canopycms 0.0.67 → 0.0.68-int.101

package/dist/cli/generate-ai-content.js

@@ -9,6 +9,9 @@ var __export = (target, all) => {
 };
 
 // dist/utils/logger.js
+function canopyLog(...args) {
+  active.log(...args);
+}
 function canopyLogWarn(...args) {
   active.warn(...args);
 }
@@ -36,7 +39,7 @@ function isImplicitlyOffOrigin(url) {
     return false;
   }
 }
-function isHttpUrlOrSameOriginPath(value, opts = {}) {
+function isHttpUrlOrSameOriginPath(value) {
   if (value === "")
     return false;
   for (let index = 0; index < value.length; index++) {
@@ -60,9 +63,8 @@ function isHttpUrlOrSameOriginPath(value, opts = {}) {
       return false;
     }
   }
-  if (isImplicitlyOffOrigin(value)) {
-    return opts.allowProtocolRelative === true && value.startsWith("//") && value[2] !== "/";
-  }
+  if (isImplicitlyOffOrigin(value))
+    return false;
   return value.startsWith("/") && value[1] !== "/";
 }
 var SENTINEL_BASE, DOT_SEGMENT;
@@ -75,11 +77,11 @@ var init_sanitize_href = __esm({
 });
 
 // dist/paths/normalize.js
-function normalizeFilesystemPath(path22) {
-  return path22.split(/[\\/]+/).filter(Boolean).join("/");
+function normalizeFilesystemPath(path24) {
+  return path24.split(/[\\/]+/).filter(Boolean).join("/");
 }
-function hasTraversalSequence(path22) {
-  const normalized = normalizeFilesystemPath(path22);
+function hasTraversalSequence(path24) {
+  const normalized = normalizeFilesystemPath(path24);
   return normalized.includes("..");
 }
 function createLogicalPath(...segments) {
@@ -89,14 +91,17 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
-function trimSlashes(path22) {
+function entryLogicalPath(collectionLogicalPath, slug) {
+  return collectionLogicalPath ? `${collectionLogicalPath}/${slug}` : slug;
+}
+function trimSlashes(path24) {
   let start = 0;
-  let end = path22.length;
-  while (start < end && path22[start] === "/")
+  let end = path24.length;
+  while (start < end && path24[start] === "/")
     start++;
-  while (end > start && path22[end - 1] === "/")
+  while (end > start && path24[end - 1] === "/")
     end--;
-  return path22.slice(start, end);
+  return path24.slice(start, end);
 }
 var init_normalize = __esm({
   "dist/paths/normalize.js"() {
@@ -310,7 +315,8 @@ var init_field = __esm({
     });
     objectFieldSchema = fieldBaseSchema.extend({
       type: z2.literal("object"),
-      fields: z2.array(z2.lazy(() => fieldHolder[0])).min(1)
+      fields: z2.array(z2.lazy(() => fieldHolder[0])).min(1),
+      itemTitleField: z2.string().min(1).optional()
     });
     inlineGroupFieldSchema = z2.object({
       type: z2.literal("group"),
@@ -375,7 +381,7 @@ var init_collection = __esm({
 
 // dist/config/schemas/url.js
 import { z as z4 } from "zod";
-var uploadTargetUrlSchema, assetMountUrlSchema;
+var uploadTargetUrlSchema, previewPrefixSchema;
 var init_url = __esm({
   "dist/config/schemas/url.js"() {
     "use strict";
@@ -383,8 +389,8 @@ var init_url = __esm({
     uploadTargetUrlSchema = z4.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
       message: 'must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
     });
-    assetMountUrlSchema = z4.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value, { allowProtocolRelative: true }), {
-      message: 'must be an absolute http(s) URL, a protocol-relative "//host" URL, or a site-relative path beginning with a single "/", with no query or fragment'
+    previewPrefixSchema = z4.string().trim().refine((value) => isHttpUrlOrSameOriginPath(value), {
+      message: 'editor.previewPrefix must be an absolute http(s) URL or a site-relative path beginning with a single "/", with no query or fragment'
     });
   }
 });
@@ -400,7 +406,6 @@ var init_media = __esm({
     mediaSchema = z5.discriminatedUnion("adapter", [
       z5.object({
         adapter: z5.literal("local"),
-        publicBaseUrl: assetMountUrlSchema.optional(),
         /** Root directory for local asset storage. Defaults to the caller's dev-assets dir. */
         directory: relativePathSchema.optional()
       }).strict(),
@@ -408,7 +413,6 @@ var init_media = __esm({
         adapter: z5.literal("s3"),
         bucket: z5.string().min(1),
         region: z5.string().min(1),
-        publicBaseUrl: assetMountUrlSchema.optional(),
         /**
          * Where the browser POSTs a presigned direct upload. Absolute http(s) URL or a
          * site-relative path; defaults to the S3 REST endpoint the AWS SDK returns.
@@ -418,18 +422,17 @@ var init_media = __esm({
          * signature is unaffected — a presigned POST's string-to-sign is the base64 policy
          * alone, so the host never enters it (pinned by store-s3.test.ts).
          *
-         * NOT a prefix. Unlike `publicBaseUrl`, nothing is joined onto this value; it replaces
-         * the POST target outright and is passed through byte-for-byte. Do not route it through
-         * `joinUrlPrefix` "for consistency" — that would strip the trailing slash and silently
-         * stop a CDN path pattern like `/asset-upload/*` from matching.
+         * NOT a prefix: nothing is joined onto this value; it replaces the POST target outright
+         * and is passed through byte-for-byte. Do not route it through `joinUrlPrefix` "for
+         * consistency" — that would strip the trailing slash and silently stop a CDN path
+         * pattern like `/asset-upload/*` from matching.
          */
         uploadUrl: uploadTargetUrlSchema.optional(),
         /** Max upload size in bytes for presigned direct uploads. Defaults to 50 MiB. */
         maxUploadBytes: z5.number().int().positive().optional()
       }).strict(),
       z5.object({
-        adapter: z5.literal("lfs"),
-        publicBaseUrl: assetMountUrlSchema.optional()
+        adapter: z5.literal("lfs")
       }).strict()
     ]);
   }
@@ -443,6 +446,7 @@ var init_config = __esm({
     "use strict";
     init_collection();
     init_media();
+    init_url();
     defaultBranchAccessSchema = z6.enum(["allow", "deny"]).default("deny");
     defaultPathAccessLevelSchema = z6.enum(["allow", "deny"]);
     defaultPathAccessLevelsSchema = z6.object({
@@ -473,7 +477,8 @@ var init_config = __esm({
       title: z6.string().optional(),
       subtitle: z6.string().optional(),
       theme: z6.unknown().optional(),
-      previewBase: z6.record(z6.string()).optional(),
+      previewBase: z6.record(z6.union([z6.string(), z6.literal(false)])).optional(),
+      previewPrefix: previewPrefixSchema.optional(),
       // UI handler functions (runtime only, don't serialize)
       onAccountClick: z6.function().returns(z6.void()).optional(),
       onLogoutClick: z6.function().returns(z6.void()).optional(),
@@ -501,6 +506,9 @@ var init_config = __esm({
       defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema,
       gitBotAuthorEmail: gitBotAuthorEmailSchema,
+      // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+      gitEditedByTrailers: z6.boolean().optional(),
+      gitCoAuthoredByTrailers: z6.boolean().optional(),
       githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
       // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
       // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -512,7 +520,6 @@ var init_config = __esm({
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
       allowNetworkRemoteInProd: z6.boolean().optional(),
       settingsBranch: z6.string().optional(),
-      autoCreateSettingsPR: z6.boolean().optional(),
       // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
       // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
       // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -528,7 +535,7 @@ var init_config = __esm({
       validateEntry: z6.custom().optional(),
       dev: devConfigSchema.optional()
     }).strict();
-    DEFAULT_PROD_WORKSPACE = "/mnt/efs/workspace";
+    DEFAULT_PROD_WORKSPACE = "/mnt/efs";
   }
 });
 
@@ -574,20 +581,20 @@ var init_validation = __esm({
     init_config();
     init_flatten();
     init_mode_env();
-    forEachReferenceField = (fields, visit) => {
+    forEachReferenceField = (fields, visit2) => {
       if (!Array.isArray(fields))
         return;
       for (const field of fields) {
         const f = field;
         if (f?.type === "reference") {
-          visit(f);
+          visit2(f);
         }
         if (f?.type === "group" || f?.type === "object") {
-          forEachReferenceField(f.fields, visit);
+          forEachReferenceField(f.fields, visit2);
         }
         if (f?.type === "block" && Array.isArray(f.templates)) {
           for (const template of f.templates) {
-            forEachReferenceField(template.fields, visit);
+            forEachReferenceField(template.fields, visit2);
           }
         }
       }
@@ -835,9 +842,6 @@ var init_client_unsafe_strategy = __esm({
           throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
         }
       }
-      shouldCreateSettingsPR(config) {
-        return config.autoCreateSettingsPR ?? true;
-      }
     };
     DevStrategy = class extends DevClientSafeStrategy {
       getWorkspaceRoot(sourceRoot) {
@@ -884,9 +888,6 @@ var init_client_unsafe_strategy = __esm({
       }
       validateConfig(_config) {
       }
-      shouldCreateSettingsPR(_config) {
-        return false;
-      }
     };
     strategyCache = /* @__PURE__ */ new Map();
   }
@@ -914,12 +915,12 @@ var init_operating_mode = __esm({
 });
 
 // dist/cli/generate-ai-content.js
-import path21 from "node:path";
+import path23 from "node:path";
 import { createJiti } from "jiti";
 
 // dist/build/generate-ai-content.js
-import fs18 from "node:fs/promises";
-import path20 from "node:path";
+import fs20 from "node:fs/promises";
+import path22 from "node:path";
 
 // dist/utils/error.js
 function getErrorMessage(err) {
@@ -931,6 +932,15 @@ function getErrorMessage(err) {
   }
   return String(err);
 }
+function redactCredentials(message) {
+  let result = message;
+  result = result.replace(/(:\/\/)[^/\s@]+@/g, "$1***@");
+  result = result.replace(/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{8,}/g, "***");
+  result = result.replace(/\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/g, "$1***");
+  result = result.replace(/-----BEGIN [A-Z]{0,9} ?PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z]{0,9} ?PRIVATE KEY-----|$)/g, "<private-key>");
+  result = result.replace(/(?<![\w-])eyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]+/g, "***");
+  return result;
+}
 function isNodeError(err) {
   return err instanceof Error && "code" in err;
 }
@@ -942,7 +952,7 @@ function isFileExistsError(err) {
 }
 
 // dist/content-store.js
-import fs10 from "node:fs/promises";
+import fs9 from "node:fs/promises";
 import path11 from "node:path";
 import matter2 from "gray-matter";
 import { parse as yamlParse } from "yaml";
@@ -965,8 +975,9 @@ async function atomicWriteFile(filePath, content) {
 }
 
 // dist/utils/content-serialize.js
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
 import matter from "gray-matter";
-import { isCollection, isMap, isNode, isScalar, isSeq, parseDocument, stringify as yamlStringify } from "yaml";
+import { isCollection as isCollection2, isMap as isMap2, isNode as isNode2, isScalar as isScalar2, isSeq as isSeq2, parseDocument as parseDocument2, Scalar, stringify as yamlStringify } from "yaml";
 
 // dist/validation/block-structural-keys.js
 var BLOCK_DISCRIMINATOR_KEYS = ["template", "_type"];
@@ -975,7 +986,517 @@ function isBlockStructuralKey(key) {
   return BLOCK_STRUCTURAL_KEYS.has(key);
 }
 
