canopycms 0.0.61-int.75 → 0.0.61

package/dist/cli/generate-ai-content.js

@@ -38,6 +38,21 @@ var init_normalize = __esm({
   }
 });
 
+// dist/utils/logger.js
+function canopyLogWarn(...args) {
+  active.warn(...args);
+}
+function canopyLogError(...args) {
+  active.error(...args);
+}
+var active;
+var init_logger = __esm({
+  "dist/utils/logger.js"() {
+    "use strict";
+    active = console;
+  }
+});
+
 // dist/paths/types.js
 var ROOT_COLLECTION_ID;
 var init_types = __esm({
@@ -150,100 +165,6 @@ var init_flatten = __esm({
   }
 });
 
-// dist/operating-mode/client-safe-strategy.js
-function clientOperatingStrategy(mode) {
-  const cached = clientStrategyCache.get(mode);
-  if (cached)
-    return cached;
-  let strategy;
-  switch (mode) {
-    case "prod":
-      strategy = new ProdClientSafeStrategy();
-      break;
-    case "dev":
-      strategy = new DevClientSafeStrategy();
-      break;
-    default: {
-      const _exhaustive = mode;
-      throw new Error(`Unknown operating mode: ${_exhaustive}`);
-    }
-  }
-  clientStrategyCache.set(mode, strategy);
-  return strategy;
-}
-function clearClientStrategyCache() {
-  clientStrategyCache.clear();
-}
-var ProdClientSafeStrategy, DevClientSafeStrategy, clientStrategyCache;
-var init_client_safe_strategy = __esm({
-  "dist/operating-mode/client-safe-strategy.js"() {
-    "use strict";
-    ProdClientSafeStrategy = class {
-      constructor() {
-        this.mode = "prod";
-      }
-      // UI Feature Flags
-      supportsBranching() {
-        return true;
-      }
-      supportsStatusBadge() {
-        return true;
-      }
-      supportsComments() {
-        return true;
-      }
-      supportsPullRequests() {
-        return true;
-      }
-      // Simple Data
-      getPermissionsFileName() {
-        return "permissions.json";
-      }
-      getGroupsFileName() {
-        return "groups.json";
-      }
-      shouldCommit() {
-        return true;
-      }
-      shouldPush() {
-        return true;
-      }
-    };
-    DevClientSafeStrategy = class {
-      constructor() {
-        this.mode = "dev";
-      }
-      // UI Feature Flags
-      supportsBranching() {
-        return true;
-      }
-      supportsStatusBadge() {
-        return true;
-      }
-      supportsComments() {
-        return true;
-      }
-      supportsPullRequests() {
-        return false;
-      }
-      // Simple Data
-      getPermissionsFileName() {
-        return "permissions.json";
-      }
-      getGroupsFileName() {
-        return "groups.json";
-      }
-      shouldCommit() {
-        return true;
-      }
-      shouldPush() {
-        return true;
-      }
-    };
-    clientStrategyCache = /* @__PURE__ */ new Map();
-  }
-});
-
 // dist/config/types.js
 var primitiveFieldTypes, fieldTypes;
 var init_types2 = __esm({
@@ -502,6 +423,16 @@ var init_config = __esm({
       allowNetworkRemoteInProd: z5.boolean().optional(),
       settingsBranch: z5.string().optional(),
       autoCreateSettingsPR: z5.boolean().optional(),
+      // Deliberately `deploymentNameSchema.optional()`, NOT `deploymentNameSchema` alone.
+      // deploymentNameSchema.default('prod') would make `parse(undefined)` resolve to
+      // the literal 'prod' instead of staying `undefined` — collapsing the
+      // env > config > modeDefault precedence chain that resolveDeploymentName
+      // (operating-mode/deployment-name.ts) implements: config would then always
+      // "win" over modeDefault (masking dev's real default of 'local'), and the env
+      // var would just be racing config's baked-in 'prod' instead of a true absence.
+      // `.optional()` here is what keeps an omitted deploymentName reaching
+      // resolveDeploymentName as `undefined`, so it can fall through to modeDefault.
