOnError = this.options.throwOnError ?? false;
+    if (throwOnError) {
+      const errorMsg = data ? `${message}: ${JSON.stringify(data)}` : message;
+      throw new Error(errorMsg);
+    }
+  }
+  /**
+   * Start timing an operation
+   */
+  time(label) {
+    this.timers.set(label, Date.now());
+  }
+  /**
+   * End timing an operation and log the duration
+   */
+  timeEnd(category, label) {
+    const start = this.timers.get(label);
+    if (start === void 0) {
+      this.warn(category, `Timer '${label}' does not exist`);
+      return;
+    }
+    const duration = Date.now() - start;
+    this.timers.delete(label);
+    this.debug(category, `${label} completed`, { durationMs: duration });
+    return duration;
+  }
+  /**
+   * Wrap an async function with automatic timing
+   */
+  async timed(category, label, fn) {
+    this.time(label);
+    try {
+      return await fn();
+    } finally {
+      this.timeEnd(category, label);
+    }
+  }
+};
+function createDebugLogger(options) {
+  return new DebugLogger(options);
+}
+var testLogger = createDebugLogger({
+  enabled: process.env.E2E_DEBUG === "true",
+  prefix: "E2E",
+  throwOnError: false
+});
+
+// dist/utils/git.js
+import { simpleGit } from "simple-git";
+async function detectHeadBranch(repoRoot, fallback = "main") {
+  try {
+    const git = simpleGit({ baseDir: repoRoot });
+    const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
+    return head && head !== "HEAD" ? head : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+// dist/git-manager.js
+var log = createDebugLogger({ prefix: "GitManager" });
+var remoteInitLocks = /* @__PURE__ */ new Map();
+var GitManager = class _GitManager {
+  constructor(options, gitOptions) {
+    this.repoPath = path10.resolve(options.repoPath);
+    this.baseBranch = options.baseBranch ?? "main";
+    this.remote = options.remote ?? "origin";
+    this.git = simpleGit2({ baseDir: this.repoPath, ...gitOptions });
+  }
+  static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
+    log.debug("git", "Cloning repository", {
+      remoteUrl,
+      targetPath,
+      baseBranch
+    });
+    const git = simpleGit2();
+    await git.clone(remoteUrl, targetPath, ["--branch", baseBranch, "--single-branch"]);
+    log.debug("git", "Clone complete");
+  }
+  /**
+   * Initializes a local bare git repository to simulate a remote for dev mode.
+   *
+   * This is idempotent - if the remote already exists, it will not be recreated.
+   *
+   * The remote is seeded with the current state of the baseBranch (e.g., 'main').
+   * If you need to change the baseBranch or reset the simulation, delete
+   * `.canopycms/remote.git` and `.canopycms/branches` and restart.
+   *
+   * @throws Error if not a git repo, no commits, or baseBranch doesn't exist
+   */
+  static async ensureLocalSimulatedRemote(options) {
+    const existingLock = remoteInitLocks.get(options.remotePath);
+    if (existingLock) {
+      log.debug("git", "Waiting for existing remote initialization", {
+        remotePath: options.remotePath
+      });
+      await existingLock;
+      try {
+        const stat = await fs9.stat(options.remotePath);
+        if (stat.isDirectory()) {
+          log.debug("git", "Remote exists after waiting for lock");
+          return;
+        }
+      } catch (err) {
+        if (!isNotFoundError(err))
+          throw err;
+        log.debug("git", "Remote does not exist after lock, will retry initialization");
+      }
+    }
+    const lockPromise = log.timed("git", "ensureLocalSimulatedRemote", async () => {
+      try {
+        log.debug("git", "Initializing local simulated remote", {
+          remotePath: options.remotePath,
+          baseBranch: options.baseBranch
+        });
+        try {
+          const stat = await fs9.stat(options.remotePath);
+          if (stat.isDirectory()) {
+            log.debug("git", "Remote already exists, skipping");
+            return;
+          }
+        } catch (err) {
+          if (!isNotFoundError(err))
+            throw err;
+        }
+        let gitRoot = options.sourcePath;
+        try {
+          const sourceGit2 = simpleGit2({ baseDir: options.sourcePath });
+          const result = await sourceGit2.raw(["rev-parse", "--show-toplevel"]);
+          gitRoot = result.trim();
+        } catch {