+// dist/utils/debug.js
+var LOG_LEVELS = {
+  DEBUG: 0,
+  INFO: 1,
+  WARN: 2,
+  ERROR: 3
+};
+var DebugLogger = class {
+  constructor(options = {}) {
+    this.timers = /* @__PURE__ */ new Map();
+    this.options = options;
+  }
+  shouldLog(level) {
+    const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
+    if (!enabled)
+      return false;
+    const minLevel = this.options.minLevel ?? "DEBUG";
+    return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
+  }
+  /**
+   * The ISO-8601 timestamp leads the line BARE, never bracketed. `CANOPYCMS_DEBUG=true` can
+   * be set on the EC2 worker, whose stdout appends to /var/log/canopy-worker/worker.log, and
+   * the CloudWatch agent's `multi_line_start_pattern` matches a timestamp at the START of a
+   * line (see worker/log.ts's INVARIANT and cms-service.ts's agent config): any leading
+   * character folds the line into the previous event instead of starting its own.
+   */
+  formatMessage(level, category, message) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const prefix = this.options.prefix ?? "CanopyCMS";
+    return `${timestamp} [${prefix}:${category}] [${level}] ${message}`;
+  }
+  debug(category, message, data) {
+    if (this.shouldLog("DEBUG")) {
+      console.log(this.formatMessage("DEBUG", category, message), data ?? "");
+    }
+  }
+  info(category, message, data) {
+    if (this.shouldLog("INFO")) {
+      console.log(this.formatMessage("INFO", category, message), data ?? "");
+    }
+  }
+  warn(category, message, data) {
+    if (this.shouldLog("WARN")) {
+      console.warn(this.formatMessage("WARN", category, message), data ?? "");
+    }
+  }
+  error(category, message, data) {
+    const msg = this.formatMessage("ERROR", category, message);
+    if (this.shouldLog("ERROR")) {
+      console.error(msg, data ?? "");
+    }
+    const throwOnError = this.options.throwOnError ?? false;
+    if (throwOnError) {
+      const errorMsg = data ? `${message}: ${JSON.stringify(data)}` : message;
+      throw new Error(errorMsg);
+    }
+  }
+  /**
+   * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+   * anything that can run concurrently uses {@link timed}.
+   */
+  time(label) {
+    this.timers.set(label, Date.now());
+  }
+  timeEnd(category, label) {
+    const start = this.timers.get(label);
+    if (start === void 0) {
+      this.warn(category, `Timer '${label}' does not exist`);
+      return;
+    }
+    const duration = Date.now() - start;
+    this.timers.delete(label);
+    this.debug(category, `${label} completed`, { durationMs: duration });
+    return duration;
+  }
+  /**
+   * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+   * call, so concurrent spans with the same label on one logger never overwrite each other.
+   */
+  async timed(category, label, fn) {
+    const start = Date.now();
+    try {
+      return await fn();
+    } finally {
+      this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
+    }
+  }
+};
+function createDebugLogger(options) {
+  return new DebugLogger(options);
+}
+var testLogger = createDebugLogger({
+  enabled: process.env.E2E_DEBUG === "true",
+  prefix: "E2E",
+  throwOnError: false
+});
+
+// dist/utils/yaml-source-splice.js
+import { isDeepStrictEqual } from "node:util";
+import { Document, parseDocument, isAlias, isCollection, isMap, isNode, isPair, isScalar, isSeq, YAMLMap, visit, YAMLSeq } from "yaml";
+var END = Symbol("end");
+var FRESH = Symbol("fresh");
+var LINE_WIDTH = 80;
+var MIN_LINE_WIDTH = 40;
+function snapshotDocument(doc) {
+  const items = /* @__PURE__ */ new Map();
+  const visitNode = (node) => {
+    if (isMap(node)) {
+      items.set(node, node.items.map((pair) => ({ item: pair, value: pair.value })));
+      for (const pair of node.items)
+        visitNode(pair.value);
+    } else if (isSeq(node)) {
+      items.set(node, node.items.map((item) => ({ item, value: item })));
+      for (const item of node.items)
+        visitNode(item);
+    }
+  };
+  visitNode(doc.contents);
+  let anchored = false;
+  visit(doc, (_key, node) => {
+    if (isAlias(node) || isNode(node) && node.anchor !== void 0) {
+      anchored = true;
+      return visit.BREAK;
+    }
+    return void 0;
+  });
+  return { items, anchored };
+}
+var SourceSplicer = class {
+  constructor(raw, eol, doc, snapshot, replaced) {
+    this.raw = raw;
+    this.eol = eol;
+    this.doc = doc;
+    this.snapshot = snapshot;
+    this.replaced = replaced;
+    this.dirtyMemo = /* @__PURE__ */ new Map();
+  }
+  print() {
+    const root = this.doc.contents;
+    if (!isCollection(root) || !this.snapshot.items.has(root))
+      return void 0;
+    if (!this.isDirty(root))
+      return this.raw;
+    if (this.snapshot.anchored)
+      return void 0;
+    const edits = this.collectionEdits(root);
+    return edits === void 0 ? void 0 : this.applyEdits(0, this.raw.length, edits);
+  }
+  /**
+   * Did the reconciler change anything under this node? An original scalar is never mutated in
+   * place (a changed value gets a fresh node), so only collections can be dirty.
+   */
+  isDirty(node) {
+    if (!isCollection(node))
+      return false;
+    const memo = this.dirtyMemo.get(node);
+    if (memo !== void 0)
+      return memo;
+    const snap = this.snapshot.items.get(node);
+    let dirty = snap === void 0 || snap.length !== node.items.length;
+    for (let i = 0; !dirty && snap !== void 0 && i < snap.length; i++) {
+      const now = node.items[i];
+      const before = snap[i];
+      if (now !== before.item)
+        dirty = true;
+      else if (isPair(now))
+        dirty = now.value !== before.value || this.isDirty(now.value);
+      else
+        dirty = this.isDirty(now);
+    }
+    this.dirtyMemo.set(node, dirty);
+    return dirty;
+  }
+  collectionEdits(node) {
+    if (node.flow)
+      return void 0;
+    const snap = this.snapshot.items.get(node);
+    if (snap === void 0 || snap.length === 0 || node.items.length === 0)
+      return void 0;
+    const geometry = [];
+    for (const { item, value } of snap) {
+      const g = isPair(item) ? this.pairGeometry(item, value) : this.seqItemGeometry(item);
+      if (g === void 0)
+        return void 0;
+      geometry.push(g);
+    }
+    if (!this.isBlockLayout(geometry))
+      return void 0;
+    return isMap(node) ? this.mapEdits(node, snap, geometry) : this.seqEdits(node, snap, geometry);
+  }
+  mapEdits(map, snap, geometry) {
+    const col = this.column(geometry[0].content);
+    const original = new Set(snap.map((s) => s.item));
+    const kept = new Set(map.items);
+    const edits = [];
+    const retainedOrder = map.items.filter((pair) => original.has(pair));
+    const expectedOrder = snap.map((s) => s.item).filter((pair) => kept.has(pair));
+    if (retainedOrder.some((pair, i) => pair !== expectedOrder[i]))
+      return void 0;
+    const added = map.items.slice(retainedOrder.length);
+    if (added.some((pair) => original.has(pair)))
+      return void 0;
+    const layout = [...geometry];
+    for (let i = 0; i < snap.length; i++) {
+      const { item, value: before } = snap[i];
+      const g = layout[i];
+      if (!isPair(item))
+        return void 0;
+      if (!kept.has(item)) {
+        if (g.inline) {
+          const next = this.promoteToInline(snap, layout, kept);
+          if (next === void 0)
+            return void 0;
+          edits.push({ start: g.content, end: layout[next].content, text: "" });
+          i = next - 1;
+        } else {
+          const start = i === 0 ? this.ownLeadingLines(map, item, g.lineStart) : this.chunkStart(layout, i);
+          edits.push({ start, end: g.end, text: "" });
+        }
+        continue;
+      }
+      const now = item.value;
+      const clean = now === before && !this.isDirty(now);
+      const inner = clean ? [] : now === before && isCollection(now) ? this.collectionEdits(now) : void 0;
+      if (inner !== void 0) {
+        const next = map.items[map.items.indexOf(item) + 1] ?? END;
+        if ((i + 1 < snap.length ? snap[i + 1].item : END) !== next) {
+          edits.push(...uncovered(this.outdentedCommentEdits(g, col), inner));
+        }
+        edits.push(...inner);
+        continue;
+      }
+      const text = withoutLeadingComment(item.key, () => this.render(mapOf([item]), col, g.inline));
+      edits.push({ start: g.lineStart, end: g.end, text: this.matchFinalNewline(g.end, text) });
+    }
+    if (added.length > 0) {
+      const at = layout[layout.length - 1].end;
+      const text = this.render(mapOf(added), col, false);
+      edits.push({ start: at, end: at, text: this.raw[at - 1] === "\n" ? text : this.eol + text });
+    }
+    return edits;
+  }
+  seqEdits(seq, snap, geometry) {
+    if (geometry[0].inline)
+      return void 0;
+    const col = this.column(geometry[0].content);
+    const oldIndex = new Map(snap.map((s, i) => [s.item, i]));
+    const parts = [];
+    const sourceOf = (item) => oldIndex.has(item) ? item : isNode(item) ? this.replaced.get(item) : void 0;
+    for (const [k, item] of seq.items.entries()) {
+      const j = oldIndex.get(item);
+      let part;
+      if (j !== void 0) {
+        const start2 = this.chunkStart(geometry, j);
+        const inner = isCollection(item) && this.isDirty(item) ? this.collectionEdits(item) : [];
+        const next = k + 1 < seq.items.length ? sourceOf(seq.items[k + 1]) : END;
+        const moved = (j + 1 < snap.length ? snap[j + 1].item : END) !== (next ?? FRESH);
+        part = inner !== void 0 ? this.applyEdits(start2, geometry[j].end, [
+          ...inner,
+          ...moved ? uncovered(this.outdentedCommentEdits(geometry[j], col), inner) : []
+        ]) : this.raw.slice(start2, geometry[j].lineStart) + withoutLeadingComment(item, () => this.render(seqOf(item), col, false));
+      } else {
+        const old = isNode(item) ? this.replaced.get(item) : void 0;
+        const k2 = old === void 0 ? void 0 : oldIndex.get(old);
+        part = k2 !== void 0 && sameLeadingComment(old, item) ? this.raw.slice(this.chunkStart(geometry, k2), geometry[k2].lineStart) + withoutLeadingComment(item, () => this.render(seqOf(item), col, false)) : this.render(seqOf(item), col, false);
+      }
+      parts.push(part.endsWith("\n") ? part : part + this.eol);
+    }
+    const start = geometry[0].lineStart;
+    const end = geometry[geometry.length - 1].end;
+    return [{ start, end, text: this.matchFinalNewline(end, parts.join("")) }];
+  }
+  /** Rendered text always ends in a line break; drop it where the source it replaces had none. */
+  matchFinalNewline(end, text) {
+    return this.raw[end - 1] !== "\n" && text.endsWith(this.eol) ? text.slice(0, -this.eol.length) : text;
+  }
+  /**
+   * The first pair shares the parent's `- ` line and was dropped: move the first retained pair up
+   * onto that line, so the pairs before it go and the rest of the map stays as written. Returns
+   * that pair's index, or undefined when no pair is retained or comment lines above it would have
+   * to go with the lines being removed.
+   */
+  promoteToInline(snap, layout, kept) {
+    const next = snap.findIndex((s) => kept.has(s.item));
+    if (next <= 0)
+      return void 0;
+    if (this.raw.slice(this.chunkStart(layout, next), layout[next].lineStart).includes("#")) {
+      return void 0;
+    }
+    const g = layout[next];
+    layout[next] = { ...g, inline: true, lineStart: g.content };
+    return next;
+  }
+  /**
+   * Where a dropped FIRST pair's lines begin. The comment lines above a nested collection's first
+   * item are the collection's and stay, but above the root map's first key `yaml` gives them to
+   * the key, so the reconciler drops them with it and so must the splice.
+   */
+  ownLeadingLines(map, pair, start) {
+    const key = pair.key;
+    if (map !== this.doc.contents || !key.commentBefore || this.doc.commentBefore)
+      return start;
+    let at = start;
+    while (at > 0) {
+      const previous = this.lineStart(at - 1);
+      if (previous >= at)
+        break;
+      if (!/^[ \t]*(#.*)?\r?\n?$/.test(this.raw.slice(previous, at)))
+        break;
+      at = previous;
+    }
+    return at;
+  }
+  /**
+   * The run of comment lines that ends an item's region reads to a person as being about what
+   * comes next, but it is the item's: `yaml`'s parser (`pop()`) keeps a trailing run with the
+   * nested collection it ends when that collection is not at column 0 and any line of the run is
+   * at or right of its indent. While the neighbour below is unchanged that is harmless; once it
+   * changes, indent the run's shallower lines to its deepest comment, so they read as the item's
+   * and do not head content they were never about. Where that lands a line in a deeper scalar's comment or content
+   * instead, {@link printsAs} refuses the splice. A run at or left of the item's own column is a
+   * zero-indented list's tail, and is left alone.
+   */
+  outdentedCommentEdits(g, col) {
+    let run = [];
+    let at = this.raw.indexOf("\n", g.content) + 1;
+    while (at > 0 && at < g.end) {
+      const lineEnd = this.raw.indexOf("\n", at);
+      const line = this.raw.slice(at, lineEnd === -1 ? g.end : lineEnd);
+      const indent = line.length - line.trimStart().length;
+      if (line.trimStart().startsWith("#"))
+        run.push({ start: at, indent });
+      else if (line.trim() !== "")
+        run = [];
+      at = lineEnd === -1 ? g.end : lineEnd + 1;
+    }
+    const pin = Math.max(-1, ...run.map((line) => line.indent));
+    if (pin <= col)
+      return [];
+    return run.filter((line) => line.indent < pin).map((line) => ({ start: line.start, end: line.start + line.indent, text: " ".repeat(pin) }));
+  }
+  /** Where item `i`'s chunk begins: its own line for the first item, else the previous item's end. */
+  chunkStart(geometry, i) {
+    return i === 0 ? geometry[0].lineStart : geometry[i - 1].end;
+  }
+  /**
+   * Every item starts at the same column, in order, and only the first may share its line with
+   * the parent's `- ` (a compact `- key: value`). Anything else — an explicit `? key`, a
+   * multi-line key, a node property on its own line — is not a layout this splices.
+   */
+  isBlockLayout(geometry) {
+    const col = this.column(geometry[0].content);
+    let previousEnd = -1;
+    for (const [i, g] of geometry.entries()) {
+      if (this.column(g.content) !== col)
+        return false;
+      if (i > 0 && g.inline)
+        return false;
+      if (g.lineStart < previousEnd || g.end <= g.content)
+        return false;
+      previousEnd = g.end;
+    }
+    return true;
+  }
+  /** `value` is the pair's value as parsed: the reconciler may already have replaced it. */
+  pairGeometry(pair, value) {
+    const key = pair.key;
+    if (!isScalar(key) || key.range == null)
+      return void 0;
+    const content = key.range[0];
+    const range = isNode(value) && value.range != null ? value.range : key.range;
+    return this.geometry(content, range[1], range[2]);
+  }
+  seqItemGeometry(item) {
+    if (!isNode(item) || item.range == null)
+      return void 0;
+    let dash = item.range[0] - 1;
+    while (dash >= 0 && " 	\r\n".includes(this.raw[dash]))
+      dash--;
+    if (dash < 0 || this.raw[dash] !== "-")
+      return void 0;
+    return this.geometry(dash, item.range[1], item.range[2]);
+  }
+  /**
+   * Trailing blank lines are not the item's — `yaml` gives them to whatever follows — unless they
+   * are inside the value itself, as a keep-chomped (`|+`) block scalar's are. A node that ends in
+   * a comment can end inside the NEXT line's indentation; that line is not the item's either.
+   */
+  geometry(content, valueEnd, nodeEnd) {
+    const nodeEndLine = this.lineStart(nodeEnd);
+    if (nodeEndLine > content && /^[ \t]*$/.test(this.raw.slice(nodeEndLine, nodeEnd))) {
+      nodeEnd = nodeEndLine;
+      valueEnd = Math.min(valueEnd, nodeEnd);
+    }
+    let last = Math.max(content, nodeEnd - 1);
+    while (last > content && last >= valueEnd && " 	\r\n".includes(this.raw[last]))
+      last--;
+    const newline = this.raw.indexOf("\n", last);
+    const lineStart = this.lineStart(content);
+    const onOwnLine = /^ *$/.test(this.raw.slice(lineStart, content));
+    return {
+      content,
+      inline: !onOwnLine,
+      lineStart: onOwnLine ? lineStart : content,
+      end: newline === -1 ? this.raw.length : newline + 1
+    };
+  }
+  lineStart(offset) {
+    return offset <= 0 ? 0 : this.raw.lastIndexOf("\n", offset - 1) + 1;
+  }
+  column(offset) {
+    return offset - this.lineStart(offset);
+  }
+  applyEdits(start, end, edits) {
+    const sorted = [...edits].sort((a, b) => a.start - b.start || a.end - b.end);
+    let out = "";
+    let cursor = start;
+    for (const edit of sorted) {
+      if (edit.start < cursor || edit.end > end)
+        throw new Error("overlapping source edits");
+      out += this.raw.slice(cursor, edit.start) + edit.text;
+      cursor = edit.end;
+    }
+    return out + this.raw.slice(cursor, end);
+  }
+  /**
+   * Render `items` as a block collection whose items sit at column `col`. `inline` leaves the
+   * first line unindented, for a slot that continues the parent's `- ` line. The fold width is
+   * reduced by the indent so the lines come out as wide as `toString()` would make them there.
+   */
+  render(container, col, inline) {
+    const fragment = new Document();
+    fragment.schema = this.doc.schema;
+    fragment.contents = container;
+    const text = fragment.toString({ lineWidth: Math.max(MIN_LINE_WIDTH, LINE_WIDTH - col) }).replace(/\r\n?/g, "\n");
+    const indent = " ".repeat(col);
+    const lines = text.split("\n");
+    if (lines[lines.length - 1] === "")
+      lines.pop();
+    return lines.map((line, i) => line === "" || i === 0 && inline ? line : indent + line).map((line) => line + this.eol).join("");
+  }
+};
+function uncovered(extra, edits) {
+  return extra.filter((e) => !edits.some((x) => x.end > x.start && x.start <= e.start && e.end <= x.end));
+}
+function mapOf(pairs) {
+  const map = new YAMLMap();
+  map.items = [...pairs];
+  return map;
+}
+function seqOf(item) {
+  const seq = new YAMLSeq();
+  seq.items = [item];
+  return seq;
+}
+function sameLeadingComment(a, b) {
+  if (!isNode(a) || !isNode(b))
+    return false;
+  const x = a;
+  const y = b;
+  return (x.commentBefore ?? void 0) === (y.commentBefore ?? void 0) && !!x.spaceBefore === !!y.spaceBefore;
+}
+function withoutLeadingComment(node, fn) {
+  if (!isNode(node))
+    return fn();
+  const target = node;
+  const { commentBefore, spaceBefore } = target;
+  target.commentBefore = void 0;
+  target.spaceBefore = false;
+  try {
+    return fn();
+  } finally {
+    target.commentBefore = commentBefore;
+    target.spaceBefore = spaceBefore;
+  }
+}
+function lineEndingOf(raw) {
+  const crlf = (raw.match(/\r\n/g) ?? []).length;
+  const lf = (raw.match(/\n/g) ?? []).length;
+  const cr = (raw.match(/\r/g) ?? []).length;
+  if (crlf === 0)
+    return cr === 0 ? "\n" : void 0;
+  return crlf === lf && crlf === cr ? "\r\n" : void 0;
+}
+function withSourceLineEndings(printed, raw) {
+  const text = printed.replace(/\r\n?/g, "\n");
+  return lineEndingOf(raw) === "\r\n" ? text.replace(/\n/g, "\r\n") : text;
+}
+function spliceSource(raw, doc, snapshot, replaced, printed) {
+  const eol = lineEndingOf(raw);
+  if (eol === void 0)
+    return void 0;
+  const spliced = new SourceSplicer(raw, eol, doc, snapshot, replaced).print();
+  return spliced !== void 0 && printsAs(spliced, doc, printed) ? spliced : void 0;
+}
+function printsAs(candidate, reconciled, printed) {
+  if (candidate === printed)
+    return true;
+  const reparsed = parseDocument(candidate);
+  if (reparsed.errors.length > 0)
+    return false;
+  if (!isDeepStrictEqual(reparsed.toJS(), reconciled.toJS()))
+    return false;
+  return layoutFree(reparsed.toString()) === layoutFree(parseDocument(printed).toString());
+}
+function layoutFree(text) {
+  return text.split("\n").map((line) => line.replace(/[ \t\r]+$/, "")).filter((line) => line !== "").join("\n");
+}
+
 // dist/utils/content-serialize.js
+var log = createDebugLogger({ prefix: "ContentSerialize" });
 function isPlainRecord(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return false;
@@ -983,7 +1504,7 @@ function isPlainRecord(value) {
   return proto === Object.prototype || proto === null;
 }
 function recordKeyOf(keyNode) {
-  if (!isScalar(keyNode))
+  if (!isScalar2(keyNode))
     return void 0;
   const { value } = keyNode;
   if (value === null || value === void 0)
@@ -993,7 +1514,7 @@ function recordKeyOf(keyNode) {
   return String(value);
 }
 function carryComments(from, to) {
-  if (!isNode(from) || !isNode(to))
+  if (!isNode2(from) || !isNode2(to))
     return;
   const source = from;
   const target = to;
@@ -1012,7 +1533,7 @@ function identityKey(value) {
   }
 }
 function nodePlainValue(node) {
-  if (!isNode(node))
+  if (!isNode2(node))
     return node;
   try {
     return node.toJSON();
@@ -1022,7 +1543,7 @@ function nodePlainValue(node) {
 }
 function nodeIdentityKey(node) {
   const plain = nodePlainValue(node);
-  return plain === void 0 && isNode(node) ? void 0 : identityKey(plain);
+  return plain === void 0 && isNode2(node) ? void 0 : identityKey(plain);
 }
 var EVIDENCE_MAX_DEPTH = 6;
 function sharesFieldEvidence(existing, value, depth) {
@@ -1048,23 +1569,46 @@ function looksLikeSameItem(node, value) {
     return true;
   return sharesFieldEvidence(existing, value, 0);
 }
-function reconcileNode(doc, existing, value) {
-  if (isMap(existing) && isPlainRecord(value)) {
-    reconcileMap(doc, existing, value);
+function reconcileNode(ctx, existing, value) {
+  if (isMap2(existing) && isPlainRecord(value)) {
+    reconcileMap(ctx, existing, value);
     return existing;
   }
-  if (isSeq(existing) && Array.isArray(value)) {
-    reconcileSeq(doc, existing, value);
+  if (isSeq2(existing) && Array.isArray(value)) {
+    reconcileSeq(ctx, existing, value);
     return existing;
   }
-  if (isScalar(existing) && Object.is(existing.value, value))
+  if (isScalar2(existing) && Object.is(existing.value, value))
     return existing;
-  const fresh = doc.createNode(value);
-  if (!isCollection(existing))
+  const fresh = ctx.doc.createNode(value);
+  if (isNode2(existing))
+    ctx.replaced.set(fresh, existing);
+  if (isScalar2(existing) && isScalar2(fresh) && typeof value === "string") {
+    const style = carriedStyle(existing, value);
+    if (style !== void 0) {
+      fresh.type = style;
+      ctx.restyled.push(fresh);
+    }
+  }
+  if (!isCollection2(existing))
     carryComments(existing, fresh);
   return fresh;
 }
-function reconcileMap(doc, map, value) {
+function carriedStyle(existing, value) {
+  if (typeof existing.value !== "string")
+    return void 0;
+  switch (existing.type) {
+    case Scalar.QUOTE_DOUBLE:
+    case Scalar.QUOTE_SINGLE:
+      return existing.type;
+    case Scalar.BLOCK_FOLDED:
+    case Scalar.BLOCK_LITERAL:
+      return /\S/.test(value) && !/^\s/.test(value) ? existing.type : void 0;
+    default:
+      return void 0;
+  }
+}
+function reconcileMap(ctx, map, value) {
   const wanted = new Set(Object.keys(value).filter((key) => value[key] !== void 0));
   const seen = /* @__PURE__ */ new Set();
   const retained = [];
@@ -1073,17 +1617,17 @@ function reconcileMap(doc, map, value) {
     if (key === void 0 || !wanted.has(key) || seen.has(key))
       continue;
     seen.add(key);
-    pair.value = reconcileNode(doc, pair.value, value[key]);
+    pair.value = reconcileNode(ctx, pair.value, value[key]);
     retained.push(pair);
   }
   map.items = retained;
   for (const key of Object.keys(value)) {
     if (seen.has(key) || !wanted.has(key))
       continue;
-    map.set(doc.createNode(key), doc.createNode(value[key]));
+    map.set(ctx.doc.createNode(key), ctx.doc.createNode(value[key]));
   }
 }
-function reconcileSeq(doc, seq, value) {
+function reconcileSeq(ctx, seq, value) {
   const oldItems = seq.items;
   const byIdentity = /* @__PURE__ */ new Map();
   oldItems.forEach((node, index) => {
@@ -1117,20 +1661,45 @@ function reconcileSeq(doc, seq, value) {
       return oldItems[matched];
     const candidate = index < oldItems.length && !consumed.has(index) ? oldItems[index] : void 0;
     const sameItem = candidate !== void 0 && looksLikeSameItem(candidate, item) ? candidate : void 0;
-    return reconcileNode(doc, sameItem, item);
+    return reconcileNode(ctx, sameItem, item);
   });
 }
-function applyDataToDocument(doc, data) {
-  doc.contents = reconcileNode(doc, doc.contents, data);
+function reconcileYamlSource(raw, data, rootAtColumnZero = false) {
+  const doc = parseDocument2(raw);
+  if (doc.errors.length > 0)
+    return void 0;
+  const snapshot = snapshotDocument(doc);
+  const ctx = { doc, replaced: /* @__PURE__ */ new WeakMap(), restyled: [] };
+  doc.contents = reconcileNode(ctx, doc.contents, data);
+  let reconciled = withSourceLineEndings(doc.toString(), raw);
+  if (!readsBackAs(reconciled, doc)) {
+    for (const scalar of ctx.restyled)
+      scalar.type = void 0;
+    reconciled = withSourceLineEndings(doc.toString(), raw);
+    if (!readsBackAs(reconciled, doc))
+      return void 0;
+  }
+  try {
+    const spliced = spliceSource(raw, doc, snapshot, ctx.replaced, reconciled);
+    if (spliced !== void 0 && !(rootAtColumnZero && /^\s*[ \t]\S/.test(spliced))) {
+      return spliced;
+    }
+    log.debug("content-serialize", "source splice not used; writing as yaml prints it");
+  } catch (err) {
+    log.debug("content-serialize", "source splice failed; writing as yaml prints it", {
+      error: getErrorMessage(err)
+    });
+  }
+  return reconciled;
+}
+function readsBackAs(text, doc) {
+  const reparsed = parseDocument2(text);
+  return reparsed.errors.length === 0 && isDeepStrictEqual2(reparsed.toJS(), doc.toJS());
 }
 function serializeYaml(data, existingRaw) {
   if (existingRaw === void 0)
     return yamlStringify(data);
-  const doc = parseDocument(existingRaw);
-  if (doc.errors.length > 0)
-    return yamlStringify(data);
-  applyDataToDocument(doc, data);
-  return doc.toString();
+  return reconcileYamlSource(existingRaw, data) ?? yamlStringify(data);
 }
 function extractRawFrontmatter(raw) {
   let parsed;
@@ -1150,11 +1719,9 @@ function serializeFrontmatter(body, data, existingRaw) {
   const existingFrontmatter = extractRawFrontmatter(existingRaw);
   if (existingFrontmatter === void 0)
     return matter.stringify(body, data);
-  const doc = parseDocument(existingFrontmatter);
-  if (doc.errors.length > 0)
+  const reconciled = reconcileYamlSource(existingFrontmatter, data, true);
+  if (reconciled === void 0)
     return matter.stringify(body, data);
-  applyDataToDocument(doc, data);
-  const reconciled = doc.toString();
   return matter.stringify(body, data, {
     engines: {
       yaml: {
@@ -1193,12 +1760,15 @@ import fs2 from "node:fs/promises";
 import path2 from "node:path";
 import lockfile from "proper-lockfile";
 init_logger();
-function provisioningLockOptions(lockPath, retries, onCompromised) {
+var PROVISIONING_LOCK_STALE_MS = 9e4;
+function provisioningLockOptions(lockPath, retries, onCompromised, staleMs) {
   return {
     lockfilePath: lockPath,
     realpath: false,
     retries,
-    stale: 3e4,
+    stale: staleMs,
+    // Fixed, not stale/2: every holder refreshes at 15s whatever threshold it judges others by.
+    update: 15e3,
     // proper-lockfile invokes this from inside its refresh timer, so ANY throw escaping here is
     // an uncaught exception that kills the process. Call sites are told not to throw (see
     // OnLockCompromised); this makes it structural rather than a convention, and also covers the
@@ -1234,37 +1804,68 @@ function releaseIgnoringAlreadyReleased(release, lockPath) {
     }
   };
 }
+function branchProvisioningLockName(dirName) {
+  return `.${dirName}.init.lock`;
+}
 async function acquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
   await fs2.mkdir(lockTargetDir2, { recursive: true });
   const lockPath = path2.join(lockTargetDir2, lockName);
-  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true }, onCompromised));
+  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true }, onCompromised, PROVISIONING_LOCK_STALE_MS));
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
-async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
-  await fs2.mkdir(lockTargetDir2, { recursive: true });
+async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised, staleMs = PROVISIONING_LOCK_STALE_MS, createParents = true) {
+  if (createParents) {
+    await fs2.mkdir(lockTargetDir2, { recursive: true });
+  } else {
+    await fs2.mkdir(lockTargetDir2).catch((err) => {
+      if (!isNodeError(err) || err.code !== "EEXIST")
+        throw err;
+    });
+  }
   const lockPath = path2.join(lockTargetDir2, lockName);
-  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised));
+  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised, staleMs));
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
+var sleep = (ms) => new Promise((resolve2) => {
+  setTimeout(resolve2, ms);
+});
+async function acquireProvisioningLockWithin(lockTargetDir2, lockName, waitMs, onCompromised) {
+  const startedAt = Date.now();
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised);
+    } catch (err) {
+      if (!isNodeError(err) || err.code !== "ELOCKED")
+        throw err;
+      const remaining = waitMs - (Date.now() - startedAt);
+      if (remaining <= 0)
+        throw err;
+      const base = Math.min(50 * 2 ** attempt, 500);
+      await sleep(Math.min(base * (0.5 + Math.random()), remaining));
+    }
+  }
+}
 
 // dist/utils/content-write-lock.js
 var META_DIR = ".canopy-meta";
 var CONTENT_WRITE_LOCK_NAME = "content-write.lock";
 var DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS = 2e3;
 var ContentWriteLockBusyError = class extends Error {
-  constructor(message = "This branch is busy (syncing with the base branch, or another save is in flight); the change was not saved. Try again in a moment.") {
+  constructor(message = "This branch is busy (syncing with the base branch, or another save is in flight); the change was not saved. Try again in a moment.", outcome = "not-run") {
     super(message);
+    this.outcome = outcome;
     this.name = "ContentWriteLockBusyError";
   }
 };
 function lockTargetDir(branchRoot) {
   return path3.join(path3.resolve(branchRoot), META_DIR);
 }
-var sleep = (ms) => new Promise((resolve2) => {
+var sleep2 = (ms) => new Promise((resolve2) => {
   setTimeout(resolve2, ms);
 });
+var CONTENT_WRITE_LOCK_STALE_MS = 3e4;
 function tryAcquireContentWriteLock(branchRoot, onCompromised) {
-  return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME, onCompromised);
+  return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME, onCompromised, CONTENT_WRITE_LOCK_STALE_MS, false);
 }
 async function acquireContentWriteLock(branchRoot, waitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, onCompromised) {
   const startedAt = Date.now();
@@ -1278,7 +1879,7 @@ async function acquireContentWriteLock(branchRoot, waitMs = DEFAULT_CONTENT_WRIT
       if (remaining <= 0)
         throw new ContentWriteLockBusyError();
       const base = Math.min(40 * 2 ** attempt, 250);
-      await sleep(Math.min(base * (0.5 + Math.random()), remaining));
+      await sleep2(Math.min(base * (0.5 + Math.random()), remaining));
     }
   }
 }
@@ -1295,7 +1896,7 @@ async function withContentWriteLock(branchRoot, fn, waitMs = DEFAULT_CONTENT_WRI
     await release();
   }
   if (compromised) {
-    throw new ContentWriteLockBusyError("This branch was being synced while your change was written, so the change may or may not have been recorded. Reload the entry to see the current state before saving again.");
+    throw new ContentWriteLockBusyError("This branch was being synced while your change was written, so the change may or may not have been recorded. Reload the entry to see the current state before saving again.", "unknown");
   }
   return result;
 }
@@ -1345,8 +1946,21 @@ function buildResolvedReference(data, meta, body) {
   resolved.slug = meta.slug;
   resolved.collection = meta.collection;
   resolved.urlPath = meta.urlPath;
+  delete resolved[RESTRICTED_REFERENCE_MARKER];
   return resolved;
 }
+var RESTRICTED_REFERENCE_MARKER = "unavailable";
+function buildRestrictedReference(meta, title) {
+  return {
+    id: meta.id,
+    slug: meta.slug,
+    collection: meta.collection,
+    urlPath: meta.urlPath,
+    title,
+    unavailable: true,
+    reason: "restricted"
+  };
+}
 var SEO_GROUP_FIELDS = [
   {
     name: DEFAULT_SEO_FIELD_NAMES.title,
@@ -1399,15 +2013,59 @@ var SEO_GROUP_FIELDS = [
   }
 ];
 