+      // Do not "fix" this by removing `.optional()`.
       deploymentName: deploymentNameSchema.optional(),
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
@@ -515,6 +446,154 @@ var init_config = __esm({
   }
 });
 
+// dist/config/validation.js
+var forEachReferenceField;
+var init_validation = __esm({
+  "dist/config/validation.js"() {
+    "use strict";
+    init_config();
+    init_flatten();
+    forEachReferenceField = (fields, visit) => {
+      if (!Array.isArray(fields))
+        return;
+      for (const field of fields) {
+        const f = field;
+        if (f?.type === "reference") {
+          visit(f);
+        }
+        if (f?.type === "group" || f?.type === "object") {
+          forEachReferenceField(f.fields, visit);
+        }
+        if (f?.type === "block" && Array.isArray(f.templates)) {
+          for (const template of f.templates) {
+            forEachReferenceField(template.fields, visit);
+          }
+        }
+      }
+    };
+  }
+});
+
+// dist/operating-mode/client-safe-strategy.js
+function clientOperatingStrategy(mode) {
+  const cached = clientStrategyCache.get(mode);
+  if (cached)
+    return cached;
+  let strategy;
+  switch (mode) {
+    case "prod":
+      strategy = new ProdClientSafeStrategy();
+      break;
+    case "dev":
+      strategy = new DevClientSafeStrategy();
+      break;
+    default: {
+      const _exhaustive = mode;
+      throw new Error(`Unknown operating mode: ${_exhaustive}`);
+    }
+  }
+  clientStrategyCache.set(mode, strategy);
+  return strategy;
+}
+function clearClientStrategyCache() {
+  clientStrategyCache.clear();
+}
+var ProdClientSafeStrategy, DevClientSafeStrategy, clientStrategyCache;
+var init_client_safe_strategy = __esm({
+  "dist/operating-mode/client-safe-strategy.js"() {
+    "use strict";
+    ProdClientSafeStrategy = class {
+      constructor() {
+        this.mode = "prod";
+      }
+      // UI Feature Flags
+      supportsBranching() {
+        return true;
+      }
+      supportsStatusBadge() {
+        return true;
+      }
+      supportsComments() {
+        return true;
+      }
+      supportsPullRequests() {
+        return true;
+      }
+      // Simple Data
+      getPermissionsFileName() {
+        return "permissions.json";
+      }
+      getGroupsFileName() {
+        return "groups.json";
+      }
+      shouldCommit() {
+        return true;
+      }
+      shouldPush() {
+        return true;
+      }
+    };
+    DevClientSafeStrategy = class {
+      constructor() {
+        this.mode = "dev";
+      }
+      // UI Feature Flags
+      supportsBranching() {
+        return true;
+      }
+      supportsStatusBadge() {
+        return true;
+      }
+      supportsComments() {
+        return true;
+      }
+      supportsPullRequests() {
+        return false;
+      }
+      // Simple Data
+      getPermissionsFileName() {
+        return "permissions.json";
+      }
+      getGroupsFileName() {
+        return "groups.json";
+      }
+      shouldCommit() {
+        return true;
+      }
+      shouldPush() {
+        return true;
+      }
+    };
+    clientStrategyCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// dist/operating-mode/deployment-name.js
+function resolveDeploymentName(config, modeDefault) {
+  const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
+  const configValue = config.deploymentName;
+  if (envValue && configValue && envValue !== configValue && !warned) {
+    canopyLogWarn(`CanopyCMS: CANOPYCMS_DEPLOYMENT_NAME ("${envValue}") differs from config.deploymentName ("${configValue}") \u2014 using the env var (infra-stamped env wins over shared-repo config by design; see resolveDeploymentName's doc comment). Update config.deploymentName to match if this mismatch was unintentional.`);
+    warned = true;
+  }
+  const resolved = envValue || configValue || modeDefault;
+  if (!isValidDeploymentName(resolved)) {
+    const source = envValue ? "CANOPYCMS_DEPLOYMENT_NAME" : configValue ? "config.deploymentName" : "the mode default";
+    throw new Error(`CanopyCMS: invalid deploymentName ${JSON.stringify(resolved)} (from ${source}). It is interpolated into the settings branch name (canopycms-settings-<deploymentName>), so it must start with a letter or digit, contain only letters, digits, '.', '_' or '-', and must not contain '..' or end with '.' or '.lock'.`);
+  }
+  return resolved;
+}
+var warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName;
+var init_deployment_name = __esm({
+  "dist/operating-mode/deployment-name.js"() {
