canopycms 0.7.1 → 0.8.0

package/dist/cli/generate-ai-content.js

@@ -346,6 +346,114 @@ var init_normalize = __esm({
   }
 });
 
+// dist/paths/branch-name.js
+function sanitizeBranchName(branchName) {
+  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const squashed = replaced.replace(/-+/g, "-");
+  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
+  return trimmedDots || "branch";
+}
+function branchShortName(name, namespace) {
+  if (namespace === null || !name.startsWith(namespace) || name.length === namespace.length) {
+    return name;
+  }
+  const rest = name.slice(namespace.length);
+  return rest.includes("/") ? name : rest;
+}
+function isSettingsBranchName(branchName, settingsBranchName) {
+  const sanitized = sanitizeBranchName(branchName);
+  return sanitized.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX) || settingsBranchName !== void 0 && sanitized === sanitizeBranchName(settingsBranchName);
+}
+var RESERVED_SETTINGS_BRANCH_PREFIX;
+var init_branch_name = __esm({
+  "dist/paths/branch-name.js"() {
+    "use strict";
+    RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
+  }
+});
+
+// dist/paths/validation.js
+function isValidContentId(id) {
+  return CONTENT_ID_PATTERN.test(id);
+}
+function parseBranchRef(name) {
+  if (!name || typeof name !== "string") {
+    return { ok: false, error: "Branch name is required" };
+  }
+  if (name.length > MAX_BRANCH_NAME_LENGTH) {
+    return { ok: false, error: `Branch name too long (max ${MAX_BRANCH_NAME_LENGTH} characters)` };
+  }
+  if (name.includes("..")) {
+    return { ok: false, error: 'Branch name cannot contain ".."' };
+  }
+  if (name.startsWith("/") || name.endsWith("/") || name.includes("//")) {
+    return { ok: false, error: "Invalid branch name format (invalid slashes)" };
+  }
+  if (name.includes(" ")) {
+    return { ok: false, error: "Branch name cannot contain spaces" };
+  }
+  if (name.startsWith("-")) {
+    return { ok: false, error: 'Branch name cannot start with "-"' };
+  }
+  if (name.startsWith(".") || name.endsWith(".")) {
+    return { ok: false, error: "Branch name cannot start or end with a dot" };
+  }
+  if (name.includes("@{")) {
+    return { ok: false, error: 'Branch name cannot contain "@{"' };
+  }
+  if (name === "HEAD" || name === "@") {
+    return { ok: false, error: 'Branch name cannot be the reserved ref "HEAD" or "@"' };
+  }
+  if (/[~^:?*[\\\x00-\x1f\x7f]/.test(name)) {
+    return { ok: false, error: "Branch name contains invalid characters" };
+  }
+  if (name.endsWith(".lock")) {
+    return { ok: false, error: 'Branch name cannot end with ".lock"' };
+  }
+  return { ok: true, name };
+}
+function parseSlug(slug) {
+  if (!slug) {
+    return {
+      ok: false,
+      error: "Slug is required"
+    };
+  }
+  if (slug.length > 64) {
+    return { ok: false, error: "Slug too long (max 64 characters)" };
+  }
+  if (slug.includes("/") || slug.includes("\\")) {
+    return {
+      ok: false,
+      error: "Slug cannot contain path separators"
+    };
+  }
+  if (slug === "." || slug === "..") {
+    return {
+      ok: false,
+      error: "Slug cannot be a traversal sequence"
+    };
+  }
+  const normalized = slug.toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
+    return {
+      ok: false,
+      error: "Slug must start with a letter or number and contain only lowercase letters, numbers, and hyphens"
+    };
+  }
+  return { ok: true, slug: normalized };
+}
+var BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, MAX_BRANCH_NAME_LENGTH;
+var init_validation = __esm({
+  "dist/paths/validation.js"() {
+    "use strict";
+    BASE58_PATTERN = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
+    CONTENT_ID_PATTERN = new RegExp(`^${BASE58_PATTERN}{12}$`);
+    PHYSICAL_SEGMENT_PATTERN = new RegExp(`\\.${BASE58_PATTERN}{12}(?:\\.[a-z]+)?$`);
+    MAX_BRANCH_NAME_LENGTH = 250;
+  }
+});
+
 // dist/paths/types.js
 var ROOT_COLLECTION_ID;
 var init_types = __esm({
@@ -946,6 +1054,8 @@ var init_config = __esm({
       // (operating-mode/deployment-name.ts) implements — config would always "win" over
       // modeDefault, masking dev's real default of 'local'. Do not remove `.optional()`.
       deploymentName: deploymentNameSchema.optional(),
+      // Checked where it is resolved (operating-mode/branch-namespace.ts), with the deployment name.