+          gitRoot = options.sourcePath;
+        }
+        const sourceGit = simpleGit2({ baseDir: gitRoot });
+        try {
+          await sourceGit.status();
+        } catch {
+          throw new Error("Cannot initialize local simulated remote: current directory is not a git repository. Please initialize git or provide an explicit remoteUrl.");
+        }
+        let hasCommits = false;
+        try {
+          const log3 = await sourceGit.log(["-1"]);
+          hasCommits = log3.total > 0;
+        } catch {
+          hasCommits = false;
+        }
+        if (!hasCommits) {
+          throw new Error("Cannot initialize local simulated remote: repository has no commits. Please make an initial commit or provide an explicit remoteUrl.");
+        }
+        const branches = await sourceGit.branchLocal();
+        if (!branches.all.includes(options.baseBranch)) {
+          throw new Error(`Cannot initialize local simulated remote: base branch '${options.baseBranch}' does not exist locally. Please checkout '${options.baseBranch}' first or provide an explicit remoteUrl.`);
+        }
+        log.debug("git", "Creating bare remote repository");
+        await fs9.mkdir(path10.dirname(options.remotePath), { recursive: true });
+        await simpleGit2().raw([
+          "init",
+          "--bare",
+          `--initial-branch=${options.baseBranch}`,
+          options.remotePath
+        ]);
+        const tempRemoteName = `__canopycms_init_${Date.now()}__`;
+        try {
+          await sourceGit.addRemote(tempRemoteName, options.remotePath);
+          if (options.subdirectory) {
+            const splitBranch = `__canopycms_split_${Date.now()}__`;
+            try {
+              await sourceGit.raw([
+                "subtree",
+                "split",
+                "--prefix",
+                options.subdirectory,
+                "-b",
+                splitBranch
+              ]);
+              await sourceGit.push(tempRemoteName, `${splitBranch}:${options.baseBranch}`);
+              await sourceGit.raw(["branch", "-D", splitBranch]);
+            } catch (err) {
+              try {
+                await sourceGit.raw(["branch", "-D", splitBranch]);
+              } catch {
+              }
+              throw err;
+            }
+          } else {
+            await sourceGit.push(tempRemoteName, `${options.baseBranch}:${options.baseBranch}`);
+          }
+        } finally {
+          try {
+            await sourceGit.removeRemote(tempRemoteName);
+          } catch {
+          }
+        }
+        log.debug("git", "Remote initialization complete");
+      } finally {
+        remoteInitLocks.delete(options.remotePath);
+      }
+    });
+    remoteInitLocks.set(options.remotePath, lockPromise);
+    await lockPromise;
+  }
+  /**
+   * Find the git root directory
+   * @returns Path to git root, or cwd if not in a git repo
+   */
+  static async findGitRoot() {
+    let gitRoot = process.cwd();
+    try {
+      const git = simpleGit2({ baseDir: process.cwd() });
+      const result = await git.raw(["rev-parse", "--show-toplevel"]);
+      gitRoot = result.trim();
+    } catch {
+    }
+    return gitRoot;
+  }
+  /**
+   * Validate that a git repository exists at the given path
+   * @param repoPath - Path to check for .git directory
+   * @throws Error if git repo doesn't exist
+   */
+  static async validateGitRepoExists(repoPath) {
+    try {
+      const stat = await fs9.stat(path10.join(repoPath, ".git"));
+      if (!stat.isDirectory()) {
+        throw new Error(`Expected git repo at ${repoPath}`);
+      }
+    } catch (err) {
+      if (isNotFoundError(err)) {
+        throw new Error(`Expected git repo at ${repoPath}`);
+      }
+      throw err;
+    }
+  }
+  /**
+   * Resolves the remote URL for git operations following the priority:
+   * 1. Explicit remoteUrl parameter
+   * 2. Config defaultRemoteUrl
+   * 3. Environment variable (mode-specific)
+   * 4. Auto-initialized local remote (for dev mode)
+   *
+   * Uses strategy flags to determine behavior, GitManager executes the logic.
+   *
+   * @param options.sourceRoot - Optional source directory for monorepos. When provided,
+   *   this directory (relative to git root) is used as the source for the simulated remote.
+   *   Defaults to process.cwd().
