canopycms 0.7.1 → 0.8.1

package/dist/cli/cli.js

@@ -849,6 +849,48 @@ async function moveToCorrupt(taskDir, sourceDir, fileName, reason, logger) {
     });
   }
 }
+function sanitizeBranchName(branchName) {
+  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const squashed = replaced.replace(/-+/g, "-");
+  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
+  return trimmedDots || "branch";
+}
+function parseBranchRef(name) {
+  if (!name || typeof name !== "string") {
+    return { ok: false, error: "Branch name is required" };
+  }
+  if (name.length > MAX_BRANCH_NAME_LENGTH) {
+    return { ok: false, error: `Branch name too long (max ${MAX_BRANCH_NAME_LENGTH} characters)` };
+  }
+  if (name.includes("..")) {
+    return { ok: false, error: 'Branch name cannot contain ".."' };
+  }
+  if (name.startsWith("/") || name.endsWith("/") || name.includes("//")) {
+    return { ok: false, error: "Invalid branch name format (invalid slashes)" };
+  }
+  if (name.includes(" ")) {
+    return { ok: false, error: "Branch name cannot contain spaces" };
+  }
+  if (name.startsWith("-")) {
+    return { ok: false, error: 'Branch name cannot start with "-"' };
+  }
+  if (name.startsWith(".") || name.endsWith(".")) {
+    return { ok: false, error: "Branch name cannot start or end with a dot" };
+  }
+  if (name.includes("@{")) {
+    return { ok: false, error: 'Branch name cannot contain "@{"' };
+  }
+  if (name === "HEAD" || name === "@") {
+    return { ok: false, error: 'Branch name cannot be the reserved ref "HEAD" or "@"' };
+  }
+  if (/[~^:?*[\\\x00-\x1f\x7f]/.test(name)) {
+    return { ok: false, error: "Branch name contains invalid characters" };
+  }
+  if (name.endsWith(".lock")) {
+    return { ok: false, error: 'Branch name cannot end with ".lock"' };
+  }
+  return { ok: true, name };
+}
 function resolveDeploymentName(config, modeDefault) {
   const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
   const configValue = config.deploymentName;
@@ -863,6 +905,64 @@ function resolveDeploymentName(config, modeDefault) {
   }
   return resolved;
 }
+function warnOnce(message) {
+  if (warned2)
+    return;
+  warned2 = true;
+  canopyLogWarn(message);
+}
+function branchNamespaceProblem(namespace) {
+  if (!namespace.endsWith("/"))
+    return 'it must end with "/"';
+  const sample = `${namespace}x`;
+  if (!/^[\x21-\x7e]+$/.test(namespace))
+    return "it is not printable ASCII without spaces";
+  if (/["%{}]/.test(namespace))
+    return 'it contains ", %, { or }';
+  if (/^(?:refs|heads|tags|remotes)\//i.test(namespace)) {
+    return "it starts with 'refs/', 'heads/', 'tags/' or 'remotes/'";
+  }
+  const parsed = parseBranchRef(sample);
+  if (!parsed.ok)
+    return `a branch in it would be refused (${parsed.error})`;
+  if (sample.split("/").some((part) => part.startsWith(".") || part.endsWith(".lock"))) {
+    return "a part of it starts with '.' or ends with '.lock'";
+  }
+  const directoryPrefix = sanitizeBranchName(namespace);
+  if (RESERVED_SETTINGS_BRANCH_PREFIX.startsWith(directoryPrefix) || sanitizeBranchName(sample).startsWith(RESERVED_SETTINGS_BRANCH_PREFIX)) {
+    return `some branches in it would be ${RESERVED_SETTINGS_BRANCH_PREFIX}* settings branches`;
+  }
+  return null;
+}
+function resolveBranchNamespaceTemplate(template, deploymentName, source) {
+  const unknown = template.replaceAll(DEPLOYMENT_PLACEHOLDER, "").match(/\{[^}]*\}?/);
+  if (unknown) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(template)} (from ${source}): ${JSON.stringify(unknown[0])} is not a placeholder; the only one is ${DEPLOYMENT_PLACEHOLDER}`);
+  }
+  const namespace = template.replaceAll(DEPLOYMENT_PLACEHOLDER, deploymentName);
+  const problem = branchNamespaceProblem(namespace);
+  if (problem !== null) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(namespace)} (from ${source}): ${problem}`);
+  }
+  return namespace;
+}
+function resolveBranchNamespace(config, modeDefault, env = process.env) {
+  const fromEnv = env[BRANCH_NAMESPACE_ENV]?.trim();
+  const [template, source] = fromEnv ? [fromEnv, BRANCH_NAMESPACE_ENV] : config.branchNamespace !== void 0 ? [config.branchNamespace, "config.branchNamespace"] : [DEFAULT_BRANCH_NAMESPACE_TEMPLATE, "the default"];
+  const deploymentName = resolveDeploymentName({ deploymentName: config.deploymentName }, modeDefault);
+  const namespace = resolveBranchNamespaceTemplate(template, deploymentName, source);
+  if (fromEnv && config.branchNamespace !== void 0) {
+    let fromConfig = null;
+    try {
+      fromConfig = resolveBranchNamespaceTemplate(config.branchNamespace, deploymentName, "config.branchNamespace");
+    } catch {
+    }
+    if (fromConfig !== namespace) {
+      warnOnce(`CanopyCMS: ${BRANCH_NAMESPACE_ENV} (${JSON.stringify(fromEnv)}) and config.branchNamespace (${JSON.stringify(config.branchNamespace)}) do not resolve to the same valid namespace; using the environment variable, which infrastructure stamps per stack.`);
+    }
+  }
+  return namespace;
+}
 function operatingStrategy(mode) {
   const cached = strategyCache.get(mode);
   if (cached)
@@ -1227,7 +1327,7 @@ CanopyCMS worker run-once (mode: ${mode}, auth: ${authMode})
   }
   console.log("\nDone");
 }
-var __defProp2, __getOwnPropNames2, __esm2, __export2, active, init_logger, scalarFieldTypes, markdownFieldTypes, primitiveFieldTypes, fieldTypes, init_types, SAFE_HTML_TAGS, COMPONENT_NAME, MDX_BINDINGS, FORBIDDEN_ATTRIBUTES, init_mdx_allowlist, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, mdxPropAllowSchema, mdxAllowlistSchema, markdownFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceSortFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, SENTINEL_BASE, DOT_SEGMENT, init_sanitize_href, uploadTargetUrlSchema, previewPrefixSchema, editorUrlSchema, init_url, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, seoFieldNameSchema, seoSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, init_config2, init_error2, init_fs2, templates_exports, __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME, init_templates, project_detect_exports, COMMANDS, MAX_WORKSPACE_DEPTH, PLACEHOLDER_GITHUB_REPO, CDK_DEPENDENCIES, init_project_detect, task_queue_config_exports, init_task_queue_config, envFlag, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, cms_task_queue_exports, debugLogger, cmsTaskQueueLogger, init_cms_task_queue, ProdClientSafeStrategy, DevClientSafeStrategy, warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName, ProdStrategy, DevStrategy, strategyCache;
+var __defProp2, __getOwnPropNames2, __esm2, __export2, active, init_logger, scalarFieldTypes, markdownFieldTypes, primitiveFieldTypes, fieldTypes, init_types, SAFE_HTML_TAGS, COMPONENT_NAME, MDX_BINDINGS, FORBIDDEN_ATTRIBUTES, init_mdx_allowlist, fieldBaseSchema, selectOptionSchema, referenceOptionSchema, primitiveFieldSchema, mdxPropAllowSchema, mdxAllowlistSchema, markdownFieldSchema, ASPECT_RATIO_RE, imageFieldSchema, selectFieldSchema, referenceSortFieldSchema, referenceFieldSchema, fieldHolder, blockSchema, blockFieldSchema, objectFieldSchema, inlineGroupFieldSchema, customFieldSchema, knownFieldSchema, fieldSchema, init_field, relativePathSchema, entryTypeSchema, collectionSchema, init_collection, SENTINEL_BASE, DOT_SEGMENT, init_sanitize_href, uploadTargetUrlSchema, previewPrefixSchema, editorUrlSchema, init_url, mediaSchema, init_media, defaultBranchAccessSchema, defaultPathAccessLevelSchema, defaultPathAccessLevelsSchema, defaultPathAccessSchema, defaultBaseBranchSchema, defaultRemoteNameSchema, defaultRemoteUrlSchema, gitBotAuthorNameSchema, gitBotAuthorEmailSchema, githubTokenEnvVarSchema, operatingModeSchema, deployedAsSchema, contentRootSchema, sourceRootSchema, basePathSchema, deploymentNameSchema, devContentSyncSchema, devConfigSchema, editorConfigSchema, seoFieldNameSchema, seoSchema, CanopyConfigSchema, DEFAULT_PROD_WORKSPACE, init_config, init_config2, init_error2, init_fs2, templates_exports, __dirname, TEMPLATES_DIR, SCAFFOLD_STACK_NAME, init_templates, project_detect_exports, COMMANDS, MAX_WORKSPACE_DEPTH, PLACEHOLDER_GITHUB_REPO, CDK_DEPENDENCIES, init_project_detect, task_queue_config_exports, init_task_queue_config, envFlag, LOG_LEVELS, DebugLogger, testLogger, init_debug, init_atomic_write, DEFAULT_MAX_RETRIES, nullLogger, init_task_queue, cms_task_queue_exports, debugLogger, cmsTaskQueueLogger, init_cms_task_queue, ProdClientSafeStrategy, DevClientSafeStrategy, RESERVED_SETTINGS_BRANCH_PREFIX, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, MAX_BRANCH_NAME_LENGTH, warned, VALID_DEPLOYMENT_NAME, isValidDeploymentName, warned2, DEPLOYMENT_PLACEHOLDER, DEFAULT_BRANCH_NAMESPACE_TEMPLATE, BRANCH_NAMESPACE_ENV, ProdStrategy, DevStrategy, strategyCache;
 var init_init = __esm({
   "dist/cli/init.js"() {
     "use strict";
@@ -1689,6 +1789,8 @@ var init_init = __esm({
           // (operating-mode/deployment-name.ts) implements — config would always "win" over
           // modeDefault, masking dev's real default of 'local'. Do not remove `.optional()`.
           deploymentName: deploymentNameSchema.optional(),
+          // Checked where it is resolved (operating-mode/branch-namespace.ts), with the deployment name.
