canopycms 0.0.61-int.75 → 0.0.61

package/dist/cli/cli.js

@@ -95,22 +95,50 @@ import { z as z4 } from "zod";
 import { z as z5 } from "zod";
 import { join, normalize } from "pathe";
 import fs2 from "node:fs/promises";
+import fs22 from "node:fs/promises";
 import path2 from "node:path";
 import { fileURLToPath } from "node:url";
-import path3 from "node:path";
 import fs3 from "node:fs/promises";
+import path3 from "node:path";
+import { simpleGit } from "simple-git";
 import path4 from "node:path";
 import fs4 from "node:fs/promises";
 import path5 from "node:path";
-import crypto from "node:crypto";
 import fs5 from "node:fs/promises";
 import path6 from "node:path";
+import crypto from "node:crypto";
+import fs6 from "node:fs/promises";
+import path7 from "node:path";
 import * as p from "@clack/prompts";
 import { createJiti } from "jiti";
-import path7 from "node:path";
-import fs6 from "node:fs/promises";
+import path8 from "node:path";
+function getErrorMessage2(err) {
+  if (err instanceof Error) {
+    return err.message;
+  }
+  if (typeof err === "string") {
+    return err;
+  }
+  return String(err);
+}
+function isNodeError2(err) {
+  return err instanceof Error && "code" in err;
+}
+function isNotFoundError2(err) {
+  return isNodeError2(err) && err.code === "ENOENT";
+}
+async function filePathExists2(filePath) {
+  try {
+    await fs2.stat(filePath);
+    return true;
+  } catch (err) {
+    if (isNotFoundError2(err))
+      return false;
+    throw err;
+  }
+}
 async function readTemplate(name) {
-  return fs2.readFile(path2.join(TEMPLATES_DIR, name), "utf-8");
+  return fs22.readFile(path2.join(TEMPLATES_DIR, name), "utf-8");
 }
 async function canopyCmsConfig(options) {
   const template = await readTemplate("canopycms.config.ts.template");
@@ -161,23 +189,142 @@ async function nextConfig(options) {
   const templateName = options.staticBuild ? "next.config-static.ts.template" : "next.config.ts.template";
   return readTemplate(templateName);
 }
-async function dockerfileCms() {
-  return readTemplate("Dockerfile.cms.template");
+async function dockerfileCms(options) {
+  const template = await readTemplate("Dockerfile.cms.template");
+  return template.replace("{{DOCKER_COPY}}", options.copy).replace("{{DOCKER_INSTALL}}", options.install).replace("{{DOCKER_BUILD}}", options.build);
 }
 async function dockerignore() {
   return readTemplate("dockerignore.template");
 }
-async function githubWorkflowCms() {
-  return readTemplate("deploy-cms.yml.template");
+async function githubWorkflowCms(options) {
+  const template = await readTemplate("deploy-cms.yml.template");
+  return template.replace("{{DEFAULT_BRANCH}}", options.defaultBranch).replace("{{LOCKFILE}}", options.lockfile).replace("{{CI_INSTALL}}", options.ciInstall).replaceAll("{{ADD_DEV}}", options.addDev).replace("{{STACK_NAME}}", SCAFFOLD_STACK_NAME);
+}
+async function cdkJson() {
+  return readTemplate("cdk.json.template");
+}
+async function cdkApp(options) {
+  const template = await readTemplate("cdk-app.ts.template");
+  return template.replace("{{STACK_NAME}}", SCAFFOLD_STACK_NAME).replace("{{GITHUB_OWNER}}", options.githubOwner).replace("{{GITHUB_REPO}}", options.githubRepo);
+}
+async function cmsStack() {
+  return readTemplate("cms-stack.ts.template");
+}
+function commandsFor(manager) {
+  return COMMANDS[manager];
+}
+async function detectPackageManager(projectDir) {
+  for (const dir of await workspaceSearchPath(projectDir)) {
+    const declared = await readDeclaredPackageManager(dir);
+    if (declared)
+      return declared;
+    if (await filePathExists2(path3.join(dir, "pnpm-lock.yaml")))
+      return "pnpm";
+    if (await filePathExists2(path3.join(dir, "yarn.lock"))) {
+      return await isYarnBerryLockfile(dir) ? "yarn-berry" : "yarn";
+    }
+  }
+  return "npm";
+}
+async function workspaceSearchPath(projectDir) {
+  const start = path3.resolve(projectDir);
+  const dirs = [start];
+  if (!await filePathExists2(path3.join(start, "package.json")))
+    return dirs;
+  let dir = start;
+  for (let depth = 0; depth < MAX_WORKSPACE_DEPTH; depth++) {
+    if (await filePathExists2(path3.join(dir, ".git")))
+      break;
+    const parent = path3.dirname(dir);
+    if (parent === dir)
+      break;
+    dir = parent;
+    dirs.push(dir);
+  }
+  return dirs;
+}
+async function readDeclaredPackageManager(projectDir) {
+  const pkg = await readPackageJson(projectDir);
+  const declared = pkg?.["packageManager"];
+  if (typeof declared !== "string")
+    return null;
+  if (declared.startsWith("pnpm@"))
+    return "pnpm";
+  if (declared.startsWith("npm@"))
+    return "npm";
+  if (declared.startsWith("yarn@")) {
+    const major = Number.parseInt(declared.slice("yarn@".length), 10);
+    if (Number.isFinite(major) && major >= 2)
+      return "yarn-berry";
+    if (Number.isFinite(major))
+      return "yarn";
+    return await isYarnBerryLockfile(projectDir) ? "yarn-berry" : "yarn";
+  }
+  return null;
+}
+async function isYarnBerryLockfile(projectDir) {
+  try {
+    const content = await fs3.readFile(path3.join(projectDir, "yarn.lock"), "utf-8");
+    return content.includes("__metadata:");
+  } catch {
+    return false;
+  }
+}
+async function detectDefaultBranch(projectDir) {
+  const head = await gitRaw(projectDir, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]);
+  if (!head)
+    return "main";
+  const slash = head.indexOf("/");
+  const branch = slash === -1 ? head : head.slice(slash + 1);
+  return branch || "main";
+}
+async function detectGitHubRepo(projectDir) {
+  const url = await gitRaw(projectDir, ["remote", "get-url", "origin"]);
+  if (!url)
+    return null;
+  const match = /github\.com[:/]+([^/]+)\/(.+?)(?:\.git)?\/?$/.exec(url);
+  if (!match)
+    return null;
+  return { owner: match[1], repo: match[2] };
+}
+async function gitRaw(projectDir, args) {
+  try {
+    const output = await simpleGit({ baseDir: projectDir }).raw(args);
+    const trimmed = output.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  } catch {
+    return null;
+  }
+}
+async function readPackageJson(projectDir) {
+  try {
+    const raw = await fs3.readFile(path3.join(projectDir, "package.json"), "utf-8");
+    const parsed = JSON.parse(raw);
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function missingCdkDependencies(projectDir) {
+  const pkg = await readPackageJson(projectDir);
+  const declared = /* @__PURE__ */ new Set();
+  for (const field of ["dependencies", "devDependencies", "peerDependencies"]) {
+    const section = pkg?.[field];
+    if (typeof section === "object" && section !== null) {
+      for (const name of Object.keys(section))
+        declared.add(name);
+    }
+  }
+  return CDK_DEPENDENCIES.filter((name) => !declared.has(name));
 }
 function getTaskQueueDir(config) {
   switch (config.mode) {
     case "prod": {
       const workspace = process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE;
-      return path3.join(path3.resolve(workspace), ".tasks");
+      return path4.join(path4.resolve(workspace), ".tasks");
     }
     case "dev": {
-      return path3.join(process.cwd(), ".canopy-dev", ".tasks");
+      return path4.join(process.cwd(), ".canopy-dev", ".tasks");
     }
   }
 }
@@ -185,24 +332,24 @@ function createDebugLogger(options) {
   return new DebugLogger(options);
 }
 async function atomicWriteFile(filePath, content) {
-  const dir = path4.dirname(filePath);
-  await fs3.mkdir(dir, { recursive: true });
+  const dir = path5.dirname(filePath);
+  await fs4.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs3.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
+  await fs4.writeFile(tempPath, content, typeof content === "string" ? "utf-8" : void 0);
   try {
-    await fs3.rename(tempPath, filePath);
+    await fs4.rename(tempPath, filePath);
   } catch (err) {
-    await fs3.unlink(tempPath).catch(() => {
+    await fs4.unlink(tempPath).catch(() => {
     });
     throw err;
   }
 }
-function isNotFoundError2(err) {
+function isNotFoundError22(err) {
   return err instanceof Error && "code" in err && err.code === "ENOENT";
 }
 async function enqueueTask(taskDir, task, logger = nullLogger) {
   const id = crypto.randomUUID();
-  const pendingDir = path5.join(taskDir, "pending");
+  const pendingDir = path6.join(taskDir, "pending");
   const queuedTask = {
     id,
     action: task.action,
@@ -212,17 +359,17 @@ async function enqueueTask(taskDir, task, logger = nullLogger) {
     retryCount: 0,
     maxRetries: task.maxRetries ?? DEFAULT_MAX_RETRIES
   };
-  const filePath = path5.join(pendingDir, `${id}.json`);
+  const filePath = path6.join(pendingDir, `${id}.json`);
   await atomicWriteFile(filePath, JSON.stringify(queuedTask, null, 2));
   logger.debug("Enqueued task", { id, action: task.action });
   return id;
 }
 async function dequeueTask(taskDir, logger = nullLogger) {
-  const pendingDir = path5.join(taskDir, "pending");
-  const processingDir = path5.join(taskDir, "processing");
+  const pendingDir = path6.join(taskDir, "pending");
+  const processingDir = path6.join(taskDir, "processing");
   let files;
   try {
-    files = await fs4.readdir(pendingDir);
+    files = await fs5.readdir(pendingDir);
   } catch {
     return null;
   }
@@ -233,7 +380,7 @@ async function dequeueTask(taskDir, logger = nullLogger) {
   const tasks = [];
   for (const fileName of jsonFiles) {
     try {
-      const content = await fs4.readFile(path5.join(pendingDir, fileName), "utf-8");
+      const content = await fs5.readFile(path6.join(pendingDir, fileName), "utf-8");
       const task = parseTaskJson(content);
       if (!task) {
         await moveToCorrupt(taskDir, pendingDir, fileName, "Invalid JSON", logger);
@@ -244,7 +391,7 @@ async function dequeueTask(taskDir, logger = nullLogger) {
       }
       tasks.push({ fileName, task });
     } catch (err) {
-      if (isNotFoundError2(err))
+      if (isNotFoundError22(err))
         continue;
       throw err;
     }
@@ -254,21 +401,21 @@ async function dequeueTask(taskDir, logger = nullLogger) {
   tasks.sort((a, b) => a.task.createdAt.localeCompare(b.task.createdAt) || a.task.id.localeCompare(b.task.id));
   for (const { fileName, task } of tasks) {
     if (await taskExistsIn(taskDir, task.id, ["completed", "failed"])) {
-      await fs4.unlink(path5.join(pendingDir, fileName)).catch(() => {
+      await fs5.unlink(path6.join(pendingDir, fileName)).catch(() => {
       });
       logger.debug("Skipped already-finished task", { id: task.id });
       continue;
     }
-    const sourcePath = path5.join(pendingDir, fileName);
-    const destPath = path5.join(processingDir, fileName);
+    const sourcePath = path6.join(pendingDir, fileName);
+    const destPath = path6.join(processingDir, fileName);
     try {
       task.status = "processing";
       await atomicWriteFile(destPath, JSON.stringify(task, null, 2));
-      await fs4.unlink(sourcePath);
+      await fs5.unlink(sourcePath);
       logger.debug("Dequeued task", { id: task.id, action: task.action });
       return task;
     } catch (err) {
-      if (isNotFoundError2(err))
+      if (isNotFoundError22(err))
         continue;
       throw err;
     }
@@ -276,22 +423,22 @@ async function dequeueTask(taskDir, logger = nullLogger) {
   return null;
 }
 async function completeTask(taskDir, taskId, result, logger = nullLogger) {
-  const processingPath = path5.join(taskDir, "processing", `${taskId}.json`);
-  const completedDir = path5.join(taskDir, "completed");
-  const completedPath = path5.join(completedDir, `${taskId}.json`);
+  const processingPath = path6.join(taskDir, "processing", `${taskId}.json`);
+  const completedDir = path6.join(taskDir, "completed");
+  const completedPath = path6.join(completedDir, `${taskId}.json`);
   let task;
   try {
-    const content = await fs4.readFile(processingPath, "utf-8");
+    const content = await fs5.readFile(processingPath, "utf-8");
     const parsed = parseTaskJson(content);
     if (!parsed) {
       logger.debug("Corrupt task file in processing, removing", { id: taskId });
-      await fs4.unlink(processingPath).catch(() => {
+      await fs5.unlink(processingPath).catch(() => {
       });
       return;
     }
     task = parsed;
   } catch (err) {
-    if (isNotFoundError2(err))
+    if (isNotFoundError22(err))
       return;
     throw err;
   }
@@ -299,27 +446,27 @@ async function completeTask(taskDir, taskId, result, logger = nullLogger) {
   task.completedAt = (/* @__PURE__ */ new Date()).toISOString();
   task.result = result;
   await atomicWriteFile(completedPath, JSON.stringify(task, null, 2));
-  await fs4.unlink(processingPath).catch(() => {
+  await fs5.unlink(processingPath).catch(() => {
   });
   logger.debug("Completed task", { id: taskId });
 }
 async function failTask(taskDir, taskId, error, logger = nullLogger) {
-  const processingPath = path5.join(taskDir, "processing", `${taskId}.json`);
-  const failedDir = path5.join(taskDir, "failed");
-  const failedPath = path5.join(failedDir, `${taskId}.json`);
+  const processingPath = path6.join(taskDir, "processing", `${taskId}.json`);
+  const failedDir = path6.join(taskDir, "failed");
+  const failedPath = path6.join(failedDir, `${taskId}.json`);
   let task;
   try {
-    const content = await fs4.readFile(processingPath, "utf-8");
+    const content = await fs5.readFile(processingPath, "utf-8");
     const parsed = parseTaskJson(content);
     if (!parsed) {
       logger.debug("Corrupt task file in processing, removing", { id: taskId });
-      await fs4.unlink(processingPath).catch(() => {
+      await fs5.unlink(processingPath).catch(() => {
       });
       return;
     }
     task = parsed;
   } catch (err) {
-    if (isNotFoundError2(err))
+    if (isNotFoundError22(err))
       return;
     throw err;
   }
@@ -327,27 +474,27 @@ async function failTask(taskDir, taskId, error, logger = nullLogger) {
   task.completedAt = (/* @__PURE__ */ new Date()).toISOString();
   task.error = error;
   await atomicWriteFile(failedPath, JSON.stringify(task, null, 2));
-  await fs4.unlink(processingPath).catch(() => {
+  await fs5.unlink(processingPath).catch(() => {
   });
   logger.debug("Failed task", { id: taskId, error });
 }
 async function retryTask(taskDir, taskId, error, logger = nullLogger) {
-  const processingPath = path5.join(taskDir, "processing", `${taskId}.json`);
-  const pendingDir = path5.join(taskDir, "pending");
-  const pendingPath = path5.join(pendingDir, `${taskId}.json`);
+  const processingPath = path6.join(taskDir, "processing", `${taskId}.json`);
+  const pendingDir = path6.join(taskDir, "pending");
+  const pendingPath = path6.join(pendingDir, `${taskId}.json`);
   let task;
   try {
-    const content = await fs4.readFile(processingPath, "utf-8");
+    const content = await fs5.readFile(processingPath, "utf-8");
     const parsed = parseTaskJson(content);
     if (!parsed) {
       logger.debug("Corrupt task file in processing, removing", { id: taskId });
-      await fs4.unlink(processingPath).catch(() => {
+      await fs5.unlink(processingPath).catch(() => {
       });
       return;
     }
     task = parsed;
   } catch (err) {
-    if (isNotFoundError2(err))
+    if (isNotFoundError22(err))
       return;
     throw err;
   }
@@ -358,17 +505,17 @@ async function retryTask(taskDir, taskId, error, logger = nullLogger) {
   task.retryAfter = new Date(Date.now() + backoffMs).toISOString();
   task.error = error;
   await atomicWriteFile(pendingPath, JSON.stringify(task, null, 2));
-  await fs4.unlink(processingPath).catch(() => {
+  await fs5.unlink(processingPath).catch(() => {
   });
   logger.debug("Retrying task", { id: taskId, retryCount, backoffMs });
 }
 async function requeueFailedTask(taskDir, taskId, logger = nullLogger) {
-  const failedPath = path5.join(taskDir, "failed", `${taskId}.json`);
+  const failedPath = path6.join(taskDir, "failed", `${taskId}.json`);
   let content;
   try {
-    content = await fs4.readFile(failedPath, "utf-8");
+    content = await fs5.readFile(failedPath, "utf-8");
   } catch (err) {
-    if (isNotFoundError2(err))
+    if (isNotFoundError22(err))
       return { error: "not-found" };
     throw err;
   }
@@ -385,37 +532,37 @@ async function requeueFailedTask(taskDir, taskId, logger = nullLogger) {
     retryCount: 0,
     maxRetries: original.maxRetries
   };
-  const pendingPath = path5.join(taskDir, "pending", `${newTaskId}.json`);
+  const pendingPath = path6.join(taskDir, "pending", `${newTaskId}.json`);
   await atomicWriteFile(pendingPath, JSON.stringify(newTask, null, 2));
-  await fs4.unlink(failedPath).catch(() => {
+  await fs5.unlink(failedPath).catch(() => {
   });
   logger.debug("Requeued failed task", { originalId: taskId, newTaskId });
   return { newTaskId };
 }
 async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLogger) {
-  const processingDir = path5.join(taskDir, "processing");
-  const pendingDir = path5.join(taskDir, "pending");
+  const processingDir = path6.join(taskDir, "processing");
+  const pendingDir = path6.join(taskDir, "pending");
   let files;
   try {
-    files = await fs4.readdir(processingDir);
+    files = await fs5.readdir(processingDir);
   } catch {
     return 0;
   }
   const now = Date.now();
   let recovered = 0;
   for (const fileName of files.filter((f) => f.endsWith(".json"))) {
-    const filePath = path5.join(processingDir, fileName);
+    const filePath = path6.join(processingDir, fileName);
     try {
-      const stat = await fs4.stat(filePath);
+      const stat = await fs5.stat(filePath);
       if (now - stat.mtimeMs >= maxAgeMs) {
-        const content = await fs4.readFile(filePath, "utf-8");
+        const content = await fs5.readFile(filePath, "utf-8");
         const task = parseTaskJson(content);
         if (!task) {
           await moveToCorrupt(taskDir, processingDir, fileName, "Invalid JSON during recovery", logger);
           continue;
         }
         if (await taskExistsIn(taskDir, task.id, ["completed", "failed"])) {
-          await fs4.unlink(filePath).catch(() => {
+          await fs5.unlink(filePath).catch(() => {
           });
           logger.debug("Cleaned up orphaned task (already finished)", {
             id: task.id
@@ -423,8 +570,8 @@ async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLo
           continue;
         }
         task.status = "pending";
-        await atomicWriteFile(path5.join(pendingDir, fileName), JSON.stringify(task, null, 2));
-        await fs4.unlink(filePath);
+        await atomicWriteFile(path6.join(pendingDir, fileName), JSON.stringify(task, null, 2));
+        await fs5.unlink(filePath);
         logger.debug("Recovered orphaned task", {
           id: task.id,
           action: task.action
@@ -432,7 +579,7 @@ async function recoverOrphanedTasks(taskDir, maxAgeMs = 5 * 6e4, logger = nullLo
         recovered++;
       }
     } catch (err) {
-      if (isNotFoundError2(err))
+      if (isNotFoundError22(err))
         continue;
       logger.debug("Failed to recover task", { fileName });
     }
@@ -443,19 +590,19 @@ async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 6e4, logger =
   const now = Date.now();
   let cleaned = 0;
   for (const subdir of ["completed", "failed"]) {
-    const dir = path5.join(taskDir, subdir);
+    const dir = path6.join(taskDir, subdir);
     let files;
     try {
-      files = await fs4.readdir(dir);
+      files = await fs5.readdir(dir);
     } catch {
       continue;
     }
     for (const fileName of files.filter((f) => f.endsWith(".json"))) {
       try {
-        const filePath = path5.join(dir, fileName);
-        const stat = await fs4.stat(filePath);
+        const filePath = path6.join(dir, fileName);
+        const stat = await fs5.stat(filePath);
         if (now - stat.mtimeMs >= maxAgeMs) {
-          await fs4.unlink(filePath);
+          await fs5.unlink(filePath);
           cleaned++;
         }
       } catch {
@@ -469,9 +616,9 @@ async function cleanupOldTasks(taskDir, maxAgeMs = 30 * 24 * 60 * 6e4, logger =
 }
 async function getTask(taskDir, taskId) {
   for (const subdir of ["completed", "failed", "processing", "pending"]) {
-    const filePath = path5.join(taskDir, subdir, `${taskId}.json`);
+    const filePath = path6.join(taskDir, subdir, `${taskId}.json`);
     try {
-      const content = await fs4.readFile(filePath, "utf-8");
+      const content = await fs5.readFile(filePath, "utf-8");
       return parseTaskJson(content);
     } catch {
       continue;
@@ -480,10 +627,10 @@ async function getTask(taskDir, taskId) {
   return null;
 }
 async function listTasks(taskDir, status, limit = 100) {
-  const dir = path5.join(taskDir, status);
+  const dir = path6.join(taskDir, status);
   let files;
   try {
-    files = await fs4.readdir(dir);
+    files = await fs5.readdir(dir);
   } catch {
     return [];
   }
@@ -492,7 +639,7 @@ async function listTasks(taskDir, status, limit = 100) {
     if (tasks.length >= limit)
       break;
     try {
-      const content = await fs4.readFile(path5.join(dir, fileName), "utf-8");
+      const content = await fs5.readFile(path6.join(dir, fileName), "utf-8");
       const task = parseTaskJson(content);
       if (task)
         tasks.push(task);
@@ -512,9 +659,9 @@ async function getQueueStats(taskDir) {
     corrupt: 0
   };
   for (const status of ["pending", "processing", "completed", "failed", "corrupt"]) {
-    const dir = path5.join(taskDir, status);
+    const dir = path6.join(taskDir, status);
     try {
-      const files = await fs4.readdir(dir);
+      const files = await fs5.readdir(dir);
       stats[status] = files.filter((f) => f.endsWith(".json")).length;
     } catch {
     }
@@ -522,20 +669,20 @@ async function getQueueStats(taskDir) {
   return stats;
 }
 async function listCorruptTaskFiles(taskDir, limit = 50, logger = nullLogger) {
-  const corruptDir = path5.join(taskDir, "corrupt");
+  const corruptDir = path6.join(taskDir, "corrupt");
   let files;
   try {
-    files = await fs4.readdir(corruptDir);
+    files = await fs5.readdir(corruptDir);
   } catch (err) {
-    if (isNotFoundError2(err))
+    if (isNotFoundError22(err))
       return [];
     throw err;
   }
   const entries = [];
   for (const fileName of files.filter((f) => f.endsWith(".json"))) {
-    const filePath = path5.join(corruptDir, fileName);
+    const filePath = path6.join(corruptDir, fileName);
     try {
-      const stat = await fs4.stat(filePath);
+      const stat = await fs5.stat(filePath);
       entries.push({
         fileName,
         size: stat.size,
@@ -543,7 +690,7 @@ async function listCorruptTaskFiles(taskDir, limit = 50, logger = nullLogger) {
         rawSnippet: await readSnippet(filePath, 500)
       });
     } catch (err) {
-      if (isNotFoundError2(err))
+      if (isNotFoundError22(err))
         continue;
       logger.debug("Failed to read corrupt task file", { fileName });
     }
@@ -552,7 +699,7 @@ async function listCorruptTaskFiles(taskDir, limit = 50, logger = nullLogger) {
   return entries.slice(0, limit);
 }
 async function readSnippet(filePath, maxBytes) {
-  const handle = await fs4.open(filePath, "r");
+  const handle = await fs5.open(filePath, "r");
   try {
     const buffer = Buffer.alloc(maxBytes);
     const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0);
@@ -575,7 +722,7 @@ function parseTaskJson(content) {
 async function taskExistsIn(taskDir, taskId, subdirs) {
   for (const subdir of subdirs) {
     try {
-      await fs4.stat(path5.join(taskDir, subdir, `${taskId}.json`));
+      await fs5.stat(path6.join(taskDir, subdir, `${taskId}.json`));
       return true;
     } catch {
     }
@@ -583,16 +730,33 @@ async function taskExistsIn(taskDir, taskId, subdirs) {
   return false;
 }
 async function moveToCorrupt(taskDir, sourceDir, fileName, reason, logger) {
-  const corruptDir = path5.join(taskDir, "corrupt");
+  const corruptDir = path6.join(taskDir, "corrupt");
   try {
-    await fs4.mkdir(corruptDir, { recursive: true });
-    await fs4.rename(path5.join(sourceDir, fileName), path5.join(corruptDir, fileName));
+    await fs5.mkdir(corruptDir, { recursive: true });
+    await fs5.rename(path6.join(sourceDir, fileName), path6.join(corruptDir, fileName));
     logger.debug("Moved corrupt task file", { fileName, reason });
   } catch {
-    await fs4.unlink(path5.join(sourceDir, fileName)).catch(() => {
+    await fs5.unlink(path6.join(sourceDir, fileName)).catch(() => {
     });
   }
 }
+function canopyLogWarn(...args) {
+  active.warn(...args);
+}
+function resolveDeploymentName(config, modeDefault) {
+  const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
+  const configValue = config.deploymentName;