+   *
+   * @returns Remote URL or undefined if no remote is needed
+   */
+  static async resolveRemoteUrl(options) {
+    const { operatingStrategy: operatingStrategy2 } = await Promise.resolve().then(() => (init_operating_mode(), operating_mode_exports));
+    const strategy = operatingStrategy2(options.mode);
+    const config = strategy.getRemoteUrlConfig();
+    if (options.remoteUrl)
+      return options.remoteUrl;
+    if (options.defaultRemoteUrl)
+      return options.defaultRemoteUrl;
+    if (process.env[config.envVarName])
+      return process.env[config.envVarName];
+    if (config.autoDetectRemotePath) {
+      try {
+        const stat = await fs9.stat(config.autoDetectRemotePath);
+        if (stat.isDirectory()) {
+          log.debug("git", "Auto-detected local remote", {
+            path: config.autoDetectRemotePath
+          });
+          return config.autoDetectRemotePath;
+        }
+      } catch {
+      }
+    }
+    if (config.shouldAutoInitLocal) {
+      const gitRoot = await this.findGitRoot();
+      const sourceRoot = options.sourceRoot;
+      const sourcePath = sourceRoot ? path10.resolve(gitRoot, sourceRoot) : gitRoot;
+      const localRemotePath = path10.join(sourcePath, config.defaultRemotePath);
+      await this.ensureLocalSimulatedRemote({
+        remotePath: localRemotePath,
+        sourcePath: gitRoot,
+        baseBranch: options.baseBranch,
+        subdirectory: sourceRoot
+      });
+      return localRemotePath;
+    }
+    return void 0;
+  }
+  /**
+   * Ensures a git workspace is initialized and ready for use.
+   * Handles cloning, remote configuration, and branch checkout/creation.
+   *
+   * This centralizes the common initialization sequence used by both BranchWorkspaceManager
+   * and SettingsWorkspaceManager.
+   *
+   * Note: Does NOT configure git author - that should be done before commits, not during init.
+   *
+   * @returns Configured GitManager instance for the workspace
+   */
+  static async initializeWorkspace(options) {
+    let baseBranch = options.baseBranch;
+    if (!baseBranch && options.mode === "dev") {
+      const sourceRoot = options.sourceRoot ? path10.resolve(process.cwd(), options.sourceRoot) : process.cwd();
+      baseBranch = await detectHeadBranch(sourceRoot);
+    }
+    baseBranch = baseBranch ?? "main";
+    const remoteName = options.remoteName ?? "origin";
+    let repoExists = false;
+    try {
+      const stat = await fs9.stat(path10.join(options.workspacePath, ".git"));
+      repoExists = stat.isDirectory();
+    } catch (err) {
+      if (!isNotFoundError(err))
+        throw err;
+    }
+    let justCloned = false;
+    if (!repoExists) {
+      const remoteUrl = await _GitManager.resolveRemoteUrl({
+        mode: options.mode,
+        remoteUrl: options.remoteUrl,
+        defaultRemoteUrl: options.defaultRemoteUrl,
+        baseBranch,
+        sourceRoot: options.sourceRoot
+      });
+      if (!remoteUrl) {
+        throw new Error("CanopyCMS: defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is required to initialize workspace");
+      }
+      await _GitManager.cloneRepo(remoteUrl, options.workspacePath, baseBranch);
+      justCloned = true;
+    }
+    const git = new _GitManager({
+      repoPath: options.workspacePath,
+      baseBranch,
+      remote: remoteName
+    });
+    if (!justCloned) {
+      const remoteUrl = await _GitManager.resolveRemoteUrl({
+        mode: options.mode,
+        remoteUrl: options.remoteUrl,
+        defaultRemoteUrl: options.defaultRemoteUrl,
+        baseBranch,
+        sourceRoot: options.sourceRoot
+      });
+      if (remoteUrl) {
+        await git.ensureRemote(remoteUrl);
+      }
+    }
+    if (options.branchType === "orphan") {
+      await git.createOrphanSettingsBranch(options.branchName, {});
+    } else {
+      await git.checkoutBranch(options.branchName);
+    }
+    await git.git.addConfig("canopycms.managed", "true");
+    log.debug("git", "Marked workspace as CanopyCMS-managed", {
+      workspacePath: options.workspacePath
+    });
+    return git;
+  }
+  async status() {
+    const s = await this.git.status();
+    return {
+      files: s.files,
+      ahead: s.ahead,
+      behind: s.behind,
+      current: s.current,
+      tracking: s.tracking
+    };
+  }
+  async checkoutBranch(branch) {
+    const branches = await this.git.branch();
+    if (branches.all.includes(branch)) {
+      await this.git.checkout(branch);
+      return;
+    }
+    const remoteRef = `${this.remote}/${this.baseBranch}`;
+    try {
+      await this.git.fetch(this.remote, this.baseBranch);
+    } catch {
+    }
+    try {
+      await this.git.checkoutBranch(branch, remoteRef);