+      branchNamespace: z6.string().optional(),
       contentRoot: contentRootSchema.default("content"),
       sourceRoot: sourceRootSchema.optional(),
       basePath: basePathSchema,
@@ -1000,7 +1110,7 @@ var init_mode_env = __esm({
 
 // dist/config/validation.js
 var forEachReferenceField;
-var init_validation = __esm({
+var init_validation2 = __esm({
   "dist/config/validation.js"() {
     "use strict";
     forEachReferenceField = (fields, visit3) => {
@@ -1134,6 +1244,80 @@ var init_deployment_name = __esm({
   }
 });
 
+// dist/operating-mode/branch-namespace.js
+function warnOnce(message) {
+  if (warned4)
+    return;
+  warned4 = true;
+  canopyLogWarn(message);
+}
+function branchNamespaceProblem(namespace) {
+  if (!namespace.endsWith("/"))
+    return 'it must end with "/"';
+  const sample = `${namespace}x`;
+  if (!/^[\x21-\x7e]+$/.test(namespace))
+    return "it is not printable ASCII without spaces";
+  if (/["%{}]/.test(namespace))
+    return 'it contains ", %, { or }';
+  if (/^(?:refs|heads|tags|remotes)\//i.test(namespace)) {
+    return "it starts with 'refs/', 'heads/', 'tags/' or 'remotes/'";
+  }
+  const parsed = parseBranchRef(sample);
+  if (!parsed.ok)
+    return `a branch in it would be refused (${parsed.error})`;
+  if (sample.split("/").some((part) => part.startsWith(".") || part.endsWith(".lock"))) {
+    return "a part of it starts with '.' or ends with '.lock'";
+  }
+  const directoryPrefix = sanitizeBranchName(namespace);
+  if (RESERVED_SETTINGS_BRANCH_PREFIX.startsWith(directoryPrefix) || sanitizeBranchName(sample).startsWith(RESERVED_SETTINGS_BRANCH_PREFIX)) {
+    return `some branches in it would be ${RESERVED_SETTINGS_BRANCH_PREFIX}* settings branches`;
+  }
+  return null;
+}
+function resolveBranchNamespaceTemplate(template, deploymentName, source) {
+  const unknown = template.replaceAll(DEPLOYMENT_PLACEHOLDER, "").match(/\{[^}]*\}?/);
+  if (unknown) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(template)} (from ${source}): ${JSON.stringify(unknown[0])} is not a placeholder; the only one is ${DEPLOYMENT_PLACEHOLDER}`);
+  }
+  const namespace = template.replaceAll(DEPLOYMENT_PLACEHOLDER, deploymentName);
+  const problem = branchNamespaceProblem(namespace);
+  if (problem !== null) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(namespace)} (from ${source}): ${problem}`);
+  }
+  return namespace;
+}
+function resolveBranchNamespace(config, modeDefault, env = process.env) {
+  const fromEnv = env[BRANCH_NAMESPACE_ENV]?.trim();
+  const [template, source] = fromEnv ? [fromEnv, BRANCH_NAMESPACE_ENV] : config.branchNamespace !== void 0 ? [config.branchNamespace, "config.branchNamespace"] : [DEFAULT_BRANCH_NAMESPACE_TEMPLATE, "the default"];
+  const deploymentName = resolveDeploymentName({ deploymentName: config.deploymentName }, modeDefault);
+  const namespace = resolveBranchNamespaceTemplate(template, deploymentName, source);
+  if (fromEnv && config.branchNamespace !== void 0) {
+    let fromConfig = null;
+    try {
+      fromConfig = resolveBranchNamespaceTemplate(config.branchNamespace, deploymentName, "config.branchNamespace");
+    } catch {
+    }
+    if (fromConfig !== namespace) {
+      warnOnce(`CanopyCMS: ${BRANCH_NAMESPACE_ENV} (${JSON.stringify(fromEnv)}) and config.branchNamespace (${JSON.stringify(config.branchNamespace)}) do not resolve to the same valid namespace; using the environment variable, which infrastructure stamps per stack.`);
+    }
+  }
+  return namespace;
+}
+var warned4, DEPLOYMENT_PLACEHOLDER, DEFAULT_BRANCH_NAMESPACE_TEMPLATE, BRANCH_NAMESPACE_ENV;
+var init_branch_namespace = __esm({
+  "dist/operating-mode/branch-namespace.js"() {
+    "use strict";
+    init_branch_name();
+    init_validation();
+    init_logger();
+    init_deployment_name();
+    warned4 = false;
+    DEPLOYMENT_PLACEHOLDER = "{deployment}";
+    DEFAULT_BRANCH_NAMESPACE_TEMPLATE = `canopycms/${DEPLOYMENT_PLACEHOLDER}/`;
+    BRANCH_NAMESPACE_ENV = "CANOPYCMS_BRANCH_NAMESPACE";
+  }
+});
+
 // dist/config/index.js
 var init_config2 = __esm({
   "dist/config/index.js"() {
@@ -1173,6 +1357,7 @@ var init_client_unsafe_strategy = __esm({
   "dist/operating-mode/client-unsafe-strategy.js"() {
     "use strict";
     init_client_safe_strategy();
+    init_branch_namespace();
     init_deployment_name();
     init_config2();
     ProdStrategy = class extends ProdClientSafeStrategy {
@@ -1213,6 +1398,9 @@ var init_client_unsafe_strategy = __esm({
           return config.settingsBranch;
         return `canopycms-settings-${resolveDeploymentName(config, "prod")}`;
       }
+      getBranchNamespace(config) {
+        return resolveBranchNamespace(config, "prod");
+      }
       getSettingsRoot(sourceRoot) {
         return path9.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
@@ -1262,6 +1450,9 @@ var init_client_unsafe_strategy = __esm({
           return config.settingsBranch;
         return `canopycms-settings-${resolveDeploymentName(config, "local")}`;
       }
+      getBranchNamespace(config) {
+        return resolveBranchNamespace(config, "local");
+      }
       getSettingsRoot(sourceRoot) {
         return path9.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
@@ -1326,11 +1517,27 @@ __export(worker_status_exports, {
   WORKER_STATUS_FILE: () => WORKER_STATUS_FILE,
   readCarriedOverStatus: () => readCarriedOverStatus,
   readWorkerStartupFailure: () => readWorkerStartupFailure,
+  readWorkerStatus: () => readWorkerStatus,
   readWorkerStatusStartedAt: () => readWorkerStatusStartedAt,
   writeWorkerStatus: () => writeWorkerStatus
 });
 import fs15 from "node:fs/promises";
 import path19 from "node:path";
+async function readWorkerStatus(taskDir) {
+  let content;
+  try {
+    content = await fs15.readFile(path19.join(taskDir, WORKER_STATUS_FILE), "utf-8");
+  } catch (err) {
+    if (isNotFoundError(err))
+      return { workerStatus: null };
+    return { workerStatus: null, statusReadError: getErrorMessage(err) };
+  }
+  try {
+    return { workerStatus: JSON.parse(content) };
+  } catch (err) {
+    return { workerStatus: null, statusReadError: getErrorMessage(err) };
+  }
+}
 async function readCarriedOverStatus(taskDir) {
   let previous;
   try {
@@ -3667,48 +3874,8 @@ import fs3 from "node:fs/promises";
 import path4 from "node:path";
 
 // dist/id.js
+init_validation();
 import { generate } from "short-uuid";
-
-// dist/paths/validation.js