+          branchNamespace: z5.string().optional(),
           contentRoot: contentRootSchema.default("content"),
           sourceRoot: sourceRootSchema.optional(),
           basePath: basePathSchema,
@@ -2021,10 +2123,20 @@ var init_init = __esm({
         return true;
       }
     };
+    RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
+    BASE58_PATTERN = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
+    CONTENT_ID_PATTERN = new RegExp(`^${BASE58_PATTERN}{12}$`);
+    PHYSICAL_SEGMENT_PATTERN = new RegExp(`\\.${BASE58_PATTERN}{12}(?:\\.[a-z]+)?$`);
+    MAX_BRANCH_NAME_LENGTH = 250;
+    init_logger();
     init_logger();
     warned = false;
     VALID_DEPLOYMENT_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
     isValidDeploymentName = (name) => VALID_DEPLOYMENT_NAME.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
+    warned2 = false;
+    DEPLOYMENT_PLACEHOLDER = "{deployment}";
+    DEFAULT_BRANCH_NAMESPACE_TEMPLATE = `canopycms/${DEPLOYMENT_PLACEHOLDER}/`;
+    BRANCH_NAMESPACE_ENV = "CANOPYCMS_BRANCH_NAMESPACE";
     init_config2();
     ProdStrategy = class extends ProdClientSafeStrategy {
       getWorkspaceRoot(_sourceRoot) {
@@ -2064,6 +2176,9 @@ var init_init = __esm({
           return config.settingsBranch;
         return `canopycms-settings-${resolveDeploymentName(config, "prod")}`;
       }
+      getBranchNamespace(config) {
+        return resolveBranchNamespace(config, "prod");
+      }
       getSettingsRoot(sourceRoot) {
         return path8.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
@@ -2113,6 +2228,9 @@ var init_init = __esm({
           return config.settingsBranch;
         return `canopycms-settings-${resolveDeploymentName(config, "local")}`;
       }
+      getBranchNamespace(config) {
+        return resolveBranchNamespace(config, "local");
+      }
       getSettingsRoot(sourceRoot) {
         return path8.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
@@ -3287,6 +3405,7 @@ import path72 from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import fs72 from "node:fs/promises";
 import path82 from "node:path";
+import { LRUCache } from "lru-cache";
 import { promises as fs62 } from "fs";
 import { join } from "pathe";
 import { z as z7 } from "zod";
@@ -3315,13 +3434,17 @@ import fs13 from "node:fs/promises";
 import path16 from "node:path";
 import { randomUUID as randomUUID22 } from "node:crypto";
 import lockfile2 from "proper-lockfile";
-import { createHash as createHash2, randomBytes } from "node:crypto";
+import { createHash as createHash3, randomBytes } from "node:crypto";
 import fs17 from "node:fs/promises";
 import path21 from "node:path";
+import { createHash as createHash2 } from "node:crypto";
 import fs16 from "node:fs/promises";
 import path20 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { simpleGit as simpleGit22 } from "simple-git";
+import { spawn as spawn2 } from "node:child_process";
+import { Readable as Readable2, Transform, Writable } from "node:stream";
+import { pipeline } from "node:stream/promises";
 import fs18 from "node:fs/promises";
 import path222 from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
@@ -3604,6 +3727,93 @@ function trimSlashes(path272) {
     end--;
   return path272.slice(start, end);
 }
+function sanitizeBranchName2(branchName) {
+  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const squashed = replaced.replace(/-+/g, "-");
+  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
+  return trimmedDots || "branch";
+}
+function branchShortName(name, namespace) {
+  if (namespace === null || !name.startsWith(namespace) || name.length === namespace.length) {
+    return name;
+  }
+  const rest = name.slice(namespace.length);
+  return rest.includes("/") ? name : rest;
+}
+function isSettingsBranchName(branchName, settingsBranchName) {
+  const sanitized = sanitizeBranchName2(branchName);
+  return sanitized.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX2) || settingsBranchName !== void 0 && sanitized === sanitizeBranchName2(settingsBranchName);
+}
+function isValidContentId(id) {
+  return CONTENT_ID_PATTERN2.test(id);
+}
+function parseBranchRef2(name) {
+  if (!name || typeof name !== "string") {
+    return { ok: false, error: "Branch name is required" };
+  }
+  if (name.length > MAX_BRANCH_NAME_LENGTH2) {
+    return { ok: false, error: `Branch name too long (max ${MAX_BRANCH_NAME_LENGTH2} characters)` };
+  }
+  if (name.includes("..")) {
+    return { ok: false, error: 'Branch name cannot contain ".."' };
+  }
+  if (name.startsWith("/") || name.endsWith("/") || name.includes("//")) {
+    return { ok: false, error: "Invalid branch name format (invalid slashes)" };
+  }
+  if (name.includes(" ")) {
+    return { ok: false, error: "Branch name cannot contain spaces" };
+  }
+  if (name.startsWith("-")) {
+    return { ok: false, error: 'Branch name cannot start with "-"' };
+  }
+  if (name.startsWith(".") || name.endsWith(".")) {
+    return { ok: false, error: "Branch name cannot start or end with a dot" };
+  }
+  if (name.includes("@{")) {
+    return { ok: false, error: 'Branch name cannot contain "@{"' };
+  }
+  if (name === "HEAD" || name === "@") {
+    return { ok: false, error: 'Branch name cannot be the reserved ref "HEAD" or "@"' };
+  }
+  if (/[~^:?*[\\\x00-\x1f\x7f]/.test(name)) {
+    return { ok: false, error: "Branch name contains invalid characters" };
+  }
+  if (name.endsWith(".lock")) {
+    return { ok: false, error: 'Branch name cannot end with ".lock"' };
+  }
+  return { ok: true, name };
+}
+function parseSlug(slug) {
+  if (!slug) {
+    return {
+      ok: false,
+      error: "Slug is required"
+    };
+  }
+  if (slug.length > 64) {
+    return { ok: false, error: "Slug too long (max 64 characters)" };
+  }
+  if (slug.includes("/") || slug.includes("\\")) {
+    return {
+      ok: false,
+      error: "Slug cannot contain path separators"
+    };
+  }
+  if (slug === "." || slug === "..") {
+    return {
+      ok: false,
+      error: "Slug cannot be a traversal sequence"
+    };
+  }
+  const normalized = slug.toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
+    return {
+      ok: false,
+      error: "Slug must start with a letter or number and contain only lowercase letters, numbers, and hyphens"
+    };
+  }
+  return { ok: true, slug: normalized };
+}
 function isComponentName2(name) {
   return COMPONENT_NAME2.test(name) && !MDX_BINDINGS2.has(name);
 }
@@ -3644,9 +3854,9 @@ function resolveOperatingMode(configMode) {
   if (env.value !== "prod" && env.value !== "dev") {
     throw new Error(`CanopyCMS: invalid ${env.name}=${JSON.stringify(env.value)}. It must be exactly "prod" or "dev". Refusing to fall back to the configured mode (${JSON.stringify(configMode)}): a typo here would silently deploy dev auth semantics.`);
   }
-  if (env.value !== configMode && !warned2) {
+  if (env.value !== configMode && !warned22) {
     canopyLogWarn2(`CanopyCMS: ${env.name}="${env.value}" overrides config.mode="${configMode}". The environment wins by design \u2014 it is the per-deployment value, while canopycms.config.ts is shared by local dev, the image build and the deployment. See operating-mode/mode-env.ts.`);
-    warned2 = true;
+    warned22 = true;
   }
   return env.value;
 }
@@ -3687,6 +3897,64 @@ function resolveDeploymentName2(config, modeDefault) {
   }
   return resolved;
 }
+function warnOnce2(message) {
+  if (warned4)
+    return;
+  warned4 = true;
+  canopyLogWarn2(message);
+}
+function branchNamespaceProblem2(namespace) {
+  if (!namespace.endsWith("/"))
+    return 'it must end with "/"';
+  const sample = `${namespace}x`;
+  if (!/^[\x21-\x7e]+$/.test(namespace))
+    return "it is not printable ASCII without spaces";
+  if (/["%{}]/.test(namespace))
+    return 'it contains ", %, { or }';
+  if (/^(?:refs|heads|tags|remotes)\//i.test(namespace)) {
+    return "it starts with 'refs/', 'heads/', 'tags/' or 'remotes/'";
+  }
+  const parsed = parseBranchRef2(sample);
+  if (!parsed.ok)
+    return `a branch in it would be refused (${parsed.error})`;
+  if (sample.split("/").some((part) => part.startsWith(".") || part.endsWith(".lock"))) {
+    return "a part of it starts with '.' or ends with '.lock'";
+  }
+  const directoryPrefix = sanitizeBranchName2(namespace);
+  if (RESERVED_SETTINGS_BRANCH_PREFIX2.startsWith(directoryPrefix) || sanitizeBranchName2(sample).startsWith(RESERVED_SETTINGS_BRANCH_PREFIX2)) {
+    return `some branches in it would be ${RESERVED_SETTINGS_BRANCH_PREFIX2}* settings branches`;
+  }
+  return null;
+}
+function resolveBranchNamespaceTemplate2(template, deploymentName, source) {
+  const unknown = template.replaceAll(DEPLOYMENT_PLACEHOLDER2, "").match(/\{[^}]*\}?/);
+  if (unknown) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(template)} (from ${source}): ${JSON.stringify(unknown[0])} is not a placeholder; the only one is ${DEPLOYMENT_PLACEHOLDER2}`);
+  }
+  const namespace = template.replaceAll(DEPLOYMENT_PLACEHOLDER2, deploymentName);
+  const problem = branchNamespaceProblem2(namespace);
+  if (problem !== null) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(namespace)} (from ${source}): ${problem}`);
+  }
+  return namespace;
+}
+function resolveBranchNamespace2(config, modeDefault, env = process.env) {
+  const fromEnv = env[BRANCH_NAMESPACE_ENV2]?.trim();
+  const [template, source] = fromEnv ? [fromEnv, BRANCH_NAMESPACE_ENV2] : config.branchNamespace !== void 0 ? [config.branchNamespace, "config.branchNamespace"] : [DEFAULT_BRANCH_NAMESPACE_TEMPLATE2, "the default"];
+  const deploymentName = resolveDeploymentName2({ deploymentName: config.deploymentName }, modeDefault);
+  const namespace = resolveBranchNamespaceTemplate2(template, deploymentName, source);
+  if (fromEnv && config.branchNamespace !== void 0) {
+    let fromConfig = null;
+    try {
+      fromConfig = resolveBranchNamespaceTemplate2(config.branchNamespace, deploymentName, "config.branchNamespace");
+    } catch {
+    }
+    if (fromConfig !== namespace) {
+      warnOnce2(`CanopyCMS: ${BRANCH_NAMESPACE_ENV2} (${JSON.stringify(fromEnv)}) and config.branchNamespace (${JSON.stringify(config.branchNamespace)}) do not resolve to the same valid namespace; using the environment variable, which infrastructure stamps per stack.`);
+    }
+  }
+  return namespace;
+}
 function operatingStrategy2(mode) {
   const cached = strategyCache2.get(mode);
   if (cached)
@@ -3721,6 +3989,21 @@ function getTaskQueueDir2(config) {
     }
   }
 }
+async function readWorkerStatus(taskDir) {
+  let content;
+  try {
+    content = await fs15.readFile(path19.join(taskDir, WORKER_STATUS_FILE), "utf-8");
+  } catch (err2) {
+    if (isNotFoundError3(err2))
+      return { workerStatus: null };
+    return { workerStatus: null, statusReadError: getErrorMessage3(err2) };
+  }
+  try {
+    return { workerStatus: JSON.parse(content) };
+  } catch (err2) {
+    return { workerStatus: null, statusReadError: getErrorMessage3(err2) };
+  }
+}
 async function readCarriedOverStatus(taskDir) {
   let previous;
   try {
@@ -4819,9 +5102,9 @@ function buildMissingReference(id) {
 }
 function warnDanglingReference(site) {
   const key = `${site.root}\0${site.entry ?? ""}\0${site.path}\0${site.id}`;
-  if (warned4.has(key) || warned4.size >= MAX_WARNED)
+  if (warned5.has(key) || warned5.size >= MAX_WARNED)
     return;
-  warned4.add(key);
+  warned5.add(key);
   canopyLogWarn2(`CanopyCMS: ${site.entry ?? "an entry"} field "${site.path}" references missing entry ${site.id}; it resolves as unavailable until the reference is repointed or cleared.`);
 }
 function isGroupField(field) {
@@ -4884,40 +5167,6 @@ function computeEntryUrl(collection, slug, contentRoot) {
   const path272 = segments.length > 0 ? `/${segments.join("/")}` : "/";
   return path272.toLowerCase();
 }
-function isValidContentId(id) {
-  return CONTENT_ID_PATTERN.test(id);
-}
-function parseSlug(slug) {
-  if (!slug) {
-    return {
-      ok: false,
-      error: "Slug is required"
-    };
-  }
-  if (slug.length > 64) {
-    return { ok: false, error: "Slug too long (max 64 characters)" };
-  }
-  if (slug.includes("/") || slug.includes("\\")) {
-    return {
-      ok: false,
-      error: "Slug cannot contain path separators"
-    };
-  }
-  if (slug === "." || slug === "..") {
-    return {
-      ok: false,
-      error: "Slug cannot be a traversal sequence"
-    };
-  }
-  const normalized = slug.toLowerCase();
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
-    return {
-      ok: false,
-      error: "Slug must start with a letter or number and contain only lowercase letters, numbers, and hyphens"
-    };
-  }
-  return { ok: true, slug: normalized };
-}
 function generateId() {
   const full = generate();
   return full.substring(0, 12);
@@ -5458,6 +5707,9 @@ async function isStaleByMtime(dir, cachedAt) {
   }
   return false;
 }
+function fileIdentity(stat) {
+  return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}`;
+}
 async function schemaCacheDir(branchRoot) {
   const gitDir = path82.join(branchRoot, ".git");
   const isClone = await fs72.stat(gitDir).then((stat) => stat.isDirectory(), () => false);
@@ -5517,16 +5769,6 @@ function validateAndNormalizePath(root, target) {
     normalizedPath: relativePath
   };
 }
-function sanitizeBranchName(branchName) {
-  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
-  const squashed = replaced.replace(/-+/g, "-");
-  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
-  return trimmedDots || "branch";
-}
-function isSettingsBranchName(branchName, settingsBranchName) {
-  const sanitized = sanitizeBranchName(branchName);
-  return sanitized.startsWith(RESERVED_SETTINGS_BRANCH_PREFIX) || settingsBranchName !== void 0 && sanitized === sanitizeBranchName(settingsBranchName);
-}
 function resolveBranchPath(options) {
   if (options.branchName.includes("..")) {
     throw new BranchPathError("Branch name cannot contain traversal segments");
@@ -5534,7 +5776,7 @@ function resolveBranchPath(options) {
   if (isSettingsBranchName(options.branchName)) {
     throw new BranchPathError("Settings branches are not content branches");
   }
-  const safeBranch = sanitizeBranchName(options.branchName);
+  const safeBranch = sanitizeBranchName2(options.branchName);
   const strategy = operatingStrategy2(options.mode);
   const baseRoot = resolveContentBranchesRoot(options.mode, options.basePathOverride);
   const normalizedBase = path102.resolve(baseRoot);
@@ -7004,6 +7246,193 @@ function mergeBranchMetadata(existing, version, incoming, now = (/* @__PURE__ */
 function buildInitialBranchMetadata(incoming, now) {
   return mergeBranchMetadata(null, null, incoming, now);
 }
+function cmsBranchNamespace(config) {
+  try {
+    return operatingStrategy2(config.mode).getBranchNamespace(config);
+  } catch {
+    return null;
+  }
+}
+function namesBaseOrActive(param, config) {
+  let base;
+  try {
+    base = baseBranchOf(config);
+  } catch (err2) {
+    if (err2 instanceof BaseBranchUnresolvedError)
+      return false;
+    throw err2;
+  }
+  return param === base || param === (config.defaultActiveBranch ?? base);
+}
+function shortNameOf(config, name) {
+  const short = branchShortName(name, cmsBranchNamespace(config));
+  return short !== name && namesBaseOrActive(short, config) ? name : short;
+}
+function spawnGit(args, options) {
+  const child = spawn2("git", [...(options.config ?? []).flatMap((c) => ["-c", c]), ...args], {
+    cwd: options.cwd,
+    // An app's own ProcessEnv augmentation (Next.js requires NODE_ENV) says nothing about git's.
