From 55409924e081946bdf4bddb638ed4fc3fd267cb1 Mon Sep 17 00:00:00 2001 From: Navneet Agarwal Date: Tue, 14 Apr 2026 16:45:52 +0530 Subject: [PATCH 01/21] feat: add --local-forms flag to serve forms from local JSON without publishing Adds --local-forms and --local-forms-mount flags to `aem up` so forms can be rendered locally from JSON files without requiring a publish step. The server constructs the standard AEM form page HTML and lets client-side scripts handle rendering. Co-Authored-By: Claude Opus 4.6 (1M context) --- package.json | 2 +- src/server/HelixProject.js | 38 ++++++++++++++++++ src/server/HelixServer.js | 80 ++++++++++++++++++++++++++++++++++++++ src/server/utils.js | 40 +++++++++++++++++++ src/up.cmd.js | 14 ++++++- src/up.js | 12 ++++++ 6 files changed, 184 insertions(+), 2 deletions(-) diff --git a/package.json b/package.json index 1e1dd4ede..c9b39db9d 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@adobe/aem-cli", - "version": "16.17.1", + "version": "16.17.0-forms-local.1", "description": "AEM CLI", "main": "index.js", "type": "module", diff --git a/src/server/HelixProject.js b/src/server/HelixProject.js index 58f97ae25..f6943e164 100644 --- a/src/server/HelixProject.js +++ b/src/server/HelixProject.js @@ -96,6 +96,25 @@ export class HelixProject extends BaseProject { return this; } + withLocalForms(value) { + if (value) { + if (path.isAbsolute(value) || value.includes('..') || value.startsWith('/')) { + throw new Error(`Invalid local forms folder: ${value} only folders within the current workspace are allowed`); + } + this._localForms = value; + } + return this; + } + + withLocalFormsMount(value) { + this._localFormsMount = value; + return this; + } + + get localForms() { + return this._localForms; + } + get proxyUrl() { return this._proxyUrl; } @@ -146,6 +165,10 @@ export class HelixProject extends BaseProject { const mount = this._htmlMount || `/${this._htmlFolder}`; this._server.withHtmlFolder(this._htmlFolder, mount); } + if (this._localForms) { + const formsMount = this._localFormsMount || '/content/forms/af/'; + this._server.withLocalForms(this._localForms, formsMount); + } await super.init(); this._indexer = new Indexer() .withLogger(this._logger) @@ -218,6 +241,20 @@ export class HelixProject extends BaseProject { } } + async initLocalForms() { + if (this._localForms && this.liveReload) { + const localFormsPath = resolve(this.directory, this._localForms); + try { + await lstat(localFormsPath); + this.log.debug(`Registered local forms folder for live-reload: ${this._localForms}`); + this.liveReload.registerFiles([`${localFormsPath}/**/*.json`], '/content/forms/af/'); + } catch (e) { + this.log.error(`Local forms folder '${this._localForms}' does not exist`); + throw new Error(`Local forms folder '${this._localForms}' does not exist`); + } + } + } + async initHlxIgnore() { if (this._hlxIgnore && this.liveReload) { const hlxIgnorePath = resolve(this.directory, '.hlxignore'); @@ -251,6 +288,7 @@ export class HelixProject extends BaseProject { await this.initHeadHtml(); await this.init404Html(); await this.initHtmlFolder(); + await this.initLocalForms(); await this.initHlxIgnore(); if (this._indexer) { await this._indexer.init(); diff --git a/src/server/HelixServer.js b/src/server/HelixServer.js index a7a5f2ca7..ad00bc700 100644 --- a/src/server/HelixServer.js +++ b/src/server/HelixServer.js @@ -74,6 +74,12 @@ export class HelixServer extends BaseServer { return this._mountPrefix; } + withLocalForms(folder, mount) { + this._localForms = folder; + this._localFormsMount = mount.endsWith('/') ? mount : `${mount}/`; + return this; + } + async handleLogin(req, res) { const userAgent = req.headers['user-agent']?.toLowerCase(); if (userAgent?.includes('safari') && !userAgent?.includes('chrome')) { @@ -325,6 +331,73 @@ export class HelixServer extends BaseServer { return undefined; } + /** + * Local Forms handler - serves form pages from local JSON files + * @param {Express.Request} req request + * @param {Express.Response} res response + * @param {Function} next next middleware + */ + async handleLocalFormsRequest(req, res, next) { + const pathname = req.path; + const formsPrefix = this._localFormsMount; + + if (!pathname.startsWith(formsPrefix)) { + return next(); + } + + const relativePath = pathname.slice(formsPrefix.length); + + // Security: prevent path traversal + if (relativePath.includes('/../') || relativePath.includes('..')) { + return next(); + } + + const jsonFile = path.resolve( + this._project.directory, + this._localForms, + `${relativePath}.json`, + ); + + if (!utils.validatePathSecurity(jsonFile, this._project.directory)) { + return next(); + } + + let formJson; + try { + formJson = await readFile(jsonFile, 'utf-8'); + } catch (e) { + return next(); + } + + const { log } = this; + const liveReload = this._liveReload; + + if (liveReload) { + liveReload.startRequest(req.id, req.url); + } + + // Construct the form page HTML + let htmlContent = utils.generateFormPageHtml(formJson, relativePath); + + if (liveReload) { + htmlContent = utils.injectLiveReloadScript(htmlContent, this); + } + + res.set({ + 'content-type': 'text/html; charset=utf-8', + 'access-control-allow-origin': '*', + }); + res.send(htmlContent); + + if (liveReload) { + liveReload.registerFile(req.id, jsonFile); + liveReload.endRequest(req.id); + } + + log.debug(`served local form from ${jsonFile} for ${req.url}`); + return undefined; + } + /** * Proxy Mode route handler * @param {Express.Request} req request @@ -448,6 +521,13 @@ export class HelixServer extends BaseServer { this.app.post(LOGIN_ACK_ROUTE, express.json(), asyncHandler(this.handleLoginAck.bind(this))); this.app.options(LOGIN_ACK_ROUTE, asyncHandler(this.handleLoginAck.bind(this))); + // Add local forms handler before the general proxy handler + if (this._localForms) { + const escapedMount = this._localFormsMount.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); + this.app.get(new RegExp(`^${escapedMount}.*`), asyncHandler(this.handleLocalFormsRequest.bind(this))); + this.log.info(`Serving local forms from folder: ${this._localForms} at ${this._localFormsMount}`); + } + // Add HTML folder handler before the general proxy handler if (this._htmlFolder) { const mountPattern = new RegExp(`^${this._mountPrefix}.*`); diff --git a/src/server/utils.js b/src/server/utils.js index 643d1fff2..c0dd405b1 100644 --- a/src/server/utils.js +++ b/src/server/utils.js @@ -786,6 +786,46 @@ window.LiveReloadOptions = { const fullHead = headHtml + metaTags; return `${fullHead}
${content}
`; }, + + /** + * Generates a complete form page HTML from a form JSON string. + * This produces the same HTML structure that AEM would serve for a published form. + * @param {string} formJson the form JSON content + * @param {string} formName the form name (used for title) + * @returns {string} complete HTML document + */ + generateFormPageHtml(formJson, formName) { + const title = formName.split('/').pop() || 'form'; + // formJson is the raw file content (a JSON object as string). + // The form block expects a JSON-stringified string inside 
,
+    // e.g. "{\"id\":...}" — so we stringify once to wrap in quotes and escape.
+    const encodedJson = JSON.stringify(formJson.trim());
+    return `
+
+  
+    ${utils.escapeHtml(title)}
+    
+    
+    
+    
+  
+  
+    

+    

+      

+        

+          

+            

+              
${encodedJson}

+            

+          

+        

+      

+    

+    

+  
+`;
+  },
 };
 
 export default Object.freeze(utils);
diff --git a/src/up.cmd.js b/src/up.cmd.js
index 26b3c81fd..7dec6b7d3 100644
--- a/src/up.cmd.js
+++ b/src/up.cmd.js
@@ -65,6 +65,16 @@ export default class UpCommand extends AbstractServerCommand {
     return this;
   }
 
+  withLocalForms(value) {
+    this._localForms = value;
+    return this;
+  }
+
+  withLocalFormsMount(value) {
+    this._localFormsMount = value;
+    return this;
+  }
+
   async doStop() {
     await super.doStop();
     if (this._watcher) {
@@ -118,7 +128,9 @@ export default class UpCommand extends AbstractServerCommand {
       .withSiteToken(this._siteToken)
       .withCookies(this._cookies)
       .withHtmlFolder(this._htmlFolder)
-      .withHtmlMount(this._htmlMount);
+      .withHtmlMount(this._htmlMount)
+      .withLocalForms(this._localForms)
+      .withLocalFormsMount(this._localFormsMount);
 
     this.log.info(chalk`{yellow     ___    ________  ___                          __      __ v${pkgJson.version}}`);
     this.log.info(chalk`{yellow    /   |  / ____/  |/  /  _____(_)___ ___  __  __/ /___ _/ /_____  _____}`);
diff --git a/src/up.js b/src/up.js
index 558c960e1..7e015a5eb 100644
--- a/src/up.js
+++ b/src/up.js
@@ -125,6 +125,16 @@ export default function up() {
           describe: 'URL path where html-folder files are served (e.g., / for root). Defaults to /FOLDER.',
           type: 'string',
         })
+        .option('local-forms', {
+          alias: 'localForms',
+          describe: 'Serve forms from local JSON files in this folder, without requiring publish.',
+          type: 'string',
+        })
+        .option('local-forms-mount', {
+          alias: 'localFormsMount',
+          describe: 'URL path where local forms are served. Defaults to /content/forms/af/.',
+          type: 'string',
+        })
 
         .help();
     },
@@ -153,6 +163,8 @@ export default function up() {
         .withCookies(argv.cookies)
         .withHtmlFolder(argv.htmlFolder)
         .withHtmlMount(argv.htmlMount)
+        .withLocalForms(argv.localForms)
+        .withLocalFormsMount(argv.localFormsMount)
         .run();
     },
   };

From 3dd7418ac1d7bf0f6960bcd4c84062955fd65015 Mon Sep 17 00:00:00 2001
From: Navneet Agarwal 
Date: Wed, 22 Apr 2026 10:09:47 +0530
Subject: [PATCH 02/21] refactor: replace --local-forms with --html-folder JSON
 support

Remove the --local-forms and --local-forms-mount flags and extend the
existing --html-folder mechanism to resolve .json files on-the-fly,
rendering them as AEM form block HTML via generateFormPageHtml().

Resolution priority: .html > .plain.html > .json

Users migrate from:
  aem up --local-forms forms
to:
  aem up --html-folder forms --html-mount /content/forms/af/

Co-Authored-By: Claude Sonnet 4.6 
---
 src/server/HelixProject.js      |  43 +--------
 src/server/HelixServer.js       | 107 ++++++----------------
 src/up.cmd.js                   |  14 +--
 src/up.js                       |  13 ---
 test/server-html-folder.test.js | 152 ++++++++++++++++++++++++++++++++
 5 files changed, 182 insertions(+), 147 deletions(-)

diff --git a/src/server/HelixProject.js b/src/server/HelixProject.js
index f6943e164..03af7aac4 100644
--- a/src/server/HelixProject.js
+++ b/src/server/HelixProject.js
@@ -96,25 +96,6 @@ export class HelixProject extends BaseProject {
     return this;
   }
 
-  withLocalForms(value) {
-    if (value) {
-      if (path.isAbsolute(value) || value.includes('..') || value.startsWith('/')) {
-        throw new Error(`Invalid local forms folder: ${value} only folders within the current workspace are allowed`);
-      }
-      this._localForms = value;
-    }
-    return this;
-  }
-
-  withLocalFormsMount(value) {
-    this._localFormsMount = value;
-    return this;
-  }
-
-  get localForms() {
-    return this._localForms;
-  }
-
   get proxyUrl() {
     return this._proxyUrl;
   }
@@ -165,10 +146,6 @@ export class HelixProject extends BaseProject {
       const mount = this._htmlMount || `/${this._htmlFolder}`;
       this._server.withHtmlFolder(this._htmlFolder, mount);
     }
-    if (this._localForms) {
-      const formsMount = this._localFormsMount || '/content/forms/af/';
-      this._server.withLocalForms(this._localForms, formsMount);
-    }
     await super.init();
     this._indexer = new Indexer()
       .withLogger(this._logger)
@@ -233,7 +210,10 @@ export class HelixProject extends BaseProject {
         await lstat(htmlFolderPath);
         this.log.debug(`Registered HTML folder for live-reload: ${this._htmlFolder}`);
         // Watch all HTML files in the folder - only .html extension
-        this.liveReload.registerFiles([`${htmlFolderPath}/**/*.html`], this._server.mountPrefix);
+        this.liveReload.registerFiles([
+          `${htmlFolderPath}/**/*.html`,
+          `${htmlFolderPath}/**/*.json`,
+        ], this._server.mountPrefix);
       } catch (e) {
         this.log.error(`HTML folder '${this._htmlFolder}' does not exist`);
         throw new Error(`HTML folder '${this._htmlFolder}' does not exist`);
@@ -241,20 +221,6 @@ export class HelixProject extends BaseProject {
     }
   }
 
-  async initLocalForms() {
-    if (this._localForms && this.liveReload) {
-      const localFormsPath = resolve(this.directory, this._localForms);
-      try {
-        await lstat(localFormsPath);
-        this.log.debug(`Registered local forms folder for live-reload: ${this._localForms}`);
-        this.liveReload.registerFiles([`${localFormsPath}/**/*.json`], '/content/forms/af/');
-      } catch (e) {
-        this.log.error(`Local forms folder '${this._localForms}' does not exist`);
-        throw new Error(`Local forms folder '${this._localForms}' does not exist`);
-      }
-    }
-  }
-
   async initHlxIgnore() {
     if (this._hlxIgnore && this.liveReload) {
       const hlxIgnorePath = resolve(this.directory, '.hlxignore');
@@ -288,7 +254,6 @@ export class HelixProject extends BaseProject {
     await this.initHeadHtml();
     await this.init404Html();
     await this.initHtmlFolder();
-    await this.initLocalForms();
     await this.initHlxIgnore();
     if (this._indexer) {
       await this._indexer.init();
diff --git a/src/server/HelixServer.js b/src/server/HelixServer.js
index ad00bc700..ea7937375 100644
--- a/src/server/HelixServer.js
+++ b/src/server/HelixServer.js
@@ -74,12 +74,6 @@ export class HelixServer extends BaseServer {
     return this._mountPrefix;
   }
 
-  withLocalForms(folder, mount) {
-    this._localForms = folder;
-    this._localFormsMount = mount.endsWith('/') ? mount : `${mount}/`;
-    return this;
-  }
-
   async handleLogin(req, res) {
     const userAgent = req.headers['user-agent']?.toLowerCase();
     if (userAgent?.includes('safari') && !userAgent?.includes('chrome')) {
@@ -238,6 +232,26 @@ export class HelixServer extends BaseServer {
       // Neither exists
     }
 
+    // Try .json (form definition files — rendered as form block HTML on-the-fly)
+    const jsonFile = path.resolve(
+      this._project.directory,
+      this._htmlFolder,
+      `${relativePath}.json`,
+    );
+
+    if (!utils.validatePathSecurity(jsonFile, this._project.directory)) {
+      return null;
+    }
+
+    try {
+      const stats = await lstat(jsonFile);
+      if (stats.isFile()) {
+        return { file: jsonFile, isJson: true };
+      }
+    } catch (e) {
+      // .json not found either
+    }
+
     return null;
   }
 
@@ -301,9 +315,12 @@ export class HelixServer extends BaseServer {
       liveReload.startRequest(req.id, req.url);
     }
 
-    // Load content (handle .plain.html transformation)
+    // Load content (handle .plain.html transformation and .json form rendering)
     let htmlContent;
-    if (resolvedFile.isPlain) {
+    if (resolvedFile.isJson) {
+      const formJson = await readFile(resolvedFile.file, 'utf-8');
+      htmlContent = utils.generateFormPageHtml(formJson, relativePath);
+    } else if (resolvedFile.isPlain) {
       htmlContent = await this.transformPlainHtml(resolvedFile.file);
     } else {
       htmlContent = await readFile(resolvedFile.file, 'utf-8');
@@ -331,73 +348,6 @@ export class HelixServer extends BaseServer {
     return undefined;
   }
 
-  /**
-   * Local Forms handler - serves form pages from local JSON files
-   * @param {Express.Request} req request
-   * @param {Express.Response} res response
-   * @param {Function} next next middleware
-   */
-  async handleLocalFormsRequest(req, res, next) {
-    const pathname = req.path;
-    const formsPrefix = this._localFormsMount;
-
-    if (!pathname.startsWith(formsPrefix)) {
-      return next();
-    }
-
-    const relativePath = pathname.slice(formsPrefix.length);
-
-    // Security: prevent path traversal
-    if (relativePath.includes('/../') || relativePath.includes('..')) {
-      return next();
-    }
-
-    const jsonFile = path.resolve(
-      this._project.directory,
-      this._localForms,
-      `${relativePath}.json`,
-    );
-
-    if (!utils.validatePathSecurity(jsonFile, this._project.directory)) {
-      return next();
-    }
-
-    let formJson;
-    try {
-      formJson = await readFile(jsonFile, 'utf-8');
-    } catch (e) {
-      return next();
-    }
-
-    const { log } = this;
-    const liveReload = this._liveReload;
-
-    if (liveReload) {
-      liveReload.startRequest(req.id, req.url);
-    }
-
-    // Construct the form page HTML
-    let htmlContent = utils.generateFormPageHtml(formJson, relativePath);
-
-    if (liveReload) {
-      htmlContent = utils.injectLiveReloadScript(htmlContent, this);
-    }
-
-    res.set({
-      'content-type': 'text/html; charset=utf-8',
-      'access-control-allow-origin': '*',
-    });
-    res.send(htmlContent);
-
-    if (liveReload) {
-      liveReload.registerFile(req.id, jsonFile);
-      liveReload.endRequest(req.id);
-    }
-
-    log.debug(`served local form from ${jsonFile} for ${req.url}`);
-    return undefined;
-  }
-
   /**
    * Proxy Mode route handler
    * @param {Express.Request} req request
@@ -521,13 +471,6 @@ export class HelixServer extends BaseServer {
     this.app.post(LOGIN_ACK_ROUTE, express.json(), asyncHandler(this.handleLoginAck.bind(this)));
     this.app.options(LOGIN_ACK_ROUTE, asyncHandler(this.handleLoginAck.bind(this)));
 
-    // Add local forms handler before the general proxy handler
-    if (this._localForms) {
-      const escapedMount = this._localFormsMount.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-      this.app.get(new RegExp(`^${escapedMount}.*`), asyncHandler(this.handleLocalFormsRequest.bind(this)));
-      this.log.info(`Serving local forms from folder: ${this._localForms} at ${this._localFormsMount}`);
-    }
-
     // Add HTML folder handler before the general proxy handler
     if (this._htmlFolder) {
       const mountPattern = new RegExp(`^${this._mountPrefix}.*`);
diff --git a/src/up.cmd.js b/src/up.cmd.js
index 7dec6b7d3..26b3c81fd 100644
--- a/src/up.cmd.js
+++ b/src/up.cmd.js
@@ -65,16 +65,6 @@ export default class UpCommand extends AbstractServerCommand {
     return this;
   }
 
-  withLocalForms(value) {
-    this._localForms = value;
-    return this;
-  }
-
-  withLocalFormsMount(value) {
-    this._localFormsMount = value;
-    return this;
-  }
-
   async doStop() {
     await super.doStop();
     if (this._watcher) {
@@ -128,9 +118,7 @@ export default class UpCommand extends AbstractServerCommand {
       .withSiteToken(this._siteToken)
       .withCookies(this._cookies)
       .withHtmlFolder(this._htmlFolder)
-      .withHtmlMount(this._htmlMount)
-      .withLocalForms(this._localForms)
-      .withLocalFormsMount(this._localFormsMount);
+      .withHtmlMount(this._htmlMount);
 
     this.log.info(chalk`{yellow     ___    ________  ___                          __      __ v${pkgJson.version}}`);
     this.log.info(chalk`{yellow    /   |  / ____/  |/  /  _____(_)___ ___  __  __/ /___ _/ /_____  _____}`);
diff --git a/src/up.js b/src/up.js
index 7e015a5eb..6828b1485 100644
--- a/src/up.js
+++ b/src/up.js
@@ -125,17 +125,6 @@ export default function up() {
           describe: 'URL path where html-folder files are served (e.g., / for root). Defaults to /FOLDER.',
           type: 'string',
         })
-        .option('local-forms', {
-          alias: 'localForms',
-          describe: 'Serve forms from local JSON files in this folder, without requiring publish.',
-          type: 'string',
-        })
-        .option('local-forms-mount', {
-          alias: 'localFormsMount',
-          describe: 'URL path where local forms are served. Defaults to /content/forms/af/.',
-          type: 'string',
-        })
-
         .help();
     },
     handler: async (argv) => {
@@ -163,8 +152,6 @@ export default function up() {
         .withCookies(argv.cookies)
         .withHtmlFolder(argv.htmlFolder)
         .withHtmlMount(argv.htmlMount)
-        .withLocalForms(argv.localForms)
-        .withLocalFormsMount(argv.localFormsMount)
         .run();
     },
   };
diff --git a/test/server-html-folder.test.js b/test/server-html-folder.test.js
index 1c602ff3b..bc4ccb526 100644
--- a/test/server-html-folder.test.js
+++ b/test/server-html-folder.test.js
@@ -1423,4 +1423,156 @@ describe('Helix Server - HTML Folder', () => {
       }
     });
   });
+
+  describe('JSON form rendering via --html-folder', () => {
+    it('serves form page from .json file in html-folder', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      const formsFolder = path.join(cwd, 'forms');
+      await fs.mkdir(formsFolder, { recursive: true });
+      const formJson = JSON.stringify({ id: 'my-form', items: [] });
+      await fs.writeFile(path.join(formsFolder, 'my-form.json'), formJson);
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withLogger(console)
+        .withHttpPort(0)
+        .withHtmlFolder('forms')
+        .withHtmlMount('/content/forms/af/');
+
+      await project.init();
+      try {
+        await project.start();
+
+        const response = await fetch(`http://127.0.0.1:${project.server.port}/content/forms/af/my-form`);
+        assert.equal(response.status, 200, 'Should return 200 for JSON-backed form');
+        assert.equal(response.headers.get('content-type'), 'text/html; charset=utf-8');
+
+        const body = await response.text();
+        assert.ok(body.includes('class="form"'), 'Response should contain form block markup');
+        assert.ok(body.includes('
'), 'Response should contain pre/code with JSON');
+        assert.ok(body.includes('/scripts/aem.js'), 'Response should include aem.js');
+        assert.ok(body.includes('/styles/styles.css'), 'Response should include styles.css');
+        // Verify the JSON content is embedded in the response
+        assert.ok(body.includes('my-form'), 'Response should contain the form id from the JSON');
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('injects live reload script into .json form response', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      const formsFolder = path.join(cwd, 'forms');
+      await fs.mkdir(formsFolder, { recursive: true });
+      await fs.writeFile(path.join(formsFolder, 'my-form.json'), JSON.stringify({ id: 'my-form' }));
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withLogger(console)
+        .withHttpPort(0)
+        .withHtmlFolder('forms')
+        .withHtmlMount('/content/forms/af/')
+        .withLiveReload(true);
+
+      await project.init();
+      try {
+        await project.start();
+
+        const response = await fetch(`http://127.0.0.1:${project.server.port}/content/forms/af/my-form`);
+        assert.equal(response.status, 200);
+
+        const body = await response.text();
+        assert.ok(body.includes('class="form"'), 'Response should contain form block markup');
+        assert.ok(body.includes('livereload'), 'Response should include live reload script');
+        assert.ok(body.includes('LiveReload'), 'Response should include LiveReload functionality');
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('.html takes precedence over .json', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      const formsFolder = path.join(cwd, 'forms');
+      await fs.mkdir(formsFolder, { recursive: true });
+      await fs.writeFile(path.join(formsFolder, 'my-page.html'), 'HTML wins');
+      await fs.writeFile(path.join(formsFolder, 'my-page.json'), JSON.stringify({ id: 'should-not-be-used' }));
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withLogger(console)
+        .withHttpPort(0)
+        .withHtmlFolder('forms');
+
+      await project.init();
+      try {
+        await project.start();
+
+        const response = await fetch(`http://127.0.0.1:${project.server.port}/forms/my-page`);
+        assert.equal(response.status, 200);
+        const body = await response.text();
+        assert.ok(body.includes('HTML wins'), '.html file should be served, not .json');
+        assert.ok(!body.includes('class="form"'), 'Should not render as form block');
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('.plain.html takes precedence over .json', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      const formsFolder = path.join(cwd, 'forms');
+      await fs.mkdir(formsFolder, { recursive: true });
+      await fs.writeFile(path.join(formsFolder, 'my-page.plain.html'), '
Plain HTML wins
');
+      await fs.writeFile(path.join(formsFolder, 'my-page.json'), JSON.stringify({ id: 'should-not-be-used' }));
+
+      nock('https://main--foo--bar.aem.page')
+        .get('/head.html')
+        .reply(404);
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withLogger(console)
+        .withHttpPort(0)
+        .withProxyUrl('https://main--foo--bar.aem.page/')
+        .withHtmlFolder('forms');
+
+      await project.init();
+      try {
+        await project.start();
+
+        const response = await fetch(`http://127.0.0.1:${project.server.port}/forms/my-page`);
+        assert.equal(response.status, 200);
+        const body = await response.text();
+        assert.ok(body.includes('Plain HTML wins'), '.plain.html should be served, not .json');
+        assert.ok(!body.includes('class="form"'), 'Should not render as form block');
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('serves .json from nested directory', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      const nestedFolder = path.join(cwd, 'forms', 'nested');
+      await fs.mkdir(nestedFolder, { recursive: true });
+      const formJson = JSON.stringify({ id: 'nested-form' });
+      await fs.writeFile(path.join(nestedFolder, 'sub-form.json'), formJson);
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withLogger(console)
+        .withHttpPort(0)
+        .withHtmlFolder('forms')
+        .withHtmlMount('/content/forms/af/');
+
+      await project.init();
+      try {
+        await project.start();
+
+        const response = await fetch(`http://127.0.0.1:${project.server.port}/content/forms/af/nested/sub-form`);
+        assert.equal(response.status, 200, 'Should serve nested JSON form');
+        const body = await response.text();
+        assert.ok(body.includes('class="form"'), 'Response should contain form block markup');
+      } finally {
+        await project.stop();
+      }
+    });
+  });
 });

From 4c75ad963a111821318bf4199b40a6bf7f9c3604 Mon Sep 17 00:00:00 2001
From: Navneet Agarwal 
Date: Wed, 22 Apr 2026 10:10:27 +0530
Subject: [PATCH 03/21] chore: revert version to 16.17.1

Co-Authored-By: Claude Sonnet 4.6 
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c9b39db9d..1e1dd4ede 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.17.0-forms-local.1",
+  "version": "16.17.1",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From 42c8ad99d484849d8f6ad2860758744ad583ae7a Mon Sep 17 00:00:00 2001
From: Navneet Agarwal 
Date: Thu, 23 Apr 2026 17:00:47 +0530
Subject: [PATCH 04/21] feat: serve static files from --html-folder

Extend the --html-folder handler to serve files with extensions
(e.g. .json) as-is from the folder. This enables the anchor tag
pattern for forms: an HTML page references a local JSON file via
, and the form block JS fetches it at runtime.

Removes the JSON-to-HTML transform (generateFormPageHtml) since
the server should not perform markup-specific rendering.

Co-Authored-By: Claude Opus 4.6 (1M context) 
---
 src/server/HelixServer.js       |  80 +++++++++++------
 src/server/utils.js             |  40 ---------
 test/server-html-folder.test.js | 153 +++++++++++++++-----------------
 3 files changed, 129 insertions(+), 144 deletions(-)

diff --git a/src/server/HelixServer.js b/src/server/HelixServer.js
index ea7937375..737779512 100644
--- a/src/server/HelixServer.js
+++ b/src/server/HelixServer.js
@@ -232,26 +232,6 @@ export class HelixServer extends BaseServer {
       // Neither exists
     }
 
-    // Try .json (form definition files — rendered as form block HTML on-the-fly)
-    const jsonFile = path.resolve(
-      this._project.directory,
-      this._htmlFolder,
-      `${relativePath}.json`,
-    );
-
-    if (!utils.validatePathSecurity(jsonFile, this._project.directory)) {
-      return null;
-    }
-
-    try {
-      const stats = await lstat(jsonFile);
-      if (stats.isFile()) {
-        return { file: jsonFile, isJson: true };
-      }
-    } catch (e) {
-      // .json not found either
-    }
-
     return null;
   }
 
@@ -304,6 +284,10 @@ export class HelixServer extends BaseServer {
     // Resolve which file to serve (.html or .plain.html)
     const resolvedFile = await this.resolveHtmlFolderFile(relativePath);
     if (!resolvedFile) {
+      // Serve static assets (e.g. .json) from the html-folder as-is
+      if (relativePath.includes('.')) {
+        return this.serveHtmlFolderStaticFile(req, res, next, relativePath);
+      }
       return next();
     }
 
@@ -315,12 +299,9 @@ export class HelixServer extends BaseServer {
       liveReload.startRequest(req.id, req.url);
     }
 
-    // Load content (handle .plain.html transformation and .json form rendering)
+    // Load content (handle .plain.html transformation)
     let htmlContent;
-    if (resolvedFile.isJson) {
-      const formJson = await readFile(resolvedFile.file, 'utf-8');
-      htmlContent = utils.generateFormPageHtml(formJson, relativePath);
-    } else if (resolvedFile.isPlain) {
+    if (resolvedFile.isPlain) {
       htmlContent = await this.transformPlainHtml(resolvedFile.file);
     } else {
       htmlContent = await readFile(resolvedFile.file, 'utf-8');
@@ -348,6 +329,55 @@ export class HelixServer extends BaseServer {
     return undefined;
   }
 
+  /**
+   * Serves static files from the HTML folder as-is
+   * @param {Express.Request} req request
+   * @param {Express.Response} res response
+   * @param {Function} next next middleware
+   * @param {string} relativePath path relative to HTML folder
+   */
+  async serveHtmlFolderStaticFile(req, res, next, relativePath) {
+    if (relativePath.includes('/../') || relativePath.includes('..')) {
+      return next();
+    }
+
+    const filePath = path.resolve(
+      this._project.directory,
+      this._htmlFolder,
+      relativePath,
+    );
+
+    if (!utils.validatePathSecurity(
+      filePath,
+      this._project.directory,
+    )) {
+      return next();
+    }
+
+    try {
+      const stats = await lstat(filePath);
+      if (!stats.isFile()) {
+        return next();
+      }
+    } catch (e) {
+      return next();
+    }
+
+    const sendFile = promisify(res.sendFile).bind(res);
+    try {
+      await sendFile(filePath, {
+        dotfiles: 'allow',
+        headers: { 'access-control-allow-origin': '*' },
+      });
+      this.log.debug(
+        `served static file ${filePath} for ${req.url}`,
+      );
+    } catch (e) {
+      return next();
+    }
+    return undefined;
+  }
+
   /**
    * Proxy Mode route handler
    * @param {Express.Request} req request
diff --git a/src/server/utils.js b/src/server/utils.js
index c0dd405b1..643d1fff2 100644
--- a/src/server/utils.js
+++ b/src/server/utils.js
@@ -786,46 +786,6 @@ window.LiveReloadOptions = {
     const fullHead = headHtml + metaTags;
     return `${fullHead}
${content}
`;
   },
-
-  /**
-   * Generates a complete form page HTML from a form JSON string.
-   * This produces the same HTML structure that AEM would serve for a published form.
-   * @param {string} formJson the form JSON content
-   * @param {string} formName the form name (used for title)
-   * @returns {string} complete HTML document
-   */
-  generateFormPageHtml(formJson, formName) {
-    const title = formName.split('/').pop() || 'form';
-    // formJson is the raw file content (a JSON object as string).
-    // The form block expects a JSON-stringified string inside 
,
-    // e.g. "{\"id\":...}" — so we stringify once to wrap in quotes and escape.
-    const encodedJson = JSON.stringify(formJson.trim());
-    return `
-
-  
-    ${utils.escapeHtml(title)}
-    
-    
-    
-    
-  
-  
-    

-    

-      

-        

-          

-            

-              
${encodedJson}

-            

-          

-        

-      

-    

-    

-  
-`;
-  },
 };
 
 export default Object.freeze(utils);
diff --git a/test/server-html-folder.test.js b/test/server-html-folder.test.js
index bc4ccb526..cab59c8d6 100644
--- a/test/server-html-folder.test.js
+++ b/test/server-html-folder.test.js
@@ -1424,77 +1424,57 @@ describe('Helix Server - HTML Folder', () => {
     });
   });
 
-  describe('JSON form rendering via --html-folder', () => {
-    it('serves form page from .json file in html-folder', async () => {
-      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+  describe('Static file serving via --html-folder', () => {
+    it('serves .json files as-is from html-folder', async () => {
+      const cwd = await setupProject(
+        path.join(__rootdir, 'test', 'fixtures', 'project'),
+        testRoot,
+      );
       const formsFolder = path.join(cwd, 'forms');
       await fs.mkdir(formsFolder, { recursive: true });
       const formJson = JSON.stringify({ id: 'my-form', items: [] });
-      await fs.writeFile(path.join(formsFolder, 'my-form.json'), formJson);
-
-      const project = new HelixProject()
-        .withCwd(cwd)
-        .withLogger(console)
-        .withHttpPort(0)
-        .withHtmlFolder('forms')
-        .withHtmlMount('/content/forms/af/');
-
-      await project.init();
-      try {
-        await project.start();
-
-        const response = await fetch(`http://127.0.0.1:${project.server.port}/content/forms/af/my-form`);
-        assert.equal(response.status, 200, 'Should return 200 for JSON-backed form');
-        assert.equal(response.headers.get('content-type'), 'text/html; charset=utf-8');
-
-        const body = await response.text();
-        assert.ok(body.includes('class="form"'), 'Response should contain form block markup');
-        assert.ok(body.includes('
'), 'Response should contain pre/code with JSON');
-        assert.ok(body.includes('/scripts/aem.js'), 'Response should include aem.js');
-        assert.ok(body.includes('/styles/styles.css'), 'Response should include styles.css');
-        // Verify the JSON content is embedded in the response
-        assert.ok(body.includes('my-form'), 'Response should contain the form id from the JSON');
-      } finally {
-        await project.stop();
-      }
-    });
-
-    it('injects live reload script into .json form response', async () => {
-      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
-      const formsFolder = path.join(cwd, 'forms');
-      await fs.mkdir(formsFolder, { recursive: true });
-      await fs.writeFile(path.join(formsFolder, 'my-form.json'), JSON.stringify({ id: 'my-form' }));
+      await fs.writeFile(
+        path.join(formsFolder, 'my-form.json'),
+        formJson,
+      );
 
       const project = new HelixProject()
         .withCwd(cwd)
         .withLogger(console)
         .withHttpPort(0)
-        .withHtmlFolder('forms')
-        .withHtmlMount('/content/forms/af/')
-        .withLiveReload(true);
+        .withHtmlFolder('forms');
 
       await project.init();
       try {
         await project.start();
 