+  if (envValue && configValue && envValue !== configValue && !warned) {
+    canopyLogWarn(`CanopyCMS: CANOPYCMS_DEPLOYMENT_NAME ("${envValue}") differs from config.deploymentName ("${configValue}") \u2014 using the env var (infra-stamped env wins over shared-repo config by design; see resolveDeploymentName's doc comment). Update config.deploymentName to match if this mismatch was unintentional.`);
+    warned = true;
+  }
+  const resolved = envValue || configValue || modeDefault;
+  if (!isValidDeploymentName(resolved)) {
+    const source = envValue ? "CANOPYCMS_DEPLOYMENT_NAME" : configValue ? "config.deploymentName" : "the mode default";
+    throw new Error(`CanopyCMS: invalid deploymentName ${JSON.stringify(resolved)} (from ${source}). It is interpolated into the settings branch name (canopycms-settings-<deploymentName>), so it must start with a letter or digit, contain only letters, digits, '.', '_' or '-', and must not contain '..' or end with '.' or '.lock'.`);
+  }
+  return resolved;
+}
 function operatingStrategy(mode) {
   const cached = strategyCache.get(mode);
   if (cached)
@@ -618,33 +782,8 @@ function assertAuthPluginAllowedForMode(plugin, mode) {
     throw new Error("CanopyCMS: an auth plugin was configured with mode: 'prod' but does not affirm `verifiesCredentials: true`. This plugin performs no real credential verification, so anyone could impersonate any user (including admins). Configure a verifying auth plugin for production (e.g. createClerkAuthPlugin from 'canopycms-auth-clerk' with CLERK_SECRET_KEY set), or run with mode: 'dev' for local development.");
   }
 }
-function getErrorMessage2(err) {
-  if (err instanceof Error) {
-    return err.message;
-  }
-  if (typeof err === "string") {
-    return err;
-  }
-  return String(err);
-}
-function isNodeError2(err) {
-  return err instanceof Error && "code" in err;
-}
-function isNotFoundError3(err) {
-  return isNodeError2(err) && err.code === "ENOENT";
-}
-async function filePathExists2(filePath) {
-  try {
-    await fs6.stat(filePath);
-    return true;
-  } catch (err) {
-    if (isNotFoundError3(err))
-      return false;
-    throw err;
-  }
-}
 async function writeFile(filePath, content, options) {
-  const relativePath = path6.relative(process.cwd(), filePath);
+  const relativePath = path7.relative(process.cwd(), filePath);
   if (await filePathExists2(filePath)) {
     if (options.force) {
     } else if (options.nonInteractive) {
@@ -661,8 +800,8 @@ async function writeFile(filePath, content, options) {
       }
     }
   }
-  await fs5.mkdir(path6.dirname(filePath), { recursive: true });
-  await fs5.writeFile(filePath, content, "utf-8");
+  await fs6.mkdir(path7.dirname(filePath), { recursive: true });
+  await fs6.writeFile(filePath, content, "utf-8");
   p.log.success(`created: ${relativePath}`);
   return true;
 }
@@ -714,24 +853,24 @@ async function init(options) {
   }
   const serverPageExt = staticBuild ? "page.server.tsx" : "page.tsx";
   const serverRouteExt = staticBuild ? "route.server.ts" : "route.ts";
-  await writeFile(path6.join(projectDir, "canopycms.config.ts"), await canopyCmsConfig2({ mode, staticBuild }), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, "lib/canopy.ts"), await canopyContext2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, "schemas.ts"), await schemasTemplate2(), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, `api/canopycms/[...canopycms]/${serverRouteExt}`), await apiRoute2({
+  await writeFile(path7.join(projectDir, "canopycms.config.ts"), await canopyCmsConfig2({ mode, staticBuild }), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, "lib/canopy.ts"), await canopyContext2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, "schemas.ts"), await schemasTemplate2(), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, `api/canopycms/[...canopycms]/${serverRouteExt}`), await apiRoute2({
     canopyImport: "../".repeat(3) + "lib/canopy"
   }), writeOpts);
-  await writeFile(path6.join(projectDir, appDir, `edit/${serverPageExt}`), await editPage2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
+  await writeFile(path7.join(projectDir, appDir, `edit/${serverPageExt}`), await editPage2({ configImport: configImportPath(appDir, 1), authProvider }), writeOpts);
   if (ai) {
-    await writeFile(path6.join(projectDir, appDir, "ai/config.ts"), await aiConfig2(), writeOpts);
-    await writeFile(path6.join(projectDir, appDir, `ai/[...path]/${serverRouteExt}`), await aiRoute2({ configImport: configImportPath(appDir, 2) }), writeOpts);
+    await writeFile(path7.join(projectDir, appDir, "ai/config.ts"), await aiConfig2(), writeOpts);
+    await writeFile(path7.join(projectDir, appDir, `ai/[...path]/${serverRouteExt}`), await aiRoute2({ configImport: configImportPath(appDir, 2) }), writeOpts);
   }
-  await writeFile(path6.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
-  await writeFile(path6.join(projectDir, "middleware.ts"), await middleware2({ authProvider }), writeOpts);
-  const gitignorePath = path6.join(projectDir, ".gitignore");
+  await writeFile(path7.join(projectDir, "next.config.ts"), await nextConfig2({ staticBuild }), writeOpts);
+  await writeFile(path7.join(projectDir, "middleware.ts"), await middleware2({ authProvider }), writeOpts);
+  const gitignorePath = path7.join(projectDir, ".gitignore");
   if (await filePathExists2(gitignorePath)) {
-    const content = await fs5.readFile(gitignorePath, "utf-8");
+    const content = await fs6.readFile(gitignorePath, "utf-8");
     if (!content.includes(".canopy-dev")) {
-      await fs5.appendFile(gitignorePath, "\n# CanopyCMS\n.canopy-dev/\n");
+      await fs6.appendFile(gitignorePath, "\n# CanopyCMS\n.canopy-dev/\n");
       p.log.success("updated: .gitignore");
     }
   }
@@ -756,36 +895,80 @@ async function init(options) {
 async function initDeployAws(options) {
   const { projectDir, force, nonInteractive } = options;
   const writeOpts = { force, nonInteractive };
-  const { dockerfileCms: dockerfileCms2, dockerignore: dockerignore2, githubWorkflowCms: githubWorkflowCms2 } = await Promise.resolve().then(() => (init_templates(), templates_exports));
+  const { dockerfileCms: dockerfileCms2, dockerignore: dockerignore2, githubWorkflowCms: githubWorkflowCms2, cdkJson: cdkJson2, cdkApp: cdkApp2, cmsStack: cmsStack2 } = await Promise.resolve().then(() => (init_templates(), templates_exports));
+  const { detectPackageManager: detectPackageManager2, detectDefaultBranch: detectDefaultBranch2, detectGitHubRepo: detectGitHubRepo2, commandsFor: commandsFor2, missingCdkDependencies: missingCdkDependencies2, CDK_DEPENDENCIES: CDK_DEPENDENCIES2 } = await Promise.resolve().then(() => (init_project_detect(), project_detect_exports));
   p.intro("CanopyCMS init-deploy aws");
-  await writeFile(path6.join(projectDir, "Dockerfile.cms"), await dockerfileCms2(), writeOpts);
-  const dockerignoreWritten = await writeFile(path6.join(projectDir, ".dockerignore"), await dockerignore2(), writeOpts);
+  const packageManager = await detectPackageManager2(projectDir);
+  const pm = commandsFor2(packageManager);
+  const defaultBranch = await detectDefaultBranch2(projectDir);
+  const repo = await detectGitHubRepo2(projectDir);
+  await writeFile(path7.join(projectDir, "Dockerfile.cms"), await dockerfileCms2({ copy: pm.dockerCopy, install: pm.dockerInstall, build: pm.build }), writeOpts);
+  const dockerignoreWritten = await writeFile(path7.join(projectDir, ".dockerignore"), await dockerignore2(), writeOpts);
   if (!dockerignoreWritten) {
-    p.log.warn("Existing .dockerignore kept \u2014 verify it excludes .env* (secrets would otherwise enter the build context) and does NOT exclude vendor/ (needed for `npm ci` with file: deps).");
+    p.log.warn("Existing .dockerignore kept \u2014 verify it excludes .env* (secrets would otherwise enter the build context) and does NOT exclude vendor/ (needed by the Dockerfile.cms install step with file: deps).");
   }
-  await writeFile(path6.join(projectDir, ".github/workflows/deploy-cms.yml"), await githubWorkflowCms2(), writeOpts);
-  const nextConfigPath = path6.join(projectDir, "next.config.ts");
-  const nextConfigMjsPath = path6.join(projectDir, "next.config.mjs");
+  await writeFile(path7.join(projectDir, ".github/workflows/deploy-cms.yml"), await githubWorkflowCms2({
+    defaultBranch,
+    lockfile: pm.lockfile,
+    ciInstall: pm.ciInstall,
+    addDev: pm.addDev
+  }), writeOpts);
+  const cdkJsonPath = path7.join(projectDir, "cdk.json");
+  const existingCdkJson = await filePathExists2(cdkJsonPath) ? await fs6.readFile(cdkJsonPath, "utf-8") : null;
+  const cdkJsonWritten = await writeFile(cdkJsonPath, await cdkJson2(), writeOpts);
+  await writeFile(path7.join(projectDir, "infrastructure/bin/app.ts"), await cdkApp2({
+    githubOwner: repo?.owner ?? "your-org",
+    githubRepo: repo?.repo ?? "your-docs-site"
+  }), writeOpts);
+  await writeFile(path7.join(projectDir, "infrastructure/lib/cms-stack.ts"), await cmsStack2(), writeOpts);
+  if (!cdkJsonWritten && existingCdkJson && !existingCdkJson.includes("infrastructure/bin/app.ts")) {
+    p.log.warn("Existing cdk.json kept, and it does not point at infrastructure/bin/app.ts \u2014 the scaffolded CDK app will not be deployed. Either wire CmsStack into your own app entry point, or re-run with --force to replace cdk.json.");
+  }
+  const nextConfigPath = path7.join(projectDir, "next.config.ts");
+  const nextConfigMjsPath = path7.join(projectDir, "next.config.mjs");
   const configPath = await filePathExists2(nextConfigPath) ? nextConfigPath : await filePathExists2(nextConfigMjsPath) ? nextConfigMjsPath : null;
   if (configPath) {
-    const content = await fs5.readFile(configPath, "utf-8");
+    const content = await fs6.readFile(configPath, "utf-8");
     if (!content.includes("CANOPY_BUILD")) {
       p.note([
-        `Add dual build support to ${path6.basename(configPath)}:`,
+        `Add dual build support to ${path7.basename(configPath)}:`,
         "",
         "  output: process.env.CANOPY_BUILD === 'cms' ? 'standalone' : 'export',"
       ].join("\n"), "Manual step");
     }
   }
-  p.note("CDK constructs are available via the canopycms-cdk package.\nSee the deployment plan for CDK stack setup.", "AWS deployment");
+  if (packageManager === "yarn" || packageManager === "yarn-berry") {
+    p.log.warn(`Yarn detected (${packageManager === "yarn-berry" ? "Berry" : "classic"}). The generated install lines are a best effort and are not exercised by CanopyCMS tests \u2014 review them in Dockerfile.cms and .github/workflows/deploy-cms.yml.` + (packageManager === "yarn-berry" ? " Berry additionally requires nodeLinker: node-modules; PnP is incompatible with Next.js standalone output, which the CMS image's runner stage copies." : ""));
+  }
+  const missing = await missingCdkDependencies2(projectDir);
+  if (missing.length > 0) {
+    p.log.warn(`Not installed: ${missing.join(", ")}. cdk.json runs \`node --import tsx infrastructure/bin/app.ts\`, so the deploy fails without them:
+   ${pm.addDev} ${CDK_DEPENDENCIES2.join(" ")}`);
+  }
+  p.note([
+    "1. Install the CDK dependencies (if you have not already):",
+    `   ${pm.addDev} ${CDK_DEPENDENCIES2.join(" ")}`,
+    "",
+    "2. Fill in infrastructure/lib/cms-stack.ts and infrastructure/bin/app.ts",
+    `   (worker repo currently set to ${repo ? `${repo.owner}/${repo.repo}` : "your-org/your-docs-site"})`,
+    "",
+    "3. Bootstrap CDK in the target account/region: cdk bootstrap",
+    "",
+    "4. Set the repository secrets and variables listed at the top of",
+    "   .github/workflows/deploy-cms.yml \u2014 the deploy fails at synth without them.",
+    "",
+    `Deploys trigger on pushes to '${defaultBranch}'; edit the workflow to change that.`,
+    "",
+    "Full walkthrough: docs/deploying-to-aws.md"
+  ].join("\n"), "AWS deployment");
   p.outro("Done!");
 }
 async function detectMode(projectDir) {
-  const cfgPath = path6.join(projectDir, "canopycms.config.ts");
+  const cfgPath = path7.join(projectDir, "canopycms.config.ts");
   try {
-    await fs5.stat(cfgPath);
+    await fs6.stat(cfgPath);
   } catch (err) {
-    if (isNotFoundError3(err))
+    if (isNotFoundError2(err))
       return "dev";
     throw err;
   }
@@ -814,7 +997,7 @@ async function workerRunOnce(options) {
     assertAuthPluginAllowedForMode(options.authPlugin, mode);
   }
   const taskDir = getTaskQueueDir2({ mode });
-  const cachePath = process.env.CANOPY_AUTH_CACHE_PATH ?? path6.join(operatingStrategy(mode).getWorkspaceRoot(options.projectDir), ".cache");
+  const cachePath = process.env.CANOPY_AUTH_CACHE_PATH ?? path7.join(operatingStrategy(mode).getWorkspaceRoot(options.projectDir), ".cache");
   let refreshAuthCache;
   const authMode = process.env.CANOPY_AUTH_MODE || "dev";
   if (options.authPlugin?.createCacheRefresher) {
@@ -864,7 +1047,7 @@ CanopyCMS worker run-once (mode: ${mode}, auth: ${authMode})
   }
   console.log("\nDone");
 }
-var __defProp2, __getOwnPropNames2, __esm2, __export2, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_validation, init_helpers, init_config2, templates_exports, __dirname, TEMPLATES_DIR, init_templates, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, ProdStrategy, DevStrategy, strategyCache;
+var __defProp2, __getOwnPropNames2, __esm2, __export2, primitiveFieldTypes, fieldTypes, init_types, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, permissionTargetSchema, pathPermissionSchema, init_permissions, init_normalize, init_types2, init_flatten, init_validation, init_helpers, init_config2, init_error2, init_fs2, templates_exports, __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME, init_templates, project_detect_exports, COMMANDS, MAX_WORKSPACE_DEPTH, CDK_DEPENDENCIES, init_project_detect, task_queue_config_exports, init_task_queue_config, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, init_task_queue2, task_queue_exports, debugLogger, cmsTaskQueueLogger, init_task_queue3, ProdClientSafeStrategy, DevClientSafeStrategy, active, warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName, ProdStrategy, DevStrategy, strategyCache;
 var init_init = __esm({
   "dist/cli/init.js"() {
     "use strict";
@@ -1116,6 +1299,16 @@ var init_init = __esm({
           allowNetworkRemoteInProd: z4.boolean().optional(),
           settingsBranch: z4.string().optional(),
           autoCreateSettingsPR: z4.boolean().optional(),
+          // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
+          // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
+          // the literal 'prod' instead of staying `undefined` — collapsing the
+          // env > config > modeDefault precedence chain that resolveDeploymentName
+          // (operating-mode/deployment-name.ts) implements: config would then always
+          // "win" over modeDefault (masking dev's real default of 'local'), and the env
+          // var would just be racing config's baked-in 'prod' instead of a true absence.
+          // `.optional()` here is what keeps an omitted deploymentName reaching
+          // resolveDeploymentName as `undefined`, so it can fall through to modeDefault.
+          // Do not "fix" this by removing `.optional()`.
           deploymentName: deploymentNameSchema.optional(),
           contentRoot: contentRootSchema.default("content"),
           sourceRoot: sourceRootSchema.optional(),
@@ -1187,13 +1380,28 @@ var init_init = __esm({
         init_helpers();
       }
     });
+    init_error2 = __esm2({
+      "dist/utils/error.js"() {
+        "use strict";
+      }
+    });
+    init_fs2 = __esm2({
+      "dist/utils/fs.js"() {
+        "use strict";
+        init_error2();
+      }
+    });
     templates_exports = {};
     __export2(templates_exports, {
+      SCAFFOLD_STACK_NAME: () => SCAFFOLD_STACK_NAME,
       aiConfig: () => aiConfig,
       aiRoute: () => aiRoute,
       apiRoute: () => apiRoute,
       canopyCmsConfig: () => canopyCmsConfig,
       canopyContext: () => canopyContext,
+      cdkApp: () => cdkApp,
+      cdkJson: () => cdkJson,
+      cmsStack: () => cmsStack,
       dockerfileCms: () => dockerfileCms,
       dockerignore: () => dockerignore,
       editPage: () => editPage,
@@ -1207,6 +1415,65 @@ var init_init = __esm({
         "use strict";
         __dirname = path2.dirname(fileURLToPath(import.meta.url));
         TEMPLATES_DIR = path2.join(__dirname, "template-files");
+        SCAFFOLD_STACK_NAME = "CanopyCms";
+      }
+    });
+    project_detect_exports = {};
+    __export2(project_detect_exports, {
+      CDK_DEPENDENCIES: () => CDK_DEPENDENCIES,
+      commandsFor: () => commandsFor,
+      detectDefaultBranch: () => detectDefaultBranch,
+      detectGitHubRepo: () => detectGitHubRepo,
+      detectPackageManager: () => detectPackageManager,
+      missingCdkDependencies: () => missingCdkDependencies,
+      readPackageJson: () => readPackageJson
+    });
+    init_project_detect = __esm2({
+      "dist/cli/project-detect.js"() {
+        "use strict";
+        init_fs2();
+        COMMANDS = {
+          npm: {
+            lockfile: "package-lock.json",
+            ciInstall: "npm ci",
+            dockerCopy: "COPY package*.json ./",
+            dockerInstall: "RUN npm ci",
+            build: "npm run build",
+            addDev: "npm install --save-dev"
+          },
+          pnpm: {
+            lockfile: "pnpm-lock.yaml",
+            ciInstall: "corepack enable && pnpm install --frozen-lockfile",
+            dockerCopy: "COPY package.json pnpm-lock.yaml ./",
+            dockerInstall: "RUN corepack enable && pnpm install --frozen-lockfile",
+            build: "pnpm run build",
+            addDev: "pnpm add -D"
+          },
+          yarn: {
+            lockfile: "yarn.lock",
+            ciInstall: "corepack enable && yarn install --frozen-lockfile",
+            dockerCopy: "COPY package.json yarn.lock ./",
+            dockerInstall: "RUN corepack enable && yarn install --frozen-lockfile",
+            build: "yarn build",
+            addDev: "yarn add -D"
+          },
+          "yarn-berry": {
+            lockfile: "yarn.lock",
+            ciInstall: "corepack enable && yarn install --immutable",
+            dockerCopy: "COPY package.json yarn.lock .yarnrc.yml ./",
+            dockerInstall: "RUN corepack enable && yarn install --immutable",
+            build: "yarn build",
+            addDev: "yarn add -D"
+          }
+        };
+        MAX_WORKSPACE_DEPTH = 8;
+        CDK_DEPENDENCIES = [
+          "canopycms-cdk",
+          "aws-cdk-lib",
+          "constructs",
+          "tsx",
+          "aws-cdk"
+        ];
       }
     });
     task_queue_config_exports = {};
@@ -1240,10 +1507,21 @@ var init_init = __esm({
             const minLevel = this.options.minLevel ?? "DEBUG";
             return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
           }
+          /**
+           * The ISO-8601 timestamp leads the line BARE - not wrapped in brackets as it
+           * once was. `CANOPYCMS_DEBUG=true` can be set on the EC2 worker, whose stdout
+           * appends to /var/log/canopy-worker/worker.log; the CloudWatch agent's
+           * `multi_line_start_pattern` matches the timestamp at the START of a line
+           * (see worker/log.ts's INVARIANT and cms-service.ts's agent config), so a
+           * leading `[` meant every debug line was silently folded into the previous
+           * event instead of starting its own. The bracketed `[prefix:category]` and
+           * `[level]` fields still follow, so the human-readable shape is unchanged
+           * apart from those two characters.
+           */
           formatMessage(level, category, message) {
             const timestamp = (/* @__PURE__ */ new Date()).toISOString();
             const prefix = this.options.prefix ?? "CanopyCMS";
-            return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+            return `${timestamp} [${prefix}:${category}] [${level}] ${message}`;
           }
           debug(category, message, data) {
             if (this.shouldLog("DEBUG")) {
@@ -1422,6 +1700,10 @@ var init_init = __esm({
         return true;
       }
     };
+    active = console;
+    warned = false;
+    VALID_DEPLOYMENT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+    isValidDeploymentName = (name) => VALID_DEPLOYMENT_NAME.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
     init_config2();
     ProdStrategy = class extends ProdClientSafeStrategy {
       // All client-safe methods inherited automatically from ProdClientSafeStrategy:
@@ -1430,32 +1712,32 @@ var init_init = __esm({
       // - shouldCommit(), shouldPush()
       // Add client-unsafe methods (use Node.js APIs)
       getWorkspaceRoot(_sourceRoot) {
-        return path7.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
+        return path8.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
       }
-      getContentRoot(sourceRoot) {
-        return path7.resolve(sourceRoot ?? process.cwd(), "content");
+      getContentRoot(contentRoot, sourceRoot) {
+        return path8.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
-        return path7.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path8.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path7.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path8.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path7.join(root, this.getPermissionsFileName());
+        return path8.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path7.join(root, this.getGroupsFileName());
+        return path8.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
           shouldAutoInitLocal: false,
           defaultRemotePath: "",
           envVarName: "CANOPYCMS_REMOTE_URL",
-          autoDetectRemotePath: path7.join(this.getWorkspaceRoot(), "remote.git")
+          autoDetectRemotePath: path8.join(this.getWorkspaceRoot(), "remote.git")
         };
       }
       requiresExistingRepo() {
@@ -1464,11 +1746,10 @@ var init_init = __esm({
       getSettingsBranchName(config) {
         if (config.settingsBranch)
           return config.settingsBranch;
-        const deploymentName = config.deploymentName ?? "prod";
-        return `canopycms-settings-${deploymentName}`;
+        return `canopycms-settings-${resolveDeploymentName(config, "prod")}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path7.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path8.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -1485,25 +1766,25 @@ var init_init = __esm({
     DevStrategy = class extends DevClientSafeStrategy {
       // Inherits client-safe methods from DevClientSafeStrategy
       getWorkspaceRoot(sourceRoot) {
-        return path7.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
+        return path8.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
-      getContentRoot(sourceRoot) {
-        return path7.resolve(sourceRoot ?? process.cwd(), "content");
+      getContentRoot(contentRoot, sourceRoot) {
+        return path8.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
-        return path7.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
+        return path8.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
       }
       getContentBranchRoot(branchName, sourceRoot) {
-        return path7.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
+        return path8.resolve(this.getContentBranchesRoot(sourceRoot), branchName);
       }
       getGitExcludePattern() {
         return ".canopy-meta/";
       }
       getPermissionsFilePath(root) {
-        return path7.join(root, this.getPermissionsFileName());
+        return path8.join(root, this.getPermissionsFileName());
       }
       getGroupsFilePath(root) {
-        return path7.join(root, this.getGroupsFileName());
+        return path8.join(root, this.getGroupsFileName());
       }
       getRemoteUrlConfig() {
         return {
@@ -1518,11 +1799,10 @@ var init_init = __esm({
       getSettingsBranchName(config) {
         if (config.settingsBranch)
           return config.settingsBranch;
-        const deploymentName = config.deploymentName ?? "local";
-        return `canopycms-settings-${deploymentName}`;
+        return `canopycms-settings-${resolveDeploymentName(config, "local")}`;
       }
       getSettingsRoot(sourceRoot) {
-        return path7.join(this.getWorkspaceRoot(sourceRoot), "settings");
+        return path8.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
       usesSeparateSettingsBranch() {
         return true;
@@ -1534,6 +1814,8 @@ var init_init = __esm({
       }
     };
     strategyCache = /* @__PURE__ */ new Map();
+    init_fs2();
+    init_error2();
   }
 });
 
