@impeccable/reviews 0.1.14 → 0.1.16

package/README.md

@@ -44,7 +44,7 @@ Keys: Enter goes on, Esc cancels the intro or the sign-in and skips a question (
 4. **Two pull requests,** opened as you with `gh`, even when something is left for a person, which goes into the report, both into the default branch and in this order:
    - the test drive, safe to close (`impeccable/test-drive`, "Impeccable test drive (safe to close)"), always: a few real style or layout changes on a page the preview renders, on top of the setup commit when there is one, so it carries the workflow, whose job builds the preview on the pull request while Impeccable's review waits for it. Its pull request opens only once its preview is proven: the host's build of the pushed branch, or the local proof of Impeccable's own preview. No preview, no test drive: the run then says why in the report and what you can do, and still opens the setup pull request when the repository needs one;
    - the setup pull request, to merge (`impeccable/setup`, "Set up Impeccable previews"), only when the repository needs a change to keep previews working: the preview workflow, any fix the build needed. The report lists the files it changes, so one the setup never meant to change stands out.
-5. **The end.** The run ends once the pull requests are open and recorded. The report (what it found, configured, skipped and could not verify, and what to do before merging) goes to the web page, which follows Impeccable's review of the test drive; the terminal ends on the test drive's screen (when there is a setup pull request too), then "You're all set up" with the setup pull request, or the test drive when there is none, and what is left, and its summary keeps both pull requests and the web page; exit 0. If something stops it, it says why in a sentence and exits 1.
+5. **The end.** The run ends once the pull requests are open and recorded. The report (what it found, configured, skipped and could not verify, and what to do before merging) goes to the web page, which follows Impeccable's review of the test drive; the terminal ends on the test drive's screen (when there is a setup pull request too), then "You're all set up" with the setup pull request, or the test drive when there is none, and what is left, and its summary keeps both pull requests and the web page; exit 0. A run that opened no test drive, or left a picked app not set up, says so in its heading ("Not set up: the previews are behind Cloudflare Access") with the reason under it, prints the report, and exits 1. If something stops it, it says why in a sentence and exits 1.
 
 The sign-in's setup token lasts an hour. A run that goes longer asks you to sign in again, in the same terminal, and carries on.
 
@@ -92,4 +92,4 @@ Vercel's bypass secret, which lets reviews open previews behind Vercel's login,
 
 Netlify's site password (Password Protection on Pro and Enterprise plans; "Project visibility: Password" on a credit-based Pro plan) is handled the same way. When a Netlify deploy preview asks for it, the command reads the site's settings through the Netlify CLI, signed in as you, and that read is what shows the site to be yours: a site the CLI cannot read as you (it is signed out, or the site is in none of your teams) gets no password, and the command refuses, saying so, since the lock at a listed address may be anyone's. For a password Netlify gives back, it asks you once, on one screen that names the preview's address, whether to store the site password for Impeccable, and on your yes reads it from the site as you. When Netlify does not give the password back, a screen names the address and takes the password you type, hidden (the run never sets one itself: the Netlify CLI takes a new password only on its command line, where any process could read it). It opens the preview with the password first, as basic credentials in the `Authorization` header (Netlify's password page asks for a password alone, so the credentials carry no username), and saves it, with the setting that sends that header, only once the page shows your app; a password that opens the preview on Netlify's own form but not in the header is reported, not saved, since reviews can send only a header. A site behind Netlify's team login (a private site) has no way in for tools, so the command asks you once, on one screen, whether to make the site public, and on your yes makes it public as you through the Netlify CLI (`netlify api updateSite` with `sso_login` off); anyone with its address can then open it, the live site included, until you make it private again in Project configuration, General, Visitor access. Where Netlify refuses (your team's default keeps every project private, or your role cannot change it), the command opens that page in your browser and asks you to try again once you changed it there; a password you set there instead is stored as above. The agent never holds the password: it goes from the command's own process to Netlify and to Impeccable's setting, and the debug log and the transcript remove it.
 