-        const response = await fetch(`http://127.0.0.1:${project.server.port}/content/forms/af/my-form`);
+        const response = await fetch(
+          `http://127.0.0.1:${project.server.port}/forms/my-form.json`,
+        );
         assert.equal(response.status, 200);
+        assert.ok(
+          response.headers.get('content-type').includes('application/json'),
+          'Should serve with JSON content-type',
+        );
 
-        const body = await response.text();
-        assert.ok(body.includes('class="form"'), 'Response should contain form block markup');
-        assert.ok(body.includes('livereload'), 'Response should include live reload script');
-        assert.ok(body.includes('LiveReload'), 'Response should include LiveReload functionality');
+        const body = await response.json();
+        assert.equal(body.id, 'my-form');
       } finally {
         await project.stop();
       }
     });
 
-    it('.html takes precedence over .json', async () => {
-      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
-      const formsFolder = path.join(cwd, 'forms');
-      await fs.mkdir(formsFolder, { recursive: true });
-      await fs.writeFile(path.join(formsFolder, 'my-page.html'), 'HTML wins');
-      await fs.writeFile(path.join(formsFolder, 'my-page.json'), JSON.stringify({ id: 'should-not-be-used' }));
+    it('serves static files from nested directories', async () => {
+      const cwd = await setupProject(
+        path.join(__rootdir, 'test', 'fixtures', 'project'),
+        testRoot,
+      );
+      const nested = path.join(cwd, 'forms', 'nested');
+      await fs.mkdir(nested, { recursive: true });
+      await fs.writeFile(
+        path.join(nested, 'data.json'),
+        JSON.stringify({ id: 'nested' }),
+      );
 
       const project = new HelixProject()
         .withCwd(cwd)
@@ -1506,54 +1486,67 @@ describe('Helix Server - HTML Folder', () => {
       try {
         await project.start();
 
-        const response = await fetch(`http://127.0.0.1:${project.server.port}/forms/my-page`);
+        const response = await fetch(
+          `http://127.0.0.1:${project.server.port}/forms/nested/data.json`,
+        );
         assert.equal(response.status, 200);
-        const body = await response.text();
-        assert.ok(body.includes('HTML wins'), '.html file should be served, not .json');
-        assert.ok(!body.includes('class="form"'), 'Should not render as form block');
+        const body = await response.json();
+        assert.equal(body.id, 'nested');
       } finally {
         await project.stop();
       }
     });
 
-    it('.plain.html takes precedence over .json', async () => {
-      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+    it('blocks path traversal for static files', async () => {
+      const cwd = await setupProject(
+        path.join(__rootdir, 'test', 'fixtures', 'project'),
+        testRoot,
+      );
       const formsFolder = path.join(cwd, 'forms');
       await fs.mkdir(formsFolder, { recursive: true });
-      await fs.writeFile(path.join(formsFolder, 'my-page.plain.html'), '
Plain HTML wins
');
-      await fs.writeFile(path.join(formsFolder, 'my-page.json'), JSON.stringify({ id: 'should-not-be-used' }));
-
-      nock('https://main--foo--bar.aem.page')
-        .get('/head.html')
-        .reply(404);
+      await fs.writeFile(
+        path.join(formsFolder, 'safe.json'),
+        '{}',
+      );
+      await fs.writeFile(
+        path.join(cwd, 'secret.json'),
+        '{"secret":true}',
+      );
 
       const project = new HelixProject()
         .withCwd(cwd)
         .withLogger(console)
         .withHttpPort(0)
-        .withProxyUrl('https://main--foo--bar.aem.page/')
         .withHtmlFolder('forms');
 
       await project.init();
       try {
         await project.start();
 
-        const response = await fetch(`http://127.0.0.1:${project.server.port}/forms/my-page`);
-        assert.equal(response.status, 200);
-        const body = await response.text();
-        assert.ok(body.includes('Plain HTML wins'), '.plain.html should be served, not .json');
-        assert.ok(!body.includes('class="form"'), 'Should not render as form block');
+        const response = await fetch(
+          `http://127.0.0.1:${project.server.port}/forms/../secret.json`,
+        );
+        assert.notEqual(
+          response.status,
+          200,
+          'Should not serve files outside html-folder',
+        );
       } finally {
         await project.stop();
       }
     });
 
-    it('serves .json from nested directory', async () => {
-      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
-      const nestedFolder = path.join(cwd, 'forms', 'nested');
-      await fs.mkdir(nestedFolder, { recursive: true });
-      const formJson = JSON.stringify({ id: 'nested-form' });
-      await fs.writeFile(path.join(nestedFolder, 'sub-form.json'), formJson);
+    it('serves static files with custom mount', async () => {
+      const cwd = await setupProject(
+        path.join(__rootdir, 'test', 'fixtures', 'project'),
+        testRoot,
+      );
+      const formsFolder = path.join(cwd, 'forms');
+      await fs.mkdir(formsFolder, { recursive: true });
+      await fs.writeFile(
+        path.join(formsFolder, 'xpl.json'),
+        JSON.stringify({ id: 'xpl-form' }),
+      );
 
       const project = new HelixProject()
         .withCwd(cwd)
@@ -1566,10 +1559,12 @@ describe('Helix Server - HTML Folder', () => {
       try {
         await project.start();
 
-        const response = await fetch(`http://127.0.0.1:${project.server.port}/content/forms/af/nested/sub-form`);
-        assert.equal(response.status, 200, 'Should serve nested JSON form');
-        const body = await response.text();
-        assert.ok(body.includes('class="form"'), 'Response should contain form block markup');
+        const response = await fetch(
+          `http://127.0.0.1:${project.server.port}/content/forms/af/xpl.json`,
+        );
+        assert.equal(response.status, 200);
+        const body = await response.json();
+        assert.equal(body.id, 'xpl-form');
       } finally {
         await project.stop();
       }

From 50d7dee185403d9ba8298358bffa123ffbbb36cd Mon Sep 17 00:00:00 2001
From: Alexandre Capt 
Date: Thu, 16 Apr 2026 16:33:41 +0200
Subject: [PATCH 05/21] feat: aem content (#2689)

---
 README.md                             |   2 +-
 package-lock.json                     | 155 +++++++++-
 package.json                          |   5 +
 src/cli.js                            |   3 +
 src/content/add.cmd.js                | 133 +++++++++
 src/content/add.js                    |  47 +++
 src/content/clone.cmd.js              | 214 ++++++++++++++
 src/content/clone.js                  |  74 +++++
 src/content/commit.cmd.js             |  57 ++++
 src/content/commit.js                 |  40 +++
 src/content/content-git.js            | 181 ++++++++++++
 src/content/content-metadata-html.js  | 321 ++++++++++++++++++++
 src/content/content-shared.js         |  44 +++
 src/content/content.js                |  38 +++
 src/content/da-api.js                 | 198 +++++++++++++
 src/content/da-auth.js                | 209 +++++++++++++
 src/content/diff.cmd.js               | 123 ++++++++
 src/content/diff.js                   |  45 +++
 src/content/merge.cmd.js              | 150 ++++++++++
 src/content/merge.js                  |  45 +++
 src/content/push.cmd.js               | 291 ++++++++++++++++++
 src/content/push.js                   |  58 ++++
 src/content/status.cmd.js             |  94 ++++++
 src/content/status.js                 |  33 +++
 src/server/BaseServer.js              |  10 +-
 src/server/HelixProject.js            |  19 ++
 src/server/HelixServer.js             |  82 ++++++
 src/server/MetadataSheetSupport.js    | 221 ++++++++++++++
 test/content-metadata-html.test.js    | 147 ++++++++++
 test/content/add.cmd.test.js          | 111 +++++++
 test/content/clone.cmd.test.js        | 288 ++++++++++++++++++
 test/content/content-commands.test.js | 373 ++++++++++++++++++++++++
 test/content/content-git.test.js      |  52 ++++
 test/content/content-test-utils.js    | 145 +++++++++
 test/content/da-api.test.js           | 405 ++++++++++++++++++++++++++
 test/content/da-auth.test.js          | 210 +++++++++++++
 test/content/diff.cmd.test.js         | 168 +++++++++++
 test/content/merge.cmd.test.js        | 205 +++++++++++++
 test/content/push.cmd.test.js         | 279 ++++++++++++++++++
 test/content/status.cmd.test.js       | 114 ++++++++
 test/metadata-sheet-support.test.js   |  50 ++++
 test/server-html-folder.test.js       |  14 +-
 test/server.test.js                   | 208 +++++++++++++
 43 files changed, 5646 insertions(+), 15 deletions(-)
 create mode 100644 src/content/add.cmd.js
 create mode 100644 src/content/add.js
 create mode 100644 src/content/clone.cmd.js
 create mode 100644 src/content/clone.js
 create mode 100644 src/content/commit.cmd.js
 create mode 100644 src/content/commit.js
 create mode 100644 src/content/content-git.js
 create mode 100644 src/content/content-metadata-html.js
 create mode 100644 src/content/content-shared.js
 create mode 100644 src/content/content.js
 create mode 100644 src/content/da-api.js
 create mode 100644 src/content/da-auth.js
 create mode 100644 src/content/diff.cmd.js
 create mode 100644 src/content/diff.js
 create mode 100644 src/content/merge.cmd.js
 create mode 100644 src/content/merge.js
 create mode 100644 src/content/push.cmd.js
 create mode 100644 src/content/push.js
 create mode 100644 src/content/status.cmd.js
 create mode 100644 src/content/status.js
 create mode 100644 src/server/MetadataSheetSupport.js
 create mode 100644 test/content-metadata-html.test.js
 create mode 100644 test/content/add.cmd.test.js
 create mode 100644 test/content/clone.cmd.test.js
 create mode 100644 test/content/content-commands.test.js
 create mode 100644 test/content/content-git.test.js
 create mode 100644 test/content/content-test-utils.js
 create mode 100644 test/content/da-api.test.js
 create mode 100644 test/content/da-auth.test.js
 create mode 100644 test/content/diff.cmd.test.js
 create mode 100644 test/content/merge.cmd.test.js
 create mode 100644 test/content/push.cmd.test.js
 create mode 100644 test/content/status.cmd.test.js
 create mode 100644 test/metadata-sheet-support.test.js

diff --git a/README.md b/README.md
index b0d287a2c..b80a37f08 100644
--- a/README.md
+++ b/README.md
@@ -80,7 +80,7 @@ The `--html-folder` option enables serving HTML files without extensions, useful
 
 ```
 $ aem up --html-folder drafts                      # serves at /drafts/*
-$ aem up --html-folder content --html-mount /       # serves at /* (root)
+$ aem up --html-folder html --html-mount /       # serves at /* (root)
 $ aem up --html-folder drafts --html-mount /preview # serves at /preview/*
 ```
 