@@ -1555,12 +1837,12 @@ import { createJiti as createJiti2 } from "jiti";
 import fs16 from "node:fs/promises";
 import path17 from "node:path";
 import fs8 from "node:fs/promises";
-import path8 from "node:path";
+import path82 from "node:path";
 import matter from "gray-matter";
 import { parse as yamlParse, stringify as yamlStringify } from "yaml";
 import fs7 from "node:fs/promises";
 import path9 from "node:path";
-import fs22 from "node:fs/promises";
+import fs23 from "node:fs/promises";
 import path22 from "node:path";
 import { generate } from "short-uuid";
 import path32 from "node:path";
@@ -1592,7 +1874,7 @@ import lockfile from "proper-lockfile";
 import fs14 from "node:fs/promises";
 import path14 from "node:path";
 import { simpleGit as simpleGit2 } from "simple-git";
-import { simpleGit } from "simple-git";
+import { simpleGit as simpleGit3 } from "simple-git";
 import fs13 from "node:fs/promises";
 import path13 from "node:path";
 import lockfile2 from "proper-lockfile";
@@ -1623,6 +1905,12 @@ function trimSlashes(path192) {
     end--;
   return path192.slice(start, end);
 }
+function canopyLogWarn2(...args) {
+  active2.warn(...args);
+}
+function canopyLogError(...args) {
+  active2.error(...args);
+}
 function clientOperatingStrategy(mode) {
   const cached = clientStrategyCache.get(mode);
   if (cached)
@@ -1646,6 +1934,20 @@ function clientOperatingStrategy(mode) {
 function clearClientStrategyCache() {
   clientStrategyCache.clear();
 }
+function resolveDeploymentName2(config, modeDefault) {
+  const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
+  const configValue = config.deploymentName;
+  if (envValue && configValue && envValue !== configValue && !warned2) {
+    canopyLogWarn2(`CanopyCMS: CANOPYCMS_DEPLOYMENT_NAME ("${envValue}") differs from config.deploymentName ("${configValue}") \u2014 using the env var (infra-stamped env wins over shared-repo config by design; see resolveDeploymentName's doc comment). Update config.deploymentName to match if this mismatch was unintentional.`);
+    warned2 = true;
+  }
+  const resolved = envValue || configValue || modeDefault;
+  if (!isValidDeploymentName2(resolved)) {
+    const source = envValue ? "CANOPYCMS_DEPLOYMENT_NAME" : configValue ? "config.deploymentName" : "the mode default";
+    throw new Error(`CanopyCMS: invalid deploymentName ${JSON.stringify(resolved)} (from ${source}). It is interpolated into the settings branch name (canopycms-settings-<deploymentName>), so it must start with a letter or digit, contain only letters, digits, '.', '_' or '-', and must not contain '..' or end with '.' or '.lock'.`);
+  }
+  return resolved;
+}
 function operatingStrategy2(mode) {
   const cached = strategyCache2.get(mode);
   if (cached)
@@ -1735,7 +2037,7 @@ function getErrorMessage3(err) {
 function isNodeError3(err) {
   return err instanceof Error && "code" in err;
 }
-function isNotFoundError4(err) {
+function isNotFoundError3(err) {
   return isNodeError3(err) && err.code === "ENOENT";
 }
 function isFileExistsError2(err) {
@@ -1783,7 +2085,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return null;
       }
     } catch (err) {
-      if (isNotFoundError4(err))
+      if (isNotFoundError3(err))
         return null;
       throw err;
     }
@@ -1923,7 +2225,7 @@ async function scanForCollectionMeta(baseDir, relativePath = "") {
         collections.push(...nestedCollections);
       } catch (err) {
         if (err.code !== "ENOENT") {
-          console.error(`Error loading ${metaPath}:`, err);
+          canopyLogError(`Error loading ${metaPath}:`, err);
           throw new Error(`Invalid .collection.json in ${folderPath}: ${err.message}`);
         }
         const nestedCollections = await scanForCollectionMeta(absolutePath, folderPath);
@@ -2075,7 +2377,7 @@ async function filePathExists3(filePath) {
     await fs62.stat(filePath);
     return true;
   } catch (err) {
-    if (isNotFoundError4(err))
+    if (isNotFoundError3(err))
       return false;
     throw err;
   }
@@ -3149,7 +3451,7 @@ function isNetworkRemoteUrl(url) {
 }
 async function detectHeadBranch(repoRoot, fallback = "main") {
   try {
-    const git = simpleGit({ baseDir: repoRoot });
+    const git = simpleGit3({ baseDir: repoRoot });
     const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
     return head && head !== "HEAD" ? head : fallback;
   } catch {
@@ -3178,7 +3480,7 @@ function gitChildEnv(overrides) {
     if (value !== void 0 && GIT_ENV_PASSTHROUGH.test(key))
       env[key] = value;
   }
-  return { ...env, ...overrides };
+  return { ...env, ...FORCE_C_LOCALE, ...overrides };
 }
 async function ensureGitExcludePattern(repoPath, pattern) {
   const excludePath = path14.join(repoPath, ".git", "info", "exclude");
@@ -3187,7 +3489,7 @@ async function ensureGitExcludePattern(repoPath, pattern) {
   try {
     content = await fs14.readFile(excludePath, "utf-8");
   } catch (err) {
-    if (!isNotFoundError4(err))
+    if (!isNotFoundError3(err))
       throw err;
   }
   const lines = content.split("\n");
@@ -3567,7 +3869,7 @@ async function generateAIContentFiles(options) {
   }
   const entriesForValidation = await listEntries(branchRoot, flatSchema, contentRootName);
   assertBuildEntriesValid(entriesForValidation, "AI content generation");
-  const store = new ContentStore(branchRoot, flatSchema);
+  const store = new ContentStore(branchRoot, flatSchema, { contentRootName });
   const result = await generateAIContent({
     store,
     flatSchema,
@@ -3644,7 +3946,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_validation2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, log5, GIT_ENV_PASSTHROUGH, remoteInitLocks, GitConflictError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, init_normalize2, active2, init_logger, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned2, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, locks, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, BRANCH_META_DIR, BRANCH_META_FILE, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataCorruptError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, parseTypedFilename, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -3662,6 +3964,12 @@ var init_generate_ai_content = __esm({
         "use strict";
       }
     });
+    init_logger = __esm3({
+      "dist/utils/logger.js"() {
+        "use strict";
+        active2 = console;
+      }
+    });
     init_types3 = __esm3({
       "dist/paths/types.js"() {
         "use strict";
@@ -3767,74 +4075,6 @@ var init_generate_ai_content = __esm({
         };
       }
     });
-    init_client_safe_strategy = __esm3({
-      "dist/operating-mode/client-safe-strategy.js"() {
-        "use strict";
-        ProdClientSafeStrategy2 = class {
-          constructor() {
-            this.mode = "prod";
-          }
-          // UI Feature Flags
-          supportsBranching() {
-            return true;
-          }
-          supportsStatusBadge() {
-            return true;
-          }
-          supportsComments() {
-            return true;
-          }
-          supportsPullRequests() {
-            return true;
-          }
-          // Simple Data
-          getPermissionsFileName() {
-            return "permissions.json";
-          }
-          getGroupsFileName() {
-            return "groups.json";
-          }
-          shouldCommit() {
-            return true;
-          }
-          shouldPush() {
-            return true;
-          }
-        };
-        DevClientSafeStrategy2 = class {
-          constructor() {
-            this.mode = "dev";
-          }
-          // UI Feature Flags
-          supportsBranching() {
-            return true;
-          }
-          supportsStatusBadge() {
-            return true;
-          }
-          supportsComments() {
-            return true;
-          }
-          supportsPullRequests() {
-            return false;
-          }
-          // Simple Data
-          getPermissionsFileName() {
-            return "permissions.json";
-          }
-          getGroupsFileName() {
-            return "groups.json";
-          }
-          shouldCommit() {
-            return true;
-          }
-          shouldPush() {
-            return true;
-          }
-        };
-        clientStrategyCache = /* @__PURE__ */ new Map();
-      }
-    });
     init_types22 = __esm3({
       "dist/config/types.js"() {
         "use strict";
@@ -4074,6 +4314,16 @@ var init_generate_ai_content = __esm({
           allowNetworkRemoteInProd: z52.boolean().optional(),
           settingsBranch: z52.string().optional(),
           autoCreateSettingsPR: z52.boolean().optional(),
+          // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
+          // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
+          // the literal 'prod' instead of staying `undefined` — collapsing the
+          // env > config > modeDefault precedence chain that resolveDeploymentName
+          // (operating-mode/deployment-name.ts) implements: config would then always
+          // "win" over modeDefault (masking dev's real default of 'local'), and the env
+          // var would just be racing config's baked-in 'prod' instead of a true absence.
+          // `.optional()` here is what keeps an omitted deploymentName reaching
+          // resolveDeploymentName as `undefined`, so it can fall through to modeDefault.
+          // Do not "fix" this by removing `.optional()`.
           deploymentName: deploymentNameSchema2.optional(),
           contentRoot: contentRootSchema2.default("content"),
           sourceRoot: sourceRootSchema2.optional(),
@@ -4086,42 +4336,137 @@ var init_generate_ai_content = __esm({
         DEFAULT_PROD_WORKSPACE2 = "/mnt/efs/workspace";
       }
     });
-    init_permissions2 = __esm3({
-      "dist/config/schemas/permissions.js"() {
-        "use strict";
-        permissionTargetSchema2 = z6.object({
-          allowedUsers: z6.array(z6.string()).optional(),
-          allowedGroups: z6.array(z6.string()).optional()
-        });
-        pathPermissionSchema2 = z6.object({
-          path: z6.string().min(1),
-          read: permissionTargetSchema2.optional(),
-          edit: permissionTargetSchema2.optional(),
-          review: permissionTargetSchema2.optional()
-        });
-      }
-    });
     init_validation2 = __esm3({
       "dist/config/validation.js"() {
         "use strict";
         init_config3();
         init_flatten2();
+        forEachReferenceField = (fields, visit) => {
+          if (!Array.isArray(fields))
+            return;
+          for (const field of fields) {
+            const f = field;
+            if (f?.type === "reference") {
+              visit(f);
+            }
+            if (f?.type === "group" || f?.type === "object") {
+              forEachReferenceField(f.fields, visit);
+            }
+            if (f?.type === "block" && Array.isArray(f.templates)) {
+              for (const template of f.templates) {
+                forEachReferenceField(template.fields, visit);
+              }
+            }
+          }
+        };
       }
     });
-    init_helpers2 = __esm3({
-      "dist/config/helpers.js"() {
-        "use strict";
-        init_validation2();
-      }
-    });
-    init_config22 = __esm3({
-      "dist/config/index.js"() {
+    init_client_safe_strategy = __esm3({
+      "dist/operating-mode/client-safe-strategy.js"() {
         "use strict";
-        init_types22();
-        init_config3();
-        init_field2();
-        init_collection2();
-        init_permissions2();
+        ProdClientSafeStrategy2 = class {
+          constructor() {
+            this.mode = "prod";
+          }
+          // UI Feature Flags
+          supportsBranching() {
+            return true;
+          }
+          supportsStatusBadge() {
+            return true;
+          }
+          supportsComments() {
+            return true;
+          }
+          supportsPullRequests() {
+            return true;
+          }
+          // Simple Data
+          getPermissionsFileName() {
+            return "permissions.json";
+          }
+          getGroupsFileName() {
+            return "groups.json";
+          }
+          shouldCommit() {
+            return true;
+          }
+          shouldPush() {
+            return true;
+          }
+        };
+        DevClientSafeStrategy2 = class {
+          constructor() {
+            this.mode = "dev";
+          }
+          // UI Feature Flags
+          supportsBranching() {
+            return true;
+          }
+          supportsStatusBadge() {
+            return true;
+          }
+          supportsComments() {
+            return true;
+          }
+          supportsPullRequests() {
+            return false;
+          }
+          // Simple Data
+          getPermissionsFileName() {
+            return "permissions.json";
+          }
+          getGroupsFileName() {
+            return "groups.json";
+          }
+          shouldCommit() {
+            return true;
+          }
+          shouldPush() {
+            return true;
+          }
+        };
+        clientStrategyCache = /* @__PURE__ */ new Map();
+      }
+    });
+    init_deployment_name = __esm3({
+      "dist/operating-mode/deployment-name.js"() {
+        "use strict";
+        init_logger();
+        warned2 = false;
+        VALID_DEPLOYMENT_NAME2 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+        isValidDeploymentName2 = (name) => VALID_DEPLOYMENT_NAME2.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
+      }
+    });
+    init_permissions2 = __esm3({
+      "dist/config/schemas/permissions.js"() {
+        "use strict";
+        permissionTargetSchema2 = z6.object({
+          allowedUsers: z6.array(z6.string()).optional(),
+          allowedGroups: z6.array(z6.string()).optional()
+        });
+        pathPermissionSchema2 = z6.object({
+          path: z6.string().min(1),
+          read: permissionTargetSchema2.optional(),
+          edit: permissionTargetSchema2.optional(),
+          review: permissionTargetSchema2.optional()
+        });
+      }
+    });
+    init_helpers2 = __esm3({
+      "dist/config/helpers.js"() {
+        "use strict";
+        init_validation2();
+      }
+    });
+    init_config22 = __esm3({
+      "dist/config/index.js"() {
+        "use strict";
+        init_types22();
+        init_config3();
+        init_field2();
+        init_collection2();
+        init_permissions2();
         init_media2();
         init_flatten2();
         init_validation2();
@@ -4132,6 +4477,7 @@ var init_generate_ai_content = __esm({
       "dist/operating-mode/client-unsafe-strategy.js"() {
         "use strict";
         init_client_safe_strategy();
+        init_deployment_name();
         init_config22();
         ProdStrategy2 = class extends ProdClientSafeStrategy2 {
           // All client-safe methods inherited automatically from ProdClientSafeStrategy:
@@ -4142,8 +4488,8 @@ var init_generate_ai_content = __esm({
           getWorkspaceRoot(_sourceRoot) {
             return path62.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE2);
           }
-          getContentRoot(sourceRoot) {
-            return path62.resolve(sourceRoot ?? process.cwd(), "content");
+          getContentRoot(contentRoot, sourceRoot) {
+            return path62.resolve(sourceRoot ?? process.cwd(), contentRoot);
           }
           getContentBranchesRoot(sourceRoot) {
             return path62.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -4174,8 +4520,7 @@ var init_generate_ai_content = __esm({
           getSettingsBranchName(config) {
             if (config.settingsBranch)
               return config.settingsBranch;
-            const deploymentName = config.deploymentName ?? "prod";
-            return `canopycms-settings-${deploymentName}`;
+            return `canopycms-settings-${resolveDeploymentName2(config, "prod")}`;
           }
           getSettingsRoot(sourceRoot) {
             return path62.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -4197,8 +4542,8 @@ var init_generate_ai_content = __esm({
           getWorkspaceRoot(sourceRoot) {
             return path62.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
           }
-          getContentRoot(sourceRoot) {
-            return path62.resolve(sourceRoot ?? process.cwd(), "content");
+          getContentRoot(contentRoot, sourceRoot) {
+            return path62.resolve(sourceRoot ?? process.cwd(), contentRoot);
           }
           getContentBranchesRoot(sourceRoot) {
             return path62.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -4228,8 +4573,7 @@ var init_generate_ai_content = __esm({
           getSettingsBranchName(config) {
             if (config.settingsBranch)
               return config.settingsBranch;
-            const deploymentName = config.deploymentName ?? "local";
-            return `canopycms-settings-${deploymentName}`;
+            return `canopycms-settings-${resolveDeploymentName2(config, "local")}`;
           }
           getSettingsRoot(sourceRoot) {
             return path62.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -4251,13 +4595,15 @@ var init_generate_ai_content = __esm({
       clearClientStrategyCache: () => clearClientStrategyCache,
       clearStrategyCache: () => clearStrategyCache,
       clientOperatingStrategy: () => clientOperatingStrategy,
-      operatingStrategy: () => operatingStrategy2
+      operatingStrategy: () => operatingStrategy2,
+      resolveDeploymentName: () => resolveDeploymentName2
     });
     init_operating_mode = __esm3({
       "dist/operating-mode/index.js"() {
         "use strict";
         init_client_safe_strategy();
         init_client_unsafe_strategy();
+        init_deployment_name();
       }
     });
     locks = /* @__PURE__ */ new Map();
@@ -4284,7 +4630,7 @@ var init_generate_ai_content = __esm({
       async scanDirectory(relativePath) {
         const absoluteDir = path22.join(this.root, relativePath);
         try {
-          const entries = await fs22.readdir(absoluteDir, { withFileTypes: true });
+          const entries = await fs23.readdir(absoluteDir, { withFileTypes: true });
           for (const entry of entries) {
             if (entry.name.startsWith(".") || entry.name === "_ids_") {
               continue;
@@ -4529,10 +4875,21 @@ var init_generate_ai_content = __esm({
         const minLevel = this.options.minLevel ?? "DEBUG";
         return LOG_LEVELS2[level] >= LOG_LEVELS2[minLevel];
       }
+      /**
+       * The ISO-8601 timestamp leads the line BARE - not wrapped in brackets as it
+       * once was. `CANOPYCMS_DEBUG=true` can be set on the EC2 worker, whose stdout
+       * appends to /var/log/canopy-worker/worker.log; the CloudWatch agent's
+       * `multi_line_start_pattern` matches the timestamp at the START of a line
+       * (see worker/log.ts's INVARIANT and cms-service.ts's agent config), so a
+       * leading `[` meant every debug line was silently folded into the previous
+       * event instead of starting its own. The bracketed `[prefix:category]` and
+       * `[level]` fields still follow, so the human-readable shape is unchanged
+       * apart from those two characters.
+       */
       formatMessage(level, category, message) {
         const timestamp = (/* @__PURE__ */ new Date()).toISOString();
         const prefix = this.options.prefix ?? "CanopyCMS";
-        return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+        return `${timestamp} [${prefix}:${category}] [${level}] ${message}`;
       }
       debug(category, message, data) {
         if (this.shouldLog("DEBUG")) {
@@ -4599,6 +4956,7 @@ var init_generate_ai_content = __esm({
     });
     log2 = createDebugLogger2({ prefix: "ResourceGeneration" });
     META_DIR = ".canopy-meta";
+    init_logger();
     entryTypeMetaSchema = z7.object({
       name: z7.string().min(1),
       format: z7.enum(["md", "mdx", "json", "yaml"]),
@@ -4626,6 +4984,72 @@ var init_generate_ai_content = __esm({
       // Embedded IDs for ordering items
     });
     init_flatten2();
+    init_validation2();
+    editDistance = (a, b) => {
+      let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+      for (let i = 1; i <= a.length; i++) {
+        const curr = [i];
+        for (let j = 1; j <= b.length; j++) {
+          curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+        prev = curr;
+      }
+      return prev[b.length];
+    };
+    closestName = (name, known) => {
+      let best;
+      let bestDistance = Infinity;
+      for (const candidate of known) {
+        const distance = editDistance(name.toLowerCase(), candidate.toLowerCase());
+        if (distance < bestDistance) {
+          bestDistance = distance;
+          best = candidate;
+        }
+      }
+      const threshold = Math.max(2, Math.floor(name.length / 3));
+      return best !== void 0 && bestDistance <= threshold ? best : void 0;
+    };
+    forEachEntryType = (schema, visit) => {
+      const walk = (node, nodePath) => {
+        for (const entryType of node.entries ?? []) {
+          visit(entryType, nodePath);
+        }
+        for (const child of node.collections ?? []) {
+          walk(child, child.path ?? (nodePath ? `${nodePath}/${child.name}` : child.name));
+        }
+      };
+      walk(schema, "");
+    };
+    collectEntryTypeNames = (schema) => {
+      const names = /* @__PURE__ */ new Set();
+      forEachEntryType(schema, (entryType) => {
+        if (typeof entryType.name === "string" && entryType.name.length > 0) {
+          names.add(entryType.name);
+        }
+      });
+      return names;
+    };
+    validateReferenceEntryTypes = (schema) => {
+      const known = collectEntryTypeNames(schema);
+      const knownList = [...known].sort();
+      const issues = [];
+      forEachEntryType(schema, (entryType, collectionPath) => {
+        const location = collectionPath ? `${collectionPath}/${entryType.name}` : entryType.name;
+        forEachReferenceField(entryType.schema, (field) => {
+          const entryTypes = field.entryTypes;
+          if (!Array.isArray(entryTypes))
+            return;
+          const fieldName = typeof field.name === "string" ? field.name : "unknown";
+          for (const value of entryTypes) {
+            if (typeof value !== "string" || known.has(value))
+              continue;
+            const suggestion = closestName(value, knownList);
+            issues.push(`Reference field "${fieldName}" in "${location}" specifies entryType "${value}", which is not defined in any collection.` + (suggestion ? ` Did you mean "${suggestion}"?` : "") + (knownList.length > 0 ? ` Known entry types: ${knownList.join(", ")}.` : " No entry types are defined in this schema."));
+          }
+        });
+      });
+      return issues;
+    };
     isDeployedStatic = (config) => {
       return config.deployedAs === "static";
     };
@@ -4737,6 +5161,11 @@ var init_generate_ai_content = __esm({
         if (!isValidSchema(result.schema)) {
           throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
         }
+        const entryTypeIssues = validateReferenceEntryTypes(result.schema);
+        if (entryTypeIssues.length > 0) {
+          throw new Error(`Invalid reference field entryTypes in ${contentRoot}:
+` + entryTypeIssues.map((issue) => `  - ${issue}`).join("\n"));
+        }
         const flatSchema = flattenSchema(result.schema, contentRootName);
         if (!skipDiskCache) {
           const cacheDir = path52.join(branchRoot, ".canopy-meta");
@@ -4854,7 +5283,8 @@ var init_generate_ai_content = __esm({
         this.lastDiskProbeMs = 0;
         this.lastForcedRefreshMs = 0;
         this.indexBuild = null;
-        this.root = path8.resolve(root);
+        this.root = path82.resolve(root);
+        this.contentRootName = options.contentRootName || "content";
         this.indexFreshnessIntervalMs = options.indexFreshnessIntervalMs ?? DEFAULT_INDEX_FRESHNESS_INTERVAL_MS;
         this.schemaIndex = new Map(flatSchema.map((item) => [item.logicalPath, item]));
         this._idIndex = new ContentIdIndex(this.root);
@@ -4896,7 +5326,7 @@ var init_generate_ai_content = __esm({
           const build = (async () => {
             const diskToken = await readContentIndexGeneration(this.root);
             const fresh = new ContentIdIndex(this.root);
-            await fresh.buildFromFilenames("content");
+            await fresh.buildFromFilenames(this.contentRootName);
             return { diskToken, fresh };
           })();
           this.indexBuild = build;
@@ -4979,7 +5409,7 @@ var init_generate_ai_content = __esm({
           if (entry.isDirectory())
             continue;
           if (extractIdFromFilename(entry.name) === id) {
-            return path8.relative(this.root, path8.join(dir, entry.name));
+            return path82.relative(this.root, path82.join(dir, entry.name));
           }
         }
         return null;
@@ -5078,7 +5508,7 @@ var init_generate_ai_content = __esm({
        * @param options.entryTypeName - For collections with multiple entry types, specify which one to use. Defaults to the default entry type.
        */
       async buildPaths(schemaItem, slug, options = {}) {
-        const rootWithSep = this.root.endsWith(path8.sep) ? this.root : `${this.root}${path8.sep}`;
+        const rootWithSep = this.root.endsWith(path82.sep) ? this.root : `${this.root}${path82.sep}`;
         if (schemaItem.type === "entry-type") {
           const parentPath = schemaItem.parentPath || "";
           const parentCollection = this.schemaIndex.get(parentPath);
@@ -5111,7 +5541,7 @@ var init_generate_ai_content = __esm({
           const entryTypeName = entryTypeConfig?.name || "entry";
           let collectionRoot = await resolveCollectionPath(this.root, schemaItem.logicalPath);
           if (!collectionRoot) {
-            collectionRoot = path8.resolve(this.root, schemaItem.logicalPath);
+            collectionRoot = path82.resolve(this.root, schemaItem.logicalPath);
           }
           if (!collectionRoot.startsWith(rootWithSep)) {
             throw new ContentStoreError("Path traversal detected", "VALIDATION");
@@ -5147,14 +5577,14 @@ var init_generate_ai_content = __esm({
             }
             filename = `${finalEntryTypeName}.${safeSlug}.${id}${ext}`;
           }
-          const resolved = path8.resolve(collectionRoot, filename);
-          const collectionRootWithSep = collectionRoot.endsWith(path8.sep) ? collectionRoot : `${collectionRoot}${path8.sep}`;
+          const resolved = path82.resolve(collectionRoot, filename);
+          const collectionRootWithSep = collectionRoot.endsWith(path82.sep) ? collectionRoot : `${collectionRoot}${path82.sep}`;
           if (!resolved.startsWith(collectionRootWithSep)) {
             throw new ContentStoreError("Path traversal detected", "VALIDATION");
           }
           return {
             absolutePath: resolved,
-            relativePath: path8.relative(this.root, resolved),
+            relativePath: path82.relative(this.root, resolved),
             id,
             entryTypeName: finalEntryTypeName,
             existed
@@ -5287,7 +5717,7 @@ var init_generate_ai_content = __esm({
               return RETRY_KEY;
             }
             const { absolutePath, relativePath, id } = inLock;
-            await fs8.mkdir(path8.dirname(absolutePath), { recursive: true });
+            await fs8.mkdir(path82.dirname(absolutePath), { recursive: true });
             if (input.expectedVersion !== void 0) {
               try {
                 const existing = await fs8.stat(absolutePath);
@@ -5304,7 +5734,7 @@ var init_generate_ai_content = __esm({
               }
             }
             if (existingId && !await filePathExists3(absolutePath)) {
-              const actualRelPath = await this.findEntryPathById(path8.dirname(absolutePath), existingId);
+              const actualRelPath = await this.findEntryPathById(path82.dirname(absolutePath), existingId);
               const indexedRelPath = this._idIndex.findById(existingId)?.relativePath ?? null;
               if (actualRelPath !== null && actualRelPath !== indexedRelPath) {
                 throw new ContentConflictError();
@@ -5326,7 +5756,7 @@ var init_generate_ai_content = __esm({
               const existing = liveIndex.findById(id);
               if (existing) {
                 if (existing.relativePath !== relativePath) {
-                  staleOldAbsPath = path8.join(this.root, existing.relativePath);
+                  staleOldAbsPath = path82.join(this.root, existing.relativePath);
                   liveIndex.updatePath(existing.id, relativePath);
                 }
               } else {
@@ -5560,7 +5990,7 @@ var init_generate_ai_content = __esm({
             }
             destLockKey = currentDestKey;
             const { absolutePath: currentPath, relativePath: currentRelPath } = inLock;
-            const currentFilename = path8.basename(currentPath);
+            const currentFilename = path82.basename(currentPath);
             const parts = currentFilename.split(".");
             if (parts.length < 4) {
               throw new ContentStoreError(`Invalid entry filename format: ${currentFilename}`, "VALIDATION");
@@ -5569,8 +5999,8 @@ var init_generate_ai_content = __esm({
             const contentId = parts[parts.length - 2];
             const ext = `.${parts[parts.length - 1]}`;
             const newFilename = `${entryTypeName}.${safeNewSlug}.${contentId}${ext}`;
-            const parentDir = path8.dirname(currentPath);
-            const newPath = path8.join(parentDir, newFilename);
+            const parentDir = path82.dirname(currentPath);
+            const newPath = path82.join(parentDir, newFilename);
             try {
               const entries = await fs8.readdir(parentDir, { withFileTypes: true });
               for (const entry of entries) {
@@ -5594,7 +6024,7 @@ var init_generate_ai_content = __esm({
               throw err;
             }
             await fs8.unlink(currentPath);
-            const newRelativePath = path8.relative(this.root, newPath);
+            const newRelativePath = path82.relative(this.root, newPath);
             const liveIndex = this._idIndex;
             const entryId = liveIndex.findByPath(currentRelPath);
             if (entryId) {
@@ -5781,6 +6211,7 @@ var init_generate_ai_content = __esm({
     log22 = createDebugLogger2({ prefix: "EntryLinks" });
     BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
     ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
+    init_logger();
     log3 = createDebugLogger2({ prefix: "BranchRegistry" });
     REGISTRY_FILE = "branches.json";
     REGISTRY_STALE_FILE = "branches.stale.json";
@@ -5807,7 +6238,7 @@ var init_generate_ai_content = __esm({
           const raw = await fs10.readFile(this.registryPath, "utf8");
           parsed = JSON.parse(raw);
         } catch (err) {
-          if (isNotFoundError4(err)) {
+          if (isNotFoundError3(err)) {
             return await this.regenerate();
           }
           throw err;
@@ -5933,7 +6364,7 @@ var init_generate_ai_content = __esm({
             try {
               meta = await BranchMetadataFileManager.loadOnly(branchRoot);
             } catch (err) {
-              console.warn(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage3(err)}`);
+              canopyLogWarn2(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage3(err)}`);
               continue;
             }
             if (meta) {
@@ -5945,7 +6376,7 @@ var init_generate_ai_content = __esm({
             }
           }
         } catch (err) {
-          if (isNotFoundError4(err)) {
+          if (isNotFoundError3(err)) {
             return [];
           }
           throw err;
@@ -5995,7 +6426,7 @@ var init_generate_ai_content = __esm({
           const raw = await fs12.readFile(filePath, "utf8");
           return JSON.parse(raw);
         } catch (err) {
-          if (isNotFoundError4(err)) {
+          if (isNotFoundError3(err)) {
             return null;
           }
           if (err instanceof SyntaxError) {
@@ -6018,7 +6449,7 @@ var init_generate_ai_content = __esm({
           const version = parsed.version ?? 0;
           return { meta: parsed, version };
         } catch (err) {
-          if (isNotFoundError4(err)) {
+          if (isNotFoundError3(err)) {
             return { meta: null, version: null };
           }
           throw err;
@@ -6077,7 +6508,7 @@ var init_generate_ai_content = __esm({
         try {
           await fs12.stat(this.branchRoot);
         } catch (err) {
-          if (isNotFoundError4(err)) {
+          if (isNotFoundError3(err)) {
             throw new BranchMetadataConflictError("Branch no longer exists");
           }
           throw err;
@@ -6166,7 +6597,9 @@ var init_generate_ai_content = __esm({
     COLON_BEFORE_SLASH_PATTERN = /^[^/\\\s]+:/;
     log5 = createDebugLogger2({ prefix: "GitManager" });
     GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
+    FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
     remoteInitLocks = /* @__PURE__ */ new Map();
+    GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
     GitConflictError = class extends Error {
       constructor(conflictedFiles) {
         super(`Git conflict in ${conflictedFiles.length} file(s): ${conflictedFiles.join(", ")}`);
@@ -6230,7 +6663,7 @@ var init_generate_ai_content = __esm({
               const stat = await fs14.stat(options.remotePath);
               remoteExists = stat.isDirectory();
             } catch (err) {
-              if (!isNotFoundError4(err))
+              if (!isNotFoundError3(err))
                 throw err;
             }
             if (remoteExists && await _GitManager.bareRemoteHasBranch(options.remotePath, options.baseBranch)) {
@@ -6301,26 +6734,115 @@ var init_generate_ai_content = __esm({
         await lockPromise;
       }
       /**
-       * Whether a bare repository already has a local branch of the given name.
+       * Whether a bare repository already has a branch of the given name, in
+       * EITHER the local-heads namespace (`refs/heads/<branch>`) or the GitHub
+       * tracking namespace (`GITHUB_TRACKING_REF_PREFIX<branch>`).
+       *
+       * Originally checked `refs/heads/*` only, for dev-mode's
+       * `ensureLocalSimulatedRemote` (a simulated remote never gets a tracking
+       * namespace, so that caller only ever needed the local-heads check).
+       * Generalized/promoted to public for api/branch.ts's create-time collision
+       * guard, which also needs the tracking namespace: `syncGit()` fetches
+       * GitHub into `GITHUB_TRACKING_REF_PREFIX*` rather than `refs/heads/*`
+       * directly (see that constant's doc comment above), and
+       * `reconcileTrackedBranches()` (worker/cms-worker.ts) only
+       * non-destructively brings `refs/heads/*` toward what's tracked there — so
+       * a branch that another CanopyCMS deployment sharing this repo (or a
+       * direct push to GitHub) just created can sit in the tracking namespace
+       * for a while before, or without ever, gaining a local head here. Checking
+       * `refs/heads/*` alone would miss exactly the two-deployments-one-repo
+       * collision that guard exists to catch.
        *
        * Runs git with an explicit `--git-dir` instead of a cwd inside the repo:
        * environments with `safe.bareRepository=explicit` (sandboxed/CI git setups)
        * refuse cwd-based discovery of bare repos but expressly allow `--git-dir`.
-       * `branch --list` exits 0 whether or not the branch exists (no
-       * exception-based control flow — also why `rev-parse --verify --quiet`
-       * can't be used: simple-git only fails a task on stderr output, and --quiet
-       * suppresses exactly that). A failure here therefore means the remote
-       * itself is unreadable and is surfaced, NOT treated as "branch absent" —
-       * that would route to the push path against a repo we couldn't even read.
+       * A single `for-each-ref` call checks both candidate refs at once (no
+       * exception-based control flow — `for-each-ref` exits 0 whether or not
+       * either ref exists, same reason the old implementation used `branch
+       * --list` instead of `rev-parse --verify --quiet`: simple-git only fails a
+       * task on stderr output, and `--quiet` suppresses exactly that).
+       * `--end-of-options` guards the ref-name positionals the same way
+       * `push`/`forcePush` below do, since `branch` here can be a sanitized but
+       * otherwise caller-influenced string.
+       *
+       * A failure here therefore means the remote itself is unreadable and is
+       * surfaced, NOT treated as "branch absent" — that would route
+       * `ensureLocalSimulatedRemote` to the push path against a repo it couldn't
+       * even read, and would silently skip api/branch.ts's collision check
+       * instead of letting that caller distinguish "unreadable" from "absent"
+       * and decide what to do.
        */
-      static async bareRemoteHasBranch(remotePath, branch) {
+      static async bareRemoteHasBranch(remotePath, branch, options = {}) {
         let output;
         try {
-          output = await simpleGit2().raw(["--git-dir", remotePath, "branch", "--list", branch]);
+          output = await simpleGit2().raw([
+            "--git-dir",
+            remotePath,
+            "for-each-ref",
+            "--format=%(refname)",
+            "--end-of-options",
+            `refs/heads/${branch}`,
+            `${GITHUB_TRACKING_REF_PREFIX}${branch}`
+          ]);
         } catch (err) {
-          throw new Error(`Cannot inspect simulated remote at ${remotePath}: ${getErrorMessage3(err)}`);
+          throw new Error(`Cannot inspect remote mirror at ${remotePath}: ${getErrorMessage3(err)}`);
+        }
+        const refs = output.split("\n").map((line) => line.trim()).filter(Boolean);
+        if (options.namespaces === "tracking") {
+          return refs.includes(`${GITHUB_TRACKING_REF_PREFIX}${branch}`);
         }
-        return output.split("\n").map((line) => line.replace(/^[*+]\s*/, "").trim()).includes(branch);
+        return refs.includes(`refs/heads/${branch}`) || refs.includes(`${GITHUB_TRACKING_REF_PREFIX}${branch}`);
+      }
+      /**
+       * Delete `refs/heads/<branch>` from a bare local mirror, if present. A
+       * no-op (not an error) when the ref doesn't exist.
+       *
+       * This is the "explicit path" for removing a deleted branch's local head
+       * that the sync loop deliberately is not (see GITHUB_TRACKING_REF_PREFIX's
+       * doc comment: reconcileTrackedBranches never deletes a head). Called by
+       * api/branch.ts's deleteBranchHandler: without it, a deleted branch's head
+       * lives in `remote.git` forever, and the ordinary create -> publish ->
+       * squash-merge -> delete -> reuse-the-name cycle then has the REUSED
+       * branch's first publish rejected non-fast-forward against the stale head
+       * (`GitManager.push()` pushes `branch:branch`, and a squash-merged old tip
+       * is not an ancestor of the new branch) -- a permanent, misleading 409.
+       * Worse, a retried submit skips the local push (clean tree) and enqueues
+       * the worker push of the STALE head, resurrecting the deleted branch's
+       * content on GitHub as an apparent success.
+       *
+       * Deliberately leaves the tracking ref (`GITHUB_TRACKING_REF_PREFIX<branch>`)
+       * alone: that namespace mirrors GitHub's view, and if the branch still
+       * exists on GitHub, the create-time collision check SHOULD keep reporting
+       * it until the remote side is actually gone.
+       *
+       * Same `--git-dir` invocation style as bareRemoteHasBranch above (works
+       * under `safe.bareRepository=explicit`). The existence pre-check makes
+       * "absent" deterministic instead of parsing update-ref's locale-dependent
+       * failure text, and its captured SHA is passed to `update-ref -d` as the
+       * expected old value -- same pattern as reconcileTrackedBranches'
+       * guarded updates (worker/cms-worker.ts): a concurrent Lambda push
+       * re-creating/moving this branch between the read and the delete makes
+       * update-ref throw (surfaced as the caller's best-effort warning) instead
+       * of silently deleting a commit that was just pushed. No
+       * `--end-of-options` on update-ref (older gits don't accept it there);
+       * the ref argument always begins with the literal `refs/heads/` prefix,
+       * so it can never parse as an option.
+       */
+      static async deleteBareRemoteHead(remotePath, branch) {
+        const ref = `refs/heads/${branch}`;
+        const output = await simpleGit2().raw([
+          "--git-dir",
+          remotePath,
+          "for-each-ref",
+          "--format=%(refname) %(objectname)",
+          "--end-of-options",
+          ref
+        ]);
+        const match = output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(" ")).find(([refname]) => refname === ref);
+        if (!match)
+          return;
+        const [, sha] = match;
+        await simpleGit2().raw(["--git-dir", remotePath, "update-ref", "-d", ref, sha]);
       }
       /**
        * Push baseBranch from the source repo into the local bare remote via a
@@ -6395,7 +6917,7 @@ var init_generate_ai_content = __esm({
             throw new Error(`Expected git repo at ${repoPath}`);
           }
         } catch (err) {
-          if (isNotFoundError4(err)) {
+          if (isNotFoundError3(err)) {
             throw new Error(`Expected git repo at ${repoPath}`);
           }
           throw err;
@@ -6493,6 +7015,30 @@ var init_generate_ai_content = __esm({
         }
         return void 0;
       }
+      /**
+       * Check whether a git repository is already initialized at `workspacePath`.
+       *
+       * Uses `rev-parse --git-dir` with `GIT_CEILING_DIRECTORIES` pinned to the
+       * parent directory so a corrupt/missing `.git` can't make git silently
+       * traverse upward and report a false positive from an ancestor repo (the
+       * same protection `initializeWorkspace` relies on below).
+       *
+       * Shared by `initializeWorkspace` (clone-vs-reuse decision) and
+       * `SettingsWorkspaceManager`'s rename guard (settings-workspace.ts), which
+       * must know whether a settings workspace ALREADY exists before touching it —
+       * touching an existing orphan settings branch under a different name wipes
+       * permissions.json/groups.json (see that guard's doc comment).
+       */
+      static async repoExistsAt(workspacePath) {
+        try {
+          const checkGit = simpleGit2({ baseDir: workspacePath });
+          checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path14.dirname(workspacePath) }));
+          await checkGit.raw(["rev-parse", "--git-dir"]);
+          return true;
+        } catch {
+          return false;
+        }
+      }
       /**
        * Ensures a git workspace is initialized and ready for use.
        * Handles cloning, remote configuration, and branch checkout/creation.
@@ -6511,13 +7057,8 @@ var init_generate_ai_content = __esm({
           detectFrom: options.sourceRoot ? path14.resolve(process.cwd(), options.sourceRoot) : process.cwd()
         });
         const remoteName = options.remoteName ?? "origin";
-        let repoExists = false;
-        try {
-          const checkGit = simpleGit2({ baseDir: options.workspacePath });
-          checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path14.dirname(options.workspacePath) }));
-          await checkGit.raw(["rev-parse", "--git-dir"]);
-          repoExists = true;
-        } catch {
+        const repoExists = await _GitManager.repoExistsAt(options.workspacePath);
+        if (!repoExists) {
           const gitPath = path14.join(options.workspacePath, ".git");
           try {
             const stat = await fs14.stat(gitPath);
@@ -6528,7 +7069,7 @@ var init_generate_ai_content = __esm({
               await fs14.rm(gitPath, { recursive: true });
             }
           } catch (cleanupErr) {
-            if (!isNotFoundError4(cleanupErr))
+            if (!isNotFoundError3(cleanupErr))
               throw cleanupErr;
           }
         }
@@ -6987,7 +7528,7 @@ var init_generate_ai_content = __esm({
         }
         return data;
       } catch (err) {
-        if (isNotFoundError4(err))
+        if (isNotFoundError3(err))
           return {};
         log7.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage3(err)}`);
         return {};
@@ -7038,7 +7579,7 @@ var init_generate_ai_content = __esm({
       try {
         dirents = await fs15.readdir(collectionRoot, { withFileTypes: true });
       } catch (err) {
-        if (isNotFoundError4(err))
+        if (isNotFoundError3(err))
           return [];
         throw err;
       }
@@ -7132,10 +7673,21 @@ var init_debug2 = __esm({
         const minLevel = this.options.minLevel ?? "DEBUG";
         return LOG_LEVELS3[level] >= LOG_LEVELS3[minLevel];
       }
+      /**
+       * The ISO-8601 timestamp leads the line BARE - not wrapped in brackets as it
+       * once was. `CANOPYCMS_DEBUG=true` can be set on the EC2 worker, whose stdout
+       * appends to /var/log/canopy-worker/worker.log; the CloudWatch agent's
+       * `multi_line_start_pattern` matches the timestamp at the START of a line
+       * (see worker/log.ts's INVARIANT and cms-service.ts's agent config), so a
+       * leading `[` meant every debug line was silently folded into the previous
+       * event instead of starting its own. The bracketed `[prefix:category]` and
+       * `[level]` fields still follow, so the human-readable shape is unchanged
+       * apart from those two characters.
+       */
       formatMessage(level, category, message) {
         const timestamp = (/* @__PURE__ */ new Date()).toISOString();
         const prefix = this.options.prefix ?? "CanopyCMS";
-        return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+        return `${timestamp} [${prefix}:${category}] [${level}] ${message}`;
       }
       debug(category, message, data) {
         if (this.shouldLog("DEBUG")) {
@@ -7288,6 +7840,21 @@ var init_content_index_registry = __esm({
   }
 });
 
