@actuate-media/cli 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import { registerMigrateCommand } from './commands/migrate.js';
+import { registerMigrateSectionsCommand } from './commands/migrate-sections.js';
 import { registerGenerateCommand } from './commands/generate.js';
 import { registerSeedCommand } from './commands/seed.js';
 import { registerImportCommand } from './commands/import.js';
@@ -12,12 +13,14 @@ import { registerDbSyncCommand } from './commands/db-sync.js';
 import { registerDbStatusCommand } from './commands/db-status.js';
 import { registerInitCommand } from './commands/init.js';
 import { registerDeployCheckCommand, registerDoctorCommand, registerVerifyCommand, } from './commands/doctor.js';
+import { registerVercelBlobLinkCommand } from './commands/vercel-blob-link.js';
 const program = new Command();
 program
     .name('actuate')
     .description('Actuate CMS — CLI toolkit for migrations, codegen, and more')
     .version('0.1.0');
 registerMigrateCommand(program);
+registerMigrateSectionsCommand(program);
 registerGenerateCommand(program);
 registerSeedCommand(program);
 registerImportCommand(program);
@@ -31,5 +34,6 @@ registerInitCommand(program);
 registerDoctorCommand(program);
 registerDeployCheckCommand(program);
 registerVerifyCommand(program);
+registerVercelBlobLinkCommand(program);
 program.parse();
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,6DAA6D,CAAC;KAC1E,OAAO,CAAC,OAAO,CAAC,CAAA;AAEnB,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,0BAA0B,CAAC,OAAO,CAAC,CAAA;AACnC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAA;AACnC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAE9B,OAAO,CAAC,KAAK,EAAE,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAA;AAE9E,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;AAE7B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,6DAA6D,CAAC;KAC1E,OAAO,CAAC,OAAO,CAAC,CAAA;AAEnB,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,8BAA8B,CAAC,OAAO,CAAC,CAAA;AACvC,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAA;AAC/B,0BAA0B,CAAC,OAAO,CAAC,CAAA;AACnC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,uBAAuB,CAAC,OAAO,CAAC,CAAA;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAA;AACnC,qBAAqB,CAAC,OAAO,CAAC,CAAA;AAC9B,6BAA6B,CAAC,OAAO,CAAC,CAAA;AAEtC,OAAO,CAAC,KAAK,EAAE,CAAA"}

package/dist/utils/database.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared helper for CLI commands that need a live connection to the consumer
+ * project's database (seed, populate, data migrations…).
+ *
+ * Resolution order mirrors how a scaffolded Actuate project exposes Prisma:
+ *   1. If `cms-core` already has an initialized client (e.g. set up by the host
+ *      app in-process), reuse it.
+ *   2. Otherwise build a client from the project's generated Prisma client
+ *      (`generated/prisma/client.ts`, Prisma 7 + pg driver adapter).
+ *   3. Fall back to a plain `@prisma/client` resolved from the project.
+ *
+ * The returned `disconnect()` only tears down clients this helper created — a
+ * pre-initialized in-process client is left untouched.
+ */
+export declare function connectProjectDatabase(): Promise<{
+    db: any;
+    disconnect: () => Promise<void>;
+}>;
+//# sourceMappingURL=database.d.ts.map

package/dist/utils/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC;IAEtD,EAAE,EAAE,GAAG,CAAA;IACP,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAChC,CAAC,CAiBD"}