+      return;
+    } catch {
+      const baseExists = branches.all.includes(this.baseBranch);
+      if (baseExists) {
+        await this.git.checkout(["-B", branch, this.baseBranch]);
+        return;
+      }
+      await this.git.checkoutLocalBranch(branch);
+    }
+  }
+  async pullBase() {
+    await this.git.fetch(this.remote, this.baseBranch);
+    await this.git.merge([`${this.remote}/${this.baseBranch}`]);
+  }
+  async pullCurrentBranch() {
+    const branches = await this.git.branch();
+    const currentBranch = branches.current;
+    await this.git.fetch(this.remote, currentBranch);
+    await this.git.merge([`${this.remote}/${currentBranch}`]);
+  }
+  async rebaseOntoBase() {
+    await this.git.fetch(this.remote, this.baseBranch);
+    await this.git.rebase([`${this.remote}/${this.baseBranch}`]);
+  }
+  async add(files) {
+    const fileArray = Array.isArray(files) ? files : [files];
+    await this.git.add(fileArray);
+  }
+  async commit(message) {
+    await this.git.commit(message);
+  }
+  async push(branch) {
+    const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
+    await this.git.push(this.remote, `${target}:${target}`, ["--set-upstream"]);
+  }
+  async ensureAuthor(author) {
+    const config = await this.git.listConfig();
+    const isManaged = config.all["canopycms.managed"] === "true";
+    if (!isManaged) {
+      throw new Error(`Cannot set git bot author in non-managed repository (${this.repoPath}). Bot identity should only be set in CanopyCMS branch clones or test workspaces. If this is a test workspace, add "git config canopycms.managed true" to mark it as managed.`);
+    }
+    const currentName = config.all["user.name"];
+    const currentEmail = config.all["user.email"];
+    if (currentName !== author.name) {
+      await this.git.addConfig("user.name", author.name);
+    }
+    if (currentEmail !== author.email) {
+      await this.git.addConfig("user.email", author.email);
+    }
+  }
+  async ensureRemote(remoteUrl) {
+    const remotes = await this.git.getRemotes(true);
+    const existing = remotes.find((r) => r.name === this.remote);
+    if (!existing) {
+      await this.git.addRemote(this.remote, remoteUrl);
+      return;
+    }
+    const currentUrl = existing.refs.push ?? existing.refs.fetch;
+    if (currentUrl && currentUrl !== remoteUrl) {
+      await this.git.remote(["set-url", this.remote, remoteUrl]);
+    }
+  }
+  /**
+   * Check if working directory has uncommitted changes
+   */
+  async hasUncommittedChanges() {
+    const status = await this.status();
+    return status.files.length > 0;
+  }
+  /**
+   * Get list of uncommitted file paths
+   */
+  async getUncommittedFiles() {
+    const status = await this.status();
+    return status.files.map((f) => f.path);
+  }
+  /**
+   * Force push (use with caution - for PR updates only)
+   * Uses --force-with-lease for safer force pushes
+   */
+  async forcePush(branch) {
+    const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
+    await this.git.push(this.remote, target, ["--force-with-lease"]);
+  }
+  /**
+   * Get remote URL for current repo
+   */
+  async getRemoteUrl() {
+    const remotes = await this.git.getRemotes(true);
+    const remote = remotes.find((r) => r.name === this.remote);
+    return remote?.refs.push || remote?.refs.fetch;
+  }
+  /**
+   * Add a pattern to .git/info/exclude to prevent it from being committed/pushed.
+   * This is used to exclude .canopy-meta/ from content branch workspaces.
+   *
+   * .git/info/exclude is a per-repository gitignore that never gets committed.
+   * Perfect for runtime metadata that should never leave the workspace.
+   *
+   * This is idempotent - if the pattern already exists, it won't be added again.
+   */
+  async ensureGitExclude(pattern) {
+    const excludePath = path10.join(this.repoPath, ".git", "info", "exclude");
+    await fs9.mkdir(path10.dirname(excludePath), { recursive: true });
+    let content = "";
+    try {
+      content = await fs9.readFile(excludePath, "utf-8");
+    } catch (err) {
+      if (!isNotFoundError(err))
+        throw err;
+    }
+    const lines = content.split("\n");
+    if (lines.some((line) => line.trim() === pattern)) {
+      log.debug("git", "Pattern already in .git/info/exclude", { pattern });
+      return;
+    }
+    const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
+    const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
+    await fs9.writeFile(excludePath, newContent, "utf-8");
+    log.debug("git", "Added pattern to .git/info/exclude", { pattern });
+  }
+  /**
+   * Create an orphan branch for settings (permissions/groups).