+// dist/utils/logger.js
+function canopyLogWarn3(...args) {
+  active3.warn(...args);
+}
+function canopyLogError2(...args) {
+  active3.error(...args);
+}
+var active3;
+var init_logger2 = __esm({
+  "dist/utils/logger.js"() {
+    "use strict";
+    active3 = console;
+  }
+});
+
 // dist/paths/normalize.js
 var init_normalize3 = __esm({
   "dist/paths/normalize.js"() {
@@ -7443,7 +8010,7 @@ async function scanForCollectionMeta2(baseDir, relativePath = "") {
         collections.push(...nestedCollections);
       } catch (err) {
         if (err.code !== "ENOENT") {
-          console.error(`Error loading ${metaPath}:`, err);
+          canopyLogError2(`Error loading ${metaPath}:`, err);
           throw new Error(`Invalid .collection.json in ${folderPath}: ${err.message}`);
         }
         const nestedCollections = await scanForCollectionMeta2(absolutePath, folderPath);
@@ -7487,6 +8054,7 @@ var init_meta_loader = __esm({
   "dist/schema/meta-loader.js"() {
     "use strict";
     init_error();
+    init_logger2();
     init_content_id_index();
     entryTypeMetaSchema2 = z8.object({
       name: z8.string().min(1),
@@ -7542,87 +8110,386 @@ var init_flatten3 = __esm({
   }
 });
 