package/dist/utils/database.js

@@ -0,0 +1,58 @@
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+/**
+ * Shared helper for CLI commands that need a live connection to the consumer
+ * project's database (seed, populate, data migrations…).
+ *
+ * Resolution order mirrors how a scaffolded Actuate project exposes Prisma:
+ *   1. If `cms-core` already has an initialized client (e.g. set up by the host
+ *      app in-process), reuse it.
+ *   2. Otherwise build a client from the project's generated Prisma client
+ *      (`generated/prisma/client.ts`, Prisma 7 + pg driver adapter).
+ *   3. Fall back to a plain `@prisma/client` resolved from the project.
+ *
+ * The returned `disconnect()` only tears down clients this helper created — a
+ * pre-initialized in-process client is left untouched.
+ */
+export async function connectProjectDatabase() {
+    const { getDB, initDB, isDBInitialized } = await import('@actuate-media/cms-core');
+    if (isDBInitialized()) {
+        return { db: getDB(), disconnect: async () => { } };
+    }
+    const db = await createProjectPrismaClient();
+    initDB(db);
+    return {
+        db,
+        disconnect: async () => {
+            if (typeof db.$disconnect === 'function') {
+                await db.$disconnect();
+            }
+        },
+    };
+}
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- see above.
+async function createProjectPrismaClient() {
+    if (!process.env.DATABASE_URL) {
+        throw new Error('DATABASE_URL is required to connect to the project database.');
+    }
+    const requireFromProject = createRequire(path.join(process.cwd(), 'package.json'));
+    const generatedClient = path.resolve('generated', 'prisma', 'client.ts');
+    if (existsSync(generatedClient)) {
+        const [{ tsImport }, adapterModule, pgModule] = await Promise.all([
+            import('tsx/esm/api'),
+            import(pathToFileURL(requireFromProject.resolve('@prisma/adapter-pg')).href),
+            import(pathToFileURL(requireFromProject.resolve('pg')).href),
+        ]);
+        const { PrismaClient } = (await tsImport(pathToFileURL(generatedClient).href, import.meta.url));
+        const { PrismaPg } = adapterModule;
+        const pg = pgModule.default ?? pgModule;
+        const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL });
+        const adapter = new PrismaPg(pool);
+        return new PrismaClient({ adapter });
+    }
+    const clientModule = (await import(pathToFileURL(requireFromProject.resolve('@prisma/client')).href));
+    return new clientModule.PrismaClient();
+}
+//# sourceMappingURL=database.js.map

package/dist/utils/database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.js","sourceRoot":"","sources":["../../src/utils/database.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAK1C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAA;IAElF,IAAI,eAAe,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAO,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAA;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,yBAAyB,EAAE,CAAA;IAC5C,MAAM,CAAC,EAAE,CAAC,CAAA;IACV,OAAO;QACL,EAAE;QACF,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,IAAI,OAAO,EAAE,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACzC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAA;YACxB,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,yBAAyB;IACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IAED,MAAM,kBAAkB,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC,CAAA;IAClF,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAA;IAExE,IAAI,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,aAAa,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,MAAM,CAAC,aAAa,CAAC;YACrB,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;YAC5E,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;SAC7D,CAAC,CAAA;QACF,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,QAAQ,CACtC,aAAa,CAAC,eAAe,CAAC,CAAC,IAAI,EACnC,MAAM,CAAC,IAAI,CAAC,GAAG,CAChB,CAEA,CAAA;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,aAA6D,CAAA;QAClF,MAAM,EAAE,GAAI,QAA0C,CAAC,OAAO,IAAI,QAAQ,CAAA;QAC1E,MAAM,IAAI,GAAG,IAAK,EAAU,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAA;QACjF,MAAM,OAAO,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAA;QAClC,OAAO,IAAI,YAAY,CAAC,EAAE,OAAO,EAAS,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,MAAM,MAAM,CAChC,aAAa,CAAC,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CACjE,CAEA,CAAA;IACD,OAAO,IAAI,YAAY,CAAC,YAAY,EAAE,CAAA;AACxC,CAAC"}