-// dist/utils/entry-url.js
-init_normalize();
-function isIndexSlug(slug) {
-  return slug?.toLowerCase() === "index";
+// dist/utils/title-field.js
+function isGroupField(field) {
+  return field.type === "group";
 }
-function computeEntryUrl(collection, slug, contentRoot) {
-  const root = trimSlashes(contentRoot);
-  let stripped = collection;
-  if (root && collection.startsWith(`${root}/`)) {
+function extractTitleFromSchema(fields, data) {
+  return findTitleValue(fields, data);
+}
+function findTitleValue(fields, data) {
+  for (const field of fields) {
+    if (isGroupField(field)) {
+      const result = findTitleValue(field.fields, data);
+      if (result !== void 0)
+        return result;
+    } else if ("isTitle" in field && field.isTitle) {
+      const value = data[field.name];
+      return typeof value === "string" ? value : void 0;
+    } else if (field.type === "object" && "fields" in field && field.fields && !field.list) {
+      const nested = data[field.name];
+      if (nested != null && typeof nested === "object" && !Array.isArray(nested)) {
+        const result = findTitleValue(field.fields, nested);
+        if (result !== void 0)
+          return result;
+      }
+    }
+  }
+  return void 0;
+}
+function humanizeSlug(slug) {
+  return slug.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase()).trim();
+}
+function resolveEntryTitle(data, options) {
+  if (options?.schema) {
+    const schemaTitle = extractTitleFromSchema(options.schema, data);
+    if (schemaTitle)
+      return schemaTitle;
+  }
+  const title = data.title ?? data.name;
+  if (typeof title === "string")
+    return title;
+  if (options?.entryTypeLabel)
+    return options.entryTypeLabel;
+  return options?.slug ? humanizeSlug(options.slug) : "Untitled";
+}
+
+// dist/utils/entry-url.js
+init_normalize();
+function isIndexSlug(slug) {
+  return slug?.toLowerCase() === "index";
+}
+function computeEntryUrl(collection, slug, contentRoot) {
+  const root = trimSlashes(contentRoot);
+  let stripped = collection;
+  if (root && collection.startsWith(`${root}/`)) {
     stripped = collection.slice(root.length + 1);
   } else if (collection === root) {
     stripped = "";
@@ -1416,8 +2074,8 @@ function computeEntryUrl(collection, slug, contentRoot) {
   if (slug && !isIndexSlug(slug)) {
     segments.push(slug);
   }
-  const path22 = segments.length > 0 ? `/${segments.join("/")}` : "/";
-  return path22.toLowerCase();
+  const path24 = segments.length > 0 ? `/${segments.join("/")}` : "/";
+  return path24.toLowerCase();
 }
 
 // dist/url-collision.js
@@ -1790,13 +2448,13 @@ function extractIdFromFilename(filename) {
   return null;
 }
 async function resolveCollectionPath(root, logicalPath) {
-  const fs19 = await import("node:fs/promises");
-  const path22 = await import("node:path");
+  const fs21 = await import("node:fs/promises");
+  const path24 = await import("node:path");
   const segments = logicalPath.split("/").filter(Boolean);
   let currentPath = root;
   for (const segment of segments) {
     try {
-      const entries = await fs19.readdir(currentPath, { withFileTypes: true });
+      const entries = await fs21.readdir(currentPath, { withFileTypes: true });
       const matchingDir = entries.find((entry) => {
         if (!entry.isDirectory())
           return false;
@@ -1804,7 +2462,7 @@ async function resolveCollectionPath(root, logicalPath) {
         return logicalName === segment.toLowerCase();
       });
       if (matchingDir) {
-        currentPath = path22.join(currentPath, matchingDir.name);
+        currentPath = path24.join(currentPath, matchingDir.name);
       } else {
         return null;
       }
@@ -1990,98 +2648,7 @@ function invalidateContentIndexesForRoot(root) {
 import fs5 from "node:fs/promises";
 import path7 from "node:path";
 import { randomUUID } from "node:crypto";
-
-// dist/utils/debug.js
-var LOG_LEVELS = {
-  DEBUG: 0,
-  INFO: 1,
-  WARN: 2,
-  ERROR: 3
-};
-var DebugLogger = class {
-  constructor(options = {}) {
-    this.timers = /* @__PURE__ */ new Map();
-    this.options = options;
-  }
-  shouldLog(level) {
-    const enabled = this.options.enabled ?? process.env.CANOPYCMS_DEBUG === "true";
-    if (!enabled)
-      return false;
-    const minLevel = this.options.minLevel ?? "DEBUG";
-    return LOG_LEVELS[level] >= LOG_LEVELS[minLevel];
-  }
-  /**
-   * The ISO-8601 timestamp leads the line BARE, never bracketed. `CANOPYCMS_DEBUG=true` can
-   * be set on the EC2 worker, whose stdout appends to /var/log/canopy-worker/worker.log, and
-   * the CloudWatch agent's `multi_line_start_pattern` matches a timestamp at the START of a
-   * line (see worker/log.ts's INVARIANT and cms-service.ts's agent config): any leading
-   * character folds the line into the previous event instead of starting its own.
-   */
-  formatMessage(level, category, message) {
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const prefix = this.options.prefix ?? "CanopyCMS";
-    return `${timestamp} [${prefix}:${category}] [${level}] ${message}`;
-  }
-  debug(category, message, data) {
-    if (this.shouldLog("DEBUG")) {
-      console.log(this.formatMessage("DEBUG", category, message), data ?? "");
-    }
-  }
-  info(category, message, data) {
-    if (this.shouldLog("INFO")) {
-      console.log(this.formatMessage("INFO", category, message), data ?? "");
-    }
-  }
-  warn(category, message, data) {
-    if (this.shouldLog("WARN")) {
-      console.warn(this.formatMessage("WARN", category, message), data ?? "");
-    }
-  }
-  error(category, message, data) {
-    const msg = this.formatMessage("ERROR", category, message);
-    if (this.shouldLog("ERROR")) {
-      console.error(msg, data ?? "");
-    }
-    const throwOnError = this.options.throwOnError ?? false;
-    if (throwOnError) {
-      const errorMsg = data ? `${message}: ${JSON.stringify(data)}` : message;
-      throw new Error(errorMsg);
-    }
-  }
-  time(label) {
-    this.timers.set(label, Date.now());
-  }
-  timeEnd(category, label) {
-    const start = this.timers.get(label);
-    if (start === void 0) {
-      this.warn(category, `Timer '${label}' does not exist`);
-      return;
-    }
-    const duration = Date.now() - start;
-    this.timers.delete(label);
-    this.debug(category, `${label} completed`, { durationMs: duration });
-    return duration;
-  }
-  async timed(category, label, fn) {
-    this.time(label);
-    try {
-      return await fn();
-    } finally {
-      this.timeEnd(category, label);
-    }
-  }
-};
-function createDebugLogger(options) {
-  return new DebugLogger(options);
-}
-var testLogger = createDebugLogger({
-  enabled: process.env.E2E_DEBUG === "true",
-  prefix: "E2E",
-  throwOnError: false
-});
-
-// dist/resource-generation.js
-var log = createDebugLogger({ prefix: "ResourceGeneration" });
+var log2 = createDebugLogger({ prefix: "ResourceGeneration" });
 var META_DIR2 = ".canopy-meta";
 function resourceGenerationPath(root, resource) {
   return path7.resolve(root, META_DIR2, `${resource}.generation`);
@@ -2092,7 +2659,7 @@ async function bumpResourceGeneration(root, resource, options) {
     await atomicWriteFile(resourceGenerationPath(root, resource), token);
     return token;
   } catch (err) {
-    log.warn("generation", `Failed to bump ${resource} generation for ${root}`, {
+    log2.warn("generation", `Failed to bump ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
     if (options?.mustSucceed)
@@ -2107,7 +2674,7 @@ async function readResourceGeneration(root, resource) {
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT")
       return { ok: true, token: null };
-    log.warn("generation", `Failed to read ${resource} generation for ${root}`, {
+    log2.warn("generation", `Failed to read ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
     return { ok: false };
@@ -2329,10 +2896,10 @@ var closestName = (name, known) => {
   const threshold = Math.max(2, Math.floor(name.length / 3));
   return best !== void 0 && bestDistance <= threshold ? best : void 0;
 };
-var forEachEntryType = (schema, visit) => {
+var forEachEntryType = (schema, visit2) => {
   const walk = (node, nodePath) => {
     for (const entryType of node.entries ?? []) {
-      visit(entryType, nodePath);
+      visit2(entryType, nodePath);
     }
     for (const child of node.collections ?? []) {
       walk(child, child.path ?? (nodePath ? `${nodePath}/${child.name}` : child.name));
@@ -2393,9 +2960,80 @@ var STATIC_DEPLOY_USER = Object.freeze({
   name: "Static Deploy"
 });
 
+// dist/utils/request-timing.js
+import { AsyncLocalStorage } from "node:async_hooks";
+var storage = new AsyncLocalStorage();
+var log3 = createDebugLogger({ prefix: "CanopyCMS" });
+async function timeRequestPhase(phase, fn) {
+  const parent = storage.getStore();
+  if (!parent)
+    return fn();
+  const key = parent.path ? `${parent.path}>${phase}` : phase;
+  let total = parent.phases.get(key);
+  if (!total) {
+    total = { count: 0, ms: 0 };
+    parent.phases.set(key, total);
+  }
+  const start = performance.now();
+  try {
+    return await storage.run({ ...parent, path: key }, fn);
+  } finally {
+    total.count += 1;
+    total.ms += performance.now() - start;
+  }
+}
+
+// dist/utils/git.js
+import { simpleGit } from "simple-git";
+var NETWORK_SCHEME_PATTERN = /^(https?|ssh|git):\/\//i;
+var TRANSPORT_HELPER_PATTERN = /^[a-z][a-z0-9+.-]*::/i;
+var LEADING_OPTION_PATTERN = /^-/;
+var WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:[\\/]/;
+var COLON_BEFORE_SLASH_PATTERN = /^[^/\\\s]+:/;
+function isNetworkRemoteUrl(url) {
+  if (/^file:\/\//i.test(url))
+    return false;
+  if (NETWORK_SCHEME_PATTERN.test(url))
+    return true;
+  if (TRANSPORT_HELPER_PATTERN.test(url))
+    return true;
+  if (LEADING_OPTION_PATTERN.test(url))
+    return true;
+  if (WINDOWS_DRIVE_PATTERN.test(url))
+    return false;
+  return COLON_BEFORE_SLASH_PATTERN.test(url);
+}
+var MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find remote ref"];
+function isMissingRemoteRefFailure(message) {
+  return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
+}
+var CANOPY_META_DIR = ".canopy-meta";
+async function stageAllExceptCanopyState(git) {
+  await git.raw(["add", "-A", "--sparse"]);
+  await git.raw(["reset", "-q", "--", CANOPY_META_DIR]);
+}
+async function detectHeadBranch(repoRoot, fallback = "main") {
+  try {
+    const git = simpleGit({ baseDir: repoRoot });
+    const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
+    return head && head !== "HEAD" ? head : fallback;
+  } catch {
+    return fallback;
+  }
+}
+async function resolveBaseBranch(options) {
+  if (options.defaultBaseBranch)
+    return options.defaultBaseBranch;
+  if (options.mode === "dev") {
+    return detectHeadBranch(options.detectFrom ?? process.cwd());
+  }
+  return "main";
+}
+
 // dist/branch-schema-cache.js
 var SCHEMA_CACHE_VERSION = 3;
 var MTIME_CHECK_DEBOUNCE_MS = 1e3;
+var SCHEMA_CACHE_FILE = "schema-cache.json";
 var SCHEMA_GENERATION_RESOURCE = "schema";
 async function isStaleByMtime(dir, cachedAt) {
   let entries;
@@ -2418,6 +3056,11 @@ async function isStaleByMtime(dir, cachedAt) {
   }
   return false;
 }
+async function schemaCacheDir(branchRoot) {
+  const gitDir = path8.join(branchRoot, ".git");
+  const isClone = await fs7.stat(gitDir).then((stat) => stat.isDirectory(), () => false);
+  return isClone ? path8.join(gitDir, "canopycms") : path8.join(branchRoot, CANOPY_META_DIR);
+}
 var BranchSchemaCache = class {
   constructor(mode = "prod") {
     this.lastMtimeCheck = /* @__PURE__ */ new Map();
@@ -2426,7 +3069,7 @@ var BranchSchemaCache = class {
   /**
    * Whether to skip the on-disk cache for this branchRoot.
    *
-   * Never write `.canopy-meta/` at the project root, whichever entrypoint
+   * Never write a schema cache at the project root, whichever entrypoint
    * produced the cwd branchRoot. branchRoot equals process.cwd() only in the
    * synthetic contexts static deployments and build phases use; a real branch
    * root is always nested under the workspace.
@@ -2436,7 +3079,7 @@ var BranchSchemaCache = class {
   }
   /** Get schema for a branch, from the cache when fresh, else resolved fresh. */
   async getSchema(branchRoot, entrySchemaRegistry, contentRootName = "content") {
-    return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
+    return timeRequestPhase("schema", () => this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName));
   }
   /**
    * Resolve the schema from disk. Protected rather than a direct resolveSchema
@@ -2450,8 +3093,7 @@ var BranchSchemaCache = class {
     const contentRoot = path8.join(branchRoot, contentRootName);
     const skipDiskCache = this.skipDiskCache(branchRoot);
     if (!skipDiskCache) {
-      const cacheDir = path8.join(branchRoot, ".canopy-meta");
-      const cachePath = path8.join(cacheDir, "schema-cache.json");
+      const cachePath = path8.join(await schemaCacheDir(branchRoot), SCHEMA_CACHE_FILE);
       let cacheData = null;
       try {
         const cacheContent = await fs7.readFile(cachePath, "utf-8");
@@ -2493,7 +3135,7 @@ var BranchSchemaCache = class {
     const { skipDiskCache } = options;
     const contentRoot = path8.join(branchRoot, contentRootName);
     const read = skipDiskCache ? null : await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
-    const result = await this.resolveFresh(contentRoot, entrySchemaRegistry);
+    const result = await timeRequestPhase("resolve", () => this.resolveFresh(contentRoot, entrySchemaRegistry));
     if (!isValidSchema(result.schema)) {
       throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
     }
@@ -2504,9 +3146,9 @@ var BranchSchemaCache = class {
     }
     const flatSchema = flattenSchema(result.schema, contentRootName);
     if (!skipDiskCache) {
-      const cacheDir = path8.join(branchRoot, ".canopy-meta");
-      const cachePath = path8.join(cacheDir, "schema-cache.json");
-      await fs7.unlink(path8.join(cacheDir, "schema-cache.stale")).catch(() => {
+      const cacheDir = await schemaCacheDir(branchRoot);
+      const cachePath = path8.join(cacheDir, SCHEMA_CACHE_FILE);
+      await fs7.unlink(path8.join(branchRoot, CANOPY_META_DIR, "schema-cache.stale")).catch(() => {
       });
       if (read && read.ok) {
         const newCache = {
@@ -2634,7 +3276,6 @@ function validateAndNormalizePath(root, target) {
 
 // dist/paths/branch.js
 init_operating_mode();
-import fs9 from "node:fs/promises";
 import path10 from "node:path";
 
 // dist/paths/branch-name.js
@@ -2644,6 +3285,11 @@ function sanitizeBranchName(branchName) {
   const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
   return trimmedDots || "branch";
 }
+var RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
+function isSettingsBranchName(branchName, settingsBranchName) {
+  const sanitized = sanitizeBranchName(branchName);
+  return sanitized.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX) || settingsBranchName !== void 0 && sanitized === sanitizeBranchName(settingsBranchName);
+}
 
 // dist/paths/branch.js
 var BranchPathError = class extends Error {
@@ -2655,6 +3301,9 @@ function resolveBranchPath(options) {
   if (options.branchName.includes("..")) {
     throw new BranchPathError("Branch name cannot contain traversal segments");
   }
+  if (isSettingsBranchName(options.branchName)) {
+    throw new BranchPathError("Settings branches are not content branches");
+  }
   const safeBranch = sanitizeBranchName(options.branchName);
   const strategy = operatingStrategy(options.mode);
   const baseRoot = resolveContentBranchesRoot(options.mode, options.basePathOverride);
@@ -2670,11 +3319,6 @@ function resolveBranchPath(options) {
   }
   return { branchRoot, baseRoot: normalizedBase, branchName: safeBranch };
 }
-async function ensureBranchRoot(options) {
-  const result = resolveBranchPath(options);
-  await fs9.mkdir(result.branchRoot, { recursive: true });
-  return result;
-}
 