-var BASE58_PATTERN = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
-var CONTENT_ID_PATTERN = new RegExp(`^${BASE58_PATTERN}{12}$`);
-var PHYSICAL_SEGMENT_PATTERN = new RegExp(`\\.${BASE58_PATTERN}{12}(?:\\.[a-z]+)?$`);
-function isValidContentId(id) {
-  return CONTENT_ID_PATTERN.test(id);
-}
-function parseSlug(slug) {
-  if (!slug) {
-    return {
-      ok: false,
-      error: "Slug is required"
-    };
-  }
-  if (slug.length > 64) {
-    return { ok: false, error: "Slug too long (max 64 characters)" };
-  }
-  if (slug.includes("/") || slug.includes("\\")) {
-    return {
-      ok: false,
-      error: "Slug cannot contain path separators"
-    };
-  }
-  if (slug === "." || slug === "..") {
-    return {
-      ok: false,
-      error: "Slug cannot be a traversal sequence"
-    };
-  }
-  const normalized = slug.toLowerCase();
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
-    return {
-      ok: false,
-      error: "Slug must start with a letter or number and contain only lowercase letters, numbers, and hyphens"
-    };
-  }
-  return { ok: true, slug: normalized };
-}
-
-// dist/id.js
 function generateId() {
   const full = generate();
   return full.substring(0, 12);
@@ -4538,7 +4705,7 @@ function registryFingerprint(registry2) {
 init_flatten();
 
 // dist/validation/entry-type-reference-validator.js
-init_validation();
+init_validation2();
 var editDistance = (a, b) => {
   let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
   for (let i = 1; i <= a.length; i++) {
@@ -4997,24 +5164,13 @@ function validateAndNormalizePath(root, target) {
   };
 }
 
+// dist/paths/index.js
+init_validation();
+
 // dist/paths/branch.js
 init_operating_mode();
 import path10 from "node:path";
-
-// dist/paths/branch-name.js
-function sanitizeBranchName(branchName) {
-  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
-  const squashed = replaced.replace(/-+/g, "-");
-  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
-  return trimmedDots || "branch";
-}
-var RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
-function isSettingsBranchName(branchName, settingsBranchName) {
-  const sanitized = sanitizeBranchName(branchName);
-  return sanitized.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX) || settingsBranchName !== void 0 && sanitized === sanitizeBranchName(settingsBranchName);
-}
-
-// dist/paths/branch.js
+init_branch_name();
 var BranchPathError = class extends Error {
 };
 var resolveContentBranchesRoot = (mode, override) => {
@@ -5043,6 +5199,9 @@ function resolveBranchPath(options) {
   return { branchRoot, baseRoot: normalizedBase, branchName: safeBranch };
 }
 
+// dist/paths/index.js
+init_branch_name();
+
 // dist/content-store.js
 async function withLocks(keys, fn) {
   const sorted = Array.from(new Set(keys)).sort();
@@ -7640,7 +7799,13 @@ var branchMetadataShape = {
   historyRewrittenFrom: z7.string().optional(),
   syncFailureReason: z7.string().optional(),
   editors: z7.array(z7.string()).optional(),
-  uncommittedEditors: z7.array(z7.string()).optional()
+  uncommittedEditors: z7.array(z7.string()).optional(),
+  // Dropped when malformed: it only decorates the PR body, so it never fails a read.
+  review: z7.object({
+    state: z7.enum(["approved", "changes-requested"]),
+    by: z7.object({ userId: z7.string(), name: z7.string().optional() }),
+    at: z7.string()
+  }).optional().catch(void 0)
 };
 var branchMetadataSchema = z7.object(branchMetadataShape).passthrough();
 var branchMetadataFileSchema = z7.object({
@@ -7781,14 +7946,23 @@ var BranchRegistry = class {
    * genuinely-absent branch costs at most one extra scan per window.
    */
   async get(name) {
-    const branches = await this.list();
-    const found = branches.find((b) => b.branch.name === name);
+    return this.find((b) => b.branch.name === name);
+  }
+  /**
+   * Returns the branch whose workspace directory is `key` (`sanitizeBranchName` of its ref),
+   * whatever its name, with {@link get}'s backstop.
+   */
+  async getByKey(key) {
+    return this.find((b) => path15.basename(b.branchRoot) === key);
+  }
+  async find(matches) {
+    const found = (await this.list()).find(matches);
     if (found)
       return found;
     if (!this.shouldForceRefresh())
       return void 0;
     const refreshed = await this.regenerate();
-    return refreshed.find((b) => b.branch.name === name);
+    return refreshed.find(matches);
   }
   shouldForceRefresh() {
     const now = Date.now();
@@ -8257,18 +8431,228 @@ var loadBranchContext = async (options) => {
   };
 };
 
+// dist/branch-param.js
+init_operating_mode();
+init_branch_name();
+function cmsBranchNamespace(config) {
+  try {
+    return operatingStrategy(config.mode).getBranchNamespace(config);
+  } catch {
+    return null;
+  }
+}
+function namesBaseOrActive(param, config) {
+  let base;
+  try {
+    base = baseBranchOf(config);
+  } catch (err) {
+    if (err instanceof BaseBranchUnresolvedError)
+      return false;
+    throw err;
+  }
+  return param === base || param === (config.defaultActiveBranch ?? base);
+}
+function shortNameOf(config, name) {
+  const short = branchShortName(name, cmsBranchNamespace(config));
+  return short !== name && namesBaseOrActive(short, config) ? name : short;
+}
+
 // dist/branch-provisioning.js
-import { createHash as createHash2, randomBytes } from "node:crypto";
+import { createHash as createHash3, randomBytes } from "node:crypto";
 import fs17 from "node:fs/promises";
 import path21 from "node:path";
 
 // dist/git-manager.js
+import { createHash as createHash2 } from "node:crypto";
 import fs16 from "node:fs/promises";
 import path20 from "node:path";
 import { fileURLToPath } from "node:url";
 import { simpleGit as simpleGit2 } from "simple-git";
 init_error();
 init_logger();
+
+// dist/worker/git-process.js
+init_error();
+import { spawn } from "node:child_process";
+import { Readable, Transform, Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+var GitProcessError = class extends Error {
+  constructor(message, exitCode, stderr) {
+    super(message);
+    this.exitCode = exitCode;
+    this.stderr = stderr;
+    this.name = "GitProcessError";
+  }
+};
+var STDERR_CAP_BYTES = 64 * 1024;
+var KILL_GRACE_MS = 2e3;
+function spawnGit(args, options) {
+  const child = spawn("git", [...(options.config ?? []).flatMap((c) => ["-c", c]), ...args], {
+    cwd: options.cwd,
+    // An app's own ProcessEnv augmentation (Next.js requires NODE_ENV) says nothing about git's.