package/dist/vercel/client.d.ts

@@ -0,0 +1,32 @@
+export declare const VERCEL_TARGETS: readonly ["production", "preview", "development"];
+export type VercelTarget = (typeof VERCEL_TARGETS)[number];
+export interface VercelLink {
+    projectId: string;
+    orgId?: string;
+}
+export interface VercelEnvVar {
+    key: string;
+    /** Targets this var applies to, e.g. ['production', 'preview']. */
+    target: VercelTarget[];
+    type?: string;
+}
+export declare class VercelApiError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/** Read `.vercel/project.json` (written by `vercel link`). Returns null if absent. */
+export declare function readVercelLink(cwd: string): Promise<VercelLink | null>;
+/** Resolve a Vercel token from an explicit flag or the standard env vars. */
+export declare function resolveVercelToken(explicit?: string): string | undefined;
+export interface VercelClientOptions {
+    token: string;
+    /** Team / org id, appended as `teamId` when the project belongs to a team. */
+    teamId?: string;
+    fetchImpl?: typeof fetch;
+    baseUrl?: string;
+}
+export interface VercelClient {
+    listProjectEnv(projectId: string): Promise<VercelEnvVar[]>;
+}
+export declare function createVercelClient(options: VercelClientOptions): VercelClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/vercel/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/vercel/client.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,cAAc,mDAAoD,CAAA;AAC/E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAE1D,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,mEAAmE;IACnE,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;gBAEX,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAS5E;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAExE;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAA;IACb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;CAC3D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAyC7E"}

package/dist/vercel/client.js

@@ -0,0 +1,74 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/**
+ * Minimal Vercel REST client for the CLI. Scope is deliberately small: read a
+ * project's environment variables so we can validate Blob wiring and print a
+ * per-environment readiness matrix. No write operations.
+ *
+ * Auth: a Vercel access token via `--token`, `VERCEL_TOKEN`, or
+ * `VERCEL_API_TOKEN`. Project/team identity from `.vercel/project.json` (written
+ * by `vercel link`) or explicit overrides. The client is fetch-injectable so the
+ * evaluation logic can be unit-tested without network access.
+ */
+const DEFAULT_BASE_URL = 'https://api.vercel.com';
+export const VERCEL_TARGETS = ['production', 'preview', 'development'];
+export class VercelApiError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = 'VercelApiError';
+        this.status = status;
+    }
+}
+/** Read `.vercel/project.json` (written by `vercel link`). Returns null if absent. */
+export async function readVercelLink(cwd) {
+    try {
+        const raw = await readFile(join(cwd, '.vercel', 'project.json'), 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (!parsed.projectId)
+            return null;
+        return { projectId: parsed.projectId, orgId: parsed.orgId };
+    }
+    catch {
+        return null;
+    }
+}
+/** Resolve a Vercel token from an explicit flag or the standard env vars. */
+export function resolveVercelToken(explicit) {
+    return explicit ?? process.env.VERCEL_TOKEN ?? process.env.VERCEL_API_TOKEN ?? undefined;
+}
+export function createVercelClient(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
+    async function request(path) {
+        const url = new URL(path, baseUrl);
+        if (options.teamId)
+            url.searchParams.set('teamId', options.teamId);
+        const response = await fetchImpl(url.toString(), {
+            headers: { Authorization: `Bearer ${options.token}` },
+        });
+        if (!response.ok) {
+            let detail = '';
+            try {
+                const body = (await response.json());
+                detail = body?.error?.message ? `: ${body.error.message}` : '';
+            }
+            catch {
+                // non-JSON error body — status alone is enough context
+            }
+            throw new VercelApiError(`Vercel API request failed (HTTP ${response.status})${detail}`, response.status);
+        }
+        return (await response.json());
+    }
+    return {
+        async listProjectEnv(projectId) {
+            const data = await request(`/v9/projects/${encodeURIComponent(projectId)}/env`);
+            return (data.envs ?? []).map((env) => ({
+                key: env.key,
+                target: Array.isArray(env.target) ? env.target : [],
+                type: env.type,
+            }));
+        },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/vercel/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/vercel/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;;;;;;;GASG;AAEH,MAAM,gBAAgB,GAAG,wBAAwB,CAAA;AAEjD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAA;AAe/E,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,MAAM,CAAQ;IAEvB,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAA;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2C,CAAA;QACxE,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,IAAI,CAAA;QAClC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,OAAO,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS,CAAA;AAC1F,CAAC;AAcD,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAA;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAA;IAEnD,KAAK,UAAU,OAAO,CAAI,IAAY;QACpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAClC,IAAI,OAAO,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;QAElE,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC/C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE;SACtD,CAAC,CAAA;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqC,CAAA;gBACxE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;YACzD,CAAC;YACD,MAAM,IAAI,cAAc,CACtB,mCAAmC,QAAQ,CAAC,MAAM,IAAI,MAAM,EAAE,EAC9D,QAAQ,CAAC,MAAM,CAChB,CAAA;QACH,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAA;IACrC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,SAAiB;YACpC,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,MAAM,CACpD,CAAA;YACD,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACrC,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACnD,IAAI,EAAE,GAAG,CAAC,IAAI;aACf,CAAC,CAAC,CAAA;QACL,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/vercel/env-matrix.d.ts