 // dist/content-store.js
 async function withLocks(keys, fn) {
@@ -2884,7 +3528,7 @@ var ContentStore = class {
   async findEntryPathsById(dir, id) {
     let entries;
     try {
-      entries = await fs10.readdir(dir, { withFileTypes: true });
+      entries = await fs9.readdir(dir, { withFileTypes: true });
     } catch (err) {
       if (isNodeError(err) && err.code === "ENOENT")
         return [];
@@ -2903,11 +3547,11 @@ var ContentStore = class {
   getSchemaItems() {
     return this.schemaIndex.values();
   }
-  assertSchemaItem(path22) {
-    const normalized = normalizeFilesystemPath(path22);
+  assertSchemaItem(path24) {
+    const normalized = normalizeFilesystemPath(path24);
     const item = this.schemaIndex.get(normalized);
     if (!item) {
-      throw new ContentStoreError(`Unknown schema item: ${path22}`, "NO_SCHEMA_ITEM");
+      throw new ContentStoreError(`Unknown schema item: ${path24}`, "NO_SCHEMA_ITEM");
     }
     return item;
   }
@@ -3082,7 +3726,7 @@ var ContentStore = class {
       let existingEntryType;
       let foundExisting = false;
       if (!id) {
-        const entries = await fs10.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+        const entries = await fs9.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
         const existingFile = entries.find((entry) => {
           if (entry.isDirectory())
             return false;
@@ -3116,6 +3760,7 @@ var ContentStore = class {
       return {
         absolutePath: resolved,
         relativePath: path11.relative(this.root, resolved),
+        logicalPath: entryLogicalPath(schemaItem.logicalPath, safeSlug),
         id,
         entryTypeName: finalEntryTypeName,
         existed
@@ -3145,11 +3790,15 @@ var ContentStore = class {
     const schemaItem = this.assertSchemaItem(schemaPath);
     return await this.buildPaths(schemaItem, slug);
   }
+  /**
+   * Read one entry. References resolve unless `resolveReferences: false`; a target that
+   * `referenceAccess` denies resolves to a `RestrictedReference` rather than its data.
+   */
   async read(collectionPath, slug = "", options = {}) {
     const schemaItem = this.assertSchemaItem(collectionPath);
     const { absolutePath, relativePath, entryTypeName: resolvedEntryTypeName } = await this.buildPaths(schemaItem, slug);
-    const stat = await fs10.stat(absolutePath);
-    const raw = await fs10.readFile(absolutePath, "utf8");
+    const stat = await fs9.stat(absolutePath);
+    const raw = await fs9.readFile(absolutePath, "utf8");
     let doc;
     let format;
     let fields;
@@ -3206,7 +3855,7 @@ var ContentStore = class {
       };
     }
     if (options.resolveReferences !== false) {
-      doc.data = await this.resolveReferencesInData(doc.data, fields);
+      doc.data = await this.resolveReferencesInData(doc.data, fields, void 0, options.referenceAccess);
     }
     doc.version = stat.mtimeMs;
     return doc;
@@ -3275,10 +3924,10 @@ var ContentStore = class {
             }
             await this.assertUrlPathAvailable(path11.dirname(absolutePath), chosenSlug);
           }
-          await fs10.mkdir(path11.dirname(absolutePath), { recursive: true });
+          await fs9.mkdir(path11.dirname(absolutePath), { recursive: true });
           if (input.expectedVersion !== void 0) {
             try {
-              const existing = await fs10.stat(absolutePath);
+              const existing = await fs9.stat(absolutePath);
               if (input.expectedVersion === null) {
                 throw new ContentConflictError("An entry with this slug already exists");
               }
@@ -3335,13 +3984,13 @@ var ContentStore = class {
             }
           }
           if (staleOldAbsPath) {
-            await fs10.unlink(staleOldAbsPath).catch((err) => {
+            await fs9.unlink(staleOldAbsPath).catch((err) => {
               if (!isNodeError(err) || err.code !== "ENOENT")
                 throw err;
             });
           }
           await this.recordOwnMutation(liveIndex);
-          const afterStat = await fs10.stat(absolutePath);
+          const afterStat = await fs9.stat(absolutePath);
           const base = {
             collection: schemaItem.logicalPath,
             collectionName: schemaItem.name,
@@ -3418,7 +4067,7 @@ var ContentStore = class {
     const schemaItem = this.assertSchemaItem(collectionPath);
     const { absolutePath } = await this.buildPaths(schemaItem, slug);
     try {
-      await fs10.access(absolutePath);
+      await fs9.access(absolutePath);
       return true;
     } catch (err) {
       if (isNodeError(err) && err.code === "ENOENT")
@@ -3453,7 +4102,7 @@ var ContentStore = class {
     const collectionRoot = await resolveCollectionPath(this.root, collectionPath);
     if (!collectionRoot)
       return 0;
-    const entries = await fs10.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
+    const entries = await fs9.readdir(collectionRoot, { withFileTypes: true }).catch(() => []);
     return entries.filter((entry) => !entry.isDirectory() && extractEntryTypeFromFilename(entry.name) === entryTypeName).length;
   }
   /**
@@ -3471,7 +4120,7 @@ var ContentStore = class {
     const collection = this.assertCollection(collectionPath);
     const prePass = await this.buildPaths(collection, slug);
     if (!prePass.existed) {
-      await fs10.unlink(prePass.absolutePath);
+      await fs9.unlink(prePass.absolutePath);
       return;
     }
     let lockKey = this.entryLockKey(collection, slug, prePass);
@@ -3487,7 +4136,7 @@ var ContentStore = class {
             return RETRY_KEY;
           }
           const { absolutePath, relativePath } = inLock;
-          await fs10.unlink(absolutePath);
+          await fs9.unlink(absolutePath);
           const liveIndex = this._idIndex;
           const id = liveIndex.findByPath(relativePath);
           if (id) {
@@ -3559,7 +4208,7 @@ var ContentStore = class {
           const parentDir = path11.dirname(currentPath);
           const newPath = path11.join(parentDir, newFilename);
           try {
-            const entries = await fs10.readdir(parentDir, { withFileTypes: true });
+            const entries = await fs9.readdir(parentDir, { withFileTypes: true });
             for (const entry of entries) {
               if (entry.isDirectory())
                 continue;
@@ -3574,14 +4223,14 @@ var ContentStore = class {
           }
           await this.assertUrlPathAvailable(parentDir, safeNewSlug);
           try {
-            await fs10.link(currentPath, newPath);
+            await fs9.link(currentPath, newPath);
           } catch (err) {
             if (isNodeError(err) && err.code === "EEXIST") {
               throw new ContentStoreError(`Entry with slug "${safeNewSlug}" already exists in collection "${collectionPath}"`, "VALIDATION");
             }
             throw err;
           }
-          await fs10.unlink(currentPath);
+          await fs9.unlink(currentPath);
           const newRelativePath = path11.relative(this.root, newPath);
           const liveIndex = this._idIndex;
           const entryId = liveIndex.findByPath(currentRelPath);
@@ -3660,20 +4309,25 @@ var ContentStore = class {
    * a target referenced by many entries is read once; omit `cache` for exactly `read()`'s
    * unmemoized behavior.
    *
-   * **Path ACLs are not consulted for the targets.** Resolution goes through this store's own
-   * `read()`, below the per-entry permission check in content-reader.ts, so a resolved target
-   * may be an entry the caller could not `read()` directly -- pre-existing `read()` behavior,
-   * matched here on purpose so one rule covers both.
+   * `access` applies to every target exactly as in `read()`; see {@link ReferenceTargetAccess}.
+   */
+  async resolveReferences(data, fields, cache, access) {
+    return this.resolveReferencesInData(data, fields, cache, access);
+  }
+  /**
+   * Resolve one reference id the way a reference field resolves it, for the editor's
+   * live-preview endpoint (api/resolve-references.ts), which has ids but no field to walk. Null
+   * when the id names no entry. No body is embedded, since there is no field to ask for one.
    */
-  async resolveReferences(data, fields, cache) {
-    return this.resolveReferencesInData(data, fields, cache);
+  async resolveReferenceTarget(id, access) {
+    return this.resolveSingleReference(id, await this.idIndex(), false, void 0, access);
   }
-  async resolveReferencesInData(data, fields, cache) {
+  async resolveReferencesInData(data, fields, cache, access) {
     const resolved = { ...data };
     const idIndex = await this.idIndex();
     for (const field of fields) {
       if (field.type === "group") {
-        const groupResolved = await this.resolveReferencesInData(resolved, field.fields, cache);
+        const groupResolved = await this.resolveReferencesInData(resolved, field.fields, cache, access);
         Object.assign(resolved, groupResolved);
         continue;
       }
@@ -3681,18 +4335,18 @@ var ContentStore = class {
       if (field.type === "reference") {
         const includeBody = field.includeBody === true;
         if (typeof value === "string" && value) {
-          resolved[field.name] = await this.resolveSingleReference(value, idIndex, includeBody, cache);
+          resolved[field.name] = await this.resolveSingleReference(value, idIndex, includeBody, cache, access);
         } else if (field.list && Array.isArray(value)) {
-          resolved[field.name] = await Promise.all(value.map((id) => typeof id === "string" ? this.resolveSingleReference(id, idIndex, includeBody, cache) : null));
+          resolved[field.name] = await Promise.all(value.map((id) => typeof id === "string" ? this.resolveSingleReference(id, idIndex, includeBody, cache, access) : null));
         }
       } else if (field.type === "object" && value) {
         const objectField = field;
         if (!objectField.fields)
           continue;
         if (objectField.list && Array.isArray(value)) {
-          resolved[field.name] = await Promise.all(value.map((item) => typeof item === "object" && item !== null ? this.resolveReferencesInData(item, objectField.fields, cache) : item));
+          resolved[field.name] = await Promise.all(value.map((item) => typeof item === "object" && item !== null ? this.resolveReferencesInData(item, objectField.fields, cache, access) : item));
         } else if (typeof value === "object") {
-          resolved[field.name] = await this.resolveReferencesInData(value, objectField.fields, cache);
+          resolved[field.name] = await this.resolveReferencesInData(value, objectField.fields, cache, access);
         }
       } else if (field.type === "block" && Array.isArray(value)) {
         const blockField = field;
@@ -3705,7 +4359,7 @@ var ContentStore = class {
             return block;
           return {
             ...b,
-            value: await this.resolveReferencesInData(b.value, template.fields, cache)
+            value: await this.resolveReferencesInData(b.value, template.fields, cache, access)
           };
         }));
       }
@@ -3736,13 +4390,13 @@ var ContentStore = class {
    * `includeBody` is opt-in per field: an embedded body sits inside the memoized object and is
    * cloned once per referencing entry.
    */
-  resolveSingleReference(id, idIndex, includeBody, cache) {
+  resolveSingleReference(id, idIndex, includeBody, cache, access) {
     if (!cache)
-      return this.resolveSingleReferenceUncached(id, idIndex, includeBody);
+      return this.resolveSingleReferenceUncached(id, idIndex, includeBody, access);
     const key = includeBody ? `${id}:body` : id;
     let pending = cache.get(key);
     if (!pending) {
-      pending = this.resolveSingleReferenceUncached(id, idIndex, includeBody);
+      pending = this.resolveSingleReferenceUncached(id, idIndex, includeBody, access);
       cache.set(key, pending);
     }
     return pending.then((resolved) => resolved === null ? null : structuredClone(resolved));
@@ -3760,15 +4414,27 @@ var ContentStore = class {
    * A {@link ReferenceResolveCache} sits ABOVE this, never inside it, so every distinct id
    * still runs the full refresh-and-retry; a cache only makes repeats of the SAME id share it.
    */
-  async resolveSingleReferenceUncached(id, idIndex, includeBody) {
-    const first = await this.resolveSingleReferenceOnce(id, idIndex, includeBody);
+  async resolveSingleReferenceUncached(id, idIndex, includeBody, access) {
+    const first = await this.resolveSingleReferenceOnce(id, idIndex, includeBody, access);
     if (first !== STALE_LOOKUP)
       return first;
     await this.refreshIndexForSuspiciousLookup();
-    const second = await this.resolveSingleReferenceOnce(id, await this.idIndex(), includeBody);
+    const second = await this.resolveSingleReferenceOnce(id, await this.idIndex(), includeBody, access);
     return second === STALE_LOOKUP ? null : second;
   }
-  async resolveSingleReferenceOnce(id, idIndex, includeBody) {
+  /**
+   * The entry type an entry file was written as, by its filename's type token, falling back to
+   * the collection's default the way `read()` does for a legacy untyped file.
+   */
+  entryTypeOf(collectionPath, relativePath) {
+    const schemaItem = this.assertSchemaItem(collectionPath);
+    if (schemaItem.type === "entry-type")
+      return schemaItem;
+    const entries = schemaItem.entries;
+    const typeName = extractEntryTypeFromFilename(path11.basename(relativePath));
+    return entries?.find((e) => e.name === typeName) ?? getDefaultEntryType(schemaItem.entries);
+  }
+  async resolveSingleReferenceOnce(id, idIndex, includeBody, access) {
     try {
       const location = idIndex.findById(id);
       if (!location)
@@ -3779,13 +4445,22 @@ var ContentStore = class {
       const doc = await this.read(location.collection, location.slug, {
         resolveReferences: false
       });
-      const bodyForEmbed = includeBody && "body" in doc ? { fieldName: doc.bodyFieldName, value: doc.body } : void 0;
-      return buildResolvedReference(doc.data, {
+      const meta = {
         id,
         slug: location.slug,
         collection: location.collection,
         urlPath: computeEntryUrl(location.collection, location.slug, this.contentRootName)
-      }, bodyForEmbed);
+      };
+      if (access && !access(entryLogicalPath(location.collection, location.slug))) {
+        const entryType = this.entryTypeOf(location.collection, location.relativePath);
+        return buildRestrictedReference(meta, resolveEntryTitle(doc.data, {
+          schema: entryType?.schema,
+          entryTypeLabel: entryType?.label,
+          slug: location.slug
+        }));
+      }
+      const bodyForEmbed = includeBody && "body" in doc ? { fieldName: doc.bodyFieldName, value: doc.body } : void 0;
+      return buildResolvedReference(doc.data, meta, bodyForEmbed);
     } catch (error) {
       if (isNodeError(error) && error.code === "ENOENT")
         return STALE_LOOKUP;
@@ -3797,7 +4472,7 @@ var ContentStore = class {
 
 // dist/ai/generate.js
 import path12 from "node:path";
-import fs11 from "node:fs/promises";
+import fs10 from "node:fs/promises";
 import { minimatch } from "minimatch";
 
 // dist/ai/strip-mdx.js
@@ -4353,7 +5028,7 @@ function yamlValue(value) {
 }
 
 // dist/entry-link-resolver.js
-var log2 = createDebugLogger({ prefix: "EntryLinks" });
+var log4 = createDebugLogger({ prefix: "EntryLinks" });
 var BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
 var ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
 function resolveEntryUrl(location, contentRoot) {
@@ -4367,7 +5042,7 @@ function resolveEntryLinksInText(text, idIndex, contentRoot, customResolver) {
     return part.text.replace(ENTRY_LINK_PATTERN, (_match, id, anchor) => {
       const location = idIndex.findById(id);
       if (!location || location.type !== "entry" || !location.collection || !location.slug) {
-        log2.warn("resolve", `Entry link target not found: entry:${id}`);
+        log4.warn("resolve", `Entry link target not found: entry:${id}`);
         return anchor ?? "#";
       }
       let url;
@@ -4669,10 +5344,10 @@ function makeReadSibling(dir) {
     if (path12.dirname(abs) !== resolvedDir)
       return null;
     try {
-      const stats = await fs11.lstat(abs);
+      const stats = await fs10.lstat(abs);
       if (!stats.isFile())
         return null;
-      return await fs11.readFile(abs, "utf8");
+      return await fs10.readFile(abs, "utf8");
     } catch (err) {
       if (isNodeError(err) && (err.code === "ENOENT" || err.code === "ENOTDIR"))
         return null;
@@ -4723,18 +5398,19 @@ function matchesBundleFilter(entry, filter, contentRoot) {
 }
 
 // dist/branch-workspace.js
-import path18 from "node:path";
+import fs18 from "node:fs/promises";
+import path20 from "node:path";
 
 // dist/branch-metadata.js
-import fs15 from "node:fs/promises";
+import fs14 from "node:fs/promises";
 import path16 from "node:path";
 
 // dist/branch-registry.js
-import fs13 from "node:fs/promises";
+import fs12 from "node:fs/promises";
 import path14 from "node:path";
 
 // dist/branch-metadata-file.js
-import fs12 from "node:fs/promises";
+import fs11 from "node:fs/promises";
 import path13 from "node:path";
 var BRANCH_META_DIR = ".canopy-meta";
 var BRANCH_META_FILE = "branch.json";
@@ -4750,7 +5426,7 @@ var branchMetadataFilePath = (branchRoot) => path13.join(path13.resolve(branchRo
 async function readBranchMetadataFile(branchRoot) {
   const resolvedRoot = path13.resolve(branchRoot);
   try {
-    const raw = await fs12.readFile(branchMetadataFilePath(resolvedRoot), "utf8");
+    const raw = await fs11.readFile(branchMetadataFilePath(resolvedRoot), "utf8");
     return JSON.parse(raw);
   } catch (err) {
     if (isNotFoundError(err)) {
@@ -4765,7 +5441,7 @@ async function readBranchMetadataFile(branchRoot) {
 
 // dist/branch-registry.js
 init_logger();
-var log3 = createDebugLogger({ prefix: "BranchRegistry" });
+var log5 = createDebugLogger({ prefix: "BranchRegistry" });
 var REGISTRY_FILE = "branches.json";
 var REGISTRY_STALE_FILE = "branches.stale.json";
 var REGISTRY_TEMP_FILE = "branches.tmp.json";
@@ -4788,7 +5464,7 @@ var BranchRegistry = class {
   async list() {
     let parsed;
     try {
-      const raw = await fs13.readFile(this.registryPath, "utf8");
+      const raw = await fs12.readFile(this.registryPath, "utf8");
       parsed = JSON.parse(raw);
     } catch (err) {
       if (isNotFoundError(err)) {
@@ -4845,7 +5521,7 @@ var BranchRegistry = class {
         });
       await this.regenerate();
     } catch (err) {
-      log3.warn("invalidate", "Eager regeneration after invalidate() failed", {
+      log5.warn("invalidate", "Eager regeneration after invalidate() failed", {
         error: getErrorMessage(err)
       });
     }
@@ -4870,7 +5546,7 @@ var BranchRegistry = class {
   async performRegenerate() {
     const read = await readResourceGeneration(this.root, RESOURCE2);
     const branches = await this.scanBranchDirectories();
-    await fs13.unlink(this.stalePath).catch(() => {
+    await fs12.unlink(this.stalePath).catch(() => {
     });
     if (!read.ok) {
       return branches;
@@ -4881,12 +5557,12 @@ var BranchRegistry = class {
       generation: read.token
     };
     const uniqueTempPath = `${this.tempPath}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-    await fs13.mkdir(this.root, { recursive: true });
-    await fs13.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
+    await fs12.mkdir(this.root, { recursive: true });
+    await fs12.writeFile(uniqueTempPath, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
     try {
-      await fs13.rename(uniqueTempPath, this.registryPath);
+      await fs12.rename(uniqueTempPath, this.registryPath);
     } catch (err) {
-      await fs13.unlink(uniqueTempPath).catch(() => {
+      await fs12.unlink(uniqueTempPath).catch(() => {
       });
       throw err;
     }
@@ -4900,7 +5576,7 @@ var BranchRegistry = class {
   async scanBranchDirectories() {
     const branches = [];
     try {
-      const entries = await fs13.readdir(this.root, { withFileTypes: true });
+      const entries = await fs12.readdir(this.root, { withFileTypes: true });
       for (const entry of entries) {
         if (!entry.isDirectory() || entry.name.startsWith(".")) {
           continue;
@@ -4932,11 +5608,11 @@ var BranchRegistry = class {
 };
 
 // dist/utils/occ-json-write.js
-import fs14 from "node:fs/promises";
+import fs13 from "node:fs/promises";
 import path15 from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import lockfile2 from "proper-lockfile";
-var log4 = createDebugLogger({ prefix: "OccJsonWrite" });
+var log6 = createDebugLogger({ prefix: "OccJsonWrite" });
 var OccWriteConflictError = class extends Error {
   constructor(message = "Concurrent modification detected") {
     super(message);
@@ -4950,28 +5626,28 @@ async function writeOccJsonFile(filePath, payload, options) {
   const data = { ...payload, version: newVersion, writeId };
   const content = JSON.stringify(data, null, 2) + (trailingNewline ? "\n" : "");
   const dir = path15.dirname(filePath);
-  await fs14.mkdir(dir, { recursive: true });
+  await fs13.mkdir(dir, { recursive: true });
   const tempPath = `${filePath}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
-  await fs14.writeFile(tempPath, content, "utf-8");
+  await fs13.writeFile(tempPath, content, "utf-8");
   if (expectedVersion === null) {
     try {
-      await fs14.link(tempPath, filePath);
+      await fs13.link(tempPath, filePath);
     } catch (err) {
-      await fs14.unlink(tempPath).catch(() => {
+      await fs13.unlink(tempPath).catch(() => {
       });
       if (isFileExistsError(err)) {
         throw new OccWriteConflictError();
       }
       throw err;
     }
-    await fs14.unlink(tempPath).catch(() => {
+    await fs13.unlink(tempPath).catch(() => {
     });
     return { version: newVersion, writeId };
   }
   try {
     let currentVersion = null;
     try {
-      const current = JSON.parse(await fs14.readFile(filePath, "utf-8"));
+      const current = JSON.parse(await fs13.readFile(filePath, "utf-8"));
       currentVersion = current.version ?? 0;
     } catch {
       currentVersion = null;
@@ -4979,16 +5655,16 @@ async function writeOccJsonFile(filePath, payload, options) {
     if (currentVersion !== expectedVersion) {
       throw new OccWriteConflictError();
     }
-    await fs14.rename(tempPath, filePath);
+    await fs13.rename(tempPath, filePath);
     if (settleMs > 0) {
       await new Promise((resolve2) => setTimeout(resolve2, settleMs));
     }
-    const afterWrite = JSON.parse(await fs14.readFile(filePath, "utf-8"));
+    const afterWrite = JSON.parse(await fs13.readFile(filePath, "utf-8"));
     if (afterWrite.writeId !== writeId) {
       throw new OccWriteConflictError();
     }
   } catch (err) {
-    await fs14.unlink(tempPath).catch(() => {
+    await fs13.unlink(tempPath).catch(() => {
     });
     throw err;
   }
@@ -5014,8 +5690,13 @@ async function withOccRetry(operation, options) {
   throw new Error("Unreachable");
 }
 async function withOccFileLock(filePath, fn) {
-  const dir = path15.dirname(filePath);
-  await fs14.mkdir(dir, { recursive: true });
+  try {
+    await fs13.mkdir(path15.dirname(filePath));
+  } catch (err) {
+    if (!isNodeError(err) || err.code !== "EEXIST") {
+      throw new OccWriteConflictError(`Could not acquire file lock: ${getErrorMessage(err)}`);
+    }
+  }
   const MAX_ATTEMPTS = 14;
   let release = null;
   for (let attempt = 1; release === null; attempt++) {
@@ -5031,7 +5712,7 @@ async function withOccFileLock(filePath, fn) {
         // Our critical sections are short and idempotent-on-conflict (OCC
         // verify inside); log and let the section finish.
         onCompromised: (err) => {
-          log4.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+          log6.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
             error: getErrorMessage(err)
           });
         }
@@ -5053,7 +5734,7 @@ async function withOccFileLock(filePath, fn) {
     await release().catch((err) => {
       if (isNodeError(err) && err.code === "ENOENT")
         return;
-      log4.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
+      log6.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
     });
   }
 }
@@ -5086,7 +5767,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
   }
   async load() {
     try {
-      const raw = await fs15.readFile(this.filePath, "utf8");
+      const raw = await fs14.readFile(this.filePath, "utf8");
       const parsed = JSON.parse(raw);
       const version = parsed.version ?? 0;
       return { meta: parsed, version };
@@ -5132,15 +5813,13 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
    * entry with no clone behind it. It runs BEFORE the lock stack so a doomed
    * save fails fast instead of paying for a lock.
    *
-   * Accepted residual window: a save that passes the check can still race a
-   * `rm` that starts moments later and is mid-flight when the write lands.
-   * Closing that needs a tombstone OUTSIDE the tree being removed, and the
-   * lockfile taken next lives INSIDE `branchRoot`, so it can promise no more
-   * than "the directory existed a moment ago".
+   * A save that passes the check just before a delete still cannot write: the
+   * delete renames the tree away under the same lockfile, and that lockfile
+   * creates only its own directory (`withOccFileLock`), so the save fails there.
    */
   async save(incoming) {
     try {
-      await fs15.stat(this.branchRoot);
+      await fs14.stat(this.branchRoot);
     } catch (err) {
       if (isNotFoundError(err)) {
         throw new BranchMetadataConflictError("Branch no longer exists");
@@ -5151,37 +5830,7 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     try {
       saved = await withLock(this.filePath, () => withOccFileLock(this.filePath, () => withOccRetry(async () => {
         const { meta: existing, version } = await this.load();
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const defaults = {
-          name: "unknown",
-          status: "editing",
-          access: {},
-          createdBy: "unknown",
-          createdAt: now,
-          updatedAt: now
-        };
-        const merged = {
-          schemaVersion: CURRENT_SCHEMA_VERSION,
-          version: version ?? 0,
-          branch: {
-            ...defaults,
-            ...existing?.branch,
-            ...incoming.branch,
-            access: {
-              ...existing?.branch?.access,
-              ...incoming.branch?.access
-            },
-            // Immutable after creation
-            createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
-            createdAt: existing?.branch.createdAt ?? defaults.createdAt,
-            // Fork point is recorded once at creation; later saves must not move it
-            baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
-            // Always stamped fresh; the spreads above would otherwise let
-            // the creation-time value win forever, freezing the timestamp
-            // the editor's Branches panel sorts and displays by
-            updatedAt: now
-          }
-        };
+        const merged = mergeBranchMetadata(existing, version, incoming);
         const written = await this.write(merged, version);
         merged.version = written.version;
         merged.writeId = written.writeId;
@@ -5202,9 +5851,40 @@ var BranchMetadataFileManager = class _BranchMetadataFileManager {
     await registry2.invalidate();
   }
 };
-var getBranchMetadataFileManager = (branchRoot, baseRoot, options) => {
-  return BranchMetadataFileManager.get(branchRoot, baseRoot, options);
-};
+function mergeBranchMetadata(existing, version, incoming, now = (/* @__PURE__ */ new Date()).toISOString()) {
+  const defaults = {
+    name: "unknown",
+    status: "editing",
+    access: {},
+    createdBy: "unknown",
+    createdAt: now,
+    updatedAt: now
+  };
+  return {
+    schemaVersion: CURRENT_SCHEMA_VERSION,
+    version: version ?? 0,
+    branch: {
+      ...defaults,
+      ...existing?.branch,
+      ...incoming.branch,
+      access: {
+        ...existing?.branch?.access,
+        ...incoming.branch?.access
+      },
+      // Immutable after creation
+      createdBy: existing?.branch.createdBy ?? incoming.branch?.createdBy ?? defaults.createdBy,
+      createdAt: existing?.branch.createdAt ?? defaults.createdAt,
+      // Fork point is recorded once at creation; later saves must not move it
+      baseBranch: existing?.branch.baseBranch ?? incoming.branch?.baseBranch,
+      // Always stamped fresh; the spreads above would otherwise let the creation-time value win
+      // forever, freezing the timestamp the editor's Branches panel sorts and displays by
+      updatedAt: now
+    }
+  };
+}
+function buildInitialBranchMetadata(incoming, now) {
+  return mergeBranchMetadata(null, null, incoming, now);
+}
 var loadBranchContext = async (options) => {
   const { branchRoot, baseRoot } = resolveBranchPath({
     branchName: options.branchName,
@@ -5222,89 +5902,140 @@ var loadBranchContext = async (options) => {
   };
 };
 