+    env: options.env,
+    stdio: ["pipe", "pipe", "pipe"],
+    // Its own process group, so a stop reaches what git spawned too (bundle create's
+    // pack-objects), which would otherwise outlive it holding the pipes open.
+    detached: process.platform !== "win32"
+  });
+  const { stdout } = child;
+  if (stdout === null)
+    throw new Error("git was spawned without a stdout pipe");
+  const command = args.find((arg) => !arg.startsWith("-")) ?? "git";
+  let stderr = "";
+  let stderrBytes = 0;
+  let killedFor = null;
+  let closed = false;
+  let exitedCleanly = false;
+  let inactivity;
+  const idle = () => {
+    if (stdout.readableLength > 0 && !stdout.destroyed) {
+      inactivity = setTimeout(idle, options.inactivityTimeoutMs);
+      return;
+    }
+    stop(`git ${command} wrote nothing for ${options.inactivityTimeoutMs}ms`);
+  };
+  const touch = () => {
+    options.onActivity?.();
+    clearTimeout(inactivity);
+    if (exitedCleanly)
+      return;
+    inactivity = setTimeout(idle, options.inactivityTimeoutMs);
+  };
+  const stop = (reason) => {
+    if (closed || killedFor !== null)
+      return;
+    if (child.exitCode === 0 || child.exitCode === null && child.signalCode === null) {
+      killedFor = reason;
+    }
+    terminate(child);
+    stdout.destroy();
+  };
+  child.on("exit", (code) => {
+    if (code !== 0)
+      return;
+    exitedCleanly = true;
+    clearTimeout(inactivity);
+    clearTimeout(deadline);
+  });
+  child.stderr?.on("data", (chunk) => {
+    touch();
+    if (stderrBytes < STDERR_CAP_BYTES) {
+      stderr += chunk.subarray(0, STDERR_CAP_BYTES - stderrBytes).toString("utf8");
+    }
+    stderrBytes += chunk.length;
+  });
+  stdout.on("data", touch);
+  const deadline = options.deadlineMs === void 0 ? void 0 : setTimeout(() => stop(`git ${command} ran longer than ${options.deadlineMs}ms`), options.deadlineMs);
+  const onAbort = () => stop(`git ${command} was aborted`);
+  if (options.signal?.aborted)
+    onAbort();
+  options.signal?.addEventListener("abort", onAbort, { once: true });
+  const input = feedStdin(child, options.stdin, touch, (err) => stop(`git ${command}'s input failed: ${getErrorMessage(err)}`));
+  input.catch(() => void 0);
+  touch();
+  const exited = new Promise((resolve2, reject) => {
+    child.on("error", (err) => {
+      if (child.pid === void 0) {
+        clearTimeout(inactivity);
+        clearTimeout(deadline);
+        options.signal?.removeEventListener("abort", onAbort);
+        reject(new GitProcessError(`git ${command} could not run: ${err.message}`, null, ""));
+      }
+    });
+    child.on("close", (code, signal) => {
+      closed = true;
+      clearTimeout(inactivity);
+      clearTimeout(deadline);
+      options.signal?.removeEventListener("abort", onAbort);
+      const written = stderrBytes > STDERR_CAP_BYTES ? `${stderr}
+[stderr truncated]` : stderr;
+      if (killedFor === null && code === 0) {
+        input.then(resolve2, (err) => reject(new GitProcessError(`git ${command}'s input failed: ${getErrorMessage(err)}`, 0, written)));
+        return;
+      }
+      const why = killedFor ?? (written.trim() || (code === null ? `git ${command} was killed by ${signal ?? "a signal"}` : `git ${command} exited with code ${code}`));
+      reject(new GitProcessError(why, code, written));
+    });
+  });
+  exited.catch(() => void 0);
+  return { stdout, exited, kill: stop };
+}
+async function runGit(args, options) {
+  const max = options.maxStdoutBytes ?? 64 * 1024 * 1024;
+  const proc = spawnGit(args, options);
+  const chunks = [];
+  let total = 0;
+  const collect = new Writable({
+    write(chunk, _encoding, callback) {
+      total += chunk.length;
+      if (total > max) {
+        proc.kill(`git printed more than ${max} bytes`);
+        callback();
+        return;
+      }
+      chunks.push(chunk);
+      callback();
+    }
+  });
+  try {
+    await Promise.all([pipeline(proc.stdout, collect).catch(() => void 0), proc.exited]);
+  } catch (err) {
+    if (options.stdoutInFailure && err instanceof GitProcessError && chunks.length > 0) {
+      throw new GitProcessError(`${Buffer.concat(chunks).toString("utf8")}${err.message}`, err.exitCode, err.stderr);
+    }
+    throw err;
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function terminate(child) {
+  signalGroup(child, "SIGTERM");
+  const timer = setTimeout(() => signalGroup(child, "SIGKILL"), KILL_GRACE_MS);
+  timer.unref();
+  child.once("close", () => clearTimeout(timer));
+}
+function signalGroup(child, signal) {
+  if (child.pid !== void 0 && process.platform !== "win32") {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+    }
+  }
+  child.kill(signal);
+}
+function feedStdin(child, source, touch, onSourceError) {
+  const sink2 = child.stdin;
+  if (sink2 === null)
+    return Promise.resolve();
+  sink2.on("error", () => void 0);
+  if (source === void 0) {
+    sink2.end();
+    return Promise.resolve();
+  }
+  const readable = typeof source === "string" ? Readable.from([Buffer.from(source)]) : source;