+    env: options.env,
+    stdio: ["pipe", "pipe", "pipe"],
+    // Its own process group, so a stop reaches what git spawned too (bundle create's
+    // pack-objects), which would otherwise outlive it holding the pipes open.
+    detached: process.platform !== "win32"
+  });
+  const { stdout } = child;
+  if (stdout === null)
+    throw new Error("git was spawned without a stdout pipe");
+  const command = args.find((arg) => !arg.startsWith("-")) ?? "git";
+  let stderr = "";
+  let stderrBytes = 0;
+  let killedFor = null;
+  let closed = false;
+  let exitedCleanly = false;
+  let inactivity;
+  const idle = () => {
+    if (stdout.readableLength > 0 && !stdout.destroyed) {
+      inactivity = setTimeout(idle, options.inactivityTimeoutMs);
+      return;
+    }
+    stop(`git ${command} wrote nothing for ${options.inactivityTimeoutMs}ms`);
+  };
+  const touch = () => {
+    options.onActivity?.();
+    clearTimeout(inactivity);
+    if (exitedCleanly)
+      return;
+    inactivity = setTimeout(idle, options.inactivityTimeoutMs);
+  };
+  const stop = (reason) => {
+    if (closed || killedFor !== null)
+      return;
+    if (child.exitCode === 0 || child.exitCode === null && child.signalCode === null) {
+      killedFor = reason;
+    }
+    terminate(child);
+    stdout.destroy();
+  };
+  child.on("exit", (code) => {
+    if (code !== 0)
+      return;
+    exitedCleanly = true;
+    clearTimeout(inactivity);
+    clearTimeout(deadline);
+  });
+  child.stderr?.on("data", (chunk) => {
+    touch();
+    if (stderrBytes < STDERR_CAP_BYTES) {
+      stderr += chunk.subarray(0, STDERR_CAP_BYTES - stderrBytes).toString("utf8");
+    }
+    stderrBytes += chunk.length;
+  });
+  stdout.on("data", touch);
+  const deadline = options.deadlineMs === void 0 ? void 0 : setTimeout(() => stop(`git ${command} ran longer than ${options.deadlineMs}ms`), options.deadlineMs);
+  const onAbort = () => stop(`git ${command} was aborted`);
+  if (options.signal?.aborted)
+    onAbort();
+  options.signal?.addEventListener("abort", onAbort, { once: true });
+  const input = feedStdin(child, options.stdin, touch, (err2) => stop(`git ${command}'s input failed: ${getErrorMessage3(err2)}`));
+  input.catch(() => void 0);
+  touch();
+  const exited = new Promise((resolve2, reject) => {
+    child.on("error", (err2) => {
+      if (child.pid === void 0) {
+        clearTimeout(inactivity);
+        clearTimeout(deadline);
+        options.signal?.removeEventListener("abort", onAbort);
+        reject(new GitProcessError(`git ${command} could not run: ${err2.message}`, null, ""));
+      }
+    });
+    child.on("close", (code, signal) => {
+      closed = true;
+      clearTimeout(inactivity);
+      clearTimeout(deadline);
+      options.signal?.removeEventListener("abort", onAbort);
+      const written = stderrBytes > STDERR_CAP_BYTES ? `${stderr}
+[stderr truncated]` : stderr;
+      if (killedFor === null && code === 0) {
+        input.then(resolve2, (err2) => reject(new GitProcessError(`git ${command}'s input failed: ${getErrorMessage3(err2)}`, 0, written)));
+        return;
+      }
+      const why = killedFor ?? (written.trim() || (code === null ? `git ${command} was killed by ${signal ?? "a signal"}` : `git ${command} exited with code ${code}`));
+      reject(new GitProcessError(why, code, written));
+    });
+  });
+  exited.catch(() => void 0);
+  return { stdout, exited, kill: stop };
+}
+async function runGit(args, options) {
+  const max = options.maxStdoutBytes ?? 64 * 1024 * 1024;
+  const proc = spawnGit(args, options);
+  const chunks = [];
+  let total = 0;
+  const collect = new Writable({
+    write(chunk, _encoding, callback) {
+      total += chunk.length;
+      if (total > max) {
+        proc.kill(`git printed more than ${max} bytes`);
+        callback();
+        return;
+      }
+      chunks.push(chunk);
+      callback();
+    }
+  });
+  try {
+    await Promise.all([pipeline(proc.stdout, collect).catch(() => void 0), proc.exited]);
+  } catch (err2) {
+    if (options.stdoutInFailure && err2 instanceof GitProcessError && chunks.length > 0) {
+      throw new GitProcessError(`${Buffer.concat(chunks).toString("utf8")}${err2.message}`, err2.exitCode, err2.stderr);
+    }
+    throw err2;
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function terminate(child) {
+  signalGroup(child, "SIGTERM");
+  const timer = setTimeout(() => signalGroup(child, "SIGKILL"), KILL_GRACE_MS);
+  timer.unref();
+  child.once("close", () => clearTimeout(timer));
+}
+function signalGroup(child, signal) {
+  if (child.pid !== void 0 && process.platform !== "win32") {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+    }
+  }
+  child.kill(signal);
+}
+function feedStdin(child, source, touch, onSourceError) {
+  const sink2 = child.stdin;
+  if (sink2 === null)
+    return Promise.resolve();
+  sink2.on("error", () => void 0);
+  if (source === void 0) {
+    sink2.end();
+    return Promise.resolve();
+  }
+  const readable = typeof source === "string" ? Readable2.from([Buffer.from(source)]) : source;
+  const counted = new Transform({
+    transform(chunk, _encoding, callback) {
+      touch();
+      callback(null, chunk);
+    }
+  });
+  return new Promise((resolve2, reject) => {
+    readable.once("error", (err2) => {
+      onSourceError(err2);
+      reject(err2);
+    });
+    sink2.once("close", () => {
+      if (!readable.readableEnded)
+        readable.destroy();
+      resolve2();
+    });
+    readable.pipe(counted).pipe(sink2);
+  });
+}
 function gitChildEnv(overrides) {
   const env = {};
   for (const [key, value] of Object.entries(process.env)) {
@@ -7110,7 +7539,7 @@ function formatDirStamp(date) {
   return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
 }
 function shortDirName(dirName) {
-  const digest = createHash2("sha1").update(dirName).digest("hex").slice(0, 10);
+  const digest = createHash3("sha1").update(dirName).digest("hex").slice(0, 10);
   return `${dirName.slice(0, 40)}-${digest}`;
 }
 function stampedName(prefix, dirName, now) {
@@ -7297,12 +7726,13 @@ async function stageBranchWorkspace(options) {
     throw err2;
   }
 }
-async function lockBranchName(baseRoot, dirName) {
+async function lockBranchName(baseRoot, dirName, shortName = dirName) {
   try {
     return await acquireProvisioningLockWithin(baseRoot, branchProvisioningLockName(dirName), PUBLISH_LOCK_WAIT_MS);
   } catch (err2) {
-    if (isNodeError3(err2) && err2.code === "ELOCKED")
-      throw new BranchProvisioningBusyError(dirName);
+    if (isNodeError3(err2) && err2.code === "ELOCKED") {
+      throw new BranchProvisioningBusyError(dirName, shortName);
+    }
     throw err2;
   }
 }
@@ -7315,9 +7745,9 @@ async function inspectBlocking(finalPath) {
   return "residue";
 }
 async function publishStaging(options) {
-  const { baseRoot, dirName, stagingPath } = options;
+  const { baseRoot, dirName, stagingPath, shortName = dirName } = options;
   const finalPath = path21.join(baseRoot, dirName);
-  const release = await lockBranchName(baseRoot, dirName);
+  const release = await lockBranchName(baseRoot, dirName, shortName);
   try {
     for (let attempt = 0; attempt < 2; attempt++) {
       try {
@@ -7339,7 +7769,7 @@ async function publishStaging(options) {
       if (blocking === "live")
         return "exists";
       if (blocking === "protected")
-        throw new BranchProvisioningBusyError(dirName);
+        throw new BranchProvisioningBusyError(dirName, shortName);
       const result = await quarantineResidueAt(baseRoot, dirName, {
         minQuietMs: CREATE_RESIDUE_MIN_QUIET_MS,
         expectedRemoteUrl: options.expectedRemoteUrl
@@ -7354,9 +7784,9 @@ async function publishStaging(options) {
       }
       if (result.reason === "foreign")
         throw new BranchDirOccupiedError(dirName);
-      throw new BranchProvisioningBusyError(dirName);
+      throw new BranchProvisioningBusyError(dirName, shortName);
     }
-    throw new BranchProvisioningBusyError(dirName);
+    throw new BranchProvisioningBusyError(dirName, shortName);
   } finally {
     await release().catch((err2) => {
       canopyLogWarn2(`[canopy] Failed to release the provisioning lock for ${dirName}:`, err2);
@@ -8006,7 +8436,7 @@ async function generateAIContentCLI(options) {
   console.log(`  Output: ${result.outputDir}
 `);
 }
-var __defProp3, __getOwnPropNames3, __esm3, __export3, init_error3, init_atomic_write2, init_field_traversal, ITEM_KEY, ITEM_KEY_PATTERN, isItemKey, BASE58, isListField, init_item_keys, active2, init_logger2, SENTINEL_BASE2, DOT_SEGMENT2, init_sanitize_href2, init_normalize, ROOT_COLLECTION_ID, init_types2, normalizePathValue, flattenSchema, init_flatten, scalarFieldTypes2, markdownFieldTypes2, primitiveFieldTypes2, fieldTypes2, init_types22, SAFE_HTML_TAGS2, COMPONENT_NAME2, MDX_BINDINGS2, FORBIDDEN_ATTRIBUTES2, init_mdx_allowlist2, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, mdxPropAllowSchema2, mdxAllowlistSchema2, markdownFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceSortFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, uploadTargetUrlSchema2, previewPrefixSchema2, editorUrlSchema2, init_url2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, seoFieldNameSchema2, seoSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned2, init_mode_env, forEachReferenceField, init_validation, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned3, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, task_queue_config_exports2, init_task_queue_config2, worker_status_exports, WORKER_STATUS_FILE, init_worker_status, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, envFlag2, LOG_LEVELS2, DebugLogger2, testLogger2, MARKDOWN_EXPORT_OPTIONS, BULLETS, DELIMITERS, EMPHASIS, STRONG, RULE, WORD_CHAR, GAP, Restyler, END, FRESH, LINE_WIDTH, MIN_LINE_WIDTH, SourceSplicer, log2, MAX_LCS_CELLS, Splicer, log22, EVIDENCE_MAX_DEPTH, log3, locks, PROVISIONING_LOCK_STALE_MS, sleep, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep2, CONTENT_WRITE_LOCK_STALE_MS, heldRoots, getFormatExtension, isDataOnlyFormat, asRecord, DEFAULT_SEO_FIELD_NAMES, asRecord2, asText