-// dist/build-mode.js
-var STATIC_DEPLOY_USER2;
-var init_build_mode = __esm({
-  "dist/build-mode.js"() {
-    "use strict";
-    STATIC_DEPLOY_USER2 = Object.freeze({
-      type: "authenticated",
-      userId: "__static_deploy__",
-      groups: ["Admins"],
-      email: "static-deploy@canopycms",
-      name: "Static Deploy"
-    });
-  }
-});
-
-// dist/branch-schema-cache.js
-var SCHEMA_GENERATION_RESOURCE2;
-var init_branch_schema_cache = __esm({
-  "dist/branch-schema-cache.js"() {
+// dist/config/types.js
+var primitiveFieldTypes3, fieldTypes3;
+var init_types5 = __esm({
+  "dist/config/types.js"() {
     "use strict";
-    init_resolver();
-    init_flatten3();
-    init_build_mode();
-    init_resource_generation();
-    SCHEMA_GENERATION_RESOURCE2 = "schema";
+    primitiveFieldTypes3 = [
+      "string",
+      "number",
+      "boolean",
+      "datetime",
+      "rich-text",
+      "markdown",
+      "mdx",
+      "code"
+    ];
+    fieldTypes3 = [
+      ...primitiveFieldTypes3,
+      "image",
+      "select",
+      "reference",
+      "object",
+      "block",
+      "group"
+    ];
   }
 });
 