diff --git a/package-lock.json b/package-lock.json
index 107c60d5d..3c02ea136 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,12 +14,14 @@
         "@adobe/helix-shared-config": "11.1.20",
         "@adobe/helix-shared-git": "3.0.23",
         "@adobe/helix-shared-indexer": "2.2.7",
+        "@adobe/helix-shared-process-queue": "3.1.6",
         "camelcase": "9.0.0",
         "chalk-template": "1.1.2",
         "chokidar": "5.0.0",
         "compression": "1.8.1",
         "cookie": "1.1.1",
         "cookie-parser": "1.4.7",
+        "diff": "8.0.3",
         "dotenv": "17.3.1",
         "express": "5.2.1",
         "faye-websocket": "0.11.4",
@@ -27,6 +29,7 @@
         "glob": "13.0.6",
         "glob-to-regexp": "0.4.1",
         "hast-util-select": "6.0.4",
+        "hast-util-to-html": "9.0.5",
         "http-proxy-agent": "8.0.0",
         "https-proxy-agent": "8.0.0",
         "ignore": "7.0.5",
@@ -34,6 +37,8 @@
         "isomorphic-git": "1.37.4",
         "jose": "6.2.2",
         "livereload-js": "4.0.2",
+        "mime": "4.1.0",
+        "node-diff3": "3.2.0",
         "node-fetch": "3.3.2",
         "open": "11.0.0",
         "progress": "2.0.3",
@@ -163,6 +168,12 @@
         "colorette": "^2.0.2"
       }
     },
+    "node_modules/@adobe/helix-shared-async": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@adobe/helix-shared-async/-/helix-shared-async-2.0.2.tgz",
+      "integrity": "sha512-I510DKZI7Vf1ikqm9asKN5ZG9oEEx6VQpttdtzM1BGkrXWA7t/QeG6O54TLKGYMXDhdhpH+8kaleS3OfhQyDOQ==",
+      "license": "Apache-2.0"
+    },
     "node_modules/@adobe/helix-shared-config": {
       "version": "11.1.20",
       "resolved": "https://registry.npmjs.org/@adobe/helix-shared-config/-/helix-shared-config-11.1.20.tgz",
@@ -217,6 +228,15 @@
         "unified": "11.0.5"
       }
     },
+    "node_modules/@adobe/helix-shared-process-queue": {
+      "version": "3.1.6",
+      "resolved": "https://registry.npmjs.org/@adobe/helix-shared-process-queue/-/helix-shared-process-queue-3.1.6.tgz",
+      "integrity": "sha512-1cYBCDRhlt/NnULO9USyao2udv17jQoAv8QcHHqq52oeYFqsBPKc/Hn4/TRBqZL3hR3pCSvG34rFQOSuYrFGDg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@adobe/helix-shared-async": "2.0.2"
+      }
+    },
     "node_modules/@adobe/helix-shared-prune": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/@adobe/helix-shared-prune/-/helix-shared-prune-1.0.5.tgz",
@@ -646,6 +666,7 @@
       "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@octokit/auth-token": "^6.0.0",
         "@octokit/graphql": "^9.0.3",
@@ -1646,6 +1667,7 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1766,6 +1788,21 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/anymatch": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
+      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -2048,6 +2085,20 @@
       "dev": true,
       "license": "Apache-2.0"
     },
+    "node_modules/binary-extensions": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
+      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/body-parser": {
       "version": "2.2.2",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
@@ -3404,10 +3455,9 @@
       }
     },
     "node_modules/diff": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-7.0.0.tgz",
-      "integrity": "sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw==",
-      "dev": true,
+      "version": "8.0.3",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.3.tgz",
+      "integrity": "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.3.1"
@@ -3987,6 +4037,7 @@
       "integrity": "sha512-sjc7Y8cUD1IlwYcTS9qPSvGjAC8Ne9LctpxKKu3x/1IC9bnOg98Zy6GxEJUfr1NojMgVPlyANXYns8oE2c1TAA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.6.1",
@@ -4922,6 +4973,21 @@
         "node": ">=14.14"
       }
     },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
     "node_modules/function-bind": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@ -5964,6 +6030,20 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "binary-extensions": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/is-boolean-object": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.2.2.tgz",
@@ -7156,6 +7236,7 @@
       "integrity": "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "bin": {
         "marked": "bin/marked.js"
       },
@@ -7664,7 +7745,6 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/mime/-/mime-4.1.0.tgz",
       "integrity": "sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw==",
-      "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa"
       ],
@@ -7886,6 +7966,16 @@
         "node": ">=12"
       }
     },
+    "node_modules/mocha/node_modules/diff": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-7.0.0.tgz",
+      "integrity": "sha512-PJWHUb1RFevKCwaFA9RlG5tCd+FO5iRh9A8HEtkmBH2Li03iJriB6m6JIN4rGz3K3JLawI7/veA1xzRKP6ISBw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.3.1"
+      }
+    },
     "node_modules/mocha/node_modules/glob": {
       "version": "10.5.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
@@ -8112,6 +8202,16 @@
         "node": ">= 10.13"
       }
     },
+    "node_modules/node-diff3": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/node-diff3/-/node-diff3-3.2.0.tgz",
+      "integrity": "sha512-vLh2xJFSyniBLYDEDbXKqD32fQ5vAxmYT4hco8t0EHQ4CQ4BDHhshi7kdvDc6Y1MwGSi1Mhl4unUukPbCayZdw==",
+      "license": "MIT",
+      "engines": {
+        "bun": ">=1.3.0",
+        "node": ">=18"
+      }
+    },
     "node_modules/node-domexception": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz",
@@ -8181,6 +8281,17 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/normalize-url": {
       "version": "9.0.0",
       "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-9.0.0.tgz",
@@ -10032,6 +10143,7 @@
       "dev": true,
       "inBundle": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -11006,7 +11118,8 @@
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/quickjs-wasi/-/quickjs-wasi-0.0.1.tgz",
       "integrity": "sha512-fBWNLTBkxkLAhe1AzF1hyXEvuA+N+vV1WMP2D6iiMUblvmOt8Pp5t8zUcgvz7aYA1ldUdxDlgUse15dmcKjkNg==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/randombytes": {
       "version": "2.1.0",
@@ -11583,6 +11696,7 @@
       "integrity": "sha512-WRgl5GcypwramYX4HV+eQGzUbD7UUbljVmS+5G1uMwX/wLgYuJAxGeerXJDMO2xshng4+FXqCgyB5QfClV6WjA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@semantic-release/commit-analyzer": "^13.0.1",
         "@semantic-release/error": "^4.0.0",
@@ -11655,6 +11769,20 @@
         "node": ">= 6"
       }
     },
+    "node_modules/semantic-release-discord-bot/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/semantic-release-discord-bot/node_modules/nunjucks": {
       "version": "3.2.4",
       "resolved": "https://registry.npmjs.org/nunjucks/-/nunjucks-3.2.4.tgz",
@@ -11681,6 +11809,20 @@
         }
       }
     },
+    "node_modules/semantic-release-discord-bot/node_modules/readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "picomatch": "^2.2.1"
+      },
+      "engines": {
+        "node": ">=8.10.0"
+      }
+    },
     "node_modules/semantic-release/node_modules/@semantic-release/error": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/@semantic-release/error/-/error-4.0.0.tgz",
@@ -13254,6 +13396,7 @@
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
diff --git a/package.json b/package.json
index 1e1dd4ede..b698cdee2 100644
--- a/package.json
+++ b/package.json
@@ -48,12 +48,14 @@
     "@adobe/helix-shared-config": "11.1.20",
     "@adobe/helix-shared-git": "3.0.23",
     "@adobe/helix-shared-indexer": "2.2.7",
+    "@adobe/helix-shared-process-queue": "3.1.6",
     "camelcase": "9.0.0",
     "chalk-template": "1.1.2",
     "chokidar": "5.0.0",
     "compression": "1.8.1",
     "cookie": "1.1.1",
     "cookie-parser": "1.4.7",
+    "diff": "8.0.3",
     "dotenv": "17.3.1",
     "express": "5.2.1",
     "faye-websocket": "0.11.4",
@@ -61,13 +63,16 @@
     "glob": "13.0.6",
     "glob-to-regexp": "0.4.1",
     "hast-util-select": "6.0.4",
+    "hast-util-to-html": "9.0.5",
     "http-proxy-agent": "8.0.0",
     "https-proxy-agent": "8.0.0",
     "ignore": "7.0.5",
     "ini": "6.0.0",
     "isomorphic-git": "1.37.4",
     "jose": "6.2.2",
+    "mime": "4.1.0",
     "livereload-js": "4.0.2",
+    "node-diff3": "3.2.0",
     "node-fetch": "3.3.2",
     "open": "11.0.0",
     "progress": "2.0.3",
diff --git a/src/cli.js b/src/cli.js
index 1e22251aa..24dd6a77f 100755
--- a/src/cli.js
+++ b/src/cli.js
@@ -112,6 +112,9 @@ export default class CLI {
           this._commands[cmd] = (await import(`./${cmd}.js`)).default();
         }
       }
+      if (!this._commands.content) {
+        this._commands.content = (await import('./content/content.js')).default();
+      }
     }
     return this;
   }
diff --git a/src/content/add.cmd.js b/src/content/add.cmd.js
new file mode 100644
index 000000000..d32092ab7
--- /dev/null
+++ b/src/content/add.cmd.js
@@ -0,0 +1,133 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { CONTENT_DIR, CONFIG_FILE } from './content-shared.js';
+
+/**
+ * Paths for git add are relative to the content repo root. Accept optional
+ * `content/…` (or `{CONTENT_DIR}/…`) so shells can tab-complete from the project root.
+ * @param {string} raw
+ * @returns {string}
+ */
+export function normalizePathForContentAdd(raw) {
+  let s = String(raw).trim().replace(/\\/g, '/');
+  while (s.startsWith('./')) {
+    s = s.slice(2);
+  }
+  const prefix = `${CONTENT_DIR}/`;
+  if (s === CONTENT_DIR || s === `${CONTENT_DIR}/`) {
+    return '.';
+  }
+  if (s.startsWith(prefix)) {
+    const rest = s.slice(prefix.length);
+    return rest.length > 0 ? rest : '.';
+  }
+  return s.length > 0 ? s : '.';
+}
+
+/**
+ * Whether a repo-relative path is covered by an `aem content add` path (`.` = whole tree).
+ * @param {string} filepath
+ * @param {string} scope normalized path from {@link normalizePathForContentAdd}
+ */
+export function filepathInContentAddScope(filepath, scope) {
+  if (scope === '.' || scope === '') {
+    return true;
+  }
+  const s = scope.replace(/\/$/, '');
+  return filepath === s || filepath.startsWith(`${s}/`);
+}
+
+/**
+ * isomorphic-git `add` only walks paths that exist on disk, so deletions are never staged.
+ * Stage removals for tracked files missing from the workdir (same idea as `git add -u` for
+ * those scopes).
+ * @param {import('isomorphic-git').FsClient} fsClient
+ * @param {string} dir content repo root
+ * @param {string[]} scopes normalized add paths
+ * @returns {Promise} number of index entries removed
+ */
+export async function stageDeletionsForContentAddScopes(fsClient, dir, scopes) {
+  const matrix = await git.statusMatrix({ fs: fsClient, dir });
+  let n = 0;
+  for (const [filepath, head, workdir, stage] of matrix) {
+    const unstagedDelete = head === 1 && workdir === 0 && stage !== 0;
+    const inScope = scopes.some((sc) => filepathInContentAddScope(filepath, sc));
+    if (unstagedDelete && inScope) {
+      // eslint-disable-next-line no-await-in-loop
+      await git.remove({ fs: fsClient, dir, filepath });
+      n += 1;
+    }
+  }
+  return n;
+}
+
+function isNotFoundError(err) {
+  return err?.code === 'NotFoundError' || err?.name === 'NotFoundError';
+}
+
+export default class AddCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+    /** @type {string[]} */
+    this._paths = ['.'];
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  /**
+   * @param {string[]} paths paths relative to content/ (default ["."])
+   */
+  withPaths(paths) {
+    this._paths = paths && paths.length > 0 ? paths : ['.'];
+    return this;
+  }
+
+  async run() {
+    const { log } = this;
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    const configPath = path.join(contentDir, CONFIG_FILE);
+
+    if (!await fse.pathExists(configPath)) {
+      throw new Error(`No config found at ${configPath}. Run 'aem content clone' first.`);
+    }
+
+    const normalized = this._paths.map((p) => normalizePathForContentAdd(p));
+
+    for (const fp of normalized) {
+      try {
+        // eslint-disable-next-line no-await-in-loop
+        await git.add({ fs, dir: contentDir, filepath: fp });
+      } catch (err) {
+        if (!isNotFoundError(err)) {
+          throw err;
+        }
+        // Deleted directory/file: `add` cannot lstat the path; stage removal if it was tracked.
+        // eslint-disable-next-line no-await-in-loop
+        const staged = await stageDeletionsForContentAddScopes(fs, contentDir, [fp]);
+        if (staged === 0) {
+          throw err;
+        }
+      }
+    }
+    // `git add .` never visits missing files — stage tracked deletions under the requested paths.
+    await stageDeletionsForContentAddScopes(fs, contentDir, normalized);
+    log.info(`Staged: ${normalized.join(', ')}`);
+  }
+}
diff --git a/src/content/add.js b/src/content/add.js
new file mode 100644
index 000000000..fc3939fce
--- /dev/null
+++ b/src/content/add.js
@@ -0,0 +1,47 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+
+export default function add() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'add [files..]',
+    description: 'Stage changes in content/ (like git add)',
+    builder: (yargs) => {
+      yargs
+        .positional('files', {
+          describe:
+            'Paths under content/ to stage, or the same with a content/ prefix for tab completion (default: all)',
+          type: 'string',
+          array: true,
+        })
+        .help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const AddCommand = (await import('./add.cmd.js')).default;
+        executor = new AddCommand(getOrCreateLogger(argv));
+      }
+      const { files } = argv;
+      let paths = [];
+      if (Array.isArray(files)) {
+        paths = files;
+      } else if (files) {
+        paths = [files];
+      }
+      await executor.withPaths(paths).run();
+    },
+  };
+}
diff --git a/src/content/clone.cmd.js b/src/content/clone.cmd.js
new file mode 100644
index 000000000..ccf6c9430
--- /dev/null
+++ b/src/content/clone.cmd.js
@@ -0,0 +1,214 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import readline from 'readline';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import processQueue from '@adobe/helix-shared-process-queue';
+import GitUtils from '../git-utils.js';
+import { prompt } from '../cli-util.js';
+import { DaClient } from './da-api.js';
+import { getValidToken } from './da-auth.js';
+import {
+  CONTENT_DIR,
+  CONFIG_FILE,
+  GIT_AUTHOR,
+  LARGE_CLONE_FILE_THRESHOLD,
+  CONTENT_IO_CONCURRENCY,
+} from './content-shared.js';
+import { writeSyncedRef, ensureGitIgnored } from './content-git.js';
+
+/**
+ * @param {*} log logger with .warn
+ * @param {number} fileCount
+ * @param {boolean} assumeYes
+ */
+async function confirmLargeCloneIfNeeded(log, fileCount, assumeYes) {
+  if (fileCount <= LARGE_CLONE_FILE_THRESHOLD) {
+    return;
+  }
+  log.warn(
+    `This clone lists ${fileCount} files (more than ${LARGE_CLONE_FILE_THRESHOLD.toLocaleString()}). `
+    + 'Downloading may take a long time and use substantial disk space.',
+  );
+  if (assumeYes) {
+    return;
+  }
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error(
+      `Large clone (${fileCount} files) needs confirmation. Re-run with --yes, or clone a smaller path with --path.`,
+    );
+  }
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = await prompt(rl, 'Do you really want to proceed? [y/N] ');
+    if (!/^y(es)?$/i.test(String(answer).trim())) {
+      throw new Error('Clone cancelled.');
+    }
+  } finally {
+    rl.close();
+  }
+}
+
+export default class CloneCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+    this._force = false;
+    this._assumeYes = false;
+    this._rootPath = null;
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  withToken(token) {
+    this._token = token;
+    return this;
+  }
+
+  withForce(force) {
+    this._force = force;
+    return this;
+  }
+
+  withAssumeYes(yes) {
+    this._assumeYes = !!yes;
+    return this;
+  }
+
+  withRootPath(daPath) {
+    this._rootPath = daPath;
+    return this;
+  }
+
+  async run() {
+    const { log } = this;
+
+    if (this._rootPath == null) {
+      throw new Error('Clone root path was not set (internal error).');
+    }
+
+    // 1. Resolve org/repo from git remote
+    const originUrl = await GitUtils.getOriginURL(this._dir);
+    if (!originUrl) {
+      throw new Error('No git remote found. Run `aem content clone` inside an AEM project directory.');
+    }
+    const org = originUrl.owner;
+    const { repo } = originUrl;
+    log.info(`Cloning content from da.live: ${org}/${repo}${this._rootPath === '/' ? '' : ` @ ${this._rootPath}`}`);
+
+    // 2. Ensure target path is available (do not create content/ until after file count is known)
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    if (await fse.pathExists(contentDir)) {
+      if (!this._force) {
+        throw new Error(`'${CONTENT_DIR}' already exists. Use --force to overwrite.`);
+      }
+      await fse.remove(contentDir);
+    }
+
+    // 3. Resolve token
+    const token = await getValidToken(log, this._token, this._dir);
+
+    // 4. Fetch file list (no local content dir required yet)
+    const client = new DaClient(token);
+    log.info('Fetching file list...');
+    const showDiscoveryProgress = process.stdout.isTTY;
+    const files = await client.listAll(org, repo, this._rootPath, showDiscoveryProgress
+      ? (n) => {
+        process.stdout.write(`\r  ${n} file(s) discovered so far...`);
+      }
+      : undefined);
+    if (showDiscoveryProgress) {
+      process.stdout.write('\n');
+    }
+    log.info(`Found ${files.length} file(s).`);
+
+    await confirmLargeCloneIfNeeded(log, files.length, this._assumeYes);
+
+    // 5. Prepare content directory and project .gitignore
+    await fse.ensureDir(contentDir);
+    await ensureGitIgnored(this._dir, CONTENT_DIR);
+
+    log.info('Downloading...');
+
+    // 6. Download files (bounded concurrency)
+    const downloadResults = await processQueue(
+      files,
+      async (file) => {
+        const prefix = `/${org}/${repo}`;
+        if (!file.path.startsWith(prefix)) {
+          log.warn(`  skip (unexpected path, missing org/repo prefix): ${file.path}`);
+          return { status: 404 };
+        }
+        const daPath = file.path.slice(prefix.length) || '/';
+        const localPath = path.join(contentDir, ...daPath.split('/').filter(Boolean));
+        try {
+          const res = await client.getSource(org, repo, daPath);
+          if (!res) {
+            log.warn(`  skip (not found): ${daPath}`);
+            return { status: 404 };
+          }
+          const buffer = await res.buffer();
+          await fse.ensureDir(path.dirname(localPath));
+          await fse.writeFile(localPath, buffer);
+          log.info(`  ✓ ${daPath}`);
+          return { status: 200, daPath };
+        } catch (err) {
+          log.warn(`  ✗ ${daPath}: ${err.message}`);
+          return { status: err.status || 500 };
+        }
+      },
+      CONTENT_IO_CONCURRENCY,
+    );
+
+    const downloaded = [];
+    let errors = 0;
+    for (const r of downloadResults) {
+      if (r.status === 200) {
+        downloaded.push(r.daPath);
+      } else if (r.status !== 404) {
+        errors += 1;
+      }
+    }
+
+    // 7. Init git repo and commit as baseline
+    await git.init({ fs, dir: contentDir, defaultBranch: 'main' });
+    await fse.writeFile(path.join(contentDir, '.gitignore'), `${CONFIG_FILE}\n`);
+    for (const daPath of downloaded) {
+      // eslint-disable-next-line no-await-in-loop
+      await git.add({ fs, dir: contentDir, filepath: daPath.replace(/^\//, '') });
+    }
+    await git.add({ fs, dir: contentDir, filepath: '.gitignore' });
+    await git.commit({
+      fs,
+      dir: contentDir,
+      message: `clone: ${org}/${repo}${this._rootPath === '/' ? '' : ` (${this._rootPath})`}`,
+      author: GIT_AUTHOR,
+    });
+    const headOid = await git.resolveRef({ fs, dir: contentDir, ref: 'HEAD' });
+    await writeSyncedRef(fs, contentDir, headOid);
+
+    // 8. Write config (not tracked by git)
+    await fse.writeJson(path.join(contentDir, CONFIG_FILE), {
+      org,
+      repo,
+      rootPath: this._rootPath,
+    }, { spaces: 2 });
+
+    log.info(`\nDone. ${downloaded.length} file(s) downloaded${errors > 0 ? `, ${errors} error(s)` : ''}.`);
+    log.info(`Content saved to ./${CONTENT_DIR}/`);
+  }
+}
diff --git a/src/content/clone.js b/src/content/clone.js
new file mode 100644
index 000000000..27f7e1665
--- /dev/null
+++ b/src/content/clone.js
@@ -0,0 +1,74 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+import { normalizeDaPath, LARGE_CLONE_FILE_THRESHOLD } from './content-shared.js';
+
+export default function clone() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'clone',
+    description: 'Clone da.live content locally into content/',
+    builder: (yargs) => {
+      yargs
+        .option('path', {
+          describe: 'da.live folder to clone (e.g. /ca/fr_ca). Omit only when using --all.',
+          type: 'string',
+        })
+        .option('all', {
+          describe: 'Clone the entire site content (large). Use instead of --path.',
+          type: 'boolean',
+          default: false,
+        })
+        .option('token', {
+          describe: 'IMS Bearer token for da.live authentication',
+          type: 'string',
+        })
+        .option('force', {
+          describe: 'Overwrite existing content/ without prompting',
+          type: 'boolean',
+          default: false,
+        })
+        .option('yes', {
+          alias: 'y',
+          describe: `Proceed without prompting when the clone has more than ${LARGE_CLONE_FILE_THRESHOLD.toLocaleString()} files`,
+          type: 'boolean',
+          default: false,
+        })
+        .check((argv) => {
+          if (argv.all && argv.path !== undefined && argv.path !== '') {
+            return 'Do not use --path together with --all.';
+          }
+          if (!argv.all && (argv.path === undefined || argv.path === '')) {
+            return 'Missing --path. Example: aem content clone --path /ca/fr_ca. Use --all to clone all the content.';
+          }
+          return true;
+        })
+        .help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const CloneCommand = (await import('./clone.cmd.js')).default;
+        executor = new CloneCommand(getOrCreateLogger(argv));
+      }
+      const rootPath = argv.all ? '/' : normalizeDaPath(argv.path);
+      await executor
+        .withToken(argv.token)
+        .withForce(argv.force)
+        .withAssumeYes(argv.yes)
+        .withRootPath(rootPath)
+        .run();
+    },
+  };
+}
diff --git a/src/content/commit.cmd.js b/src/content/commit.cmd.js
new file mode 100644
index 000000000..d00deea52
--- /dev/null
+++ b/src/content/commit.cmd.js
@@ -0,0 +1,57 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { CONTENT_DIR, CONFIG_FILE, GIT_AUTHOR } from './content-shared.js';
+
+export default class CommitCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+    this._message = '';
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  withMessage(message) {
+    this._message = message || '';
+    return this;
+  }
+
+  async run() {
+    const { log } = this;
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    const configPath = path.join(contentDir, CONFIG_FILE);
+
+    if (!await fse.pathExists(configPath)) {
+      throw new Error(`No config found at ${configPath}. Run 'aem content clone' first.`);
+    }
+
+    const msg = String(this._message).trim();
+    if (!msg) {
+      throw new Error('Commit message is required. Use -m "your message".');
+    }
+
+    const oid = await git.commit({
+      fs,
+      dir: contentDir,
+      message: msg,
+      author: GIT_AUTHOR,
+    });
+    log.info(`Committed ${oid.slice(0, 7)}`);
+  }
+}
diff --git a/src/content/commit.js b/src/content/commit.js
new file mode 100644
index 000000000..13ce5dffd
--- /dev/null
+++ b/src/content/commit.js
@@ -0,0 +1,40 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+
+export default function commit() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'commit',
+    description: 'Commit staged changes in content/ (like git commit)',
+    builder: (yargs) => {
+      yargs
+        .option('m', {
+          alias: 'message',
+          describe: 'Commit message',
+          type: 'string',
+          demandOption: true,
+        })
+        .help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const CommitCommand = (await import('./commit.cmd.js')).default;
+        executor = new CommitCommand(getOrCreateLogger(argv));
+      }
+      await executor.withMessage(argv.m).run();
+    },
+  };
+}
diff --git a/src/content/content-git.js b/src/content/content-git.js
new file mode 100644
index 000000000..630c625ad
--- /dev/null
+++ b/src/content/content-git.js
@@ -0,0 +1,181 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+
+/** Ref pointing at the last commit whose tree was fully synced to da.live. */
+export const DA_SYNCED_REF = 'refs/da/synced';
+
+/**
+ * OID of the last da.live sync. Uses refs/da/synced when present; otherwise infers
+ * from commit history (newest `push:` then `clone:`) so repos created before the ref
+ * existed still compare against the correct baseline.
+ * @param {import('isomorphic-git').FsClient} fs
+ * @param {string} dir
+ * @returns {Promise}
+ */
+export async function resolveSyncedOid(fs, dir) {
+  try {
+    return await git.resolveRef({ fs, dir, ref: DA_SYNCED_REF });
+  } catch (err) {
+    if (err && (err.code === 'NotFoundError' || err.name === 'NotFoundError')) {
+      const commits = await git.log({ fs, dir, depth: 500 });
+      for (const c of commits) {
+        if (String(c.commit.message).startsWith('push:')) {
+          return c.oid;
+        }
+      }
+      for (const c of commits) {
+        if (String(c.commit.message).startsWith('clone:')) {
+          return c.oid;
+        }
+      }
+      return git.resolveRef({ fs, dir, ref: 'HEAD' });
+    }
+    throw err;
+  }
+}
+
+/**
+ * @param {import('isomorphic-git').FsClient} fs
+ * @param {string} dir
+ * @param {string} oid
+ * @returns {Promise}
+ */
+export async function writeSyncedRef(fs, dir, oid) {
+  await git.writeRef({
+    fs,
+    dir,
+    ref: DA_SYNCED_REF,
+    value: oid,
+    force: true,
+  });
+}
+
+/**
+ * True when the index or working tree differs from HEAD (uncommitted work).
+ * @param {Array<[string, number, number, number]>} matrix
+ * @returns {boolean}
+ */
+export function statusMatrixHasUncommitted(matrix) {
+  return matrix.some(([, h, w, s]) => !(h === 1 && w === 1 && s === 1));
+}
+
+/**
+ * Diff trees at two commits: paths as da.live paths (`/file`).
+ * @param {import('isomorphic-git').FsClient} fs
+ * @param {string} dir
+ * @param {string} baseOid
+ * @param {string} headOid
+ * @returns {Promise<{ added: string[], modified: string[], deleted: string[] }>}
+ */
+export async function diffCommitTrees(fs, dir, baseOid, headOid) {
+  if (baseOid === headOid) {
+    return { added: [], modified: [], deleted: [] };
+  }
+
+  const baseFiles = new Set(await git.listFiles({ fs, dir, ref: baseOid }));
+  const headFiles = new Set(await git.listFiles({ fs, dir, ref: headOid }));
+
+  const added = [];
+  const modified = [];
+  const deleted = [];
+
+  for (const f of headFiles) {
+    if (!baseFiles.has(f)) {
+      added.push(`/${f}`);
+    } else {
+      // eslint-disable-next-line no-await-in-loop
+      const b1 = await git.readBlob({
+        fs,
+        dir,
+        oid: baseOid,
+        filepath: f,
+      });
+      // eslint-disable-next-line no-await-in-loop
+      const b2 = await git.readBlob({
+        fs,
+        dir,
+        oid: headOid,
+        filepath: f,
+      });
+      if (b1.oid !== b2.oid) {
+        modified.push(`/${f}`);
+      }
+    }
+  }
+
+  for (const f of baseFiles) {
+    if (!headFiles.has(f)) {
+      deleted.push(`/${f}`);
+    }
+  }
+
+  return { added, modified, deleted };
+}
+
+/**
+ * Number of commits reachable from `tipOid` before hitting `ancestorOid` (exclusive).
+ * @param {import('isomorphic-git').FsClient} fs
+ * @param {string} dir
+ * @param {string} tipOid
+ * @param {string} ancestorOid
+ * @returns {Promise}
+ */
+export async function countCommitsAhead(fs, dir, tipOid, ancestorOid) {
+  if (tipOid === ancestorOid) {
+    return 0;
+  }
+  const commits = await git.log({
+    fs,
+    dir,
+    ref: tipOid,
+    depth: 5000,
+  });
+  let n = 0;
+  for (const c of commits) {
+    if (c.oid === ancestorOid) {
+      return n;
+    }
+    n += 1;
+  }
+  return n;
+}
+
+/**
+ * Committer time in ms for conflict checks (da.live lastModified).
+ * @param {import('isomorphic-git').FsClient} fs
+ * @param {string} dir
+ * @param {string} commitOid
+ * @returns {Promise}
+ */
+export async function getCommitCommitterTimeMs(fs, dir, commitOid) {
+  const { commit } = await git.readCommit({ fs, dir, oid: commitOid });
+  return commit.committer.timestamp * 1000;
+}
+
+/**
+ * Ensures an entry is present in the project .gitignore, creating the file if needed.
+ * @param {string} projectDir
+ * @param {string} entry
+ */
+export async function ensureGitIgnored(projectDir, entry) {
+  const gitIgnorePath = path.resolve(projectDir, '.gitignore');
+  let content = '';
+  if (await fse.pathExists(gitIgnorePath)) {
+    content = await fse.readFile(gitIgnorePath, 'utf-8');
+  }
+  if (!content.split('\n').map((l) => l.trim()).includes(entry)) {
+    await fse.appendFile(gitIgnorePath, `\n${entry}\n`);
+  }
+}
diff --git a/src/content/content-metadata-html.js b/src/content/content-metadata-html.js
new file mode 100644
index 000000000..7e5159f63
--- /dev/null
+++ b/src/content/content-metadata-html.js
@@ -0,0 +1,321 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/**
+ * Transforms da.live-style `
` blocks in content HTML into
+ * `` tags for local dev (`aem up`), strips the block from the body, and
+ * adds description / Open Graph / Twitter tags where data is available.
+ */
+
+import { unified } from 'unified';
+import rehypeParse from 'rehype-parse';
+import { select } from 'hast-util-select';
+import { toHtml } from 'hast-util-to-html';
+
+/** @typedef {import('hast').Root} HastRoot */
+/** @typedef {import('hast').Element} HastElement */
+
+const REHYPE_PARSE = { fragment: true };
+
+/**
+ * @param {string} s
+ * @returns {string}
+ */
+export function escapeHtmlAttr(s) {
+  return String(s)
+    .replace(/&/g, '&')
+    .replace(/"/g, '"')
+    .replace(/ textContent(c)).join('');
+  }
+  return '';
+}
+
+/**
+ * @param {HastElement} metadataRoot
+ * @returns {Array<[string, string]>}
+ */
+export function extractMetadataPairs(metadataRoot) {
+  /** @type {Array<[string, string]>} */
+  const pairs = [];
+  if (!metadataRoot.children) {
+    return pairs;
+  }
+  for (const row of metadataRoot.children) {
+    if (row.type !== 'element' || row.tagName !== 'div') {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    const cells = (row.children || []).filter(
+      (c) => c.type === 'element' && c.tagName === 'div',
+    );
+    if (cells.length < 2) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    const label = textContent(cells[0]).trim();
+    const value = textContent(cells[1]).trim();
+    if (label) {
+      pairs.push([label, value]);
+    }
+  }
+  return pairs;
+}
+
+/**
+ * @param {HastElement} node
+ * @param {string} className
+ * @returns {boolean}
+ */
+function hasClass(node, className) {
+  const cn = node.properties?.className;
+  if (Array.isArray(cn)) {
+    return cn.includes(className);
+  }
+  if (typeof cn === 'string') {
+    return cn.split(/\s+/).includes(className);
+  }
+  return false;
+}
+
+/**
+ * @param {import('hast').Node} tree
+ * @param {import('hast').Element} target
+ * @returns {boolean}
+ */
+function removeNode(tree, target) {
+  if (tree === target) {
+    return true;
+  }
+  if ('children' in tree && Array.isArray(tree.children)) {
+    const { children } = tree;
+    for (let i = 0; i < children.length; i += 1) {
+      const c = children[i];
+      if (c === target) {
+        children.splice(i, 1);
+        return true;
+      }
+      if (removeNode(c, target)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * @param {HastRoot} tree
+ * @returns {string}
+ */
+function firstImgSrc(tree) {
+  const img = select('img[src]', tree);
+  if (!img || img.type !== 'element') {
+    return '';
+  }
+  const s = img.properties?.src;
+  return typeof s === 'string' ? s : '';
+}
+
+/**
+ * @param {HastRoot} tree
+ * @returns {string}
+ */
+function firstParagraphText(tree) {
+  const p = select('p', tree);
+  return p && p.type === 'element' ? textContent(p).trim() : '';
+}
+
+/**
+ * Truncates a string to `max` characters, trimming and appending an ellipsis when needed.
+ * @param {string} s
+ * @param {number} max
+ * @returns {string}
+ */
+function truncateWithEllipsis(s, max) {
+  if (s.length <= max) {
+    return s;
+  }
+  return `${s.slice(0, max - 1).trim()}…`;
+}
+
+const SEO_LABEL_SKIP = new Set(['title', 'description', 'image']);
+
+/**
+ * @param {object | null | undefined} sheetRow row from /metadata.json matched for this URL
+ * @param {Set | null | undefined} excludeMetaNames lowercase meta `name` values to skip
+ *   (local page wins)
+ * @returns {string[]}
+ */
+export function buildSheetMetaLines(sheetRow, excludeMetaNames) {
+  if (!sheetRow || typeof sheetRow !== 'object') {
+    return [];
+  }
+  /** @type {string[]} */
+  const lines = [];
+  for (const [k, v] of Object.entries(sheetRow)) {
+    if (k === 'URL' || k.startsWith(':')) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    if (excludeMetaNames && excludeMetaNames.has(k.toLowerCase())) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    if (v === undefined || v === null) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    const s = String(v).trim();
+    if (!s) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    lines.push(``);
+  }
+  return lines;
+}
+
+/**
+ * @param {string[]} lines
+ * @returns {string}
+ */
+function joinLines(lines) {
+  return lines.length > 0 ? `\n${lines.join('\n')}\n` : '';
+}
+
+/**
+ * @param {string} htmlFragment body-only or partial HTML from content/
+ * @param {{ absolutePageUrl?: string, sheetRow?: object | null }} [options]
+ * @returns {{ htmlFragment: string, metaTagsHtml: string }}
+ */
+export function transformContentMetadataHtml(htmlFragment, options = {}) {
+  const { absolutePageUrl = '', sheetRow = null } = options;
+
+  let tree;
+  try {
+    tree = unified().use(rehypeParse, REHYPE_PARSE).parse(htmlFragment);
+  } catch {
+    return { htmlFragment, metaTagsHtml: joinLines(buildSheetMetaLines(sheetRow)) };
+  }
+
+  const metadataEl = select('div.metadata', tree);
+  if (!metadataEl || metadataEl.type !== 'element' || !hasClass(metadataEl, 'metadata')) {
+    return { htmlFragment, metaTagsHtml: joinLines(buildSheetMetaLines(sheetRow)) };
+  }
+
+  const pairs = extractMetadataPairs(metadataEl);
+
+  /** Names from page metadata; sheet entries with the same meta name are skipped. */
+  const localPairMetaNames = new Set();
+  for (const [label, value] of pairs) {
+    const slug = slugifyMetadataLabel(label);
+    if (!slug || value === undefined) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    localPairMetaNames.add(slug);
+  }
+
+  const sheetLines = buildSheetMetaLines(sheetRow, localPairMetaNames);
+
+  const lowerMap = new Map(pairs.map(([k, v]) => [k.toLowerCase().trim(), v]));
+
+  removeNode(tree, metadataEl);
+
+  const title = (lowerMap.get('title') || textContent(select('h1', tree)).trim() || '').trim();
+  let description = (lowerMap.get('description') || firstParagraphText(tree) || '').trim();
+  description = truncateWithEllipsis(description, 200);
+  const image = (lowerMap.get('image') || lowerMap.get('og image') || firstImgSrc(tree) || '').trim();
+
+  /** @type {string[]} */
+  const seoLines = [];
+
+  if (description) {
+    const e = escapeHtmlAttr(description);
+    seoLines.push(``);
+    seoLines.push(``);
+    seoLines.push(``);
+  }
+
+  if (title) {
+    const e = escapeHtmlAttr(title);
+    seoLines.push(``);
+    seoLines.push(``);
+  }
+
+  if (absolutePageUrl) {
+    seoLines.push(``);
+  }
+
+  if (image) {
+    const e = escapeHtmlAttr(image);
+    const alt = escapeHtmlAttr(title || 'image');
+    seoLines.push(``);
+    seoLines.push(``);
+    seoLines.push(``);
+    seoLines.push('');
+    seoLines.push(``);
+  } else {
+    seoLines.push('');
+  }
+
+  /** @type {string[]} */
+  const pairLines = [];
+  for (const [label, value] of pairs) {
+    const key = label.toLowerCase().trim();
+    if (SEO_LABEL_SKIP.has(key)) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    const slug = slugifyMetadataLabel(label);
+    if (!slug || value === undefined) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    pairLines.push(
+      ``,
+    );
+  }
+
+  // SEO first, then sheet (fields not overridden by local pairs), then local page metadata
+  const allLines = [...seoLines, ...sheetLines, ...pairLines];
+  const htmlOut = toHtml(tree);
+  return { htmlFragment: htmlOut, metaTagsHtml: joinLines(allLines) };
+}
diff --git a/src/content/content-shared.js b/src/content/content-shared.js
new file mode 100644
index 000000000..e34ffd84c
--- /dev/null
+++ b/src/content/content-shared.js
@@ -0,0 +1,44 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+export const CONTENT_DIR = 'content';
+export const CONFIG_FILE = '.da-config.json';
+export const GIT_AUTHOR = { name: 'aem-cli', email: 'aem-cli@adobe.com' };
+
+/** Above this count, clone warns and requires confirmation (or --yes). */
+export const LARGE_CLONE_FILE_THRESHOLD = 10000;
+
+/**
+ * Parallelism for da.live I/O: recursive list fan-out, clone downloads, push uploads/deletes.
+ */
+export const CONTENT_IO_CONCURRENCY = 10;
+
+/**
+ * Normalizes a da.live path: leading slash, no trailing slash except root.
+ * @param {string} input
+ * @returns {string}
+ * @throws {Error} if input is null, undefined, or empty
+ */
+export function normalizeDaPath(input) {
+  if (input === undefined || input === null) {
+    throw new Error('Content path is required.');
+  }
+  let s = String(input).trim();
+  if (s === '') {
+    throw new Error('Content path cannot be empty.');
+  }
+  if (!s.startsWith('/')) {
+    s = `/${s}`;
+  }
+  s = s.replace(/\/+$/, '') || '/';
+  return s;
+}
diff --git a/src/content/content.js b/src/content/content.js
new file mode 100644
index 000000000..193fea226
--- /dev/null
+++ b/src/content/content.js
@@ -0,0 +1,38 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import clone from './clone.js';
+import add from './add.js';
+import commit from './commit.js';
+import push from './push.js';
+import status from './status.js';
+import diff from './diff.js';
+import mergeCmd from './merge.js';
+
+export default function content() {
+  return {
+    command: 'content',
+    description: 'Manage AEM content from da.live',
+    builder: (yargs) => {
+      yargs
+        .command(clone())
+        .command(add())
+        .command(commit())
+        .command(push())
+        .command(status())
+        .command(diff())
+        .command(mergeCmd())
+        .demandCommand(1, 'You need at least one content subcommand.')
+        .help();
+    },
+    handler: () => {},
+  };
+}
diff --git a/src/content/da-api.js b/src/content/da-api.js
new file mode 100644
index 000000000..8d697c40f
--- /dev/null
+++ b/src/content/da-api.js
@@ -0,0 +1,198 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import mime from 'mime';
+import processQueue from '@adobe/helix-shared-process-queue';
+import { getFetch } from '../fetch-utils.js';
+import { CONTENT_IO_CONCURRENCY } from './content-shared.js';
+
+const DA_ADMIN = 'https://admin.da.live';
+
+/** Response header used to page past the per-request list limit (e.g. 1000 items). */
+const LIST_CONTINUATION_HEADER = 'da-continuation-token';
+
+/** Safety cap on list pages per directory (avoids infinite loops if the API misbehaves). */
+const LIST_MAX_PAGES = 50000;
+
+export function getContentType(ext) {
+  return mime.getType(ext) || 'application/octet-stream';
+}
+
+export class DaClient {
+  constructor(token) {
+    this.token = token;
+    this.fetch = getFetch(false);
+  }
+
+  get authHeader() {
+    return { Authorization: `Bearer ${this.token}` };
+  }
+
+  /**
+   * Lists the contents of a directory, following {@link LIST_CONTINUATION_HEADER} until complete.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} daPath - path starting with /
+   * @returns {Promise>}
+   */
+  async list(org, repo, daPath) {
+    const url = `${DA_ADMIN}/list/${org}/${repo}${daPath}`;
+    const aggregated = [];
+    let continuation = null;
+
+    for (let page = 0; page < LIST_MAX_PAGES; page += 1) {
+      const headers = { ...this.authHeader };
+      if (continuation) {
+        headers[LIST_CONTINUATION_HEADER] = continuation;
+      }
+      // eslint-disable-next-line no-await-in-loop
+      const res = await this.fetch(url, { headers });
+      if (res.status === 401) {
+        throw new Error('Unauthorized: invalid or missing token');
+      }
+      if (!res.ok) {
+        throw new Error(`List failed for ${daPath}: ${res.status} ${res.statusText}`);
+      }
+      // eslint-disable-next-line no-await-in-loop
+      const body = await res.json();
+      if (!Array.isArray(body)) {
+        throw new Error(`List response for ${daPath} must be a JSON array`);
+      }
+      aggregated.push(...body);
+
+      const next = res.headers.get(LIST_CONTINUATION_HEADER);
+      if (!next || next === continuation) {
+        return aggregated;
+      }
+      continuation = next;
+    }
+
+    return aggregated;
+  }
+
+  /**
+   * Recursively lists all files under a path using a non-recursive queue-based approach.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} [daPath='/']
+   * @param {(discoveredCount: number) => void} [onDiscovered] - cumulative file count per discovery
+   * @returns {Promise>}
+   */
+  async listAll(org, repo, daPath = '/', onDiscovered = undefined) {
+    const prefix = `/${org}/${repo}`;
+    const files = [];
+    let dirsToProcess = [daPath];
+
+    while (dirsToProcess.length > 0) {
+      const nextDirs = [];
+      // eslint-disable-next-line no-await-in-loop
+      await processQueue(
+        dirsToProcess,
+        async (currentPath) => {
+          const items = await this.list(org, repo, currentPath);
+          for (const item of items) {
+            if (item.ext !== undefined) {
+              files.push(item);
+              if (onDiscovered) {
+                onDiscovered(files.length);
+              }
+            } else {
+              nextDirs.push(item.path.replace(prefix, '') || '/');
+            }
+          }
+        },
+        CONTENT_IO_CONCURRENCY,
+      );
+      dirsToProcess = nextDirs;
+    }
+
+    return files;
+  }
+
+  /**
+   * Fetches the raw content of a file.
+   * @returns {Promise}
+   */
+  async getSource(org, repo, daPath) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, { headers: this.authHeader });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    if (res.status === 404) {
+      return null;
+    }
+    if (!res.ok) {
+      throw new Error(`GET failed for ${daPath}: ${res.status} ${res.statusText}`);
+    }
+    return res;
+  }
+
+  /**
+   * Uploads a file via PUT.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} daPath
+   * @param {Buffer} buffer
+   * @param {string} contentType
+   * @returns {Promise} API response body
+   */
+  async putSource(org, repo, daPath, buffer, contentType) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, {
+      method: 'PUT',
+      headers: { ...this.authHeader, 'Content-Type': contentType },
+      body: buffer,
+    });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    if (!res.ok) {
+      throw new Error(`PUT failed for ${daPath}: ${res.status} ${res.statusText}`);
+    }
+    return res.json();
+  }
+
+  /**
+   * Deletes a file or folder. Idempotent.
+   */
+  async deleteSource(org, repo, daPath) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, {
+      method: 'DELETE',
+      headers: this.authHeader,
+    });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    return res.ok || res.status === 204;
+  }
+
+  /**
+   * Returns the current lastModified for a file via a HEAD request.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} daPath - e.g. /blog/post.html
+   * @returns {Promise}
+   */
+  async getRemoteLastModified(org, repo, daPath) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, { method: 'HEAD', headers: this.authHeader });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    if (!res.ok) {
+      return null;
+    }
+    const lastModified = res.headers.get('last-modified');
+    return lastModified ? new Date(lastModified).getTime() : null;
+  }
+}
diff --git a/src/content/da-auth.js b/src/content/da-auth.js
new file mode 100644
index 000000000..10fdf4d02
--- /dev/null
+++ b/src/content/da-auth.js
@@ -0,0 +1,209 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import http from 'http';
+import path from 'path';
+import fse from 'fs-extra';
+import open from 'open';
+import { ensureGitIgnored } from './content-git.js';
+
+const IMS_ORIGIN = 'https://ims-na1.adobelogin.com';
+const CLIENT_ID = 'darkalley';
+const SCOPE = 'ab.manage,AdobeID,gnav,openid,org.read,read_organizations,session,aem.frontend.all,additional_info.ownerOrg,additional_info.projectedProductContext,account_cluster.read';
+const CALLBACK_PORT = 9898;
+const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/callback`;
+
+/** Token file stored in the project's .hlx folder, alongside the site token. */
+export const DA_TOKEN_FILE = path.join('.hlx', '.da-token.json');
+
+// ─── Token storage ───────────────────────────────────────────────────────────
+
+async function loadStoredToken(tokenFile) {
+  if (!await fse.pathExists(tokenFile)) {
+    return null;
+  }
+  try {
+    return await fse.readJson(tokenFile);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Saves the DA token to the project's .hlx folder and ensures the file is git-ignored,
+ * following the same pattern as saveSiteTokenToFile in config-utils.js.
+ * @param {string} projectDir
+ * @param {object} tokenData
+ */
+async function saveDaTokenToFile(projectDir, tokenData) {
+  const tokenFile = path.join(projectDir, DA_TOKEN_FILE);
+  await fse.ensureDir(path.dirname(tokenFile));
+  await fse.writeJson(tokenFile, tokenData, { spaces: 2 });
+
+  await ensureGitIgnored(projectDir, DA_TOKEN_FILE);
+}
+
+// ─── Token validity ──────────────────────────────────────────────────────────
+
+function isTokenExpired(stored) {
+  if (stored.expires_at) {
+    // 60 second early buffer for clock skew
+    return Date.now() >= (stored.expires_at - 60_000);
+  }
+  // legacy stored tokens without expires_at — treat as expired
+  return true;
+}
+
+// ─── OAuth flow ──────────────────────────────────────────────────────────────
+
+/**
+ * Starts a local HTTP server that handles the implicit flow callback.
+ *
+ * IMS redirects to http://localhost:{port}/callback#access_token=TOKEN
+ * The fragment never reaches the server, so /callback serves a tiny HTML page
+ * that reads the fragment via JS and forwards the token to /token, then
+ * redirects the browser to https://tools.aem.live/cli/logged-in on success.
+ *
+ * @returns {Promise<{token: string, expiresIn: number|null}>}
+ */
+function waitForToken() {
+  return new Promise((resolve, reject) => {
+    let timeout;
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
+
+      // Step 1: IMS lands here with the token in the fragment.
+      // Serve a page that extracts it and calls /token.
+      if (url.pathname === '/callback') {
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(`Logging in...
+`);
+        return;
+      }
+
+      // Step 2: the page above calls /token with the token as a query param.
+      if (url.pathname === '/token') {
+        const token = url.searchParams.get('access_token');
+        const expiresIn = url.searchParams.get('expires_in');
+        const error = url.searchParams.get('error');
+        res.writeHead(200);
+        res.end();
+        clearTimeout(timeout);
+        server.close();
+        if (token) {
+          resolve({ token, expiresIn: expiresIn ? parseInt(expiresIn, 10) : null });
+        } else {
+          reject(new Error(`Login failed: ${error || 'unknown error'}`));
+        }
+        return;
+      }
+
+      res.writeHead(404);
+      res.end();
+    });
+
+    server.listen(CALLBACK_PORT, 'localhost');
+    server.on('error', (err) => reject(new Error(`Could not start callback server on port ${CALLBACK_PORT}: ${err.message}`)));
+
+    timeout = setTimeout(() => {
+      server.close();
+      reject(new Error('Login timed out (5 minutes). Please try again.'));
+    }, 5 * 60 * 1000);
+  });
+}
+
+/**
+ * Runs the implicit OAuth login flow.
+ * @param {object} log
+ * @param {string} projectDir
+ * @returns {Promise} access token
+ */
+async function login(log, projectDir) {
+  const params = new URLSearchParams({
+    response_type: 'token',
+    client_id: CLIENT_ID,
+    scope: SCOPE,
+    redirect_uri: REDIRECT_URI,
+  });
+  const authUrl = `${IMS_ORIGIN}/ims/authorize/v2?${params}`;
+
+  log.info('Opening browser for da.live login...');
+  log.info(`If the browser does not open automatically, visit:\n  ${authUrl}\n`);
+  log.info('Waiting for login to complete...');
+
+  await open(authUrl);
+
+  const { token, expiresIn } = await waitForToken();
+
+  await saveDaTokenToFile(projectDir, {
+    access_token: token,
+    expires_at: expiresIn ? Date.now() + (expiresIn * 1000) : null,
+  });
+
+  log.info(`Login successful. Token saved to ${path.join(projectDir, DA_TOKEN_FILE)}`);
+  return token;
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Returns a valid da.live access token. Triggers browser login if needed.
+ *
+ * Priority:
+ *  1. Caller-supplied token (--token flag) — used as-is, not persisted
+ *  2. Stored token in .hlx/.da-token.json that is still valid
+ *  3. Full browser implicit login flow
+ *
+ * @param {object} log
+ * @param {string} [override] token supplied via CLI --token flag
+ * @param {string} projectDir project root directory (token stored in .hlx/ here)
+ * @returns {Promise} valid access token
+ */
+export async function getValidToken(log, override, projectDir) {
+  if (override) {
+    return override;
+  }
+
+  const tokenFile = path.join(projectDir, DA_TOKEN_FILE);
+  const stored = await loadStoredToken(tokenFile);
+
+  if (stored?.access_token && !isTokenExpired(stored)) {
+    return stored.access_token;
+  }
+
+  if (stored?.access_token) {
+    log.info('Stored token has expired. Re-authenticating...');
+  }
+
+  return login(log, projectDir);
+}
diff --git a/src/content/diff.cmd.js b/src/content/diff.cmd.js
new file mode 100644
index 000000000..e915a4a28
--- /dev/null
+++ b/src/content/diff.cmd.js
@@ -0,0 +1,123 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { createTwoFilesPatch } from 'diff';
+import chalk from 'chalk-template';
+import { DaClient } from './da-api.js';
+import { getValidToken } from './da-auth.js';
+import { CONTENT_DIR, CONFIG_FILE } from './content-shared.js';
+
+function printPatch(patch) {
+  for (const line of patch.split('\n')) {
+    if (line.startsWith('+++') || line.startsWith('---')) {
+      process.stdout.write(chalk`{bold ${line}}\n`);
+    } else if (line.startsWith('@@')) {
+      process.stdout.write(chalk`{cyan ${line}}\n`);
+    } else if (line.startsWith('+')) {
+      process.stdout.write(chalk`{green ${line}}\n`);
+    } else if (line.startsWith('-')) {
+      process.stdout.write(chalk`{red ${line}}\n`);
+    } else {
+      process.stdout.write(`${line}\n`);
+    }
+  }
+}
+
+export default class DiffCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+    this._filePath = null;
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  withToken(token) {
+    this._token = token;
+    return this;
+  }
+
+  withFilePath(filePath) {
+    this._filePath = filePath || null;
+    return this;
+  }
+
+  async run() {
+    const { log } = this;
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    const configPath = path.join(contentDir, CONFIG_FILE);
+
+    if (!await fse.pathExists(configPath)) {
+      throw new Error('No config found. Run \'aem content clone\' first.');
+    }
+    const { org, repo } = await fse.readJson(configPath);
+
+    const matrix = await git.statusMatrix({ fs, dir: contentDir });
+    let changedPaths = matrix
+      .filter(([, head, workdir]) => (head === 0 && workdir === 2)
+        || (head === 1 && workdir === 2)
+        || (head === 1 && workdir === 0))
+      .map(([filepath]) => `/${filepath}`);
+
+    if (this._filePath) {
+      const needle = this._filePath.startsWith('/') ? this._filePath : `/${this._filePath}`;
+      changedPaths = changedPaths.filter((p) => p === needle);
+      if (changedPaths.length === 0) {
+        log.info(`No local changes detected for ${needle}`);
+        return;
+      }
+    }
+
+    if (changedPaths.length === 0) {
+      log.info('Nothing to diff. No local changes vs last commit.');
+      return;
+    }
+
+    const token = await getValidToken(log, this._token, this._dir);
+    const client = new DaClient(token);
+
+    await Promise.all(changedPaths.map(async (daPath) => {
+      const localPath = path.join(contentDir, ...daPath.split('/').filter(Boolean));
+
+      const localBuffer = await fse.pathExists(localPath)
+        ? await fse.readFile(localPath)
+        : Buffer.from('');
+
+      const remoteRes = await client.getSource(org, repo, daPath);
+
+      const localText = localBuffer.toString('utf-8');
+      const remoteText = remoteRes ? await remoteRes.text() : '';
+
+      const patch = createTwoFilesPatch(
+        `a${daPath}`,
+        `b${daPath}`,
+        remoteText,
+        localText,
+        '',
+        '',
+        { context: 3 },
+      );
+
+      if (!patch.includes('\n@@')) {
+        return;
+      }
+
+      printPatch(patch);
+    }));
+  }
+}
diff --git a/src/content/diff.js b/src/content/diff.js
new file mode 100644
index 000000000..a2918b64f
--- /dev/null
+++ b/src/content/diff.js
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+
+export default function diff() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'diff [path]',
+    description: 'Show diff between local and remote content',
+    builder: (yargs) => {
+      yargs
+        .positional('path', {
+          describe: 'File to diff (e.g. /blog/post.html). Diffs all modified files if omitted.',
+          type: 'string',
+        })
+        .option('token', {
+          describe: 'IMS Bearer token for da.live authentication',
+          type: 'string',
+        })
+        .help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const DiffCommand = (await import('./diff.cmd.js')).default;
+        executor = new DiffCommand(getOrCreateLogger(argv));
+      }
+      await executor
+        .withToken(argv.token)
+        .withFilePath(argv.path)
+        .run();
+    },
+  };
+}
diff --git a/src/content/merge.cmd.js b/src/content/merge.cmd.js
new file mode 100644
index 000000000..181b56eef
--- /dev/null
+++ b/src/content/merge.cmd.js
@@ -0,0 +1,150 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { diff3Merge } from 'node-diff3'; // eslint-disable-line import/no-unresolved
+import { DaClient } from './da-api.js';
+import { getValidToken } from './da-auth.js';
+import { CONTENT_DIR, CONFIG_FILE } from './content-shared.js';
+
+/**
+ * 3-way merge using diff3 algorithm.
+ * Returns { text, conflict }.
+ */
+function threeWayMerge(base, local, remote) {
+  const baseLines = base.split('\n');
+  const localLines = local.split('\n');
+  const remoteLines = remote.split('\n');
+
+  const regions = diff3Merge(localLines, baseLines, remoteLines);
+
+  const out = [];
+  let hasConflict = false;
+
+  for (const region of regions) {
+    if (region.ok) {
+      out.push(...region.ok);
+    } else {
+      out.push('<<<<<<< LOCAL', ...region.conflict.a, '=======', ...region.conflict.b, '>>>>>>> REMOTE');
+      hasConflict = true;
+    }
+  }
+
+  return { text: out.join('\n'), conflict: hasConflict };
+}
+
+export default class MergeCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+    this._filePath = null;
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  withToken(token) {
+    this._token = token;
+    return this;
+  }
+
+  withFilePath(filePath) {
+    this._filePath = filePath || null;
+    return this;
+  }
+
+  async run() {
+    const { log } = this;
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    const configPath = path.join(contentDir, CONFIG_FILE);
+
+    if (!await fse.pathExists(configPath)) {
+      throw new Error('No config found. Run \'aem content clone\' first.');
+    }
+    const { org, repo } = await fse.readJson(configPath);
+
+    // Find locally changed files via git
+    const matrix = await git.statusMatrix({ fs, dir: contentDir });
+    let changedPaths = matrix
+      .filter(([, head, workdir]) => head === 1 && workdir === 2)
+      .map(([filepath]) => `/${filepath}`);
+
+    if (this._filePath) {
+      const needle = this._filePath.startsWith('/') ? this._filePath : `/${this._filePath}`;
+      changedPaths = changedPaths.filter((p) => p === needle);
+      if (changedPaths.length === 0) {
+        log.info(`No local changes detected for ${needle}`);
+        return;
+      }
+    }
+
+    if (changedPaths.length === 0) {
+      log.info('Nothing to merge. No locally modified files.');
+      return;
+    }
+
+    const token = await getValidToken(log, this._token, contentDir);
+    const client = new DaClient(token);
+
+    // Get the HEAD commit to read base blobs
+    const [headCommit] = await git.log({ fs, dir: contentDir, depth: 1 });
+
+    let cleanCount = 0;
+    let conflictCount = 0;
+
+    for (const daPath of changedPaths) {
+      const relPath = daPath.slice(1); // strip leading /
+      const localPath = path.join(contentDir, ...daPath.split('/').filter(Boolean));
+
+      // eslint-disable-next-line no-await-in-loop
+      const [localBuffer, remoteRes, blobResult] = await Promise.all([
+        fse.readFile(localPath),
+        client.getSource(org, repo, daPath),
+        git.readBlob({
+          fs, dir: contentDir, oid: headCommit.oid, filepath: relPath,
+        })
+          .catch(() => null),
+      ]);
+
+      const localText = localBuffer.toString('utf-8');
+      // eslint-disable-next-line no-await-in-loop
+      const remoteText = remoteRes ? await remoteRes.text() : '';
+      const baseText = blobResult ? Buffer.from(blobResult.blob).toString('utf-8') : '';
+
+      const { text: merged, conflict } = threeWayMerge(baseText, localText, remoteText);
+
+      // eslint-disable-next-line no-await-in-loop
+      await fse.writeFile(localPath, merged, 'utf-8');
+
+      if (conflict) {
+        log.info(`CONFLICT ${daPath}`);
+        conflictCount += 1;
+      } else {
+        log.info(`merged  ${daPath}`);
+        cleanCount += 1;
+      }
+    }
+
+    log.info('');
+    if (conflictCount > 0) {
+      log.info(`Merge complete: ${cleanCount} clean, ${conflictCount} with conflicts.`);
+      log.info('Resolve conflicts manually, then: aem content add, aem content commit -m "...", aem content push');
+    } else {
+      log.info(`Merge complete: ${cleanCount} file(s) merged cleanly.`);
+      log.info('Review changes, then: aem content add, aem content commit -m "...", aem content push');
+    }
+  }
+}
diff --git a/src/content/merge.js b/src/content/merge.js
new file mode 100644
index 000000000..d2f4ea79d
--- /dev/null
+++ b/src/content/merge.js
@@ -0,0 +1,45 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+
+export default function mergeCmd() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'merge [path]',
+    description: 'Merge remote content into local files',
+    builder: (yargs) => {
+      yargs
+        .positional('path', {
+          describe: 'File to merge (e.g. /blog/post.html). Merges all modified files if omitted.',
+          type: 'string',
+        })
+        .option('token', {
+          describe: 'IMS Bearer token for da.live authentication',
+          type: 'string',
+        })
+        .help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const MergeCommand = (await import('./merge.cmd.js')).default;
+        executor = new MergeCommand(getOrCreateLogger(argv));
+      }
+      await executor
+        .withToken(argv.token)
+        .withFilePath(argv.path)
+        .run();
+    },
+  };
+}
diff --git a/src/content/push.cmd.js b/src/content/push.cmd.js
new file mode 100644
index 000000000..1df7aafc5
--- /dev/null
+++ b/src/content/push.cmd.js
@@ -0,0 +1,291 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import processQueue from '@adobe/helix-shared-process-queue';
+import { DaClient, getContentType } from './da-api.js';
+import { getValidToken } from './da-auth.js';
+import {
+  CONTENT_DIR,
+  CONFIG_FILE,
+  CONTENT_IO_CONCURRENCY,
+} from './content-shared.js';
+import {
+  resolveSyncedOid,
+  writeSyncedRef,
+  statusMatrixHasUncommitted,
+  diffCommitTrees,
+  getCommitCommitterTimeMs,
+} from './content-git.js';
+
+export default class PushCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+    this._force = false;
+    this._dryRun = false;
+    this._pushPath = null;
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  withToken(token) {
+    this._token = token;
+    return this;
+  }
+
+  withForce(force) {
+    this._force = force;
+    return this;
+  }
+
+  withDryRun(dryRun) {
+    this._dryRun = dryRun;
+    return this;
+  }
+
+  withPath(pushPath) {
+    this._pushPath = pushPath || null;
+    return this;
+  }
+
+  /**
+   * Checks for conflicts between local changes and remote modifications.
+   * @param {DaClient} client
+   * @param {string} org
+   * @param {string} repo
+   * @param {string[]} modified
+   * @param {string[]} deleted
+   * @param {number} lastSyncTime
+   * @returns {Promise} true if the push should be aborted
+   */
+  async _checkConflicts(client, org, repo, modified, deleted, lastSyncTime) {
+    const { log } = this;
+    const conflicts = [];
+
+    for (const daPath of [...modified, ...deleted]) {
+      // eslint-disable-next-line no-await-in-loop
+      const remoteLastModified = await client.getRemoteLastModified(org, repo, daPath);
+      if (remoteLastModified != null && remoteLastModified > lastSyncTime) {
+        conflicts.push({ daPath, remoteDate: new Date(remoteLastModified).toLocaleString() });
+      }
+    }
+
+    if (conflicts.length > 0) {
+      log.warn('\nConflicts detected — remote files were modified after your last sync:\n');
+      for (const { daPath, remoteDate } of conflicts) {
+        log.warn(`  ✗ ${daPath}  (remote modified ${remoteDate})`);
+      }
+      if (!this._force) {
+        log.warn('\nPush aborted. Use --force to overwrite remote changes.');
+        process.exitCode = 1;
+        return true;
+      }
+      log.warn('\n--force specified: overwriting remote changes.');
+    }
+
+    return false;
+  }
+
+  /**
+   * Uploads added and modified files to da.live.
+   * @param {DaClient} client
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} contentDir
+   * @param {string[]} targets
+   * @returns {Promise<{ pushed: number, errors: number, successfullyPushed: Set }>}
+   */
+  async _uploadFiles(client, org, repo, contentDir, targets) {
+    const { log } = this;
+    let pushed = 0;
+    let errors = 0;
+    const successfullyPushed = new Set();
+
+    const results = await processQueue(
+      targets,
+      async (daPath) => {
+        const localPath = path.join(contentDir, ...daPath.split('/').filter(Boolean));
+        const ext = daPath.split('.').pop();
+        try {
+          const buffer = await fse.readFile(localPath);
+          await client.putSource(org, repo, daPath, buffer, getContentType(ext));
+          log.info(`  ✓ ${daPath}`);
+          return { ok: true, daPath };
+        } catch (err) {
+          log.warn(`  ✗ ${daPath}: ${err.message}`);
+          return { ok: false };
+        }
+      },
+      CONTENT_IO_CONCURRENCY,
+    );
+    for (const r of results) {
+      if (r.ok) {
+        pushed += 1;
+        successfullyPushed.add(r.daPath);
+      } else {
+        errors += 1;
+      }
+    }
+
+    return { pushed, errors, successfullyPushed };
+  }
+
+  /**
+   * Deletes files from da.live.
+   * @param {DaClient} client
+   * @param {string} org
+   * @param {string} repo
+   * @param {string[]} deleted
+   * @returns {Promise<{ pushed: number, errors: number, successfullyDeleted: Set }>}
+   */
+  async _deleteFiles(client, org, repo, deleted) {
+    const { log } = this;
+    let pushed = 0;
+    let errors = 0;
+    const successfullyDeleted = new Set();
+
+    const results = await processQueue(
+      deleted,
+      async (daPath) => {
+        try {
+          await client.deleteSource(org, repo, daPath);
+          log.info(`  ✓ deleted ${daPath}`);
+          return { ok: true, daPath };
+        } catch (err) {
+          log.warn(`  ✗ ${daPath}: ${err.message}`);
+          return { ok: false };
+        }
+      },
+      CONTENT_IO_CONCURRENCY,
+    );
+    for (const r of results) {
+      if (r.ok) {
+        pushed += 1;
+        successfullyDeleted.add(r.daPath);
+      } else {
+        errors += 1;
+      }
+    }
+
+    return { pushed, errors, successfullyDeleted };
+  }
+
+  async run() {
+    const { log } = this;
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    const configPath = path.join(contentDir, CONFIG_FILE);
+
+    if (!await fse.pathExists(configPath)) {
+      throw new Error(`No config found at ${configPath}. Run 'aem content clone' first.`);
+    }
+    const { org, repo } = await fse.readJson(configPath);
+
+    const matrix = await git.statusMatrix({ fs, dir: contentDir });
+    if (statusMatrixHasUncommitted(matrix)) {
+      throw new Error(
+        'Cannot push: you have uncommitted changes in content/. '
+        + 'Stage with \'aem content add\' and commit with \'aem content commit -m "..."\'.',
+      );
+    }
+
+    const headOid = await git.resolveRef({ fs, dir: contentDir, ref: 'HEAD' });
+    const syncedOid = await resolveSyncedOid(fs, contentDir);
+    const lastSyncTime = await getCommitCommitterTimeMs(fs, contentDir, syncedOid);
+
+    let { added, modified, deleted } = await diffCommitTrees(fs, contentDir, syncedOid, headOid);
+
+    const inScope = (daPath) => !this._pushPath || daPath.startsWith(this._pushPath);
+    added = added.filter(inScope);
+    modified = modified.filter(inScope);
+    deleted = deleted.filter(inScope);
+
+    if (added.length === 0 && modified.length === 0 && deleted.length === 0) {
+      log.info('Nothing to push. No commits ahead of the last da.live sync.');
+      return;
+    }
+
+    const token = await getValidToken(log, this._token, this._dir);
+
+    log.info(`Pushing content to da.live: ${org}/${repo}`);
+    log.info(`${added.length} added, ${modified.length} modified, ${deleted.length} deleted`);
+
+    const client = new DaClient(token);
+
+    const shouldAbort = await this._checkConflicts(
+      client,
+      org,
+      repo,
+      modified,
+      deleted,
+      lastSyncTime,
+    );
+    if (shouldAbort) {
+      return;
+    }
+
+    if (this._dryRun) {
+      log.info('\nDry run — no files were pushed.');
+      if (added.length) {
+        log.info('\nWould add:');
+        for (const p of added) {
+          log.info(`  + ${p}`);
+        }
+      }
+      if (modified.length) {
+        log.info('\nWould update:');
+        for (const p of modified) {
+          log.info(`  ~ ${p}`);
+        }
+      }
+      if (deleted.length) {
+        log.info('\nWould delete:');
+        for (const p of deleted) {
+          log.info(`  - ${p}`);
+        }
+      }
+      return;
+    }
+
+    const putTargets = [...added, ...modified];
+    const {
+      pushed: putPushed,
+      errors: putErrors,
+      successfullyPushed,
+    } = await this._uploadFiles(client, org, repo, contentDir, putTargets);
+
+    const {
+      pushed: deletePushed,
+      errors: deleteErrors,
+      successfullyDeleted,
+    } = await this._deleteFiles(client, org, repo, deleted);
+
+    const pushed = putPushed + deletePushed;
+    const pushErrors = putErrors + deleteErrors;
+
+    const allPutsOk = putTargets.every((p) => successfullyPushed.has(p));
+    const allDeletesOk = deleted.every((p) => successfullyDeleted.has(p));
+
+    if (allPutsOk && allDeletesOk) {
+      await writeSyncedRef(fs, contentDir, headOid);
+    } else {
+      log.warn('\nSync ref not updated: fix errors and push again to finish syncing this commit.');
+    }
+
+    log.info(`\nDone. ${pushed} file(s) pushed${pushErrors > 0 ? `, ${pushErrors} error(s)` : ''}.`);
+  }
+}
diff --git a/src/content/push.js b/src/content/push.js
new file mode 100644
index 000000000..a11b16407
--- /dev/null
+++ b/src/content/push.js
@@ -0,0 +1,58 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+
+export default function push() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'push',
+    description: 'Push committed content/ changes to da.live (use content add & content commit first)',
+    builder: (yargs) => {
+      yargs
+        .option('token', {
+          describe: 'IMS Bearer token for da.live authentication',
+          type: 'string',
+        })
+        .option('path', {
+          describe: 'Push only a specific file or subtree (e.g. /blog)',
+          type: 'string',
+        })
+        .option('force', {
+          describe: 'Overwrite remote changes even when conflicts are detected',
+          type: 'boolean',
+          default: false,
+        })
+        .option('dry-run', {
+          alias: 'dryRun',
+          describe: 'Show what would be pushed without actually pushing',
+          type: 'boolean',
+          default: false,
+        })
+        .help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const PushCommand = (await import('./push.cmd.js')).default;
+        executor = new PushCommand(getOrCreateLogger(argv));
+      }
+      await executor
+        .withToken(argv.token)
+        .withPath(argv.path)
+        .withForce(argv.force)
+        .withDryRun(argv.dryRun)
+        .run();
+    },
+  };
+}
diff --git a/src/content/status.cmd.js b/src/content/status.cmd.js
new file mode 100644
index 000000000..911661f84
--- /dev/null
+++ b/src/content/status.cmd.js
@@ -0,0 +1,94 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { CONTENT_DIR, CONFIG_FILE } from './content-shared.js';
+import { resolveSyncedOid, countCommitsAhead } from './content-git.js';
+
+export default class StatusCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  async run() {
+    const { log } = this;
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    const configPath = path.join(contentDir, CONFIG_FILE);
+
+    if (!await fse.pathExists(configPath)) {
+      throw new Error('No config found. Run \'aem content clone\' first.');
+    }
+    const { org, repo } = await fse.readJson(configPath);
+
+    log.info(`On da.live: ${org}/${repo}`);
+    log.info(`Local content: ./${CONTENT_DIR}/\n`);
+
+    const matrix = await git.statusMatrix({ fs, dir: contentDir });
+
+    const added = [];
+    const modified = [];
+    const deleted = [];
+
+    for (const [filepath, head, workdir] of matrix) {
+      if (head === 0 && workdir === 2) {
+        added.push(filepath);
+      } else if (head === 1 && workdir === 2) {
+        modified.push(filepath);
+      } else if (head === 1 && workdir === 0) {
+        deleted.push(filepath);
+      }
+    }
+
+    const headOid = await git.resolveRef({ fs, dir: contentDir, ref: 'HEAD' });
+    const syncedOid = await resolveSyncedOid(fs, contentDir);
+    const ahead = await countCommitsAhead(fs, contentDir, headOid, syncedOid);
+
+    if (added.length === 0 && modified.length === 0 && deleted.length === 0) {
+      log.info('No uncommitted changes in content/.');
+      if (ahead === 0) {
+        log.info('Nothing to push to da.live.');
+      } else {
+        log.info(`${ahead} commit(s) not yet pushed to da.live. Run 'aem content push'.`);
+      }
+      return;
+    }
+
+    if (added.length) {
+      log.info('Added (unstaged or not committed):');
+      for (const f of added) {
+        log.info(`  A  /${f}`);
+      }
+    }
+    if (modified.length) {
+      log.info('Modified (unstaged or not committed):');
+      for (const f of modified) {
+        log.info(`  M  /${f}`);
+      }
+    }
+    if (deleted.length) {
+      log.info('Deleted (unstaged or not committed):');
+      for (const f of deleted) {
+        log.info(`  D  /${f}`);
+      }
+    }
+
+    log.info(`\n${added.length} added, ${modified.length} modified, ${deleted.length} deleted`);
+  }
+}
diff --git a/src/content/status.js b/src/content/status.js
new file mode 100644
index 000000000..33e3e9d93
--- /dev/null
+++ b/src/content/status.js
@@ -0,0 +1,33 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+
+export default function status() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'status',
+    description: 'Show locally added, modified, and deleted content files',
+    builder: (yargs) => {
+      yargs.help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const StatusCommand = (await import('./status.cmd.js')).default;
+        executor = new StatusCommand(getOrCreateLogger(argv));
+      }
+      await executor.run();
+    },
+  };
+}
diff --git a/src/server/BaseServer.js b/src/server/BaseServer.js
index 5db23b651..29166f5e7 100644
--- a/src/server/BaseServer.js
+++ b/src/server/BaseServer.js
@@ -10,10 +10,13 @@
  * governing permissions and limitations under the License.
  */
 import https from 'https';
+import { existsSync } from 'fs';
+import path from 'path';
 import EventEmitter from 'events';
 import express from 'express';
 import cookieParser from 'cookie-parser';
 import { getFetch } from '../fetch-utils.js';
+import { CONTENT_DIR } from '../content/content-shared.js';
 import utils from './utils.js';
 import packageJson from '../package.cjs';
 