, asFlag, asImageUrl, asOgType, asTwitterCard, RESTRICTED_REFERENCE_MARKER, SEO_GROUP_FIELDS, MAX_WARNED, warned4, SchemaUnavailableError, BASE58_PATTERN, CONTENT_ID_PATTERN, PHYSICAL_SEGMENT_PATTERN, isValidId, parseTypedFilename, EMPTY_LOGICAL_PATH, ENTRY_EXTENSIONS, ContentIdIndex, CONTENT_EXTENSIONS, registry, finalization, log4, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, fingerprints, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER, storage, log5, BaseBranchUnresolvedError, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, CANOPY_META_DIR, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SCHEMA_CACHE_FILE, SCHEMA_GENERATION_RESOURCE, reportedIssues, BranchSchemaCache, RESOURCE, RESERVED_SETTINGS_BRANCH_PREFIX, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, EntryGoneError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, isEmptyFieldValue, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, isMissingReference, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, DEFAULT_REFERENCE_RENDERING, FLAT_CELL_TYPES, log6, BASE58_CHAR, ENTRY_LINK_PATTERN, INLINE_LINK_TARGET, BranchMetadataCorruptError, BRANCH_META_DIR, BRANCH_META_FILE, branchMetadataFilePath, UNKNOWN_TIME, enumOf, branchMetadataShape, branchMetadataSchema, branchMetadataFileSchema, log7, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, snapshotSchema, reportedUnreadable, BranchRegistry, log8, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, loadBranchContext, log9, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, GIT_NETWORK_ENV_PASSTHROUGH, NO_AUTO_GC_CONFIG, REMOTE_GIT_CONFIG, REMOTE_GIT_MAX_LOOSE_OBJECTS, REMOTE_GIT_MAX_PACKS, PARALLEL_CHECKOUT_ARGS, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, GitConflictError, GitRemoteRefMissingError, RemoteNotReadyError, SettingsRemoteUnreadableError, SettingsBranchDivergedError, SETTINGS_BRANCH_FILES, SettingsBranchHasContentHistoryError, GitManager, PUBLISH_LOCK_WAIT_MS, CREATE_RESIDUE_MIN_QUIET_MS, STAGING_MAX_AGE_MS, REPAIR_MAX_AGE_MS, DELETING_MAX_AGE_MS, SETTINGS_TRASH_MAX_AGE_MS, BranchProvisioningBusyError, BranchDirOccupiedError, STAGING_PREFIX, REPAIR_PREFIX, TRASH_PREFIX, stagingDirName, NO_GIT, RENAME_BLOCKED, SPARSE_CONE_RECORD, defaultSink, sink, ProvisionLog, testHooks, provisionsInFlight, BranchWorkspaceManager, log10, normalizePath, readEntryData, createReferenceResolver, withoutUnavailableEntries, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, CROP_PRECISION, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
+var __defProp3, __getOwnPropNames3, __esm3, __export3, init_error3, init_atomic_write2, init_field_traversal, ITEM_KEY, ITEM_KEY_PATTERN, isItemKey, BASE58, isListField, init_item_keys, active2, init_logger2, SENTINEL_BASE2, DOT_SEGMENT2, init_sanitize_href2, init_normalize, RESERVED_SETTINGS_BRANCH_PREFIX2, init_branch_name, BASE58_PATTERN2, CONTENT_ID_PATTERN2, PHYSICAL_SEGMENT_PATTERN2, MAX_BRANCH_NAME_LENGTH2, init_validation, ROOT_COLLECTION_ID, init_types2, normalizePathValue, flattenSchema, init_flatten, scalarFieldTypes2, markdownFieldTypes2, primitiveFieldTypes2, fieldTypes2, init_types22, SAFE_HTML_TAGS2, COMPONENT_NAME2, MDX_BINDINGS2, FORBIDDEN_ATTRIBUTES2, init_mdx_allowlist2, fieldBaseSchema2, selectOptionSchema2, referenceOptionSchema2, primitiveFieldSchema2, mdxPropAllowSchema2, mdxAllowlistSchema2, markdownFieldSchema2, ASPECT_RATIO_RE2, imageFieldSchema2, selectFieldSchema2, referenceSortFieldSchema2, referenceFieldSchema2, fieldHolder2, blockSchema2, blockFieldSchema2, objectFieldSchema2, inlineGroupFieldSchema2, customFieldSchema2, knownFieldSchema2, fieldSchema2, init_field2, relativePathSchema2, entryTypeSchema2, collectionSchema2, init_collection2, uploadTargetUrlSchema2, previewPrefixSchema2, editorUrlSchema2, init_url2, mediaSchema2, init_media2, defaultBranchAccessSchema2, defaultPathAccessLevelSchema2, defaultPathAccessLevelsSchema2, defaultPathAccessSchema2, defaultBaseBranchSchema2, defaultRemoteNameSchema2, defaultRemoteUrlSchema2, gitBotAuthorNameSchema2, gitBotAuthorEmailSchema2, githubTokenEnvVarSchema2, operatingModeSchema2, deployedAsSchema2, contentRootSchema2, sourceRootSchema2, basePathSchema2, deploymentNameSchema2, devContentSyncSchema2, devConfigSchema2, editorConfigSchema2, seoFieldNameSchema2, seoSchema2, CanopyConfigSchema2, DEFAULT_PROD_WORKSPACE2, init_config3, SERVER_MODE_ENV_VAR, BROWSER_MODE_ENV_VAR, warned22, init_mode_env, forEachReferenceField, init_validation2, ProdClientSafeStrategy2, DevClientSafeStrategy2, clientStrategyCache, init_client_safe_strategy, warned3, VALID_DEPLOYMENT_NAME2, isValidDeploymentName2, init_deployment_name, warned4, DEPLOYMENT_PLACEHOLDER2, DEFAULT_BRANCH_NAMESPACE_TEMPLATE2, BRANCH_NAMESPACE_ENV2, init_branch_namespace, init_config22, ProdStrategy2, DevStrategy2, strategyCache2, init_client_unsafe_strategy, operating_mode_exports, init_operating_mode, task_queue_config_exports2, init_task_queue_config2, worker_status_exports, WORKER_STATUS_FILE, init_worker_status, BLOCK_DISCRIMINATOR_KEYS, BLOCK_STRUCTURAL_KEYS, envFlag2, LOG_LEVELS2, DebugLogger2, testLogger2, MARKDOWN_EXPORT_OPTIONS, BULLETS, DELIMITERS, EMPHASIS, STRONG, RULE, WORD_CHAR, GAP, Restyler, END, FRESH, LINE_WIDTH, MIN_LINE_WIDTH, SourceSplicer, log2, MAX_LCS_CELLS, Splicer, log22, EVIDENCE_MAX_DEPTH, log3, locks, PROVISIONING_LOCK_STALE_MS, sleep, META_DIR, CONTENT_WRITE_LOCK_NAME, DEFAULT_CONTENT_WRITE_LOCK_WAIT_MS, ContentWriteLockBusyError, sleep2, CONTENT_WRITE_LOCK_STALE_MS, heldRoots, getFormatExtension, isDataOnlyFormat, asRecord, DEFAULT_SEO_FIELD_NAMES, asRecord2, asText, asFlag, asImageUrl, asOgType, asTwitterCard, RESTRICTED_REFERENCE_MARKER, SEO_GROUP_FIELDS, MAX_WARNED, warned5, SchemaUnavailableError, isValidId, parseTypedFilename, EMPTY_LOGICAL_PATH, ENTRY_EXTENSIONS, ContentIdIndex, CONTENT_EXTENSIONS, registry, finalization, log4, META_DIR2, entryTypeMetaSchema, collectionMetaSchema, rootCollectionMetaSchema, fingerprints, editDistance, closestName, forEachEntryType, collectEntryTypeNames, validateReferenceEntryTypes, isDeployedStatic, isBuildMode, readsFromCheckout, STATIC_DEPLOY_USER, storage, log5, BaseBranchUnresolvedError, NETWORK_SCHEME_PATTERN, TRANSPORT_HELPER_PATTERN, LEADING_OPTION_PATTERN, WINDOWS_DRIVE_PATTERN, COLON_BEFORE_SLASH_PATTERN, MISSING_REMOTE_REF_REASONS, CANOPY_META_DIR, SCHEMA_CACHE_VERSION, MTIME_CHECK_DEBOUNCE_MS, SNAPSHOT_MEMO_MAX_BYTES, SCHEMA_CACHE_FILE, SCHEMA_GENERATION_RESOURCE, reportedIssues, BranchSchemaCache, RESOURCE, BranchPathError, resolveContentBranchesRoot, ContentStoreError, ContentConflictError, EntryGoneError, BranchSyncingError, DuplicateContentIdError, UrlPathConflictError, isEmptyFieldValue, DEFAULT_INDEX_FRESHNESS_INTERVAL_MS, FORCED_REFRESH_MIN_INTERVAL_MS, STALE_LOOKUP, isMissingReference, createReferenceResolveCache, ContentStore, ATTR_CONTENT, BLOCK_PREFIX, BLOCK_SUFFIX, BLOCK_RESTORE_RE, INLINE_PREFIX, INLINE_SUFFIX, INLINE_RESTORE_RE, DEFAULT_REFERENCE_RENDERING, FLAT_CELL_TYPES, log6, BASE58_CHAR, ENTRY_LINK_PATTERN, INLINE_LINK_TARGET, BranchMetadataCorruptError, BRANCH_META_DIR, BRANCH_META_FILE, branchMetadataFilePath, UNKNOWN_TIME, enumOf, branchMetadataShape, branchMetadataSchema, branchMetadataFileSchema, log7, REGISTRY_FILE, REGISTRY_STALE_FILE, REGISTRY_TEMP_FILE, REGISTRY_VERSION, RESOURCE2, GET_MISS_REFRESH_MIN_INTERVAL_MS, snapshotSchema, reportedUnreadable, BranchRegistry, log8, OccWriteConflictError, CURRENT_SCHEMA_VERSION, BranchMetadataConflictError, BranchMetadataFileManager, loadBranchContext, GitProcessError, STDERR_CAP_BYTES, KILL_GRACE_MS, log9, GIT_ENV_PASSTHROUGH, FORCE_C_LOCALE, GIT_NETWORK_ENV_PASSTHROUGH, NO_AUTO_GC_CONFIG, HASH_INACTIVITY_TIMEOUT_MS, MAX_HASH_RUNS, LS_REMOTE_INACTIVITY_TIMEOUT_MS, symlinkBlobSha, REMOTE_GIT_CONFIG, REMOTE_GIT_MAX_LOOSE_OBJECTS, REMOTE_GIT_MAX_PACKS, PARALLEL_CHECKOUT_ARGS, remoteInitLocks, GITHUB_TRACKING_REF_PREFIX, BaseBranchMissingError, GitConflictError, GitRemoteRefMissingError, RemoteNotReadyError, SettingsRemoteUnreadableError, SettingsBranchDivergedError, SETTINGS_BRANCH_FILES, SettingsBranchHasContentHistoryError, GitManager, PUBLISH_LOCK_WAIT_MS, CREATE_RESIDUE_MIN_QUIET_MS, STAGING_MAX_AGE_MS, REPAIR_MAX_AGE_MS, DELETING_MAX_AGE_MS, SETTINGS_TRASH_MAX_AGE_MS, BranchProvisioningBusyError, BranchDirOccupiedError, STAGING_PREFIX, REPAIR_PREFIX, TRASH_PREFIX, stagingDirName, NO_GIT, RENAME_BLOCKED, SPARSE_CONE_RECORD, defaultSink, sink, ProvisionLog, testHooks, provisionsInFlight, BranchWorkspaceManager, log10, normalizePath, parseEntryParts, parseEntryData, readEntryData, createReferenceResolver, withoutUnavailableEntries, resolveCollectionItemReferences, looksLikeMalformedEntry, listCollectionEntries, MAX_INPUT_PIXELS, CROP_PRECISION, KNOWN_FIELD_TYPES, STRING_FIELD_TYPES, selectOptionValues, GENERATED_RECORD_FILENAME, SAFE_BUILD_ID, BUILD_ID_RULE, jiti;
 var init_generate_ai_content = __esm({
   "dist/cli/generate-ai-content.js"() {
     "use strict";
@@ -8063,6 +8493,21 @@ var init_generate_ai_content = __esm({
         "use strict";
       }
     });
+    init_branch_name = __esm3({
+      "dist/paths/branch-name.js"() {
+        "use strict";
+        RESERVED_SETTINGS_BRANCH_PREFIX2 = "canopycms-settings-";
+      }
+    });
+    init_validation = __esm3({
+      "dist/paths/validation.js"() {
+        "use strict";
+        BASE58_PATTERN2 = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
+        CONTENT_ID_PATTERN2 = new RegExp(`^${BASE58_PATTERN2}{12}$`);
+        PHYSICAL_SEGMENT_PATTERN2 = new RegExp(`\\.${BASE58_PATTERN2}{12}(?:\\.[a-z]+)?$`);
+        MAX_BRANCH_NAME_LENGTH2 = 250;
+      }
+    });
     init_types2 = __esm3({
       "dist/paths/types.js"() {
         "use strict";
@@ -8606,6 +9051,8 @@ var init_generate_ai_content = __esm({
           // (operating-mode/deployment-name.ts) implements — config would always "win" over
           // modeDefault, masking dev's real default of 'local'. Do not remove `.optional()`.
           deploymentName: deploymentNameSchema2.optional(),
+          // Checked where it is resolved (operating-mode/branch-namespace.ts), with the deployment name.