@@ -0,0 +1,34 @@
+import { type VercelEnvVar, type VercelTarget } from './client.js';
+/**
+ * Pure evaluation helpers over a project's Vercel env vars. Kept free of I/O so
+ * the matrix / blob logic is unit-testable without hitting the Vercel API.
+ */
+export type TargetPresence = Record<VercelTarget, boolean>;
+/** Which targets a given env var key is defined for. */
+export declare function presenceForKey(envVars: VercelEnvVar[], key: string): TargetPresence;
+export interface EnvMatrixRow {
+    key: string;
+    required: boolean;
+    presence: TargetPresence;
+}
+export interface EnvMatrix {
+    rows: EnvMatrixRow[];
+    /** Required vars missing on production or preview (deploy-blocking). */
+    missingCritical: {
+        key: string;
+        targets: VercelTarget[];
+    }[];
+}
+export declare function buildEnvMatrix(envVars: VercelEnvVar[], requiredKeys: readonly string[], optionalKeys?: readonly string[]): EnvMatrix;
+export type BlobLinkStatus = 'ok' | 'partial' | 'none';
+export interface BlobLinkReport {
+    /** True when any BLOB_* var indicates a store is connected to the project. */
+    linked: boolean;
+    tokenByTarget: TargetPresence;
+    /** Targets (any) where BLOB_READ_WRITE_TOKEN is absent while linked. */
+    missingTargets: VercelTarget[];
+    /** 'partial' when production/preview lack the token (deploy-blocking). */
+    status: BlobLinkStatus;
+}
+export declare function evaluateBlobLink(envVars: VercelEnvVar[]): BlobLinkReport;
+//# sourceMappingURL=env-matrix.d.ts.map

package/dist/vercel/env-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-matrix.d.ts","sourceRoot":"","sources":["../../src/vercel/env-matrix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA;AAElF;;;GAGG;AAEH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;AAM1D,wDAAwD;AACxD,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAWnF;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,EAAE,cAAc,CAAA;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,YAAY,EAAE,CAAA;IACpB,wEAAwE;IACxE,eAAe,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,YAAY,EAAE,CAAA;KAAE,EAAE,CAAA;CAC5D;AAKD,wBAAgB,cAAc,CAC5B,OAAO,EAAE,YAAY,EAAE,EACvB,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,SAAS,CAoBX;AAED,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAA;AAEtD,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,MAAM,EAAE,OAAO,CAAA;IACf,aAAa,EAAE,cAAc,CAAA;IAC7B,wEAAwE;IACxE,cAAc,EAAE,YAAY,EAAE,CAAA;IAC9B,0EAA0E;IAC1E,MAAM,EAAE,cAAc,CAAA;CACvB;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,cAAc,CAkBxE"}

