canopycms 0.0.67 → 0.0.68-int.93

package/dist/cli/cli.js

@@ -1285,7 +1285,8 @@ var init_init = __esm({
         });
         objectFieldSchema = fieldBaseSchema.extend({
           type: z.literal("object"),
-          fields: z.array(z.lazy(() => fieldHolder[0])).min(1)
+          fields: z.array(z.lazy(() => fieldHolder[0])).min(1),
+          itemTitleField: z.string().min(1).optional()
         });
         inlineGroupFieldSchema = z.object({
           type: z.literal("group"),
@@ -1466,6 +1467,9 @@ var init_init = __esm({
           defaultRemoteUrl: defaultRemoteUrlSchema.optional(),
           gitBotAuthorName: gitBotAuthorNameSchema,
           gitBotAuthorEmail: gitBotAuthorEmailSchema,
+          // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+          gitEditedByTrailers: z5.boolean().optional(),
+          gitCoAuthoredByTrailers: z5.boolean().optional(),
           githubTokenEnvVar: githubTokenEnvVarSchema.optional(),
           // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
           // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -1477,7 +1481,6 @@ var init_init = __esm({
           // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
           allowNetworkRemoteInProd: z5.boolean().optional(),
           settingsBranch: z5.string().optional(),
-          autoCreateSettingsPR: z5.boolean().optional(),
           // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
           // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
           // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -1734,6 +1737,10 @@ var init_init = __esm({
               throw new Error(errorMsg);
             }
           }
+          /**
+           * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+           * anything that can run concurrently uses {@link timed}.
+           */
           time(label) {
             this.timers.set(label, Date.now());
           }
@@ -1748,12 +1755,16 @@ var init_init = __esm({
             this.debug(category, `${label} completed`, { durationMs: duration });
             return duration;
           }
+          /**
+           * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+           * call, so concurrent spans with the same label on one logger never overwrite each other.
+           */
           async timed(category, label, fn) {
-            this.time(label);
+            const start = Date.now();
             try {
               return await fn();
             } finally {
-              this.timeEnd(category, label);
+              this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
             }
           }
         };
@@ -1919,9 +1930,6 @@ var init_init = __esm({
           throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
         }
       }
-      shouldCreateSettingsPR(config) {
-        return config.autoCreateSettingsPR ?? true;
-      }
     };
     DevStrategy = class extends DevClientSafeStrategy {
       getWorkspaceRoot(sourceRoot) {
@@ -1968,9 +1976,6 @@ var init_init = __esm({
       }
       validateConfig(_config) {
       }
-      shouldCreateSettingsPR(_config) {
-        return false;
-      }
     };
     strategyCache = /* @__PURE__ */ new Map();
     init_mode_env();
@@ -3058,6 +3063,8 @@ import { promises as fs62 } from "fs";
 import { join as join3 } from "pathe";
 import { z as z8 } from "zod";
 import chokidar from "chokidar";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { simpleGit as simpleGit3 } from "simple-git";
 import fs82 from "node:fs/promises";
 import { sep, resolve, relative } from "node:path";
 import fs9 from "node:fs/promises";
@@ -3079,7 +3086,6 @@ import lockfile2 from "proper-lockfile";
 import fs16 from "node:fs/promises";
 import path17 from "node:path";
 import { simpleGit as simpleGit22 } from "simple-git";
-import { simpleGit as simpleGit3 } from "simple-git";
 import fs17 from "node:fs/promises";
 import path19 from "node:path";
 import matter3 from "gray-matter";
@@ -3145,6 +3151,9 @@ function createLogicalPath(...segments) {
   }
   return normalized;
 }
+function entryLogicalPath(collectionLogicalPath, slug) {
+  return collectionLogicalPath ? `${collectionLogicalPath}/${slug}` : slug;
+}
 function trimSlashes(path222) {
   let start = 0;
   let end = path222.length;
@@ -3473,12 +3482,14 @@ async function withLock(key, fn) {
       locks.delete(key);
   }
 }
-function provisioningLockOptions(lockPath, retries, onCompromised) {
+function provisioningLockOptions(lockPath, retries, onCompromised, staleMs) {
   return {
     lockfilePath: lockPath,
     realpath: false,
     retries,
-    stale: 3e4,
+    stale: staleMs,
+    // Fixed, not stale/2: every holder refreshes at 15s whatever threshold it judges others by.
+    update: 15e3,
     // proper-lockfile invokes this from inside its refresh timer, so ANY throw escaping here is
     // an uncaught exception that kills the process. Call sites are told not to throw (see
     // OnLockCompromised); this makes it structural rather than a convention, and also covers the
@@ -3514,23 +3525,26 @@ function releaseIgnoringAlreadyReleased(release, lockPath) {
     }
   };
 }
+function branchProvisioningLockName(dirName) {
+  return `.${dirName}.init.lock`;
+}
 async function acquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
   await fs23.mkdir(lockTargetDir2, { recursive: true });
   const lockPath = path22.join(lockTargetDir2, lockName);
-  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true }, onCompromised));
+  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, { retries: 600, factor: 1, minTimeout: 300, maxTimeout: 800, randomize: true }, onCompromised, PROVISIONING_LOCK_STALE_MS));
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
-async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised) {
+async function tryAcquireProvisioningLock(lockTargetDir2, lockName, onCompromised, staleMs = PROVISIONING_LOCK_STALE_MS) {
   await fs23.mkdir(lockTargetDir2, { recursive: true });
   const lockPath = path22.join(lockTargetDir2, lockName);
-  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised));
+  const release = await lockfile.lock(lockPath, provisioningLockOptions(lockPath, 0, onCompromised, staleMs));
   return releaseIgnoringAlreadyReleased(release, lockPath);
 }
 function lockTargetDir(branchRoot) {
   return path32.join(path32.resolve(branchRoot), META_DIR);
 }
 function tryAcquireContentWriteLock(branchRoot, onCompromised) {
-  return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME, onCompromised);
+  return tryAcquireProvisioningLock(lockTargetDir(branchRoot), CONTENT_WRITE_LOCK_NAME, onCompromised, CONTENT_WRITE_LOCK_STALE_MS);
 }
 async function acquireContentWriteLock(branchRoot, waitMs = DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, onCompromised) {
   const startedAt = Date.now();
@@ -4006,6 +4020,61 @@ function isValidSchema(schema) {
   const hasCollections = !!(schema.collections && schema.collections.length > 0);
   return hasEntries || hasCollections;
 }
+async function timeRequestPhase(phase, fn) {