-// dist/branch-workspace.js
-init_operating_mode();
+// dist/branch-provisioning.js
+import { createHash, randomBytes } from "node:crypto";
+import fs16 from "node:fs/promises";
+import path18 from "node:path";
 
 // dist/git-manager.js
-import fs16 from "node:fs/promises";
+import fs15 from "node:fs/promises";
 import path17 from "node:path";
 import { simpleGit as simpleGit2 } from "simple-git";
-
-// dist/utils/git.js
-import { simpleGit } from "simple-git";
-var NETWORK_SCHEME_PATTERN = /^(https?|ssh|git):\/\//i;
-var TRANSPORT_HELPER_PATTERN = /^[a-z][a-z0-9+.-]*::/i;
-var LEADING_OPTION_PATTERN = /^-/;
-var WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:[\\/]/;
-var COLON_BEFORE_SLASH_PATTERN = /^[^/\\\s]+:/;
-function isNetworkRemoteUrl(url) {
-  if (/^file:\/\//i.test(url))
-    return false;
-  if (NETWORK_SCHEME_PATTERN.test(url))
-    return true;
-  if (TRANSPORT_HELPER_PATTERN.test(url))
-    return true;
-  if (LEADING_OPTION_PATTERN.test(url))
-    return true;
-  if (WINDOWS_DRIVE_PATTERN.test(url))
-    return false;
-  return COLON_BEFORE_SLASH_PATTERN.test(url);
-}
-var MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find remote ref"];
-function isMissingRemoteRefFailure(message) {
-  return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
-}
-async function detectHeadBranch(repoRoot, fallback = "main") {
-  try {
-    const git = simpleGit({ baseDir: repoRoot });
-    const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
-    return head && head !== "HEAD" ? head : fallback;
-  } catch {
-    return fallback;
+init_logger();
+var log7 = createDebugLogger({ prefix: "GitManager" });
+var GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
+var FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
+function gitChildEnv(overrides) {
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== void 0 && GIT_ENV_PASSTHROUGH.test(key))
+      env[key] = value;
   }
+  return { ...env, ...FORCE_C_LOCALE, ...overrides };
 }
-async function resolveBaseBranch(options) {
-  if (options.defaultBaseBranch)
-    return options.defaultBaseBranch;
-  if (options.mode === "dev") {
-    return detectHeadBranch(options.detectFrom ?? process.cwd());
-  }
-  return "main";
-}
-
-// dist/git-manager.js
-var log5 = createDebugLogger({ prefix: "GitManager" });
-var GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
-var FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
-function gitChildEnv(overrides) {
+var GIT_NETWORK_ENV_PASSTHROUGH = /^((HTTPS?|ALL)_PROXY|(https?|all)_proxy|NO_PROXY|no_proxy|GIT_SSL_(CAINFO|CAPATH|NO_VERIFY|VERSION)|CURL_CA_BUNDLE|SSL_CERT_(FILE|DIR)|REQUESTS_CA_BUNDLE|NODE_EXTRA_CA_CERTS)$/;
+function gitNetworkChildEnv() {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
-    if (value !== void 0 && GIT_ENV_PASSTHROUGH.test(key))
+    if (value === void 0)
+      continue;
+    if (GIT_ENV_PASSTHROUGH.test(key) || GIT_NETWORK_ENV_PASSTHROUGH.test(key))
       env[key] = value;
   }
-  return { ...env, ...FORCE_C_LOCALE, ...overrides };
+  return { ...env, ...FORCE_C_LOCALE };
+}
+var NO_AUTO_GC_CONFIG = ["gc.auto=0", "maintenance.auto=false"];
+var REMOTE_GIT_CONFIG = [
+  ["gc.auto", "0"],
+  ["receive.autogc", "false"],
+  ["maintenance.auto", "false"],
+  ["transfer.unpackLimit", "1"]
+];
+async function ensureRemoteGitConfig(gitDir) {
+  const git = simpleGit2().env(gitChildEnv({}));
+  const current = /* @__PURE__ */ new Map();
+  const listed = await git.raw(["--git-dir", gitDir, "config", "--local", "--list"]);
+  for (const line of listed.split("\n")) {
+    const eq = line.indexOf("=");
+    if (eq > 0)
+      current.set(line.slice(0, eq).toLowerCase(), line.slice(eq + 1));
+  }
+  for (const [key, value] of REMOTE_GIT_CONFIG) {
+    if (current.get(key.toLowerCase()) === value)
+      continue;
+    await git.raw(["--git-dir", gitDir, "config", "--local", key, value]);
+  }
+}
+var REMOTE_GIT_MAX_LOOSE_OBJECTS = 50;
+var REMOTE_GIT_MAX_PACKS = 6;
+async function countObjects(git, gitDir) {
+  const output = await git.raw(["--git-dir", gitDir, "count-objects", "-v"]);
+  const fields = new Map(output.split("\n").map((line) => {
+    const [name, value = ""] = line.split(": ");
+    return [name, value.trim()];
+  }));
+  const field = (name) => {
+    const value = fields.get(name);
+    if (!value || !/^\d+$/.test(value)) {
+      throw new Error(`count-objects -v printed no '${name}' count: ${output.trim()}`);
+    }
+    return Number(value);
+  };
+  return { loose: field("count"), packs: field("packs") };
+}
+async function repackBareRemoteIfNeeded(gitDir) {
+  const git = simpleGit2().env(gitChildEnv({}));
+  const before = await countObjects(git, gitDir);
+  if (before.loose <= REMOTE_GIT_MAX_LOOSE_OBJECTS && before.packs <= REMOTE_GIT_MAX_PACKS) {
+    return { repacked: false, before };
+  }
+  const startedAt = Date.now();
+  await git.raw(["--git-dir", gitDir, "repack", "-a", "-d", "--cruft", "-q"]);
+  await git.raw(["--git-dir", gitDir, "pack-refs", "--all"]);
+  const after = await countObjects(git, gitDir);
+  return { repacked: true, before, after, ms: Date.now() - startedAt };
+}
+function failOnSignalExit(error, result) {
+  if (error)
+    return error;
+  if (result.exitCode === null) {
+    return new Error("git was killed by a signal before it finished");
+  }
+  return void 0;
+}
+var PARALLEL_CHECKOUT_ARGS = [
+  "-c",
+  "checkout.workers=8",
+  "-c",
+  "checkout.thresholdForParallelism=1"
+];
+async function dirState(dir) {
+  try {
+    return (await fs15.readdir(dir)).length === 0 ? "empty" : "occupied";
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT")
+      return "absent";
+    throw err;
+  }
+}
+function managedWorkspaceConfig(gitBotAuthorName, gitBotAuthorEmail) {
+  return {
+    "canopycms.managed": "true",
+    "user.name": gitBotAuthorName,
+    "user.email": gitBotAuthorEmail
+  };
 }
 var remoteInitLocks = /* @__PURE__ */ new Map();
 var GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
 async function ensureGitExcludePattern(repoPath, pattern) {
   const excludePath = path17.join(repoPath, ".git", "info", "exclude");
-  await fs16.mkdir(path17.dirname(excludePath), { recursive: true });
+  await fs15.mkdir(path17.dirname(excludePath), { recursive: true });
   let content = "";
   try {
-    content = await fs16.readFile(excludePath, "utf-8");
+    content = await fs15.readFile(excludePath, "utf-8");
   } catch (err) {
     if (!isNotFoundError(err))
       throw err;
   }
   const lines = content.split("\n");
   if (lines.some((line) => line.trim() === pattern)) {
-    log5.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    log7.debug("git", "Pattern already in .git/info/exclude", { pattern });
     return;
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
-  await fs16.writeFile(excludePath, newContent, "utf-8");
-  log5.debug("git", "Added pattern to .git/info/exclude", { pattern });
+  await fs15.writeFile(excludePath, newContent, "utf-8");
+  log7.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
 var GitConflictError = class extends Error {
   constructor(conflictedFiles) {
@@ -5322,24 +6053,95 @@ var GitRemoteRefMissingError = class extends Error {
     this.name = "GitRemoteRefMissingError";
   }
 };
+var RemoteNotReadyError = class extends Error {
+  constructor(expectedRemotePath) {
+    super(`CanopyCMS: no git remote is available yet. defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is not set and the CMS worker has not created ${expectedRemotePath}; the worker may still be starting.`);
+    this.expectedRemotePath = expectedRemotePath;
+    this.name = "RemoteNotReadyError";
+  }
+};
+var SettingsRemoteUnreadableError = class extends Error {
+  constructor(branch, remote, gitError) {
+    super(`CanopyCMS: could not read settings branch '${branch}' from remote '${remote}', so the settings workspace was not provisioned: ${getErrorMessage(gitError)}`);
+    this.branch = branch;
+    this.remote = remote;
+    this.gitError = gitError;
+    this.name = "SettingsRemoteUnreadableError";
+  }
+};
+var SettingsBranchDivergedError = class extends Error {
+  constructor(branch, workspacePath, localWork) {
+    super(`CanopyCMS: settings branch '${branch}' in ${workspacePath} shares no history with the remote's '${branch}', and holds ${localWork}. Settings saves cannot pull until one copy is chosen. To keep the remote's settings: copy anything you need out of ${workspacePath}, move it aside, and restart; the next start checks out the remote's '${branch}', and copied changes can then be re-applied in the editor.`);
+    this.branch = branch;
+    this.workspacePath = workspacePath;
+    this.localWork = localWork;
+    this.name = "SettingsBranchDivergedError";
+  }
+};
+var SETTINGS_BRANCH_FILES = /* @__PURE__ */ new Set(["permissions.json", "groups.json"]);
+var SettingsBranchHasContentHistoryError = class extends Error {
+  constructor(branch, remote, evidence) {
+    super(`CanopyCMS: the settings branch '${branch}' on remote '${remote}' holds content, not settings (${evidence}), so it was not checked out. Restore '${branch}' on the remote from a copy of the settings (it may hold only permissions.json and groups.json), then restart.`);
+    this.branch = branch;
+    this.remote = remote;
+    this.evidence = evidence;
+    this.name = "SettingsBranchHasContentHistoryError";
+  }
+};
 var GitManager = class _GitManager {
   constructor(options, gitOptions) {
     this.repoPath = path17.resolve(options.repoPath);
     this.baseBranch = options.baseBranch ?? "main";
     this.remote = options.remote ?? "origin";
     this.skipIndexMarker = options.skipIndexMarker ?? false;
-    this.git = simpleGit2({ baseDir: this.repoPath, ...gitOptions });
+    this.git = simpleGit2({
+      baseDir: this.repoPath,
+      errors: failOnSignalExit,
+      ...gitOptions,
+      config: [...NO_AUTO_GC_CONFIG, ...gitOptions?.config ?? []]
+    });
     this.git.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(this.repoPath) }));
   }
-  static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
-    log5.debug("git", "Cloning repository", {
+  /**
+   * Single-branch clone of `baseBranch`, retried once: a clone can lose a race
+   * with the worker's repack of `remote.git` deleting a pack it had just
+   * listed. Before the retry it clears only what it created itself, so a
+   * target that held files beforehand is never touched.
+   */
+  static async cloneRepo(remoteUrl, targetPath, baseBranch = "main", options = {}) {
+    log7.debug("git", "Cloning repository", {
       remoteUrl,
       targetPath,
       baseBranch
     });
-    const git = simpleGit2();
-    await git.clone(remoteUrl, targetPath, ["--branch", baseBranch, "--single-branch"]);
-    log5.debug("git", "Clone complete");
+    const args = ["--single-branch", "--branch", baseBranch];
+    if (options.noCheckout)
+      args.push("--no-checkout");
+    if (options.remoteName)
+      args.push("--origin", options.remoteName);
+    for (const [key, value] of Object.entries(options.config ?? {})) {
+      args.push("-c", `${key}=${value}`);
+    }
+    for (const setting of NO_AUTO_GC_CONFIG)
+      args.push("-c", setting);
+    const git = simpleGit2({ config: [...NO_AUTO_GC_CONFIG], errors: failOnSignalExit });
+    git.env({
+      ...isNetworkRemoteUrl(remoteUrl) ? gitNetworkChildEnv() : gitChildEnv({}),
+      GIT_CEILING_DIRECTORIES: path17.dirname(targetPath)
+    });
+    const before = await dirState(targetPath);
+    try {
+      await git.clone(remoteUrl, targetPath, args);
+    } catch (err) {
+      if (before === "occupied")
+        throw err;
+      canopyLogWarn(`[canopy] clone into ${targetPath} failed, retrying once: ` + redactCredentials(getErrorMessage(err)));
+      await fs15.rm(targetPath, { recursive: true, force: true });
+      if (before === "empty")
+        await fs15.mkdir(targetPath);
+      await git.clone(remoteUrl, targetPath, args);
+    }
+    log7.debug("git", "Clone complete");
   }
   /**
    * Initializes a local bare git repository to simulate a remote for dev mode,
@@ -5353,15 +6155,15 @@ var GitManager = class _GitManager {
   static async ensureLocalSimulatedRemote(options) {
     const existingLock = remoteInitLocks.get(options.remotePath);
     if (existingLock) {
-      log5.debug("git", "Waiting for existing remote initialization", {
+      log7.debug("git", "Waiting for existing remote initialization", {
         remotePath: options.remotePath
       });
       await existingLock;
     }
-    const lockPromise = log5.timed("git", "ensureLocalSimulatedRemote", async () => {
+    const lockPromise = log7.timed("git", "ensureLocalSimulatedRemote", async () => {
       let releaseLock;
       try {
-        log5.debug("git", "Initializing local simulated remote", {
+        log7.debug("git", "Initializing local simulated remote", {
           remotePath: options.remotePath,
           baseBranch: options.baseBranch
         });
@@ -5369,14 +6171,26 @@ var GitManager = class _GitManager {
         releaseLock = await acquireProvisioningLock(remoteParent, ".remote-init.lock");
         let remoteExists = false;
         try {
-          const stat = await fs16.stat(options.remotePath);
+          const stat = await fs15.stat(options.remotePath);
           remoteExists = stat.isDirectory();
         } catch (err) {
           if (!isNotFoundError(err))
             throw err;
         }
+        if (remoteExists) {
+          try {
+            const repack = await repackBareRemoteIfNeeded(options.remotePath);
+            if (repack.repacked)
+              log7.debug("git", "Repacked local simulated remote", repack);
+          } catch (err) {
+            log7.debug("git", "Could not repack local simulated remote", {
+              error: getErrorMessage(err)
+            });
+          }
+        }
         if (remoteExists && await _GitManager.bareRemoteHasBranch(options.remotePath, options.baseBranch)) {
-          log5.debug("git", "Remote already has base branch, skipping");
+          log7.debug("git", "Remote already has base branch, skipping");
+          await ensureRemoteGitConfig(options.remotePath);
           return;
         }
         let gitRoot = options.sourcePath;
@@ -5395,8 +6209,8 @@ var GitManager = class _GitManager {
         }
         let hasCommits = false;
         try {
-          const log8 = await sourceGit.log(["-1"]);
-          hasCommits = log8.total > 0;
+          const log9 = await sourceGit.log(["-1"]);
+          hasCommits = log9.total > 0;
         } catch {
           hasCommits = false;
         }
@@ -5408,12 +6222,12 @@ var GitManager = class _GitManager {
           throw new Error(`Cannot initialize local simulated remote: base branch '${options.baseBranch}' does not exist locally. Please checkout '${options.baseBranch}' first or provide an explicit remoteUrl.`);
         }
         if (remoteExists) {
-          log5.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
+          log7.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
             remotePath: options.remotePath,
             baseBranch: options.baseBranch
           });
         } else {
-          log5.debug("git", "Creating bare remote repository");
+          log7.debug("git", "Creating bare remote repository");
           await simpleGit2().raw([
             "init",
             "--bare",
@@ -5421,19 +6235,20 @@ var GitManager = class _GitManager {
             options.remotePath
           ]);
         }
+        await ensureRemoteGitConfig(options.remotePath);
         await _GitManager.pushBranchToLocalRemote({
           sourceGit,
           remotePath: options.remotePath,
           baseBranch: options.baseBranch,
           subdirectory: options.subdirectory
         });
-        log5.debug("git", "Remote initialization complete");
+        log7.debug("git", "Remote initialization complete");
       } finally {
         if (releaseLock) {
           try {
             await releaseLock();
           } catch (err) {
-            log5.debug("git", "Failed to release remote-init lock", { err });
+            log7.debug("git", "Failed to release remote-init lock", { err });
           }
         }
         remoteInitLocks.delete(options.remotePath);
@@ -5501,7 +6316,7 @@ var GitManager = class _GitManager {
    * deleteBranchHandler: a head left in `remote.git` forever makes the
    * create -> publish -> squash-merge -> delete -> reuse-the-name cycle reject
    * the reused branch's first publish non-fast-forward against the stale head
-   * (`GitManager.push()` pushes `branch:branch`, and a squash-merged old tip is
+   * (`GitManager.push()` pushes the branch to the same name, and a squash-merged old tip is
    * not an ancestor of the new branch), and a retried submit then skips the
    * local push on a clean tree and enqueues the worker push of the STALE head,
    * resurrecting the deleted branch's content on GitHub as an apparent success.
@@ -5601,7 +6416,7 @@ var GitManager = class _GitManager {
    */
   static async validateGitRepoExists(repoPath) {
     try {
-      const stat = await fs16.stat(path17.join(repoPath, ".git"));
+      const stat = await fs15.stat(path17.join(repoPath, ".git"));
       if (!stat.isDirectory()) {
         throw new Error(`Expected git repo at ${repoPath}`);
       }
@@ -5632,6 +6447,12 @@ var GitManager = class _GitManager {
       return;
     throw new Error(`CanopyCMS: refusing to use a network remote URL in prod mode (from ${source}: "${url}"). The standard AWS Lambda+EC2-worker topology runs the CMS Lambda with no internet access \u2014 the EC2 worker owns all network git I/O, and the Lambda is expected to reach the EFS-local bare repo ({workspace}/remote.git) via auto-detect instead. Pointing a network URL here would make the internet-less Lambda try to clone/fetch/push it directly and hang until timeout. If this prod host genuinely has internet access and intentionally runs git against a network remote (e.g. a single-VM deployment), set config.allowNetworkRemoteInProd: true to acknowledge this.`);
   }
+  /** The not-ready error for a mode whose remote is auto-detected, or `undefined` for other modes. */
+  static async remoteNotReadyError(mode) {
+    const { operatingStrategy: operatingStrategy2 } = await Promise.resolve().then(() => (init_operating_mode(), operating_mode_exports));
+    const { autoDetectRemotePath } = operatingStrategy2(mode).getRemoteUrlConfig();
+    return autoDetectRemotePath ? new RemoteNotReadyError(autoDetectRemotePath) : void 0;
+  }
   /**
    * Resolves the remote URL for git operations following the priority:
    * 1. Explicit remoteUrl parameter
@@ -5666,9 +6487,9 @@ var GitManager = class _GitManager {
     }
     if (config.autoDetectRemotePath) {
       try {
-        const stat = await fs16.stat(config.autoDetectRemotePath);
+        const stat = await fs15.stat(config.autoDetectRemotePath);
         if (stat.isDirectory()) {
-          log5.debug("git", "Auto-detected local remote", {
+          log7.debug("git", "Auto-detected local remote", {
             path: config.autoDetectRemotePath
           });
           return config.autoDetectRemotePath;
@@ -5691,6 +6512,31 @@ var GitManager = class _GitManager {
     }
     return void 0;
   }
+  /**
+   * {@link resolveRemoteUrl} for a workspace about to be cloned, which needs a
+   * remote: none resolving is the worker-not-ready error in a mode whose
+   * remote the worker creates, and a configuration error otherwise.
+   */
+  static async resolveCloneRemoteUrl(options) {
+    const remoteUrl = await _GitManager.resolveRemoteUrl(options);
+    if (remoteUrl)
+      return remoteUrl;
+    const notReady = await _GitManager.remoteNotReadyError(options.mode);
+    if (notReady)
+      throw notReady;
+    throw new Error("CanopyCMS: defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is required to initialize workspace");
+  }
+  /**
+   * {@link cloneRepo} for a workspace, failing with one message that names the
+   * workspace, the remote and the base branch, which git's own error mixes.
+   */
+  static async cloneWorkspace(remoteUrl, workspacePath, baseBranch, options) {
+    try {
+      await _GitManager.cloneRepo(remoteUrl, workspacePath, baseBranch, options);
+    } catch (err) {
+      throw new Error(`Failed to clone branch workspace at ${workspacePath} from ${remoteUrl} (base branch '${baseBranch}'): ${getErrorMessage(err)}`);
+    }
+  }
   /**
    * Check whether a git repository is already initialized at `workspacePath`.
    *
@@ -5730,21 +6576,24 @@ var GitManager = class _GitManager {
     if (!repoExists) {
       const gitPath = path17.join(options.workspacePath, ".git");
       try {
-        const stat = await fs16.stat(gitPath);
+        const stat = await fs15.stat(gitPath);
         if (stat.isDirectory()) {
-          log5.debug("git", "Removing corrupt .git directory", {
+          log7.debug("git", "Removing corrupt .git directory", {
             workspacePath: options.workspacePath
           });
-          await fs16.rm(gitPath, { recursive: true });
+          await fs15.rm(gitPath, { recursive: true });
         }
       } catch (cleanupErr) {
         if (!isNotFoundError(cleanupErr))
           throw cleanupErr;
       }
     }
+    const step = (name, run) => options.provisionLog ? options.provisionLog.step(name, run) : run();
+    const identity = managedWorkspaceConfig(options.gitBotAuthorName, options.gitBotAuthorEmail);
     let justCloned = false;
+    let resolvedRemoteUrl;
     if (!repoExists) {
-      const remoteUrl = await _GitManager.resolveRemoteUrl({
+      const remoteUrl = await _GitManager.resolveCloneRemoteUrl({
         mode: options.mode,
         remoteUrl: options.remoteUrl,
         defaultRemoteUrl: options.defaultRemoteUrl,
@@ -5752,20 +6601,13 @@ var GitManager = class _GitManager {
         sourceRoot: options.sourceRoot,
         allowNetworkRemoteInProd: options.allowNetworkRemoteInProd
       });
-      if (!remoteUrl) {
-        throw new Error("CanopyCMS: defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is required to initialize workspace");
-      }
-      try {
-        await _GitManager.cloneRepo(remoteUrl, options.workspacePath, baseBranch);
-      } catch (err) {
-        throw new Error(`Failed to clone branch workspace at ${options.workspacePath} from ${remoteUrl} (base branch '${baseBranch}'): ${getErrorMessage(err)}`);
-      }
+      await step("clone", () => _GitManager.cloneWorkspace(remoteUrl, options.workspacePath, baseBranch, {
+        remoteName,
+        noCheckout: options.branchType === "content",
+        config: identity
+      }));
       justCloned = true;
-      const freshGit = simpleGit2({ baseDir: options.workspacePath });
-      freshGit.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(options.workspacePath) }));
-      await freshGit.addConfig("canopycms.managed", "true");
-      await freshGit.addConfig("user.name", options.gitBotAuthorName);
-      await freshGit.addConfig("user.email", options.gitBotAuthorEmail);
+      resolvedRemoteUrl = remoteUrl;
     }
     const git = new _GitManager({
       repoPath: options.workspacePath,
@@ -5773,32 +6615,38 @@ var GitManager = class _GitManager {
       remote: remoteName,
       skipIndexMarker: options.branchType === "orphan"
     });
-    await git.git.addConfig("canopycms.managed", "true");
-    await git.git.addConfig("user.name", options.gitBotAuthorName);
-    await git.git.addConfig("user.email", options.gitBotAuthorEmail);
-    log5.debug("git", "Marked workspace as CanopyCMS-managed", {
-      workspacePath: options.workspacePath
-    });
     if (!justCloned) {
-      const remoteUrl = await _GitManager.resolveRemoteUrl({
-        mode: options.mode,
-        remoteUrl: options.remoteUrl,
-        defaultRemoteUrl: options.defaultRemoteUrl,
-        baseBranch,
-        sourceRoot: options.sourceRoot,
-        allowNetworkRemoteInProd: options.allowNetworkRemoteInProd
+      await step("config", async () => {
+        await git.ensureLocalConfig(identity);
+        const remoteUrl = await _GitManager.resolveRemoteUrl({
+          mode: options.mode,
+          remoteUrl: options.remoteUrl,
+          defaultRemoteUrl: options.defaultRemoteUrl,
+          baseBranch,
+          sourceRoot: options.sourceRoot,
+          allowNetworkRemoteInProd: options.allowNetworkRemoteInProd
+        });
+        if (remoteUrl) {
+          await git.ensureRemote(remoteUrl);
+        }
+        resolvedRemoteUrl = remoteUrl;
       });
-      if (remoteUrl) {
-        await git.ensureRemote(remoteUrl);
-      }
     }
     if (options.branchType === "orphan") {
-      await git.createOrphanSettingsBranch(options.branchName, {});
-      await git.ensureGitExclude("*.lock");
+      try {
+        await step("checkout", () => git.createOrphanSettingsBranch(options.branchName, {}));
+      } catch (err) {
+        if (err instanceof SettingsRemoteUnreadableError && !resolvedRemoteUrl) {
+          throw await _GitManager.remoteNotReadyError(options.mode) ?? err;
+        }
+        throw err;
+      }
+      await step("exclude", () => git.ensureGitExclude("*.lock"));
     } else {
-      await git.checkoutBranch(options.branchName);
-      if (options.gitExcludePattern) {
-        await git.ensureGitExclude(options.gitExcludePattern);
+      await step("checkout", () => justCloned ? git.checkoutFreshClone(options.branchName) : git.checkoutBranch(options.branchName));
+      const pattern = options.gitExcludePattern;
+      if (pattern) {
+        await step("exclude", () => git.ensureGitExclude(pattern));
       }
     }
     return git;
@@ -5840,6 +6688,21 @@ var GitManager = class _GitManager {
       await this.invalidateContentIndexes();
     }
   }
+  /**
+   * The one checkout of a `--no-checkout` clone, which has the base branch
+   * and its remote-tracking ref and nothing else, so neither the branch
+   * listing nor the fetch that {@link checkoutBranch} starts with is needed.
+   * The missing index makes git populate the whole tree, even for the base
+   * branch HEAD already names.
+   */
+  async checkoutFreshClone(branch) {
+    const target = branch === this.baseBranch ? ["checkout", branch] : ["checkout", "-b", branch, `${this.remote}/${this.baseBranch}`];
+    try {
+      await this.git.raw([...PARALLEL_CHECKOUT_ARGS, ...target]);
+    } finally {
+      await this.invalidateContentIndexes();
+    }
+  }
   async checkoutBranchInner(branch) {
     const branches = await this.git.branch();
     if (branches.all.includes(branch)) {
@@ -5902,7 +6765,7 @@ var GitManager = class _GitManager {
     const branches = await this.git.branch();
     const currentBranch = branches.current;
     try {
-      await this.git.fetch(this.remote, currentBranch);
+      await this.git.fetch(this.remote, `refs/heads/${currentBranch}`);
     } catch (err) {
       if (!isMissingRemoteRefFailure(getErrorMessage(err)))
         throw err;
@@ -5955,23 +6818,46 @@ var GitManager = class _GitManager {
       throw err;
     }
   }
+  /** `--sparse` stages a named path outside a sparse clone's cone (branch-sparse.ts). */
   async add(files) {
     const fileArray = Array.isArray(files) ? files : [files];
-    await this.git.add(fileArray);
+    await this.git.raw(["add", "--sparse", "--", ...fileArray]);
+  }
+  /**
+   * Restrict the working tree to `dirs` in cone mode, which always keeps the root-level files.
+   * Runs before a `--no-checkout` clone's one checkout, which invalidates the content caches.