+    "use strict";
+    init_logger();
+    warned = false;
+    VALID_DEPLOYMENT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+    isValidDeploymentName = (name) => VALID_DEPLOYMENT_NAME.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
+  }
+});
+
 // dist/config/schemas/permissions.js
 import { z as z6 } from "zod";
 var permissionTargetSchema, pathPermissionSchema;
@@ -534,15 +613,6 @@ var init_permissions = __esm({
   }
 });
 
-// dist/config/validation.js
-var init_validation = __esm({
-  "dist/config/validation.js"() {
-    "use strict";
-    init_config();
-    init_flatten();
-  }
-});
-
 // dist/config/helpers.js
 var init_helpers = __esm({
   "dist/config/helpers.js"() {
@@ -597,6 +667,7 @@ var init_client_unsafe_strategy = __esm({
   "dist/operating-mode/client-unsafe-strategy.js"() {
     "use strict";
     init_client_safe_strategy();
+    init_deployment_name();
     init_config2();
     ProdStrategy = class extends ProdClientSafeStrategy {
       // All client-safe methods inherited automatically from ProdClientSafeStrategy:
@@ -607,8 +678,8 @@ var init_client_unsafe_strategy = __esm({
       getWorkspaceRoot(_sourceRoot) {
         return path6.resolve(process.env.CANOPYCMS_WORKSPACE_ROOT ?? DEFAULT_PROD_WORKSPACE);
       }
-      getContentRoot(sourceRoot) {
-        return path6.resolve(sourceRoot ?? process.cwd(), "content");
+      getContentRoot(contentRoot, sourceRoot) {
+        return path6.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
         return path6.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -639,8 +710,7 @@ var init_client_unsafe_strategy = __esm({
       getSettingsBranchName(config) {
         if (config.settingsBranch)
           return config.settingsBranch;
-        const deploymentName = config.deploymentName ?? "prod";
-        return `canopycms-settings-${deploymentName}`;
+        return `canopycms-settings-${resolveDeploymentName(config, "prod")}`;
       }
       getSettingsRoot(sourceRoot) {
         return path6.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -662,8 +732,8 @@ var init_client_unsafe_strategy = __esm({
       getWorkspaceRoot(sourceRoot) {
         return path6.resolve(sourceRoot ?? process.cwd(), ".canopy-dev");
       }
-      getContentRoot(sourceRoot) {
-        return path6.resolve(sourceRoot ?? process.cwd(), "content");
+      getContentRoot(contentRoot, sourceRoot) {
+        return path6.resolve(sourceRoot ?? process.cwd(), contentRoot);
       }
       getContentBranchesRoot(sourceRoot) {
         return path6.join(this.getWorkspaceRoot(sourceRoot), "content-branches");
@@ -693,8 +763,7 @@ var init_client_unsafe_strategy = __esm({
       getSettingsBranchName(config) {
         if (config.settingsBranch)
           return config.settingsBranch;
-        const deploymentName = config.deploymentName ?? "local";
-        return `canopycms-settings-${deploymentName}`;
+        return `canopycms-settings-${resolveDeploymentName(config, "local")}`;
       }
       getSettingsRoot(sourceRoot) {
         return path6.join(this.getWorkspaceRoot(sourceRoot), "settings");
@@ -718,13 +787,15 @@ __export(operating_mode_exports, {
   clearClientStrategyCache: () => clearClientStrategyCache,
   clearStrategyCache: () => clearStrategyCache,
   clientOperatingStrategy: () => clientOperatingStrategy,
-  operatingStrategy: () => operatingStrategy
+  operatingStrategy: () => operatingStrategy,
+  resolveDeploymentName: () => resolveDeploymentName
 });
 var init_operating_mode = __esm({
   "dist/operating-mode/index.js"() {
     "use strict";
     init_client_safe_strategy();
     init_client_unsafe_strategy();
+    init_deployment_name();
   }
 });
 
@@ -1232,10 +1303,21 @@ var DebugLogger = class {
     const minLevel = this.options.minLevel ?? "DEBUG";
     return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
   }
+  /**
+   * The ISO-8601 timestamp leads the line BARE - not wrapped in brackets as it
+   * once was. `CANOPYCMS_DEBUG=true` can be set on the EC2 worker, whose stdout
+   * appends to /var/log/canopy-worker/worker.log; the CloudWatch agent's
+   * `multi_line_start_pattern` matches the timestamp at the START of a line
+   * (see worker/log.ts's INVARIANT and cms-service.ts's agent config), so a
+   * leading `[` meant every debug line was silently folded into the previous
+   * event instead of starting its own. The bracketed `[prefix:category]` and
+   * `[level]` fields still follow, so the human-readable shape is unchanged
+   * apart from those two characters.