+  const parent = storage.getStore();
+  if (!parent)
+    return fn();
+  const key = parent.path ? `${parent.path}>${phase}` : phase;
+  let total = parent.phases.get(key);
+  if (!total) {
+    total = { count: 0, ms: 0 };
+    parent.phases.set(key, total);
+  }
+  const start = performance.now();
+  try {
+    return await storage.run({ ...parent, path: key }, fn);
+  } finally {
+    total.count += 1;
+    total.ms += performance.now() - start;
+  }
+}
+function isNetworkRemoteUrl(url) {
+  if (/^file:\/\//i.test(url))
+    return false;
+  if (NETWORK_SCHEME_PATTERN.test(url))
+    return true;
+  if (TRANSPORT_HELPER_PATTERN.test(url))
+    return true;
+  if (LEADING_OPTION_PATTERN.test(url))
+    return true;
+  if (WINDOWS_DRIVE_PATTERN.test(url))
+    return false;
+  return COLON_BEFORE_SLASH_PATTERN.test(url);
+}
+function isMissingRemoteRefFailure(message) {
+  return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
+}
+async function stageAllExceptCanopyState(git) {
+  await git.add(["-A"]);
+  await git.raw(["reset", "-q", "--", CANOPY_META_DIR]);
+}
+async function detectHeadBranch(repoRoot, fallback = "main") {
+  try {
+    const git = simpleGit3({ baseDir: repoRoot });
+    const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
+    return head && head !== "HEAD" ? head : fallback;
+  } catch {
+    return fallback;
+  }
+}
+async function resolveBaseBranch(options) {
+  if (options.defaultBaseBranch)
+    return options.defaultBaseBranch;
+  if (options.mode === "dev") {
+    return detectHeadBranch(options.detectFrom ?? process.cwd());
+  }
+  return "main";
+}
 async function isStaleByMtime(dir, cachedAt) {
   let entries;
   try {
@@ -4027,6 +4096,11 @@ async function isStaleByMtime(dir, cachedAt) {
   }
   return false;
 }
+async function schemaCacheDir(branchRoot) {
+  const gitDir = path82.join(branchRoot, ".git");
+  const isClone = await fs72.stat(gitDir).then((stat) => stat.isDirectory(), () => false);
+  return isClone ? path82.join(gitDir, "canopycms") : path82.join(branchRoot, CANOPY_META_DIR);
+}
 async function bumpContentIndexGeneration(root) {
   return bumpResourceGeneration(root, RESOURCE);
 }
@@ -4663,7 +4737,7 @@ function resolveEntryLinksInText(text3, idIndex, contentRoot, customResolver) {
     return part.text.replace(ENTRY_LINK_PATTERN, (_match, id, anchor) => {
       const location = idIndex.findById(id);
       if (!location || location.type !== "entry" || !location.collection || !location.slug) {
-        log22.warn("resolve", `Entry link target not found: entry:${id}`);
+        log3.warn("resolve", `Entry link target not found: entry:${id}`);
         return anchor ?? "#";
       }
       let url;
@@ -5118,7 +5192,7 @@ async function withOccFileLock(filePath, fn) {
         // Our critical sections are short and idempotent-on-conflict (OCC
         // verify inside); log and let the section finish.
         onCompromised: (err) => {
-          log4.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+          log5.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
             error: getErrorMessage3(err)
           });
         }
@@ -5140,43 +5214,10 @@ async function withOccFileLock(filePath, fn) {
     await release().catch((err) => {
       if (isNodeError3(err) && err.code === "ENOENT")
         return;
-      log4.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage3(err) });
+      log5.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage3(err) });
     });
   }
 }
-function isNetworkRemoteUrl(url) {
-  if (/^file:\/\//i.test(url))
-    return false;
-  if (NETWORK_SCHEME_PATTERN.test(url))
-    return true;
-  if (TRANSPORT_HELPER_PATTERN.test(url))
-    return true;
-  if (LEADING_OPTION_PATTERN.test(url))
-    return true;
-  if (WINDOWS_DRIVE_PATTERN.test(url))
-    return false;
-  return COLON_BEFORE_SLASH_PATTERN.test(url);
-}
-function isMissingRemoteRefFailure(message) {
-  return MISSING_REMOTE_REF_REASONS.some((reason) => message.includes(reason));
-}
-async function detectHeadBranch(repoRoot, fallback = "main") {
-  try {
-    const git = simpleGit3({ baseDir: repoRoot });
-    const head = (await git.revparse(["--abbrev-ref", "HEAD"])).trim();
-    return head && head !== "HEAD" ? head : fallback;
-  } catch {
-    return fallback;
-  }
-}
-async function resolveBaseBranch(options) {
-  if (options.defaultBaseBranch)
-    return options.defaultBaseBranch;
-  if (options.mode === "dev") {
-    return detectHeadBranch(options.detectFrom ?? process.cwd());
-  }
-  return "main";
-}
 function gitChildEnv(overrides) {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
@@ -5197,13 +5238,13 @@ async function ensureGitExcludePattern(repoPath, pattern) {
   }
   const lines = content.split("\n");
   if (lines.some((line) => line.trim() === pattern)) {
-    log5.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    log6.debug("git", "Pattern already in .git/info/exclude", { pattern });
     return;
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
   await fs16.writeFile(excludePath, newContent, "utf-8");
-  log5.debug("git", "Added pattern to .git/info/exclude", { pattern });
+  log6.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
 async function loadOrCreateBranchContext(options) {
   if (readsFromCheckout(options.config)) {
@@ -5269,7 +5310,7 @@ async function listEntries(branchRoot, flatSchema, contentRootName, options, vis
   const resolver = options?.resolveReferences ? createReferenceResolver(branchRoot, flatSchema, contentRootName) : null;
   const collectionResults = await Promise.all(collections.map(async (collection) => {
     const entries = await listCollectionEntries(branchRoot, collection, (file) => skippedFiles.push(file));
-    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.physicalPath)) : entries;
+    const visible = shouldInclude ? entries.filter((e) => shouldInclude(e.logicalPath)) : entries;
     const resolved = resolver ? await resolveCollectionItemReferences(visible, collection, resolver) : visible;
     return resolved.map((entry) => ({ entry, collection }));
   }));