-// dist/content-index-generation.js
-async function bumpContentIndexGeneration2(root) {
-  return bumpResourceGeneration2(root, RESOURCE3);
-}
-async function invalidateBranchContentCaches2(root) {
-  await bumpContentIndexGeneration2(root);
-  await bumpResourceGeneration2(root, SCHEMA_GENERATION_RESOURCE2);
-  invalidateContentIndexesForRoot2(root);
-}
-var RESOURCE3;
-var init_content_index_generation = __esm({
-  "dist/content-index-generation.js"() {
+// dist/config/schemas/field.js
+import { z as z9 } from "zod";
+var fieldBaseSchema3, selectOptionSchema3, referenceOptionSchema3, primitiveFieldSchema3, ASPECT_RATIO_RE3, imageFieldSchema3, selectFieldSchema3, referenceFieldSchema3, fieldHolder3, blockSchema3, blockFieldSchema3, objectFieldSchema3, inlineGroupFieldSchema3, customFieldSchema3, knownFieldSchema3, fieldSchema3;
+var init_field3 = __esm({
+  "dist/config/schemas/field.js"() {
     "use strict";
-    init_resource_generation();
-    init_content_index_registry();
-    init_branch_schema_cache();
-    RESOURCE3 = "content-index";
-  }
-});
-
-// dist/sync-core.js
-import fs20 from "node:fs/promises";
-import path23 from "node:path";
-import { simpleGit as simpleGit3 } from "simple-git";
-function assertWithinDir(resolved, parent, label) {
-  const normalizedResolved = path23.resolve(resolved);
-  const normalizedParent = path23.resolve(parent);
-  if (!normalizedResolved.startsWith(normalizedParent + path23.sep) && normalizedResolved !== normalizedParent) {
-    throw new Error(`${label} escapes the expected directory: ${resolved}`);
-  }
-}
-async function safeReplaceDir(oldDir, newDir) {
-  const backupDir = `${oldDir}.sync-backup-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-  const oldExists = await filePathExists(oldDir);
-  if (oldExists) {
-    await fs20.rename(oldDir, backupDir);
-  }
-  try {
-    await fs20.rename(newDir, oldDir);
-  } catch (err) {
-    if (oldExists) {
-      await fs20.rename(backupDir, oldDir).catch(() => {
-      });
-    }
-    throw err;
-  }
-  if (oldExists) {
-    await fs20.rm(backupDir, { recursive: true, force: true }).catch(() => {
-    });
-  }
-}
-async function listFilesRecursive(dir, prefix = "") {
-  const results = [];
+    init_types5();
+    fieldBaseSchema3 = z9.object({
+      name: z9.string().min(1),
+      label: z9.string().optional(),
+      description: z9.string().optional(),
+      required: z9.boolean().optional(),
+      list: z9.boolean().optional(),
+      isTitle: z9.boolean().optional(),
+      isBody: z9.boolean().optional()
+    });
+    selectOptionSchema3 = z9.union([
+      z9.string(),
+      z9.object({
+        label: z9.string().min(1),
+        value: z9.string().min(1)
+      })
+    ]);
+    referenceOptionSchema3 = z9.union([
+      z9.string(),
+      z9.object({
+        label: z9.string().min(1),
+        value: z9.string().min(1)
+      })
+    ]);
+    primitiveFieldSchema3 = fieldBaseSchema3.extend({
+      type: z9.enum(primitiveFieldTypes3)
+    });
+    ASPECT_RATIO_RE3 = /^[1-9][0-9]*:[1-9][0-9]*$/;
+    imageFieldSchema3 = fieldBaseSchema3.extend({
+      type: z9.literal("image"),
+      aspect: z9.string().regex(ASPECT_RATIO_RE3, 'aspect must be "W:H" with positive integers (e.g. "16:9")').optional(),
+      altOptional: z9.boolean().optional()
+    });
+    selectFieldSchema3 = fieldBaseSchema3.extend({
+      type: z9.literal("select"),
+      options: z9.array(selectOptionSchema3).min(1)
+    });
+    referenceFieldSchema3 = fieldBaseSchema3.extend({
+      type: z9.literal("reference"),
+      collections: z9.array(z9.string().min(1)).min(1).optional(),
+      entryTypes: z9.array(z9.string().min(1)).min(1).optional(),
+      displayField: z9.string().min(1).optional(),
+      options: z9.array(referenceOptionSchema3).optional()
+    });
+    fieldHolder3 = [z9.never()];
+    blockSchema3 = z9.object({
+      name: z9.string().min(1),
+      label: z9.string().optional(),
+      description: z9.string().optional(),
+      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
+    });
+    blockFieldSchema3 = fieldBaseSchema3.extend({
+      type: z9.literal("block"),
+      templates: z9.array(blockSchema3).min(1)
+    });
+    objectFieldSchema3 = fieldBaseSchema3.extend({
+      type: z9.literal("object"),
+      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
+    });
+    inlineGroupFieldSchema3 = z9.object({
+      type: z9.literal("group"),
+      name: z9.string().min(1),
+      label: z9.string().optional(),
+      description: z9.string().optional(),
+      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
+    });
+    customFieldSchema3 = z9.lazy(() => fieldBaseSchema3.extend({
+      type: z9.string().min(1).refine((val) => !fieldTypes3.includes(val), {
+        message: "Custom field types must not conflict with built-in types"
+      })
+    }).passthrough());
+    knownFieldSchema3 = z9.discriminatedUnion("type", [
+      primitiveFieldSchema3,
+      selectFieldSchema3,
+      referenceFieldSchema3,
+      imageFieldSchema3,
+      objectFieldSchema3,
+      blockFieldSchema3,
+      inlineGroupFieldSchema3
+    ]);
+    fieldSchema3 = z9.lazy(() => z9.union([knownFieldSchema3, customFieldSchema3]));
+    fieldHolder3[0] = fieldSchema3;
+  }
+});
+
+// dist/config/schemas/collection.js
+import { z as z10 } from "zod";
+import { isAbsolute as isAbsolute3 } from "pathe";
+var relativePathSchema3, entryTypeSchema3, collectionSchema3;
+var init_collection3 = __esm({
+  "dist/config/schemas/collection.js"() {
+    "use strict";
+    init_field3();
+    relativePathSchema3 = z10.string().min(1).refine((val) => !isAbsolute3(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
+      message: 'Path must not contain ".."'
+    }).transform((val) => val.split(/[\\/]+/).filter(Boolean).join("/"));
+    entryTypeSchema3 = z10.object({
+      name: z10.string().min(1),
+      format: z10.enum(["md", "mdx", "json", "yaml"]),
+      schema: z10.array(z10.lazy(() => fieldSchema3)).min(1),
+      label: z10.string().optional(),
+      description: z10.string().optional(),
+      default: z10.boolean().optional(),
+      maxItems: z10.number().int().positive().optional()
+    });
+    collectionSchema3 = z10.lazy(() => z10.object({
+      name: z10.string().min(1),
+      path: relativePathSchema3,
+      label: z10.string().optional(),
+      description: z10.string().optional(),
+      entries: z10.array(entryTypeSchema3).optional(),
+      collections: z10.array(collectionSchema3).optional(),
+      order: z10.array(z10.string()).optional()
+      // Embedded IDs for ordering items
+    }).refine((data) => data.entries || data.collections, {
+      message: "Collection must have entries or collections"
+    }));
+  }
+});
+
+// dist/config/schemas/media.js
+import { z as z11 } from "zod";
+var mediaSchema3;
+var init_media3 = __esm({
+  "dist/config/schemas/media.js"() {
+    "use strict";
+    init_collection3();
+    mediaSchema3 = z11.discriminatedUnion("adapter", [
+      z11.object({
+        adapter: z11.literal("local"),
+        publicBaseUrl: z11.string().url().optional(),
+        /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
+        directory: relativePathSchema3.optional()
+      }),
+      z11.object({
+        adapter: z11.literal("s3"),
+        bucket: z11.string().min(1),
+        region: z11.string().min(1),
+        publicBaseUrl: z11.string().url().optional(),
+        /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
+        maxUploadBytes: z11.number().int().positive().optional()
+      }),
+      z11.object({
+        adapter: z11.literal("lfs"),
+        publicBaseUrl: z11.string().url().optional()
+      })
+    ]);
+  }
+});
+
+// dist/config/schemas/config.js
+import { z as z12 } from "zod";
+var defaultBranchAccessSchema3, defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
+var init_config4 = __esm({
+  "dist/config/schemas/config.js"() {
+    "use strict";
+    init_collection3();
+    init_media3();
+    defaultBranchAccessSchema3 = z12.enum(["allow", "deny"]).default("deny");
+    defaultPathAccessLevelSchema3 = z12.enum(["allow", "deny"]);
+    defaultPathAccessLevelsSchema3 = z12.object({
+      read: defaultPathAccessLevelSchema3.optional(),
+      edit: defaultPathAccessLevelSchema3.optional(),
+      review: defaultPathAccessLevelSchema3.optional()
+    }).strict();
+    defaultPathAccessSchema3 = z12.union([defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3]).default("deny");
+    defaultBaseBranchSchema3 = z12.string().default("main");
+    defaultRemoteNameSchema3 = z12.string().default("origin");
+    defaultRemoteUrlSchema3 = z12.string().min(1);
+    gitBotAuthorNameSchema3 = z12.string().min(1);
+    gitBotAuthorEmailSchema3 = z12.string().email();
+    githubTokenEnvVarSchema3 = z12.string().default("GITHUB_BOT_TOKEN");
+    operatingModeSchema3 = z12.enum(["prod", "dev"]);
+    deployedAsSchema3 = z12.enum(["static", "server"]).default("server");
+    contentRootSchema3 = relativePathSchema3.default("content");
+    sourceRootSchema3 = z12.string().min(1).optional();
+    deploymentNameSchema3 = z12.string().default("prod");
+    devContentSyncSchema3 = z12.enum(["off", "warn"]).default("warn");
+    devConfigSchema3 = z12.object({
+      contentSync: devContentSyncSchema3.optional()
+    });
+    editorConfigSchema3 = z12.object({
+      title: z12.string().optional(),
+      subtitle: z12.string().optional(),
+      theme: z12.unknown().optional(),
+      previewBase: z12.record(z12.string()).optional(),
+      // UI handler functions (runtime only, don't serialize)
+      onAccountClick: z12.function().returns(z12.void()).optional(),
+      onLogoutClick: z12.function().returns(z12.void()).optional(),
+      // Optional: custom account component (e.g., Clerk's UserButton)
+      AccountComponent: z12.custom().optional()
+    });
+    CanopyConfigSchema3 = z12.object({
+      media: mediaSchema3.optional(),
+      // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
+      // have .default('deny'), so the field is optional on input but always resolves to
+      // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
+      // before the inner default runs, defeating the fail-closed default (SCH-M1).
+      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
+      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
+      // still resolves to 'deny' and an omitted level inside the object form stays undefined
+      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
+      defaultBranchAccess: defaultBranchAccessSchema3,
+      defaultPathAccess: defaultPathAccessSchema3,
+      // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
+      // unset must stay undefined after parsing so dev mode can detect the fork
+      // point from git HEAD (see resolveBaseBranch in utils/git.ts).
+      defaultBaseBranch: defaultBaseBranchSchema3.optional(),
+      defaultActiveBranch: z12.string().min(1).optional(),
+      defaultRemoteName: defaultRemoteNameSchema3.optional(),
+      defaultRemoteUrl: defaultRemoteUrlSchema3.optional(),
+      gitBotAuthorName: gitBotAuthorNameSchema3,
+      gitBotAuthorEmail: gitBotAuthorEmailSchema3,
+      githubTokenEnvVar: githubTokenEnvVarSchema3.optional(),
+      // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
+      // validation loudly rather than silently running header-trusting dev auth semantics.
+      mode: operatingModeSchema3,
+      deployedAs: deployedAsSchema3,
+      // Has .default('server'), so always present after validation
+      // Escape hatch for prod hosts that genuinely have internet access and intentionally
+      // run git against a network remote (see GitManager.resolveRemoteUrl's prod-mode guard).
+      // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
+      allowNetworkRemoteInProd: z12.boolean().optional(),
+      settingsBranch: z12.string().optional(),
+      autoCreateSettingsPR: z12.boolean().optional(),
+      // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
+      // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
+      // the literal 'prod' instead of staying `undefined` — collapsing the
+      // env > config > modeDefault precedence chain that resolveDeploymentName
+      // (operating-mode/deployment-name.ts) implements: config would then always
+      // "win" over modeDefault (masking dev's real default of 'local'), and the env
+      // var would just be racing config's baked-in 'prod' instead of a true absence.
+      // `.optional()` here is what keeps an omitted deploymentName reaching
+      // resolveDeploymentName as `undefined`, so it can fall through to modeDefault.
+      // Do not "fix" this by removing `.optional()`.
+      deploymentName: deploymentNameSchema3.optional(),
+      contentRoot: contentRootSchema3.default("content"),
+      sourceRoot: sourceRootSchema3.optional(),
+      editor: editorConfigSchema3.optional(),
+      authPlugin: z12.custom().optional(),
+      entryLinkUrl: z12.custom().optional(),
+      validateEntry: z12.custom().optional(),
+      dev: devConfigSchema3.optional()
+    }).strict();
+    DEFAULT_PROD_WORKSPACE3 = "/mnt/efs/workspace";
+  }
+});
+
+// dist/config/validation.js
+var init_validation4 = __esm({
+  "dist/config/validation.js"() {
+    "use strict";
+    init_config4();
+    init_flatten3();
+  }
+});
+
+// dist/validation/entry-type-reference-validator.js
+var init_entry_type_reference_validator = __esm({
+  "dist/validation/entry-type-reference-validator.js"() {
+    "use strict";
+    init_validation4();
+  }
+});
+
+// dist/build-mode.js
+var STATIC_DEPLOY_USER2;
+var init_build_mode = __esm({
+  "dist/build-mode.js"() {
+    "use strict";
+    STATIC_DEPLOY_USER2 = Object.freeze({
+      type: "authenticated",
+      userId: "__static_deploy__",
+      groups: ["Admins"],
+      email: "static-deploy@canopycms",
+      name: "Static Deploy"
+    });
+  }
+});
+
+// dist/branch-schema-cache.js
+var SCHEMA_GENERATION_RESOURCE2;
+var init_branch_schema_cache = __esm({
+  "dist/branch-schema-cache.js"() {
+    "use strict";
+    init_resolver();
+    init_flatten3();
+    init_entry_type_reference_validator();
+    init_build_mode();
+    init_resource_generation();
+    SCHEMA_GENERATION_RESOURCE2 = "schema";
+  }
+});
+
+// dist/content-index-generation.js
+async function bumpContentIndexGeneration2(root) {
+  return bumpResourceGeneration2(root, RESOURCE3);
+}
+async function invalidateBranchContentCaches2(root) {
+  await bumpContentIndexGeneration2(root);
+  await bumpResourceGeneration2(root, SCHEMA_GENERATION_RESOURCE2);
+  invalidateContentIndexesForRoot2(root);
+}
+var RESOURCE3;
+var init_content_index_generation = __esm({
+  "dist/content-index-generation.js"() {
+    "use strict";
+    init_resource_generation();
+    init_content_index_registry();
+    init_branch_schema_cache();
+    RESOURCE3 = "content-index";
+  }
+});
+
+// dist/sync-core.js
+import fs20 from "node:fs/promises";
+import path23 from "node:path";
+import { simpleGit as simpleGit4 } from "simple-git";
+function assertWithinDir(resolved, parent, label) {
+  const normalizedResolved = path23.resolve(resolved);
+  const normalizedParent = path23.resolve(parent);
+  if (!normalizedResolved.startsWith(normalizedParent + path23.sep) && normalizedResolved !== normalizedParent) {
+    throw new Error(`${label} escapes the expected directory: ${resolved}`);
+  }
+}
+async function safeReplaceDir(oldDir, newDir) {
+  const backupDir = `${oldDir}.sync-backup-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const oldExists = await filePathExists(oldDir);
+  if (oldExists) {
+    await fs20.rename(oldDir, backupDir);
+  }
+  try {
+    await fs20.rename(newDir, oldDir);
+  } catch (err) {
+    if (oldExists) {
+      await fs20.rename(backupDir, oldDir).catch(() => {
+      });
+    }
+    throw err;
+  }
+  if (oldExists) {
+    await fs20.rm(backupDir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+async function listFilesRecursive(dir, prefix = "") {
+  const results = [];
   let entries;
   try {
     entries = await fs20.readdir(dir, { withFileTypes: true });
@@ -7677,7 +8544,7 @@ async function pushContentToWorkspace(options) {
     throw err;
   }
   try {
-    const wsGit = simpleGit3({ baseDir: branchPath });
+    const wsGit = simpleGit4({ baseDir: branchPath });
     await wsGit.add("-A");
     const postStatus = await wsGit.status();
     if (postStatus.files.length === 0) {
@@ -7704,7 +8571,7 @@ var init_sync_core = __esm({
 });
 