+   */
+  async setSparseCone(dirs) {
+    await this.git.raw(["sparse-checkout", "set", "--cone", "--", ...dirs]);
+  }
+  /** Stage every working-tree change except canopycms's own state. See {@link stageAllExceptCanopyState}. */
+  async addAllExceptCanopyState() {
+    await stageAllExceptCanopyState(this.git);
   }
   async commit(message) {
     await this.git.commit(message);
   }
   async push(branch) {
-    const target = branch ?? await this.git.revparse(["--abbrev-ref", "HEAD"]);
+    const target = branch ?? await this.currentBranchName();
     await this.git.raw([
       "push",
       "--set-upstream",
       "--end-of-options",
       this.remote,
-      `${target}:${target}`
+      `refs/heads/${target}:refs/heads/${target}`
     ]);
   }
+  /**
+   * The checked-out branch's plain name. `rev-parse --abbrev-ref HEAD` prints
+   * `heads/<name>` when a same-named tag exists, which is not a branch name.
+   */
+  async currentBranchName() {
+    const branches = await this.git.branch();
+    if (branches.detached || !branches.current) {
+      throw new Error(`CanopyCMS: no branch is checked out (detached HEAD) in ${this.repoPath}`);
+    }
+    return branches.current;
+  }
   /**
    * Whether the local branch has commits the remote mirror doesn't -- i.e.
    * whether push() would move the remote ref forward.
@@ -5990,12 +6876,12 @@ var GitManager = class _GitManager {
    * ("couldn't find remote ref"); that counts as "ahead", not an error.
    */
   async hasUnpushedCommits(branch) {
-    const target = branch ?? await this.git.revparse(["--abbrev-ref", "--end-of-options", "HEAD"]);
-    const localSha = (await this.git.revparse(["--end-of-options", target])).trim();
+    const target = branch ?? await this.git.revparse(["--verify", "--abbrev-ref", "--end-of-options", "HEAD"]);
+    const localSha = (await this.git.revparse(["--verify", "--end-of-options", target])).trim();
     let fetchedTip;
     try {
       await this.git.raw(["fetch", "--end-of-options", this.remote, target]);
-      fetchedTip = (await this.git.revparse(["--end-of-options", "FETCH_HEAD"])).trim();
+      fetchedTip = (await this.git.revparse(["--verify", "--end-of-options", "FETCH_HEAD"])).trim();
     } catch {
       return true;
     }
@@ -6004,6 +6890,25 @@ var GitManager = class _GitManager {
     const aheadCount = (await this.git.raw(["rev-list", "--count", `${fetchedTip}..${localSha}`])).trim();
     return aheadCount !== "0";
   }
+  /**
+   * Repo-relative paths that differ between HEAD and its merge base with the
+   * base branch: everything the branch changes, across all of its commits.
+   * Diffs against the just-fetched base tip pinned to a SHA — the pullBaseInner
+   * constraint.
+   */
+  async listChangedPathsSinceBase() {
+    await this.git.raw(["fetch", "--end-of-options", this.remote, this.baseBranch]);
+    const baseTip = (await this.git.revparse(["--verify", "--end-of-options", "FETCH_HEAD"])).trim();
+    const output = await this.git.raw([
+      "diff",
+      "--name-only",
+      "-z",
+      "--no-renames",
+      `${baseTip}...HEAD`,
+      "--"
+    ]);
+    return output.split("\0").filter((p) => p.length > 0);
+  }
   async ensureAuthor(author) {
     const config = await this.git.listConfig();
     const isManaged = config.all["canopycms.managed"] === "true";
@@ -6019,6 +6924,14 @@ var GitManager = class _GitManager {
       await this.git.addConfig("user.email", author.email);
     }
   }
+  /** Writes each key into this repo's own config only where it differs. */
+  async ensureLocalConfig(values) {
+    const local = await this.git.listConfig("local");
+    for (const [key, value] of Object.entries(values)) {
+      if (local.all[key] !== value)
+        await this.git.addConfig(key, value);
+    }
+  }
   async ensureRemote(remoteUrl) {
     const config = await this.git.listConfig();
     const isManaged = config.all["canopycms.managed"] === "true";
@@ -6057,10 +6970,24 @@ var GitManager = class _GitManager {
     await ensureGitExcludePattern(this.repoPath, pattern);
   }
   /**
-   * Create an orphan branch (no shared history) for settings, so
-   * deployment-specific settings never pollute content history. It holds only
-   * settings files committed by explicit path (permissions.json, groups.json at
-   * the workspace root).
+   * Put the workspace on the settings branch: an orphan (no shared history),
+   * so deployment-specific settings never pollute content history. It holds
+   * only settings files committed by explicit path (permissions.json,
+   * groups.json at the workspace root).
+   *
+   * The remote is the settings branch's durable copy, and the workspace clone
+   * is `--single-branch` at the base branch, so the remote is asked first:
+   * - no local branch: check out the remote's, or create an empty orphan only
+   *   when the remote has none. An unreadable remote throws
+   *   {@link SettingsRemoteUnreadableError} rather than guess "none".
+   * - local branch present: a history unrelated to the remote's is repaired
+   *   onto the remote's when the local branch is still its empty initial
+   *   commit with a clean working tree, and otherwise throws
+   *   {@link SettingsBranchDivergedError}; local commits are never discarded.
+   *   An unreadable remote throws only for that empty branch, since one that
+   *   holds settings can serve them and the next save surfaces the remote error.
+   * Either way a remote branch holding content is never adopted:
+   * {@link SettingsBranchHasContentHistoryError}.
    */
   async createOrphanSettingsBranch(branchName, initialFiles) {
     try {
@@ -6070,56 +6997,709 @@ var GitManager = class _GitManager {
     }
   }
   async createOrphanSettingsBranchInner(branchName, initialFiles) {
-    log5.debug("git", "Creating orphan settings branch", { branchName });
+    log7.debug("git", "Ensuring settings branch", { branchName });
     const branches = await this.git.branch();
-    if (branches.all.includes(branchName)) {
-      log5.debug("git", "Orphan branch already exists", { branchName });
+    const localExists = branches.all.includes(branchName);
+    if (localExists) {
       await this.git.checkout(branchName);
+    }
+    let remoteTip;
+    try {
+      remoteTip = await this.remoteBranchTip(branchName);
+    } catch (err) {
+      if (localExists && !await this.isEmptyInitialBranch(branchName)) {
+        log7.debug("git", "Remote unreadable; serving the local settings branch", { branchName });
+        return;
+      }
+      throw new SettingsRemoteUnreadableError(branchName, this.remote, err);
+    }
+    if (localExists) {
+      await this.reconcileLocalSettingsBranch(branchName, remoteTip);
+      return;
+    }
+    if (remoteTip) {
+      const fetchedTip = await this.fetchBranchTip(branchName);
+      await this.assertNotContentHistory(branchName, fetchedTip);
+      await this.git.raw(["checkout", "-b", branchName, fetchedTip]);
+      log7.debug("git", "Checked out the remote settings branch", { branchName });
       return;
     }
     await this.git.raw(["checkout", "--orphan", branchName]);
-    try {
-      await this.git.raw(["rm", "-rf", "."]);
-    } catch {
+    await this.git.raw(["rm", "-r", "-f", "-q", "--sparse", "--ignore-unmatch", "--", "."]);
+    const leftover = (await this.git.raw(["ls-files"])).trim();
+    if (leftover) {
+      throw new Error(`Settings branch '${branchName}' was not created: the base branch's files (${leftover.split("\n").slice(0, 3).join(", ")}) stayed in its index`);
     }
     for (const [filePath, content] of Object.entries(initialFiles)) {
       const absolutePath = path17.join(this.repoPath, filePath);
-      await fs16.mkdir(path17.dirname(absolutePath), { recursive: true });
-      await fs16.writeFile(absolutePath, content, "utf-8");
+      await fs15.mkdir(path17.dirname(absolutePath), { recursive: true });
+      await fs15.writeFile(absolutePath, content, "utf-8");
       await this.git.add(filePath);
     }
     await this.git.commit("Initialize settings branch", ["--allow-empty"]);
-    log5.debug("git", "Orphan settings branch created", { branchName });
+    log7.debug("git", "Orphan settings branch created", { branchName });
+  }
+  /**
+   * Compares the checked-out local settings branch with the remote's tip.
+   * Related histories are left for the next settings pull to reconcile; only
+   * an unrelated one is acted on here.
+   */
+  async reconcileLocalSettingsBranch(branchName, remoteTip) {
+    if (!remoteTip)
+      return;
+    const localTip = (await this.git.revparse([`refs/heads/${branchName}`])).trim();
+    if (localTip === remoteTip)
+      return;
+    const fetchedTip = await this.fetchBranchTip(branchName);
+    const [localRoots, remoteRoots] = await Promise.all([
+      this.rootCommits(localTip),
+      this.rootCommits(fetchedTip)
+    ]);
+    if (localRoots.some((root) => remoteRoots.includes(root)))
+      return;
+    const localWork = [];
+    if (!await this.isEmptyInitialBranch(branchName)) {
+      localWork.push("commits beyond its empty initial commit");
+    }
+    const uncommitted = await this.getUncommittedFiles();
+    if (uncommitted.length > 0) {
+      localWork.push(`uncommitted changes to ${uncommitted.join(", ")}`);
+    }
+    if (localWork.length > 0) {
+      throw new SettingsBranchDivergedError(branchName, this.repoPath, localWork.join(" and "));
+    }
+    await this.assertNotContentHistory(branchName, fetchedTip);
+    await this.git.raw(["checkout", "-B", branchName, fetchedTip]);
+    log7.debug("git", "Replaced an empty settings branch with the remote one", { branchName });
+  }
+  /**
+   * The remote's tip for `branch`, or `undefined` when the remote has no such
+   * branch. A remote that cannot be read throws: `ls-remote` exits 0 with no
+   * output only for a reachable remote without the ref.
+   */
+  async remoteBranchTip(branch) {
+    const ref = `refs/heads/${branch}`;
+    const output = await this.git.raw(["ls-remote", "--heads", this.remote, ref]);
+    for (const line of output.split("\n")) {
+      const [sha, name] = line.trim().split("	");
+      if (sha && name === ref)
+        return sha;
+    }
+    return void 0;
+  }
+  /**
+   * Fetch `branch` from the remote and return the fetched commit, pinned as
+   * pullBaseInner explains. The full ref: a bare name resolves to a
+   * same-named tag first.
+   */
+  async fetchBranchTip(branch) {
+    await this.git.fetch(this.remote, `refs/heads/${branch}`);
+    return (await this.git.revparse(["FETCH_HEAD"])).trim();
+  }
+  /**
+   * Refuse to adopt a remote settings branch that holds content: its tip has a file other than
+   * the settings files, or its roots include the base branch's (a settings branch is an orphan).
+   * Neither alone suffices: a base can have a root of its own, and a content tree can be pruned.
+   * The base comes from the remote when the clone lacks it (it was cloned at an earlier base).
+   */
+  async assertNotContentHistory(branchName, tip) {
+    const tree = await this.git.raw(["ls-tree", "-r", "--name-only", tip]);
+    const strays = tree.split("\n").filter((file) => file && !SETTINGS_BRANCH_FILES.has(file));
+    if (strays.length > 0) {
+      const shown = strays.slice(0, 3).join(", ") + (strays.length > 3 ? ", \u2026" : "");
+      throw new SettingsBranchHasContentHistoryError(branchName, this.remote, `it holds ${shown}`);
+    }
+    const [tipRoots, baseRoots] = await Promise.all([
+      this.rootCommits(tip),
+      this.baseBranchRev(branchName).then((rev) => this.rootCommits(rev))
+    ]);
+    if (tipRoots.some((root) => baseRoots.includes(root))) {
+      throw new SettingsBranchHasContentHistoryError(branchName, this.remote, `it shares history with the base branch '${this.baseBranch}'`);
+    }
+  }
+  async baseBranchRev(settingsBranch) {
+    for (const ref of [
+      `refs/heads/${this.baseBranch}`,
+      `refs/remotes/${this.remote}/${this.baseBranch}`
+    ]) {
+      const sha = await this.git.raw(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).catch(() => "");
+      if (sha.trim())
+        return sha.trim();
+    }
+    try {
+      return await this.fetchBranchTip(this.baseBranch);
+    } catch (err) {
+      throw new Error(`CanopyCMS: could not read base branch '${this.baseBranch}' from remote '${this.remote}', so settings branch '${settingsBranch}' was not checked out: ${getErrorMessage(err)}`);
+    }
+  }
+  async rootCommits(rev) {
+    const output = await this.git.raw(["rev-list", "--max-parents=0", rev]);
+    return output.split("\n").filter(Boolean);
+  }
+  /**
+   * Whether `branch` is a single parentless commit with an empty tree, as
+   * orphan creation leaves it. Full refs throughout: a bare name resolves to a
+   * same-named tag first, and clones fetch tags.
+   */
+  async isEmptyInitialBranch(branch) {
+    const ref = `refs/heads/${branch}`;
+    const commits = await this.git.raw(["rev-list", "--max-count=2", ref]);
+    if (commits.split("\n").filter(Boolean).length !== 1)
+      return false;
+    const tree = await this.git.raw(["ls-tree", ref]);
+    return tree.trim() === "";
+  }
+};
+
+// dist/branch-provisioning.js
+init_logger();
+var PUBLISH_LOCK_WAIT_MS = 8e3;
+var CREATE_RESIDUE_MIN_QUIET_MS = 6e4;
+var STAGING_MAX_AGE_MS = 20 * 6e4;
+var REPAIR_MAX_AGE_MS = 20 * 6e4;
+var DELETING_MAX_AGE_MS = 10 * 6e4;
+var SETTINGS_TRASH_MAX_AGE_MS = 30 * 24 * 60 * 6e4;
+var BranchProvisioningBusyError = class extends Error {
+  constructor(dirName, message = `Branch '${dirName}' is still being set up. Try again in a minute.`) {
+    super(message);
+    this.dirName = dirName;
+    this.name = "BranchProvisioningBusyError";
+  }
+};
+var BranchDirOccupiedError = class extends Error {
+  constructor(dirName) {
+    super(`A directory named '${dirName}' already exists in the branch workspace and holds a git repository this deployment did not create. It was left untouched; an admin can purge it from System Health, or choose another branch name.`);
+    this.dirName = dirName;
+    this.name = "BranchDirOccupiedError";
+  }
+};
+function formatDirStamp(date) {
+  return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
+}
+function shortDirName(dirName) {
+  const digest = createHash("sha1").update(dirName).digest("hex").slice(0, 10);
+  return `${dirName.slice(0, 40)}-${digest}`;
+}
+function stampedName(prefix, dirName, now) {
+  return `${prefix}${shortDirName(dirName)}-${randomBytes(3).toString("hex")}-${formatDirStamp(now)}`;
+}
+var STAGING_PREFIX = ".prov-";
+var REPAIR_PREFIX = ".repair-";
+var TRASH_PREFIX = ".trash-";
+var stagingDirName = (dirName, now = /* @__PURE__ */ new Date()) => stampedName(STAGING_PREFIX, dirName, now);
+var NO_GIT = { hasGitDir: false, configLock: false, hasIndex: false };
+async function listDir(dirPath) {
+  try {
+    return await fs16.readdir(dirPath);
+  } catch (err) {
+    if (isNodeError(err) && (err.code === "ENOENT" || err.code === "ENOTDIR"))
+      return null;
+    throw err;
+  }
+}
+function gitConfigRemoteUrls(text) {
+  const urls = [];
+  let inRemote = false;
+  for (const raw of text.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("[")) {
+      inRemote = /^\[\s*remote\s+"[^"]*"\s*\]/i.test(line);
+      continue;
+    }
+    const match = inRemote ? /^url\s*=\s*(.*)$/i.exec(line) : null;
+    if (match)
+      urls.push(match[1].trim().replace(/^"(.*)"$/, "$1"));
+  }
+  return urls;
+}
+function sameRemote(url, expected) {
+  if (isNetworkRemoteUrl(url) || isNetworkRemoteUrl(expected))
+    return url === expected;
+  const local = (value) => path18.resolve(value.replace(/^file:\/\//i, ""));
+  return local(url) === local(expected);
+}
+async function classifyFinalDir(dirPath, expectedRemoteUrl) {
+  let stat;
+  try {
+    stat = await fs16.lstat(dirPath);
+  } catch (err) {
+    if (isNotFoundError(err))
+      return { kind: "vacant" };
+    throw err;
+  }
+  if (!stat.isDirectory())
+    return { kind: "residue", signature: NO_GIT };
+  const metaEntries = await listDir(path18.join(dirPath, BRANCH_META_DIR)) ?? [];
+  if (metaEntries.includes(BRANCH_META_FILE)) {
+    try {
+      return await readBranchMetadataFile(dirPath) ? { kind: "live" } : { kind: "protected" };
+    } catch (err) {
+      if (err instanceof BranchMetadataCorruptError)
+        return { kind: "corrupt" };
+      throw err;
+    }
+  }
+  if (metaEntries.some((name) => name.startsWith(`${BRANCH_META_FILE}.corrupt-`))) {
+    return { kind: "protected" };
+  }
+  const gitPath = path18.join(dirPath, ".git");
+  let gitStat;
+  try {
+    gitStat = await fs16.lstat(gitPath);
+  } catch (err) {
+    if (isNotFoundError(err))
+      return { kind: "residue", signature: NO_GIT };
+    throw err;
+  }
+  if (!gitStat.isDirectory())
+    return { kind: "foreign" };
+  const gitEntries = await listDir(gitPath) ?? [];
+  const signature = {
+    hasGitDir: true,
+    configLock: gitEntries.includes("config.lock"),
+    hasIndex: gitEntries.includes("index")
+  };
+  let config;
+  try {
+    config = await fs16.readFile(path18.join(gitPath, "config"), "utf8");
+  } catch {
+    return { kind: "residue", signature };
+  }
+  return gitConfigRemoteUrls(config).some((url) => sameRemote(url, expectedRemoteUrl)) ? { kind: "residue", signature } : { kind: "foreign" };
+}
+async function quietAgeMs(dirPath, now = Date.now()) {
+  const mtimes = await Promise.all(["", ".git", BRANCH_META_DIR].map((sub) => fs16.lstat(path18.join(dirPath, sub)).then((stat) => stat.mtimeMs, () => 0)));
+  return now - Math.max(...mtimes);
+}
+async function quarantineResidueAt(baseRoot, dirName, options) {
+  const finalPath = path18.join(baseRoot, dirName);
+  let inode;
+  try {
+    inode = (await fs16.lstat(finalPath)).ino;
+  } catch (err) {
+    if (isNotFoundError(err))
+      return { kind: "vacant" };
+    throw err;
+  }
+  const candidateName = stampedName(REPAIR_PREFIX, dirName, /* @__PURE__ */ new Date());
+  const candidate = path18.join(baseRoot, candidateName);
+  try {
+    await fs16.rename(finalPath, candidate);
+  } catch (err) {
+    if (isNotFoundError(err))
+      return { kind: "vacant" };
+    throw err;
+  }
+  const moveBack = async (why) => {
+    try {
+      await fs16.rename(candidate, finalPath);
+    } catch (err) {
+      canopyLogError(`[canopy] Could not move '${dirName}' back from ${candidateName} after ${why}: ${getErrorMessage(err)}. The worker's sweep restores or trashes it.`);
+    }
+  };
+  const { state, quiet, reason } = await judgeQuarantineCandidate(candidate, inode, options).catch(async (err) => {
+    await moveBack(`failing to judge it (${getErrorMessage(err)})`);
+    throw err;
+  });
+  if (reason === void 0 && state.kind === "residue") {
+    const trashName = stampedName(TRASH_PREFIX, dirName, /* @__PURE__ */ new Date());
+    await fs16.rename(candidate, path18.join(baseRoot, trashName));
+    const { hasGitDir, configLock, hasIndex } = state.signature;
+    canopyLogWarn(`[canopy] Quarantined unfinished branch directory '${dirName}' as ${trashName} (git=${hasGitDir} config.lock=${configLock} index=${hasIndex} quiet=${Math.round(quiet / 1e3)}s)`);
+    return { kind: "quarantined", trashName };
+  }
+  await moveBack(`declining to quarantine it (${reason})`);
+  return { kind: "kept", reason: reason ?? "replaced" };
+}
+async function judgeQuarantineCandidate(candidate, inode, options) {
+  const state = await classifyFinalDir(candidate, options.expectedRemoteUrl);
+  const moved = await fs16.lstat(candidate).catch(() => null);
+  const quiet = await quietAgeMs(candidate, options.now);
+  let reason;
+  if (!moved || moved.ino !== inode)
+    reason = "replaced";
+  else if (state.kind === "vacant")
+    reason = "replaced";
+  else if (state.kind !== "residue")
+    reason = state.kind;
+  else if (quiet < options.minQuietMs)
+    reason = "too-young";
+  return { state, quiet, reason };
+}
+async function removeLeftoverDir(dirPath) {
+  try {
+    await fs16.rm(dirPath, { recursive: true, force: true, maxRetries: 3, retryDelay: 100 });
+  } catch (err) {
+    canopyLogWarn(`[canopy] Could not remove ${dirPath}; the worker sweeps it: ${getErrorMessage(err)}`);
+  }
+}
+async function hasBranchMetadata(branchRoot) {
+  return fs16.access(path18.join(branchRoot, BRANCH_META_DIR, BRANCH_META_FILE)).then(() => true, () => false);
+}
+async function stageBranchWorkspace(options) {
+  const { provisionLog: log9 } = options;
+  const stagingPath = path18.join(options.baseRoot, stagingDirName(options.dirName));
+  try {
+    await log9.step("clone", () => GitManager.cloneWorkspace(options.remoteUrl, stagingPath, options.baseBranch, {
+      ...options.clone,
+      noCheckout: true
+    }));
+    const git = new GitManager({
+      repoPath: stagingPath,
+      baseBranch: options.baseBranch,
+      remote: options.clone.remoteName
+    });
+    const cone = options.sparseCone;
+    if (cone)
+      await log9.step("sparse", () => git.setSparseCone(cone));
+    if (await hasBranchMetadata(path18.join(options.baseRoot, options.dirName))) {
+      await removeLeftoverDir(stagingPath);
+      return { kind: "exists" };
+    }
+    await log9.step("checkout", () => git.checkoutFreshClone(options.branchName));
+    await log9.step("exclude", () => git.ensureGitExclude(options.gitExcludePattern));
+    const written = await log9.step("metadata", () => writeOccJsonFile(path18.join(stagingPath, BRANCH_META_DIR, BRANCH_META_FILE), { ...options.metadata }, { expectedVersion: null, trailingNewline: true }));
+    return {
+      kind: "staged",
+      stagingPath,
+      meta: { ...options.metadata, version: written.version, writeId: written.writeId }
+    };
+  } catch (err) {
+    await removeLeftoverDir(stagingPath);
+    throw err;
+  }
+}
+async function lockBranchName(baseRoot, dirName) {
+  try {
+    return await acquireProvisioningLockWithin(baseRoot, branchProvisioningLockName(dirName), PUBLISH_LOCK_WAIT_MS);
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ELOCKED")
+      throw new BranchProvisioningBusyError(dirName);
+    throw err;
+  }
+}
+async function inspectBlocking(finalPath) {
+  const entries = await listDir(path18.join(finalPath, BRANCH_META_DIR)) ?? [];
+  if (entries.includes(BRANCH_META_FILE))
+    return "live";
+  if (entries.some((name) => name.startsWith(`${BRANCH_META_FILE}.corrupt-`)))
+    return "protected";
+  return "residue";
+}
+var RENAME_BLOCKED = /* @__PURE__ */ new Set(["EEXIST", "ENOTEMPTY", "ENOTDIR"]);
+async function publishStaging(options) {
+  const { baseRoot, dirName, stagingPath } = options;
+  const finalPath = path18.join(baseRoot, dirName);
+  const release = await lockBranchName(baseRoot, dirName);
+  try {
+    for (let attempt = 0; attempt < 2; attempt++) {
+      try {
+        await fs16.rename(stagingPath, finalPath);
+        return "published";
+      } catch (err) {
+        if (!isNodeError(err))
+          throw err;
+        if (err.code === "ENOENT") {
+          const meta = await readBranchMetadataFile(finalPath).catch(() => null);
+          if (meta?.writeId !== void 0 && meta.writeId === options.writeId)
+            return "published";
+          throw err;
+        }
+        if (!RENAME_BLOCKED.has(err.code ?? ""))
+          throw err;
+      }
+      const blocking = await (options.inspectBlocked ?? inspectBlocking)(finalPath);
+      if (blocking === "live")
+        return "exists";
+      if (blocking === "protected")
+        throw new BranchProvisioningBusyError(dirName);
+      const result = await quarantineResidueAt(baseRoot, dirName, {
+        minQuietMs: CREATE_RESIDUE_MIN_QUIET_MS,
+        expectedRemoteUrl: options.expectedRemoteUrl
+      });
+      if (result.kind !== "kept")
+        continue;
+      if (result.reason === "live")
+        return "exists";
+      if (result.reason === "corrupt") {
+        await readBranchMetadataFile(finalPath);
+        return "exists";
+      }
+      if (result.reason === "foreign")
+        throw new BranchDirOccupiedError(dirName);
+      throw new BranchProvisioningBusyError(dirName);
+    }
+    throw new BranchProvisioningBusyError(dirName);
+  } finally {
+    await release().catch((err) => {
+      canopyLogWarn(`[canopy] Failed to release the provisioning lock for ${dirName}:`, err);
+    });
+  }
+}
+
+// dist/branch-sparse.js
+import fs17 from "node:fs/promises";
+import path19 from "node:path";
+init_operating_mode();
+init_logger();
+function sparseConeFor(contentRoot) {
+  const root = (contentRoot ?? "content").split("/").filter((segment) => segment && segment !== ".").join("/");
+  return root ? [.../* @__PURE__ */ new Set([CANOPY_META_DIR, root])].sort() : null;
+}
+function sameCone(a, b) {
+  if (a === null || b === null)
+    return a === b;
+  const [left, right] = [[...a].sort(), [...b].sort()];
+  return left.length === right.length && left.every((dir, i) => dir === right[i]);
+}
+var SPARSE_CONE_RECORD = ".sparse-cone.json";
+function isConeDir(dir) {
+  return typeof dir === "string" && dir.length > 0 && !path19.isAbsolute(dir) && !dir.split("/").some((segment) => segment === "" || segment === "." || segment === "..");
+}
+async function readRecordedSparseCone(contentBranchesRoot) {
+  let raw;
+  try {
+    raw = await fs17.readFile(path19.join(contentBranchesRoot, SPARSE_CONE_RECORD), "utf8");
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT")
+      return void 0;
+    throw err;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+  if (typeof parsed !== "object" || parsed === null || !("cone" in parsed))
+    return void 0;
+  const { cone } = parsed;
+  if (cone === null)
+    return { cone: null };
+  return Array.isArray(cone) && cone.length > 0 && cone.every(isConeDir) ? { cone: cone.filter(isConeDir) } : void 0;
+}
+async function recordSparseCone(contentBranchesRoot, cone) {
+  const current = await readRecordedSparseCone(contentBranchesRoot);
+  if (current && sameCone(current.cone, cone))
+    return;
+  const target = path19.join(contentBranchesRoot, SPARSE_CONE_RECORD);
+  const temp = `${target}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    await fs17.writeFile(temp, `${JSON.stringify({ cone })}
+`, "utf8");
+  } catch (err) {
+    if (isNodeError(err) && err.code === "ENOENT")
+      return;
+    throw err;
+  }
+  try {
+    await fs17.rename(temp, target);
+  } catch (err) {
+    await fs17.unlink(temp).catch(() => {
+    });
+    throw err;
+  }
+}
+
+// dist/branch-workspace.js
+init_operating_mode();
+init_logger();
+
+// dist/utils/provision-log.js
+init_logger();
+import { randomBytes as randomBytes2 } from "node:crypto";
+var defaultSink = (line) => canopyLog(line);
+var sink = defaultSink;
+var ProvisionLog = class {
+  constructor(dir) {
+    this.id = randomBytes2(3).toString("hex");
+    this.startedAt = Date.now();
+    this.durations = [];
+    this.prefix = `[canopy] provision id=${this.id} dir=${dir}`;
+  }
+  async step(name, run) {
+    sink(`${this.prefix} step=${name} start`);
+    const stepStartedAt = Date.now();
+    let state = "failed";
+    try {
+      const result = await run();
+      state = "done";
+      return result;
+    } finally {
+      const ms = Date.now() - stepStartedAt;
+      this.durations.push(`${name}=${ms}`);
+      sink(`${this.prefix} step=${name} ${state} ms=${ms}`);
+    }
+  }
+  finish(outcome) {
+    const total = Date.now() - this.startedAt;
+    sink(`${this.prefix} outcome=${outcome} total=${total} ${this.durations.join(" ")}`.trim());
   }
 };
 