@@ -155,7 +158,12 @@ export class BaseServer extends EventEmitter {
         this._addr = this._server.address().address;
         log.info(`Local AEM dev server up and running: ${this.scheme}://${this.hostname}:${this.port}/`);
         if (this._project.proxyUrl) {
-          log.info(`Enabled reverse proxy to ${this._project.proxyUrl}`);
+          const contentDir = path.join(this._project.directory, CONTENT_DIR);
+          if (existsSync(contentDir)) {
+            log.info(`Serving content from local ${CONTENT_DIR}/, proxying missing files from ${this._project.proxyUrl}`);
+          } else {
+            log.info(`Enabled reverse proxy to ${this._project.proxyUrl}`);
+          }
         }
         this._server.on('connection', (socket) => {
           log.debug(`new connection from ${socket.remoteAddress}:${socket.remotePort}`);
diff --git a/src/server/HelixProject.js b/src/server/HelixProject.js
index 03af7aac4..e4c195ffb 100644
--- a/src/server/HelixProject.js
+++ b/src/server/HelixProject.js
@@ -15,6 +15,7 @@ import { IgnoreConfig } from '@adobe/helix-shared-config';
 import { HelixServer } from './HelixServer.js';
 import { BaseProject } from './BaseProject.js';
 import HeadHtmlSupport from './HeadHtmlSupport.js';
+import MetadataSheetSupport from './MetadataSheetSupport.js';
 import Indexer from './Indexer.js';
 
 export class HelixProject extends BaseProject {
@@ -22,6 +23,7 @@ export class HelixProject extends BaseProject {
     super(HelixServer);
     this._proxyUrl = null;
     this._headHtml = null;
+    this._metadataSheet = null;
     this._indexer = null;
     this._printIndex = false;
     this._allowInsecure = false;
@@ -42,6 +44,7 @@ export class HelixProject extends BaseProject {
   withSiteToken(value) {
     this.siteToken = value;
     this._server.withSiteToken(value);
+    this._metadataSheet?.setSiteToken(value);
     return this;
   }
 
@@ -133,6 +136,10 @@ export class HelixProject extends BaseProject {
     return this._headHtml;
   }
 
+  get metadataSheet() {
+    return this._metadataSheet;
+  }
+
   get htmlFolder() {
     return this._htmlFolder;
   }
@@ -188,6 +195,17 @@ export class HelixProject extends BaseProject {
     }
   }
 
+  async initMetadataSheet() {
+    if (this.proxyUrl) {
+      this._metadataSheet = new MetadataSheetSupport({
+        proxyUrl: this.proxyUrl,
+        log: this.log,
+        allowInsecure: this.allowInsecure,
+        siteToken: this.siteToken,
+      });
+    }
+  }
+
   async init404Html() {
     if (this.proxyUrl) {
       this._file404html = resolve(this.directory, '404.html');
@@ -252,6 +270,7 @@ export class HelixProject extends BaseProject {
     this.log.debug('Launching AEM dev server...');
     await super.start();
     await this.initHeadHtml();
+    await this.initMetadataSheet();
     await this.init404Html();
     await this.initHtmlFolder();
     await this.initHlxIgnore();
diff --git a/src/server/HelixServer.js b/src/server/HelixServer.js
index 737779512..62913f2d3 100644
--- a/src/server/HelixServer.js
+++ b/src/server/HelixServer.js
@@ -20,10 +20,32 @@ import RequestContext from './RequestContext.js';
 import { asyncHandler, BaseServer } from './BaseServer.js';
 import LiveReload from './LiveReload.js';
 import { saveSiteTokenToFile } from '../config/config-utils.js';
+import { CONTENT_DIR } from '../content/content-shared.js';
+import { transformContentMetadataHtml } from '../content/content-metadata-html.js';
 
 const LOGIN_ROUTE = '/.aem/cli/login';
 const LOGIN_ACK_ROUTE = '/.aem/cli/login/ack';
 
+/**
+ * @param {import('express').Request} req
+ * @param {import('./RequestContext.js').default} ctx
+ * @returns {string}
+ */
+function absolutePageUrlFromRequest(req, ctx) {
+  const raw = req.headers['x-forwarded-proto'];
+  const proto = (Array.isArray(raw) ? raw[0] : raw) || req.protocol || 'http';
+  const host = req.get('host');
+  if (!host) {
+    return '';
+  }
+  try {
+    const pathWithQuery = req.originalUrl || ctx.url;
+    return new URL(pathWithQuery, `${proto}://${host}`).href;
+  } catch {
+    return '';
+  }
+}
+
 export class HelixServer extends BaseServer {
   /**
    * Creates a new HelixServer for the given project.
@@ -149,6 +171,7 @@ export class HelixServer extends BaseServer {
 
         this.withSiteToken(siteToken);
         this._project.headHtml.setSiteToken(siteToken);
+        this._project.metadataSheet?.setSiteToken(siteToken);
         await saveSiteTokenToFile(siteToken);
         this.log.info('Site token received and saved to file.');
 