+   */
   formatMessage(level, category, message) {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
     const prefix = this.options.prefix ?? "CanopyCMS";
-    return `[${timestamp}] [${prefix}:${category}] [${level}] ${message}`;
+    return `${timestamp} [${prefix}:${category}] [${level}] ${message}`;
   }
   debug(category, message, data) {
     if (this.shouldLog("DEBUG")) {
@@ -1350,6 +1432,7 @@ import { promises as fs4 } from "fs";
 import { join } from "pathe";
 import { z } from "zod";
 import chokidar from "chokidar";
+init_logger();
 var entryTypeMetaSchema = z.object({
   name: z.string().min(1),
   format: z.enum(["md", "mdx", "json", "yaml"]),
@@ -1407,7 +1490,7 @@ async function scanForCollectionMeta(baseDir, relativePath = "") {
         collections.push(...nestedCollections);
       } catch (err) {
         if (err.code !== "ENOENT") {
-          console.error(`Error loading ${metaPath}:`, err);
+          canopyLogError(`Error loading ${metaPath}:`, err);
           throw new Error(`Invalid .collection.json in ${folderPath}: ${err.message}`);
         }
         const nestedCollections = await scanForCollectionMeta(absolutePath, folderPath);
@@ -1527,6 +1610,74 @@ function isValidSchema(schema) {
 // dist/branch-schema-cache.js
 init_flatten();
 
+// dist/validation/entry-type-reference-validator.js
+init_validation();
+var editDistance = (a, b) => {
+  let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    const curr = [i];
+    for (let j = 1; j <= b.length; j++) {
+      curr[j] = Math.min(prev[j] + 1, curr[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+    }
+    prev = curr;
+  }
+  return prev[b.length];
+};
+var closestName = (name, known) => {
+  let best;
+  let bestDistance = Infinity;
+  for (const candidate of known) {
+    const distance = editDistance(name.toLowerCase(), candidate.toLowerCase());
+    if (distance < bestDistance) {
+      bestDistance = distance;
+      best = candidate;
+    }
+  }
+  const threshold = Math.max(2, Math.floor(name.length / 3));
+  return best !== void 0 && bestDistance <= threshold ? best : void 0;
+};
+var forEachEntryType = (schema, visit) => {
+  const walk = (node, nodePath) => {
+    for (const entryType of node.entries ?? []) {
+      visit(entryType, nodePath);
+    }
+    for (const child of node.collections ?? []) {
+      walk(child, child.path ?? (nodePath ? `${nodePath}/${child.name}` : child.name));
+    }
+  };
+  walk(schema, "");
+};
+var collectEntryTypeNames = (schema) => {
+  const names = /* @__PURE__ */ new Set();
+  forEachEntryType(schema, (entryType) => {
+    if (typeof entryType.name === "string" && entryType.name.length > 0) {
+      names.add(entryType.name);
+    }
+  });
+  return names;
+};
+var validateReferenceEntryTypes = (schema) => {
+  const known = collectEntryTypeNames(schema);
+  const knownList = [...known].sort();
+  const issues = [];
+  forEachEntryType(schema, (entryType, collectionPath) => {
+    const location = collectionPath ? `${collectionPath}/${entryType.name}` : entryType.name;
+    forEachReferenceField(entryType.schema, (field) => {
+      const entryTypes = field.entryTypes;
+      if (!Array.isArray(entryTypes))
+        return;
+      const fieldName = typeof field.name === "string" ? field.name : "unknown";
+      for (const value of entryTypes) {
+        if (typeof value !== "string" || known.has(value))
+          continue;
+        const suggestion = closestName(value, knownList);
+        issues.push(`Reference field "${fieldName}" in "${location}" specifies entryType "${value}", which is not defined in any collection.` + (suggestion ? ` Did you mean "${suggestion}"?` : "") + (knownList.length > 0 ? ` Known entry types: ${knownList.join(", ")}.` : " No entry types are defined in this schema."));
+      }
+    });
+  });
+  return issues;
+};
+
 // dist/build-mode.js
 var isDeployedStatic = (config) => {
   return config.deployedAs === "static";
@@ -1662,6 +1813,11 @@ var BranchSchemaCache = class {
     if (!isValidSchema(result.schema)) {
       throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
     }
+    const entryTypeIssues = validateReferenceEntryTypes(result.schema);