@@ -5751,7 +5792,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, SENTINEL_BASE2, DOT_SEGMENT2, init_sanitize_href2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, uploadTargetUrlSchema2, assetMountUrlSchema2, init_url2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, DEFAULT_SEO_FIELD_NAMES, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log22, BASE58_CHAR, ENTRY_LINK_PATTERN, BRANCH_META_DIR, BRANCH_META_FILE, BranchMetadataCorruptError, branchMetadataFilePath, log3, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log4, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, log5, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, GitManager, log6, workspaceInitLocks, BranchWorkspaceManager, log7, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, active2, init_logger2, SENTINEL_BASE2, DOT_SEGMENT2, init_sanitize_href2, init_normalize2, ROOT_COLLECTION_ID, init_types3, normalizePathValue, flattenSchema, init_flatten2, primitiveFieldTypes2, fieldTypes2, init_types22, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, uploadTargetUrlSchema2, assetMountUrlSchema2, init_url2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env2, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned22, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, permissionTargetSchema2, pathPermissionSchema2, init_permissions2, init_helpers2, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, EVIDENCE_MAX_DEPTH, locks, PROVISIONING_LOCK_STALE_MS, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep, CONTENT_WRITE_LOCK_STALE_MS, DEFAULT_SEO_FIELD_NAMES, SEO_GROUP_FIELDS, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, EMPTY_LOGICAL_PATH, ContentIdIndex, parseTypedFilename, CONTENT_EXTENSIONS, registry, finalization, LOG_LEVELS2, DebugLogger2, testLogger2, log2, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER, storage, log22, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, CANOPY_META_DIR, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_CACHE_FILE, SCHEMA_GENERATION_RESOURCE, BranchSchemaCache, RESOURCE, getFormatExtension, isDataOnlyFormat, asRecord, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, FLAT_CELL_TYPES, log3, BASE58_CHAR, ENTRY_LINK_PATTERN, BRANCH_META_DIR, BRANCH_META_FILE, BranchMetadataCorruptError, branchMetadataFilePath, log4, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, BranchRegistry, log5, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, getBranchMetadataFileManager, loadBranchContext, log6, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, RemoteNotReadyError, GitManager, log7, workspaceInitLocks, BranchWorkspaceManager, log8, normalizePath, readEntryData, createReferenceResolver, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -5975,7 +6016,8 @@ var init_generate_ai_content = __esm({
         });
         objectFieldSchema2 = fieldBaseSchema2.extend({
           type: z22.literal("object"),
-          fields: z22.array(z22.lazy(() => fieldHolder2[0])).min(1)
+          fields: z22.array(z22.lazy(() => fieldHolder2[0])).min(1),
+          itemTitleField: z22.string().min(1).optional()
         });
         inlineGroupFieldSchema2 = z22.object({
           type: z22.literal("group"),
@@ -6149,6 +6191,9 @@ var init_generate_ai_content = __esm({
           defaultRemoteUrl: defaultRemoteUrlSchema2.optional(),
           gitBotAuthorName: gitBotAuthorNameSchema2,
           gitBotAuthorEmail: gitBotAuthorEmailSchema2,
+          // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+          gitEditedByTrailers: z62.boolean().optional(),
+          gitCoAuthoredByTrailers: z62.boolean().optional(),
           githubTokenEnvVar: githubTokenEnvVarSchema2.optional(),
           // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
           // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -6160,7 +6205,6 @@ var init_generate_ai_content = __esm({
           // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
           allowNetworkRemoteInProd: z62.boolean().optional(),
           settingsBranch: z62.string().optional(),
-          autoCreateSettingsPR: z62.boolean().optional(),
           // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
           // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
           // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -6377,9 +6421,6 @@ var init_generate_ai_content = __esm({
               throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
             }
           }
-          shouldCreateSettingsPR(config) {
-            return config.autoCreateSettingsPR ?? true;
-          }
         };
         DevStrategy2 = class extends DevClientSafeStrategy2 {
           getWorkspaceRoot(sourceRoot) {
@@ -6426,9 +6467,6 @@ var init_generate_ai_content = __esm({
           }
           validateConfig(_config) {
           }
-          shouldCreateSettingsPR(_config) {
-            return false;
-          }
         };
         strategyCache2 = /* @__PURE__ */ new Map();
       }
@@ -6458,6 +6496,7 @@ var init_generate_ai_content = __esm({
     locks = /* @__PURE__ */ new Map();
     init_logger2();
     init_logger2();
+    PROVISIONING_LOCK_STALE_MS = 9e4;
     META_DIR = ".canopy-meta";
     CONTENT_WRITE_LOCK_NAME = "content-write.lock";
     DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS = 2e3;
@@ -6470,6 +6509,7 @@ var init_generate_ai_content = __esm({
     sleep = (ms) => new Promise((resolve2) => {
       setTimeout(resolve2, ms);
     });
+    CONTENT_WRITE_LOCK_STALE_MS = 3e4;
     init_sanitize_href2();
     DEFAULT_SEO_FIELD_NAMES = {
       title: "metaTitle",
@@ -6915,6 +6955,10 @@ var init_generate_ai_content = __esm({
           throw new Error(errorMsg);
         }
       }
+      /**
+       * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+       * anything that can run concurrently uses {@link timed}.
+       */
       time(label) {
         this.timers.set(label, Date.now());
       }
@@ -6929,12 +6973,16 @@ var init_generate_ai_content = __esm({
         this.debug(category, `${label} completed`, { durationMs: duration });
         return duration;
       }
+      /**
+       * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+       * call, so concurrent spans with the same label on one logger never overwrite each other.
+       */
       async timed(category, label, fn) {
-        this.time(label);
+        const start = Date.now();
         try {
           return await fn();
         } finally {
-          this.timeEnd(category, label);
+          this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
         }
       }
     };
@@ -7059,8 +7107,18 @@ var init_generate_ai_content = __esm({
       email: "static-deploy@canopycms",
       name: "Static Deploy"
     });
+    storage = new AsyncLocalStorage();
+    log22 = createDebugLogger2({ prefix: "CanopyCMS" });
+    NETWORK_SCHEME_PATTERN = /^(https?|ssh|git):\/\//i;
+    TRANSPORT_HELPER_PATTERN = /^[a-z][a-z0-9+.-]*::/i;
+    LEADING_OPTION_PATTERN = /^-/;
+    WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:[\\/]/;
+    COLON_BEFORE_SLASH_PATTERN = /^[^/\\\s]+:/;
+    MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find remote ref"];
+    CANOPY_META_DIR = ".canopy-meta";
     SCHEMA_CACHE_VERSION = 3;
     MTIME_CHECK_DEBOUNCE_MS = 1e3;
+    SCHEMA_CACHE_FILE = "schema-cache.json";
     SCHEMA_GENERATION_RESOURCE = "schema";
     BranchSchemaCache = class {
       constructor(mode = "prod") {
@@ -7070,7 +7128,7 @@ var init_generate_ai_content = __esm({
       /**
        * Whether to skip the on-disk cache for this branchRoot.
        *
-       * Never write `.canopy-meta/` at the project root, whichever entrypoint
+       * Never write a schema cache at the project root, whichever entrypoint
        * produced the cwd branchRoot. branchRoot equals process.cwd() only in the
        * synthetic contexts static deployments and build phases use; a real branch
        * root is always nested under the workspace.