+  const counted = new Transform({
+    transform(chunk, _encoding, callback) {
+      touch();
+      callback(null, chunk);
+    }
+  });
+  return new Promise((resolve2, reject) => {
+    readable.once("error", (err) => {
+      onSourceError(err);
+      reject(err);
+    });
+    sink2.once("close", () => {
+      if (!readable.readableEnded)
+        readable.destroy();
+      resolve2();
+    });
+    readable.pipe(counted).pipe(sink2);
+  });
+}
+
+// dist/git-manager.js
 var log9 = createDebugLogger({ prefix: "GitManager" });
 var GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
 var FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
@@ -8292,6 +8676,13 @@ function gitNetworkChildEnv() {
   return { ...env, ...FORCE_C_LOCALE };
 }
 var NO_AUTO_GC_CONFIG = ["gc.auto=0", "maintenance.auto=false"];
+var HASH_INACTIVITY_TIMEOUT_MS = 6e4;
+var MAX_HASH_RUNS = 50;
+var LS_REMOTE_INACTIVITY_TIMEOUT_MS = 6e4;
+var symlinkBlobSha = (target, likeSha) => {
+  const body = Buffer.from(target, "utf8");
+  return createHash2(likeSha.length === 64 ? "sha256" : "sha1").update(Buffer.concat([Buffer.from(`blob ${body.length}\0`), body])).digest("hex");
+};
 var REMOTE_GIT_CONFIG = [
   ["gc.auto", "0"],
   ["receive.autogc", "false"],
@@ -8392,6 +8783,12 @@ async function ensureGitExcludePattern(repoPath, pattern) {
   await fs16.writeFile(excludePath, newContent, "utf-8");
   log9.debug("git", "Added pattern to .git/info/exclude", { pattern });
 }
+var BaseBranchMissingError = class extends Error {
+  constructor(remote, baseBranch) {
+    super(`CanopyCMS: remote '${remote}' has no branch '${baseBranch}'`);
+    this.name = "BaseBranchMissingError";
+  }
+};
 var GitConflictError = class extends Error {
   constructor(conflictedFiles) {
     super(`Git conflict in ${conflictedFiles.length} file(s): ${conflictedFiles.join(", ")}`);
@@ -8667,6 +9064,36 @@ var GitManager = class _GitManager {
     }
     return refs.includes(`refs/heads/${branch}`) || refs.includes(`${GITHUB_TRACKING_REF_PREFIX}${branch}`);
   }
+  /**
+   * The branches inside `branch` (`<branch>/…`) that a bare mirror holds as local heads or in
+   * GitHub's tracking namespace, which git cannot hold beside `branch` itself. `for-each-ref`
+   * matches a pattern up to a slash, so the pattern `<branch>` lists them. Throws, as
+   * {@link bareRemoteHasBranch} does, when the mirror is unreadable.
+   */
+  static async bareRemoteBranchesInside(remotePath, branch) {
+    let output;
+    try {
+      output = await simpleGit2().raw([
+        "--git-dir",
+        remotePath,
+        "for-each-ref",
+        "--format=%(refname)",
+        "--end-of-options",
+        `refs/heads/${branch}`,
+        `${GITHUB_TRACKING_REF_PREFIX}${branch}`
+      ]);
+    } catch (err) {
+      throw new Error(`Cannot inspect remote mirror at ${remotePath}: ${getErrorMessage(err)}`);
+    }
+    const inside = /* @__PURE__ */ new Set();
+    for (const ref of output.split("\n").map((line) => line.trim())) {
+      for (const prefix of ["refs/heads/", GITHUB_TRACKING_REF_PREFIX]) {
+        if (ref.startsWith(`${prefix}${branch}/`))
+          inside.add(ref.slice(prefix.length));
+      }
+    }
+    return [...inside].sort();
+  }
   /**
    * Delete `refs/heads/<branch>` from a bare local mirror, if present. A
    * no-op (not an error) when the ref doesn't exist.
@@ -9365,6 +9792,199 @@ var GitManager = class _GitManager {
     ]);
     return output.split("\0").filter((p) => p.length > 0);
   }
+  /**
+   * Every file in `rev`'s tree below repo-relative directory `under`, with its size in bytes,
+   * so a caller can refuse a file too large to read before reading it.
+   */
+  async listFilesWithSizeAt(rev, under) {
+    const dir = `${under.replace(/\/+$/, "")}/`;
+    const output = await this.git.raw([
+      "ls-tree",
+      "-r",
+      "-z",
+      "-l",
+      "--full-tree",
+      "--end-of-options",
+      rev,
+      dir
+    ]);
+    const files = [];
+    for (const record of output.split("\0")) {
+      const tab = record.indexOf("	");
+      if (tab === -1)
+        continue;
+      const [, type, , size] = record.slice(0, tab).split(/ +/);
+      const filePath = record.slice(tab + 1);
+      if (type === "blob" && filePath.startsWith(dir)) {
+        files.push({ path: filePath, size: Number(size) });
+      }
+    }
+    return files;
+  }
+  /**
+   * The commit HEAD forked from the base branch at, or `undefined` when they share no history.
+   * Takes the base tip from the remote by `ls-remote` rather than `<remote>/<base>`: the worker
+   * fetches by path, which moves no remote-tracking ref, so that ref is left behind by every
+   * rebase. A tip this clone lacks is fetched as objects only (`--refmap=`, `--no-tags`,
+   * `--no-write-fetch-head`, git 2.29+): no ref and no FETCH_HEAD moves, so a concurrent fetch
+   * pinning FETCH_HEAD is never repointed. Throws {@link BaseBranchMissingError} when the
+   * remote has no base branch, and any other error when it can't be read.