+    if (entryTypeIssues.length > 0) {
+      throw new Error(`Invalid reference field entryTypes in ${contentRoot}:
+` + entryTypeIssues.map((issue) => `  - ${issue}`).join("\n"));
+    }
     const flatSchema = flattenSchema(result.schema, contentRootName);
     if (!skipDiskCache) {
       const cacheDir = path5.join(branchRoot, ".canopy-meta");
@@ -1888,6 +2044,7 @@ var ContentStore = class {
     this.lastForcedRefreshMs = 0;
     this.indexBuild = null;
     this.root = path8.resolve(root);
+    this.contentRootName = options.contentRootName || "content";
     this.indexFreshnessIntervalMs = options.indexFreshnessIntervalMs ?? DEFAULT_INDEX_FRESHNESS_INTERVAL_MS;
     this.schemaIndex = new Map(flatSchema.map((item) => [item.logicalPath, item]));
     this._idIndex = new ContentIdIndex(this.root);
@@ -1929,7 +2086,7 @@ var ContentStore = class {
       const build = (async () => {
         const diskToken = await readContentIndexGeneration(this.root);
         const fresh = new ContentIdIndex(this.root);
-        await fresh.buildFromFilenames("content");
+        await fresh.buildFromFilenames(this.contentRootName);
         return { diskToken, fresh };
       })();
       this.indexBuild = build;
@@ -3718,6 +3875,7 @@ import path12 from "node:path";
 // dist/branch-registry.js
 import fs10 from "node:fs/promises";
 import path10 from "node:path";
+init_logger();
 var log3 = createDebugLogger({ prefix: "BranchRegistry" });
 var REGISTRY_FILE = "branches.json";
 var REGISTRY_STALE_FILE = "branches.stale.json";
@@ -3870,7 +4028,7 @@ var BranchRegistry = class {
         try {
           meta = await BranchMetadataFileManager.loadOnly(branchRoot);
         } catch (err) {
-          console.warn(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage(err)}`);
+          canopyLogWarn(`CanopyCMS: Skipping branch directory '${entry.name}' during registry scan: ${getErrorMessage(err)}`);
           continue;
         }
         if (meta) {
@@ -4280,15 +4438,17 @@ async function acquireProvisioningLock(lockTargetDir, lockName) {
 // dist/git-manager.js
 var log5 = createDebugLogger({ prefix: "GitManager" });
 var GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
+var FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
 function gitChildEnv(overrides) {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (value !== void 0 && GIT_ENV_PASSTHROUGH.test(key))
       env[key] = value;
   }
-  return { ...env, ...overrides };
+  return { ...env, ...FORCE_C_LOCALE, ...overrides };
 }
 var remoteInitLocks = /* @__PURE__ */ new Map();
+var GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
 async function ensureGitExcludePattern(repoPath, pattern) {
   const excludePath = path14.join(repoPath, ".git", "info", "exclude");
   await fs14.mkdir(path14.dirname(excludePath), { recursive: true });
@@ -4443,26 +4603,115 @@ var GitManager = class _GitManager {
     await lockPromise;
   }
   /**
-   * Whether a bare repository already has a local branch of the given name.
+   * Whether a bare repository already has a branch of the given name, in
+   * EITHER the local-heads namespace (`refs/heads/<branch>`) or the GitHub
+   * tracking namespace (`GITHUB_TRACKING_REF_PREFIX<branch>`).
+   *
+   * Originally checked `refs/heads/*` only, for dev-mode's
+   * `ensureLocalSimulatedRemote` (a simulated remote never gets a tracking
+   * namespace, so that caller only ever needed the local-heads check).
+   * Generalized/promoted to public for api/branch.ts's create-time collision
+   * guard, which also needs the tracking namespace: `syncGit()` fetches
+   * GitHub into `GITHUB_TRACKING_REF_PREFIX*` rather than `refs/heads/*`
+   * directly (see that constant's doc comment above), and
+   * `reconcileTrackedBranches()` (worker/cms-worker.ts) only
+   * non-destructively brings `refs/heads/*` toward what's tracked there — so
+   * a branch that another CanopyCMS deployment sharing this repo (or a
+   * direct push to GitHub) just created can sit in the tracking namespace
+   * for a while before, or without ever, gaining a local head here. Checking
+   * `refs/heads/*` alone would miss exactly the two-deployments-one-repo
+   * collision that guard exists to catch.