+          branchNamespace: z6.string().optional(),
           contentRoot: contentRootSchema2.default("content"),
           sourceRoot: sourceRootSchema2.optional(),
           basePath: basePathSchema2,
@@ -8629,10 +9076,10 @@ var init_generate_ai_content = __esm({
         init_logger2();
         SERVER_MODE_ENV_VAR = "CANOPY_MODE";
         BROWSER_MODE_ENV_VAR = "NEXT_PUBLIC_CANOPY_MODE";
-        warned2 = false;
+        warned22 = false;
       }
     });
-    init_validation = __esm3({
+    init_validation2 = __esm3({
       "dist/config/validation.js"() {
         "use strict";
         forEachReferenceField = (fields, visit3) => {
@@ -8722,6 +9169,19 @@ var init_generate_ai_content = __esm({
         isValidDeploymentName2 = (name) => VALID_DEPLOYMENT_NAME2.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
       }
     });
+    init_branch_namespace = __esm3({
+      "dist/operating-mode/branch-namespace.js"() {
+        "use strict";
+        init_branch_name();
+        init_validation();
+        init_logger2();
+        init_deployment_name();
+        warned4 = false;
+        DEPLOYMENT_PLACEHOLDER2 = "{deployment}";
+        DEFAULT_BRANCH_NAMESPACE_TEMPLATE2 = `canopycms/${DEPLOYMENT_PLACEHOLDER2}/`;
+        BRANCH_NAMESPACE_ENV2 = "CANOPYCMS_BRANCH_NAMESPACE";
+      }
+    });
     init_config22 = __esm3({
       "dist/config/index.js"() {
         "use strict";
@@ -8733,6 +9193,7 @@ var init_generate_ai_content = __esm({
       "dist/operating-mode/client-unsafe-strategy.js"() {
         "use strict";
         init_client_safe_strategy();
+        init_branch_namespace();
         init_deployment_name();
         init_config22();
         ProdStrategy2 = class extends ProdClientSafeStrategy2 {
@@ -8773,6 +9234,9 @@ var init_generate_ai_content = __esm({
               return config.settingsBranch;
             return `canopycms-settings-${resolveDeploymentName2(config, "prod")}`;
           }
+          getBranchNamespace(config) {
+            return resolveBranchNamespace2(config, "prod");
+          }
           getSettingsRoot(sourceRoot) {
             return path92.join(this.getWorkspaceRoot(sourceRoot), "settings");
           }
@@ -8822,6 +9286,9 @@ var init_generate_ai_content = __esm({
               return config.settingsBranch;
             return `canopycms-settings-${resolveDeploymentName2(config, "local")}`;
           }
+          getBranchNamespace(config) {
+            return resolveBranchNamespace2(config, "local");
+          }
           getSettingsRoot(sourceRoot) {
             return path92.join(this.getWorkspaceRoot(sourceRoot), "settings");
           }
@@ -8868,6 +9335,7 @@ var init_generate_ai_content = __esm({
       WORKER_STATUS_FILE: () => WORKER_STATUS_FILE,
       readCarriedOverStatus: () => readCarriedOverStatus,
       readWorkerStartupFailure: () => readWorkerStartupFailure,
+      readWorkerStatus: () => readWorkerStatus,
       readWorkerStatusStartedAt: () => readWorkerStatusStartedAt,
       writeWorkerStatus: () => writeWorkerStatus
     });
@@ -9937,7 +10405,7 @@ var init_generate_ai_content = __esm({
     ];
     init_logger2();
     MAX_WARNED = 1e3;
-    warned4 = /* @__PURE__ */ new Set();
+    warned5 = /* @__PURE__ */ new Set();
     init_logger2();
     SchemaUnavailableError = class extends Error {
       constructor(entryType, unavailable) {
@@ -9948,9 +10416,7 @@ var init_generate_ai_content = __esm({
       }
     };
     init_normalize();
-    BASE58_PATTERN = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
-    CONTENT_ID_PATTERN = new RegExp(`^${BASE58_PATTERN}{12}$`);
-    PHYSICAL_SEGMENT_PATTERN = new RegExp(`\\.${BASE58_PATTERN}{12}(?:\\.[a-z]+)?$`);
+    init_validation();
     isValidId = isValidContentId;
     init_error3();
     init_logger2();
@@ -10311,7 +10777,7 @@ var init_generate_ai_content = __esm({
     });
     fingerprints = /* @__PURE__ */ new WeakMap();
     init_flatten();
-    init_validation();
+    init_validation2();
     editDistance = (a, b) => {
       let prev = Array.from({ length: b.length + 1 }, (_, i) => i);
       for (let i = 1; i <= a.length; i++) {
@@ -10416,12 +10882,18 @@ var init_generate_ai_content = __esm({
     init_logger2();
     SCHEMA_CACHE_VERSION = 4;
     MTIME_CHECK_DEBOUNCE_MS = 1e3;
+    SNAPSHOT_MEMO_MAX_BYTES = 64 * 1024 * 1024;
     SCHEMA_CACHE_FILE = "schema-cache.json";
     SCHEMA_GENERATION_RESOURCE = "schema";
     reportedIssues = /* @__PURE__ */ new Set();
     BranchSchemaCache = class {
       constructor(mode = "prod") {
         this.lastMtimeCheck = /* @__PURE__ */ new Map();
+        this.snapshots = new LRUCache({
+          maxSize: SNAPSHOT_MEMO_MAX_BYTES,
+          sizeCalculation: (snapshot) => Math.max(1, snapshot.bytes)
+        });
+        this.buildResolves = /* @__PURE__ */ new Map();
         this.devMode = mode === "dev";
       }
       /**
@@ -10451,15 +10923,12 @@ var init_generate_ai_content = __esm({
       async loadFromCacheOrResolve(branchRoot, entrySchemaRegistry, contentRootName) {
         const contentRoot = path82.join(branchRoot, contentRootName);
         const fromCheckout = this.readsCheckout(branchRoot);
+        if (fromCheckout && isBuildMode()) {
+          return this.resolveForBuild(branchRoot, entrySchemaRegistry, contentRootName);
+        }
         if (!fromCheckout) {
           const cachePath = path82.join(await schemaCacheDir(branchRoot), SCHEMA_CACHE_FILE);
-          let cacheData = null;
-          try {
-            const cacheContent = await fs72.readFile(cachePath, "utf-8");
-            cacheData = JSON.parse(cacheContent);
-          } catch {
-            cacheData = null;
-          }
+          let cacheData = await this.readSnapshot(cachePath);
           if (cacheData && cacheData.version === SCHEMA_CACHE_VERSION && cacheData.registryFingerprint === registryFingerprint(entrySchemaRegistry)) {
             const read = await readResourceGeneration(branchRoot, SCHEMA_GENERATION_RESOURCE);
             if (isGenerationCurrent(cacheData.generation, read)) {
@@ -10489,6 +10958,42 @@ var init_generate_ai_content = __esm({
           fromCheckout
         });
       }
+      resolveForBuild(branchRoot, entrySchemaRegistry, contentRootName) {
+        const key = `${path82.resolve(branchRoot, contentRootName)}\0${registryFingerprint(entrySchemaRegistry)}`;
+        let pending = this.buildResolves.get(key);
+        if (!pending) {
+          pending = this.resolveFreshAndPersist(branchRoot, entrySchemaRegistry, contentRootName, {
+            fromCheckout: true
+          });
+          this.buildResolves.set(key, pending);
+          pending.catch(() => this.buildResolves.delete(key));
+        }
+        return pending;
+      }
+      /** The parsed cache file, or null when it is absent or unreadable. */
+      async readSnapshot(cachePath) {
+        let handle;
+        try {
+          handle = await fs72.open(cachePath, "r");
+        } catch {
+          return null;
+        }
+        try {
+          const stat = await handle.stat({ bigint: true });
+          const identity = fileIdentity(stat);
+          const memo = this.snapshots.get(cachePath);
+          if (memo?.identity === identity)
+            return memo.entry;
+          const entry = JSON.parse(await fs72.readFile(handle, "utf-8"));
+          this.snapshots.set(cachePath, { identity, entry, bytes: Number(stat.size) });
+          return entry;
+        } catch {
+          return null;
+        } finally {
+          await handle.close().catch(() => {
+          });
+        }
+      }
       /**
        * Resolve the schema fresh from disk and persist it (subject to the
        * skip-persist rule below), UNCONDITIONALLY -- never through the cache-read
@@ -10530,14 +11035,22 @@ var init_generate_ai_content = __esm({
             };
             await fs72.mkdir(cacheDir, { recursive: true });
             const tmpPath = path82.join(cacheDir, `schema-cache.tmp.${Date.now()}.${Math.random()}.json`);
-            await fs72.writeFile(tmpPath, JSON.stringify(newCache, null, 2), "utf-8");
+            const body = JSON.stringify(newCache);
+            let identity;
             try {
+              await fs72.writeFile(tmpPath, body, "utf-8");
+              identity = fileIdentity(await fs72.stat(tmpPath, { bigint: true }));
               await fs72.rename(tmpPath, cachePath);
             } catch (err2) {
               await fs72.unlink(tmpPath).catch(() => {
               });
               throw err2;
             }
+            this.snapshots.set(cachePath, {
+              identity,
+              entry: JSON.parse(body),
+              bytes: Buffer.byteLength(body)
+            });
           }
         }
         reportSchemaIssues(issues);
@@ -10576,13 +11089,15 @@ var init_generate_ai_content = __esm({
     init_error3();
     init_error3();
     init_normalize();
+    init_validation();
     init_operating_mode();
-    RESERVED_SETTINGS_BRANCH_PREFIX = "canopycms-settings-";
+    init_branch_name();
     BranchPathError = class extends Error {
     };
     resolveContentBranchesRoot = (mode, override) => {
       return operatingStrategy2(mode).getContentBranchesRoot(override);
     };
+    init_branch_name();
     ContentStoreError = class extends Error {
       constructor(message, code) {
         super(message);
@@ -11881,7 +12396,13 @@ var init_generate_ai_content = __esm({
       historyRewrittenFrom: z72.string().optional(),
       syncFailureReason: z72.string().optional(),
       editors: z72.array(z72.string()).optional(),
-      uncommittedEditors: z72.array(z72.string()).optional()
+      uncommittedEditors: z72.array(z72.string()).optional(),
+      // Dropped when malformed: it only decorates the PR body, so it never fails a read.
+      review: z72.object({
+        state: z72.enum(["approved", "changes-requested"]),
+        by: z72.object({ userId: z72.string(), name: z72.string().optional() }),
+        at: z72.string()
+      }).optional().catch(void 0)
     };
     branchMetadataSchema = z72.object(branchMetadataShape).passthrough();
     branchMetadataFileSchema = z72.object({
@@ -11978,14 +12499,23 @@ var init_generate_ai_content = __esm({
        * genuinely-absent branch costs at most one extra scan per window.
        */
       async get(name) {
-        const branches = await this.list();
-        const found = branches.find((b) => b.branch.name === name);
+        return this.find((b) => b.branch.name === name);
+      }
+      /**
+       * Returns the branch whose workspace directory is `key` (`sanitizeBranchName` of its ref),
+       * whatever its name, with {@link get}'s backstop.
+       */
+      async getByKey(key) {
+        return this.find((b) => path15.basename(b.branchRoot) === key);
+      }
+      async find(matches) {
+        const found = (await this.list()).find(matches);
         if (found)
           return found;
         if (!this.shouldForceRefresh())
           return void 0;
         const refreshed = await this.regenerate();
-        return refreshed.find((b) => b.branch.name === name);
+        return refreshed.find(matches);
       }
       shouldForceRefresh() {
         const now = Date.now();
@@ -12286,13 +12816,33 @@ var init_generate_ai_content = __esm({
         baseRoot
       };
     };
+    init_operating_mode();
+    init_branch_name();
     init_error3();
     init_logger2();
+    init_error3();
+    GitProcessError = class extends Error {
+      constructor(message, exitCode, stderr) {
+        super(message);
+        this.exitCode = exitCode;
+        this.stderr = stderr;
+        this.name = "GitProcessError";
+      }
+    };
+    STDERR_CAP_BYTES = 64 * 1024;
+    KILL_GRACE_MS = 2e3;
     log9 = createDebugLogger2({ prefix: "GitManager" });
     GIT_ENV_PASSTHROUGH = /^(PATH|HOME|USER|LANG|LC_[A-Z]+|TZ|TMPDIR|GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)|GIT_TERMINAL_PROMPT|GIT_TRACE[0-9A-Z_]*)$/;
     FORCE_C_LOCALE = { LC_ALL: "C", LANG: "C" };
     GIT_NETWORK_ENV_PASSTHROUGH = /^((HTTPS?|ALL)_PROXY|(https?|all)_proxy|NO_PROXY|no_proxy|GIT_SSL_(CAINFO|CAPATH|NO_VERIFY|VERSION)|CURL_CA_BUNDLE|SSL_CERT_(FILE|DIR)|REQUESTS_CA_BUNDLE|NODE_EXTRA_CA_CERTS)$/;
     NO_AUTO_GC_CONFIG = ["gc.auto=0", "maintenance.auto=false"];
+    HASH_INACTIVITY_TIMEOUT_MS = 6e4;
+    MAX_HASH_RUNS = 50;
+    LS_REMOTE_INACTIVITY_TIMEOUT_MS = 6e4;
+    symlinkBlobSha = (target, likeSha) => {
+      const body = Buffer.from(target, "utf8");
+      return createHash2(likeSha.length === 64 ? "sha256" : "sha1").update(Buffer.concat([Buffer.from(`blob ${body.length}\0`), body])).digest("hex");
+    };
     REMOTE_GIT_CONFIG = [
       ["gc.auto", "0"],
       ["receive.autogc", "false"],
@@ -12309,6 +12859,12 @@ var init_generate_ai_content = __esm({
     ];
     remoteInitLocks = /* @__PURE__ */ new Map();
     GITHUB_TRACKING_REF_PREFIX = "refs/remotes/github/";
+    BaseBranchMissingError = class extends Error {
+      constructor(remote, baseBranch) {
+        super(`CanopyCMS: remote '${remote}' has no branch '${baseBranch}'`);
+        this.name = "BaseBranchMissingError";
+      }
+    };
     GitConflictError = class extends Error {
       constructor(conflictedFiles) {
         super(`Git conflict in ${conflictedFiles.length} file(s): ${conflictedFiles.join(", ")}`);
@@ -12584,6 +13140,36 @@ var init_generate_ai_content = __esm({
         }
         return refs.includes(`refs/heads/${branch}`) || refs.includes(`${GITHUB_TRACKING_REF_PREFIX}${branch}`);
       }
+      /**
+       * The branches inside `branch` (`<branch>/…`) that a bare mirror holds as local heads or in
+       * GitHub's tracking namespace, which git cannot hold beside `branch` itself. `for-each-ref`
+       * matches a pattern up to a slash, so the pattern `<branch>` lists them. Throws, as
+       * {@link bareRemoteHasBranch} does, when the mirror is unreadable.