+   */
+  async mergeBaseWithBase() {
+    const tip = await this.remoteBranchTip(this.baseBranch);
+    if (!tip)
+      throw new BaseBranchMissingError(this.remote, this.baseBranch);
+    if (!await this.hasCommit(tip)) {
+      await this.git.raw([
+        "fetch",
+        "--refmap=",
+        "--no-tags",
+        "--no-write-fetch-head",
+        "--end-of-options",
+        this.remote,
+        `refs/heads/${this.baseBranch}`
+      ]);
+      if (!await this.hasCommit(tip)) {
+        throw new Error(`CanopyCMS: could not fetch ${this.baseBranch}'s tip ${tip}`);
+      }
+    }
+    const forkPoint = (await this.git.raw(["merge-base", "--end-of-options", "HEAD", tip])).trim();
+    return forkPoint || void 0;
+  }
+  /** Whether this clone holds commit `sha`. */
+  async hasCommit(sha) {
+    return (await this.git.raw(["rev-parse", "--verify", "--quiet", `${sha}^{commit}`])).trim() !== "";
+  }
+  /**
+   * Repo-relative paths whose working-tree content differs from commit `rev`, with `T` (a type
+   * change) reported as `M`. A sparse clone leaves a path outside its cone unchecked out, marked
+   * skip-worktree, and git reads that path's index entry in place of the missing file: it is never
+   * reported deleted, and differs from `rev` only as the index does.
+   *
+   * `diff-index`, not `git diff`: the porcelain refreshes the index and writes it back under
+   * `index.lock`, which would fail a concurrent writer's own git step. `diff-index` writes
+   * nothing, so it reports a file whose stat changed but whose content did not; those are
+   * hashed here and dropped when they match `rev`.
+   */
+  async diffNameStatusAgainst(rev) {
+    const output = await this.git.raw([
+      "diff-index",
+      "--raw",
+      "-z",
+      "--no-renames",
+      "--end-of-options",
+      rev,
+      "--"
+    ]);
+    const tokens = output.split("\0");
+    const changes = [];
+    for (let i = 0; i + 1 < tokens.length; i += 2) {
+      const [srcMode, dstMode, srcSha, dstSha, code] = tokens[i].slice(1).split(" ");
+      const path27 = tokens[i + 1];
+      const letter = code?.charAt(0);
+      if (letter === "A" || letter === "D")
+        changes.push({ status: letter, path: path27 });
+      else if (letter === "M" || letter === "T") {
+        const unhashed = /^0+$/.test(dstSha) && srcMode === dstMode ? srcSha : void 0;
+        changes.push({ status: "M", path: path27, unhashed });
+      }
+    }
+    const unchanged = await this.matchingBlobs(changes.flatMap((c) => c.unhashed ? [{ path: c.path, sha: c.unhashed }] : []));
+    return changes.filter((c) => !unchanged.has(c.path)).map(({ status, path: path27 }) => ({ status, path: path27 }));
+  }
+  /**
+   * The paths whose working-tree file hashes to `sha`, as git hashes it: a symlink's blob is its
+   * target, a file's goes through `hash-object --stdin-paths`, so its attributes' filters apply.
+   * Callers pass only paths whose mode is unchanged, since diff-index reports the working tree's
+   * own mode. A path that is gone or can't be hashed matches nothing, so it stays reported as
+   * changed. When git refuses a path (exit 128), having printed
+   * the SHAs before it, the next run resumes past that path, for at most {@link MAX_HASH_RUNS}
+   * runs. A run that ends any other way (killed, timed out, a signal) stops the hashing, and the
+   * paths it didn't reach stay changed.
+   */
+  async matchingBlobs(files) {
+    const matching = /* @__PURE__ */ new Set();
+    const regular = [];
+    for (const file of files) {
+      if (file.path.includes("\n"))
+        continue;
+      const stat = await fs16.lstat(path20.join(this.repoPath, file.path)).catch(() => void 0);
+      if (!stat)
+        continue;
+      if (stat.isSymbolicLink()) {
+        const target = await fs16.readlink(path20.join(this.repoPath, file.path)).catch(() => void 0);
+        if (target !== void 0 && symlinkBlobSha(target, file.sha) === file.sha) {
+          matching.add(file.path);
+        }
+      } else if (stat.isFile())
+        regular.push(file);
+    }
+    for (let start = 0, runs = 0; start < regular.length && runs < MAX_HASH_RUNS; runs++) {
+      const batch = regular.slice(start);
+      const { shas, outcome } = await this.hashPaths(batch.map((f) => f.path));
+      shas.forEach((sha, i) => {
+        if (batch[i] && sha === batch[i].sha)
+          matching.add(batch[i].path);
+      });
+      if (outcome !== "refused")
+        break;
+      start += shas.length + 1;
+    }
+    return matching;
+  }
+  /**
+   * `hash-object --stdin-paths` over `paths`: one SHA per path, in order, up to where it ended.
+   * `refused` is git's own exit 128 on a path it can't hash; `stopped` is any other ending.
+   */
+  async hashPaths(paths) {
+    const chunks = [];
+    let proc;
+    try {
+      proc = spawnGit(["hash-object", "--stdin-paths"], {
+        ...this.processOptions(),
+        stdin: `${paths.join("\n")}
+`,
+        inactivityTimeoutMs: HASH_INACTIVITY_TIMEOUT_MS
+      });
+    } catch {
+      return { shas: [], outcome: "stopped" };
+    }
+    const read = (async () => {
+      for await (const chunk of proc.stdout)
+        chunks.push(chunk);
+    })().catch(() => {
+    });
+    const outcome = await proc.exited.then(() => "complete", (err) => err instanceof GitProcessError && err.exitCode === 128 ? "refused" : "stopped");
+    await read;
+    return { shas: Buffer.concat(chunks).toString("utf8").split("\n").filter(Boolean), outcome };
+  }
+  /** What a git run outside simple-git needs to run as `this.git` does. */
+  processOptions() {
+    return {
+      cwd: this.repoPath,
+      env: gitChildEnv({ GIT_CEILING_DIRECTORIES: path20.dirname(this.repoPath) }),
+      config: NO_AUTO_GC_CONFIG
+    };
+  }
+  /** Repo-relative paths of the working tree's untracked, non-ignored files. */
+  async listUntrackedFiles() {
+    const output = await this.git.raw(["ls-files", "--others", "--exclude-standard", "-z"]);
+    return output.split("\0").filter((p) => p.length > 0);
+  }
+  /**
+   * The text of repo-relative `filePath` at commit `rev`, or `undefined` when `rev` has no such
+   * path. Any other failure, such as an unknown `rev`, throws.