package/dist/vercel/env-matrix.js

@@ -0,0 +1,57 @@
+import { VERCEL_TARGETS } from './client.js';
+function emptyPresence() {
+    return { production: false, preview: false, development: false };
+}
+/** Which targets a given env var key is defined for. */
+export function presenceForKey(envVars, key) {
+    const presence = emptyPresence();
+    for (const env of envVars) {
+        if (env.key !== key)
+            continue;
+        for (const target of env.target) {
+            if (VERCEL_TARGETS.includes(target)) {
+                presence[target] = true;
+            }
+        }
+    }
+    return presence;
+}
+/** Production and preview are the deploy-blocking targets; development is local-only. */
+const DEPLOY_TARGETS = ['production', 'preview'];
+export function buildEnvMatrix(envVars, requiredKeys, optionalKeys = []) {
+    const rows = [];
+    const seen = new Set();
+    const missingCritical = [];
+    for (const key of requiredKeys) {
+        seen.add(key);
+        const presence = presenceForKey(envVars, key);
+        rows.push({ key, required: true, presence });
+        const missing = DEPLOY_TARGETS.filter((t) => !presence[t]);
+        if (missing.length > 0)
+            missingCritical.push({ key, targets: missing });
+    }
+    for (const key of optionalKeys) {
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        rows.push({ key, required: false, presence: presenceForKey(envVars, key) });
+    }
+    return { rows, missingCritical };
+}
+const BLOB_LINK_SIGNALS = ['BLOB_STORE_ID', 'BLOB_WEBHOOK_PUBLIC_KEY', 'BLOB_READ_WRITE_TOKEN'];
+export function evaluateBlobLink(envVars) {
+    const linked = envVars.some((env) => BLOB_LINK_SIGNALS.includes(env.key) || env.key.startsWith('BLOB_'));
+    const tokenByTarget = presenceForKey(envVars, 'BLOB_READ_WRITE_TOKEN');
+    if (!linked) {
+        return { linked: false, tokenByTarget, missingTargets: [], status: 'none' };
+    }
+    const missingTargets = VERCEL_TARGETS.filter((t) => !tokenByTarget[t]);
+    const criticalMissing = DEPLOY_TARGETS.some((t) => !tokenByTarget[t]);
+    return {
+        linked: true,
+        tokenByTarget,
+        missingTargets,
+        status: criticalMissing ? 'partial' : 'ok',
+    };
+}
+//# sourceMappingURL=env-matrix.js.map

package/dist/vercel/env-matrix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-matrix.js","sourceRoot":"","sources":["../../src/vercel/env-matrix.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAwC,MAAM,aAAa,CAAA;AASlF,SAAS,aAAa;IACpB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAA;AAClE,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,OAAuB,EAAE,GAAW;IACjE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAA;IAChC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;YAAE,SAAQ;QAC7B,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAChC,IAAK,cAAoC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,MAAsB,CAAC,GAAG,IAAI,CAAA;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAcD,yFAAyF;AACzF,MAAM,cAAc,GAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;AAEhE,MAAM,UAAU,cAAc,CAC5B,OAAuB,EACvB,YAA+B,EAC/B,eAAkC,EAAE;IAEpC,MAAM,IAAI,GAAmB,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,eAAe,GAA+C,EAAE,CAAA;IAEtE,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QAC7C,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAA;AAClC,CAAC;AAcD,MAAM,iBAAiB,GAAG,CAAC,eAAe,EAAE,yBAAyB,EAAE,uBAAuB,CAAC,CAAA;AAE/F,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CACzB,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAC5E,CAAA;IACD,MAAM,aAAa,GAAG,cAAc,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAA;IAEtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;IAC7E,CAAC;IAED,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IACtE,MAAM,eAAe,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAA;IACrE,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,aAAa;QACb,cAAc;QACd,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;KAC3C,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actuate-media/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "CLI for Actuate CMS — migrations, codegen, imports, exports, and upgrades",
   "repository": {
     "type": "git",
@@ -28,7 +28,7 @@
   "devDependencies": {
     "typescript": "^5.7.0",
     "vitest": "^4.1.0",
-    "@actuate-media/cms-core": "0.51.0"
+    "@actuate-media/cms-core": "0.55.0"
   },
   "scripts": {
     "build": "tsc",

package/src/__tests__/db-sync.test.ts

@@ -3,7 +3,13 @@ import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, describe, expect, it } from 'vitest'
 