-A Cloudflare Access service token, which lets reviews open Pages previews behind Access, is handled the same way. When Access stands in front of a preview, the command asks you once, on one screen that names the preview's address, whether to create a service token for Impeccable. On your yes it creates the token as you through Cloudflare's CLI, cf (run through npx), named "Impeccable reviews", and allows it in a Service Auth policy of the Access application in front of the preview (a reusable policy added to the application's list). The token goes only to a preview an Access application in your accounts covers, which that read shows; where none covers it, the command refuses, saying so, and asks for no token. When cf here is not signed in with Access, your browser opens Cloudflare's sign-in first, for five scopes (`account:read`, `user:read`, `pages:read`, `access.write`, `access-service-token.write`), with a retry when it did not complete. Only where that sign-in cannot create the token (it grants no Access, cf does not run here, or the application runs on policies of its own, which cf has no command for) does the command ask for a Cloudflare API token with two permissions (Access: Apps and Policies, Edit; Access: Service Tokens, Edit), used for that run only and stored nowhere. On a skip, or where that cannot be done, a screen names the address and takes a client id and secret you paste, the secret hidden, again only once an application of yours was read to cover the preview (on a skip, through cf as it is signed in here, with no sign-in opened). It opens the preview with the token in the `CF-Access-Client-Id` and `CF-Access-Client-Secret` headers first and saves it, with the setting that sends them, only once the page shows your app; a token it made that opens nothing is deleted, with its policy. The agent never holds either, and the debug log and the transcript remove both. You revoke it in Zero Trust, Access controls, Service credentials, Service Tokens.
+A Cloudflare Access service token, which lets reviews open Pages previews behind Access, is handled the same way. When Access stands in front of a preview, the command asks you once, on one screen that names the preview's address, whether to create a service token for Impeccable. On your yes it creates the token as you through Cloudflare's CLI, cf (run through npx), named "Impeccable reviews", and allows it in a Service Auth policy of the Access application in front of the preview (a reusable policy added to the application's list). The token goes only to a preview an Access application in your accounts covers, which that read shows; where none covers it, the command refuses, saying so, and asks for no token. When cf here is not signed in with Access, your browser opens Cloudflare's sign-in first, for five scopes (`account:read`, `user:read`, `pages:read`, `access.write`, `access-service-token.write`), with a retry when it did not complete. An application whose policies are its own, which cf has no command to add to, gets one more screen, naming it, asking to make those policies reusable (each keeps allowing whom it allows, and shows under Access controls, Policies); on your yes cf makes them so and the token's policy goes beside them, and on a skip the paste screen below says which account and application to make the token in, and why. Only where that sign-in cannot create the token (it grants no Access, or cf does not run here) does the command ask for a Cloudflare API token with two permissions (Access: Apps and Policies, Edit; Access: Service Tokens, Edit), used for that run only and stored nowhere. On a skip, or where that cannot be done, a screen names the address and takes a client id and secret you paste, the secret hidden, again only once an application of yours was read to cover the preview (on a skip, through cf as it is signed in here, with no sign-in opened). It opens the preview with the token in the `CF-Access-Client-Id` and `CF-Access-Client-Secret` headers first and saves it, with the setting that sends them, only once the page shows your app; a token it made that opens nothing is deleted, with its policy. The agent never holds either, and the debug log and the transcript remove both. You revoke it in Zero Trust, Access controls, Service credentials, Service Tokens.