@@ -424,6 +447,65 @@ export class HelixServer extends BaseServer {
 
     // try to serve static
     try {
+      // Check content/ first — prefer local content checkout over proxy
+      const contentDir = path.join(this._project.directory, CONTENT_DIR);
+      const contentFilePath = path.join(contentDir, ctx.path);
+      if (!path.relative(contentDir, contentFilePath).startsWith('..')) {
+        try {
+          if (contentFilePath.endsWith('.html')) {
+            // readFile throws EISDIR for directories and ENOENT for missing files
+            let htmlContent = await readFile(contentFilePath, 'utf-8');
+            const absolutePageUrl = absolutePageUrlFromRequest(req, ctx);
+            if (this._project.metadataSheet) {
+              this._project.metadataSheet.setCookie(req.headers.cookie || '');
+              await this._project.metadataSheet.ensureLoaded();
+            }
+            const sheetRow = this._project.metadataSheet?.matchPath(ctx.path) ?? null;
+            const { htmlFragment, metaTagsHtml } = transformContentMetadataHtml(htmlContent, {
+              absolutePageUrl,
+              sheetRow,
+            });
+            htmlContent = htmlFragment;
+            // content/ files are plain HTML (body only, no )
+            // wrap with a full document and inject local head.html
+            if (!htmlContent.includes('')) {
+              await this._project.headHtml.update();
+              const headHtml = this._project.headHtml.localHtml || '';
+              htmlContent = `${headHtml}${metaTagsHtml}${htmlContent}`;
+            } else {
+              await this._project.headHtml.setCookie(req.headers.cookie);
+              htmlContent = await this._project.headHtml.replace(htmlContent);
+              if (metaTagsHtml) {
+                htmlContent = htmlContent.replace(/<\/head>/i, `${metaTagsHtml}`);
+              }
+            }
+            if (liveReload) {
+              htmlContent = utils.injectLiveReloadScript(htmlContent, this);
+              liveReload.registerFile(ctx.requestId, contentFilePath);
+            }
+            res.set({
+              'content-type': 'text/html; charset=utf-8',
+              'access-control-allow-origin': '*',
+            });
+            res.send(htmlContent);
+            log.debug(`${pfx}served from ${CONTENT_DIR}/: ${ctx.path}`);
+            return;
+          }
+          // sendFile throws EISDIR for directories and ENOENT for missing files
+          await sendFile(contentFilePath, {
+            dotfiles: 'allow',
+            headers: { 'access-control-allow-origin': '*' },
+          });
+          if (liveReload) {
+            liveReload.registerFile(ctx.requestId, contentFilePath);
+          }
+          log.debug(`${pfx}served from ${CONTENT_DIR}/: ${ctx.path}`);
+          return;
+        } catch (e) {
+          log.debug(`${pfx}${CONTENT_DIR}/ miss for ${ctx.path}: ${e.code}`);
+        }
+      }
+
       // Check if it's an HTML file and live reload is enabled
       if (liveReload && filePath.endsWith('.html')) {
         // Read the HTML file and inject the livereload script
diff --git a/src/server/MetadataSheetSupport.js b/src/server/MetadataSheetSupport.js
new file mode 100644
index 000000000..9398251c8
--- /dev/null
+++ b/src/server/MetadataSheetSupport.js
@@ -0,0 +1,221 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+import globToRegExp from 'glob-to-regexp';
+import { getFetch } from '../fetch-utils.js';
+
+/**
+ * Normalizes the request path for matching against metadata.json URL globs.
+ * @param {string} pathname
+ * @returns {string}
+ */
+export function normalizePathForMetadataMatch(pathname) {
+  let p = pathname || '/';
+  if (!p.startsWith('/')) {
+    p = `/${p}`;
+  }
+  if (p.length > 5 && p.endsWith('.html')) {
+    p = p.slice(0, -5);
+  }
+  return p || '/';
+}
+
+/**
+ * @param {unknown} body
+ * @returns {object[]}
+ */
+function extractDataRows(body) {
+  if (!body || typeof body !== 'object') {
+    return [];
+  }
+  const { data } = /** @type {{ data?: unknown }} */ (body);
+  if (!Array.isArray(data)) {
+    return [];
+  }
+  return /** @type {object[]} */ (data.filter((r) => r && typeof r === 'object'));
+}
+
+/**
+ * @param {object[]} rows
+ * @returns {Array<{ pattern: string, regex: RegExp, row: object }>}
+ */
+export function compileMetadataSheetPatterns(rows) {
+  /** @type {Array<{ pattern: string, regex: RegExp, row: object }>} */
+  const out = [];
+  for (const row of rows) {
+    const pattern = row.URL;
+    if (typeof pattern !== 'string' || !pattern.trim()) {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+    try {
+      const regex = globToRegExp(pattern, { globstar: true });
+      out.push({ pattern, regex, row });
+    } catch {
+      // eslint-disable-next-line no-continue
+      continue;
+    }
+  }
+  return out;
+}
+
+/**
+ * Merges all matching metadata sheet rows for a path: most specific URL pattern first,
+ * then each field uses the first non-empty value (empty string falls through to broader rows).
+ * @param {string} normalizedPath
+ * @param {Array<{ pattern: string, regex: RegExp, row: object }>} compiled
+ * @returns {Record | null}
+ */
+export function mergeMetadataSheetRows(normalizedPath, compiled) {
+  /** @type {Array<{ pattern: string, row: object }>} */
+  const hits = [];
+  for (const { pattern, regex, row } of compiled) {
+    if (regex.test(normalizedPath)) {
+      hits.push({ pattern, row });
+    }
+  }
+  if (hits.length === 0) {
+    return null;
+  }
+  hits.sort((a, b) => b.pattern.length - a.pattern.length);
+
+  /** @type {Set} */
+  const keys = new Set();
+  for (const { row } of hits) {
+    for (const k of Object.keys(row)) {
+      if (k !== 'URL' && !k.startsWith(':')) {
+        keys.add(k);
+      }
+    }
+  }
+
+  /** @type {Record} */
+  const merged = {};
+  for (const key of keys) {
+    for (const { row } of hits) {
+      const v = row[key];
+      if (v === undefined || v === null) {
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      const s = String(v).trim();
+      if (s === '') {
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+      merged[key] = s;
+      break;
+    }
+  }
+
+  return Object.keys(merged).length > 0 ? merged : null;
+}
+
+export default class MetadataSheetSupport {
+  /**
+   * @param {{ proxyUrl: string, log: object, allowInsecure: boolean, siteToken?: string }} opts
+   */
+  constructor({
+    proxyUrl, log, allowInsecure, siteToken,
+  }) {
+    this.url = new URL(proxyUrl);
+    this.url.pathname = '/metadata.json';
+    this.log = log;
+    this.allowInsecure = allowInsecure;
+    this.siteToken = siteToken || '';
+    this.cookie = '';
+    /** @type {Array<{ pattern: string, regex: RegExp, row: object }> | null} */
+    this._compiled = null;
+    /** @type {Promise | null} */
+    this._loadPromise = null;
+  }
+
+  setCookie(cookie) {
+    const next = cookie || '';
+    if (this.cookie !== next) {
+      this.cookie = next;
+      this._compiled = null;
+      this._loadPromise = null;
+    }
+  }
+
+  setSiteToken(siteToken) {
+    const next = siteToken || '';
+    if (this.siteToken !== next) {
+      this.siteToken = next;
+      this._compiled = null;
+      this._loadPromise = null;
+    }
+  }
+
+  invalidate() {
+    this._compiled = null;
+    this._loadPromise = null;
+  }
+
+  async ensureLoaded() {
+    if (this._compiled !== null) {
+      return;
+    }
+    if (this._loadPromise) {
+      await this._loadPromise;
+      return;
+    }
+    this._loadPromise = this._fetchAndCompile();
+    try {
+      await this._loadPromise;
+    } finally {
+      this._loadPromise = null;
+    }
+  }
+
+  async _fetchAndCompile() {
+    const headers = {};
+    if (this.cookie) {
+      headers.cookie = this.cookie;
+    }
+    if (this.siteToken) {
+      headers.authorization = `token ${this.siteToken}`;
+    }
+    try {
+      const resp = await getFetch(this.allowInsecure)(this.url, {
+        cache: 'no-store',
+        headers,
+      });
+      if (!resp.ok) {
+        this.log.debug(`metadata.json not loaded (${resp.status}) from ${this.url}`);
+        this._compiled = [];
+        return;
+      }
+      const text = await resp.text();
+      const body = JSON.parse(text);
+      const rows = extractDataRows(body);
+      this._compiled = compileMetadataSheetPatterns(rows);
+      this.log.debug(`loaded metadata.json (${this._compiled.length} URL pattern(s)) from ${this.url}`);
+    } catch (e) {
+      this.log.debug(`metadata.json fetch/parse failed: ${e.message || e}`);
+      this._compiled = [];
+    }
+  }
+
+  /**
+   * @param {string} pathname ctx.path or resource path with .html
+   * @returns {object | null}
+   */
+  matchPath(pathname) {
+    if (!this._compiled || this._compiled.length === 0) {
+      return null;
+    }
+    const normalized = normalizePathForMetadataMatch(pathname);
+    return mergeMetadataSheetRows(normalized, this._compiled);
+  }
+}
diff --git a/test/content-metadata-html.test.js b/test/content-metadata-html.test.js
new file mode 100644
index 000000000..0c43afb7a
--- /dev/null
+++ b/test/content-metadata-html.test.js
@@ -0,0 +1,147 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import { select } from 'hast-util-select';
+import rehypeParse from 'rehype-parse';
+import { unified } from 'unified';
+import {
+  transformContentMetadataHtml,
+  slugifyMetadataLabel,
+  extractMetadataPairs,
+  escapeHtmlAttr,
+  buildSheetMetaLines,
+} from '../src/content/content-metadata-html.js';
+
+describe('content-metadata-html', () => {
+  it('slugifyMetadataLabel', () => {
+    assert.strictEqual(slugifyMetadataLabel('Total Time'), 'total-time');
+    assert.strictEqual(slugifyMetadataLabel('Recipe Type'), 'recipe-type');
+  });
+
+  it('escapeHtmlAttr', () => {
+    assert.strictEqual(escapeHtmlAttr('a"b&c'), 'a"b&c');
+  });
+
+  it('extractMetadataPairs parses label/value rows', () => {
+    const tree = unified()
+      .use(rehypeParse, { fragment: true })
+      .parse(
+        '
'
+        + '
Yield
4
'
+        + '
',
+      );
+    const el = select('div.metadata', tree);
+    assert.ok(el && el.type === 'element');
+    const pairs = extractMetadataPairs(/** @type {import("hast").Element} */ (el));
+    assert.deepStrictEqual(pairs, [['Yield', '4']]);
+  });
+
+  it('removes metadata div and emits meta tags', () => {
+    const input = '
Ramen
'
+      + '
'
+      + '
Total Time
00:17:30
'
+      + '
Yield
4 portions
'
+      + '
';
+    const { htmlFragment, metaTagsHtml } = transformContentMetadataHtml(input, {
+      absolutePageUrl: 'https://example.com/recipe',
+    });
+    assert.ok(!htmlFragment.includes('metadata'));
+    assert.ok(!htmlFragment.includes('00:17:30'));
+    assert.ok(metaTagsHtml.includes('name="total-time"'));
+    assert.ok(metaTagsHtml.includes('content="00:17:30"'));
+    assert.ok(metaTagsHtml.includes('name="yield"'));
+    assert.ok(metaTagsHtml.includes('property="og:title"'));
+    assert.ok(metaTagsHtml.includes('content="Ramen"'));
+    assert.ok(metaTagsHtml.includes('property="og:url"'));
+    const ogUrlMatch = metaTagsHtml.match(/property="og:url"\s+content="([^"]*)"/);
+    assert.ok(ogUrlMatch, 'expected og:url meta tag');
+    assert.strictEqual(
+      new URL(ogUrlMatch[1]).href,
+      new URL('https://example.com/recipe').href,
+    );
+  });
+
+  it('uses Description row for description metas', () => {
+    const input = '
ignored
'
+      + '
Description
Short desc here
'
+      + '
';
+    const { metaTagsHtml } = transformContentMetadataHtml(input, {});
+    assert.ok(metaTagsHtml.includes('name="description"'));
+    assert.ok(metaTagsHtml.includes('Short desc here'));
+    assert.ok(metaTagsHtml.includes('property="og:description"'));
+  });
+
+  it('returns input unchanged when no metadata block', () => {
+    const input = '
x
';
+    const { htmlFragment, metaTagsHtml } = transformContentMetadataHtml(input, {});
+    assert.strictEqual(htmlFragment, input);
+    assert.strictEqual(metaTagsHtml, '');
+  });
+
+  it('injects sheet metas without body metadata div', () => {
+    const input = '
hi
';
+    const { htmlFragment, metaTagsHtml } = transformContentMetadataHtml(input, {
+      sheetRow: {
+        URL: '/x/**', nav: '/nav', template: 'recipe', ':type': 'sheet',
+      },
+    });
+    assert.strictEqual(htmlFragment, input);
+    assert.ok(metaTagsHtml.includes('name="nav"'));
+    assert.ok(metaTagsHtml.includes('name="template"'));
+    assert.ok(!metaTagsHtml.includes(':type'));
+  });
+
+  it('places sheet metas after SEO block and before body pairs', () => {
+    const input = '
T
'
+      + '
Yield
1
'
+      + '
';
+    const { metaTagsHtml } = transformContentMetadataHtml(input, {
+      sheetRow: { nav: '/n', template: 'recipe' },
+    });
+    const idxOg = metaTagsHtml.indexOf('og:title');
+    const idxNav = metaTagsHtml.indexOf('name="nav"');
+    const idxYield = metaTagsHtml.indexOf('name="yield"');
+    assert.ok(idxOg >= 0 && idxNav > idxOg && idxYield > idxNav);
+  });
+
+  it('omits sheet meta when the page metadata div defines the same name', () => {
+    const input = '
T
'
+      + '
Template
article
'
+      + '
';
+    const { metaTagsHtml } = transformContentMetadataHtml(input, {
+      sheetRow: { nav: '/n', template: 'recipe' },
+    });
+    assert.ok(metaTagsHtml.includes('name="template"'));
+    assert.ok(metaTagsHtml.includes('content="article"'));
+    assert.ok(!metaTagsHtml.includes('content="recipe"'));
+    assert.ok(metaTagsHtml.includes('name="nav"'));
+  });
+});
+
+describe('buildSheetMetaLines', () => {
+  it('skips URL and keys starting with colon', () => {
+    const lines = buildSheetMetaLines({ URL: '/a', ':type': 'sheet', nav: '/n' });
+    assert.strictEqual(lines.length, 1);
+    assert.ok(lines[0].includes('nav'));
+  });
+
+  it('skips names in exclude set', () => {
+    const lines = buildSheetMetaLines(
+      { nav: '/a', template: 'recipe' },
+      new Set(['template']),
+    );
+    assert.strictEqual(lines.length, 1);
+    assert.ok(lines[0].includes('nav'));
+  });
+});
diff --git a/test/content/add.cmd.test.js b/test/content/add.cmd.test.js
new file mode 100644
index 000000000..b7e2bd88d
--- /dev/null
+++ b/test/content/add.cmd.test.js
@@ -0,0 +1,111 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { createTestRoot } from '../utils.js';
+import AddCommand, {
+  filepathInContentAddScope,
+  normalizePathForContentAdd,
+} from '../../src/content/add.cmd.js';
+import { makeLogger, setupContentDir } from './content-test-utils.js';
+
+describe('normalizePathForContentAdd', () => {
+  it('strips content/ prefix', () => {
+    assert.strictEqual(normalizePathForContentAdd('content/index.html'), 'index.html');
+    assert.strictEqual(normalizePathForContentAdd('content/blog/post.html'), 'blog/post.html');
+  });
+
+  it('strips ./content/ prefix', () => {
+    assert.strictEqual(normalizePathForContentAdd('./content/foo.html'), 'foo.html');
+  });
+
+  it('maps content or content/ to .', () => {
+    assert.strictEqual(normalizePathForContentAdd('content'), '.');
+    assert.strictEqual(normalizePathForContentAdd('content/'), '.');
+  });
+
+  it('normalizes backslashes before stripping prefix', () => {
+    assert.strictEqual(normalizePathForContentAdd('content\\dir\\a.txt'), 'dir/a.txt');
+  });
+
+  it('leaves repo-relative paths unchanged', () => {
+    assert.strictEqual(normalizePathForContentAdd('index.html'), 'index.html');
+    assert.strictEqual(normalizePathForContentAdd('.'), '.');
+  });
+});
+
+describe('filepathInContentAddScope', () => {
+  it('treats . as whole tree', () => {
+    assert.strictEqual(filepathInContentAddScope('blog/post.html', '.'), true);
+    assert.strictEqual(filepathInContentAddScope('index.html', '.'), true);
+  });
+
+  it('matches exact file and directory prefix', () => {
+    assert.strictEqual(filepathInContentAddScope('blog/post.html', 'blog'), true);
+    assert.strictEqual(filepathInContentAddScope('blog/post.html', 'blog/'), true);
+    assert.strictEqual(filepathInContentAddScope('blog', 'blog'), true);
+    assert.strictEqual(filepathInContentAddScope('blogging/readme.md', 'blog'), false);
+  });
+});
+
+describe('AddCommand', () => {
+  let testRoot;
+
+  beforeEach(async () => {
+    testRoot = await createTestRoot();
+  });
+
+  afterEach(async () => {
+    await fse.remove(testRoot);
+  });
+
+  describe('run()', () => {
+    it('stages deletion when adding . after removing a tracked file', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.remove(path.join(contentDir, 'index.html'));
+
+      const cmd = new AddCommand(makeLogger()).withDirectory(testRoot).withPaths(['.']);
+      await cmd.run();
+
+      const matrix = await git.statusMatrix({ fs, dir: contentDir });
+      const row = matrix.find((r) => r[0] === 'index.html');
+      assert.ok(row);
+      assert.strictEqual(row[1], 1);
+      assert.strictEqual(row[2], 0);
+      assert.strictEqual(row[3], 0);
+    });
+
+    it('stages deletion when adding a removed file path', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.remove(path.join(contentDir, 'index.html'));
+
+      const cmd = new AddCommand(makeLogger()).withDirectory(testRoot).withPaths(['index.html']);
+      await cmd.run();
+
+      const matrix = await git.statusMatrix({ fs, dir: contentDir });
+      const row = matrix.find((r) => r[0] === 'index.html');
+      assert.ok(row);
+      assert.strictEqual(row[3], 0);
+    });
+
+    it('rethrows when add path is missing and not a tracked deletion', async () => {
+      await setupContentDir(testRoot);
+      const cmd = new AddCommand(makeLogger()).withDirectory(testRoot).withPaths(['no-such-file.html']);
+      await assert.rejects(() => cmd.run(), /NotFoundError/);
+    });
+  });
+});
diff --git a/test/content/clone.cmd.test.js b/test/content/clone.cmd.test.js
new file mode 100644
index 000000000..f420829a2
--- /dev/null
+++ b/test/content/clone.cmd.test.js
@@ -0,0 +1,288 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import esmock from 'esmock';
+import { createTestRoot } from '../utils.js';
+import { makeLogger, createDaClientClass } from './content-test-utils.js';
+import { normalizeDaPath, CONTENT_DIR, LARGE_CLONE_FILE_THRESHOLD } from '../../src/content/content-shared.js';
+import { DA_SYNCED_REF } from '../../src/content/content-git.js';
+
+async function makeCloneCommand(testRoot, DaClientClass) {
+  const mod = await esmock('../../src/content/clone.cmd.js', {
+    '../../src/git-utils.js': {
+      default: {
+        getOriginURL: async () => ({ owner: 'myorg', repo: 'myrepo' }),
+      },
+    },
+    '../../src/content/da-auth.js': {
+      getValidToken: async () => 'mock-token',
+    },
+    '../../src/content/da-api.js': {
+      DaClient: DaClientClass,
+      getContentType: (ext) => `text/${ext}`,
+    },
+  });
+  const Cmd = mod.default;
+  return new Cmd(makeLogger()).withDirectory(testRoot);
+}
+
+describe('CloneCommand', () => {
+  let testRoot;
+
+  beforeEach(async () => {
+    testRoot = await createTestRoot();
+    await fse.writeFile(path.join(testRoot, '.gitignore'), 'node_modules\n');
+  });
+
+  afterEach(async () => {
+    await fse.remove(testRoot);
+  });
+
+  describe('builder methods', () => {
+    it('withDirectory sets _dir', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd._dir, testRoot); // eslint-disable-line no-underscore-dangle
+    });
+
+    it('withToken sets _token', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withToken('abc');
+      assert.strictEqual(cmd._token, 'abc'); // eslint-disable-line no-underscore-dangle
+    });
+
+    it('withForce sets _force', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withForce(true);
+      assert.strictEqual(cmd._force, true); // eslint-disable-line no-underscore-dangle
+    });
+
+    it('withRootPath sets _rootPath', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withRootPath('/ca/fr_ca');
+      assert.strictEqual(cmd._rootPath, '/ca/fr_ca'); // eslint-disable-line no-underscore-dangle
+    });
+
+    it('withAssumeYes sets _assumeYes', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withAssumeYes(true);
+      assert.strictEqual(cmd._assumeYes, true); // eslint-disable-line no-underscore-dangle
+    });
+
+    it('builder methods return this for chaining', async () => {
+      const mod = await esmock('../../src/content/clone.cmd.js', {
+        '../../src/git-utils.js': { default: { getOriginURL: async () => null } },
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(makeLogger());
+      assert.strictEqual(cmd.withDirectory('/tmp'), cmd);
+      assert.strictEqual(cmd.withToken('t'), cmd);
+      assert.strictEqual(cmd.withForce(false), cmd);
+      assert.strictEqual(cmd.withRootPath('/'), cmd);
+      assert.strictEqual(cmd.withAssumeYes(false), cmd);
+    });
+  });
+
+  describe('normalizeDaPath()', () => {
+    it('adds leading slash and strips trailing slashes', () => {
+      assert.strictEqual(normalizeDaPath('ca/fr_ca/'), '/ca/fr_ca');
+      assert.strictEqual(normalizeDaPath('/a/b/'), '/a/b');
+    });
+
+    it('preserves root', () => {
+      assert.strictEqual(normalizeDaPath('/'), '/');
+      assert.strictEqual(normalizeDaPath('///'), '/');
+    });
+
+    it('rejects empty input', () => {
+      assert.throws(() => normalizeDaPath(''), /empty/);
+      assert.throws(() => normalizeDaPath('   '), /empty/);
+    });
+  });
+
+  describe('run()', () => {
+    it('throws when no git remote found', async () => {
+      const mod = await esmock('../../src/content/clone.cmd.js', {
+        '../../src/git-utils.js': {
+          default: { getOriginURL: async () => null },
+        },
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(makeLogger()).withDirectory(testRoot).withRootPath('/');
+      await assert.rejects(() => cmd.run(), /No git remote/);
+    });
+
+    it('throws when run without withRootPath', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      await assert.rejects(() => cmd.run(), /root path was not set/);
+    });
+
+    it('throws when content dir exists and --force not set', async () => {
+      const contentDir = path.join(testRoot, CONTENT_DIR);
+      await fse.ensureDir(contentDir);
+
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withRootPath('/');
+      await assert.rejects(() => cmd.run(), /already exists/);
+    });
+
+    it('removes existing content dir when --force is set', async () => {
+      const contentDir = path.join(testRoot, CONTENT_DIR);
+      await fse.ensureDir(contentDir);
+      await fse.writeFile(path.join(contentDir, 'old-file.txt'), 'old');
+
+      const DaClientClass = createDaClientClass({
+        files: [{ path: '/myorg/myrepo/index.html', name: 'index.html', ext: 'html' }],
+        sourceContent: 'hi',
+      });
+      const cmd = await makeCloneCommand(testRoot, DaClientClass);
+      cmd.withForce(true).withRootPath('/');
+      await cmd.run();
+
+      assert.ok(!await fse.pathExists(path.join(contentDir, 'old-file.txt')));
+      assert.ok(await fse.pathExists(contentDir));
+    });
+
+    it('downloads files into content/', async () => {
+      const DaClientClass = createDaClientClass({
+        files: [{ path: '/myorg/myrepo/page.html', name: 'page.html', ext: 'html' }],
+        sourceContent: 'page',
+      });
+      const cmd = await makeCloneCommand(testRoot, DaClientClass);
+      cmd.withRootPath('/');
+      await cmd.run();
+
+      const localPath = path.join(testRoot, CONTENT_DIR, 'page.html');
+      assert.ok(await fse.pathExists(localPath));
+      const content = await fse.readFile(localPath, 'utf-8');
+      assert.strictEqual(content, 'page');
+    });
+
+    it('writes .da-config.json with org, repo, and rootPath', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withRootPath('/blog');
+      await cmd.run();
+
+      const configPath = path.join(testRoot, CONTENT_DIR, '.da-config.json');
+      assert.ok(await fse.pathExists(configPath));
+      const config = await fse.readJson(configPath);
+      assert.strictEqual(config.org, 'myorg');
+      assert.strictEqual(config.repo, 'myrepo');
+      assert.strictEqual(config.rootPath, '/blog');
+    });
+
+    it('initializes a git repo in content/', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withRootPath('/');
+      await cmd.run();
+
+      const gitDir = path.join(testRoot, CONTENT_DIR, '.git');
+      assert.ok(await fse.pathExists(gitDir));
+    });
+
+    it('sets refs/da/synced to HEAD after clone', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withRootPath('/');
+      await cmd.run();
+
+      const contentDir = path.join(testRoot, CONTENT_DIR);
+      const synced = await git.resolveRef({ fs, dir: contentDir, ref: DA_SYNCED_REF });
+      const head = await git.resolveRef({ fs, dir: contentDir, ref: 'HEAD' });
+      assert.strictEqual(synced, head);
+    });
+
+    it('writes .gitignore in content/ excluding .da-config.json', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withRootPath('/');
+      await cmd.run();
+
+      const gitIgnorePath = path.join(testRoot, CONTENT_DIR, '.gitignore');
+      assert.ok(await fse.pathExists(gitIgnorePath));
+      const content = await fse.readFile(gitIgnorePath, 'utf-8');
+      assert.ok(content.includes('.da-config.json'));
+    });
+
+    it('skips files that return null from getSource', async () => {
+      const DaClientClass = createDaClientClass({
+        files: [{ path: '/myorg/myrepo/missing.html', name: 'missing.html', ext: 'html' }],
+        sourceContent: null,
+      });
+      const cmd = await makeCloneCommand(testRoot, DaClientClass);
+      cmd.withRootPath('/');
+      await cmd.run();
+
+      const localPath = path.join(testRoot, CONTENT_DIR, 'missing.html');
+      assert.ok(!await fse.pathExists(localPath));
+    });
+
+    it('adds content to project .gitignore', async () => {
+      const cmd = await makeCloneCommand(testRoot, createDaClientClass());
+      cmd.withRootPath('/');
+      await cmd.run();
+
+      const gitIgnorePath = path.join(testRoot, '.gitignore');
+      const content = await fse.readFile(gitIgnorePath, 'utf-8');
+      assert.ok(content.includes(CONTENT_DIR));
+    });
+
+    it('passes root path to listAll', async () => {
+      let listedAt;
+      const DaClientClass = createDaClientClass({
+        files: [{ path: '/myorg/myrepo/ca/fr_ca/page.html', name: 'page.html', ext: 'html' }],
+        sourceContent: 'x',
+        onListAll: (org, repo, daPath) => {
+          listedAt = daPath;
+        },
+      });
+      const cmd = await makeCloneCommand(testRoot, DaClientClass);
+      cmd.withRootPath('/ca/fr_ca');
+      await cmd.run();
+      assert.strictEqual(listedAt, '/ca/fr_ca');
+      assert.ok(await fse.pathExists(path.join(testRoot, CONTENT_DIR, 'ca', 'fr_ca', 'page.html')));
+    });
+
+    it('refuses large clone without --yes when not interactive', async () => {
+      const prevIn = process.stdin.isTTY;
+      const prevOut = process.stdout.isTTY;
+      process.stdin.isTTY = false;
+      process.stdout.isTTY = false;
+      try {
+        const n = LARGE_CLONE_FILE_THRESHOLD + 1;
+        const files = Array.from({ length: n }, (_, i) => ({
+          path: `/myorg/myrepo/f${i}.html`,
+          name: `f${i}.html`,
+          ext: 'html',
+        }));
+        const DaClientClass = createDaClientClass({
+          files,
+          sourceContent: '',
+        });
+        const cmd = await makeCloneCommand(testRoot, DaClientClass);
+        cmd.withRootPath('/');
+        await assert.rejects(() => cmd.run(), /needs confirmation/);
+        assert.ok(!await fse.pathExists(path.join(testRoot, CONTENT_DIR)));
+      } finally {
+        process.stdin.isTTY = prevIn;
+        process.stdout.isTTY = prevOut;
+      }
+    });
+  });
+});
diff --git a/test/content/content-commands.test.js b/test/content/content-commands.test.js
new file mode 100644
index 000000000..1e7171c5d
--- /dev/null
+++ b/test/content/content-commands.test.js
@@ -0,0 +1,373 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import content from '../../src/content/content.js';
+import clone from '../../src/content/clone.js';
+import add from '../../src/content/add.js';
+import commit from '../../src/content/commit.js';
+import push from '../../src/content/push.js';
+import status from '../../src/content/status.js';
+import diff from '../../src/content/diff.js';
+import mergeCmd from '../../src/content/merge.js';
+
+describe('content()', () => {
+  it('returns command named content', () => {
+    const cmd = content();
+    assert.strictEqual(cmd.command, 'content');
+  });
+
+  it('has a description', () => {
+    const cmd = content();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('has a builder function', () => {
+    const cmd = content();
+    assert.strictEqual(typeof cmd.builder, 'function');
+  });
+
+  it('has a handler function', () => {
+    const cmd = content();
+    assert.strictEqual(typeof cmd.handler, 'function');
+  });
+
+  it('builder registers subcommands', () => {
+    const cmd = content();
+    const registered = [];
+    const chainable = {
+      command: (sub) => {
+        registered.push(sub);
+        return chainable;
+      },
+      demandCommand: () => chainable,
+      help: () => chainable,
+    };
+    cmd.builder(chainable);
+    assert.ok(registered.length > 0);
+  });
+});
+
+describe('clone()', () => {
+  it('returns command named clone', () => {
+    const cmd = clone();
+    assert.strictEqual(cmd.command, 'clone');
+  });
+
+  it('has a description', () => {
+    const cmd = clone();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('has a builder that registers path, all, token, force, and yes options', () => {
+    const cmd = clone();
+    const registered = {};
+    const chainable = {
+      option: (name, opts) => {
+        registered[name] = opts;
+        return chainable;
+      },
+      check: () => chainable,
+      help: () => chainable,
+    };
+    cmd.builder(chainable);
+    assert.ok('path' in registered);
+    assert.ok('all' in registered);
+    assert.ok('token' in registered);
+    assert.ok('force' in registered);
+    assert.ok('yes' in registered);
+  });
+
+  it('executor setter replaces internal executor', () => {
+    const cmd = clone();
+    const mockExecutor = {
+      withToken: () => mockExecutor,
+      withForce: () => mockExecutor,
+      withAssumeYes: () => mockExecutor,
+      withRootPath: () => mockExecutor,
+      run: async () => {},
+    };
+    cmd.executor = mockExecutor;
+  });
+
+  it('has a handler function', () => {
+    const cmd = clone();
+    assert.strictEqual(typeof cmd.handler, 'function');
+  });
+
+  it('handler calls executor when executor is set', async () => {
+    const cmd = clone();
+    let ranWith;
+    let assumeYesArg;
+    let rootPathArg;
+    cmd.executor = {
+      withToken: (t) => {
+        ranWith = t;
+        return {
+          withForce: () => ({
+            withAssumeYes: (y) => {
+              assumeYesArg = y;
+              return {
+                withRootPath: (rp) => {
+                  rootPathArg = rp;
+                  return { run: async () => {} };
+                },
+              };
+            },
+          }),
+        };
+      },
+    };
+    await cmd.handler({
+      token: 'abc', force: false, yes: true, all: false, path: '/ca/fr_ca',
+    });
+    assert.strictEqual(ranWith, 'abc');
+    assert.strictEqual(assumeYesArg, true);
+    assert.strictEqual(rootPathArg, '/ca/fr_ca');
+  });
+});
+
+describe('add()', () => {
+  it('returns command named add [files..]', () => {
+    const cmd = add();
+    assert.strictEqual(cmd.command, 'add [files..]');
+  });
+
+  it('has a description', () => {
+    const cmd = add();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('executor setter works', () => {
+    const cmd = add();
+    cmd.executor = { withPaths: () => ({ run: async () => {} }) };
+  });
+
+  it('handler calls executor when set', async () => {
+    const cmd = add();
+    let called = false;
+    cmd.executor = {
+      withPaths: () => ({
+        run: async () => {
+          called = true;
+        },
+      }),
+    };
+    await cmd.handler({});
+    assert.strictEqual(called, true);
+  });
+});
+
+describe('commit()', () => {
+  it('returns command named commit', () => {
+    const cmd = commit();
+    assert.strictEqual(cmd.command, 'commit');
+  });
+
+  it('has a description', () => {
+    const cmd = commit();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('has a builder that registers -m', () => {
+    const cmd = commit();
+    const registered = {};
+    const chainable = {
+      option: (name, opts) => {
+        registered[name] = opts;
+        return chainable;
+      },
+      help: () => chainable,
+    };
+    cmd.builder(chainable);
+    assert.ok('m' in registered);
+  });
+
+  it('handler calls executor when set', async () => {
+    const cmd = commit();
+    let called = false;
+    cmd.executor = {
+      withMessage: () => ({
+        run: async () => {
+          called = true;
+        },
+      }),
+    };
+    await cmd.handler({ m: 'msg' });
+    assert.strictEqual(called, true);
+  });
+});
+
+describe('push()', () => {
+  it('returns command named push', () => {
+    const cmd = push();
+    assert.strictEqual(cmd.command, 'push');
+  });
+
+  it('has a description', () => {
+    const cmd = push();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('has a builder that registers --token, --path, --force, --dry-run options', () => {
+    const cmd = push();
+    const registered = {};
+    const chainable = {
+      option: (name, opts) => {
+        registered[name] = opts;
+        return chainable;
+      },
+      help: () => chainable,
+    };
+    cmd.builder(chainable);
+    assert.ok('token' in registered);
+    assert.ok('force' in registered);
+    assert.ok('dry-run' in registered);
+    assert.ok('path' in registered);
+  });
+
+  it('executor setter works', () => {
+    const cmd = push();
+    cmd.executor = { withToken: () => {}, run: async () => {} };
+  });
+
+  it('handler calls executor when set', async () => {
+    const cmd = push();
+    let called = false;
+    cmd.executor = {
+      withToken: () => ({
+        withPath: () => ({
+          withForce: () => ({
+            withDryRun: () => ({
+              run: async () => {
+                called = true;
+              },
+            }),
+          }),
+        }),
+      }),
+    };
+    await cmd.handler({
+      token: 't', path: null, force: false, dryRun: false,
+    });
+    assert.strictEqual(called, true);
+  });
+});
+
+describe('status()', () => {
+  it('returns command named status', () => {
+    const cmd = status();
+    assert.strictEqual(cmd.command, 'status');
+  });
+
+  it('has a description', () => {
+    const cmd = status();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('has a builder function', () => {
+    const cmd = status();
+    assert.strictEqual(typeof cmd.builder, 'function');
+  });
+
+  it('executor setter works', () => {
+    const cmd = status();
+    cmd.executor = { run: async () => {} };
+  });
+
+  it('handler calls executor.run() when set', async () => {
+    const cmd = status();
+    let called = false;
+    cmd.executor = {
+      run: async () => {
+        called = true;
+      },
+    };
+    await cmd.handler({});
+    assert.strictEqual(called, true);
+  });
+});
+
+describe('diff()', () => {
+  it('returns command named diff [path]', () => {
+    const cmd = diff();
+    assert.strictEqual(cmd.command, 'diff [path]');
+  });
+
+  it('has a description', () => {
+    const cmd = diff();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('executor setter works', () => {
+    const cmd = diff();
+    cmd.executor = {
+      withToken: () => {},
+      withFilePath: () => {},
+      run: async () => {},
+    };
+  });
+
+  it('handler calls executor when set', async () => {
+    const cmd = diff();
+    let called = false;
+    cmd.executor = {
+      withToken: () => ({
+        withFilePath: () => ({
+          run: async () => {
+            called = true;
+          },
+        }),
+      }),
+    };
+    await cmd.handler({ token: 't', path: null });
+    assert.strictEqual(called, true);
+  });
+});
+
+describe('mergeCmd()', () => {
+  it('returns command named merge [path]', () => {
+    const cmd = mergeCmd();
+    assert.strictEqual(cmd.command, 'merge [path]');
+  });
+
+  it('has a description', () => {
+    const cmd = mergeCmd();
+    assert.ok(cmd.description && cmd.description.length > 0);
+  });
+
+  it('executor setter works', () => {
+    const cmd = mergeCmd();
+    cmd.executor = {
+      withToken: () => {},
+      withFilePath: () => {},
+      run: async () => {},
+    };
+  });
+
+  it('handler calls executor when set', async () => {
+    const cmd = mergeCmd();
+    let called = false;
+    cmd.executor = {
+      withToken: () => ({
+        withFilePath: () => ({
+          run: async () => {
+            called = true;
+          },
+        }),
+      }),
+    };
+    await cmd.handler({ token: 't', path: null });
+    assert.strictEqual(called, true);
+  });
+});
diff --git a/test/content/content-git.test.js b/test/content/content-git.test.js
new file mode 100644
index 000000000..3a3df33b3
--- /dev/null
+++ b/test/content/content-git.test.js
@@ -0,0 +1,52 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import path from 'path';
+import fse from 'fs-extra';
+import { createTestRoot } from '../utils.js';
+import { ensureGitIgnored } from '../../src/content/content-git.js';
+
+describe('ensureGitIgnored', () => {
+  let testRoot;
+
+  beforeEach(async () => {
+    testRoot = await createTestRoot();
+    await fse.writeFile(path.join(testRoot, '.gitignore'), 'node_modules\n');
+  });
+
+  afterEach(async () => {
+    await fse.remove(testRoot);
+  });
+
+  it('adds entry when not present', async () => {
+    await ensureGitIgnored(testRoot, 'content');
+    const content = await fse.readFile(path.join(testRoot, '.gitignore'), 'utf-8');
+    assert.ok(content.includes('content'));
+  });
+
+  it('does not duplicate entry when already present', async () => {
+    await fse.writeFile(path.join(testRoot, '.gitignore'), 'node_modules\ncontent\n');
+    await ensureGitIgnored(testRoot, 'content');
+    const content = await fse.readFile(path.join(testRoot, '.gitignore'), 'utf-8');
+    const count = content.split('\n').filter((l) => l.trim() === 'content').length;
+    assert.strictEqual(count, 1);
+  });
+
+  it('creates .gitignore if it does not exist', async () => {
+    await fse.remove(path.join(testRoot, '.gitignore'));
+    await ensureGitIgnored(testRoot, 'content');
+    const content = await fse.readFile(path.join(testRoot, '.gitignore'), 'utf-8');
+    assert.ok(content.includes('content'));
+  });
+});
diff --git a/test/content/content-test-utils.js b/test/content/content-test-utils.js
new file mode 100644
index 000000000..f1ebee41d
--- /dev/null
+++ b/test/content/content-test-utils.js
@@ -0,0 +1,145 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { stageDeletionsForContentAddScopes } from '../../src/content/add.cmd.js';
+import { CONTENT_DIR } from '../../src/content/content-shared.js';
+
+export const GIT_AUTHOR = { name: 'aem-cli', email: 'aem-cli@adobe.com' };
+
+export function makeLogger() {
+  const logs = [];
+  return {
+    info: (msg) => logs.push({ level: 'info', msg }),
+    warn: (msg) => logs.push({ level: 'warn', msg }),
+    error: (msg) => logs.push({ level: 'error', msg }),
+    logs,
+  };
+}
+
+/**
+ * Creates a content dir with a baseline git commit.
+ * Writes .da-config.json (not tracked).
+ */
+export async function setupContentDir(baseDir, org = 'myorg', repo = 'myrepo') {
+  const contentDir = path.join(baseDir, CONTENT_DIR);
+  await fse.ensureDir(path.join(contentDir, 'blog'));
+
+  await fse.writeFile(path.join(contentDir, 'blog', 'post.html'), '
original
');
+  await fse.writeFile(path.join(contentDir, 'index.html'), '
index
');
+  await fse.writeFile(path.join(contentDir, '.gitignore'), '.da-config.json\n');
+
+  await git.init({ fs, dir: contentDir, defaultBranch: 'main' });
+  await git.add({ fs, dir: contentDir, filepath: 'blog/post.html' });
+  await git.add({ fs, dir: contentDir, filepath: 'index.html' });
+  await git.add({ fs, dir: contentDir, filepath: '.gitignore' });
+  await git.commit({
+    fs,
+    dir: contentDir,
+    message: `clone: ${org}/${repo}`,
+    author: GIT_AUTHOR,
+  });
+
+  await fse.writeJson(path.join(contentDir, '.da-config.json'), { org, repo }, { spaces: 2 });
+
+  return contentDir;
+}
+
+/**
+ * Stage all paths and create a commit (for tests that exercise push after edits).
+ * @param {string} contentDir
+ * @param {string} message
+ */
+export async function stageAllAndCommit(contentDir, message) {
+  await git.add({ fs, dir: contentDir, filepath: '.' });
+  await stageDeletionsForContentAddScopes(fs, contentDir, ['.']);
+  await git.commit({
+    fs,
+    dir: contentDir,
+    message,
+    author: GIT_AUTHOR,
+  });
+}
+
+/**
+ * Returns a constructor function (not a class) for a configurable DaClient mock.
+ * @param {object} opts
+ * @param {Array}   opts.files           files returned by listAll
+ * @param {string}  opts.sourceContent   content returned by getSource (null = 404)
+ * @param {number}  opts.remoteLastModified lastModified returned by getRemoteLastModified
+ * @param {boolean} opts.putFails        if true, putSource throws
+ * @param {boolean} opts.deleteFails     if true, deleteSource throws
+ * @param {Function} opts.onPut         called with (daPath) when putSource is called
+ * @param {Function} opts.onDelete      called with (daPath) when deleteSource is called
+ */
+export function createDaClientClass(opts = {}) {
+  function DaClientMock(token) {
+    this.token = token;
+  }
+
+  DaClientMock.prototype.listAll = async function listAll(org, repo, daPath, onDiscovered) {
+    if (opts.onListAll) {
+      opts.onListAll(org, repo, daPath);
+    }
+    const files = opts.files || [];
+    if (onDiscovered) {
+      let n = 0;
+      for (const item of files) {
+        if (item.ext !== undefined) {
+          n += 1;
+          onDiscovered(n);
+        }
+      }
+    }
+    return files;
+  };
+
+  DaClientMock.prototype.getSource = async function getSource() {
+    const content = opts.sourceContent !== undefined ? opts.sourceContent : 'remote';
+    if (content === null) {
+      return null;
+    }
+    return {
+      buffer: async () => Buffer.from(content),
+      arrayBuffer: async () => Buffer.from(content),
+      text: async () => content,
+    };
+  };
+
+  DaClientMock.prototype.getRemoteLastModified = async function getRemoteLastModified() {
+    return opts.remoteLastModified !== undefined ? opts.remoteLastModified : null;
+  };
+
+  DaClientMock.prototype.putSource = async function putSource(org, repo, daPath) {
+    if (opts.putFails) {
+      throw new Error(`PUT failed for ${daPath}`);
+    }
+    if (opts.onPut) {
+      opts.onPut(daPath);
+    }
+    return {};
+  };
+
+  DaClientMock.prototype.deleteSource = async function deleteSource(org, repo, daPath) {
+    if (opts.deleteFails) {
+      throw new Error(`DELETE failed for ${daPath}`);
+    }
+    if (opts.onDelete) {
+      opts.onDelete(daPath);
+    }
+    return true;
+  };
+
+  return DaClientMock;
+}
diff --git a/test/content/da-api.test.js b/test/content/da-api.test.js
new file mode 100644
index 000000000..2cdb4af8b
--- /dev/null
+++ b/test/content/da-api.test.js
@@ -0,0 +1,405 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import { DaClient, getContentType } from '../../src/content/da-api.js';
+
+function mockResponse(status, body, ok = status >= 200 && status < 300, responseHeaders = {}) {
+  const lower = Object.fromEntries(
+    Object.entries(responseHeaders).map(([k, v]) => [k.toLowerCase(), v]),
+  );
+  return {
+    status,
+    ok,
+    statusText: ok ? 'OK' : String(status),
+    json: async () => body,
+    text: async () => (typeof body === 'string' ? body : JSON.stringify(body)),
+    arrayBuffer: async () => Buffer.from(typeof body === 'string' ? body : JSON.stringify(body)),
+    headers: {
+      get(name) {
+        return lower[name.toLowerCase()] ?? null;
+      },
+    },
+  };
+}
+
+describe('getContentType', () => {
+  it('returns text/html for html', () => {
+    assert.strictEqual(getContentType('html'), 'text/html');