+       */
+      static async bareRemoteBranchesInside(remotePath, branch) {
+        let output;
+        try {
+          output = await simpleGit22().raw([
+            "--git-dir",
+            remotePath,
+            "for-each-ref",
+            "--format=%(refname)",
+            "--end-of-options",
+            `refs/heads/${branch}`,
+            `${GITHUB_TRACKING_REF_PREFIX}${branch}`
+          ]);
+        } catch (err2) {
+          throw new Error(`Cannot inspect remote mirror at ${remotePath}: ${getErrorMessage3(err2)}`);
+        }
+        const inside = /* @__PURE__ */ new Set();
+        for (const ref of output.split("\n").map((line) => line.trim())) {
+          for (const prefix of ["refs/heads/", GITHUB_TRACKING_REF_PREFIX]) {
+            if (ref.startsWith(`${prefix}${branch}/`))
+              inside.add(ref.slice(prefix.length));
+          }
+        }
+        return [...inside].sort();
+      }
       /**
        * Delete `refs/heads/<branch>` from a bare local mirror, if present. A
        * no-op (not an error) when the ref doesn't exist.
@@ -13282,6 +13868,199 @@ var init_generate_ai_content = __esm({
         ]);
         return output.split("\0").filter((p5) => p5.length > 0);
       }
+      /**
+       * Every file in `rev`'s tree below repo-relative directory `under`, with its size in bytes,
+       * so a caller can refuse a file too large to read before reading it.
+       */
+      async listFilesWithSizeAt(rev, under) {
+        const dir = `${under.replace(/\/+$/, "")}/`;
+        const output = await this.git.raw([
+          "ls-tree",
+          "-r",
+          "-z",
+          "-l",
+          "--full-tree",
+          "--end-of-options",
+          rev,
+          dir
+        ]);
+        const files = [];
+        for (const record of output.split("\0")) {
+          const tab = record.indexOf("	");
+          if (tab === -1)
+            continue;
+          const [, type, , size] = record.slice(0, tab).split(/ +/);
+          const filePath = record.slice(tab + 1);
+          if (type === "blob" && filePath.startsWith(dir)) {
+            files.push({ path: filePath, size: Number(size) });
+          }
+        }
+        return files;
+      }
+      /**
+       * The commit HEAD forked from the base branch at, or `undefined` when they share no history.
+       * Takes the base tip from the remote by `ls-remote` rather than `<remote>/<base>`: the worker
+       * fetches by path, which moves no remote-tracking ref, so that ref is left behind by every
+       * rebase. A tip this clone lacks is fetched as objects only (`--refmap=`, `--no-tags`,
+       * `--no-write-fetch-head`, git 2.29+): no ref and no FETCH_HEAD moves, so a concurrent fetch
+       * pinning FETCH_HEAD is never repointed. Throws {@link BaseBranchMissingError} when the
+       * remote has no base branch, and any other error when it can't be read.
+       */
+      async mergeBaseWithBase() {
+        const tip = await this.remoteBranchTip(this.baseBranch);
+        if (!tip)
+          throw new BaseBranchMissingError(this.remote, this.baseBranch);
+        if (!await this.hasCommit(tip)) {
+          await this.git.raw([
+            "fetch",
+            "--refmap=",
+            "--no-tags",
+            "--no-write-fetch-head",
+            "--end-of-options",
+            this.remote,
+            `refs/heads/${this.baseBranch}`
+          ]);
+          if (!await this.hasCommit(tip)) {
+            throw new Error(`CanopyCMS: could not fetch ${this.baseBranch}'s tip ${tip}`);
+          }
+        }
+        const forkPoint = (await this.git.raw(["merge-base", "--end-of-options", "HEAD", tip])).trim();
+        return forkPoint || void 0;
+      }
+      /** Whether this clone holds commit `sha`. */
+      async hasCommit(sha) {
+        return (await this.git.raw(["rev-parse", "--verify", "--quiet", `${sha}^{commit}`])).trim() !== "";
+      }
+      /**
+       * Repo-relative paths whose working-tree content differs from commit `rev`, with `T` (a type
+       * change) reported as `M`. A sparse clone leaves a path outside its cone unchecked out, marked
+       * skip-worktree, and git reads that path's index entry in place of the missing file: it is never
+       * reported deleted, and differs from `rev` only as the index does.
+       *
+       * `diff-index`, not `git diff`: the porcelain refreshes the index and writes it back under
+       * `index.lock`, which would fail a concurrent writer's own git step. `diff-index` writes
+       * nothing, so it reports a file whose stat changed but whose content did not; those are
+       * hashed here and dropped when they match `rev`.
+       */
+      async diffNameStatusAgainst(rev) {
+        const output = await this.git.raw([
+          "diff-index",
+          "--raw",
+          "-z",
+          "--no-renames",
+          "--end-of-options",
+          rev,
+          "--"
+        ]);
+        const tokens = output.split("\0");
+        const changes = [];
+        for (let i = 0; i + 1 < tokens.length; i += 2) {
+          const [srcMode, dstMode, srcSha, dstSha, code] = tokens[i].slice(1).split(" ");
+          const path272 = tokens[i + 1];
+          const letter = code?.charAt(0);
+          if (letter === "A" || letter === "D")
+            changes.push({ status: letter, path: path272 });
+          else if (letter === "M" || letter === "T") {
+            const unhashed = /^0+$/.test(dstSha) && srcMode === dstMode ? srcSha : void 0;
+            changes.push({ status: "M", path: path272, unhashed });
+          }
+        }
+        const unchanged = await this.matchingBlobs(changes.flatMap((c) => c.unhashed ? [{ path: c.path, sha: c.unhashed }] : []));
+        return changes.filter((c) => !unchanged.has(c.path)).map(({ status, path: path272 }) => ({ status, path: path272 }));
+      }
+      /**
+       * The paths whose working-tree file hashes to `sha`, as git hashes it: a symlink's blob is its
+       * target, a file's goes through `hash-object --stdin-paths`, so its attributes' filters apply.
+       * Callers pass only paths whose mode is unchanged, since diff-index reports the working tree's
+       * own mode. A path that is gone or can't be hashed matches nothing, so it stays reported as
+       * changed. When git refuses a path (exit 128), having printed
+       * the SHAs before it, the next run resumes past that path, for at most {@link MAX_HASH_RUNS}
+       * runs. A run that ends any other way (killed, timed out, a signal) stops the hashing, and the
+       * paths it didn't reach stay changed.
+       */
+      async matchingBlobs(files) {
+        const matching = /* @__PURE__ */ new Set();
+        const regular = [];
+        for (const file of files) {
+          if (file.path.includes("\n"))
+            continue;
+          const stat = await fs16.lstat(path20.join(this.repoPath, file.path)).catch(() => void 0);
+          if (!stat)
+            continue;
+          if (stat.isSymbolicLink()) {
+            const target = await fs16.readlink(path20.join(this.repoPath, file.path)).catch(() => void 0);
+            if (target !== void 0 && symlinkBlobSha(target, file.sha) === file.sha) {
+              matching.add(file.path);
+            }
+          } else if (stat.isFile())
+            regular.push(file);
+        }
+        for (let start = 0, runs = 0; start < regular.length && runs < MAX_HASH_RUNS; runs++) {
+          const batch = regular.slice(start);
+          const { shas, outcome } = await this.hashPaths(batch.map((f) => f.path));
+          shas.forEach((sha, i) => {
+            if (batch[i] && sha === batch[i].sha)
+              matching.add(batch[i].path);
+          });
+          if (outcome !== "refused")
+            break;
+          start += shas.length + 1;
+        }
+        return matching;
+      }
+      /**
+       * `hash-object --stdin-paths` over `paths`: one SHA per path, in order, up to where it ended.
+       * `refused` is git's own exit 128 on a path it can't hash; `stopped` is any other ending.
+       */
+      async hashPaths(paths) {
+        const chunks = [];
+        let proc;
+        try {
+          proc = spawnGit(["hash-object", "--stdin-paths"], {
+            ...this.processOptions(),
+            stdin: `${paths.join("\n")}
+`,
+            inactivityTimeoutMs: HASH_INACTIVITY_TIMEOUT_MS
+          });
+        } catch {
+          return { shas: [], outcome: "stopped" };
+        }
+        const read = (async () => {
+          for await (const chunk of proc.stdout)
+            chunks.push(chunk);
+        })().catch(() => {
+        });
+        const outcome = await proc.exited.then(() => "complete", (err2) => err2 instanceof GitProcessError && err2.exitCode === 128 ? "refused" : "stopped");
+        await read;
+        return { shas: Buffer.concat(chunks).toString("utf8").split("\n").filter(Boolean), outcome };
+      }
+      /** What a git run outside simple-git needs to run as `this.git` does. */
+      processOptions() {
+        return {
+          cwd: this.repoPath,
+          env: gitChildEnv({ GIT_CEILING_DIRECTORIES: path20.dirname(this.repoPath) }),
+          config: NO_AUTO_GC_CONFIG
+        };
+      }
+      /** Repo-relative paths of the working tree's untracked, non-ignored files. */
+      async listUntrackedFiles() {
+        const output = await this.git.raw(["ls-files", "--others", "--exclude-standard", "-z"]);
+        return output.split("\0").filter((p5) => p5.length > 0);
+      }
+      /**
+       * The text of repo-relative `filePath` at commit `rev`, or `undefined` when `rev` has no such
+       * path. Any other failure, such as an unknown `rev`, throws.