-import { buildConsumerSchema, syncPrismaAssets } from '../commands/db-sync.js'
+import {
+  buildConsumerSchema,
+  checkSchemaDrift,
+  driftGuidance,
+  syncPrismaAssets,
+  type DriftRunner,
+} from '../commands/db-sync.js'
 
 const CORE_SCHEMA = `generator client {
   provider = "prisma-client"
@@ -164,4 +170,52 @@ describe('db:sync (WS-D D2 — post-upgrade schema sync)', () => {
       expect(second.migrationsAdded).toEqual([])
     })
   })
+
+  describe('checkSchemaDrift', () => {
+    const okRunner: DriftRunner = async () => ({ exitCode: 0, stdout: '', stderr: '' })
+    const driftRunner: DriftRunner = async () => ({
+      exitCode: 2,
+      stdout: 'ALTER TABLE "actuate_media_usages" RENAME COLUMN "fieldName" TO "fieldPath";',
+      stderr: '',
+    })
+
+    it('skips when no database URL is configured', async () => {
+      const result = await checkSchemaDrift('prisma/schema.prisma', {}, okRunner)
+      expect(result.status).toBe('skipped')
+    })
+
+    it('reports no-drift on exit code 0', async () => {
+      const result = await checkSchemaDrift(
+        'prisma/schema.prisma',
+        { DATABASE_URL: 'postgres://x' },
+        okRunner,
+      )
+      expect(result.status).toBe('no-drift')
+    })
+
+    it('reports drift (with reconciling SQL) on exit code 2', async () => {
+      const result = await checkSchemaDrift(
+        'prisma/schema.prisma',
+        { DATABASE_URL: 'postgres://x' },
+        driftRunner,
+      )
+      expect(result.status).toBe('drift')
+      expect(result.detail).toContain('RENAME COLUMN')
+      expect(driftGuidance(result).join('\n')).toContain('prisma migrate dev --name')
+    })
+
+    it('prefers DIRECT_DATABASE_URL for the diff connection', async () => {
+      let usedUrl = ''
+      const spyRunner: DriftRunner = async ({ url }) => {
+        usedUrl = url
+        return { exitCode: 0, stdout: '', stderr: '' }
+      }
+      await checkSchemaDrift(
+        'prisma/schema.prisma',
+        { DATABASE_URL: 'postgres://pooled', DIRECT_DATABASE_URL: 'postgres://direct' },
+        spyRunner,
+      )
+      expect(usedUrl).toBe('postgres://direct')
+    })
+  })
 })

package/src/__tests__/deployment-diagnostics.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, it } from 'vitest'
 import {
   buildDeploymentManifest,
   createDiagnosticReport,
+  detectBlobLinkState,
   REQUIRED_CMS_MODELS,
   REQUIRED_ENV_VARS,
 } from '../deployment/diagnostics.js'
@@ -127,6 +128,56 @@ describe('deployment diagnostics', () => {
     )
   })
 