@@ -7080,7 +7138,7 @@ var init_generate_ai_content = __esm({
       }
       /** Get schema for a branch, from the cache when fresh, else resolved fresh. */
       async getSchema(branchRoot, entrySchemaRegistry, contentRootName = "content") {
-        return this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName);
+        return timeRequestPhase("schema", () => this.loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName));
       }
       /**
        * Resolve the schema from disk. Protected rather than a direct resolveSchema
@@ -7094,8 +7152,7 @@ var init_generate_ai_content = __esm({
         const contentRoot = path82.join(branchRoot, contentRootName);
         const skipDiskCache = this.skipDiskCache(branchRoot);
         if (!skipDiskCache) {
-          const cacheDir = path82.join(branchRoot, ".canopy-meta");
-          const cachePath = path82.join(cacheDir, "schema-cache.json");
+          const cachePath = path82.join(await schemaCacheDir(branchRoot), SCHEMA_CACHE_FILE);
           let cacheData = null;
           try {
             const cacheContent = await fs72.readFile(cachePath, "utf-8");
@@ -7137,7 +7194,7 @@ var init_generate_ai_content = __esm({
         const { skipDiskCache } = options;
         const contentRoot = path82.join(branchRoot, contentRootName);
         const read = skipDiskCache ? null : await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
-        const result = await this.resolveFresh(contentRoot, entrySchemaRegistry);
+        const result = await timeRequestPhase("resolve", () => this.resolveFresh(contentRoot, entrySchemaRegistry));
         if (!isValidSchema(result.schema)) {
           throw new Error(`No schema found in ${contentRoot}. Create .collection.json files with references to field schemas defined in your entry schema registry.`);
         }
@@ -7148,9 +7205,9 @@ var init_generate_ai_content = __esm({
         }
         const flatSchema = flattenSchema(result.schema, contentRootName);
         if (!skipDiskCache) {
-          const cacheDir = path82.join(branchRoot, ".canopy-meta");
-          const cachePath = path82.join(cacheDir, "schema-cache.json");
-          await fs72.unlink(path82.join(cacheDir, "schema-cache.stale")).catch(() => {
+          const cacheDir = await schemaCacheDir(branchRoot);
+          const cachePath = path82.join(cacheDir, SCHEMA_CACHE_FILE);
+          await fs72.unlink(path82.join(branchRoot, CANOPY_META_DIR, "schema-cache.stale")).catch(() => {
           });
           if (read && read.ok) {
             const newCache = {
@@ -7643,6 +7700,7 @@ var init_generate_ai_content = __esm({
           return {
             absolutePath: resolved,
             relativePath: path11.relative(this.root, resolved),
+            logicalPath: entryLogicalPath(schemaItem.logicalPath, safeSlug),
             id,
             entryTypeName: finalEntryTypeName,
             existed
@@ -8337,7 +8395,7 @@ var init_generate_ai_content = __esm({
       "reference",
       "image"
     ]);
-    log22 = createDebugLogger2({ prefix: "EntryLinks" });
+    log3 = createDebugLogger2({ prefix: "EntryLinks" });
     BASE58_CHAR = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
     ENTRY_LINK_PATTERN = new RegExp(`entry:(${BASE58_CHAR}{12})(#[^\\s)>"']*)?`, "g");
     BRANCH_META_DIR = ".canopy-meta";
@@ -8352,7 +8410,7 @@ var init_generate_ai_content = __esm({
     };
     branchMetadataFilePath = (branchRoot) => path13.join(path13.resolve(branchRoot), BRANCH_META_DIR, BRANCH_META_FILE);
     init_logger2();
-    log3 = createDebugLogger2({ prefix: "BranchRegistry" });
+    log4 = createDebugLogger2({ prefix: "BranchRegistry" });
     REGISTRY_FILE = "branches.json";
     REGISTRY_STALE_FILE = "branches.stale.json";
     REGISTRY_TEMP_FILE = "branches.tmp.json";
@@ -8432,7 +8490,7 @@ var init_generate_ai_content = __esm({
             });
           await this.regenerate();
         } catch (err) {
-          log3.warn("invalidate", "Eager regeneration after invalidate() failed", {
+          log4.warn("invalidate", "Eager regeneration after invalidate() failed", {
             error: getErrorMessage3(err)
           });
         }
@@ -8517,7 +8575,7 @@ var init_generate_ai_content = __esm({
         return branches;
       }
     };
-    log4 = createDebugLogger2({ prefix: "OccJsonWrite" });
+    log5 = createDebugLogger2({ prefix: "OccJsonWrite" });
     OccWriteConflictError = class extends Error {
       constructor(message = "Concurrent modification detected") {
         super(message);
@@ -8687,13 +8745,7 @@ var init_generate_ai_content = __esm({
       };
     };
     init_operating_mode();
-    NETWORK_SCHEME_PATTERN = /^(https?|ssh|git):\/\//i;
-    TRANSPORT_HELPER_PATTERN = /^[a-z][a-z0-9+.-]*::/i;
-    LEADING_OPTION_PATTERN = /^-/;
-    WINDOWS_DRIVE_PATTERN = /^[a-zA-Z]:[\\/]/;
-    COLON_BEFORE_SLASH_PATTERN = /^[^/\\\s]+:/;
-    MISSING_REMOTE_REF_REASONS = ["couldn't find remote ref", "Couldn't find remote ref"];
-    log5 = createDebugLogger2({ prefix: "GitManager" });
+    log6 = createDebugLogger2({ prefix: "GitManager" });
     GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
     FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
     remoteInitLocks = /* @__PURE__ */ new Map();
@@ -8714,6 +8766,13 @@ var init_generate_ai_content = __esm({
         this.name = "GitRemoteRefMissingError";
       }
     };
+    RemoteNotReadyError = class extends Error {
+      constructor(expectedRemotePath) {
+        super(`CanopyCMS: no git remote is available yet. defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is not set and the CMS worker has not created ${expectedRemotePath}; the worker may still be starting.`);
+        this.expectedRemotePath = expectedRemotePath;
+        this.name = "RemoteNotReadyError";
+      }
+    };
     GitManager = class _GitManager {
       constructor(options, gitOptions) {
         this.repoPath = path17.resolve(options.repoPath);
@@ -8724,14 +8783,14 @@ var init_generate_ai_content = __esm({
         this.git.env(gitChildEnv({ GIT_CEILING_DIRECTORIES: path17.dirname(this.repoPath) }));
       }
       static async cloneRepo(remoteUrl, targetPath, baseBranch = "main") {
-        log5.debug("git", "Cloning repository", {
+        log6.debug("git", "Cloning repository", {
           remoteUrl,
           targetPath,
           baseBranch
         });
         const git = simpleGit22();
         await git.clone(remoteUrl, targetPath, ["--branch", baseBranch, "--single-branch"]);
-        log5.debug("git", "Clone complete");
+        log6.debug("git", "Clone complete");
       }
       /**
        * Initializes a local bare git repository to simulate a remote for dev mode,
@@ -8745,15 +8804,15 @@ var init_generate_ai_content = __esm({
       static async ensureLocalSimulatedRemote(options) {
         const existingLock = remoteInitLocks.get(options.remotePath);
         if (existingLock) {
-          log5.debug("git", "Waiting for existing remote initialization", {
+          log6.debug("git", "Waiting for existing remote initialization", {