    *
    * Runs git with an explicit `--git-dir` instead of a cwd inside the repo:
    * environments with `safe.bareRepository=explicit` (sandboxed/CI git setups)
    * refuse cwd-based discovery of bare repos but expressly allow `--git-dir`.
-   * `branch --list` exits 0 whether or not the branch exists (no
-   * exception-based control flow — also why `rev-parse --verify --quiet`
-   * can't be used: simple-git only fails a task on stderr output, and --quiet
-   * suppresses exactly that). A failure here therefore means the remote
-   * itself is unreadable and is surfaced, NOT treated as "branch absent" —
-   * that would route to the push path against a repo we couldn't even read.
+   * A single `for-each-ref` call checks both candidate refs at once (no
+   * exception-based control flow — `for-each-ref` exits 0 whether or not
+   * either ref exists, same reason the old implementation used `branch
+   * --list` instead of `rev-parse --verify --quiet`: simple-git only fails a
+   * task on stderr output, and `--quiet` suppresses exactly that).
+   * `--end-of-options` guards the ref-name positionals the same way
+   * `push`/`forcePush` below do, since `branch` here can be a sanitized but
+   * otherwise caller-influenced string.
+   *
+   * A failure here therefore means the remote itself is unreadable and is
+   * surfaced, NOT treated as "branch absent" — that would route
+   * `ensureLocalSimulatedRemote` to the push path against a repo it couldn't
+   * even read, and would silently skip api/branch.ts's collision check
+   * instead of letting that caller distinguish "unreadable" from "absent"
+   * and decide what to do.
    */
-  static async bareRemoteHasBranch(remotePath, branch) {
+  static async bareRemoteHasBranch(remotePath, branch, options = {}) {
     let output;
     try {
-      output = await simpleGit2().raw(["--git-dir", remotePath, "branch", "--list", branch]);
+      output = await simpleGit2().raw([
+        "--git-dir",
+        remotePath,
+        "for-each-ref",
+        "--format=%(refname)",
+        "--end-of-options",
+        `refs/heads/${branch}`,
+        `${GITHUB_TRACKING_REF_PREFIX}${branch}`
+      ]);
     } catch (err) {
-      throw new Error(`Cannot inspect simulated remote at ${remotePath}: ${getErrorMessage(err)}`);
+      throw new Error(`Cannot inspect remote mirror at ${remotePath}: ${getErrorMessage(err)}`);
+    }
+    const refs = output.split("\n").map((line) => line.trim()).filter(Boolean);
+    if (options.namespaces === "tracking") {
+      return refs.includes(`${GITHUB_TRACKING_REF_PREFIX}${branch}`);
     }
-    return output.split("\n").map((line) => line.replace(/^[*+]\s*/, "").trim()).includes(branch);
+    return refs.includes(`refs/heads/${branch}`) || refs.includes(`${GITHUB_TRACKING_REF_PREFIX}${branch}`);
+  }
+  /**
+   * Delete `refs/heads/<branch>` from a bare local mirror, if present. A
+   * no-op (not an error) when the ref doesn't exist.
+   *
+   * This is the "explicit path" for removing a deleted branch's local head
+   * that the sync loop deliberately is not (see GITHUB_TRACKING_REF_PREFIX's
+   * doc comment: reconcileTrackedBranches never deletes a head). Called by
+   * api/branch.ts's deleteBranchHandler: without it, a deleted branch's head
+   * lives in `remote.git` forever, and the ordinary create -> publish ->
+   * squash-merge -> delete -> reuse-the-name cycle then has the REUSED
+   * branch's first publish rejected non-fast-forward against the stale head
+   * (`GitManager.push()` pushes `branch:branch`, and a squash-merged old tip
+   * is not an ancestor of the new branch) -- a permanent, misleading 409.
+   * Worse, a retried submit skips the local push (clean tree) and enqueues
+   * the worker push of the STALE head, resurrecting the deleted branch's
+   * content on GitHub as an apparent success.