 // dist/utils/git.js
-import { simpleGit as simpleGit4 } from "simple-git";
+import { simpleGit as simpleGit5 } from "simple-git";
 var init_git = __esm({
   "dist/utils/git.js"() {
     "use strict";
@@ -7722,379 +8589,134 @@ var init_provisioning_lock = __esm({
 // dist/git-manager.js
 import fs21 from "node:fs/promises";
 import path24 from "node:path";
-import { simpleGit as simpleGit5 } from "simple-git";
+import { simpleGit as simpleGit6 } from "simple-git";
 async function ensureGitExcludePattern2(repoPath, pattern) {
-  const excludePath = path24.join(repoPath, ".git", "info", "exclude");
-  await fs21.mkdir(path24.dirname(excludePath), { recursive: true });
-  let content = "";
-  try {
-    content = await fs21.readFile(excludePath, "utf-8");
-  } catch (err) {
-    if (!isNotFoundError(err))
-      throw err;
-  }
-  const lines = content.split("\n");
-  if (lines.some((line) => line.trim() === pattern)) {
-    log9.debug("git", "Pattern already in .git/info/exclude", { pattern });
-    return;
-  }
-  const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
-  const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-  await fs21.writeFile(excludePath, newContent, "utf-8");
-  log9.debug("git", "Added pattern to .git/info/exclude", { pattern });
-}
-var log9;
-var init_git_manager = __esm({
-  "dist/git-manager.js"() {
-    "use strict";
-    init_content_index_registry();
-    init_content_index_generation();
-    init_debug2();
-    init_error();
-    init_git();
-    init_provisioning_lock();
-    log9 = createDebugLogger3({ prefix: "GitManager" });
-  }
-});
-
-// dist/operating-mode/client-safe-strategy.js
-var ProdClientSafeStrategy3, DevClientSafeStrategy3;
-var init_client_safe_strategy2 = __esm({
-  "dist/operating-mode/client-safe-strategy.js"() {
-    "use strict";
-    ProdClientSafeStrategy3 = class {
-      constructor() {
-        this.mode = "prod";
-      }
-      // UI Feature Flags
-      supportsBranching() {
-        return true;
-      }
-      supportsStatusBadge() {
-        return true;
-      }
-      supportsComments() {
-        return true;
-      }
-      supportsPullRequests() {
-        return true;
-      }
-      // Simple Data
-      getPermissionsFileName() {
-        return "permissions.json";
-      }
-      getGroupsFileName() {
-        return "groups.json";
-      }
-      shouldCommit() {
-        return true;
-      }
-      shouldPush() {
-        return true;
-      }
-    };
-    DevClientSafeStrategy3 = class {
-      constructor() {
-        this.mode = "dev";
-      }
-      // UI Feature Flags
-      supportsBranching() {
-        return true;
-      }
-      supportsStatusBadge() {
-        return true;
-      }
-      supportsComments() {
-        return true;
-      }
-      supportsPullRequests() {
-        return false;
-      }
-      // Simple Data
-      getPermissionsFileName() {
-        return "permissions.json";
-      }
-      getGroupsFileName() {
-        return "groups.json";
-      }
-      shouldCommit() {
-        return true;
-      }
-      shouldPush() {
-        return true;
-      }
-    };
-  }
-});
-
-// dist/config/types.js
-var primitiveFieldTypes3, fieldTypes3;
-var init_types5 = __esm({
-  "dist/config/types.js"() {
-    "use strict";
-    primitiveFieldTypes3 = [
-      "string",
-      "number",
-      "boolean",
-      "datetime",
-      "rich-text",
-      "markdown",
-      "mdx",
-      "code"
-    ];
-    fieldTypes3 = [
-      ...primitiveFieldTypes3,
-      "image",
-      "select",
-      "reference",
-      "object",
-      "block",
-      "group"
-    ];
-  }
-});
-
-// dist/config/schemas/field.js
-import { z as z9 } from "zod";
-var fieldBaseSchema3, selectOptionSchema3, referenceOptionSchema3, primitiveFieldSchema3, ASPECT_RATIO_RE3, imageFieldSchema3, selectFieldSchema3, referenceFieldSchema3, fieldHolder3, blockSchema3, blockFieldSchema3, objectFieldSchema3, inlineGroupFieldSchema3, customFieldSchema3, knownFieldSchema3, fieldSchema3;
-var init_field3 = __esm({
-  "dist/config/schemas/field.js"() {
-    "use strict";
-    init_types5();
-    fieldBaseSchema3 = z9.object({
-      name: z9.string().min(1),
-      label: z9.string().optional(),
-      description: z9.string().optional(),
-      required: z9.boolean().optional(),
-      list: z9.boolean().optional(),
-      isTitle: z9.boolean().optional(),
-      isBody: z9.boolean().optional()
-    });
-    selectOptionSchema3 = z9.union([
-      z9.string(),
-      z9.object({
-        label: z9.string().min(1),
-        value: z9.string().min(1)
-      })
-    ]);
-    referenceOptionSchema3 = z9.union([
-      z9.string(),
-      z9.object({
-        label: z9.string().min(1),
-        value: z9.string().min(1)
-      })
-    ]);
-    primitiveFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.enum(primitiveFieldTypes3)
-    });
-    ASPECT_RATIO_RE3 = /^[1-9][0-9]*:[1-9][0-9]*$/;
-    imageFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("image"),
-      aspect: z9.string().regex(ASPECT_RATIO_RE3, 'aspect must be "W:H" with positive integers (e.g. "16:9")').optional(),
-      altOptional: z9.boolean().optional()
-    });
-    selectFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("select"),
-      options: z9.array(selectOptionSchema3).min(1)
-    });
-    referenceFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("reference"),
-      collections: z9.array(z9.string().min(1)).min(1).optional(),
-      entryTypes: z9.array(z9.string().min(1)).min(1).optional(),
-      displayField: z9.string().min(1).optional(),
-      options: z9.array(referenceOptionSchema3).optional()
-    });
-    fieldHolder3 = [z9.never()];
-    blockSchema3 = z9.object({
-      name: z9.string().min(1),
-      label: z9.string().optional(),
-      description: z9.string().optional(),
-      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
-    });
-    blockFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("block"),
-      templates: z9.array(blockSchema3).min(1)
-    });
-    objectFieldSchema3 = fieldBaseSchema3.extend({
-      type: z9.literal("object"),
-      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
-    });
-    inlineGroupFieldSchema3 = z9.object({
-      type: z9.literal("group"),
-      name: z9.string().min(1),
-      label: z9.string().optional(),
-      description: z9.string().optional(),
-      fields: z9.array(z9.lazy(() => fieldHolder3[0])).min(1)
-    });
-    customFieldSchema3 = z9.lazy(() => fieldBaseSchema3.extend({
-      type: z9.string().min(1).refine((val) => !fieldTypes3.includes(val), {
-        message: "Custom field types must not conflict with built-in types"
-      })
-    }).passthrough());
-    knownFieldSchema3 = z9.discriminatedUnion("type", [
-      primitiveFieldSchema3,
-      selectFieldSchema3,
-      referenceFieldSchema3,
-      imageFieldSchema3,
-      objectFieldSchema3,
-      blockFieldSchema3,
-      inlineGroupFieldSchema3
-    ]);
-    fieldSchema3 = z9.lazy(() => z9.union([knownFieldSchema3, customFieldSchema3]));
-    fieldHolder3[0] = fieldSchema3;
+  const excludePath = path24.join(repoPath, ".git", "info", "exclude");
+  await fs21.mkdir(path24.dirname(excludePath), { recursive: true });
+  let content = "";
+  try {
+    content = await fs21.readFile(excludePath, "utf-8");
+  } catch (err) {
+    if (!isNotFoundError(err))
+      throw err;
   }
-});
-
-// dist/config/schemas/collection.js
-import { z as z10 } from "zod";
-import { isAbsolute as isAbsolute3 } from "pathe";
-var relativePathSchema3, entryTypeSchema3, collectionSchema3;
-var init_collection3 = __esm({
-  "dist/config/schemas/collection.js"() {
+  const lines = content.split("\n");
+  if (lines.some((line) => line.trim() === pattern)) {
+    log9.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    return;
+  }
+  const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
+  const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
+  await fs21.writeFile(excludePath, newContent, "utf-8");
+  log9.debug("git", "Added pattern to .git/info/exclude", { pattern });
+}
+var log9;
+var init_git_manager = __esm({
+  "dist/git-manager.js"() {
     "use strict";
-    init_field3();
-    relativePathSchema3 = z10.string().min(1).refine((val) => !isAbsolute3(val), { message: "Path must be relative" }).refine((val) => !val.split(/[\\/]+/).includes(".."), {
-      message: 'Path must not contain ".."'
-    }).transform((val) => val.split(/[\\/]+/).filter(Boolean).join("/"));
-    entryTypeSchema3 = z10.object({
-      name: z10.string().min(1),
-      format: z10.enum(["md", "mdx", "json", "yaml"]),
-      schema: z10.array(z10.lazy(() => fieldSchema3)).min(1),
-      label: z10.string().optional(),
-      description: z10.string().optional(),
-      default: z10.boolean().optional(),
-      maxItems: z10.number().int().positive().optional()
-    });
-    collectionSchema3 = z10.lazy(() => z10.object({
-      name: z10.string().min(1),
-      path: relativePathSchema3,
-      label: z10.string().optional(),
-      description: z10.string().optional(),
-      entries: z10.array(entryTypeSchema3).optional(),
-      collections: z10.array(collectionSchema3).optional(),
-      order: z10.array(z10.string()).optional()
-      // Embedded IDs for ordering items
-    }).refine((data) => data.entries || data.collections, {
-      message: "Collection must have entries or collections"
-    }));
+    init_content_index_registry();
+    init_content_index_generation();
+    init_debug2();
+    init_error();
+    init_git();
+    init_provisioning_lock();
+    log9 = createDebugLogger3({ prefix: "GitManager" });
   }
 });
 
-// dist/config/schemas/media.js
-import { z as z11 } from "zod";
-var mediaSchema3;
-var init_media3 = __esm({
-  "dist/config/schemas/media.js"() {
+// dist/operating-mode/client-safe-strategy.js
+var ProdClientSafeStrategy3, DevClientSafeStrategy3;
+var init_client_safe_strategy2 = __esm({
+  "dist/operating-mode/client-safe-strategy.js"() {
     "use strict";
-    init_collection3();
-    mediaSchema3 = z11.discriminatedUnion("adapter", [
-      z11.object({
-        adapter: z11.literal("local"),
-        publicBaseUrl: z11.string().url().optional(),
-        /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
-        directory: relativePathSchema3.optional()
-      }),
-      z11.object({
-        adapter: z11.literal("s3"),
-        bucket: z11.string().min(1),
-        region: z11.string().min(1),
-        publicBaseUrl: z11.string().url().optional(),
-        /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
-        maxUploadBytes: z11.number().int().positive().optional()
-      }),
-      z11.object({
-        adapter: z11.literal("lfs"),
-        publicBaseUrl: z11.string().url().optional()
-      })
-    ]);
+    ProdClientSafeStrategy3 = class {
+      constructor() {
+        this.mode = "prod";
+      }
+      // UI Feature Flags
+      supportsBranching() {
+        return true;
+      }
+      supportsStatusBadge() {
+        return true;
+      }
+      supportsComments() {
+        return true;
+      }
+      supportsPullRequests() {
+        return true;
+      }
+      // Simple Data
+      getPermissionsFileName() {
+        return "permissions.json";
+      }
+      getGroupsFileName() {
+        return "groups.json";
+      }
+      shouldCommit() {
+        return true;
+      }
+      shouldPush() {
+        return true;
+      }
+    };
+    DevClientSafeStrategy3 = class {
+      constructor() {
+        this.mode = "dev";
+      }
+      // UI Feature Flags
+      supportsBranching() {
+        return true;
+      }
+      supportsStatusBadge() {
+        return true;
+      }
+      supportsComments() {
+        return true;
+      }
+      supportsPullRequests() {
+        return false;
+      }
+      // Simple Data
+      getPermissionsFileName() {
+        return "permissions.json";
+      }
+      getGroupsFileName() {
+        return "groups.json";
+      }
+      shouldCommit() {
+        return true;
+      }
+      shouldPush() {
+        return true;
+      }
+    };
   }
 });
 