+   *
+   * Orphan branches have no shared history with other branches - they start fresh.
+   * This is perfect for deployment-specific settings that shouldn't pollute content history.
+   *
+   * The branch contains only settings files in .canopy-meta/ (groups.json, permissions.json).
+   *
+   * @param branchName - Name of the orphan branch (e.g., 'canopycms-settings-prod')
+   * @param initialFiles - Files to commit to the new branch (e.g., { 'permissions.json': '{}', 'groups.json': '{}' })
+   */
+  async createOrphanSettingsBranch(branchName, initialFiles) {
+    log.debug("git", "Creating orphan settings branch", { branchName });
+    const branches = await this.git.branch();
+    if (branches.all.includes(branchName)) {
+      log.debug("git", "Orphan branch already exists", { branchName });
+      await this.git.checkout(branchName);
+      return;
+    }
+    await this.git.raw(["checkout", "--orphan", branchName]);
+    try {
+      await this.git.raw(["rm", "-rf", "."]);
+    } catch {
+    }
+    for (const [filePath, content] of Object.entries(initialFiles)) {
+      const absolutePath = path10.join(this.repoPath, filePath);
+      await fs9.mkdir(path10.dirname(absolutePath), { recursive: true });
+      await fs9.writeFile(absolutePath, content, "utf-8");
+      await this.git.add(filePath);
+    }
+    await this.git.commit("Initialize settings branch", ["--allow-empty"]);
+    log.debug("git", "Orphan settings branch created", { branchName });
+  }
+};
+
+// dist/branch-workspace.js
+var log2 = createDebugLogger({ prefix: "BranchWorkspace" });
+var workspaceInitLocks = /* @__PURE__ */ new Map();
+var BranchWorkspaceManager = class {
+  constructor(config) {
+    this.config = config;
+  }
+  async ensureGitWorkspace(options) {
+    return log2.timed("workspace", "ensureGitWorkspace", async () => {
+      const existingLock = workspaceInitLocks.get(options.branchRoot);
+      if (existingLock) {
+        await existingLock;
+        return;
+      }
+      const lockPromise = (async () => {
+        try {
+          log2.debug("workspace", "Ensuring git workspace", {
+            branchName: options.branchName,
+            mode: options.mode
+          });
+          await GitManager.initializeWorkspace({
+            workspacePath: options.branchRoot,
+            branchName: options.branchName,
+            mode: options.mode,
+            baseBranch: this.config.defaultBaseBranch,
+            sourceRoot: this.config.sourceRoot,
+            defaultRemoteUrl: this.config.defaultRemoteUrl,
+            remoteUrl: options.remoteUrl,
+            remoteName: this.config.defaultRemoteName,
+            branchType: "content"
+          });
+        } finally {
+          workspaceInitLocks.delete(options.branchRoot);
+        }
+      })();
+      workspaceInitLocks.set(options.branchRoot, lockPromise);
+      await lockPromise;
+    });
+  }
+  async openOrCreateBranch(options) {
+    const { branchName, mode, basePathOverride, title, description, access, createdBy, remoteUrl } = options;
+    const { branchRoot, baseRoot, branchName: safeName } = await ensureBranchRoot({
+      mode,
+      branchName,
+      basePathOverride
+    });
+    await this.ensureGitWorkspace({
+      branchRoot,
+      branchName: safeName,
+      mode,
+      remoteUrl
+    });
+    const metadata = getBranchMetadataFileManager(branchRoot, baseRoot);
+    const meta = await metadata.save({
+      branch: {
+        name: safeName,
+        title,
+        description,
+        access,
+        createdBy
+      }
+    });
+    return {
+      branch: meta.branch,
+      branchRoot,
+      baseRoot
+    };
+  }
+};
+async function loadOrCreateBranchContext(options) {
+  if (isDeployedStatic(options.config)) {
+    const cwd = process.cwd();
+    return {
+      branch: {
+        name: options.branchName,
+        status: "editing",
+        access: {},
+        createdBy: "__static_deploy__",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      branchRoot: cwd,
+      baseRoot: cwd
+    };
+  }
+  const existing = await loadBranchContext({
+    branchName: options.branchName,