+  });
+
+  it('returns application/json for json', () => {
+    assert.strictEqual(getContentType('json'), 'application/json');
+  });
+
+  it('returns image/svg+xml for svg', () => {
+    assert.strictEqual(getContentType('svg'), 'image/svg+xml');
+  });
+
+  it('returns image/png for png', () => {
+    assert.strictEqual(getContentType('png'), 'image/png');
+  });
+
+  it('returns image/jpeg for jpg', () => {
+    assert.strictEqual(getContentType('jpg'), 'image/jpeg');
+  });
+
+  it('returns image/jpeg for jpeg', () => {
+    assert.strictEqual(getContentType('jpeg'), 'image/jpeg');
+  });
+
+  it('returns image/gif for gif', () => {
+    assert.strictEqual(getContentType('gif'), 'image/gif');
+  });
+
+  it('returns image/webp for webp', () => {
+    assert.strictEqual(getContentType('webp'), 'image/webp');
+  });
+
+  it('returns application/pdf for pdf', () => {
+    assert.strictEqual(getContentType('pdf'), 'application/pdf');
+  });
+
+  it('returns application/octet-stream for unknown extension', () => {
+    assert.strictEqual(getContentType('zzzunknown'), 'application/octet-stream');
+  });
+
+  it('is case-insensitive', () => {
+    assert.strictEqual(getContentType('HTML'), 'text/html');
+    assert.strictEqual(getContentType('PNG'), 'image/png');
+  });
+
+  it('returns application/octet-stream for undefined', () => {
+    assert.strictEqual(getContentType(undefined), 'application/octet-stream');
+  });
+
+  it('returns application/octet-stream for null', () => {
+    assert.strictEqual(getContentType(null), 'application/octet-stream');
+  });
+});
+
+describe('DaClient', () => {
+  let client;
+
+  beforeEach(() => {
+    client = new DaClient('test-token');
+  });
+
+  describe('authHeader', () => {
+    it('returns Authorization Bearer header', () => {
+      assert.deepStrictEqual(client.authHeader, { Authorization: 'Bearer test-token' });
+    });
+  });
+
+  describe('list', () => {
+    it('returns parsed JSON on success', async () => {
+      const items = [{ path: '/org/repo/file.html', name: 'file.html', ext: 'html' }];
+      client.fetch = async () => mockResponse(200, items);
+      const result = await client.list('org', 'repo', '/');
+      assert.deepStrictEqual(result, items);
+    });
+
+    it('calls the correct URL', async () => {
+      let calledUrl;
+      client.fetch = async (url) => {
+        calledUrl = url;
+        return mockResponse(200, []);
+      };
+      await client.list('myorg', 'myrepo', '/some/path');
+      assert.strictEqual(calledUrl, 'https://admin.da.live/list/myorg/myrepo/some/path');
+    });
+
+    it('passes auth header', async () => {
+      let calledHeaders;
+      client.fetch = async (url, opts) => {
+        calledHeaders = opts.headers;
+        return mockResponse(200, []);
+      };
+      await client.list('org', 'repo', '/');
+      assert.deepStrictEqual(calledHeaders, { Authorization: 'Bearer test-token' });
+    });
+
+    it('throws Unauthorized on 401', async () => {
+      client.fetch = async () => mockResponse(401, 'Unauthorized', false);
+      await assert.rejects(() => client.list('org', 'repo', '/'), /Unauthorized/);
+    });
+
+    it('throws on non-ok status', async () => {
+      client.fetch = async () => mockResponse(500, 'Server Error', false);
+      await assert.rejects(() => client.list('org', 'repo', '/'), /List failed/);
+    });
+
+    it('follows da-continuation-token until no further pages', async () => {
+      let calls = 0;
+      client.fetch = async (url, opts) => {
+        calls += 1;
+        if (calls === 1) {
+          assert.strictEqual(opts.headers.Authorization, 'Bearer test-token');
+          assert.strictEqual(opts.headers['da-continuation-token'], undefined);
+          return mockResponse(
+            200,
+            [{ path: '/org/repo/a.html', name: 'a.html', ext: 'html' }],
+            true,
+            { 'da-continuation-token': 'page2token' },
+          );
+        }
+        assert.strictEqual(opts.headers['da-continuation-token'], 'page2token');
+        return mockResponse(200, [{ path: '/org/repo/b.html', name: 'b.html', ext: 'html' }], true, {});
+      };
+      const result = await client.list('org', 'repo', '/');
+      assert.strictEqual(calls, 2);
+      assert.strictEqual(result.length, 2);
+      assert.ok(result.some((i) => i.path === '/org/repo/a.html'));
+      assert.ok(result.some((i) => i.path === '/org/repo/b.html'));
+    });
+  });
+
+  describe('listAll', () => {
+    it('returns files directly for flat structure', async () => {
+      const items = [
+        { path: '/org/repo/a.html', name: 'a.html', ext: 'html' },
+        { path: '/org/repo/b.html', name: 'b.html', ext: 'html' },
+      ];
+      client.list = async () => items;
+      const result = await client.listAll('org', 'repo', '/');
+      assert.deepStrictEqual(result, items);
+    });
+
+    it('recurses into folders', async () => {
+      client.list = async (org, repo, daPath) => {
+        if (daPath === '/') {
+          return [
+            { path: '/org/repo/file.html', name: 'file.html', ext: 'html' },
+            { path: '/org/repo/sub', name: 'sub' },
+          ];
+        }
+        if (daPath === '/sub') {
+          return [{ path: '/org/repo/sub/page.html', name: 'page.html', ext: 'html' }];
+        }
+        return [];
+      };
+      const result = await client.listAll('org', 'repo', '/');
+      assert.strictEqual(result.length, 2);
+      assert.ok(result.some((f) => f.path === '/org/repo/file.html'));
+      assert.ok(result.some((f) => f.path === '/org/repo/sub/page.html'));
+    });
+
+    it('returns empty array for empty directory', async () => {
+      client.list = async () => [];
+      const result = await client.listAll('org', 'repo', '/');
+      assert.deepStrictEqual(result, []);
+    });
+
+    it('strips org/repo prefix when computing subfolder path', async () => {
+      const listedPaths = [];
+      client.list = async (org, repo, daPath) => {
+        listedPaths.push(daPath);
+        if (daPath === '/') {
+          return [{ path: '/org/repo/nested', name: 'nested' }];
+        }
+        return [];
+      };
+      await client.listAll('org', 'repo', '/');
+      assert.ok(listedPaths.includes('/nested'));
+    });
+
+    it('invokes onDiscovered with cumulative count for each file', async () => {
+      const counts = [];
+      client.list = async (org, repo, daPath) => {
+        if (daPath === '/') {
+          return [
+            { path: '/org/repo/a.html', name: 'a.html', ext: 'html' },
+            { path: '/org/repo/sub', name: 'sub' },
+          ];
+        }
+        if (daPath === '/sub') {
+          return [
+            { path: '/org/repo/sub/b.html', name: 'b.html', ext: 'html' },
+            { path: '/org/repo/sub/c.html', name: 'c.html', ext: 'html' },
+          ];
+        }
+        return [];
+      };
+      await client.listAll('org', 'repo', '/', (n) => counts.push(n));
+      assert.deepStrictEqual(counts, [1, 2, 3]);
+    });
+  });
+
+  describe('getSource', () => {
+    it('returns response on success', async () => {
+      const resp = mockResponse(200, '');
+      client.fetch = async () => resp;
+      const result = await client.getSource('org', 'repo', '/file.html');
+      assert.strictEqual(result, resp);
+    });
+
+    it('returns null on 404', async () => {
+      client.fetch = async () => mockResponse(404, 'Not Found', false);
+      const result = await client.getSource('org', 'repo', '/missing.html');
+      assert.strictEqual(result, null);
+    });
+
+    it('throws Unauthorized on 401', async () => {
+      client.fetch = async () => mockResponse(401, 'Unauthorized', false);
+      await assert.rejects(() => client.getSource('org', 'repo', '/file.html'), /Unauthorized/);
+    });
+
+    it('throws on non-ok, non-404 status', async () => {
+      client.fetch = async () => mockResponse(500, 'Error', false);
+      await assert.rejects(() => client.getSource('org', 'repo', '/file.html'), /GET failed/);
+    });
+
+    it('calls correct source URL', async () => {
+      let calledUrl;
+      client.fetch = async (url) => {
+        calledUrl = url;
+        return mockResponse(200, '');
+      };
+      await client.getSource('org', 'repo', '/path/to/file.html');
+      assert.strictEqual(calledUrl, 'https://admin.da.live/source/org/repo/path/to/file.html');
+    });
+  });
+
+  describe('putSource', () => {
+    it('returns parsed JSON on success', async () => {
+      const responseBody = { status: 'ok' };
+      client.fetch = async () => mockResponse(200, responseBody);
+      const result = await client.putSource('org', 'repo', '/file.html', Buffer.from(''), 'text/html');
+      assert.deepStrictEqual(result, responseBody);
+    });
+
+    it('sends PUT request', async () => {
+      let method;
+      client.fetch = async (url, opts) => {
+        method = opts.method;
+        return mockResponse(200, {});
+      };
+      await client.putSource('org', 'repo', '/file.html', Buffer.from(''), 'text/html');
+      assert.strictEqual(method, 'PUT');
+    });
+
+    it('calls correct source URL', async () => {
+      let calledUrl;
+      client.fetch = async (url) => {
+        calledUrl = url;
+        return mockResponse(200, {});
+      };
+      await client.putSource('org', 'repo', '/page.html', Buffer.from(''), 'text/html');
+      assert.strictEqual(calledUrl, 'https://admin.da.live/source/org/repo/page.html');
+    });
+
+    it('throws Unauthorized on 401', async () => {
+      client.fetch = async () => mockResponse(401, 'Unauthorized', false);
+      await assert.rejects(
+        () => client.putSource('org', 'repo', '/file.html', Buffer.from(''), 'text/html'),
+        /Unauthorized/,
+      );
+    });
+
+    it('throws on non-ok status', async () => {
+      client.fetch = async () => mockResponse(500, 'Error', false);
+      await assert.rejects(
+        () => client.putSource('org', 'repo', '/file.html', Buffer.from(''), 'text/html'),
+        /PUT failed/,
+      );
+    });
+  });
+
+  describe('deleteSource', () => {
+    it('returns true on ok response', async () => {
+      client.fetch = async () => mockResponse(200, 'deleted');
+      const result = await client.deleteSource('org', 'repo', '/file.html');
+      assert.strictEqual(result, true);
+    });
+
+    it('returns true on 204', async () => {
+      client.fetch = async () => ({ status: 204, ok: false });
+      const result = await client.deleteSource('org', 'repo', '/file.html');
+      assert.strictEqual(result, true);
+    });
+
+    it('sends DELETE request', async () => {
+      let method;
+      client.fetch = async (url, opts) => {
+        method = opts.method;
+        return mockResponse(200, '');
+      };
+      await client.deleteSource('org', 'repo', '/file.html');
+      assert.strictEqual(method, 'DELETE');
+    });
+
+    it('throws Unauthorized on 401', async () => {
+      client.fetch = async () => mockResponse(401, 'Unauthorized', false);
+      await assert.rejects(() => client.deleteSource('org', 'repo', '/file.html'), /Unauthorized/);
+    });
+
+    it('calls correct source URL', async () => {
+      let calledUrl;
+      client.fetch = async (url) => {
+        calledUrl = url;
+        return mockResponse(200, '');
+      };
+      await client.deleteSource('org', 'repo', '/dir/file.html');
+      assert.strictEqual(calledUrl, 'https://admin.da.live/source/org/repo/dir/file.html');
+    });
+  });
+
+  describe('getRemoteLastModified', () => {
+    it('returns parsed lastModified from last-modified header', async () => {
+      const date = 'Tue, 01 Jan 2025 00:00:00 GMT';
+      client.fetch = async () => mockResponse(200, '', true, { 'last-modified': date });
+      const result = await client.getRemoteLastModified('org', 'repo', '/file.html');
+      assert.strictEqual(result, new Date(date).getTime());
+    });
+
+    it('returns null when last-modified header is absent', async () => {
+      client.fetch = async () => mockResponse(200, '', true, {});
+      const result = await client.getRemoteLastModified('org', 'repo', '/file.html');
+      assert.strictEqual(result, null);
+    });
+
+    it('returns null on 404', async () => {
+      client.fetch = async () => mockResponse(404, '', false);
+      const result = await client.getRemoteLastModified('org', 'repo', '/missing.html');
+      assert.strictEqual(result, null);
+    });
+
+    it('throws Unauthorized on 401', async () => {
+      client.fetch = async () => mockResponse(401, '', false);
+      await assert.rejects(() => client.getRemoteLastModified('org', 'repo', '/file.html'), /Unauthorized/);
+    });
+
+    it('sends HEAD request to correct source URL', async () => {
+      let method;
+      let calledUrl;
+      client.fetch = async (url, opts) => {
+        method = opts.method;
+        calledUrl = url;
+        return mockResponse(200, '', true, {});
+      };
+      await client.getRemoteLastModified('org', 'repo', '/path/to/file.html');
+      assert.strictEqual(method, 'HEAD');
+      assert.strictEqual(calledUrl, 'https://admin.da.live/source/org/repo/path/to/file.html');
+    });
+
+    it('passes auth header', async () => {
+      let calledHeaders;
+      client.fetch = async (_url, opts) => {
+        calledHeaders = opts.headers;
+        return mockResponse(200, '', true, {});
+      };
+      await client.getRemoteLastModified('org', 'repo', '/file.html');
+      assert.deepStrictEqual(calledHeaders, { Authorization: 'Bearer test-token' });
+    });
+  });
+});
diff --git a/test/content/da-auth.test.js b/test/content/da-auth.test.js
new file mode 100644
index 000000000..3fb2a0254
--- /dev/null
+++ b/test/content/da-auth.test.js
@@ -0,0 +1,210 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import path from 'path';
+import esmock from 'esmock';
+import fse from 'fs-extra';
+import { makeLogger } from './content-test-utils.js';
+
+const TEST_PROJECT_DIR = '/tmp/test-da-project';
+
+function waitForTimeout(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}
+
+describe('getValidToken', () => {
+  it('returns override token immediately without reading stored token', async () => {
+    let fseCalled = false;
+    const { getValidToken } = await esmock('../../src/content/da-auth.js', {
+      'fs-extra': {
+        ...fse,
+        pathExists: async () => {
+          fseCalled = true;
+          return false;
+        },
+      },
+    });
+    const log = makeLogger();
+    const result = await getValidToken(log, 'my-explicit-token', TEST_PROJECT_DIR);
+    assert.strictEqual(result, 'my-explicit-token');
+    assert.strictEqual(fseCalled, false);
+  });
+
+  it('returns stored access token when valid', async () => {
+    const tokenData = {
+      access_token: 'stored-token',
+      expires_at: Date.now() + 60_000 * 10,
+    };
+    const { getValidToken } = await esmock('../../src/content/da-auth.js', {
+      'fs-extra': {
+        ...fse,
+        pathExists: async () => true,
+        readJson: async () => tokenData,
+      },
+    });
+    const log = makeLogger();
+    const result = await getValidToken(log, undefined, TEST_PROJECT_DIR);
+    assert.strictEqual(result, 'stored-token');
+  });
+
+  it('logs expiry message and calls login when stored token is expired', async () => {
+    const tokenData = {
+      access_token: 'old-token',
+      expires_at: Date.now() - 1000,
+    };
+    const { getValidToken } = await esmock('../../src/content/da-auth.js', {
+      'fs-extra': {
+        ...fse,
+        pathExists: async () => true,
+        readJson: async () => tokenData,
+        ensureDir: async () => {},
+        writeJson: async () => {},
+      },
+      open: async () => {},
+    });
+    const log = makeLogger();
+    try {
+      await Promise.race([
+        getValidToken(log, undefined, TEST_PROJECT_DIR),
+        waitForTimeout(100).then(() => { throw new Error('timeout'); }),
+      ]);
+    } catch (err) {
+      const msgs = log.logs.map((l) => l.msg).join(' ');
+      const isExpectedError = err.message === 'timeout'
+        || err.message.includes('login')
+        || err.message.includes('EADDRINUSE')
+        || err.message.includes('callback');
+      const hasExpiredLog = msgs.includes('expired') || msgs.includes('login') || msgs.includes('browser');
+      assert.ok(isExpectedError || hasExpiredLog);
+    }
+  });
+
+  it('proceeds to login when no stored token file exists', async () => {
+    const { getValidToken } = await esmock('../../src/content/da-auth.js', {
+      'fs-extra': {
+        ...fse,
+        pathExists: async () => false,
+        ensureDir: async () => {},
+        writeJson: async () => {},
+      },
+      open: async () => {},
+    });
+    const log = makeLogger();
+    try {
+      await Promise.race([
+        getValidToken(log, undefined, TEST_PROJECT_DIR),
+        waitForTimeout(100).then(() => { throw new Error('timeout'); }),
+      ]);
+    } catch (err) {
+      assert.ok(
+        err.message === 'timeout'
+          || err.message.includes('login')
+          || err.message.includes('EADDRINUSE')
+          || err.message.includes('callback'),
+      );
+    }
+  });
+
+  it('treats stored token without expires_at as expired', async () => {
+    const tokenData = { access_token: 'legacy-token' };
+    const { getValidToken } = await esmock('../../src/content/da-auth.js', {
+      'fs-extra': {
+        ...fse,
+        pathExists: async () => true,
+        readJson: async () => tokenData,
+        ensureDir: async () => {},
+        writeJson: async () => {},
+      },
+      open: async () => {},
+    });
+    const log = makeLogger();
+    try {
+      await Promise.race([
+        getValidToken(log, undefined, TEST_PROJECT_DIR),
+        waitForTimeout(100).then(() => { throw new Error('timeout'); }),
+      ]);
+    } catch (err) {
+      assert.ok(
+        err.message === 'timeout'
+          || err.message.includes('login')
+          || err.message.includes('EADDRINUSE')
+          || err.message.includes('callback'),
+      );
+    }
+  });
+
+  it('calls ensureGitIgnored with the token file path after login', async () => {
+    let gitIgnoredEntry;
+    // Mock http so no real socket is bound (avoids EADDRINUSE from other tests)
+    // When listen() is called, simulate the /token request firing immediately.
+    const { getValidToken } = await esmock('../../src/content/da-auth.js', {
+      'node:http': {
+        default: {
+          createServer: (reqHandler) => {
+            const mockServer = {
+              listen: () => {
+                setImmediate(() => {
+                  const fakeReq = { url: '/token?access_token=test-token&expires_in=3600' };
+                  const fakeRes = { writeHead: () => {}, end: () => {} };
+                  reqHandler(fakeReq, fakeRes);
+                });
+              },
+              close: () => {},
+              on: () => {},
+            };
+            return mockServer;
+          },
+        },
+      },
+      'fs-extra': {
+        ...fse,
+        pathExists: async () => false,
+        ensureDir: async () => {},
+        writeJson: async () => {},
+      },
+      '../../src/content/content-git.js': {
+        ensureGitIgnored: async (_dir, entry) => {
+          gitIgnoredEntry = entry;
+        },
+      },
+      open: async () => {},
+    });
+    const log = makeLogger();
+    await getValidToken(log, undefined, TEST_PROJECT_DIR);
+    assert.strictEqual(gitIgnoredEntry, path.join('.hlx', '.da-token.json'));
+  });
+
+  it('reads token file from the content directory', async () => {
+    const tokenData = {
+      access_token: 'valid-token',
+      expires_at: Date.now() + 3_600_000,
+    };
+    let readPath;
+    const { getValidToken } = await esmock('../../src/content/da-auth.js', {
+      'fs-extra': {
+        ...fse,
+        pathExists: async (p) => {
+          readPath = p;
+          return true;
+        },
+        readJson: async () => tokenData,
+      },
+    });
+    const log = makeLogger();
+    await getValidToken(log, undefined, TEST_PROJECT_DIR);
+    assert.strictEqual(readPath, path.join(TEST_PROJECT_DIR, '.hlx', '.da-token.json'));
+  });
+});
diff --git a/test/content/diff.cmd.test.js b/test/content/diff.cmd.test.js
new file mode 100644
index 000000000..ef2c34ace
--- /dev/null
+++ b/test/content/diff.cmd.test.js
@@ -0,0 +1,168 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import path from 'path';
+import fse from 'fs-extra';
+import esmock from 'esmock';
+import { createTestRoot } from '../utils.js';
+import { makeLogger, setupContentDir, createDaClientClass } from './content-test-utils.js';
+
+async function makeDiffCommand(testRoot, DaClientClass) {
+  const mod = await esmock('../../src/content/diff.cmd.js', {
+    '../../src/content/da-auth.js': { getValidToken: async () => 'mock-token' },
+    '../../src/content/da-api.js': { DaClient: DaClientClass },
+  });
+  const Cmd = mod.default;
+  return new Cmd(makeLogger()).withDirectory(testRoot);
+}
+
+describe('DiffCommand', () => {
+  let testRoot;
+
+  beforeEach(async () => {
+    testRoot = await createTestRoot();
+  });
+
+  afterEach(async () => {
+    await fse.remove(testRoot);
+  });
+
+  describe('builder methods', () => {
+    it('withDirectory returns this', async () => {
+      const cmd = await makeDiffCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withDirectory('/tmp'), cmd);
+    });
+
+    it('withToken returns this', async () => {
+      const cmd = await makeDiffCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withToken('t'), cmd);
+    });
+
+    it('withFilePath returns this', async () => {
+      const cmd = await makeDiffCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withFilePath('/file.html'), cmd);
+    });
+
+    it('withFilePath stores null for falsy values', async () => {
+      const cmd = await makeDiffCommand(testRoot, createDaClientClass());
+      cmd.withFilePath(undefined);
+      assert.strictEqual(cmd._filePath, null); // eslint-disable-line no-underscore-dangle
+    });
+  });
+
+  describe('run()', () => {
+    it('throws when no config found', async () => {
+      const cmd = await makeDiffCommand(testRoot, createDaClientClass());
+      await assert.rejects(() => cmd.run(), /No config found/);
+    });
+
+    it('reports no changes when working tree is clean', async () => {
+      await setupContentDir(testRoot);
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/diff.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Nothing to diff')));
+      assert.ok(log.logs.some((l) => l.msg.includes('last commit')));
+    });
+
+    it('reports no changes for specific file when unmodified', async () => {
+      await setupContentDir(testRoot);
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/diff.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot).withFilePath('/index.html');
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('No local changes detected')));
+    });
+
+    it('does not throw when file path lacks leading slash', async () => {
+      await setupContentDir(testRoot);
+      const mod = await esmock('../../src/content/diff.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(makeLogger()).withDirectory(testRoot).withFilePath('index.html');
+      await cmd.run();
+    });
+
+    it('generates a diff for modified files', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(
+        path.join(contentDir, 'index.html'),
+        '
local change
',
+      );
+
+      const written = [];
+      const origWrite = process.stdout.write.bind(process.stdout);
+      process.stdout.write = (s) => {
+        written.push(s);
+        return true;
+      };
+
+      try {
+        const DaClientClass = createDaClientClass({
+          sourceContent: '
remote
',
+        });
+        const mod = await esmock('../../src/content/diff.cmd.js', {
+          '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+          '../../src/content/da-api.js': { DaClient: DaClientClass },
+        });
+        const Cmd = mod.default;
+        const cmd = new Cmd(makeLogger()).withDirectory(testRoot);
+        await cmd.run();
+      } finally {
+        process.stdout.write = origWrite;
+      }
+
+      const output = written.join('');
+      assert.ok(output.includes('@@') || output.includes('---') || output.includes('+++'));
+    });
+
+    it('handles null remote content gracefully', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'new content');
+
+      const written = [];
+      const origWrite = process.stdout.write.bind(process.stdout);
+      process.stdout.write = (s) => {
+        written.push(s);
+        return true;
+      };
+
+      try {
+        const DaClientClass = createDaClientClass({ sourceContent: null });
+        const mod = await esmock('../../src/content/diff.cmd.js', {
+          '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+          '../../src/content/da-api.js': { DaClient: DaClientClass },
+        });
+        const Cmd = mod.default;
+        const cmd = new Cmd(makeLogger()).withDirectory(testRoot);
+        await cmd.run();
+      } finally {
+        process.stdout.write = origWrite;
+      }
+    });
+  });
+});
diff --git a/test/content/merge.cmd.test.js b/test/content/merge.cmd.test.js
new file mode 100644
index 000000000..6511cef0f
--- /dev/null
+++ b/test/content/merge.cmd.test.js
@@ -0,0 +1,205 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import path from 'path';
+import fse from 'fs-extra';
+import esmock from 'esmock';
+import { createTestRoot } from '../utils.js';
+import { makeLogger, setupContentDir, createDaClientClass } from './content-test-utils.js';
+
+async function makeMergeCommand(testRoot, DaClientClass) {
+  const mod = await esmock('../../src/content/merge.cmd.js', {
+    '../../src/content/da-auth.js': { getValidToken: async () => 'mock-token' },
+    '../../src/content/da-api.js': { DaClient: DaClientClass },
+  });
+  const Cmd = mod.default;
+  return new Cmd(makeLogger()).withDirectory(testRoot);
+}
+
+describe('MergeCommand', () => {
+  let testRoot;
+
+  beforeEach(async () => {
+    testRoot = await createTestRoot();
+  });
+
+  afterEach(async () => {
+    await fse.remove(testRoot);
+  });
+
+  describe('builder methods', () => {
+    it('withDirectory returns this', async () => {
+      const cmd = await makeMergeCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withDirectory('/tmp'), cmd);
+    });
+
+    it('withToken returns this', async () => {
+      const cmd = await makeMergeCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withToken('t'), cmd);
+    });
+
+    it('withFilePath returns this', async () => {
+      const cmd = await makeMergeCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withFilePath('/file.html'), cmd);
+    });
+
+    it('withFilePath stores null for falsy values', async () => {
+      const cmd = await makeMergeCommand(testRoot, createDaClientClass());
+      cmd.withFilePath(null);
+      assert.strictEqual(cmd._filePath, null); // eslint-disable-line no-underscore-dangle
+    });
+  });
+
+  describe('run()', () => {
+    it('throws when no config found', async () => {
+      const cmd = await makeMergeCommand(testRoot, createDaClientClass());
+      await assert.rejects(() => cmd.run(), /No config found/);
+    });
+
+    it('reports nothing to merge when working tree is clean', async () => {
+      await setupContentDir(testRoot);
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/merge.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Nothing to merge')));
+    });
+
+    it('reports no changes for specific file when unmodified', async () => {
+      await setupContentDir(testRoot);
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/merge.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot).withFilePath('/index.html');
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('No local changes detected')));
+    });
+
+    it('performs merge when local file is modified', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(
+        path.join(contentDir, 'index.html'),
+        '
index
local addition
',
+      );
+
+      const log = makeLogger();
+      const DaClientClass = createDaClientClass({
+        sourceContent: '
index
',
+      });
+      const mod = await esmock('../../src/content/merge.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: DaClientClass },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('merged') || l.msg.includes('Merge')));
+    });
+
+    it('writes merged result to the local file', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(
+        path.join(contentDir, 'index.html'),
+        '
index
local extra
',
+      );
+
+      const DaClientClass = createDaClientClass({
+        sourceContent: '
index
',
+      });
+      const mod = await esmock('../../src/content/merge.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: DaClientClass },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(makeLogger()).withDirectory(testRoot);
+      await cmd.run();
+
+      const merged = await fse.readFile(path.join(contentDir, 'index.html'), 'utf-8');
+      assert.ok(merged.length > 0);
+    });
+
+    it('produces conflict markers when local and remote diverge from the same base', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      // base: '
index
'
+      // local: completely different content → conflict with remote
+      await fse.writeFile(
+        path.join(contentDir, 'index.html'),
+        '
completely different local
',
+      );
+
+      const log = makeLogger();
+      const DaClientClass = createDaClientClass({
+        sourceContent: '
completely different remote
',
+      });
+      const mod = await esmock('../../src/content/merge.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: DaClientClass },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      const mergedContent = await fse.readFile(
+        path.join(contentDir, 'index.html'),
+        'utf-8',
+      );
+      const hasConflictMarker = mergedContent.includes('<<<<<<< LOCAL');
+      const hasMergeLog = log.logs.some((l) => l.msg.includes('merged') || l.msg.includes('CONFLICT'));
+      assert.ok(hasConflictMarker || hasMergeLog);
+    });
+
+    it('logs merge complete message', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(
+        path.join(contentDir, 'index.html'),
+        '
local conflict
',
+      );
+
+      const log = makeLogger();
+      const DaClientClass = createDaClientClass({
+        sourceContent: '
remote conflict
',
+      });
+      const mod = await esmock('../../src/content/merge.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: DaClientClass },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Merge complete')));
+    });
+
+    it('normalizes file path by adding leading slash', async () => {
+      await setupContentDir(testRoot);
+      const mod = await esmock('../../src/content/merge.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': { DaClient: createDaClientClass() },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(makeLogger()).withDirectory(testRoot).withFilePath('index.html');
+      await cmd.run();
+    });
+  });
+});
diff --git a/test/content/push.cmd.test.js b/test/content/push.cmd.test.js
new file mode 100644
index 000000000..0e1448f0f
--- /dev/null
+++ b/test/content/push.cmd.test.js
@@ -0,0 +1,279 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import path from 'path';
+import fse from 'fs-extra';
+import esmock from 'esmock';
+import { createTestRoot } from '../utils.js';
+import {
+  makeLogger,
+  setupContentDir,
+  createDaClientClass,
+  stageAllAndCommit,
+} from './content-test-utils.js';
+
+async function makePushCommand(testRoot, DaClientClass) {
+  const mod = await esmock('../../src/content/push.cmd.js', {
+    '../../src/content/da-auth.js': { getValidToken: async () => 'mock-token' },
+    '../../src/content/da-api.js': {
+      DaClient: DaClientClass,
+      getContentType: () => 'text/html',
+    },
+  });
+  const Cmd = mod.default;
+  return new Cmd(makeLogger()).withDirectory(testRoot);
+}
+
+describe('PushCommand', () => {
+  let testRoot;
+
+  beforeEach(async () => {
+    testRoot = await createTestRoot();
+  });
+
+  afterEach(async () => {
+    await fse.remove(testRoot);
+  });
+
+  describe('builder methods', () => {
+    it('withToken returns this', async () => {
+      const cmd = await makePushCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withToken('t'), cmd);
+    });
+
+    it('withForce returns this', async () => {
+      const cmd = await makePushCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withForce(true), cmd);
+    });
+
+    it('withDryRun returns this', async () => {
+      const cmd = await makePushCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withDryRun(true), cmd);
+    });
+
+    it('withPath returns this', async () => {
+      const cmd = await makePushCommand(testRoot, createDaClientClass());
+      assert.strictEqual(cmd.withPath('/blog'), cmd);
+    });
+
+    it('withPath stores null for falsy values', async () => {
+      const cmd = await makePushCommand(testRoot, createDaClientClass());
+      cmd.withPath(undefined);
+      assert.strictEqual(cmd._pushPath, null); // eslint-disable-line no-underscore-dangle
+    });
+  });
+
+  describe('run()', () => {
+    it('throws when no config found', async () => {
+      const cmd = await makePushCommand(testRoot, createDaClientClass());
+      await assert.rejects(() => cmd.run(), /No config found/);
+    });
+
+    it('reports nothing to push when working tree is clean', async () => {
+      await setupContentDir(testRoot);
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: createDaClientClass(),
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Nothing to push')));
+      assert.ok(log.logs.some((l) => l.msg.includes('last da.live sync')));
+    });
+
+    it('rejects push when there are uncommitted changes', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed');
+
+      const cmd = await makePushCommand(testRoot, createDaClientClass());
+      await assert.rejects(() => cmd.run(), /uncommitted changes/);
+    });
+
+    it('dry-run shows what would be pushed without pushing', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed');
+      await stageAllAndCommit(contentDir, 'edit index');
+
+      let putCalled = false;
+      const DaClientClass = createDaClientClass({
+        onPut: () => {
+          putCalled = true;
+        },
+      });
+
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: DaClientClass,
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot).withDryRun(true);
+      await cmd.run();
+
+      assert.strictEqual(putCalled, false);
+      assert.ok(log.logs.some((l) => l.msg.includes('Dry run')));
+    });
+
+    it('aborts on conflict without --force', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed');
+      await stageAllAndCommit(contentDir, 'edit index');
+
+      // Remote modified time is in the future (more recent than our last sync)
+      const DaClientClass = createDaClientClass({ remoteLastModified: Date.now() + 60_000 });
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: DaClientClass,
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Conflicts') || l.msg.includes('aborted')));
+    });
+
+    it('pushes despite conflict when --force is set', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed');
+      await stageAllAndCommit(contentDir, 'edit index');
+
+      let putCalled = false;
+      const DaClientClass = createDaClientClass({
+        remoteLastModified: Date.now() + 60_000,
+        onPut: () => { putCalled = true; },
+      });
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: DaClientClass,
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot).withForce(true);
+      await cmd.run();
+
+      assert.strictEqual(putCalled, true);
+    });
+
+    it('pushes modified files to da.live', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed content');
+      await stageAllAndCommit(contentDir, 'edit index');
+
+      const pushed = [];
+      const DaClientClass = createDaClientClass({ onPut: (p) => pushed.push(p) });
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: DaClientClass,
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(pushed.includes('/index.html'));
+    });
+
+    it('deletes removed files from da.live', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.remove(path.join(contentDir, 'index.html'));
+      await stageAllAndCommit(contentDir, 'drop index');
+
+      const deleted = [];
+      const DaClientClass = createDaClientClass({ onDelete: (p) => deleted.push(p) });
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: DaClientClass,
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(deleted.includes('/index.html'));
+    });
+
+    it('only pushes files matching --path filter', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed');
+      await fse.writeFile(path.join(contentDir, 'blog', 'post.html'), 'changed blog');
+      await stageAllAndCommit(contentDir, 'edit pages');
+
+      const pushed = [];
+      const DaClientClass = createDaClientClass({ onPut: (p) => pushed.push(p) });
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: DaClientClass,
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot).withPath('/blog');
+      await cmd.run();
+
+      assert.ok(pushed.includes('/blog/post.html'));
+      assert.ok(!pushed.includes('/index.html'));
+    });
+
+    it('shows dry-run added/modified/deleted sections', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed');
+      await fse.writeFile(path.join(contentDir, 'new.html'), 'new');
+      await fse.remove(path.join(contentDir, 'blog', 'post.html'));
+      await stageAllAndCommit(contentDir, 'mixed changes');
+
+      const log = makeLogger();
+      const mod = await esmock('../../src/content/push.cmd.js', {
+        '../../src/content/da-auth.js': { getValidToken: async () => 'token' },
+        '../../src/content/da-api.js': {
+          DaClient: createDaClientClass(),
+          getContentType: () => 'text/html',
+        },
+      });
+      const Cmd = mod.default;
+      const cmd = new Cmd(log).withDirectory(testRoot).withDryRun(true);
+      await cmd.run();
+
+      const allMsgs = log.logs.map((l) => l.msg).join('\n');
+      assert.ok(
+        allMsgs.includes('Would update')
+        || allMsgs.includes('Would add')
+        || allMsgs.includes('Would delete'),
+      );
+    });
+  });
+});
diff --git a/test/content/status.cmd.test.js b/test/content/status.cmd.test.js
new file mode 100644
index 000000000..f46fff6e1
--- /dev/null
+++ b/test/content/status.cmd.test.js
@@ -0,0 +1,114 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import path from 'path';
+import fse from 'fs-extra';
+import { createTestRoot } from '../utils.js';
+import StatusCommand from '../../src/content/status.cmd.js';
+import { makeLogger, setupContentDir } from './content-test-utils.js';
+
+describe('StatusCommand', () => {
+  let testRoot;
+
+  beforeEach(async () => {
+    testRoot = await createTestRoot();
+  });
+
+  afterEach(async () => {
+    await fse.remove(testRoot);
+  });
+
+  describe('withDirectory', () => {
+    it('returns this for chaining', () => {
+      const cmd = new StatusCommand(makeLogger());
+      assert.strictEqual(cmd.withDirectory('/tmp'), cmd);
+    });
+  });
+
+  describe('run()', () => {
+    it('throws when no .da-config.json found', async () => {
+      const cmd = new StatusCommand(makeLogger()).withDirectory(testRoot);
+      await assert.rejects(() => cmd.run(), /No config found/);
+    });
+
+    it('reports nothing to push when working tree is clean', async () => {
+      await setupContentDir(testRoot);
+      const log = makeLogger();
+      const cmd = new StatusCommand(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Nothing to push to da.live')));
+    });
+
+    it('reports modified files', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), '
changed
');
+
+      const log = makeLogger();
+      const cmd = new StatusCommand(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Modified')));
+      assert.ok(log.logs.some((l) => l.msg.includes('not committed')));
+      assert.ok(log.logs.some((l) => l.msg.includes('/index.html')));
+    });
+
+    it('reports added files', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'new-page.html'), 'new');
+
+      const log = makeLogger();
+      const cmd = new StatusCommand(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Added')));
+      assert.ok(log.logs.some((l) => l.msg.includes('/new-page.html')));
+    });
+
+    it('reports deleted files', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.remove(path.join(contentDir, 'index.html'));
+
+      const log = makeLogger();
+      const cmd = new StatusCommand(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('Deleted')));
+      assert.ok(log.logs.some((l) => l.msg.includes('/index.html')));
+    });
+
+    it('prints org/repo from config', async () => {
+      await setupContentDir(testRoot, 'testorg', 'testrepo');
+      const log = makeLogger();
+      const cmd = new StatusCommand(log).withDirectory(testRoot);
+      await cmd.run();
+
+      assert.ok(log.logs.some((l) => l.msg.includes('testorg/testrepo')));
+    });
+
+    it('prints summary counts when changes exist', async () => {
+      const contentDir = await setupContentDir(testRoot);
+      await fse.writeFile(path.join(contentDir, 'index.html'), 'changed');
+      await fse.writeFile(path.join(contentDir, 'new.html'), 'new');
+      await fse.remove(path.join(contentDir, 'blog', 'post.html'));
+
+      const log = makeLogger();
+      const cmd = new StatusCommand(log).withDirectory(testRoot);
+      await cmd.run();
+
+      const summary = log.logs.find((l) => l.msg.includes('added') && l.msg.includes('modified') && l.msg.includes('deleted'));
+      assert.ok(summary);
+    });
+  });
+});
diff --git a/test/metadata-sheet-support.test.js b/test/metadata-sheet-support.test.js
new file mode 100644
index 000000000..9ba4ffe33
--- /dev/null
+++ b/test/metadata-sheet-support.test.js
@@ -0,0 +1,50 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+/* eslint-env mocha */
+import assert from 'assert';
+import {
+  normalizePathForMetadataMatch,
+  compileMetadataSheetPatterns,
+  mergeMetadataSheetRows,
+} from '../src/server/MetadataSheetSupport.js';
+
+describe('MetadataSheetSupport', () => {
+  it('normalizePathForMetadataMatch strips .html', () => {
+    assert.strictEqual(normalizePathForMetadataMatch('/a/b/c.html'), '/a/b/c');
+    assert.strictEqual(normalizePathForMetadataMatch('/x'), '/x');
+  });
+
+  it('mergeMetadataSheetRows uses template from specific row and nav from broader when specific leaves nav empty', () => {
+    const rows = [
+      { URL: '/ca/fr_ca/**', nav: '/nav1', template: 'broad' },
+      { URL: '/ca/fr_ca/recipes/**', nav: '', template: 'recipe' },
+    ];
+    const compiled = compileMetadataSheetPatterns(rows);
+    const hit = mergeMetadataSheetRows('/ca/fr_ca/recipes/chicken', compiled);
+    assert.ok(hit);
+    assert.strictEqual(hit.template, 'recipe');
+    assert.strictEqual(hit.nav, '/nav1');
+  });
+
+  it('mergeMetadataSheetRows returns broader rule when specific does not match', () => {
+    const rows = [
+      { URL: '/ca/fr_ca/**', nav: '/nav1', template: 'section' },
+      { URL: '/ca/fr_ca/recipes/**', template: 'recipe' },
+    ];
+    const compiled = compileMetadataSheetPatterns(rows);
+    const hit = mergeMetadataSheetRows('/ca/fr_ca/about', compiled);
+    assert.ok(hit);
+    assert.strictEqual(hit.template, 'section');
+    assert.strictEqual(hit.nav, '/nav1');
+  });
+});
diff --git a/test/server-html-folder.test.js b/test/server-html-folder.test.js
index cab59c8d6..337ec32b8 100644
--- a/test/server-html-folder.test.js
+++ b/test/server-html-folder.test.js
@@ -1389,7 +1389,7 @@ describe('Helix Server - HTML Folder', () => {
   describe('Default mount (backward compatibility)', () => {
     it('without --html-mount, serves at /folder/* as before', async () => {
       const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
-      const contentFolder = path.join(cwd, 'content');
+      const contentFolder = path.join(cwd, 'html');
       await fs.mkdir(contentFolder, { recursive: true });
       await fs.writeFile(path.join(contentFolder, 'my-page.html'), 'Default Mount Page');
 