+       */
+      async showFile(rev, filePath) {
+        try {
+          return await this.git.raw(["show", "--end-of-options", `${rev}:${filePath}`]);
+        } catch (err2) {
+          if (/fatal: path '.*' (does not exist in|exists on disk, but not in) '/.test(getErrorMessage3(err2))) {
+            return void 0;
+          }
+          throw err2;
+        }
+      }
       async ensureAuthor(author) {
         const config = await this.git.listConfig();
         const isManaged = config.all["canopycms.managed"] === "true";
@@ -13452,7 +14231,10 @@ var init_generate_ai_content = __esm({
        */
       async remoteBranchTip(branch) {
         const ref = `refs/heads/${branch}`;
-        const output = await this.git.raw(["ls-remote", "--heads", this.remote, ref]);
+        const output = await runGit(["ls-remote", "--heads", "--end-of-options", this.remote, ref], {
+          ...this.processOptions(),
+          inactivityTimeoutMs: LS_REMOTE_INACTIVITY_TIMEOUT_MS
+        });
         for (const line of output.split("\n")) {
           const [sha, name] = line.trim().split("	");
           if (sha && name === ref)
@@ -13531,7 +14313,7 @@ var init_generate_ai_content = __esm({
     DELETING_MAX_AGE_MS = 10 * 6e4;
     SETTINGS_TRASH_MAX_AGE_MS = 30 * 24 * 60 * 6e4;
     BranchProvisioningBusyError = class extends Error {
-      constructor(dirName, message = `Branch '${dirName}' is still being set up. Try again in a minute.`) {
+      constructor(dirName, shortName = dirName, message = `Branch '${shortName}' is still being set up. Try again in a minute.`) {
         super(message);
         this.dirName = dirName;
         this.name = "BranchProvisioningBusyError";
@@ -13607,12 +14389,16 @@ var init_generate_ai_content = __esm({
         if (isSettingsBranchName(options.branchName, operatingStrategy2(options.mode).getSettingsBranchName(this.config))) {
           throw new BranchPathError("Settings branches are not content branches");
         }
-        const { branchRoot, baseRoot, branchName: safeName } = resolveBranchPath(options);
+        const named = parseBranchRef2(options.branchName);
+        if (!named.ok)
+          throw new BranchPathError(named.error);
+        const { branchRoot, baseRoot } = resolveBranchPath(options);
         const paths = {
           branchRoot,
           baseRoot,
           dirName: path23.basename(branchRoot),
-          safeName
+          ref: options.branchName,
+          shortName: shortNameOf({ ...this.config, mode: options.mode }, options.branchName)
         };
         const existing = await readBranchMetadataFile(branchRoot);
         if (existing) {
@@ -13630,7 +14416,7 @@ var init_generate_ai_content = __esm({
         }
       }
       async provisionUnshared(options, paths) {
-        const { branchRoot, baseRoot, dirName } = paths;
+        const { branchRoot, baseRoot, dirName, shortName } = paths;
         await fs19.mkdir(baseRoot, { recursive: true });
         const baseBranch = await GitManager.resolveWorkspaceBaseBranch({
           ...this.config,
@@ -13648,7 +14434,7 @@ var init_generate_ai_content = __esm({
         });
         const metadata = buildInitialBranchMetadata({
           branch: {
-            name: paths.safeName,
+            name: paths.ref,
             title: options.title,
             description: options.description,
             access: options.access,
@@ -13660,14 +14446,14 @@ var init_generate_ai_content = __esm({
         if (state.kind === "live" || state.kind === "corrupt")
           return this.existing(paths);
         if (state.kind === "protected")
-          throw new BranchProvisioningBusyError(dirName);
+          throw new BranchProvisioningBusyError(dirName, shortName);
         if (state.kind === "foreign") {
           if (options.mode !== "dev")
             throw new BranchDirOccupiedError(dirName);
           return this.adoptInPlace(options, paths, baseBranch, metadata);
         }
         if (state.kind === "residue" && await this.recentlyActive(paths)) {
-          throw new BranchProvisioningBusyError(dirName);
+          throw new BranchProvisioningBusyError(dirName, shortName);
         }
         const sparseCone = sparseConeFor(this.config.contentRoot);
         await recordSparseCone(baseRoot, sparseCone).catch((err2) => {
@@ -13692,11 +14478,11 @@ var init_generate_ai_content = __esm({
         return outcome;
       }
       async stageAndPublish(paths, run) {
-        const { branchRoot, baseRoot, dirName } = paths;
+        const { branchRoot, baseRoot, dirName, shortName } = paths;
         const staged = await stageBranchWorkspace({
           baseRoot,
           dirName,
-          branchName: paths.safeName,
+          branchName: paths.ref,
           baseBranch: run.baseBranch,
           remoteUrl: run.remoteUrl,
           clone: {
@@ -13716,6 +14502,7 @@ var init_generate_ai_content = __esm({
           published = await run.provisionLog.step("publish", () => publishStaging({
             baseRoot,
             dirName,
+            shortName,
             stagingPath: staged.stagingPath,
             writeId: staged.meta.writeId,
             expectedRemoteUrl: run.remoteUrl,
@@ -13735,16 +14522,16 @@ var init_generate_ai_content = __esm({
        * is, given branch.json under the branch's lock.
        */
       async adoptInPlace(options, paths, baseBranch, metadata) {
-        const { branchRoot, baseRoot, dirName } = paths;
+        const { branchRoot, baseRoot, dirName, shortName } = paths;
         const provisionLog = new ProvisionLog(dirName);
         let created = false;
         try {
-          const release = await provisionLog.step("lock", () => lockBranchName(baseRoot, dirName));
+          const release = await provisionLog.step("lock", () => lockBranchName(baseRoot, dirName, shortName));
           try {
             if (!await readBranchMetadataFile(branchRoot)) {
               await GitManager.initializeWorkspace({
                 workspacePath: branchRoot,
-                branchName: paths.safeName,
+                branchName: paths.ref,
                 mode: options.mode,
                 baseBranch,
                 sourceRoot: this.config.sourceRoot,
@@ -13779,7 +14566,7 @@ var init_generate_ai_content = __esm({
           return this.existing(paths);
         const meta = await readBranchMetadataFile(branchRoot);
         if (!meta)
-          throw new BranchProvisioningBusyError(dirName);
+          throw new BranchProvisioningBusyError(dirName, shortName);
         return { kind: "created", context: { branch: meta.branch, branchRoot, baseRoot } };
       }
       /** Whether residue at the branch path may still belong to a live process. */
@@ -13789,10 +14576,10 @@ var init_generate_ai_content = __esm({
           return true;
         return await quietAgeMs(branchRoot) < CREATE_RESIDUE_MIN_QUIET_MS;
       }
-      async existing({ branchRoot, baseRoot, dirName }) {
+      async existing({ branchRoot, baseRoot, dirName, shortName }) {
         const meta = await readBranchMetadataFile(branchRoot);
         if (!meta)
-          throw new BranchProvisioningBusyError(dirName);
+          throw new BranchProvisioningBusyError(dirName, shortName);
         return { kind: "exists", context: { branch: meta.branch, branchRoot, baseRoot } };
       }
     };
@@ -13806,21 +14593,23 @@ var init_generate_ai_content = __esm({
       }
       return result.normalizedPath;
     };
+    parseEntryParts = (raw, format) => {
+      if (format === "json")
+        return { data: asRecord(JSON.parse(raw)) };
+      if (format === "yaml")
+        return { data: asRecord(yamlParse2(raw)) };
+      const parsed = matter3(raw);
+      return { data: { ...parsed.data ?? {} }, body: parsed.content };
+    };
+    parseEntryData = (raw, format, bodyFieldName = "body") => {
+      const { data, body } = parseEntryParts(raw, format);
+      if (body)
+        data[bodyFieldName] = body;
+      return data;
+    };
     readEntryData = async (filePath, format, bodyFieldName = "body") => {
       try {
-        const raw = await fs20.readFile(filePath, "utf8");
-        if (format === "json") {
-          return asRecord(JSON.parse(raw));
-        }
-        if (format === "yaml") {
-          return asRecord(yamlParse2(raw));
-        }
-        const parsed = matter3(raw);
-        const data = { ...parsed.data ?? {} };
-        if (parsed.content) {
-          data[bodyFieldName] = parsed.content;
-        }
-        return data;
+        return parseEntryData(await fs20.readFile(filePath, "utf8"), format, bodyFieldName);
       } catch (err2) {
         if (isNotFoundError3(err2))
           return {};
@@ -14235,30 +15024,30 @@ function computeExtractRegion(crop, width, height) {
   const extractHeight = Math.max(1, bottom - top);
   return { left, top, width: extractWidth, height: extractHeight };
 }
-function encode(pipeline, format, quality) {
+function encode(pipeline2, format, quality) {
   const options = quality !== void 0 ? { quality } : void 0;
   switch (format) {
     case "webp":
-      return pipeline.webp(options);
+      return pipeline2.webp(options);
     case "jpeg":
-      return pipeline.jpeg(options);
+      return pipeline2.jpeg(options);
     case "png":
-      return pipeline.png(options);
+      return pipeline2.png(options);
   }
 }
-function encodeSourceFormat(pipeline, sourceExt, quality) {
+function encodeSourceFormat(pipeline2, sourceExt, quality) {
   const options = quality !== void 0 ? { quality } : void 0;
   switch (sourceExt) {
     case "gif":
-      return pipeline.gif();
+      return pipeline2.gif();
     case "webp":
-      return pipeline.webp(options);
+      return pipeline2.webp(options);
     case "jpg":
     case "jpeg":
-      return pipeline.jpeg(options);
+      return pipeline2.jpeg(options);
     case "png":
     default:
-      return pipeline.png(options);
+      return pipeline2.png(options);
   }
 }
 async function applyTransform(input, directives) {
@@ -14278,22 +15067,22 @@ async function applyTransform(input, directives) {
     const probeMeta = await sharp(input.data, { limitInputPixels: MAX_INPUT_PIXELS2 }).metadata();
     const totalPages = probeMeta.pages ?? 1;
     const pagesToRead = Math.min(totalPages, MAX_ANIMATED_FRAMES);
-    let pipeline = sharp(input.data, {
+    let pipeline2 = sharp(input.data, {
       pages: pagesToRead,
       limitInputPixels: MAX_INPUT_PIXELS2
     }).rotate();
     if (resize?.crop) {
-      const oriented = orientedDimensions(await pipeline.metadata());
+      const oriented = orientedDimensions(await pipeline2.metadata());
       if (!oriented) {
         return { ok: false, status: 422, error: "Could not read image dimensions for crop" };
       }
-      pipeline = pipeline.extract(computeExtractRegion(resize.crop, oriented.width, oriented.height));
+      pipeline2 = pipeline2.extract(computeExtractRegion(resize.crop, oriented.width, oriented.height));
     }
     if (resize?.width) {
-      pipeline = pipeline.resize({ width: resize.width, withoutEnlargement: true });
+      pipeline2 = pipeline2.resize({ width: resize.width, withoutEnlargement: true });
     }
-    pipeline = format ? encode(pipeline, format, quality) : encodeSourceFormat(pipeline, sourceExt, quality);
-    const data = await pipeline.toBuffer();
+    pipeline2 = format ? encode(pipeline2, format, quality) : encodeSourceFormat(pipeline2, sourceExt, quality);
+    const data = await pipeline2.toBuffer();
     if (!directives.identity && data.byteLength > MAX_OUTPUT_BYTES) {
       return {
         ok: false,
@@ -16239,13 +17028,110 @@ var init_client_safe_strategy2 = __esm({
   }
 });
 
+// dist/paths/branch-name.js
+function sanitizeBranchName3(branchName) {
+  const replaced = branchName.replace(/[^a-zA-Z0-9._-]/g, "-");
+  const squashed = replaced.replace(/-+/g, "-");
+  const trimmedDots = squashed.replace(/^\.+/, "").replace(/(?<!\.)\.+$/, "");
+  return trimmedDots || "branch";
+}
+var RESERVED_SETTINGS_BRANCH_PREFIX3;
+var init_branch_name2 = __esm({
+  "dist/paths/branch-name.js"() {
+    "use strict";
+    RESERVED_SETTINGS_BRANCH_PREFIX3 = "canopycms-settings-";
+  }
+});
+
+// dist/paths/validation.js
+function isValidContentId2(id) {
+  return CONTENT_ID_PATTERN3.test(id);
+}
+function parseBranchRef3(name) {
+  if (!name || typeof name !== "string") {
+    return { ok: false, error: "Branch name is required" };
+  }
+  if (name.length > MAX_BRANCH_NAME_LENGTH3) {
+    return { ok: false, error: `Branch name too long (max ${MAX_BRANCH_NAME_LENGTH3} characters)` };
+  }
+  if (name.includes("..")) {
+    return { ok: false, error: 'Branch name cannot contain ".."' };
+  }
+  if (name.startsWith("/") || name.endsWith("/") || name.includes("//")) {
+    return { ok: false, error: "Invalid branch name format (invalid slashes)" };
+  }
+  if (name.includes(" ")) {
+    return { ok: false, error: "Branch name cannot contain spaces" };
+  }
+  if (name.startsWith("-")) {
+    return { ok: false, error: 'Branch name cannot start with "-"' };
+  }
+  if (name.startsWith(".") || name.endsWith(".")) {
+    return { ok: false, error: "Branch name cannot start or end with a dot" };
+  }
+  if (name.includes("@{")) {