-// dist/config/schemas/config.js
-import { z as z12 } from "zod";
-var defaultBranchAccessSchema3, defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
-var init_config4 = __esm({
-  "dist/config/schemas/config.js"() {
+// dist/operating-mode/deployment-name.js
+function resolveDeploymentName3(config, modeDefault) {
+  const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
+  const configValue = config.deploymentName;
+  if (envValue && configValue && envValue !== configValue && !warned3) {
+    canopyLogWarn3(`CanopyCMS: CANOPYCMS_DEPLOYMENT_NAME ("${envValue}") differs from config.deploymentName ("${configValue}") \u2014 using the env var (infra-stamped env wins over shared-repo config by design; see resolveDeploymentName's doc comment). Update config.deploymentName to match if this mismatch was unintentional.`);
+    warned3 = true;
+  }
+  const resolved = envValue || configValue || modeDefault;
+  if (!isValidDeploymentName3(resolved)) {
+    const source = envValue ? "CANOPYCMS_DEPLOYMENT_NAME" : configValue ? "config.deploymentName" : "the mode default";
+    throw new Error(`CanopyCMS: invalid deploymentName ${JSON.stringify(resolved)} (from ${source}). It is interpolated into the settings branch name (canopycms-settings-<deploymentName>), so it must start with a letter or digit, contain only letters, digits, '.', '_' or '-', and must not contain '..' or end with '.' or '.lock'.`);
+  }
+  return resolved;
+}
+var warned3, VALID_DEPLOYMENT_NAME3, isValidDeploymentName3;
+var init_deployment_name2 = __esm({
+  "dist/operating-mode/deployment-name.js"() {
     "use strict";
-    init_collection3();
-    init_media3();
-    defaultBranchAccessSchema3 = z12.enum(["allow", "deny"]).default("deny");
-    defaultPathAccessLevelSchema3 = z12.enum(["allow", "deny"]);
-    defaultPathAccessLevelsSchema3 = z12.object({
-      read: defaultPathAccessLevelSchema3.optional(),
-      edit: defaultPathAccessLevelSchema3.optional(),
-      review: defaultPathAccessLevelSchema3.optional()
-    }).strict();
-    defaultPathAccessSchema3 = z12.union([defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3]).default("deny");
-    defaultBaseBranchSchema3 = z12.string().default("main");
-    defaultRemoteNameSchema3 = z12.string().default("origin");
-    defaultRemoteUrlSchema3 = z12.string().min(1);
-    gitBotAuthorNameSchema3 = z12.string().min(1);
-    gitBotAuthorEmailSchema3 = z12.string().email();
-    githubTokenEnvVarSchema3 = z12.string().default("GITHUB_BOT_TOKEN");
-    operatingModeSchema3 = z12.enum(["prod", "dev"]);
-    deployedAsSchema3 = z12.enum(["static", "server"]).default("server");
-    contentRootSchema3 = relativePathSchema3.default("content");
-    sourceRootSchema3 = z12.string().min(1).optional();
-    deploymentNameSchema3 = z12.string().default("prod");
-    devContentSyncSchema3 = z12.enum(["off", "warn"]).default("warn");
-    devConfigSchema3 = z12.object({
-      contentSync: devContentSyncSchema3.optional()
-    });
-    editorConfigSchema3 = z12.object({
-      title: z12.string().optional(),
-      subtitle: z12.string().optional(),
-      theme: z12.unknown().optional(),
-      previewBase: z12.record(z12.string()).optional(),
-      // UI handler functions (runtime only, don't serialize)
-      onAccountClick: z12.function().returns(z12.void()).optional(),
-      onLogoutClick: z12.function().returns(z12.void()).optional(),
-      // Optional: custom account component (e.g., Clerk's UserButton)
-      AccountComponent: z12.custom().optional()
-    });
-    CanopyConfigSchema3 = z12.object({
-      media: mediaSchema3.optional(),
-      // No outer .optional() here: defaultBranchAccessSchema/defaultPathAccessSchema already
-      // have .default('deny'), so the field is optional on input but always resolves to
-      // 'allow'/'deny' (never undefined) on output. An outer .optional() would short-circuit
-      // before the inner default runs, defeating the fail-closed default (SCH-M1).
-      // defaultPathAccessSchema's union keeps the same rule: the .default('deny') sits on the
-      // OUTER union, not inside defaultPathAccessLevelsSchema, so an omitted top-level field
-      // still resolves to 'deny' and an omitted level inside the object form stays undefined
-      // (resolved to 'deny' at read time by resolveDefaultPathAccess).
-      defaultBranchAccess: defaultBranchAccessSchema3,
-      defaultPathAccess: defaultPathAccessSchema3,
-      // .optional() deliberately defeats defaultBaseBranchSchema's .default('main'):
-      // unset must stay undefined after parsing so dev mode can detect the fork
-      // point from git HEAD (see resolveBaseBranch in utils/git.ts).
-      defaultBaseBranch: defaultBaseBranchSchema3.optional(),
-      defaultActiveBranch: z12.string().min(1).optional(),
-      defaultRemoteName: defaultRemoteNameSchema3.optional(),
-      defaultRemoteUrl: defaultRemoteUrlSchema3.optional(),
-      gitBotAuthorName: gitBotAuthorNameSchema3,
-      gitBotAuthorEmail: gitBotAuthorEmailSchema3,
-      githubTokenEnvVar: githubTokenEnvVarSchema3.optional(),
-      // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
-      // validation loudly rather than silently running header-trusting dev auth semantics.
-      mode: operatingModeSchema3,
-      deployedAs: deployedAsSchema3,
-      // Has .default('server'), so always present after validation
-      // Escape hatch for prod hosts that genuinely have internet access and intentionally
-      // run git against a network remote (see GitManager.resolveRemoteUrl's prod-mode guard).
-      // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
-      allowNetworkRemoteInProd: z12.boolean().optional(),
-      settingsBranch: z12.string().optional(),
-      autoCreateSettingsPR: z12.boolean().optional(),
-      deploymentName: deploymentNameSchema3.optional(),
-      contentRoot: contentRootSchema3.default("content"),
-      sourceRoot: sourceRootSchema3.optional(),
-      editor: editorConfigSchema3.optional(),
-      authPlugin: z12.custom().optional(),
-      entryLinkUrl: z12.custom().optional(),
-      validateEntry: z12.custom().optional(),
-      dev: devConfigSchema3.optional()
-    }).strict();
-    DEFAULT_PROD_WORKSPACE3 = "/mnt/efs/workspace";
+    init_logger2();
+    warned3 = false;
+    VALID_DEPLOYMENT_NAME3 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+    isValidDeploymentName3 = (name) => VALID_DEPLOYMENT_NAME3.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
   }
 });
 
@@ -8117,15 +8739,6 @@ var init_permissions3 = __esm({
   }
 });
 
-// dist/config/validation.js
-var init_validation4 = __esm({
-  "dist/config/validation.js"() {
-    "use strict";
-    init_config4();
-    init_flatten3();
-  }
-});
-
 // dist/config/helpers.js
 var init_helpers3 = __esm({
   "dist/config/helpers.js"() {
@@ -8177,6 +8790,7 @@ var init_client_unsafe_strategy2 = __esm({
   "dist/operating-mode/client-unsafe-strategy.js"() {
     "use strict";
     init_client_safe_strategy2();
+    init_deployment_name2();
     init_config5();
     ProdStrategy3 = class extends ProdClientSafeStrategy3 {
       // All client-safe methods inherited automatically from ProdClientSafeStrategy:
@@ -8187,8 +8801,8 @@ var init_client_unsafe_strategy2 = __esm({
       getWorkspaceRoot(_sourceRoot) {
         return path25.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE3);
       }
-      getContentRoot(sourceRoot) {
-        return path25.resolve(sourceRoot ?? process.cwd(), "content");
+      getContentRoot(contentRoot, sourceRoot) {
+        return path25.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
         return path25.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -8219,8 +8833,7 @@ var init_client_unsafe_strategy2 = __esm({
       getSettingsBranchName(config) {
         if (config.settingsBranch)
           return config.settingsBranch;
-        const deploymentName = config.deploymentName ?? "prod";
-        return `canopycms-settings-${deploymentName}`;
+        return `canopycms-settings-${resolveDeploymentName3(config, "prod")}`;
       }
       getSettingsRoot(sourceRoot) {
         return path25.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -8242,8 +8855,8 @@ var init_client_unsafe_strategy2 = __esm({
       getWorkspaceRoot(sourceRoot) {
         return path25.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
-      getContentRoot(sourceRoot) {
-        return path25.resolve(sourceRoot ?? process.cwd(), "content");
+      getContentRoot(contentRoot, sourceRoot) {
+        return path25.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
         return path25.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -8273,8 +8886,7 @@ var init_client_unsafe_strategy2 = __esm({
       getSettingsBranchName(config) {
         if (config.settingsBranch)
           return config.settingsBranch;
-        const deploymentName = config.deploymentName ?? "local";
-        return `canopycms-settings-${deploymentName}`;
+        return `canopycms-settings-${resolveDeploymentName3(config, "local")}`;
       }
       getSettingsRoot(sourceRoot) {
         return path25.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -8298,6 +8910,7 @@ var init_operating_mode2 = __esm({
     "use strict";
     init_client_safe_strategy2();
     init_client_unsafe_strategy2();
+    init_deployment_name2();
   }
 });
 
@@ -8307,12 +8920,12 @@ __export(sync_exports, {
   SyncError: () => SyncError,
   sync: () => sync
 });
-import fs23 from "node:fs/promises";
+import fs24 from "node:fs/promises";
 import path26 from "node:path";
-import { simpleGit as simpleGit6 } from "simple-git";
+import { simpleGit as simpleGit7 } from "simple-git";
 import * as p2 from "@clack/prompts";
 async function detectCurrentBranch(projectDir) {
-  const git = simpleGit6({ baseDir: projectDir });
+  const git = simpleGit7({ baseDir: projectDir });
   const branch = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
   if (branch === "HEAD")
     throw new Error("Detached HEAD \u2014 use --branch to specify a branch name");
@@ -8321,7 +8934,7 @@ async function detectCurrentBranch(projectDir) {
 async function selectBranch(options, branchesDir) {
   let branches = [];
   if (await filePathExists(branchesDir)) {
-    const entries = await fs23.readdir(branchesDir, { withFileTypes: true });
+    const entries = await fs24.readdir(branchesDir, { withFileTypes: true });
     branches = entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
   }
   let branchName = options.branch;
@@ -8353,8 +8966,8 @@ async function selectBranch(options, branchesDir) {
   assertWithinDir(branchPath, branchesDir, "--branch");
   if (!branches.includes(branchName)) {
     if (options.autoCreate) {
-      await fs23.mkdir(branchPath, { recursive: true });
-      const wsGit = simpleGit6({ baseDir: branchPath });
+      await fs24.mkdir(branchPath, { recursive: true });
+      const wsGit = simpleGit7({ baseDir: branchPath });
       await wsGit.init();
       await wsGit.checkoutLocalBranch(branchName);
       await wsGit.raw(["commit", "--allow-empty", "-m", "init: workspace created by sync"]);
@@ -8381,7 +8994,7 @@ async function syncPush(options) {
     return { fileCount: 0 };
   const branchPath = path26.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
-  const wsGit = simpleGit6({ baseDir: branchPath });
+  const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
   if (status.conflicted.length > 0) {
     p2.log.error("Branch workspace has unresolved merge conflicts.");
@@ -8451,7 +9064,7 @@ async function syncPull(options) {
   p2.log.step(`Pulling content from branch: ${branchName}`);
   const destContentDir = path26.join(projectDir, contentRoot);
   assertWithinDir(destContentDir, projectDir, "--content-root");
-  const sourceGit = simpleGit6({ baseDir: projectDir });
+  const sourceGit = simpleGit7({ baseDir: projectDir });
   const status = await sourceGit.status();
   const uncommittedContent = status.files.filter((f) => f.path.startsWith(contentRoot + "/") || f.path === contentRoot);
   const untrackedLosses = [];
@@ -8501,7 +9114,7 @@ async function syncPull(options) {
     await copyDir(branchContentDir, tmpDestDir);
     await safeReplaceDir(destContentDir, tmpDestDir);
   } catch (err) {
-    await fs23.rm(tmpDestDir, { recursive: true, force: true }).catch(() => {
+    await fs24.rm(tmpDestDir, { recursive: true, force: true }).catch(() => {
     });
     throw err;
   }
@@ -8536,7 +9149,7 @@ async function syncBoth(options) {
     return { pushed: 0, pulled: 0 };
   const branchPath = path26.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
-  const wsGit = simpleGit6({ baseDir: branchPath });
+  const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
   if (status.conflicted.length > 0) {
     p2.log.error("Branch workspace has unresolved merge conflicts.");
@@ -8576,7 +9189,7 @@ async function syncBoth(options) {
       await copyDir(srcContentDir, tmpDir);
       await safeReplaceDir(wsContentDir, tmpDir);
     } catch (err) {
-      await fs23.rm(tmpDir, { recursive: true, force: true }).catch(() => {
+      await fs24.rm(tmpDir, { recursive: true, force: true }).catch(() => {
       });
       await wsGit.checkout(currentBranch);
       await wsGit.raw(["branch", "-D", incomingBranch]).catch(() => {
@@ -8639,7 +9252,7 @@ async function syncAbort(options) {
     return;
   const branchPath = path26.join(branchesDir, branchName);
   assertWithinDir(branchPath, branchesDir, "--branch");
-  const wsGit = simpleGit6({ baseDir: branchPath });
+  const wsGit = simpleGit7({ baseDir: branchPath });
   const status = await wsGit.status();
   if (status.conflicted.length === 0) {
     p2.log.info(`Branch workspace "${branchName}" is not in a merge state \u2014 nothing to abort.`);
@@ -8765,7 +9378,7 @@ var init_async_mutex = __esm({
 });
 
 // dist/utils/occ-json-write.js
-import fs24 from "node:fs/promises";
+import fs25 from "node:fs/promises";
 import path27 from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import lockfile4 from "proper-lockfile";
@@ -8776,28 +9389,28 @@ async function writeOccJsonFile2(filePath, payload, options) {
   const data = { ...payload, version: newVersion, writeId };
   const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
   const dir = path27.dirname(filePath);
-  await fs24.mkdir(dir, { recursive: true });
+  await fs25.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs24.writeFile(tempPath, content, "utf-8");
+  await fs25.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs24.link(tempPath, filePath);
+      await fs25.link(tempPath, filePath);
     } catch (err) {
-      await fs24.unlink(tempPath).catch(() => {
+      await fs25.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError(err)) {
         throw new OccWriteConflictError2();
       }
       throw err;
     }
-    await fs24.unlink(tempPath).catch(() => {
+    await fs25.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs24.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs25.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -8805,16 +9418,16 @@ async function writeOccJsonFile2(filePath, payload, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError2();
     }
-    await fs24.rename(tempPath, filePath);
+    await fs25.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs24.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs25.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError2();
     }
   } catch (err) {
-    await fs24.unlink(tempPath).catch(() => {
+    await fs25.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -8841,7 +9454,7 @@ async function withOccRetry2(operation, options) {
 }
 async function withOccFileLock2(filePath, fn) {
   const dir = path27.dirname(filePath);
-  await fs24.mkdir(dir, { recursive: true });
+  await fs25.mkdir(dir, { recursive: true });
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -8900,7 +9513,7 @@ var init_occ_json_write = __esm({
 });
 
 // dist/branch-registry.js
-import fs25 from "node:fs/promises";
+import fs26 from "node:fs/promises";
 import path28 from "node:path";
 var log12, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
 var init_branch_registry = __esm({
@@ -8909,6 +9522,7 @@ var init_branch_registry = __esm({
     init_branch_metadata();
     init_error();
     init_debug2();
+    init_logger2();
     init_resource_generation();
     log12 = createDebugLogger3({ prefix: "BranchRegistry" });
     REGISTRY_FILE2 = "branches.json";
@@ -8933,7 +9547,7 @@ var init_branch_registry = __esm({
       async list() {
         let parsed;
         try {
-          const raw = await fs25.readFile(this.registryPath, "utf8");
+          const raw = await fs26.readFile(this.registryPath, "utf8");
           parsed = JSON.parse(raw);
         } catch (err) {
           if (isNotFoundError(err)) {
@@ -9022,7 +9636,7 @@ var init_branch_registry = __esm({
       async performRegenerate() {
         const read = await readResourceGeneration2(this.root, RESOURCE4);
         const branches = await this.scanBranchDirectories();
-        await fs25.unlink(this.stalePath).catch(() => {
+        await fs26.unlink(this.stalePath).catch(() => {
         });
         if (!read.ok) {
           return branches;
@@ -9033,12 +9647,12 @@ var init_branch_registry = __esm({
           generation: read.token
         };
         const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-        await fs25.mkdir(this.root, { recursive: true });
-        await fs25.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+        await fs26.mkdir(this.root, { recursive: true });
+        await fs26.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
         try {
-          await fs25.rename(uniqueTempPath, this.registryPath);
+          await fs26.rename(uniqueTempPath, this.registryPath);
         } catch (err) {
-          await fs25.unlink(uniqueTempPath).catch(() => {
+          await fs26.unlink(uniqueTempPath).catch(() => {
           });
           throw err;
         }
@@ -9052,7 +9666,7 @@ var init_branch_registry = __esm({
       async scanBranchDirectories() {
         const branches = [];
         try {
-          const entries = await fs25.readdir(this.root, { withFileTypes: true });
+          const entries = await fs26.readdir(this.root, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory() || entry.name.startsWith(".")) {
               continue;
@@ -9062,7 +9676,7 @@ var init_branch_registry = __esm({
             try {
               meta = await BranchMetadataFileManager2.loadOnly(branchRoot);
             } catch (err) {
-              console.warn(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage(err)}`);
+              canopyLogWarn3(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage(err)}`);
               continue;
             }
             if (meta) {
@@ -9086,7 +9700,7 @@ var init_branch_registry = __esm({
 });
 
 // dist/branch-metadata.js
-import fs26 from "node:fs/promises";
+import fs27 from "node:fs/promises";
 import path29 from "node:path";
 var BRANCH_META_DIR2, BRANCH_META_FILE2, CURRENT_SCHEMA_VERSION2, BranchMetadataConflictError2, BranchMetadataCorruptError2, BranchMetadataFileManager2;
 var init_branch_metadata = __esm({
@@ -9129,7 +9743,7 @@ var init_branch_metadata = __esm({
         const resolvedRoot = path29.resolve(branchRoot);
         const filePath = path29.join(resolvedRoot, BRANCH_META_DIR2, BRANCH_META_FILE2);
         try {
-          const raw = await fs26.readFile(filePath, "utf8");
+          const raw = await fs27.readFile(filePath, "utf8");
           return JSON.parse(raw);
         } catch (err) {
           if (isNotFoundError(err)) {
@@ -9150,7 +9764,7 @@ var init_branch_metadata = __esm({
       }
       async load() {
         try {
-          const raw = await fs26.readFile(this.filePath, "utf8");
+          const raw = await fs27.readFile(this.filePath, "utf8");
           const parsed = JSON.parse(raw);
           const version = parsed.version ?? 0;
           return { meta: parsed, version };
@@ -9212,7 +9826,7 @@ var init_branch_metadata = __esm({
        */
       async save(incoming) {
         try {
-          await fs26.stat(this.branchRoot);
+          await fs27.stat(this.branchRoot);
         } catch (err) {
           if (isNotFoundError(err)) {
             throw new BranchMetadataConflictError2("Branch no longer exists");
@@ -9287,7 +9901,7 @@ __export(migrate_exports, {
   migrate: () => migrate,
   slugifyName: () => slugifyName
 });
-import fs27 from "node:fs/promises";
+import fs28 from "node:fs/promises";
 import path30 from "node:path";
 import * as p3 from "@clack/prompts";
 function slugifyName(name) {
@@ -9313,7 +9927,7 @@ function stripDirIdSuffix(dirName) {
   return dirName;
 }
 async function planDirectory(dirPath, isRoot, ctx) {
-  const entries = await fs27.readdir(dirPath, { withFileTypes: true });
+  const entries = await fs28.readdir(dirPath, { withFileTypes: true });
   entries.sort((a, b) => a.name.localeCompare(b.name));
   const ops = [];
   let hasOwnFiles = false;
@@ -9440,9 +10054,9 @@ async function migrate(options) {
   const applyOps = async () => {
     for (const op of ops) {
       if (op.kind === "rename") {
-        await fs27.rename(op.from, op.to);
+        await fs28.rename(op.from, op.to);
       } else {
-        await fs27.writeFile(op.filePath, op.content, "utf-8");
+        await fs28.writeFile(op.filePath, op.content, "utf-8");
       }
     }
   };