             remotePath: options.remotePath
           });
           await existingLock;
         }
-        const lockPromise = log5.timed("git", "ensureLocalSimulatedRemote", async () => {
+        const lockPromise = log6.timed("git", "ensureLocalSimulatedRemote", async () => {
           let releaseLock;
           try {
-            log5.debug("git", "Initializing local simulated remote", {
+            log6.debug("git", "Initializing local simulated remote", {
               remotePath: options.remotePath,
               baseBranch: options.baseBranch
             });
@@ -8768,7 +8827,7 @@ var init_generate_ai_content = __esm({
                 throw err;
             }
             if (remoteExists && await _GitManager.bareRemoteHasBranch(options.remotePath, options.baseBranch)) {
-              log5.debug("git", "Remote already has base branch, skipping");
+              log6.debug("git", "Remote already has base branch, skipping");
               return;
             }
             let gitRoot = options.sourcePath;
@@ -8787,8 +8846,8 @@ var init_generate_ai_content = __esm({
             }
             let hasCommits = false;
             try {
-              const log82 = await sourceGit.log(["-1"]);
-              hasCommits = log82.total > 0;
+              const log92 = await sourceGit.log(["-1"]);
+              hasCommits = log92.total > 0;
             } catch {
               hasCommits = false;
             }
@@ -8800,12 +8859,12 @@ var init_generate_ai_content = __esm({
               throw new Error(`Cannot initialize local simulated remote: base branch '${options.baseBranch}' does not exist locally. Please checkout '${options.baseBranch}' first or provide an explicit remoteUrl.`);
             }
             if (remoteExists) {
-              log5.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
+              log6.debug("git", "Existing remote is missing base branch \u2014 pushing it from source", {
                 remotePath: options.remotePath,
                 baseBranch: options.baseBranch
               });
             } else {
-              log5.debug("git", "Creating bare remote repository");
+              log6.debug("git", "Creating bare remote repository");
               await simpleGit22().raw([
                 "init",
                 "--bare",
@@ -8819,13 +8878,13 @@ var init_generate_ai_content = __esm({
               baseBranch: options.baseBranch,
               subdirectory: options.subdirectory
             });
-            log5.debug("git", "Remote initialization complete");
+            log6.debug("git", "Remote initialization complete");
           } finally {
             if (releaseLock) {
               try {
                 await releaseLock();
               } catch (err) {
-                log5.debug("git", "Failed to release remote-init lock", { err });
+                log6.debug("git", "Failed to release remote-init lock", { err });
               }
             }
             remoteInitLocks.delete(options.remotePath);
@@ -9060,7 +9119,7 @@ var init_generate_ai_content = __esm({
           try {
             const stat = await fs16.stat(config.autoDetectRemotePath);
             if (stat.isDirectory()) {
-              log5.debug("git", "Auto-detected local remote", {
+              log6.debug("git", "Auto-detected local remote", {
                 path: config.autoDetectRemotePath
               });
               return config.autoDetectRemotePath;
@@ -9124,7 +9183,7 @@ var init_generate_ai_content = __esm({
           try {
             const stat = await fs16.stat(gitPath);
             if (stat.isDirectory()) {
-              log5.debug("git", "Removing corrupt .git directory", {
+              log6.debug("git", "Removing corrupt .git directory", {
                 workspacePath: options.workspacePath
               });
               await fs16.rm(gitPath, { recursive: true });
@@ -9145,6 +9204,10 @@ var init_generate_ai_content = __esm({
             allowNetworkRemoteInProd: options.allowNetworkRemoteInProd
           });
           if (!remoteUrl) {
+            const { operatingStrategy: operatingStrategy22 } = await Promise.resolve().then(() => (init_operating_mode(), operating_mode_exports));
+            const { autoDetectRemotePath } = operatingStrategy22(options.mode).getRemoteUrlConfig();
+            if (autoDetectRemotePath)
+              throw new RemoteNotReadyError(autoDetectRemotePath);
             throw new Error("CanopyCMS: defaultRemoteUrl (or CANOPYCMS_REMOTE_URL) is required to initialize workspace");
           }
           try {
@@ -9168,7 +9231,7 @@ var init_generate_ai_content = __esm({
         await git.git.addConfig("canopycms.managed", "true");
         await git.git.addConfig("user.name", options.gitBotAuthorName);
         await git.git.addConfig("user.email", options.gitBotAuthorEmail);
-        log5.debug("git", "Marked workspace as CanopyCMS-managed", {
+        log6.debug("git", "Marked workspace as CanopyCMS-managed", {
           workspacePath: options.workspacePath
         });
         if (!justCloned) {
@@ -9351,6 +9414,10 @@ var init_generate_ai_content = __esm({
         const fileArray = Array.isArray(files) ? files : [files];
         await this.git.add(fileArray);
       }
+      /** Stage every working-tree change except canopycms's own state. See {@link stageAllExceptCanopyState}. */
+      async addAllExceptCanopyState() {
+        await stageAllExceptCanopyState(this.git);
+      }
       async commit(message) {
         await this.git.commit(message);
       }
@@ -9382,12 +9449,12 @@ var init_generate_ai_content = __esm({
        * ("couldn't find remote ref"); that counts as "ahead", not an error.
        */
       async hasUnpushedCommits(branch) {
-        const target = branch ?? await this.git.revparse(["--abbrev-ref", "--end-of-options", "HEAD"]);
-        const localSha = (await this.git.revparse(["--end-of-options", target])).trim();
+        const target = branch ?? await this.git.revparse(["--verify", "--abbrev-ref", "--end-of-options", "HEAD"]);
+        const localSha = (await this.git.revparse(["--verify", "--end-of-options", target])).trim();
         let fetchedTip;
         try {
           await this.git.raw(["fetch", "--end-of-options", this.remote, target]);
-          fetchedTip = (await this.git.revparse(["--end-of-options", "FETCH_HEAD"])).trim();
+          fetchedTip = (await this.git.revparse(["--verify", "--end-of-options", "FETCH_HEAD"])).trim();
         } catch {
           return true;
         }
@@ -9396,6 +9463,25 @@ var init_generate_ai_content = __esm({
         const aheadCount = (await this.git.raw(["rev-list", "--count", `${fetchedTip}..${localSha}`])).trim();
         return aheadCount !== "0";
       }
+      /**
+       * Repo-relative paths that differ between HEAD and its merge base with the
+       * base branch: everything the branch changes, across all of its commits.
+       * Diffs against the just-fetched base tip pinned to a SHA — the pullBaseInner
+       * constraint.