+   */
+  async showFile(rev, filePath) {
+    try {
+      return await this.git.raw(["show", "--end-of-options", `${rev}:${filePath}`]);
+    } catch (err) {
+      if (/fatal: path '.*' (does not exist in|exists on disk, but not in) '/.test(getErrorMessage(err))) {
+        return void 0;
+      }
+      throw err;
+    }
+  }
   async ensureAuthor(author) {
     const config = await this.git.listConfig();
     const isManaged = config.all["canopycms.managed"] === "true";
@@ -9535,7 +10155,10 @@ var GitManager = class _GitManager {
    */
   async remoteBranchTip(branch) {
     const ref = `refs/heads/${branch}`;
-    const output = await this.git.raw(["ls-remote", "--heads", this.remote, ref]);
+    const output = await runGit(["ls-remote", "--heads", "--end-of-options", this.remote, ref], {
+      ...this.processOptions(),
+      inactivityTimeoutMs: LS_REMOTE_INACTIVITY_TIMEOUT_MS
+    });
     for (const line of output.split("\n")) {
       const [sha, name] = line.trim().split("	");
       if (sha && name === ref)
@@ -9616,7 +10239,7 @@ var REPAIR_MAX_AGE_MS = 20 * 6e4;
 var DELETING_MAX_AGE_MS = 10 * 6e4;
 var SETTINGS_TRASH_MAX_AGE_MS = 30 * 24 * 60 * 6e4;
 var BranchProvisioningBusyError = class extends Error {
-  constructor(dirName, message = `Branch '${dirName}' is still being set up. Try again in a minute.`) {
+  constructor(dirName, shortName = dirName, message = `Branch '${shortName}' is still being set up. Try again in a minute.`) {
     super(message);
     this.dirName = dirName;
     this.name = "BranchProvisioningBusyError";
@@ -9633,7 +10256,7 @@ function formatDirStamp(date) {
   return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
 }
 function shortDirName(dirName) {
-  const digest = createHash2("sha1").update(dirName).digest("hex").slice(0, 10);
+  const digest = createHash3("sha1").update(dirName).digest("hex").slice(0, 10);
   return `${dirName.slice(0, 40)}-${digest}`;
 }
 function stampedName(prefix, dirName, now) {
@@ -9825,12 +10448,13 @@ async function stageBranchWorkspace(options) {
     throw err;
   }
 }
-async function lockBranchName(baseRoot, dirName) {
+async function lockBranchName(baseRoot, dirName, shortName = dirName) {
   try {
     return await acquireProvisioningLockWithin(baseRoot, branchProvisioningLockName(dirName), PUBLISH_LOCK_WAIT_MS);
   } catch (err) {
-    if (isNodeError(err) && err.code === "ELOCKED")
-      throw new BranchProvisioningBusyError(dirName);
+    if (isNodeError(err) && err.code === "ELOCKED") {
+      throw new BranchProvisioningBusyError(dirName, shortName);
+    }
     throw err;
   }
 }
@@ -9844,9 +10468,9 @@ async function inspectBlocking(finalPath) {
 }
 var RENAME_BLOCKED = /* @__PURE__ */ new Set(["EEXIST", "ENOTEMPTY", "ENOTDIR"]);
 async function publishStaging(options) {
-  const { baseRoot, dirName, stagingPath } = options;
+  const { baseRoot, dirName, stagingPath, shortName = dirName } = options;
   const finalPath = path21.join(baseRoot, dirName);
-  const release = await lockBranchName(baseRoot, dirName);
+  const release = await lockBranchName(baseRoot, dirName, shortName);
   try {
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
@@ -9868,7 +10492,7 @@ async function publishStaging(options) {
       if (blocking === "live")
         return "exists";
       if (blocking === "protected")
-        throw new BranchProvisioningBusyError(dirName);
+        throw new BranchProvisioningBusyError(dirName, shortName);
       const result = await quarantineResidueAt(baseRoot, dirName, {
         minQuietMs: CREATE_RESIDUE_MIN_QUIET_MS,
         expectedRemoteUrl: options.expectedRemoteUrl
@@ -9883,9 +10507,9 @@ async function publishStaging(options) {
       }
       if (result.reason === "foreign")
         throw new BranchDirOccupiedError(dirName);
-      throw new BranchProvisioningBusyError(dirName);
+      throw new BranchProvisioningBusyError(dirName, shortName);
     }
-    throw new BranchProvisioningBusyError(dirName);
+    throw new BranchProvisioningBusyError(dirName, shortName);
   } finally {
     await release().catch((err) => {
       canopyLogWarn(`[canopy] Failed to release the provisioning lock for ${dirName}:`, err);
@@ -10017,12 +10641,16 @@ var BranchWorkspaceManager = class {
     if (isSettingsBranchName(options.branchName, operatingStrategy(options.mode).getSettingsBranchName(this.config))) {
       throw new BranchPathError("Settings branches are not content branches");
     }
-    const { branchRoot, baseRoot, branchName: safeName } = resolveBranchPath(options);
+    const named = parseBranchRef(options.branchName);
+    if (!named.ok)
+      throw new BranchPathError(named.error);
+    const { branchRoot, baseRoot } = resolveBranchPath(options);
     const paths = {
       branchRoot,
       baseRoot,
       dirName: path23.basename(branchRoot),
-      safeName
+      ref: options.branchName,
+      shortName: shortNameOf({ ...this.config, mode: options.mode }, options.branchName)
     };
     const existing = await readBranchMetadataFile(branchRoot);
     if (existing) {
@@ -10040,7 +10668,7 @@ var BranchWorkspaceManager = class {
     }
   }
   async provisionUnshared(options, paths) {
-    const { branchRoot, baseRoot, dirName } = paths;
+    const { branchRoot, baseRoot, dirName, shortName } = paths;