+  it('fails (not warns) when a Blob store is linked but the read-write token is missing', () => {
+    const report = createDiagnosticReport({
+      schemaModels: new Set(REQUIRED_CMS_MODELS),
+      schemaContent: '',
+      env: {
+        DATABASE_URL: 'postgresql://example',
+        CMS_SECRET: 'secret',
+        CMS_ENCRYPTION_KEY: 'a'.repeat(64),
+        NEXT_PUBLIC_SITE_URL: 'https://example.com',
+        BLOB_STORE_ID: 'store_abc123',
+        BLOB_WEBHOOK_PUBLIC_KEY: 'pk_abc',
+        // BLOB_READ_WRITE_TOKEN deliberately absent — the partial-link failure.
+      },
+      packageManager: 'pnpm',
+      schemaPath: 'prisma/schema.prisma',
+    })
+
+    expect(report.status).toBe('fail')
+    expect(report.checks).toEqual(
+      expect.arrayContaining([expect.objectContaining({ id: 'blob-storage', status: 'fail' })]),
+    )
+  })
+
+  it('passes the blob check when no Blob storage is configured', () => {
+    const report = createDiagnosticReport({
+      schemaModels: new Set(REQUIRED_CMS_MODELS),
+      schemaContent: '',
+      env: {
+        DATABASE_URL: 'postgresql://example',
+        CMS_SECRET: 'secret',
+        CMS_ENCRYPTION_KEY: 'a'.repeat(64),
+        NEXT_PUBLIC_SITE_URL: 'https://example.com',
+      },
+      packageManager: 'pnpm',
+      schemaPath: 'prisma/schema.prisma',
+    })
+
+    expect(report.checks).toEqual(
+      expect.arrayContaining([expect.objectContaining({ id: 'blob-storage', status: 'pass' })]),
+    )
+  })
+
+  it('classifies blob link state from env and config signals', () => {
+    expect(detectBlobLinkState({ BLOB_READ_WRITE_TOKEN: 'vercel_blob_rw_x' })).toBe('ok')
+    expect(detectBlobLinkState({ BLOB_READ_WRITE_TOKEN: 'not-a-real-token' })).toBe('token-format')
+    expect(detectBlobLinkState({ BLOB_STORE_ID: 'store_x' })).toBe('partial')
+    expect(detectBlobLinkState({}, "storage: { provider: 'vercel-blob' }")).toBe('partial')
+    expect(detectBlobLinkState({})).toBe('none')
+  })
+
   it('exposes machine-readable deployment metadata', () => {
     const manifest = buildDeploymentManifest()
 

package/src/__tests__/vercel-env-matrix.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from 'vitest'
+
+import type { VercelEnvVar } from '../vercel/client.js'
+import { buildEnvMatrix, evaluateBlobLink, presenceForKey } from '../vercel/env-matrix.js'
+
+function env(key: string, target: VercelEnvVar['target']): VercelEnvVar {
+  return { key, target }
+}
+
+describe('presenceForKey', () => {
+  it('aggregates targets across multiple entries for the same key', () => {
+    const vars = [env('DATABASE_URL', ['production']), env('DATABASE_URL', ['preview'])]
+    expect(presenceForKey(vars, 'DATABASE_URL')).toEqual({
+      production: true,
+      preview: true,
+      development: false,
+    })
+  })
+})
+
+describe('buildEnvMatrix', () => {
+  it('flags required vars missing on production or preview as critical', () => {
+    const vars = [
+      env('DATABASE_URL', ['production', 'preview', 'development']),
+      env('CMS_SECRET', ['production']),
+    ]
+    const matrix = buildEnvMatrix(vars, ['DATABASE_URL', 'CMS_SECRET'], ['CRON_SECRET'])
+
+    expect(matrix.missingCritical).toEqual([{ key: 'CMS_SECRET', targets: ['preview'] }])
+    expect(matrix.rows.find((r) => r.key === 'CRON_SECRET')).toMatchObject({ required: false })
+  })
+})
+
+describe('evaluateBlobLink', () => {
+  it('reports none when no blob vars exist', () => {
+    expect(evaluateBlobLink([env('DATABASE_URL', ['production'])]).status).toBe('none')
+  })
+
+  it('reports partial when linked but token missing on production/preview', () => {
+    const report = evaluateBlobLink([
+      env('BLOB_STORE_ID', ['production', 'preview', 'development']),
+    ])
+    expect(report.linked).toBe(true)
+    expect(report.status).toBe('partial')
+    expect(report.missingTargets).toContain('production')
+  })
+
+  it('reports ok when token covers production and preview (dev optional)', () => {
+    const report = evaluateBlobLink([
+      env('BLOB_STORE_ID', ['production', 'preview']),
+      env('BLOB_READ_WRITE_TOKEN', ['production', 'preview']),
+    ])
+    expect(report.status).toBe('ok')
+    expect(report.missingTargets).toEqual(['development'])
+  })
+})