+       */
+      async listChangedPathsSinceBase() {
+        await this.git.raw(["fetch", "--end-of-options", this.remote, this.baseBranch]);
+        const baseTip = (await this.git.revparse(["--verify", "--end-of-options", "FETCH_HEAD"])).trim();
+        const output = await this.git.raw([
+          "diff",
+          "--name-only",
+          "-z",
+          "--no-renames",
+          `${baseTip}...HEAD`,
+          "--"
+        ]);
+        return output.split("\0").filter((p5) => p5.length > 0);
+      }
       async ensureAuthor(author) {
         const config = await this.git.listConfig();
         const isManaged = config.all["canopycms.managed"] === "true";
@@ -9462,10 +9548,10 @@ var init_generate_ai_content = __esm({
         }
       }
       async createOrphanSettingsBranchInner(branchName, initialFiles) {
-        log5.debug("git", "Creating orphan settings branch", { branchName });
+        log6.debug("git", "Creating orphan settings branch", { branchName });
         const branches = await this.git.branch();
         if (branches.all.includes(branchName)) {
-          log5.debug("git", "Orphan branch already exists", { branchName });
+          log6.debug("git", "Orphan branch already exists", { branchName });
           await this.git.checkout(branchName);
           return;
         }
@@ -9481,17 +9567,17 @@ var init_generate_ai_content = __esm({
           await this.git.add(filePath);
         }
         await this.git.commit("Initialize settings branch", ["--allow-empty"]);
-        log5.debug("git", "Orphan settings branch created", { branchName });
+        log6.debug("git", "Orphan settings branch created", { branchName });
       }
     };
-    log6 = createDebugLogger2({ prefix: "BranchWorkspace" });
+    log7 = createDebugLogger2({ prefix: "BranchWorkspace" });
     workspaceInitLocks = /* @__PURE__ */ new Map();
     BranchWorkspaceManager = class {
       constructor(config) {
         this.config = config;
       }
       async ensureGitWorkspace(options) {
-        return log6.timed("workspace", "ensureGitWorkspace", async () => {
+        return log7.timed("workspace", "ensureGitWorkspace", async () => {
           const existingLock = workspaceInitLocks.get(options.branchRoot);
           if (existingLock) {
             await existingLock;
@@ -9500,11 +9586,11 @@ var init_generate_ai_content = __esm({
           const lockPromise = (async () => {
             let releaseLock;
             try {
-              log6.debug("workspace", "Ensuring git workspace", {
+              log7.debug("workspace", "Ensuring git workspace", {
                 branchName: options.branchName,
                 mode: options.mode
               });
-              releaseLock = await acquireProvisioningLock(path18.dirname(options.branchRoot), `.${path18.basename(options.branchRoot)}.init.lock`);
+              releaseLock = await acquireProvisioningLock(path18.dirname(options.branchRoot), branchProvisioningLockName(path18.basename(options.branchRoot)));
               await GitManager.initializeWorkspace({
                 workspacePath: options.branchRoot,
                 branchName: options.branchName,
@@ -9525,7 +9611,7 @@ var init_generate_ai_content = __esm({
                 try {
                   await releaseLock();
                 } catch (err) {
-                  log6.debug("workspace", "Failed to release workspace-init lock", { err });
+                  log7.debug("workspace", "Failed to release workspace-init lock", { err });
                 }
               }
               workspaceInitLocks.delete(options.branchRoot);
@@ -9572,7 +9658,7 @@ var init_generate_ai_content = __esm({
         };
       }
     };
-    log7 = createDebugLogger2({ prefix: "ContentListing" });
+    log8 = createDebugLogger2({ prefix: "ContentListing" });
     normalizePath = (root, target) => {
       const result = validateAndNormalizePath(root, target);
       if (!result.valid) {
@@ -9598,7 +9684,7 @@ var init_generate_ai_content = __esm({
       } catch (err) {
         if (isNotFoundError3(err))
           return {};
-        log7.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage3(err)}`);
+        log8.warn("readEntryData", `Failed to read entry data from ${filePath}: ${getErrorMessage3(err)}`);
         return {};
       }
     };
@@ -9655,7 +9741,7 @@ var init_generate_ai_content = __esm({
         const relativePath = normalizePath(root, absolutePath);
         const parsed = parseTypedFilename(file.name, entryTypes);
         if (!parsed) {
-          log7.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
+          log8.warn("listCollectionEntries", `Skipping file with unrecognized filename format: ${file.name} (expected {type}.{slug}.{id}.{ext} with a known entry type and valid 12-char Base58 ID)`);
           if (looksLikeMalformedEntry(file.name, entryTypes)) {
             onSkip?.({ filename: file.name, collectionPath: collection.logicalPath });
           }
@@ -9670,7 +9756,7 @@ var init_generate_ai_content = __esm({
           readEntryData(absolutePath, format, bodyField)
         ]);
         const item = {
-          logicalPath: `${collection.logicalPath}/${slug}`,
+          logicalPath: entryLogicalPath(collection.logicalPath, slug),
           contentId,
           slug,
           collectionPath: collection.logicalPath,
@@ -9697,6 +9783,23 @@ var init_generate_ai_content = __esm({
   }
 });
 
+// dist/utils/git.js
+import { simpleGit as simpleGit4 } from "simple-git";
+function isCanopyInternalPath(repoRelativePath) {
+  return repoRelativePath === CANOPY_META_DIR2 || repoRelativePath.startsWith(`${CANOPY_META_DIR2}/`);
+}
+async function stageAllExceptCanopyState2(git) {
+  await git.add(["-A"]);
+  await git.raw(["reset", "-q", "--", CANOPY_META_DIR2]);
+}
+var CANOPY_META_DIR2;
+var init_git = __esm({
+  "dist/utils/git.js"() {
+    "use strict";
+    CANOPY_META_DIR2 = ".canopy-meta";
+  }
+});
+
 // dist/utils/atomic-write.js
 import fs19 from "node:fs/promises";
 import path23 from "node:path";
@@ -9783,6 +9886,10 @@ var init_debug2 = __esm({
           throw new Error(errorMsg);
         }
       }
+      /**
+       * Keyed by label alone, so two overlapping timers with one label overwrite each other;
+       * anything that can run concurrently uses {@link timed}.
+       */
       time(label) {
         this.timers.set(label, Date.now());
       }
@@ -9797,12 +9904,16 @@ var init_debug2 = __esm({
         this.debug(category, `${label} completed`, { durationMs: duration });
         return duration;
       }
+      /**
+       * Log `<label> completed {durationMs}` once `fn` settles. The start time is local to the
+       * call, so concurrent spans with the same label on one logger never overwrite each other.