 // dist/branch-workspace.js
-var log6 = createDebugLogger({ prefix: "BranchWorkspace" });
-var workspaceInitLocks = /* @__PURE__ */ new Map();
+var testHooks = {};
+var provisionsInFlight = /* @__PURE__ */ new Map();
 var BranchWorkspaceManager = class {
   constructor(config) {
     this.config = config;
   }
-  async ensureGitWorkspace(options) {
-    return log6.timed("workspace", "ensureGitWorkspace", async () => {
-      const existingLock = workspaceInitLocks.get(options.branchRoot);
-      if (existingLock) {
-        await existingLock;
-        return;
+  /** The branch's context, provisioning it first when it does not exist. */
+  async openOrCreateBranch(options) {
+    return (await this.provisionBranch(options)).context;
+  }
+  /**
+   * Provision a branch workspace, or report the one already there.
+   *
+   * @throws BranchProvisioningBusyError when another process is mid-way through this branch, or
+   *   what is at its path is too fresh to judge (retriable)
+   * @throws BranchDirOccupiedError in prod, when its path holds a repository this deployment did
+   *   not create
+   * @throws BranchMetadataCorruptError when its branch.json does not parse
+   */
+  async provisionBranch(options) {
+    if (isSettingsBranchName(options.branchName, operatingStrategy(options.mode).getSettingsBranchName(this.config))) {
+      throw new BranchPathError("Settings branches are not content branches");
+    }
+    const { branchRoot, baseRoot, branchName: safeName } = resolveBranchPath(options);
+    const paths = {
+      branchRoot,
+      baseRoot,
+      dirName: path20.basename(branchRoot),
+      safeName
+    };
+    const existing = await readBranchMetadataFile(branchRoot);
+    if (existing) {
+      return { kind: "exists", context: { branch: existing.branch, branchRoot, baseRoot } };
+    }
+    const inFlight = provisionsInFlight.get(branchRoot);
+    if (inFlight)
+      return { kind: "exists", context: (await inFlight).context };
+    const run = this.provisionUnshared(options, paths);
+    provisionsInFlight.set(branchRoot, run);
+    try {
+      return await run;
+    } finally {
+      provisionsInFlight.delete(branchRoot);
+    }
+  }
+  async provisionUnshared(options, paths) {
+    const { branchRoot, baseRoot, dirName } = paths;
+    await fs18.mkdir(baseRoot, { recursive: true });
+    const baseBranch = await resolveBaseBranch({
+      defaultBaseBranch: this.config.defaultBaseBranch,
+      mode: options.mode,
+      detectFrom: this.config.sourceRoot ? path20.resolve(process.cwd(), this.config.sourceRoot) : void 0
+    });
+    const remoteUrl = await GitManager.resolveCloneRemoteUrl({
+      mode: options.mode,
+      remoteUrl: options.remoteUrl,
+      defaultRemoteUrl: this.config.defaultRemoteUrl,
+      baseBranch,
+      sourceRoot: this.config.sourceRoot,
+      allowNetworkRemoteInProd: this.config.allowNetworkRemoteInProd
+    });
+    const metadata = buildInitialBranchMetadata({
+      branch: {
+        name: paths.safeName,
+        title: options.title,
+        description: options.description,
+        access: options.access,
+        createdBy: options.createdBy,
+        baseBranch
       }
-      const lockPromise = (async () => {
-        let releaseLock;
-        try {
-          log6.debug("workspace", "Ensuring git workspace", {
-            branchName: options.branchName,
-            mode: options.mode
-          });
-          releaseLock = await acquireProvisioningLock(path18.dirname(options.branchRoot), `.${path18.basename(options.branchRoot)}.init.lock`);
+    });
+    const state = await classifyFinalDir(branchRoot, remoteUrl);
+    if (state.kind === "live" || state.kind === "corrupt")
+      return this.existing(paths);
+    if (state.kind === "protected")
+      throw new BranchProvisioningBusyError(dirName);
+    if (state.kind === "foreign") {
+      if (options.mode !== "dev")
+        throw new BranchDirOccupiedError(dirName);
+      return this.adoptInPlace(options, paths, baseBranch, metadata);
+    }
+    if (state.kind === "residue" && await this.recentlyActive(paths)) {
+      throw new BranchProvisioningBusyError(dirName);
+    }
+    const sparseCone = sparseConeFor(this.config.contentRoot);
+    await recordSparseCone(baseRoot, sparseCone).catch((err) => {
+      canopyLogWarn(`[canopy] Could not record the sparse-checkout cone: ${getErrorMessage(err)}`);
+    });
+    const provisionLog = new ProvisionLog(dirName);
+    let outcome;
+    try {
+      outcome = await this.stageAndPublish(paths, {
+        provisionLog,
+        baseBranch,
+        remoteUrl,
+        metadata,
+        mode: options.mode,
+        sparseCone
+      });
+    } catch (err) {
+      provisionLog.finish("error");
+      throw err;
+    }
+    provisionLog.finish(outcome.kind === "created" ? "ok" : "exists");
+    return outcome;
+  }
+  async stageAndPublish(paths, run) {
+    const { branchRoot, baseRoot, dirName } = paths;
+    const staged = await stageBranchWorkspace({
+      baseRoot,
+      dirName,
+      branchName: paths.safeName,
+      baseBranch: run.baseBranch,
+      remoteUrl: run.remoteUrl,
+      clone: {
+        remoteName: this.config.defaultRemoteName,
+        config: managedWorkspaceConfig(this.config.gitBotAuthorName, this.config.gitBotAuthorEmail)
+      },
+      gitExcludePattern: operatingStrategy(run.mode).getGitExcludePattern(),
+      metadata: run.metadata,
+      provisionLog: run.provisionLog,
+      sparseCone: run.sparseCone
+    });
+    if (staged.kind === "exists")
+      return this.existing(paths);
+    let published;
+    try {
+      await testHooks.beforePublish?.({ stagingPath: staged.stagingPath, finalPath: branchRoot });
+      published = await run.provisionLog.step("publish", () => publishStaging({
+        baseRoot,
+        dirName,
+        stagingPath: staged.stagingPath,
+        writeId: staged.meta.writeId,
+        expectedRemoteUrl: run.remoteUrl,
+        inspectBlocked: testHooks.inspectBlocked
+      }));
+    } finally {
+      if (published !== "published")
+        await removeLeftoverDir(staged.stagingPath);
+    }
+    if (published === "exists")
+      return this.existing(paths);
+    await run.provisionLog.step("register", () => register(paths));
+    return { kind: "created", context: { branch: staged.meta.branch, branchRoot, baseRoot } };
+  }
+  /**
+   * The one exception to [PROV-1]: a dev workspace that already holds real work is kept where it
+   * is, given branch.json under the branch's lock.
+   */
+  async adoptInPlace(options, paths, baseBranch, metadata) {
+    const { branchRoot, baseRoot, dirName } = paths;
+    const provisionLog = new ProvisionLog(dirName);
+    let created = false;
+    try {
+      const release = await provisionLog.step("lock", () => lockBranchName(baseRoot, dirName));
+      try {
+        if (!await readBranchMetadataFile(branchRoot)) {
           await GitManager.initializeWorkspace({
-            workspacePath: options.branchRoot,
-            branchName: options.branchName,
+            workspacePath: branchRoot,
+            branchName: paths.safeName,
             mode: options.mode,
-            baseBranch: options.baseBranch,
+            baseBranch,
             sourceRoot: this.config.sourceRoot,
             defaultRemoteUrl: this.config.defaultRemoteUrl,
             remoteUrl: options.remoteUrl,
@@ -6128,60 +7708,55 @@ var BranchWorkspaceManager = class {
             branchType: "content",
             gitBotAuthorName: this.config.gitBotAuthorName,
             gitBotAuthorEmail: this.config.gitBotAuthorEmail,
-            gitExcludePattern: operatingStrategy(options.mode).getGitExcludePattern()
+            gitExcludePattern: operatingStrategy(options.mode).getGitExcludePattern(),
+            provisionLog
           });
-        } finally {
-          if (releaseLock) {
-            try {
-              await releaseLock();
-            } catch (err) {
-              log6.debug("workspace", "Failed to release workspace-init lock", { err });
-            }
-          }
-          workspaceInitLocks.delete(options.branchRoot);
+          created = await provisionLog.step("metadata", () => writeOccJsonFile(path20.join(branchRoot, BRANCH_META_DIR, BRANCH_META_FILE), { ...metadata }, { expectedVersion: null, trailingNewline: true }).then(() => true, (err) => {
+            if (err instanceof OccWriteConflictError)
+              return false;
+            throw err;
+          }));
         }
-      })();
-      workspaceInitLocks.set(options.branchRoot, lockPromise);
-      await lockPromise;
-    });
-  }
-  async openOrCreateBranch(options) {
-    const { branchName, mode, basePathOverride, title, description, access, createdBy, remoteUrl } = options;
-    const { branchRoot, baseRoot, branchName: safeName } = await ensureBranchRoot({
-      mode,
-      branchName,
-      basePathOverride
-    });
-    const baseBranch = await resolveBaseBranch({
-      defaultBaseBranch: this.config.defaultBaseBranch,
-      mode,
-      detectFrom: this.config.sourceRoot ? path18.resolve(process.cwd(), this.config.sourceRoot) : void 0
-    });
-    await this.ensureGitWorkspace({
-      branchRoot,
-      branchName: safeName,
-      mode,
-      baseBranch,
-      remoteUrl
-    });
-    const metadata = getBranchMetadataFileManager(branchRoot, baseRoot);
-    const meta = await metadata.save({
-      branch: {
-        name: safeName,
-        title,
-        description,
-        access,
-        createdBy,
-        baseBranch
+      } finally {
+        await release().catch(() => {
+        });
       }
-    });
-    return {
-      branch: meta.branch,
-      branchRoot,
-      baseRoot
-    };
+      if (created)
+        await provisionLog.step("register", () => register(paths));
+    } catch (err) {
+      provisionLog.finish("error");
+      throw err;
+    }
+    provisionLog.finish(created ? "ok" : "exists");
+    if (!created)
+      return this.existing(paths);
+    const meta = await readBranchMetadataFile(branchRoot);
+    if (!meta)
+      throw new BranchProvisioningBusyError(dirName);
+    return { kind: "created", context: { branch: meta.branch, branchRoot, baseRoot } };
+  }
+  /** Whether residue at the branch path may still belong to a live process. */
+  async recentlyActive({ branchRoot, baseRoot, dirName }) {
+    const lockAgeMs = await fs18.stat(path20.join(baseRoot, branchProvisioningLockName(dirName))).then((stat) => Date.now() - stat.mtimeMs, () => Infinity);
+    if (lockAgeMs < PROVISIONING_LOCK_STALE_MS)
+      return true;
+    return await quietAgeMs(branchRoot) < CREATE_RESIDUE_MIN_QUIET_MS;
+  }
+  async existing({ branchRoot, baseRoot, dirName }) {
+    const meta = await readBranchMetadataFile(branchRoot);
+    if (!meta)
+      throw new BranchProvisioningBusyError(dirName);
+    return { kind: "exists", context: { branch: meta.branch, branchRoot, baseRoot } };
   }
 };
+async function register({ branchRoot, baseRoot }) {
+  try {
+    await invalidateBranchContentCaches(branchRoot);
+    await new BranchRegistry(baseRoot).invalidate();
+  } catch (err) {
+    canopyLogWarn(`[canopy] Registering new branch ${branchRoot} failed: ${getErrorMessage(err)}`);
+  }
+}
 async function loadOrCreateBranchContext(options) {
   if (readsFromCheckout(options.config)) {
     const cwd = process.cwd();
@@ -6239,11 +7814,11 @@ async function resolveBranchRoot(config) {
 }
 