+    mode: options.mode,
+    basePathOverride: options.basePathOverride
+  });
+  if (existing)
+    return existing;
+  const manager = new BranchWorkspaceManager(options.config);
+  return manager.openOrCreateBranch({
+    branchName: options.branchName,
+    mode: options.mode,
+    basePathOverride: options.basePathOverride,
+    createdBy: options.createdBy,
+    remoteUrl: options.remoteUrl
+  });
+}
+
 // dist/ai/resolve-branch.js
 async function resolveBranchRoot(config) {
-  if (config.mode === "dev" || isDeployedStatic(config)) {
+  if (isDeployedStatic(config)) {
     return process.cwd();
   }
   const baseBranch = config.defaultBaseBranch ?? "main";
-  const context = await loadBranchContext({
+  const context = await loadOrCreateBranchContext({
+    config,
     branchName: baseBranch,
-    mode: config.mode
+    mode: config.mode,
+    createdBy: "canopycms-ai",
+    remoteUrl: config.defaultRemoteUrl
   });
-  if (!context) {
-    throw new Error(`Could not load branch context for "${baseBranch}". Ensure the branch exists and has been initialized.`);
-  }
   return context.branchRoot;
 }
 
@@ -2641,15 +3419,15 @@ async function generateAIContentFiles(options) {
     contentRoot: contentRootName,
     config: aiConfig
   });
-  const absoluteOutputDir = path10.resolve(outputDir) + path10.sep;
+  const absoluteOutputDir = path11.resolve(outputDir) + path11.sep;
   let fileCount = 0;
   for (const [filePath, content] of result.files) {
-    const absolutePath = path10.resolve(path10.join(absoluteOutputDir, filePath));
+    const absolutePath = path11.resolve(path11.join(absoluteOutputDir, filePath));
     if (!absolutePath.startsWith(absoluteOutputDir)) {
       throw new Error(`Path traversal detected in AI content output: ${filePath}`);
     }
-    await fs8.mkdir(path10.dirname(absolutePath), { recursive: true });
-    await fs8.writeFile(absolutePath, content, "utf-8");
+    await fs10.mkdir(path11.dirname(absolutePath), { recursive: true });
+    await fs10.writeFile(absolutePath, content, "utf-8");
     fileCount++;
   }
   return { fileCount, outputDir: absoluteOutputDir };
@@ -2660,7 +3438,7 @@ var jiti = createJiti(import.meta.url);
 async function generateAIContentCLI(options) {
   const { projectDir, outputDir = "public/ai", configPath, appDir = "app" } = options;
   console.log("\nCanopyCMS generate-ai-content\n");
-  const canopyConfigPath = path11.join(projectDir, "canopycms.config.ts");
+  const canopyConfigPath = path12.join(projectDir, "canopycms.config.ts");
   let canopyConfigModule;
   try {
     canopyConfigModule = await jiti.import(canopyConfigPath);
@@ -2671,7 +3449,7 @@ async function generateAIContentCLI(options) {
   }
   const configExport = canopyConfigModule.default ?? canopyConfigModule.config ?? canopyConfigModule;
   const serverConfig = typeof configExport === "object" && configExport !== null && "server" in configExport ? configExport.server : configExport;
-  const schemasPath = path11.join(projectDir, appDir, "schemas.ts");
+  const schemasPath = path12.join(projectDir, appDir, "schemas.ts");
   let entrySchemaRegistry = {};
   try {
     const schemasModule = await jiti.import(schemasPath);
@@ -2682,7 +3460,7 @@ async function generateAIContentCLI(options) {
   let aiConfig;
   if (configPath) {
     try {
-      const aiConfigModule = await jiti.import(path11.resolve(configPath));
+      const aiConfigModule = await jiti.import(path12.resolve(configPath));
       aiConfig = aiConfigModule.aiContentConfig ?? aiConfigModule.default ?? aiConfigModule.config;
     } catch (err) {
       console.error(`Could not load AI config from ${configPath}`);
@@ -2699,7 +3477,7 @@ async function generateAIContentCLI(options) {
     console.error("Make sure canopycms.config.ts uses defineCanopyConfig().");
     process.exit(1);
   }
-  const resolvedOutput = path11.resolve(projectDir, outputDir);
+  const resolvedOutput = path12.resolve(projectDir, outputDir);
   console.log(`  Output: ${resolvedOutput}`);
   console.log(`  Mode: ${serverConfig.mode ?? "dev"}`);
   const result = await generateAIContentFiles({