+       */
       async timed(category, label, fn) {
-        this.time(label);
+        const start = Date.now();
         try {
           return await fn();
         } finally {
-          this.timeEnd(category, label);
+          this.debug(category, `${label} completed`, { durationMs: Date.now() - start });
         }
       }
     };
@@ -9827,7 +9938,7 @@ async function bumpResourceGeneration2(root, resource, options) {
     await atomicWriteFile3(resourceGenerationPath2(root, resource), token);
     return token;
   } catch (err) {
-    log8.warn("generation", `Failed to bump ${resource} generation for ${root}`, {
+    log9.warn("generation", `Failed to bump ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
     if (options?.mustSucceed)
@@ -9842,7 +9953,7 @@ async function readResourceGeneration2(root, resource) {
   } catch (err) {
     if (isNodeError(err) && err.code === "ENOENT")
       return { ok: true, token: null };
-    log8.warn("generation", `Failed to read ${resource} generation for ${root}`, {
+    log9.warn("generation", `Failed to read ${resource} generation for ${root}`, {
       error: getErrorMessage(err)
     });
     return { ok: false };
@@ -9851,14 +9962,14 @@ async function readResourceGeneration2(root, resource) {
 function isGenerationCurrent2(snapshotToken, read) {
   return read.ok && read.token === snapshotToken;
 }
-var log8, META_DIR3;
+var log9, META_DIR3;
 var init_resource_generation = __esm({
   "dist/resource-generation.js"() {
     "use strict";
     init_atomic_write2();
     init_error();
     init_debug2();
-    log8 = createDebugLogger3({ prefix: "ResourceGeneration" });
+    log9 = createDebugLogger3({ prefix: "ResourceGeneration" });
     META_DIR3 = ".canopy-meta";
   }
 });
@@ -10263,7 +10374,8 @@ var init_field3 = __esm({
     });
     objectFieldSchema3 = fieldBaseSchema3.extend({
       type: z10.literal("object"),
-      fields: z10.array(z10.lazy(() => fieldHolder3[0])).min(1)
+      fields: z10.array(z10.lazy(() => fieldHolder3[0])).min(1),
+      itemTitleField: z10.string().min(1).optional()
     });
     inlineGroupFieldSchema3 = z10.object({
       type: z10.literal("group"),
@@ -10505,6 +10617,9 @@ var init_config4 = __esm({
       defaultRemoteUrl: defaultRemoteUrlSchema3.optional(),
       gitBotAuthorName: gitBotAuthorNameSchema3,
       gitBotAuthorEmail: gitBotAuthorEmailSchema3,
+      // Unset reads as on for Edited-by and off for Co-authored-by (services.ts submitBranch).
+      gitEditedByTrailers: z14.boolean().optional(),
+      gitCoAuthoredByTrailers: z14.boolean().optional(),
       githubTokenEnvVar: githubTokenEnvVarSchema3.optional(),
       // Required by design (follow-up to SEC-C1): a prod deploy that omits `mode` must fail
       // validation loudly rather than silently running header-trusting dev auth semantics.
@@ -10516,7 +10631,6 @@ var init_config4 = __esm({
       // Default false/unset — the standard AWS Lambda+worker topology must leave this unset.
       allowNetworkRemoteInProd: z14.boolean().optional(),
       settingsBranch: z14.string().optional(),
-      autoCreateSettingsPR: z14.boolean().optional(),
       // `.optional()`, NOT bare `deploymentNameSchema`: its own `.default('prod')` would make
       // `parse(undefined)` resolve to 'prod' instead of staying `undefined`, collapsing the
       // env > config > modeDefault precedence chain `resolveDeploymentName`
@@ -10577,6 +10691,18 @@ var init_build_mode = __esm({
   }
 });
 
+// dist/utils/request-timing.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+var storage2, log10;
+var init_request_timing = __esm({
+  "dist/utils/request-timing.js"() {
+    "use strict";
+    init_debug2();
+    storage2 = new AsyncLocalStorage2();
+    log10 = createDebugLogger3({ prefix: "CanopyCMS" });
+  }
+});
+
 // dist/branch-schema-cache.js
 var SCHEMA_GENERATION_RESOURCE2;
 var init_branch_schema_cache = __esm({
@@ -10587,6 +10713,8 @@ var init_branch_schema_cache = __esm({
     init_entry_type_reference_validator();
     init_build_mode();
     init_resource_generation();
+    init_request_timing();
+    init_git();
     SCHEMA_GENERATION_RESOURCE2 = "schema";
   }
 });
@@ -10614,7 +10742,7 @@ var init_content_index_generation = __esm({
 // dist/sync-core.js
 import fs24 from "node:fs/promises";
 import path26 from "node:path";
-import { simpleGit as simpleGit4 } from "simple-git";
+import { simpleGit as simpleGit5 } from "simple-git";
 function assertWithinDir(resolved, parent, label) {
   const normalizedResolved = path26.resolve(resolved);
   const normalizedParent = path26.resolve(parent);
@@ -10698,10 +10826,10 @@ async function pushContentToWorkspace(options) {
     throw err;
   }
   try {
-    const wsGit = simpleGit4({ baseDir: branchPath });
-    await wsGit.add("-A");
-    const postStatus = await wsGit.status();
-    if (postStatus.files.length === 0) {
+    const wsGit = simpleGit5({ baseDir: branchPath });
+    await stageAllExceptCanopyState2(wsGit);
+    const staged = (await wsGit.status()).files.filter((f) => !isCanopyInternalPath(f.path));
+    if (staged.length === 0) {
       if (baseTag)
         await wsGit.tag(["-f", baseTag]);
       return { fileCount: 0 };
@@ -10709,7 +10837,7 @@ async function pushContentToWorkspace(options) {
     await wsGit.commit(commitMessage ?? "sync: update content from working tree");
     if (baseTag)
       await wsGit.tag(["-f", baseTag]);
-    return { fileCount: postStatus.files.length };
+    return { fileCount: staged.length };
   } finally {
     await invalidateBranchContentCaches2(branchPath);
   }
@@ -10720,18 +10848,11 @@ var init_sync_core = __esm({
     "use strict";
     init_content_index_generation();
     init_fs();
+    init_git();
     SYNC_BASE_TAG = "canopycms-sync-base";
   }
 });
 
-// dist/utils/git.js
-import { simpleGit as simpleGit5 } from "simple-git";
-var init_git = __esm({
-  "dist/utils/git.js"() {
-    "use strict";
-  }
-});
-
 // dist/utils/provisioning-lock.js
 import lockfile3 from "proper-lockfile";
 var init_provisioning_lock = __esm({
@@ -10758,15 +10879,15 @@ async function ensureGitExcludePattern2(repoPath, pattern) {
   }
   const lines = content.split("\n");
   if (lines.some((line) => line.trim() === pattern)) {
-    log9.debug("git", "Pattern already in .git/info/exclude", { pattern });
+    log11.debug("git", "Pattern already in .git/info/exclude", { pattern });
     return;
   }
   const needsLeadingNewline = content.length > 0 && !content.endsWith("\n");
   const newContent = content + (needsLeadingNewline ? "\n" : "") + pattern + "\n";
   await fs25.writeFile(excludePath, newContent, "utf-8");
-  log9.debug("git", "Added pattern to .git/info/exclude", { pattern });