@@ -1402,22 +1402,22 @@ describe('Helix Server - HTML Folder', () => {
         .withLogger(console)
         .withHttpPort(0)
         .withProxyUrl('https://main--foo--bar.aem.page/')
-        .withHtmlFolder('content');
+        .withHtmlFolder('html');
 
       await project.init();
       try {
         await project.start();
 
-        // /content/my-page should work (default mount is /content)
-        const prefixedResponse = await fetch(`http://127.0.0.1:${project.server.port}/content/my-page`);
-        assert.equal(prefixedResponse.status, 200, 'Default mount should serve at /content/*');
+        // /html/my-page should work (default mount is /html, matching the folder name)
+        const prefixedResponse = await fetch(`http://127.0.0.1:${project.server.port}/html/my-page`);
+        assert.equal(prefixedResponse.status, 200, 'Default mount should serve at /html/*');
 
         const content = await prefixedResponse.text();
         assert.ok(content.includes('Default Mount Page'));
 
-        // /my-page should NOT be served (mount is /content, not /)
+        // /my-page should NOT be served (mount is /html, not /)
         const cleanResponse = await fetch(`http://127.0.0.1:${project.server.port}/my-page`);
-        assert.equal(cleanResponse.status, 404, 'Should not serve at root when default mount is /content');
+        assert.equal(cleanResponse.status, 404, 'Should not serve at root when default mount is /html');
       } finally {
         await project.stop();
       }
diff --git a/test/server.test.js b/test/server.test.js
index 17238ad55..3c9c7ecbc 100644
--- a/test/server.test.js
+++ b/test/server.test.js
@@ -28,6 +28,7 @@ import {
 import { getFetch } from '../src/fetch-utils.js';
 import { getSiteTokenFromFile } from '../src/config/config-utils.js';
 import packageJson from '../src/package.cjs';
+import { CONTENT_DIR } from '../src/content/content-shared.js';
 
 describe('Helix Server', () => {
   let nock;
@@ -1141,4 +1142,211 @@ describe('Helix Server', () => {
       }
     });
   });
+
+  describe('content/ serving', () => {
+    it('serves a plain file from content/ without hitting the proxy', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      await fse.ensureDir(path.join(cwd, CONTENT_DIR, 'blog'));
+      await fse.writeFile(path.join(cwd, CONTENT_DIR, 'blog', 'post.json'), '{"title":"local"}');
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withProxyUrl('http://main--foo--bar.aem.page')
+        .withHttpPort(0);
+      await project.init();
+      try {
+        await project.start();
+        const resp = await getFetch()(`http://127.0.0.1:${project.server.port}/blog/post.json`);
+        assert.strictEqual(resp.status, 200);
+        const body = await resp.text();
+        assert.strictEqual(body, '{"title":"local"}');
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('serves a body-only HTML file from content/ and injects head.html', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      await fse.ensureDir(path.join(cwd, CONTENT_DIR));
+      // content/ files are plain HTML (body only, no ) as stored by da.live
+      await fse.writeFile(
+        path.join(cwd, CONTENT_DIR, 'index.html'),
+        '
local content
',
+      );
+      await fse.writeFile(
+        path.join(cwd, 'head.html'),
+        '',
+      );
+
+      nock('http://main--foo--bar.aem.page')
+        .get('/head.html')
+        .reply(200, '', { 'content-type': 'text/html' })
+        .get('/metadata.json')
+        .reply(200, { data: [] });
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withProxyUrl('http://main--foo--bar.aem.page')
+        .withHttpPort(0);
+      await project.init();
+      try {
+        await project.start();
+        const resp = await getFetch()(`http://127.0.0.1:${project.server.port}/index.html`);
+        assert.strictEqual(resp.status, 200);
+        const body = await resp.text();
+        assert.ok(body.includes('local content'));
+        assert.ok(body.includes(''));
+        assert.ok(body.includes('/styles.css'));
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('strips content/ metadata block and injects meta tags in head', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      const recipeDir = path.join(cwd, CONTENT_DIR, 'ca', 'fr_ca', 'recipes');
+      await fse.ensureDir(recipeDir);
+      await fse.writeFile(
+        path.join(recipeDir, 'chicken.html'),
+        '
Ramen
'
+        + '
'
+        + '
Total Time
00:17:30
'
+        + '
Yield
4 portions
'
+        + '
',
+      );
+      await fse.writeFile(
+        path.join(cwd, 'head.html'),
+        '',
+      );
+
+      nock('http://main--foo--bar.aem.page')
+        .get('/head.html')
+        .reply(200, '', { 'content-type': 'text/html' })
+        .get('/metadata.json')
+        .reply(200, {
+          data: [
+            {
+              URL: '/ca/fr_ca/**',
+              nav: '/ca/fr_ca/nav/nav',
+              footer: '/ca/fr_ca/footer/footer',
+              template: 'section',
+            },
+            {
+              URL: '/ca/fr_ca/recipes/**',
+              nav: '',
+              footer: '',
+              'nav-banners': '',
+              template: 'recipe',
+            },
+          ],
+          ':type': 'sheet',
+        });
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withProxyUrl('http://main--foo--bar.aem.page')
+        .withHttpPort(0);
+      await project.init();
+      try {
+        await project.start();
+        const { port } = project.server;
+        const resp = await getFetch()(`http://127.0.0.1:${port}/ca/fr_ca/recipes/chicken`);
+        assert.strictEqual(resp.status, 200);
+        const body = await resp.text();
+        assert.ok(!body.includes('
'));
+        assert.ok(body.includes('name="total-time"'));
+        assert.ok(body.includes('content="00:17:30"'));
+        assert.ok(body.includes('property="og:title"'));
+        assert.ok(body.includes('content="Ramen"'));
+        assert.ok(body.includes(`http://127.0.0.1:${port}/ca/fr_ca/recipes/chicken`));
+        assert.ok(body.includes('name="template"'));
+        assert.ok(body.includes('content="recipe"'));
+        assert.ok(!body.includes('content="section"'));
+        assert.ok(body.includes('name="nav"'));
+        assert.ok(body.includes('content="/ca/fr_ca/nav/nav"'));
+        assert.ok(body.includes('name="footer"'));
+        assert.ok(body.includes('content="/ca/fr_ca/footer/footer"'));
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('falls through to proxy when file is not in content/', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      await fse.ensureDir(path.join(cwd, CONTENT_DIR));
+      // content/ exists but does NOT contain /page.html
+
+      nock('http://main--foo--bar.aem.page')
+        .get('/page.html')
+        .reply(200, 'from proxy', { 'content-type': 'text/html' })
+        .get('/head.html')
+        .reply(200, '', { 'content-type': 'text/html' });
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withProxyUrl('http://main--foo--bar.aem.page')
+        .withHttpPort(0);
+      await project.init();
+      try {
+        await project.start();
+        const resp = await getFetch()(`http://127.0.0.1:${project.server.port}/page.html`);
+        assert.strictEqual(resp.status, 200);
+        const body = await resp.text();
+        assert.ok(body.includes('from proxy'));
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('does not serve directories from content/', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      await fse.ensureDir(path.join(cwd, CONTENT_DIR, 'blog'));
+
+      nock('http://main--foo--bar.aem.page')
+        .get('/blog')
+        .reply(200, 'proxy blog index', { 'content-type': 'text/html' })
+        .get('/head.html')
+        .reply(200, '', { 'content-type': 'text/html' });
+
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withProxyUrl('http://main--foo--bar.aem.page')
+        .withHttpPort(0);
+      await project.init();
+      try {
+        await project.start();
+        const resp = await getFetch()(`http://127.0.0.1:${project.server.port}/blog`);
+        // Should not serve the directory — fall through to proxy
+        const body = await resp.text();
+        assert.ok(body.includes('proxy blog index'));
+      } finally {
+        await project.stop();
+      }
+    });
+
+    it('prefers content/ over proxy even when project dir has no such file', async () => {
+      const cwd = await setupProject(path.join(__rootdir, 'test', 'fixtures', 'project'), testRoot);
+      await fse.ensureDir(path.join(cwd, CONTENT_DIR));
+      await fse.writeFile(
+        path.join(cwd, CONTENT_DIR, 'data.json'),
+        '{"source":"content"}',
+      );
+
+      // Proxy should NOT be called for this path
+      const project = new HelixProject()
+        .withCwd(cwd)
+        .withProxyUrl('http://main--foo--bar.aem.page')
+        .withHttpPort(0);
+      await project.init();
+      try {
+        await project.start();
+        const resp = await getFetch()(`http://127.0.0.1:${project.server.port}/data.json`);
+        assert.strictEqual(resp.status, 200);
+        const body = await resp.text();
+        assert.strictEqual(body, '{"source":"content"}');
+      } finally {
+        await project.stop();
+      }
+    });
+  });
 });

From 2880da00e47cb81da56686025d9f2e4f003ca200 Mon Sep 17 00:00:00 2001
From: semantic-release-bot 
Date: Thu, 16 Apr 2026 14:41:47 +0000
Subject: [PATCH 06/21] chore(release): 16.18.0 [skip ci]

# [16.18.0](https://github.com/adobe/helix-cli/compare/v16.17.1...v16.18.0) (2026-04-16)

### Features

* aem content ([#2689](https://github.com/adobe/helix-cli/issues/2689)) ([5524b6d](https://github.com/adobe/helix-cli/commit/5524b6d63949a1d45efe35479a31ab55e62f78ef))
---
 CHANGELOG.md      |   7 +++
 package-lock.json | 111 ++--------------------------------------------
 package.json      |   2 +-
 3 files changed, 11 insertions(+), 109 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9a9d009b4..d2725f18a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+# [16.18.0](https://github.com/adobe/helix-cli/compare/v16.17.1...v16.18.0) (2026-04-16)
+
+
+### Features
+
+* aem content ([#2689](https://github.com/adobe/helix-cli/issues/2689)) ([5524b6d](https://github.com/adobe/helix-cli/commit/5524b6d63949a1d45efe35479a31ab55e62f78ef))
+
 ## [16.17.1](https://github.com/adobe/helix-cli/compare/v16.17.0...v16.17.1) (2026-04-08)
 
 
diff --git a/package-lock.json b/package-lock.json
index 3c02ea136..773ea45c6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.17.1",
+  "version": "16.18.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@adobe/aem-cli",
-      "version": "16.17.1",
+      "version": "16.18.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "4.3.0",
@@ -666,7 +666,6 @@
       "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@octokit/auth-token": "^6.0.0",
         "@octokit/graphql": "^9.0.3",
@@ -1667,7 +1666,6 @@
       "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1788,21 +1786,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/anymatch": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
-      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "dependencies": {
-        "normalize-path": "^3.0.0",
-        "picomatch": "^2.0.4"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
@@ -2085,20 +2068,6 @@
       "dev": true,
       "license": "Apache-2.0"
     },
-    "node_modules/binary-extensions": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
-      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/body-parser": {
       "version": "2.2.2",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
@@ -4037,7 +4006,6 @@
       "integrity": "sha512-sjc7Y8cUD1IlwYcTS9qPSvGjAC8Ne9LctpxKKu3x/1IC9bnOg98Zy6GxEJUfr1NojMgVPlyANXYns8oE2c1TAA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.6.1",
@@ -4973,21 +4941,6 @@
         "node": ">=14.14"
       }
     },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
     "node_modules/function-bind": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@ -6030,20 +5983,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/is-binary-path": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
-      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "binary-extensions": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/is-boolean-object": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.2.2.tgz",
@@ -7236,7 +7175,6 @@
       "integrity": "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "bin": {
         "marked": "bin/marked.js"
       },
@@ -8281,17 +8219,6 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/normalize-path": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/normalize-url": {
       "version": "9.0.0",
       "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-9.0.0.tgz",
@@ -10143,7 +10070,6 @@
       "dev": true,
       "inBundle": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -11118,8 +11044,7 @@
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/quickjs-wasi/-/quickjs-wasi-0.0.1.tgz",
       "integrity": "sha512-fBWNLTBkxkLAhe1AzF1hyXEvuA+N+vV1WMP2D6iiMUblvmOt8Pp5t8zUcgvz7aYA1ldUdxDlgUse15dmcKjkNg==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/randombytes": {
       "version": "2.1.0",
@@ -11696,7 +11621,6 @@
       "integrity": "sha512-WRgl5GcypwramYX4HV+eQGzUbD7UUbljVmS+5G1uMwX/wLgYuJAxGeerXJDMO2xshng4+FXqCgyB5QfClV6WjA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "@semantic-release/commit-analyzer": "^13.0.1",
         "@semantic-release/error": "^4.0.0",
@@ -11769,20 +11693,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/semantic-release-discord-bot/node_modules/glob-parent": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "dependencies": {
-        "is-glob": "^4.0.1"
-      },
-      "engines": {
-        "node": ">= 6"
-      }
-    },
     "node_modules/semantic-release-discord-bot/node_modules/nunjucks": {
       "version": "3.2.4",
       "resolved": "https://registry.npmjs.org/nunjucks/-/nunjucks-3.2.4.tgz",
@@ -11809,20 +11719,6 @@
         }
       }
     },
-    "node_modules/semantic-release-discord-bot/node_modules/readdirp": {
-      "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "picomatch": "^2.2.1"
-      },
-      "engines": {
-        "node": ">=8.10.0"
-      }
-    },
     "node_modules/semantic-release/node_modules/@semantic-release/error": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/@semantic-release/error/-/error-4.0.0.tgz",
@@ -13396,7 +13292,6 @@
       "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
diff --git a/package.json b/package.json
index b698cdee2..5b2257d8f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.17.1",
+  "version": "16.18.0",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From a127557316ffcd9b0b4d4a82cf1ae6d15f79fd7b Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 16 Apr 2026 21:11:11 +0000
Subject: [PATCH 07/21] fix(deps): update dependency
 @adobe/helix-shared-process-queue to v3.1.8 (#2708)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 773ea45c6..b78498c58 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
         "@adobe/helix-shared-config": "11.1.20",
         "@adobe/helix-shared-git": "3.0.23",
         "@adobe/helix-shared-indexer": "2.2.7",
-        "@adobe/helix-shared-process-queue": "3.1.6",
+        "@adobe/helix-shared-process-queue": "3.1.8",
         "camelcase": "9.0.0",
         "chalk-template": "1.1.2",
         "chokidar": "5.0.0",
@@ -229,9 +229,9 @@
       }
     },
     "node_modules/@adobe/helix-shared-process-queue": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/@adobe/helix-shared-process-queue/-/helix-shared-process-queue-3.1.6.tgz",
-      "integrity": "sha512-1cYBCDRhlt/NnULO9USyao2udv17jQoAv8QcHHqq52oeYFqsBPKc/Hn4/TRBqZL3hR3pCSvG34rFQOSuYrFGDg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/@adobe/helix-shared-process-queue/-/helix-shared-process-queue-3.1.8.tgz",
+      "integrity": "sha512-XRczDKqfEYJoXl6CnRRCZe9E/gnbR2BHHsJ93p5z91EypxtElEKIA9lf6SdTC1GAKUTGROApReBEjtp4LXv7Ug==",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/helix-shared-async": "2.0.2"
diff --git a/package.json b/package.json
index 5b2257d8f..03c628ab0 100644
--- a/package.json
+++ b/package.json
@@ -48,7 +48,7 @@
     "@adobe/helix-shared-config": "11.1.20",
     "@adobe/helix-shared-git": "3.0.23",
     "@adobe/helix-shared-indexer": "2.2.7",
-    "@adobe/helix-shared-process-queue": "3.1.6",
+    "@adobe/helix-shared-process-queue": "3.1.8",
     "camelcase": "9.0.0",
     "chalk-template": "1.1.2",
     "chokidar": "5.0.0",

From fd95b172fb22c97b53f671aa0f828ddb95911e5c Mon Sep 17 00:00:00 2001
From: semantic-release-bot 
Date: Thu, 16 Apr 2026 21:18:42 +0000
Subject: [PATCH 08/21] chore(release): 16.18.1 [skip ci]

## [16.18.1](https://github.com/adobe/helix-cli/compare/v16.18.0...v16.18.1) (2026-04-16)

### Bug Fixes

* **deps:** update dependency @adobe/helix-shared-process-queue to v3.1.8 ([#2708](https://github.com/adobe/helix-cli/issues/2708)) ([17d3962](https://github.com/adobe/helix-cli/commit/17d3962b355749eaff69b0a5b5da62058c9fa513))
---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d2725f18a..da1a63e0d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [16.18.1](https://github.com/adobe/helix-cli/compare/v16.18.0...v16.18.1) (2026-04-16)
+
+
+### Bug Fixes
+
+* **deps:** update dependency @adobe/helix-shared-process-queue to v3.1.8 ([#2708](https://github.com/adobe/helix-cli/issues/2708)) ([17d3962](https://github.com/adobe/helix-cli/commit/17d3962b355749eaff69b0a5b5da62058c9fa513))
+
 # [16.18.0](https://github.com/adobe/helix-cli/compare/v16.17.1...v16.18.0) (2026-04-16)
 
 
diff --git a/package-lock.json b/package-lock.json
index b78498c58..46fd5bc50 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.0",
+  "version": "16.18.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@adobe/aem-cli",
-      "version": "16.18.0",
+      "version": "16.18.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "4.3.0",
diff --git a/package.json b/package.json
index 03c628ab0..d89c96aff 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.0",
+  "version": "16.18.1",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From c1f47745d1482b61f3a3a1de9b82bd510e8c72fb Mon Sep 17 00:00:00 2001
From: David Nuescheler 
Date: Fri, 17 Apr 2026 09:49:55 -0600
Subject: [PATCH 09/21] chore: readme update

---
 README.md | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index b80a37f08..b60528b86 100644
--- a/README.md
+++ b/README.md
@@ -26,8 +26,9 @@ $ aem --help
 Usage: aem  [options]
 
 Commands:
-  aem up  Run a AEM development server
-  aem import  Run the AEM import server
+  aem up       Run a AEM development server
+  aem import   Run the AEM import server
+  aem content  Manage local da.live content
 
 Options:
   --version                Show version number                         [boolean]
@@ -203,6 +204,24 @@ $ aem import
 
 Read the full AEM Importer [documentation](https://github.com/adobe/helix-importer-ui).
 
+## Managing content
+
+The `aem content` commands let you check out content from da.live locally, make bulk edits, and push changes back. The local content lives in a `content/` folder in your project.
+
+| Command | Description |
+|---------|-------------|
+| `aem content clone` | Clone da.live content locally into `content/` |
+| `aem content status` | Show locally added, modified, and deleted content files |
+| `aem content diff` | Show diff between local and remote content |
+| `aem content merge` | Merge remote content into local files |
+| `aem content add` | Stage changes in `content/` (like `git add`) |
+| `aem content commit` | Commit staged changes in `content/` (like `git commit`) |
+| `aem content push` | Push committed `content/` changes to da.live (use `content add` & `content commit` first) |
+
+### Local content serving
+
+When a `content/` folder is present, `aem up` automatically serves content from it first, falling back to the proxy for any files not found locally. HTML files in `content/` are wrapped with `head.html` and have their metadata blocks processed, so pages render the same way they would when served from da.live.
+
 # Developing AEM CLI
 
 ## Testing

From f4b0de78c56630034e192cf251ed14b3c8a9147a Mon Sep 17 00:00:00 2001
From: Tobias Bocanegra 
Date: Mon, 20 Apr 2026 15:51:51 +0200
Subject: [PATCH 10/21] fix: remove if-modified-since from proxy request to
 ensure that content-type is included (#2711)

---
 src/server/utils.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/server/utils.js b/src/server/utils.js
index 643d1fff2..e7ff31de6 100644
--- a/src/server/utils.js
+++ b/src/server/utils.js
@@ -287,6 +287,7 @@ window.LiveReloadOptions = {
     delete headers.connection;
     delete headers['proxy-connection'];
     delete headers.host;
+    delete headers['if-modified-since'];
     const ret = await getFetch(ctx.config.allowInsecure)(url, {
       method: req.method,
       headers,

From 4462801f10c49508719856f0c4673d299003a113 Mon Sep 17 00:00:00 2001
From: semantic-release-bot 
Date: Mon, 20 Apr 2026 13:59:23 +0000
Subject: [PATCH 11/21] chore(release): 16.18.2 [skip ci]

## [16.18.2](https://github.com/adobe/helix-cli/compare/v16.18.1...v16.18.2) (2026-04-20)

### Bug Fixes

* remove if-modified-since from proxy request to ensure that content-type is included ([#2711](https://github.com/adobe/helix-cli/issues/2711)) ([482a618](https://github.com/adobe/helix-cli/commit/482a618deeacfffb4d14d41ce828bd2650c9dc3e))
---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da1a63e0d..39f8c1ed5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [16.18.2](https://github.com/adobe/helix-cli/compare/v16.18.1...v16.18.2) (2026-04-20)
+
+
+### Bug Fixes
+
+* remove if-modified-since from proxy request to ensure that content-type is included ([#2711](https://github.com/adobe/helix-cli/issues/2711)) ([482a618](https://github.com/adobe/helix-cli/commit/482a618deeacfffb4d14d41ce828bd2650c9dc3e))
+
 ## [16.18.1](https://github.com/adobe/helix-cli/compare/v16.18.0...v16.18.1) (2026-04-16)
 
 
diff --git a/package-lock.json b/package-lock.json
index 46fd5bc50..c569d26c1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.1",
+  "version": "16.18.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@adobe/aem-cli",
-      "version": "16.18.1",
+      "version": "16.18.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "4.3.0",
diff --git a/package.json b/package.json
index d89c96aff..8cbdf9d78 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.1",
+  "version": "16.18.2",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From 229bb5221662b0fb4d80c80682bb6e7279a90cf2 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 03:36:15 +0000
Subject: [PATCH 12/21] fix(deps): update external fixes (#2712)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package-lock.json                             | 63 ++++++++++---------
 package.json                                  |  8 +--
 .../browser-injectables/package-lock.json     | 42 ++++++++++---
 packages/browser-injectables/package.json     |  2 +-
 4 files changed, 72 insertions(+), 43 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c569d26c1..2e63f53be 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21,8 +21,8 @@
         "compression": "1.8.1",
         "cookie": "1.1.1",
         "cookie-parser": "1.4.7",
-        "diff": "8.0.3",
-        "dotenv": "17.3.1",
+        "diff": "8.0.4",
+        "dotenv": "17.4.1",
         "express": "5.2.1",
         "faye-websocket": "0.11.4",
         "fs-extra": "11.3.4",
@@ -34,7 +34,7 @@
         "https-proxy-agent": "8.0.0",
         "ignore": "7.0.5",
         "ini": "6.0.0",
-        "isomorphic-git": "1.37.4",
+        "isomorphic-git": "1.37.5",
         "jose": "6.2.2",
         "livereload-js": "4.0.2",
         "mime": "4.1.0",
@@ -58,7 +58,7 @@
       },
       "devDependencies": {
         "@adobe/eslint-config-helix": "3.0.24",
-        "@eslint/config-helpers": "0.5.3",
+        "@eslint/config-helpers": "0.5.4",
         "@semantic-release/changelog": "6.0.3",
         "@semantic-release/git": "10.0.1",
         "c8": "11.0.0",
@@ -145,6 +145,19 @@
         "eslint": "^9.0.0"
       }
     },
+    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/config-helpers": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.3.tgz",
+      "integrity": "sha512-lzGN0onllOZCGroKJmRwY6QcEHxbjBw1gwB8SgRSqK8YbbtEXMvKynsXc3553ckIEBxsbMBU7oOZXKIPGZNeZw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.1.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
     "node_modules/@adobe/fetch": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/@adobe/fetch/-/fetch-4.3.0.tgz",
@@ -356,22 +369,22 @@
       }
     },
     "node_modules/@eslint/config-helpers": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.3.tgz",
-      "integrity": "sha512-lzGN0onllOZCGroKJmRwY6QcEHxbjBw1gwB8SgRSqK8YbbtEXMvKynsXc3553ckIEBxsbMBU7oOZXKIPGZNeZw==",
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.4.tgz",
+      "integrity": "sha512-jJhqiY3wPMlWWO3370M86CPJ7pt8GmEwSLglMfQhjXal07RCvhmU0as4IuUEW5SJeunfItiEetHmSxCCe9lDBg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^1.1.1"
+        "@eslint/core": "^1.2.0"
       },
       "engines": {
         "node": "^20.19.0 || ^22.13.0 || >=24"
       }
     },
     "node_modules/@eslint/core": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.1.1.tgz",
-      "integrity": "sha512-QUPblTtE51/7/Zhfv8BDwO0qkkzQL7P/aWWbqcf4xWLEYn1oKjdO0gglQBB4GAsu7u6wjijbCmzsUTy6mnk6oQ==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -3424,9 +3437,9 @@
       }
     },
     "node_modules/diff": {
-      "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.3.tgz",
-      "integrity": "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ==",
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
+      "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.3.1"
@@ -3491,9 +3504,9 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "17.3.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.3.1.tgz",
-      "integrity": "sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==",
+      "version": "17.4.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.1.tgz",
+      "integrity": "sha512-k8DaKGP6r1G30Lx8V4+pCsLzKr8vLmV2paqEj1Y55GdAgJuIqpRp5FfajGF8KtwMxCz9qJc6wUIJnm053d/WCw==",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=12"
@@ -6514,9 +6527,9 @@
       "license": "ISC"
     },
     "node_modules/isomorphic-git": {
-      "version": "1.37.4",
-      "resolved": "https://registry.npmjs.org/isomorphic-git/-/isomorphic-git-1.37.4.tgz",
-      "integrity": "sha512-fNnCEJtI1refeVxysiuqGP9cubUoLibUS6UIDUWSy5Op6sVdFwGv/SpzfhMFiDkfgYoXKqurZ+LVxEeesy+T0Q==",
+      "version": "1.37.5",
+      "resolved": "https://registry.npmjs.org/isomorphic-git/-/isomorphic-git-1.37.5.tgz",
+      "integrity": "sha512-wek54c5uFvd3WsxewLWt6h0GXKWQh0P8rRXns9bN1rHNjcgCb3+0lmyAsP594NeTtQFeCJQVS9b0kjbkD1l5qg==",
       "license": "MIT",
       "dependencies": {
         "async-lock": "^1.4.1",
@@ -12382,16 +12395,6 @@
         "url": "https://opencollective.com/sinon"
       }
     },
-    "node_modules/sinon/node_modules/diff": {
-      "version": "8.0.4",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
-      "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.3.1"
-      }
-    },
     "node_modules/skin-tone": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/skin-tone/-/skin-tone-2.0.0.tgz",
diff --git a/package.json b/package.json
index 8cbdf9d78..18ba2d4e3 100644
--- a/package.json
+++ b/package.json
@@ -55,8 +55,8 @@
     "compression": "1.8.1",
     "cookie": "1.1.1",
     "cookie-parser": "1.4.7",
-    "diff": "8.0.3",
-    "dotenv": "17.3.1",
+    "diff": "8.0.4",
+    "dotenv": "17.4.1",
     "express": "5.2.1",
     "faye-websocket": "0.11.4",
     "fs-extra": "11.3.4",
@@ -68,7 +68,7 @@
     "https-proxy-agent": "8.0.0",
     "ignore": "7.0.5",
     "ini": "6.0.0",
-    "isomorphic-git": "1.37.4",
+    "isomorphic-git": "1.37.5",
     "jose": "6.2.2",
     "mime": "4.1.0",
     "livereload-js": "4.0.2",
@@ -88,7 +88,7 @@
   },
   "devDependencies": {
     "@adobe/eslint-config-helix": "3.0.24",
-    "@eslint/config-helpers": "0.5.3",
+    "@eslint/config-helpers": "0.5.4",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/git": "10.0.1",
     "c8": "11.0.0",
diff --git a/packages/browser-injectables/package-lock.json b/packages/browser-injectables/package-lock.json
index c3a64e736..a2fbdec5a 100644
--- a/packages/browser-injectables/package-lock.json
+++ b/packages/browser-injectables/package-lock.json
@@ -13,7 +13,7 @@
       },
       "devDependencies": {
         "@adobe/eslint-config-helix": "^3.0.9",
-        "@eslint/config-helpers": "0.5.3",
+        "@eslint/config-helpers": "0.5.4",
         "@esm-bundle/chai": "4.3.4-fix.0",
         "@web/test-runner": "0.20.2",
         "@web/test-runner-junit-reporter": "0.8.0",
@@ -39,6 +39,32 @@
         "eslint": "^9.0.0"
       }
     },
+    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/config-helpers": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.3.tgz",
+      "integrity": "sha512-lzGN0onllOZCGroKJmRwY6QcEHxbjBw1gwB8SgRSqK8YbbtEXMvKynsXc3553ckIEBxsbMBU7oOZXKIPGZNeZw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.1.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
@@ -126,22 +152,22 @@
       }
     },
     "node_modules/@eslint/config-helpers": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.3.tgz",
-      "integrity": "sha512-lzGN0onllOZCGroKJmRwY6QcEHxbjBw1gwB8SgRSqK8YbbtEXMvKynsXc3553ckIEBxsbMBU7oOZXKIPGZNeZw==",
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.4.tgz",
+      "integrity": "sha512-jJhqiY3wPMlWWO3370M86CPJ7pt8GmEwSLglMfQhjXal07RCvhmU0as4IuUEW5SJeunfItiEetHmSxCCe9lDBg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^1.1.1"
+        "@eslint/core": "^1.2.0"
       },
       "engines": {
         "node": "^20.19.0 || ^22.13.0 || >=24"
       }
     },
     "node_modules/@eslint/config-helpers/node_modules/@eslint/core": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.1.1.tgz",
-      "integrity": "sha512-QUPblTtE51/7/Zhfv8BDwO0qkkzQL7P/aWWbqcf4xWLEYn1oKjdO0gglQBB4GAsu7u6wjijbCmzsUTy6mnk6oQ==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
diff --git a/packages/browser-injectables/package.json b/packages/browser-injectables/package.json
index c4b672190..cee0fdc9c 100644
--- a/packages/browser-injectables/package.json
+++ b/packages/browser-injectables/package.json
@@ -13,7 +13,7 @@
   },
   "devDependencies": {
     "@adobe/eslint-config-helix": "^3.0.9",
-    "@eslint/config-helpers": "0.5.3",
+    "@eslint/config-helpers": "0.5.4",
     "@esm-bundle/chai": "4.3.4-fix.0",
     "@web/test-runner": "0.20.2",
     "@web/test-runner-playwright": "0.11.1",

From 583b5c54300c9eb453487f3daeef0649b2cbf12e Mon Sep 17 00:00:00 2001
From: semantic-release-bot 
Date: Tue, 21 Apr 2026 03:44:10 +0000
Subject: [PATCH 13/21] chore(release): 16.18.3 [skip ci]