+    return { ok: false, error: 'Branch name cannot contain "@{"' };
+  }
+  if (name === "HEAD" || name === "@") {
+    return { ok: false, error: 'Branch name cannot be the reserved ref "HEAD" or "@"' };
+  }
+  if (/[~^:?*[\\\x00-\x1f\x7f]/.test(name)) {
+    return { ok: false, error: "Branch name contains invalid characters" };
+  }
+  if (name.endsWith(".lock")) {
+    return { ok: false, error: 'Branch name cannot end with ".lock"' };
+  }
+  return { ok: true, name };
+}
+function parseSlug2(slug) {
+  if (!slug) {
+    return {
+      ok: false,
+      error: "Slug is required"
+    };
+  }
+  if (slug.length > 64) {
+    return { ok: false, error: "Slug too long (max 64 characters)" };
+  }
+  if (slug.includes("/") || slug.includes("\\")) {
+    return {
+      ok: false,
+      error: "Slug cannot contain path separators"
+    };
+  }
+  if (slug === "." || slug === "..") {
+    return {
+      ok: false,
+      error: "Slug cannot be a traversal sequence"
+    };
+  }
+  const normalized = slug.toLowerCase();
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
+    return {
+      ok: false,
+      error: "Slug must start with a letter or number and contain only lowercase letters, numbers, and hyphens"
+    };
+  }
+  return { ok: true, slug: normalized };
+}
+var BASE58_PATTERN3, CONTENT_ID_PATTERN3, PHYSICAL_SEGMENT_PATTERN3, MAX_BRANCH_NAME_LENGTH3;
+var init_validation3 = __esm({
+  "dist/paths/validation.js"() {
+    "use strict";
+    BASE58_PATTERN3 = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
+    CONTENT_ID_PATTERN3 = new RegExp(`^${BASE58_PATTERN3}{12}$`);
+    PHYSICAL_SEGMENT_PATTERN3 = new RegExp(`\\.${BASE58_PATTERN3}{12}(?:\\.[a-z]+)?$`);
+    MAX_BRANCH_NAME_LENGTH3 = 250;
+  }
+});
+
 // dist/operating-mode/deployment-name.js
 function resolveDeploymentName3(config, modeDefault) {
   const envValue = process.env.CANOPYCMS_DEPLOYMENT_NAME?.trim();
   const configValue = config.deploymentName;
-  if (envValue && configValue && envValue !== configValue && !warned5) {
+  if (envValue && configValue && envValue !== configValue && !warned6) {
     canopyLogWarn3(`CanopyCMS: CANOPYCMS_DEPLOYMENT_NAME ("${envValue}") differs from config.deploymentName ("${configValue}") \u2014 using the env var (infra-stamped env wins over shared-repo config by design; see resolveDeploymentName's doc comment). Update config.deploymentName to match if this mismatch was unintentional.`);
-    warned5 = true;
+    warned6 = true;
   }
   const resolved = envValue || configValue || modeDefault;
   if (!isValidDeploymentName3(resolved)) {
@@ -16254,17 +17140,91 @@ function resolveDeploymentName3(config, modeDefault) {
   }
   return resolved;
 }
-var warned5, VALID_DEPLOYMENT_NAME3, isValidDeploymentName3;
+var warned6, VALID_DEPLOYMENT_NAME3, isValidDeploymentName3;
 var init_deployment_name2 = __esm({
   "dist/operating-mode/deployment-name.js"() {
     "use strict";
     init_logger3();
-    warned5 = false;
+    warned6 = false;
     VALID_DEPLOYMENT_NAME3 = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
     isValidDeploymentName3 = (name) => VALID_DEPLOYMENT_NAME3.test(name) && !name.includes("..") && !name.endsWith(".") && !name.endsWith(".lock");
   }
 });
 
+// dist/operating-mode/branch-namespace.js
+function warnOnce3(message) {
+  if (warned7)
+    return;
+  warned7 = true;
+  canopyLogWarn3(message);
+}
+function branchNamespaceProblem3(namespace) {
+  if (!namespace.endsWith("/"))
+    return 'it must end with "/"';
+  const sample = `${namespace}x`;
+  if (!/^[\x21-\x7e]+$/.test(namespace))
+    return "it is not printable ASCII without spaces";
+  if (/["%{}]/.test(namespace))
+    return 'it contains ", %, { or }';
+  if (/^(?:refs|heads|tags|remotes)\//i.test(namespace)) {
+    return "it starts with 'refs/', 'heads/', 'tags/' or 'remotes/'";
+  }
+  const parsed = parseBranchRef3(sample);
+  if (!parsed.ok)
+    return `a branch in it would be refused (${parsed.error})`;
+  if (sample.split("/").some((part) => part.startsWith(".") || part.endsWith(".lock"))) {
+    return "a part of it starts with '.' or ends with '.lock'";
+  }
+  const directoryPrefix = sanitizeBranchName3(namespace);
+  if (RESERVED_SETTINGS_BRANCH_PREFIX3.startsWith(directoryPrefix) || sanitizeBranchName3(sample).startsWith(RESERVED_SETTINGS_BRANCH_PREFIX3)) {
+    return `some branches in it would be ${RESERVED_SETTINGS_BRANCH_PREFIX3}* settings branches`;
+  }
+  return null;
+}
+function resolveBranchNamespaceTemplate3(template, deploymentName, source) {
+  const unknown = template.replaceAll(DEPLOYMENT_PLACEHOLDER3, "").match(/\{[^}]*\}?/);
+  if (unknown) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(template)} (from ${source}): ${JSON.stringify(unknown[0])} is not a placeholder; the only one is ${DEPLOYMENT_PLACEHOLDER3}`);
+  }
+  const namespace = template.replaceAll(DEPLOYMENT_PLACEHOLDER3, deploymentName);
+  const problem = branchNamespaceProblem3(namespace);
+  if (problem !== null) {
+    throw new Error(`CanopyCMS: invalid branch namespace ${JSON.stringify(namespace)} (from ${source}): ${problem}`);
+  }
+  return namespace;
+}
+function resolveBranchNamespace3(config, modeDefault, env = process.env) {
+  const fromEnv = env[BRANCH_NAMESPACE_ENV3]?.trim();
+  const [template, source] = fromEnv ? [fromEnv, BRANCH_NAMESPACE_ENV3] : config.branchNamespace !== void 0 ? [config.branchNamespace, "config.branchNamespace"] : [DEFAULT_BRANCH_NAMESPACE_TEMPLATE3, "the default"];
+  const deploymentName = resolveDeploymentName3({ deploymentName: config.deploymentName }, modeDefault);
+  const namespace = resolveBranchNamespaceTemplate3(template, deploymentName, source);
+  if (fromEnv && config.branchNamespace !== void 0) {
+    let fromConfig = null;
+    try {
+      fromConfig = resolveBranchNamespaceTemplate3(config.branchNamespace, deploymentName, "config.branchNamespace");
+    } catch {
+    }
+    if (fromConfig !== namespace) {
+      warnOnce3(`CanopyCMS: ${BRANCH_NAMESPACE_ENV3} (${JSON.stringify(fromEnv)}) and config.branchNamespace (${JSON.stringify(config.branchNamespace)}) do not resolve to the same valid namespace; using the environment variable, which infrastructure stamps per stack.`);
+    }
+  }
+  return namespace;
+}
+var warned7, DEPLOYMENT_PLACEHOLDER3, DEFAULT_BRANCH_NAMESPACE_TEMPLATE3, BRANCH_NAMESPACE_ENV3;
+var init_branch_namespace2 = __esm({
+  "dist/operating-mode/branch-namespace.js"() {
+    "use strict";
+    init_branch_name2();
+    init_validation3();
+    init_logger3();
+    init_deployment_name2();
+    warned7 = false;
+    DEPLOYMENT_PLACEHOLDER3 = "{deployment}";
+    DEFAULT_BRANCH_NAMESPACE_TEMPLATE3 = `canopycms/${DEPLOYMENT_PLACEHOLDER3}/`;
+    BRANCH_NAMESPACE_ENV3 = "CANOPYCMS_BRANCH_NAMESPACE";
+  }
+});
+
 // dist/config/schemas/config.js
 import { z as z14 } from "zod";
 var defaultBranchAccessSchema3, defaultPathAccessLevelSchema3, defaultPathAccessLevelsSchema3, defaultPathAccessSchema3, defaultBaseBranchSchema3, defaultRemoteNameSchema3, defaultRemoteUrlSchema3, gitBotAuthorNameSchema3, gitBotAuthorEmailSchema3, githubTokenEnvVarSchema3, operatingModeSchema3, deployedAsSchema3, contentRootSchema3, sourceRootSchema3, basePathSchema3, deploymentNameSchema3, devContentSyncSchema3, devConfigSchema3, editorConfigSchema3, seoFieldNameSchema3, seoSchema3, CanopyConfigSchema3, DEFAULT_PROD_WORKSPACE3;
@@ -16366,6 +17326,8 @@ var init_config4 = __esm({
       // (operating-mode/deployment-name.ts) implements — config would always "win" over
       // modeDefault, masking dev's real default of 'local'. Do not remove `.optional()`.
       deploymentName: deploymentNameSchema3.optional(),
+      // Checked where it is resolved (operating-mode/branch-namespace.ts), with the deployment name.
+      branchNamespace: z14.string().optional(),
       contentRoot: contentRootSchema3.default("content"),
       sourceRoot: sourceRootSchema3.optional(),
       basePath: basePathSchema3,
@@ -16419,6 +17381,7 @@ var init_client_unsafe_strategy2 = __esm({
   "dist/operating-mode/client-unsafe-strategy.js"() {
     "use strict";
     init_client_safe_strategy2();
+    init_branch_namespace2();
     init_deployment_name2();
     init_config5();
     ProdStrategy3 = class extends ProdClientSafeStrategy3 {
@@ -16459,6 +17422,9 @@ var init_client_unsafe_strategy2 = __esm({
           return config.settingsBranch;
         return `canopycms-settings-${resolveDeploymentName3(config, "prod")}`;
       }
+      getBranchNamespace(config) {
+        return resolveBranchNamespace3(config, "prod");
+      }
       getSettingsRoot(sourceRoot) {
         return path30.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
@@ -16508,6 +17474,9 @@ var init_client_unsafe_strategy2 = __esm({
           return config.settingsBranch;
         return `canopycms-settings-${resolveDeploymentName3(config, "local")}`;
       }
+      getBranchNamespace(config) {
+        return resolveBranchNamespace3(config, "local");
+      }
       getSettingsRoot(sourceRoot) {
         return path30.join(this.getWorkspaceRoot(sourceRoot), "settings");
       }
@@ -16951,51 +17920,6 @@ var init_content_index_registry = __esm({
   }
 });
 
-// dist/paths/validation.js
-function isValidContentId2(id) {
-  return CONTENT_ID_PATTERN2.test(id);
-}
-function parseSlug2(slug) {
-  if (!slug) {
-    return {
-      ok: false,
-      error: "Slug is required"
-    };
-  }
-  if (slug.length > 64) {
-    return { ok: false, error: "Slug too long (max 64 characters)" };
-  }
-  if (slug.includes("/") || slug.includes("\\")) {
-    return {
-      ok: false,
-      error: "Slug cannot contain path separators"
-    };
-  }
-  if (slug === "." || slug === "..") {
-    return {
-      ok: false,
-      error: "Slug cannot be a traversal sequence"
-    };
-  }
-  const normalized = slug.toLowerCase();
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(normalized)) {
-    return {
-      ok: false,
-      error: "Slug must start with a letter or number and contain only lowercase letters, numbers, and hyphens"
-    };
-  }
-  return { ok: true, slug: normalized };
-}
-var BASE58_PATTERN2, CONTENT_ID_PATTERN2, PHYSICAL_SEGMENT_PATTERN2;
-var init_validation2 = __esm({
-  "dist/paths/validation.js"() {
-    "use strict";
-    BASE58_PATTERN2 = "[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz]";
-    CONTENT_ID_PATTERN2 = new RegExp(`^${BASE58_PATTERN2}{12}$`);
-    PHYSICAL_SEGMENT_PATTERN2 = new RegExp(`\\.${BASE58_PATTERN2}{12}(?:\\.[a-z]+)?$`);
-  }
-});
-
 // dist/id.js
 import { generate as generate2 } from "short-uuid";
 function generateId2() {
@@ -17006,7 +17930,7 @@ var isValidId2;
 var init_id = __esm({
   "dist/id.js"() {
     "use strict";
-    init_validation2();
+    init_validation3();
     isValidId2 = isValidContentId2;
   }
 });
@@ -17191,10 +18115,12 @@ var init_meta_loader = __esm({
 });
 
 // dist/branch-schema-cache.js
-var SCHEMA_GENERATION_RESOURCE2;
+import { LRUCache as LRUCache2 } from "lru-cache";
+var SNAPSHOT_MEMO_MAX_BYTES2, SCHEMA_GENERATION_RESOURCE2;
 var init_branch_schema_cache = __esm({
   "dist/branch-schema-cache.js"() {
     "use strict";
+    SNAPSHOT_MEMO_MAX_BYTES2 = 64 * 1024 * 1024;
     SCHEMA_GENERATION_RESOURCE2 = "schema";
   }
 });
@@ -17939,7 +18865,7 @@ var init_sync = __esm({
 var init_paths = __esm({
   "dist/paths/index.js"() {
     "use strict";
-    init_validation2();
+    init_validation3();
   }
 });
 
@@ -18282,7 +19208,13 @@ var init_branch_metadata_file = __esm({
       historyRewrittenFrom: z18.string().optional(),
       syncFailureReason: z18.string().optional(),
       editors: z18.array(z18.string()).optional(),
-      uncommittedEditors: z18.array(z18.string()).optional()
+      uncommittedEditors: z18.array(z18.string()).optional(),
+      // Dropped when malformed: it only decorates the PR body, so it never fails a read.
+      review: z18.object({
+        state: z18.enum(["approved", "changes-requested"]),
+        by: z18.object({ userId: z18.string(), name: z18.string().optional() }),
+        at: z18.string()
+      }).optional().catch(void 0)
     };
     branchMetadataSchema2 = z18.object(branchMetadataShape2).passthrough();
     branchMetadataFileSchema2 = z18.object({
@@ -18393,14 +19325,23 @@ var init_branch_registry = __esm({
        * genuinely-absent branch costs at most one extra scan per window.
        */
       async get(name) {
-        const branches = await this.list();
-        const found = branches.find((b) => b.branch.name === name);
+        return this.find((b) => b.branch.name === name);
+      }
+      /**
+       * Returns the branch whose workspace directory is `key` (`sanitizeBranchName` of its ref),
+       * whatever its name, with {@link get}'s backstop.
+       */
+      async getByKey(key) {
+        return this.find((b) => path45.basename(b.branchRoot) === key);
+      }
+      async find(matches) {
+        const found = (await this.list()).find(matches);
         if (found)
           return found;
         if (!this.shouldForceRefresh())
           return void 0;
         const refreshed = await this.regenerate();
-        return refreshed.find((b) => b.branch.name === name);
+        return refreshed.find(matches);
       }
       shouldForceRefresh() {
         const now = Date.now();