+   *
+   * Deliberately leaves the tracking ref (`GITHUB_TRACKING_REF_PREFIX<branch>`)
+   * alone: that namespace mirrors GitHub's view, and if the branch still
+   * exists on GitHub, the create-time collision check SHOULD keep reporting
+   * it until the remote side is actually gone.
+   *
+   * Same `--git-dir` invocation style as bareRemoteHasBranch above (works
+   * under `safe.bareRepository=explicit`). The existence pre-check makes
+   * "absent" deterministic instead of parsing update-ref's locale-dependent
+   * failure text, and its captured SHA is passed to `update-ref -d` as the
+   * expected old value -- same pattern as reconcileTrackedBranches'
+   * guarded updates (worker/cms-worker.ts): a concurrent Lambda push
+   * re-creating/moving this branch between the read and the delete makes
+   * update-ref throw (surfaced as the caller's best-effort warning) instead
+   * of silently deleting a commit that was just pushed. No
+   * `--end-of-options` on update-ref (older gits don't accept it there);
+   * the ref argument always begins with the literal `refs/heads/` prefix,
+   * so it can never parse as an option.
+   */
+  static async deleteBareRemoteHead(remotePath, branch) {
+    const ref = `refs/heads/${branch}`;
+    const output = await simpleGit2().raw([
+      "--git-dir",
+      remotePath,
+      "for-each-ref",
+      "--format=%(refname) %(objectname)",
+      "--end-of-options",
+      ref
+    ]);
+    const match = output.split("\n").map((line) => line.trim()).filter(Boolean).map((line) => line.split(" ")).find(([refname]) => refname === ref);
+    if (!match)
+      return;
+    const [, sha] = match;
+    await simpleGit2().raw(["--git-dir", remotePath, "update-ref", "-d", ref, sha]);
   }
   /**
    * Push baseBranch from the source repo into the local bare remote via a
@@ -4635,6 +4884,30 @@ var GitManager = class _GitManager {
     }
     return void 0;
   }
+  /**
+   * Check whether a git repository is already initialized at `workspacePath`.
+   *
+   * Uses `rev-parse --git-dir` with `GIT_CEILING_DIRECTORIES` pinned to the
+   * parent directory so a corrupt/missing `.git` can't make git silently
+   * traverse upward and report a false positive from an ancestor repo (the
+   * same protection `initializeWorkspace` relies on below).
+   *
+   * Shared by `initializeWorkspace` (clone-vs-reuse decision) and
+   * `SettingsWorkspaceManager`'s rename guard (settings-workspace.ts), which
+   * must know whether a settings workspace ALREADY exists before touching it —
+   * touching an existing orphan settings branch under a different name wipes
+   * permissions.json/groups.json (see that guard's doc comment).
+   */
+  static async repoExistsAt(workspacePath) {
+    try {
+      const checkGit = simpleGit2({ baseDir: workspacePath });
+      checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path14.dirname(workspacePath) }));
+      await checkGit.raw(["rev-parse", "--git-dir"]);
+      return true;
+    } catch {
+      return false;
+    }
+  }
   /**
    * Ensures a git workspace is initialized and ready for use.
    * Handles cloning, remote configuration, and branch checkout/creation.
@@ -4653,13 +4926,8 @@ var GitManager = class _GitManager {
       detectFrom: options.sourceRoot ? path14.resolve(process.cwd(), options.sourceRoot) : process.cwd()
     });
     const remoteName = options.remoteName ?? "origin";
-    let repoExists = false;
-    try {
-      const checkGit = simpleGit2({ baseDir: options.workspacePath });
-      checkGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path14.dirname(options.workspacePath) }));
-      await checkGit.raw(["rev-parse", "--git-dir"]);
-      repoExists = true;
-    } catch {
+    const repoExists = await _GitManager.repoExistsAt(options.workspacePath);
+    if (!repoExists) {
       const gitPath = path14.join(options.workspacePath, ".git");
       try {
         const stat = await fs14.stat(gitPath);
@@ -5611,7 +5879,7 @@ async function generateAIContentFiles(options) {
   }
   const entriesForValidation = await listEntries(branchRoot, flatSchema, contentRootName);
   assertBuildEntriesValid(entriesForValidation, "AI content generation");
-  const store = new ContentStore(branchRoot, flatSchema);
+  const store = new ContentStore(branchRoot, flatSchema, { contentRootName });
   const result = await generateAIContent({
     store,
     flatSchema,