## [16.18.3](https://github.com/adobe/helix-cli/compare/v16.18.2...v16.18.3) (2026-04-21)

### Bug Fixes

* **deps:** update external fixes ([#2712](https://github.com/adobe/helix-cli/issues/2712)) ([3cb40a0](https://github.com/adobe/helix-cli/commit/3cb40a07ead3949a29cc12c4ab3c7b595e9941fc))
---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 39f8c1ed5..2b1c84556 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [16.18.3](https://github.com/adobe/helix-cli/compare/v16.18.2...v16.18.3) (2026-04-21)
+
+
+### Bug Fixes
+
+* **deps:** update external fixes ([#2712](https://github.com/adobe/helix-cli/issues/2712)) ([3cb40a0](https://github.com/adobe/helix-cli/commit/3cb40a07ead3949a29cc12c4ab3c7b595e9941fc))
+
 ## [16.18.2](https://github.com/adobe/helix-cli/compare/v16.18.1...v16.18.2) (2026-04-20)
 
 
diff --git a/package-lock.json b/package-lock.json
index 2e63f53be..a671cbdbe 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.2",
+  "version": "16.18.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@adobe/aem-cli",
-      "version": "16.18.2",
+      "version": "16.18.3",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "4.3.0",
diff --git a/package.json b/package.json
index 18ba2d4e3..c12deb43f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.2",
+  "version": "16.18.3",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From dac9963cf2cd20384cc5998fda3502eb966d06c9 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 11:18:48 +0000
Subject: [PATCH 14/21] fix(deps): update adobe fixes (#2714)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package-lock.json                             | 39 +++++++------------
 package.json                                  |  4 +-
 .../browser-injectables/package-lock.json     | 34 ++--------------
 3 files changed, 19 insertions(+), 58 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a671cbdbe..446e9951f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
       "dependencies": {
         "@adobe/fetch": "4.3.0",
         "@adobe/helix-log": "7.0.0",
-        "@adobe/helix-shared-config": "11.1.20",
+        "@adobe/helix-shared-config": "11.1.21",
         "@adobe/helix-shared-git": "3.0.23",
         "@adobe/helix-shared-indexer": "2.2.7",
         "@adobe/helix-shared-process-queue": "3.1.8",
@@ -57,7 +57,7 @@
         "hlx": "index.js"
       },
       "devDependencies": {
-        "@adobe/eslint-config-helix": "3.0.24",
+        "@adobe/eslint-config-helix": "3.0.25",
         "@eslint/config-helpers": "0.5.4",
         "@semantic-release/changelog": "6.0.3",
         "@semantic-release/git": "10.0.1",
@@ -128,13 +128,13 @@
       "license": "MIT"
     },
     "node_modules/@adobe/eslint-config-helix": {
-      "version": "3.0.24",
-      "resolved": "https://registry.npmjs.org/@adobe/eslint-config-helix/-/eslint-config-helix-3.0.24.tgz",
-      "integrity": "sha512-JspRdcd9JVlIcj1FTVvX1+tP9QbgENUdjVUqQcYBS0KesLWgLemSWn3LL4bsBvO33QrGo/DySk3/0zFXRAWXRw==",
+      "version": "3.0.25",
+      "resolved": "https://registry.npmjs.org/@adobe/eslint-config-helix/-/eslint-config-helix-3.0.25.tgz",
+      "integrity": "sha512-3m8DoRPS/vq91ANyqbrgh/YnDljbHhZXpKooSWRK+OIoArkY6ju/NSFYYzbLj5ImVmfg3I4JPoiiWnNR/OTCGQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/config-helpers": "0.5.3",
+        "@eslint/config-helpers": "0.5.4",
         "eslint-plugin-import": "2.32.0",
         "globals": "17.4.0"
       },
@@ -145,19 +145,6 @@
         "eslint": "^9.0.0"
       }
     },
-    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/config-helpers": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.3.tgz",
-      "integrity": "sha512-lzGN0onllOZCGroKJmRwY6QcEHxbjBw1gwB8SgRSqK8YbbtEXMvKynsXc3553ckIEBxsbMBU7oOZXKIPGZNeZw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^1.1.1"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
-      }
-    },
     "node_modules/@adobe/fetch": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/@adobe/fetch/-/fetch-4.3.0.tgz",
@@ -188,9 +175,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/@adobe/helix-shared-config": {
-      "version": "11.1.20",
-      "resolved": "https://registry.npmjs.org/@adobe/helix-shared-config/-/helix-shared-config-11.1.20.tgz",
-      "integrity": "sha512-fAoCYgU8GHETmKqKTwz6+jduLNvh9dDGaWJ84qIttPpE68J1kbHKl2WhyPj1NgCQRuL4I3q9z2cTtIMkDQUQNw==",
+      "version": "11.1.21",
+      "resolved": "https://registry.npmjs.org/@adobe/helix-shared-config/-/helix-shared-config-11.1.21.tgz",
+      "integrity": "sha512-pxlzixrH+2bbOpmcAJMzs+gK9HIOLb/SJukCHjg148bxk3cWK6uX/elgdbOAFT7+X8TjxsFhsw45oyLlN4Xr1g==",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "^4.0.1",
@@ -202,14 +189,14 @@
         "cookie": "1.1.1",
         "fs-extra": "11.3.4",
         "ignore": "7.0.5",
-        "lru-cache": "11.2.7",
+        "lru-cache": "11.3.2",
         "yaml": "2.8.3"
       }
     },
     "node_modules/@adobe/helix-shared-config/node_modules/lru-cache": {
-      "version": "11.2.7",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.7.tgz",
-      "integrity": "sha512-aY/R+aEsRelme17KGQa/1ZSIpLpNYYrhcrepKTZgE+W3WM16YMCaPwOHLHsmopZHELU0Ojin1lPVxKR0MihncA==",
+      "version": "11.3.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.2.tgz",
+      "integrity": "sha512-wgWa6FWQ3QRRJbIjbsldRJZxdxYngT/dO0I5Ynmlnin8qy7tC6xYzbcJjtN4wHLXtkbVwHzk0C+OejVw1XM+DQ==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
diff --git a/package.json b/package.json
index c12deb43f..0c42a4c55 100644
--- a/package.json
+++ b/package.json
@@ -45,7 +45,7 @@
   "dependencies": {
     "@adobe/fetch": "4.3.0",
     "@adobe/helix-log": "7.0.0",
-    "@adobe/helix-shared-config": "11.1.20",
+    "@adobe/helix-shared-config": "11.1.21",
     "@adobe/helix-shared-git": "3.0.23",
     "@adobe/helix-shared-indexer": "2.2.7",
     "@adobe/helix-shared-process-queue": "3.1.8",
@@ -87,7 +87,7 @@
     "yargs": "18.0.0"
   },
   "devDependencies": {
-    "@adobe/eslint-config-helix": "3.0.24",
+    "@adobe/eslint-config-helix": "3.0.25",
     "@eslint/config-helpers": "0.5.4",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/git": "10.0.1",
diff --git a/packages/browser-injectables/package-lock.json b/packages/browser-injectables/package-lock.json
index a2fbdec5a..b466c0f8e 100644
--- a/packages/browser-injectables/package-lock.json
+++ b/packages/browser-injectables/package-lock.json
@@ -22,13 +22,13 @@
       }
     },
     "node_modules/@adobe/eslint-config-helix": {
-      "version": "3.0.24",
-      "resolved": "https://registry.npmjs.org/@adobe/eslint-config-helix/-/eslint-config-helix-3.0.24.tgz",
-      "integrity": "sha512-JspRdcd9JVlIcj1FTVvX1+tP9QbgENUdjVUqQcYBS0KesLWgLemSWn3LL4bsBvO33QrGo/DySk3/0zFXRAWXRw==",
+      "version": "3.0.25",
+      "resolved": "https://registry.npmjs.org/@adobe/eslint-config-helix/-/eslint-config-helix-3.0.25.tgz",
+      "integrity": "sha512-3m8DoRPS/vq91ANyqbrgh/YnDljbHhZXpKooSWRK+OIoArkY6ju/NSFYYzbLj5ImVmfg3I4JPoiiWnNR/OTCGQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/config-helpers": "0.5.3",
+        "@eslint/config-helpers": "0.5.4",
         "eslint-plugin-import": "2.32.0",
         "globals": "17.4.0"
       },
@@ -39,32 +39,6 @@
         "eslint": "^9.0.0"
       }
     },
-    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/config-helpers": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.3.tgz",
-      "integrity": "sha512-lzGN0onllOZCGroKJmRwY6QcEHxbjBw1gwB8SgRSqK8YbbtEXMvKynsXc3553ckIEBxsbMBU7oOZXKIPGZNeZw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^1.1.1"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
-      }
-    },
-    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/core": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
-      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
-      }
-    },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",

From ea77f2e8364297cd06234ff3fa8e4ae347101181 Mon Sep 17 00:00:00 2001
From: semantic-release-bot 
Date: Tue, 21 Apr 2026 11:26:25 +0000
Subject: [PATCH 15/21] chore(release): 16.18.4 [skip ci]

## [16.18.4](https://github.com/adobe/helix-cli/compare/v16.18.3...v16.18.4) (2026-04-21)

### Bug Fixes

* **deps:** update adobe fixes ([#2714](https://github.com/adobe/helix-cli/issues/2714)) ([e555c3f](https://github.com/adobe/helix-cli/commit/e555c3f1e61a68bea2c4fbda36911165f673a192))
---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2b1c84556..d877e7ab8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [16.18.4](https://github.com/adobe/helix-cli/compare/v16.18.3...v16.18.4) (2026-04-21)
+
+
+### Bug Fixes
+
+* **deps:** update adobe fixes ([#2714](https://github.com/adobe/helix-cli/issues/2714)) ([e555c3f](https://github.com/adobe/helix-cli/commit/e555c3f1e61a68bea2c4fbda36911165f673a192))
+
 ## [16.18.3](https://github.com/adobe/helix-cli/compare/v16.18.2...v16.18.3) (2026-04-21)
 
 
diff --git a/package-lock.json b/package-lock.json
index 446e9951f..7f3af062b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.3",
+  "version": "16.18.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@adobe/aem-cli",
-      "version": "16.18.3",
+      "version": "16.18.4",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "4.3.0",
diff --git a/package.json b/package.json
index 0c42a4c55..1a741a975 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.3",
+  "version": "16.18.4",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From 1ac5cc3f66b12d2450c9d2d9e4e27bbd96c44eff Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 21 Apr 2026 16:56:22 +0200
Subject: [PATCH 16/21] fix(deps): update external major (#2713)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package-lock.json | 152 ++++++++++++++++++++++------------------------
 package.json      |   6 +-
 2 files changed, 76 insertions(+), 82 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 7f3af062b..e55207163 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -30,8 +30,8 @@
         "glob-to-regexp": "0.4.1",
         "hast-util-select": "6.0.4",
         "hast-util-to-html": "9.0.5",
-        "http-proxy-agent": "8.0.0",
-        "https-proxy-agent": "8.0.0",
+        "http-proxy-agent": "9.0.0",
+        "https-proxy-agent": "9.0.0",
         "ignore": "7.0.5",
         "ini": "6.0.0",
         "isomorphic-git": "1.37.5",
@@ -42,7 +42,7 @@
         "node-fetch": "3.3.2",
         "open": "11.0.0",
         "progress": "2.0.3",
-        "proxy-agent": "7.0.0",
+        "proxy-agent": "8.0.1",
         "proxy-from-env": "2.1.0",
         "rehype-parse": "9.0.1",
         "semver": "7.7.4",
@@ -1684,12 +1684,12 @@
       }
     },
     "node_modules/agent-base": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-8.0.0.tgz",
-      "integrity": "sha512-QT8i0hCz6C/KQ+KTAbSNwCHDGdmUJl2tp2ZpNlGSWCfhUNVbYG2WLE3MdZGBAgXPV4GAvjGMxo+C1hroyxmZEg==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-9.0.0.tgz",
+      "integrity": "sha512-TQf59BsZnytt8GdJKLPfUZ54g/iaUL2OWDSFCCvMOhsHduDQxO8xC4PNeyIkVcA5KwL2phPSv0douC0fgWzmnA==",
       "license": "MIT",
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
     "node_modules/aggregate-error": {
@@ -2043,9 +2043,9 @@
       "license": "MIT"
     },
     "node_modules/basic-ftp": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz",
-      "integrity": "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw==",
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.3.0.tgz",
+      "integrity": "sha512-5K9eNNn7ywHPsYnFwjKgYH8Hf8B5emh7JKcPaVjjrMJFQQwGpwowEnZNEtHs7DfR7hCZsmaK3VA4HUK0YarT+w==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -3366,9 +3366,9 @@
       }
     },
     "node_modules/degenerator": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/degenerator/-/degenerator-6.0.0.tgz",
-      "integrity": "sha512-j5MdXdefrecJeSqTpUrgZd4fBsD2IxZx0JlJD+n1Q7+aTf7/HcyXSfHsicPW6ekPurX159v1ZYla6OJgSPh2Dw==",
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/degenerator/-/degenerator-7.0.1.tgz",
+      "integrity": "sha512-ABErK0IefDSyHjlPH7WUEenIAX2rPPnrDcDM+TS3z3+zu9TfyKKi07BQM+8rmxpdE2y1v5fjjdoAS/x4D2U60w==",
       "license": "MIT",
       "dependencies": {
         "ast-types": "^0.13.4",
@@ -3376,10 +3376,10 @@
         "esprima": "^4.0.1"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       },
       "peerDependencies": {
-        "quickjs-wasi": "^0.0.1"
+        "quickjs-wasi": "^2.2.0"
       }
     },
     "node_modules/delayed-stream": {
@@ -5093,26 +5093,26 @@
       }
     },
     "node_modules/get-uri": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-7.0.0.tgz",
-      "integrity": "sha512-ZsC7KQxm1Hra8yO0RvMZ4lGJT7vnBtSNpEHKq39MPN7vjuvCiu1aQ8rkXUaIXG1y/TSDez97Gmv04ibnYqCp/A==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-8.0.0.tgz",
+      "integrity": "sha512-CqtZlMKvfJeY0Zxv8wazDwXmSKmnMnsmNy8j8+wudi8EyG/pMUB1NqHc+Tv1QaNtpYsK9nOYjb7r7Ufu32RPSw==",
       "license": "MIT",
       "dependencies": {
-        "basic-ftp": "^5.0.2",
-        "data-uri-to-buffer": "7.0.0",
+        "basic-ftp": "^5.2.0",
+        "data-uri-to-buffer": "8.0.0",
         "debug": "^4.3.4"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
     "node_modules/get-uri/node_modules/data-uri-to-buffer": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-7.0.0.tgz",
-      "integrity": "sha512-CuRUx0TXGSbbWdEci3VK/XOZGP3n0P4pIKpsqpVtBqaIIuj3GKK8H45oAqA4Rg8FHipc+CzRdUzmD4YQXxv66Q==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-8.0.0.tgz",
+      "integrity": "sha512-6UHfyCux51b8PTGDgveqtz1tvphBku5DrMKKJbFAZAJOI2zsjDpDoYE1+QGj7FOMS4BdTFNJsJiR3zEB0xH0yQ==",
       "license": "MIT",
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
     "node_modules/git-log-parser": {
@@ -5661,29 +5661,29 @@
       "license": "MIT"
     },
     "node_modules/http-proxy-agent": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-8.0.0.tgz",
-      "integrity": "sha512-7pose0uGgrCJeH2Qh4JcNhWZp3u/oNrWjNYDK4ydOLxOpTw8V8ogHFAmkz0VWq96JBFj4umVJpvmQi287rSYLg==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-9.0.0.tgz",
+      "integrity": "sha512-FcF8VhXYLQcxWCnt/cCpT2apKsRDUGeVEeMqGu4HSTu29U8Yw0TLOjdYIlDsYk3IkUh+taX4IDWpPcCqKDhCjA==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "8.0.0",
+        "agent-base": "9.0.0",
         "debug": "^4.3.4"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
     "node_modules/https-proxy-agent": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-8.0.0.tgz",
-      "integrity": "sha512-YYeW+iCnAS3xhvj2dvVoWgsbca3RfQy/IlaNHHOtDmU0jMqPI9euIq3Y9BJETdxk16h9NHHCKqp/KB9nIMStCQ==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-9.0.0.tgz",
+      "integrity": "sha512-/MVmHp58WkOypgFhCLk4fzpPcFQvTJ/e6LBI7irpIO2HfxUbpmYoHF+KzipzJpxxzJu7aJNWQ0xojJ/dzV2G5g==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "8.0.0",
+        "agent-base": "9.0.0",
         "debug": "^4.3.4"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
     "node_modules/human-signals": {
@@ -8117,9 +8117,9 @@
       "license": "MIT"
     },
     "node_modules/netmask": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/netmask/-/netmask-2.0.2.tgz",
-      "integrity": "sha512-dBpDMdxv9Irdq66304OLfEmQ9tbNRFnFTuZiLo+bD+r332bBmMJ8GBLXklIXXgxd3+v9+KUnZaUR5PJMa75Gsg==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/netmask/-/netmask-2.1.1.tgz",
+      "integrity": "sha512-eonl3sLUha+S1GzTPxychyhnUzKyeQkZ7jLjKrBagJgPla13F+uQ71HgpFefyHgqrjEbCPkDArxYsjY8/+gLKA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4.0"
@@ -10513,38 +10513,38 @@
       }
     },
     "node_modules/pac-proxy-agent": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-8.0.0.tgz",
-      "integrity": "sha512-HyCoVbyQ/nbVlQ/R6wBu0YXhbG2oAnEK5BQ3xMyj1OffQmU5NoOnpLzgPlKHaobUzz5NK0+AZHby4TdydAEBUA==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/pac-proxy-agent/-/pac-proxy-agent-9.0.1.tgz",
+      "integrity": "sha512-3ZOSpLboOlpW4yp8Cuv21KlTULRqyJ5Uuad3wXpSKFrxdNgcHEyoa22GRaZ2UlgCVuR6z+5BiavtYVvbajL/Yw==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "8.0.0",
+        "agent-base": "9.0.0",
         "debug": "^4.3.4",
-        "get-uri": "7.0.0",
-        "http-proxy-agent": "8.0.0",
-        "https-proxy-agent": "8.0.0",
-        "pac-resolver": "8.0.0",
-        "quickjs-wasi": "^0.0.1",
-        "socks-proxy-agent": "9.0.0"
+        "get-uri": "8.0.0",
+        "http-proxy-agent": "9.0.0",
+        "https-proxy-agent": "9.0.0",
+        "pac-resolver": "9.0.1",
+        "quickjs-wasi": "^2.2.0",
+        "socks-proxy-agent": "10.0.0"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
     "node_modules/pac-resolver": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/pac-resolver/-/pac-resolver-8.0.0.tgz",
-      "integrity": "sha512-SVNzOxVq2zuTew3WAt7U8UghwzJzuWYuJryd3y8FxyLTZdjVoCzY8kLP39PpEqQCDvlMWdQXwViu0sYT3eiU2w==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/pac-resolver/-/pac-resolver-9.0.1.tgz",
+      "integrity": "sha512-lJbS008tmkj08VhoM8Hzuv/VE5tK9MS0OIQ/7+s0lIF+BYhiQWFYzkSpML7lXs9iBu2jfmzBTLzhe9n6BX+dYw==",
       "license": "MIT",
       "dependencies": {
-        "degenerator": "6.0.0",
+        "degenerator": "7.0.1",
         "netmask": "^2.0.2"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       },
       "peerDependencies": {
-        "quickjs-wasi": "^0.0.1"
+        "quickjs-wasi": "^2.2.0"
       }
     },
     "node_modules/package-json-from-dist": {
@@ -10962,30 +10962,24 @@
       }
     },
     "node_modules/proxy-agent": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-7.0.0.tgz",
-      "integrity": "sha512-okTgt79rHTvMHkr/Ney5rZpgCHh3g1g3tI5uhkgN5b7OeI3n0Q/ui1uv9OdrnZNJM9WIZJqZPh/UJs+YtO/TMQ==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-8.0.1.tgz",
+      "integrity": "sha512-kccqGBqHZXR8onQhY/ganJjoO8QIKKRiFBhPOzbTZK16attzSZ/0XSmp9H7jrRxPKHjhGyx1q32lMPrJ3uLFgA==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "8.0.0",
+        "agent-base": "9.0.0",
         "debug": "^4.3.4",
-        "http-proxy-agent": "8.0.0",
-        "https-proxy-agent": "8.0.0",
+        "http-proxy-agent": "9.0.0",
+        "https-proxy-agent": "9.0.0",
         "lru-cache": "^7.14.1",
-        "pac-proxy-agent": "8.0.0",
-        "proxy-from-env": "^1.1.0",
-        "socks-proxy-agent": "9.0.0"
+        "pac-proxy-agent": "9.0.1",
+        "proxy-from-env": "^2.0.0",
+        "socks-proxy-agent": "10.0.0"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
-    "node_modules/proxy-agent/node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
-    },
     "node_modules/proxy-from-env": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
@@ -11041,9 +11035,9 @@
       "license": "MIT"
     },
     "node_modules/quickjs-wasi": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/quickjs-wasi/-/quickjs-wasi-0.0.1.tgz",
-      "integrity": "sha512-fBWNLTBkxkLAhe1AzF1hyXEvuA+N+vV1WMP2D6iiMUblvmOt8Pp5t8zUcgvz7aYA1ldUdxDlgUse15dmcKjkNg==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/quickjs-wasi/-/quickjs-wasi-2.2.0.tgz",
+      "integrity": "sha512-zQxXmQMrEoD3S+jQdYsloq4qAuaxKFHZj6hHqOYGwB2iQZH+q9e/lf5zQPXCKOk0WJuAjzRFbO4KwHIp2D05Iw==",
       "license": "MIT"
     },
     "node_modules/randombytes": {
@@ -12437,17 +12431,17 @@
       }
     },
     "node_modules/socks-proxy-agent": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-9.0.0.tgz",
-      "integrity": "sha512-fFlbMlfsXhK02ZB8aZY7Hwxh/IHBV9b1Oq9bvBk6tkFWXvdAxUgA0wbw/NYR5liU3Y5+KI6U4FH3kYJt9QYv0w==",
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-10.0.0.tgz",
+      "integrity": "sha512-pyp2YR3mNxAMu0mGLtzs4g7O3uT4/9sQOLAKcViAkaS9fJWkud7nmaf6ZREFqQEi24IPkBcjfHjXhPTUWjo3uA==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "8.0.0",
+        "agent-base": "9.0.0",
         "debug": "^4.3.4",
         "socks": "^2.8.3"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">= 20"
       }
     },
     "node_modules/source-map": {
diff --git a/package.json b/package.json
index 1a741a975..014c89e49 100644
--- a/package.json
+++ b/package.json
@@ -64,8 +64,8 @@
     "glob-to-regexp": "0.4.1",
     "hast-util-select": "6.0.4",
     "hast-util-to-html": "9.0.5",
-    "http-proxy-agent": "8.0.0",
-    "https-proxy-agent": "8.0.0",
+    "http-proxy-agent": "9.0.0",
+    "https-proxy-agent": "9.0.0",
     "ignore": "7.0.5",
     "ini": "6.0.0",
     "isomorphic-git": "1.37.5",
@@ -76,7 +76,7 @@
     "node-fetch": "3.3.2",
     "open": "11.0.0",
     "progress": "2.0.3",
-    "proxy-agent": "7.0.0",
+    "proxy-agent": "8.0.1",
     "proxy-from-env": "2.1.0",
     "rehype-parse": "9.0.1",
     "semver": "7.7.4",

From b2de220207533fd99e49b5807ff80f6853f5f0bf Mon Sep 17 00:00:00 2001
From: semantic-release-bot 
Date: Tue, 21 Apr 2026 15:04:08 +0000
Subject: [PATCH 17/21] chore(release): 16.18.5 [skip ci]

## [16.18.5](https://github.com/adobe/helix-cli/compare/v16.18.4...v16.18.5) (2026-04-21)

### Bug Fixes

* **deps:** update external major ([#2713](https://github.com/adobe/helix-cli/issues/2713)) ([72143f3](https://github.com/adobe/helix-cli/commit/72143f3670c00b2d41dbd1629a562612039f7d71))
---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d877e7ab8..5c55c81fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [16.18.5](https://github.com/adobe/helix-cli/compare/v16.18.4...v16.18.5) (2026-04-21)
+
+
+### Bug Fixes
+
+* **deps:** update external major ([#2713](https://github.com/adobe/helix-cli/issues/2713)) ([72143f3](https://github.com/adobe/helix-cli/commit/72143f3670c00b2d41dbd1629a562612039f7d71))
+
 ## [16.18.4](https://github.com/adobe/helix-cli/compare/v16.18.3...v16.18.4) (2026-04-21)
 
 
diff --git a/package-lock.json b/package-lock.json
index e55207163..4f7fb7f36 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.4",
+  "version": "16.18.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@adobe/aem-cli",
-      "version": "16.18.4",
+      "version": "16.18.5",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "4.3.0",
diff --git a/package.json b/package.json
index 014c89e49..919626273 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.4",
+  "version": "16.18.5",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From 61ed8d3bdbd6ee6ade15b28cb7e350fcbd59b102 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 13:06:58 +0000
Subject: [PATCH 18/21] fix(deps): update dependency diff to v9

---
 package-lock.json | 18 ++++++++++++++----
 package.json      |  2 +-
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4f7fb7f36..daa0cd113 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21,7 +21,7 @@
         "compression": "1.8.1",
         "cookie": "1.1.1",
         "cookie-parser": "1.4.7",
-        "diff": "8.0.4",
+        "diff": "9.0.0",
         "dotenv": "17.4.1",
         "express": "5.2.1",
         "faye-websocket": "0.11.4",
@@ -3424,9 +3424,9 @@
       }
     },
     "node_modules/diff": {
-      "version": "8.0.4",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
-      "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-9.0.0.tgz",
+      "integrity": "sha512-svtcdpS8CgJyqAjEQIXdb3OjhFVVYjzGAPO8WGCmRbrml64SPw/jJD4GoE98aR7r25A0XcgrK3F02yw9R/vhQw==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.3.1"
@@ -12376,6 +12376,16 @@
         "url": "https://opencollective.com/sinon"
       }
     },
+    "node_modules/sinon/node_modules/diff": {
+      "version": "8.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.4.tgz",
+      "integrity": "sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.3.1"
+      }
+    },
     "node_modules/skin-tone": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/skin-tone/-/skin-tone-2.0.0.tgz",
diff --git a/package.json b/package.json
index 919626273..6387a5b85 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "compression": "1.8.1",
     "cookie": "1.1.1",
     "cookie-parser": "1.4.7",
-    "diff": "8.0.4",
+    "diff": "9.0.0",
     "dotenv": "17.4.1",
     "express": "5.2.1",
     "faye-websocket": "0.11.4",

From 12689c02c9044491c891f38f72ba50b228c90a66 Mon Sep 17 00:00:00 2001
From: semantic-release-bot 
Date: Mon, 27 Apr 2026 13:29:27 +0000
Subject: [PATCH 19/21] chore(release): 16.18.6 [skip ci]

## [16.18.6](https://github.com/adobe/helix-cli/compare/v16.18.5...v16.18.6) (2026-04-27)

### Bug Fixes

* **deps:** update dependency diff to v9 ([0da5b57](https://github.com/adobe/helix-cli/commit/0da5b573584a495350b18c2f05b6496cae9b5f42))
---
 CHANGELOG.md      | 7 +++++++
 package-lock.json | 4 ++--
 package.json      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5c55c81fb..ab084c353 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,10 @@
+## [16.18.6](https://github.com/adobe/helix-cli/compare/v16.18.5...v16.18.6) (2026-04-27)
+
+
+### Bug Fixes
+
+* **deps:** update dependency diff to v9 ([0da5b57](https://github.com/adobe/helix-cli/commit/0da5b573584a495350b18c2f05b6496cae9b5f42))
+
 ## [16.18.5](https://github.com/adobe/helix-cli/compare/v16.18.4...v16.18.5) (2026-04-21)
 
 
diff --git a/package-lock.json b/package-lock.json
index daa0cd113..a04d476e3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.5",
+  "version": "16.18.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@adobe/aem-cli",
-      "version": "16.18.5",
+      "version": "16.18.6",
       "license": "Apache-2.0",
       "dependencies": {
         "@adobe/fetch": "4.3.0",
diff --git a/package.json b/package.json
index 6387a5b85..e1bf9b327 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.18.5",
+  "version": "16.18.6",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

From 9aadc38bc4528083580251413241307328823bc3 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 27 Apr 2026 15:44:00 +0200
Subject: [PATCH 20/21] fix(deps): update external fixes (#2715)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
---
 package-lock.json                             | 58 +++++++++++--------
 package.json                                  |  6 +-
 .../browser-injectables/package-lock.json     | 36 ++++++++++--
 packages/browser-injectables/package.json     |  2 +-
 4 files changed, 70 insertions(+), 32 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a04d476e3..7ee6b6c88 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -22,7 +22,7 @@
         "cookie": "1.1.1",
         "cookie-parser": "1.4.7",
         "diff": "9.0.0",
-        "dotenv": "17.4.1",
+        "dotenv": "17.4.2",
         "express": "5.2.1",
         "faye-websocket": "0.11.4",
         "fs-extra": "11.3.4",
@@ -58,7 +58,7 @@
       },
       "devDependencies": {
         "@adobe/eslint-config-helix": "3.0.25",
-        "@eslint/config-helpers": "0.5.4",
+        "@eslint/config-helpers": "0.5.5",
         "@semantic-release/changelog": "6.0.3",
         "@semantic-release/git": "10.0.1",
         "c8": "11.0.0",
@@ -72,7 +72,7 @@
         "nock": "13.5.6",
         "semantic-release": "25.0.3",
         "semantic-release-discord-bot": "^1.1.0",
-        "sinon": "21.0.3"
+        "sinon": "21.1.2"
       },
       "engines": {
         "node": ">=18"
@@ -145,6 +145,19 @@
         "eslint": "^9.0.0"
       }
     },
+    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/config-helpers": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.4.tgz",
+      "integrity": "sha512-jJhqiY3wPMlWWO3370M86CPJ7pt8GmEwSLglMfQhjXal07RCvhmU0as4IuUEW5SJeunfItiEetHmSxCCe9lDBg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.2.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
     "node_modules/@adobe/fetch": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/@adobe/fetch/-/fetch-4.3.0.tgz",
@@ -356,13 +369,13 @@
       }
     },
     "node_modules/@eslint/config-helpers": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.4.tgz",
-      "integrity": "sha512-jJhqiY3wPMlWWO3370M86CPJ7pt8GmEwSLglMfQhjXal07RCvhmU0as4IuUEW5SJeunfItiEetHmSxCCe9lDBg==",
+      "version": "0.5.5",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.5.tgz",
+      "integrity": "sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^1.2.0"
+        "@eslint/core": "^1.2.1"
       },
       "engines": {
         "node": "^20.19.0 || ^22.13.0 || >=24"
@@ -1531,9 +1544,9 @@
       }
     },
     "node_modules/@sinonjs/fake-timers": {
-      "version": "15.1.1",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-15.1.1.tgz",
-      "integrity": "sha512-cO5W33JgAPbOh07tvZjUOJ7oWhtaqGHiZw+11DPbyqh2kHTBc3eF/CjJDeQ4205RLQsX6rxCuYOroFQwl7JDRw==",
+      "version": "15.3.2",
+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-15.3.2.tgz",
+      "integrity": "sha512-mrn35Jl2pCpns+mE3HaZa1yPN5EYCRgiMI+135COjr2hr8Cls9DXqIZ57vZe2cz7y2XVSq92tcs6kGQcT1J8Rw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -1541,9 +1554,9 @@
       }
     },
     "node_modules/@sinonjs/samsam": {
-      "version": "9.0.3",
-      "resolved": "https://registry.npmjs.org/@sinonjs/samsam/-/samsam-9.0.3.tgz",
-      "integrity": "sha512-ZgYY7Dc2RW+OUdnZ1DEHg00lhRt+9BjymPKHog4PRFzr1U3MbK57+djmscWyKxzO1qfunHqs4N45WWyKIFKpiQ==",
+      "version": "10.0.2",
+      "resolved": "https://registry.npmjs.org/@sinonjs/samsam/-/samsam-10.0.2.tgz",
+      "integrity": "sha512-8lVwD1Df1BmzoaOLhMcGGcz/Jyr5QY2KSB75/YK1QgKzoabTeLdIVyhXNZK9ojfSKSdirbXqdbsXXqP9/Ve8+A==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -3491,9 +3504,9 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "17.4.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.1.tgz",
-      "integrity": "sha512-k8DaKGP6r1G30Lx8V4+pCsLzKr8vLmV2paqEj1Y55GdAgJuIqpRp5FfajGF8KtwMxCz9qJc6wUIJnm053d/WCw==",
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=12"
@@ -12359,17 +12372,16 @@
       }
     },
     "node_modules/sinon": {
-      "version": "21.0.3",
-      "resolved": "https://registry.npmjs.org/sinon/-/sinon-21.0.3.tgz",
-      "integrity": "sha512-0x8TQFr8EjADhSME01u1ZK31yv2+bd6Z5NrBCHVM+n4qL1wFqbxftmeyi3bwlr49FbbzRfrqSFOpyHCOh/YmYA==",
+      "version": "21.1.2",
+      "resolved": "https://registry.npmjs.org/sinon/-/sinon-21.1.2.tgz",
+      "integrity": "sha512-FS6mN+/bx7e2ajpXkEmOcWB6xBzWiuNoAQT18/+a20SS4U7FSYl8Ms7N6VTUxN/1JAjkx7aXp+THMC8xdpp0gA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "@sinonjs/commons": "^3.0.1",
-        "@sinonjs/fake-timers": "^15.1.1",
-        "@sinonjs/samsam": "^9.0.3",
-        "diff": "^8.0.3",
-        "supports-color": "^7.2.0"
+        "@sinonjs/fake-timers": "^15.3.2",
+        "@sinonjs/samsam": "^10.0.2",
+        "diff": "^8.0.4"
       },
       "funding": {
         "type": "opencollective",
diff --git a/package.json b/package.json
index e1bf9b327..810f652b7 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
     "cookie": "1.1.1",
     "cookie-parser": "1.4.7",
     "diff": "9.0.0",
-    "dotenv": "17.4.1",
+    "dotenv": "17.4.2",
     "express": "5.2.1",
     "faye-websocket": "0.11.4",
     "fs-extra": "11.3.4",
@@ -88,7 +88,7 @@
   },
   "devDependencies": {
     "@adobe/eslint-config-helix": "3.0.25",
-    "@eslint/config-helpers": "0.5.4",
+    "@eslint/config-helpers": "0.5.5",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/git": "10.0.1",
     "c8": "11.0.0",
@@ -102,7 +102,7 @@
     "nock": "13.5.6",
     "semantic-release": "25.0.3",
     "semantic-release-discord-bot": "^1.1.0",
-    "sinon": "21.0.3"
+    "sinon": "21.1.2"
   },
   "lint-staged": {
     "*.js": "eslint"
diff --git a/packages/browser-injectables/package-lock.json b/packages/browser-injectables/package-lock.json
index b466c0f8e..fd8ec1fe8 100644
--- a/packages/browser-injectables/package-lock.json
+++ b/packages/browser-injectables/package-lock.json
@@ -13,7 +13,7 @@
       },
       "devDependencies": {
         "@adobe/eslint-config-helix": "^3.0.9",
-        "@eslint/config-helpers": "0.5.4",
+        "@eslint/config-helpers": "0.5.5",
         "@esm-bundle/chai": "4.3.4-fix.0",
         "@web/test-runner": "0.20.2",
         "@web/test-runner-junit-reporter": "0.8.0",
@@ -39,6 +39,32 @@
         "eslint": "^9.0.0"
       }
     },
+    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/config-helpers": {
+      "version": "0.5.4",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.4.tgz",
+      "integrity": "sha512-jJhqiY3wPMlWWO3370M86CPJ7pt8GmEwSLglMfQhjXal07RCvhmU0as4IuUEW5SJeunfItiEetHmSxCCe9lDBg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@eslint/core": "^1.2.0"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
+    "node_modules/@adobe/eslint-config-helix/node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      }
+    },
     "node_modules/@babel/code-frame": {
       "version": "7.27.1",
       "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
@@ -126,13 +152,13 @@
       }
     },
     "node_modules/@eslint/config-helpers": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.4.tgz",
-      "integrity": "sha512-jJhqiY3wPMlWWO3370M86CPJ7pt8GmEwSLglMfQhjXal07RCvhmU0as4IuUEW5SJeunfItiEetHmSxCCe9lDBg==",
+      "version": "0.5.5",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.5.5.tgz",
+      "integrity": "sha512-eIJYKTCECbP/nsKaaruF6LW967mtbQbsw4JTtSVkUQc9MneSkbrgPJAbKl9nWr0ZeowV8BfsarBmPpBzGelA2w==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^1.2.0"
+        "@eslint/core": "^1.2.1"
       },
       "engines": {
         "node": "^20.19.0 || ^22.13.0 || >=24"
diff --git a/packages/browser-injectables/package.json b/packages/browser-injectables/package.json
index cee0fdc9c..2e88633fd 100644
--- a/packages/browser-injectables/package.json
+++ b/packages/browser-injectables/package.json
@@ -13,7 +13,7 @@
   },
   "devDependencies": {
     "@adobe/eslint-config-helix": "^3.0.9",
-    "@eslint/config-helpers": "0.5.4",
+    "@eslint/config-helpers": "0.5.5",
     "@esm-bundle/chai": "4.3.4-fix.0",
     "@web/test-runner": "0.20.2",
     "@web/test-runner-playwright": "0.11.1",

From 7385cdd7f30191a314c63c93ccc69bd1fba4df27 Mon Sep 17 00:00:00 2001
From: Tobias Bocanegra 
Date: Mon, 27 Apr 2026 15:57:31 +0200
Subject: [PATCH 21/21] chore: revert trivial change

---
 src/up.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/up.js b/src/up.js
index 6828b1485..558c960e1 100644
--- a/src/up.js
+++ b/src/up.js
@@ -125,6 +125,7 @@ export default function up() {
           describe: 'URL path where html-folder files are served (e.g., / for root). Defaults to /FOLDER.',
           type: 'string',
         })
+
         .help();
     },
     handler: async (argv) => {