     await fs19.mkdir(baseRoot, { recursive: true });
     const baseBranch = await GitManager.resolveWorkspaceBaseBranch({
       ...this.config,
@@ -10058,7 +10686,7 @@ var BranchWorkspaceManager = class {
     });
     const metadata = buildInitialBranchMetadata({
       branch: {
-        name: paths.safeName,
+        name: paths.ref,
         title: options.title,
         description: options.description,
         access: options.access,
@@ -10070,14 +10698,14 @@ var BranchWorkspaceManager = class {
     if (state.kind === "live" || state.kind === "corrupt")
       return this.existing(paths);
     if (state.kind === "protected")
-      throw new BranchProvisioningBusyError(dirName);
+      throw new BranchProvisioningBusyError(dirName, shortName);
     if (state.kind === "foreign") {
       if (options.mode !== "dev")
         throw new BranchDirOccupiedError(dirName);
       return this.adoptInPlace(options, paths, baseBranch, metadata);
     }
     if (state.kind === "residue" && await this.recentlyActive(paths)) {
-      throw new BranchProvisioningBusyError(dirName);
+      throw new BranchProvisioningBusyError(dirName, shortName);
     }
     const sparseCone = sparseConeFor(this.config.contentRoot);
     await recordSparseCone(baseRoot, sparseCone).catch((err) => {
@@ -10102,11 +10730,11 @@ var BranchWorkspaceManager = class {
     return outcome;
   }
   async stageAndPublish(paths, run) {
-    const { branchRoot, baseRoot, dirName } = paths;
+    const { branchRoot, baseRoot, dirName, shortName } = paths;
     const staged = await stageBranchWorkspace({
       baseRoot,
       dirName,
-      branchName: paths.safeName,
+      branchName: paths.ref,
       baseBranch: run.baseBranch,
       remoteUrl: run.remoteUrl,
       clone: {
@@ -10126,6 +10754,7 @@ var BranchWorkspaceManager = class {
       published = await run.provisionLog.step("publish", () => publishStaging({
         baseRoot,
         dirName,
+        shortName,
         stagingPath: staged.stagingPath,
         writeId: staged.meta.writeId,
         expectedRemoteUrl: run.remoteUrl,
@@ -10145,16 +10774,16 @@ var BranchWorkspaceManager = class {
    * is, given branch.json under the branch's lock.
    */
   async adoptInPlace(options, paths, baseBranch, metadata) {
-    const { branchRoot, baseRoot, dirName } = paths;
+    const { branchRoot, baseRoot, dirName, shortName } = paths;
     const provisionLog = new ProvisionLog(dirName);
     let created = false;
     try {
-      const release = await provisionLog.step("lock", () => lockBranchName(baseRoot, dirName));
+      const release = await provisionLog.step("lock", () => lockBranchName(baseRoot, dirName, shortName));
       try {
         if (!await readBranchMetadataFile(branchRoot)) {
           await GitManager.initializeWorkspace({
             workspacePath: branchRoot,
-            branchName: paths.safeName,
+            branchName: paths.ref,
             mode: options.mode,
             baseBranch,
             sourceRoot: this.config.sourceRoot,
@@ -10189,7 +10818,7 @@ var BranchWorkspaceManager = class {
       return this.existing(paths);
     const meta = await readBranchMetadataFile(branchRoot);
     if (!meta)
-      throw new BranchProvisioningBusyError(dirName);
+      throw new BranchProvisioningBusyError(dirName, shortName);
     return { kind: "created", context: { branch: meta.branch, branchRoot, baseRoot } };
   }
   /** Whether residue at the branch path may still belong to a live process. */
@@ -10199,10 +10828,10 @@ var BranchWorkspaceManager = class {
       return true;
     return await quietAgeMs(branchRoot) < CREATE_RESIDUE_MIN_QUIET_MS;
   }
-  async existing({ branchRoot, baseRoot, dirName }) {
+  async existing({ branchRoot, baseRoot, dirName, shortName }) {
     const meta = await readBranchMetadataFile(branchRoot);
     if (!meta)
-      throw new BranchProvisioningBusyError(dirName);
+      throw new BranchProvisioningBusyError(dirName, shortName);
     return { kind: "exists", context: { branch: meta.branch, branchRoot, baseRoot } };
   }
 };
@@ -10286,21 +10915,23 @@ var normalizePath = (root, target) => {
   }
   return result.normalizedPath;
 };
+var parseEntryParts = (raw, format) => {
+  if (format === "json")
+    return { data: asRecord(JSON.parse(raw)) };
+  if (format === "yaml")
+    return { data: asRecord(yamlParse2(raw)) };
+  const parsed = matter3(raw);
+  return { data: { ...parsed.data ?? {} }, body: parsed.content };
+};
+var parseEntryData = (raw, format, bodyFieldName = "body") => {
+  const { data, body } = parseEntryParts(raw, format);
+  if (body)
+    data[bodyFieldName] = body;
+  return data;
+};
 var readEntryData = async (filePath, format, bodyFieldName = "body") => {
   try {
-    const raw = await fs20.readFile(filePath, "utf8");
-    if (format === "json") {
-      return asRecord(JSON.parse(raw));
-    }
-    if (format === "yaml") {
-      return asRecord(yamlParse2(raw));
-    }
-    const parsed = matter3(raw);
-    const data = { ...parsed.data ?? {} };
-    if (parsed.content) {
-      data[bodyFieldName] = parsed.content;
-    }
-    return data;
+    return parseEntryData(await fs20.readFile(filePath, "utf8"), format, bodyFieldName);
   } catch (err) {
     if (isNotFoundError(err))
       return {};