 // dist/content-listing.js
-import fs17 from "node:fs/promises";
-import path19 from "node:path";
+import fs19 from "node:fs/promises";
+import path21 from "node:path";
 import matter3 from "gray-matter";
 import { parse as yamlParse2 } from "yaml";
-var log7 = createDebugLogger({ prefix: "ContentListing" });
+var log8 = createDebugLogger({ prefix: "ContentListing" });
 var normalizePath = (root, target) => {
   const result = validateAndNormalizePath(root, target);
   if (!result.valid) {
@@ -6253,7 +7828,7 @@ var normalizePath = (root, target) => {
 };
 var readEntryData = async (filePath, format, bodyFieldName = "body") => {
   try {
-    const raw = await fs17.readFile(filePath, "utf8");
+    const raw = await fs19.readFile(filePath, "utf8");
     if (format === "json") {
       return asRecord(JSON.parse(raw));
     }
@@ -6269,13 +7844,17 @@ var readEntryData = async (filePath, format, bodyFieldName = "body") => {
   } catch (err) {
     if (isNotFoundError(err))
       return {};
-    log7.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage(err)}`);
+    log8.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage(err)}`);
     return {};
   }
 };
-var createReferenceResolver = (branchRoot, flatSchema, contentRootName) => ({
+var createReferenceResolver = (branchRoot, flatSchema, contentRootName, visibility) => ({
   store: new ContentStore(branchRoot, flatSchema, { contentRootName }),
-  cache: createReferenceResolveCache()
+  cache: createReferenceResolveCache(),
+  // The predicate that hides an entry from the listing is the one that restricts it as a
+  // reference target, so a target is never shown in a sibling's data that its own listing
+  // row would have hidden.
+  access: visibility?.shouldInclude
 });
 var resolveCollectionItemReferences = async (items, collection, resolver) => Promise.all(items.map(async (item) => {
   const fields = collection.entries?.find((e) => e.name === item.entryType)?.schema;
@@ -6283,7 +7862,7 @@ var resolveCollectionItemReferences = async (items, collection, resolver) => Pro
     return item;
   return {
     ...item,
-    data: await resolver.store.resolveReferences(item.data, fields, resolver.cache)
+    data: await resolver.store.resolveReferences(item.data, fields, resolver.cache, resolver.access)
   };
 }));
 async function listEntries(branchRoot, flatSchema, contentRootName, options, visibility) {
@@ -6294,10 +7873,10 @@ async function listEntries(branchRoot, flatSchema, contentRootName, options, vis
   const collections = flatSchema.filter((item) => item.type === "collection" && item.entries !== void 0 && (item.logicalPath === rootPath || item.logicalPath.startsWith(`${rootPath}/`)));
   const shouldInclude = visibility?.shouldInclude;
   const skippedFiles = [];
-  const resolver = options?.resolveReferences ? createReferenceResolver(branchRoot, flatSchema, contentRootName) : null;
+  const resolver = options?.resolveReferences ? createReferenceResolver(branchRoot, flatSchema, contentRootName, visibility) : null;
   const collectionResults = await Promise.all(collections.map(async (collection) => {
     const entries = await listCollectionEntries(branchRoot, collection, (file) => skippedFiles.push(file));
-    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.physicalPath)) : entries;
+    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.logicalPath)) : entries;
     const resolved = resolver ? await resolveCollectionItemReferences(visible, collection, resolver) : visible;
     return resolved.map((entry) => ({ entry, collection }));
   }));
@@ -6375,7 +7954,7 @@ var listCollectionEntries = async (root, collection, onSkip) => {
   normalizePath(root, collectionRoot);
   let dirents;
   try {
-    dirents = await fs17.readdir(collectionRoot, { withFileTypes: true });
+    dirents = await fs19.readdir(collectionRoot, { withFileTypes: true });
   } catch (err) {
     if (isNotFoundError(err))
       return [];
@@ -6383,11 +7962,11 @@ var listCollectionEntries = async (root, collection, onSkip) => {
   }
   const files = dirents.filter((d) => d.isFile() && validExts.some((ext) => d.name.endsWith(ext)) && d.name !== ".collection.json").sort((a, b) => a.name.localeCompare(b.name));
   const entries = await Promise.all(files.map(async (file) => {
-    const absolutePath = path19.join(collectionRoot, file.name);
+    const absolutePath = path21.join(collectionRoot, file.name);
     const relativePath = normalizePath(root, absolutePath);
     const parsed = parseTypedFilename(file.name, entryTypes);
     if (!parsed) {
-      log7.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
+      log8.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
       if (looksLikeMalformedEntry(file.name, entryTypes)) {
         onSkip?.({ filename: file.name, collectionPath: collection.logicalPath });
       }
@@ -6398,11 +7977,11 @@ var listCollectionEntries = async (root, collection, onSkip) => {
     const format = entryType?.format || "json";
     const bodyField = entryType?.schema ? findBodyFieldName(entryType.schema) : "body";
     const [stats, data] = await Promise.all([
-      fs17.stat(absolutePath),
+      fs19.stat(absolutePath),
       readEntryData(absolutePath, format, bodyField)
     ]);
     const item = {
-      logicalPath: `${collection.logicalPath}/${slug}`,
+      logicalPath: entryLogicalPath(collection.logicalPath, slug),
       contentId,
       slug,
       collectionPath: collection.logicalPath,
@@ -6422,7 +8001,8 @@ var listCollectionEntries = async (root, collection, onSkip) => {
 init_config2();
 
 // dist/assets/transform-directives.js
-var MAX_INPUT_PIXELS = 4096 * 4096;
+var MAX_INPUT_PIXELS = 6e3 * 4e3;
+var CROP_PRECISION = 4;
 function isValidCropRect(x, y, w, h) {
   for (const n of [x, y, w, h]) {
     if (!Number.isFinite(n) || n < 0 || n > 1)
@@ -6434,6 +8014,21 @@ function isValidCropRect(x, y, w, h) {
     return false;
   return true;
 }
+function roundToCropPrecision(n) {
+  const factor = 10 ** CROP_PRECISION;
+  return Math.round(n * factor) / factor;
+}
+function roundCropRect(rect) {
+  const x = roundToCropPrecision(rect.x);
+  const y = roundToCropPrecision(rect.y);
+  let w = roundToCropPrecision(rect.w);
+  let h = roundToCropPrecision(rect.h);
+  if (x + w > 1)
+    w = roundToCropPrecision(1 - x);
+  if (y + h > 1)
+    h = roundToCropPrecision(1 - y);
+  return { x, y, w, h };
+}
 
 // dist/validation/field-traversal.js
 function isPlainRecord2(value) {
@@ -6466,32 +8061,35 @@ function isValidImageCropValue(value) {
   if (typeof x !== "number" || typeof y !== "number" || typeof w !== "number" || typeof h !== "number") {
     return false;
   }
-  return isValidCropRect(x, y, w, h);
+  if (!isValidCropRect(x, y, w, h))
+    return false;
+  const rounded = roundCropRect({ x, y, w, h });
+  return isValidCropRect(rounded.x, rounded.y, rounded.w, rounded.h);
 }
-function validateImageValue(field, value, path22) {
+function validateImageValue(field, value, path24) {
   if (!isPlainRecord3(value)) {
-    return [{ fieldPath: path22, message: "Expected an image object with { src, alt }" }];
+    return [{ fieldPath: path24, message: "Expected an image object with { src, alt }" }];
   }
   const errors = [];
   if (typeof value.src !== "string" || value.src.trim() === "") {
-    errors.push({ fieldPath: `${path22}.src`, message: "Image src is required" });
+    errors.push({ fieldPath: `${path24}.src`, message: "Image src is required" });
   }
   if (typeof value.alt !== "string") {
-    errors.push({ fieldPath: `${path22}.alt`, message: "Image alt text is required" });
+    errors.push({ fieldPath: `${path24}.alt`, message: "Image alt text is required" });
   } else if (value.alt.trim() === "" && field.altOptional !== true) {
-    errors.push({ fieldPath: `${path22}.alt`, message: "Image alt text is required" });
+    errors.push({ fieldPath: `${path24}.alt`, message: "Image alt text is required" });
   }
   if (value.width !== void 0 && !isPositiveInt(value.width)) {
-    errors.push({ fieldPath: `${path22}.width`, message: "Image width must be a positive integer" });
+    errors.push({ fieldPath: `${path24}.width`, message: "Image width must be a positive integer" });
   }
   if (value.height !== void 0 && !isPositiveInt(value.height)) {
     errors.push({
-      fieldPath: `${path22}.height`,
+      fieldPath: `${path24}.height`,
       message: "Image height must be a positive integer"
     });
   }
   if (value.crop !== void 0 && !isValidImageCropValue(value.crop)) {
-    errors.push({ fieldPath: `${path22}.crop`, message: "Invalid image crop rect" });
+    errors.push({ fieldPath: `${path24}.crop`, message: "Invalid image crop rect" });
   }
   return errors;
 }
@@ -6503,44 +8101,44 @@ function referenceValueId(value) {
   return void 0;
 }
 var selectOptionValues = (field) => (field.options ?? []).map((opt) => typeof opt === "string" ? opt : opt.value);
-function validateScalar(field, value, path22) {
+function validateScalar(field, value, path24) {
   switch (field.type) {
     case "number":
       if (typeof value !== "number" || !Number.isFinite(value)) {
-        return [{ fieldPath: path22, message: "Expected a number" }];
+        return [{ fieldPath: path24, message: "Expected a number" }];
       }
       return [];
     case "boolean":
       if (typeof value !== "boolean") {
-        return [{ fieldPath: path22, message: "Expected true or false" }];
+        return [{ fieldPath: path24, message: "Expected true or false" }];
       }
       return [];
     case "datetime":
       if (typeof value !== "string" || value !== "" && Number.isNaN(Date.parse(value))) {
-        return [{ fieldPath: path22, message: "Expected a valid date/time string" }];
+        return [{ fieldPath: path24, message: "Expected a valid date/time string" }];
       }
       return [];
     case "select": {
       if (typeof value !== "string") {
-        return [{ fieldPath: path22, message: "Expected a selection" }];
+        return [{ fieldPath: path24, message: "Expected a selection" }];
       }
       const options = selectOptionValues(field);
       if (value !== "" && !options.includes(value)) {
-        return [{ fieldPath: path22, message: `Must be one of: ${options.join(", ")}` }];
+        return [{ fieldPath: path24, message: `Must be one of: ${options.join(", ")}` }];
       }
       return [];
     }
     case "reference":
       if (referenceValueId(value) === void 0) {
-        return [{ fieldPath: path22, message: "Expected a reference id" }];
+        return [{ fieldPath: path24, message: "Expected a reference id" }];
       }
       return [];
     case "image":
-      return validateImageValue(field, value, path22);
+      return validateImageValue(field, value, path24);
     default:
       if (STRING_FIELD_TYPES.has(field.type)) {
         if (typeof value !== "string") {
-          return [{ fieldPath: path22, message: "Expected text" }];
+          return [{ fieldPath: path24, message: "Expected text" }];
         }
       }
       return [];
@@ -6563,12 +8161,12 @@ function validateEntryData(fields, data, pathPrefix = "") {
       errors.push(...validateEntryData(field.fields, data, pathPrefix));
       continue;
     }
-    const path22 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
+    const path24 = pathPrefix ? `${pathPrefix}.${field.name}` : field.name;
     const value = data[field.name];
     const isRequired = "required" in field && field.required === true;
     if (isRequired && isEmptyForRequired(field, value)) {
       const message = Array.isArray(value) ? "At least one item is required" : "This field is required";
-      errors.push({ fieldPath: path22, message });
+      errors.push({ fieldPath: path24, message });
       continue;
     }
     if (value === void 0 || value === null)
@@ -6576,11 +8174,11 @@ function validateEntryData(fields, data, pathPrefix = "") {
     if (field.type === "block") {
       const blockField = field;
       if (!Array.isArray(value)) {
-        errors.push({ fieldPath: path22, message: "Expected a list of blocks" });
+        errors.push({ fieldPath: path24, message: "Expected a list of blocks" });
         continue;
       }
       value.forEach((item, index) => {
-        const itemPath = `${path22}[${index}]`;
+        const itemPath = `${path24}[${index}]`;
         if (!isPlainRecord3(item)) {
           errors.push({ fieldPath: itemPath, message: "Expected a block object" });
           return;
@@ -6602,11 +8200,11 @@ function validateEntryData(fields, data, pathPrefix = "") {
       const objectField = field;
       if (objectField.list) {
         if (!Array.isArray(value)) {
-          errors.push({ fieldPath: path22, message: "Expected a list of items" });
+          errors.push({ fieldPath: path24, message: "Expected a list of items" });
           continue;
         }
         value.forEach((item, index) => {
-          const itemPath = `${path22}[${index}]`;
+          const itemPath = `${path24}[${index}]`;
           if (!isPlainRecord3(item)) {
             errors.push({ fieldPath: itemPath, message: "Expected an object" });
             return;
@@ -6616,27 +8214,27 @@ function validateEntryData(fields, data, pathPrefix = "") {
           }
         });
       } else if (!isPlainRecord3(value)) {
-        errors.push({ fieldPath: path22, message: "Expected an object" });
+        errors.push({ fieldPath: path24, message: "Expected an object" });
       } else if (objectField.fields) {
-        errors.push(...validateEntryData(objectField.fields, value, path22));
+        errors.push(...validateEntryData(objectField.fields, value, path24));
       }
       continue;
     }
     if ("list" in field && field.list) {
       if (!Array.isArray(value)) {
-        errors.push({ fieldPath: path22, message: "Expected a list of values" });
+        errors.push({ fieldPath: path24, message: "Expected a list of values" });
         continue;
       }
       value.forEach((item, index) => {
-        errors.push(...validateScalar(field, item, `${path22}[${index}]`));
+        errors.push(...validateScalar(field, item, `${path24}[${index}]`));
       });
       continue;
     }
     if (Array.isArray(value) && KNOWN_FIELD_TYPES.has(field.type)) {
-      errors.push({ fieldPath: path22, message: "Expected a single value, not a list" });
+      errors.push({ fieldPath: path24, message: "Expected a single value, not a list" });
       continue;
     }
-    errors.push(...validateScalar(field, value, path22));
+    errors.push(...validateScalar(field, value, path24));
   }
   return errors;
 }
@@ -6687,7 +8285,7 @@ These are likely abandoned create-scaffolds (empty entries left behind when a cr
 var GENERATED_RECORD_FILENAME = ".canopy-generated.json";
 async function readGeneratedRecord(outputDir) {
   try {
-    const raw = await fs18.readFile(path20.join(outputDir, GENERATED_RECORD_FILENAME), "utf-8");
+    const raw = await fs20.readFile(path22.join(outputDir, GENERATED_RECORD_FILENAME), "utf-8");
     const parsed = JSON.parse(raw);
     if (typeof parsed !== "object" || parsed === null || !("files" in parsed))
       return [];
@@ -6701,19 +8299,19 @@ async function readGeneratedRecord(outputDir) {
 }
 async function writeGeneratedRecord(outputDir, files) {
   const record = { files: [...files].sort() };
-  await fs18.mkdir(outputDir, { recursive: true });
-  await fs18.writeFile(path20.join(outputDir, GENERATED_RECORD_FILENAME), `${JSON.stringify(record, null, 2)}
+  await fs20.mkdir(outputDir, { recursive: true });
+  await fs20.writeFile(path22.join(outputDir, GENERATED_RECORD_FILENAME), `${JSON.stringify(record, null, 2)}
 `, "utf-8");
 }
 async function removeEmptyDirsUpward(startDir, stopAt) {
   let current = startDir;
   while (current.startsWith(stopAt) && current !== stopAt) {
     try {
-      await fs18.rmdir(current);
+      await fs20.rmdir(current);
     } catch {
       return;
     }
-    current = path20.dirname(current);
+    current = path22.dirname(current);
   }
 }
 var SAFE_BUILD_ID = /^[A-Za-z0-9._-]{1,255}$/;
@@ -6775,9 +8373,9 @@ async function generateAIContentFiles(options) {
     entryLinkUrl: config.entryLinkUrl,
     ...resolveBuildStamp()
   });
-  const absoluteOutputDir = path20.resolve(outputDir) + path20.sep;
+  const absoluteOutputDir = path22.resolve(outputDir) + path22.sep;
   const resolveOutputPath = (filePath) => {
-    const absolutePath = path20.resolve(path20.join(absoluteOutputDir, filePath));
+    const absolutePath = path22.resolve(path22.join(absoluteOutputDir, filePath));
     if (!absolutePath.startsWith(absoluteOutputDir)) {
       throw new Error(`Path traversal detected in AI content output: ${filePath}`);
     }
@@ -6789,8 +8387,8 @@ async function generateAIContentFiles(options) {
   let fileCount = 0;
   for (const [filePath, content] of result.files) {
     const absolutePath = resolveOutputPath(filePath);
-    await fs18.mkdir(path20.dirname(absolutePath), { recursive: true });
-    await fs18.writeFile(absolutePath, content, "utf-8");
+    await fs20.mkdir(path22.dirname(absolutePath), { recursive: true });
+    await fs20.writeFile(absolutePath, content, "utf-8");
     fileCount++;
   }
   const currentSet = new Set(currentFiles);
@@ -6799,13 +8397,13 @@ async function generateAIContentFiles(options) {
   for (const filePath of stale) {
     const absolutePath = resolveOutputPath(filePath);
     try {
-      await fs18.unlink(absolutePath);
+      await fs20.unlink(absolutePath);
       removedCount++;
     } catch (err) {
       if (!isNodeError(err) || err.code !== "ENOENT")
         throw err;
     }
-    await removeEmptyDirsUpward(path20.dirname(absolutePath), absoluteOutputDir);
+    await removeEmptyDirsUpward(path22.dirname(absolutePath), absoluteOutputDir);
   }
   await writeGeneratedRecord(absoluteOutputDir, currentFiles);
   return { fileCount, removedCount, outputDir: absoluteOutputDir };
@@ -6816,7 +8414,7 @@ var jiti = createJiti(import.meta.url);
 async function generateAIContentCLI(options) {
   const { projectDir, outputDir = "public/ai", configPath, appDir = "app" } = options;
   console.log("\nCanopyCMS generate-ai-content\n");
-  const canopyConfigPath = path21.join(projectDir, "canopycms.config.ts");
+  const canopyConfigPath = path23.join(projectDir, "canopycms.config.ts");
   let canopyConfigModule;
   try {
     canopyConfigModule = await jiti.import(canopyConfigPath);
@@ -6827,7 +8425,7 @@ async function generateAIContentCLI(options) {
   }
   const configExport = canopyConfigModule.default ?? canopyConfigModule.config ?? canopyConfigModule;
   const serverConfig = typeof configExport === "object" && configExport !== null && "server" in configExport ? configExport.server : configExport;
-  const schemasPath = path21.join(projectDir, appDir, "schemas.ts");
+  const schemasPath = path23.join(projectDir, appDir, "schemas.ts");
   let entrySchemaRegistry = {};
   try {
     const schemasModule = await jiti.import(schemasPath);
@@ -6838,7 +8436,7 @@ async function generateAIContentCLI(options) {
   let aiConfig;
   if (configPath) {
     try {
-      const aiConfigModule = await jiti.import(path21.resolve(configPath));
+      const aiConfigModule = await jiti.import(path23.resolve(configPath));
       aiConfig = aiConfigModule.aiContentConfig ?? aiConfigModule.default ?? aiConfigModule.config;
     } catch (err) {
       console.error(`Could not load AI config from ${configPath}`);
@@ -6855,7 +8453,7 @@ async function generateAIContentCLI(options) {
     console.error("Make sure canopycms.config.ts uses defineCanopyConfig().");
     process.exit(1);
   }
-  const resolvedOutput = path21.resolve(projectDir, outputDir);
+  const resolvedOutput = path23.resolve(projectDir, outputDir);
   console.log(`  Output: ${resolvedOutput}`);
   console.log(`  Mode: ${serverConfig.mode ?? "dev"}`);
   const result = await generateAIContentFiles({