+  log11.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
-var log9;
+var log11;
 var init_git_manager = __esm({
   "dist/git-manager.js"() {
     "use strict";
@@ -10776,7 +10897,7 @@ var init_git_manager = __esm({
     init_error();
     init_git();
     init_provisioning_lock();
-    log9 = createDebugLogger3({ prefix: "GitManager" });
+    log11 = createDebugLogger3({ prefix: "GitManager" });
   }
 });
 
@@ -10993,9 +11114,6 @@ var init_client_unsafe_strategy2 = __esm({
           throw new Error("gitBotAuthorName and gitBotAuthorEmail are required in prod mode");
         }
       }
-      shouldCreateSettingsPR(config) {
-        return config.autoCreateSettingsPR ?? true;
-      }
     };
     DevStrategy3 = class extends DevClientSafeStrategy3 {
       getWorkspaceRoot(sourceRoot) {
@@ -11042,9 +11160,6 @@ var init_client_unsafe_strategy2 = __esm({
       }
       validateConfig(_config) {
       }
-      shouldCreateSettingsPR(_config) {
-        return false;
-      }
     };
     strategyCache3 = /* @__PURE__ */ new Map();
   }
@@ -11157,13 +11272,14 @@ async function syncPush(options) {
     }
     return { fileCount: 0 };
   }
-  if (status.files.length > 0 && !options.force) {
-    p2.log.warn(`Branch workspace has ${status.files.length} uncommitted change(s) that will be committed to history then overwritten:`);
-    for (const file of status.files.slice(0, 10)) {
+  const editorChanges = status.files.filter((f) => !isCanopyInternalPath(f.path));
+  if (editorChanges.length > 0 && !options.force) {
+    p2.log.warn(`Branch workspace has ${editorChanges.length} uncommitted change(s) that will be committed to history then overwritten:`);
+    for (const file of editorChanges.slice(0, 10)) {
       p2.log.warn(`  ${file.path}`);
     }
-    if (status.files.length > 10) {
-      p2.log.warn(`  ... and ${status.files.length - 10} more`);
+    if (editorChanges.length > 10) {
+      p2.log.warn(`  ... and ${editorChanges.length - 10} more`);
     }
     const confirm5 = await p2.confirm({
       message: "Continue? Editor changes will be preserved in git history.",
@@ -11174,8 +11290,8 @@ async function syncPush(options) {
       return { fileCount: 0 };
     }
   }
-  if (status.files.length > 0) {
-    await wsGit.add("-A");
+  if (editorChanges.length > 0) {
+    await stageAllExceptCanopyState2(wsGit);
     await wsGit.commit("sync: save editor state before push");
     p2.log.info("Committed editor changes to history before push");
   }
@@ -11312,8 +11428,8 @@ async function syncBoth(options) {
     }
     return { pushed: 0, pulled: 0 };
   }
-  if (status.files.length > 0) {
-    await wsGit.add("-A");
+  if (status.files.some((f) => !isCanopyInternalPath(f.path))) {
+    await stageAllExceptCanopyState2(wsGit);
     await wsGit.commit("sync: save editor state before merge");
     p2.log.info("Committed editor changes before merge");
   }
@@ -11342,9 +11458,9 @@ async function syncBoth(options) {
       });
       throw err;
     }
-    await wsGit.add("-A");
-    const incomingStatus = await wsGit.status();
-    if (incomingStatus.files.length === 0) {
+    await stageAllExceptCanopyState2(wsGit);
+    const incomingFiles = (await wsGit.status()).files.filter((f) => !isCanopyInternalPath(f.path));
+    if (incomingFiles.length === 0) {
       await wsGit.checkout(currentBranch);
       await wsGit.raw(["branch", "-D", incomingBranch]);
       p2.log.info("No working-tree changes to merge \u2014 pulling editor changes only");
@@ -11385,7 +11501,7 @@ async function syncBoth(options) {
     await wsGit.tag(["-f", SYNC_BASE_TAG]);
     p2.log.success("Merged working-tree changes with editor changes");
     const pullResult = await syncPull({ ...options, branch: branchName, force: true });
-    return { pushed: incomingStatus.files.length, pulled: pullResult.fileCount };
+    return { pushed: incomingFiles.length, pulled: pullResult.fileCount };
   } finally {
     await invalidateBranchContentCaches2(branchPath);
   }
@@ -11433,6 +11549,7 @@ var init_sync = __esm({
   "dist/cli/sync.js"() {
     "use strict";
     init_fs();
+    init_git();
     init_sync_core();
     init_content_index_generation();
     init_git_manager();
@@ -11616,7 +11733,7 @@ async function withOccFileLock2(filePath, fn) {
         // Our critical sections are short and idempotent-on-conflict (OCC
         // verify inside); log and let the section finish.
         onCompromised: (err) => {
-          log11.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
+          log13.warn("lock", `Lock compromised mid-hold for ${filePath}`, {
             error: getErrorMessage(err)
           });
         }
@@ -11638,17 +11755,17 @@ async function withOccFileLock2(filePath, fn) {
     await release().catch((err) => {
       if (isNodeError(err) && err.code === "ENOENT")
         return;
-      log11.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
+      log13.warn("lock", `Failed to release lock for ${filePath}`, { error: getErrorMessage(err) });
     });
   }
 }
-var log11, OccWriteConflictError2;
+var log13, OccWriteConflictError2;
 var init_occ_json_write = __esm({
   "dist/utils/occ-json-write.js"() {
     "use strict";
     init_error();
     init_debug2();
-    log11 = createDebugLogger3({ prefix: "OccJsonWrite" });
+    log13 = createDebugLogger3({ prefix: "OccJsonWrite" });
     OccWriteConflictError2 = class extends Error {
       constructor(message = "Concurrent modification detected") {
         super(message);
@@ -11698,7 +11815,7 @@ var init_branch_metadata_file = __esm({
 // dist/branch-registry.js
 import fs29 from "node:fs/promises";
 import path33 from "node:path";
-var log12, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
+var log14, REGISTRY_FILE2, REGISTRY_STALE_FILE2, REGISTRY_TEMP_FILE2, REGISTRY_VERSION2, RESOURCE4, GET_MISS_REFRESH_MIN_INTERVAL_MS2, BranchRegistry2;
 var init_branch_registry = __esm({
   "dist/branch-registry.js"() {
     "use strict";
@@ -11707,7 +11824,7 @@ var init_branch_registry = __esm({
     init_debug2();
     init_logger3();
     init_resource_generation();
-    log12 = createDebugLogger3({ prefix: "BranchRegistry" });
+    log14 = createDebugLogger3({ prefix: "BranchRegistry" });
     REGISTRY_FILE2 = "branches.json";
     REGISTRY_STALE_FILE2 = "branches.stale.json";
     REGISTRY_TEMP_FILE2 = "branches.tmp.json";
@@ -11787,7 +11904,7 @@ var init_branch_registry = __esm({
             });
           await this.regenerate();
         } catch (err) {
-          log12.warn("invalidate", "Eager regeneration after invalidate() failed", {
+          log14.warn("invalidate", "Eager regeneration after invalidate() failed", {
             error: getErrorMessage(err)
           });
         }