package/dist/cloudflare-access.js

@@ -4,9 +4,11 @@ import { cfFailure, cfStatus } from './cloudflare.js';
  * Getting past Cloudflare Access the way Cloudflare documents it for tools: a service token, a client id and a client
  * secret sent in two headers, which a Service Auth policy of the Access application in front of the previews allows.
  * The run makes both as the person through cf, Cloudflare's CLI, signed in with the scopes below, and signs cf in, in
- * the browser, where it lacks them. Where that sign-in cannot make them (it grants no Access, cf does not run here, or
- * the application runs on policies of its own, which cf has no command to add to), the person gives the run a Cloudflare
- * API token with two permissions instead, used in the command's own process for this run and kept nowhere. The person
+ * the browser, where it lacks them. An application on policies of its own, which cf has no command to add to, has them
+ * made reusable through cf on the person's yes (#327), or else the person makes the token by hand, told the account, the
+ * application and why. Where that sign-in cannot make them (it grants no Access, or cf does not run here), the person
+ * gives the run a Cloudflare API token with two permissions instead, used in the command's own process for this run and
+ * kept nowhere. The person
  * consents once, on the tool's screen, before anything is made; a token opens the locked address before anything saves
  * it; neither it nor the API token goes back to the model.
  */
@@ -54,7 +56,7 @@ function withApiToken(key, deps) {
         },
     };
 }
-/** The cf command for each call in an account's Access; a policy of an application's own has none. A delete asks first unless forced, and the run deletes only what it made. */
+/** The cf command for each call in an account's Access; adding a policy of an application's own has none, but making one reusable has. A delete asks first unless forced, and the run deletes only what it made. */
 const CF_COMMANDS = [
     [/^GET apps$/, () => ['applications', 'list']],
     [/^GET policies$/, () => ['policies', 'list']],
@@ -63,6 +65,7 @@ const CF_COMMANDS = [
     [/^PUT apps\/([\w-]+)$/, (id) => ['applications', 'update', id]],
     [/^DELETE service_tokens\/([\w-]+)$/, (id) => ['service-tokens', 'delete', id, '--force']],
     [/^DELETE policies\/([\w-]+)$/, (id) => ['policies', 'delete', id, '--force']],
+    [/^PUT apps\/([\w-]+)\/policies\/([\w-]+)\/make_reusable$/, (app, policy) => ['applications', 'policies', 'make-reusable', policy, '--app-id', app]],
 ];
 /** Cloudflare's API through cf signed in as the person: each call as the cf command that makes it, in the account its path names, which is one of the sign-in's. */
 function throughCf(cf, accounts, signal) {
@@ -79,7 +82,7 @@ function throughCf(cf, accounts, signal) {
             const command = CF_COMMANDS.find(([pattern]) => pattern.test(call));
             if (!at || !command)
                 return { ok: false, status: null };
-            const args = ['zero-trust', 'access', ...command[1](command[0].exec(call)[1] ?? ''),
+            const args = ['zero-trust', 'access', ...command[1](...command[0].exec(call).slice(1)),
                 ...(paging.has('page') ? ['--page', paging.get('page'), '--per-page', paging.get('per_page')] : []),
                 ...(body === undefined ? [] : ['--body', JSON.stringify(body)])];
             try {
@@ -208,17 +211,41 @@ async function create(way, deps, found) {
         return { reason: `${found.length} Access applications cover ${url.host}, so which one's policy should allow the token is not clear.` };
     const { account, app } = found[0];
     const base = `/accounts/${account}/access`;
-    const links = list(app.policies).flatMap((p, i) => (uid(p.id) ? [{ id: p.id, precedence: typeof p.precedence === 'number' ? p.precedence : i + 1 }] : []));
+    let links = list(app.policies).flatMap((p, i) => (uid(p.id) ? [{ id: p.id, precedence: typeof p.precedence === 'number' ? p.precedence : i + 1 }] : []));
     let reusable = true;
+    let ids = new Set();
     if (links.length) {
         const policies = await every(api, `${base}/policies`, 1000);
         if (!policies.ok)
             return stop(way, policies, '');
-        const ids = new Set(list(policies.result).map((p) => p.id));
+        ids = new Set(list(policies.result).map((p) => p.id));
         reusable = links.every((link) => ids.has(link.id));
     }
-    if (!reusable && way.cf)
-        return { fallback: 'The Access application runs on policies of its own, which cf has no command to add to.' };
+    if (!reusable && way.cf) {
+        // cf adds no policy of an application's own, but makes one reusable: asked first, since the person's policies change kind (#327).
+        const name = typeof app.name === 'string' && app.name ? app.name : url.host;
+        if (!(await deps.reusable(name))) {
+            return {
+                reason: `The person kept the policies of the Access application "${name}" its own, which the Cloudflare CLI cannot add the token's policy to.`,
+                manual: `The Access application "${name}", in the Cloudflare account ${account}, keeps its policies to itself, and the Cloudflare CLI can't add a policy to those. Make the token by hand in that account: Zero Trust → Access controls → Service credentials → Service Tokens → Create Service Token, named "${TOKEN_NAME}"; then add a policy to "${name}" (Access controls → Applications → "${name}" → Policies) with the action Service Auth, including that token.`,
+            };
+        }
+        const converted = [];
+        for (const link of links) {
+            if (ids.has(link.id))
+                converted.push(link);
+            else {
+                const made = await api('PUT', `${base}/apps/${app.id}/policies/${link.id}/make_reusable`);
+                if (!made.ok)
+                    return stop(way, made, '');
+                // The reusable policy Cloudflare answers, by its own id.
+                const id = record(made.result)?.id;
+                converted.push({ ...link, id: uid(id) ? id : link.id });
+            }
+        }
+        links = converted;
+        reusable = true;
+    }
     const undo = [];
     const rollback = async () => {
         let clean = true;
@@ -295,8 +322,9 @@ export async function passCloudflareAccess(deps) {
         const failed = await deps.save(token);
         return { status: failed ? 'save-failed' : 'saved', token: how, ...made, ...(failed ? { reason: failed } : {}), value: token };
     };
-    /** Why the run's own way ended without a token that opens the address, for the paste screen's skip. */
+    /** Why the run's own way ended without a token that opens the address, for the paste screen's skip, and how to make one by hand there. */
     let stopped;
+    let manual;
     if (!(await deps.consent())) {
         stopped = 'The person skipped creating a service token.';
         // cf signed in here, with whatever scopes, says whether an application of the person's covers the address, since reading takes no write; a skip opens no sign-in for it.
@@ -319,8 +347,11 @@ export async function passCloudflareAccess(deps) {
                 made = await build(withApiToken(key, deps));
             }
         }
-        if (!('token' in made))
+        if (!('token' in made)) {
             stopped = 'reason' in made ? made.reason : made.fallback;
+            if ('manual' in made && typeof made.manual === 'string')
+                manual = made.manual;
+        }
         else {
             const token = made;
             // A token that opens nothing is no use to anyone, nor is one a stopped run leaves behind: it and its policy go.
@@ -337,7 +368,7 @@ export async function passCloudflareAccess(deps) {
     deps.signal?.throwIfAborted();
     if (!covered)
         return { status: 'refused', reason: `${stopped} A service token goes only to a preview an Access application in the person's accounts covers, and none was read for ${url.host}, so none was asked for or sent.` };
-    const typed = await deps.paste();
+    const typed = await deps.paste(manual);
     if (!typed)
         return { status: 'skipped', reason: stopped };
     const token = { id: typed.id?.trim() ?? '', secret: typed.secret?.trim() ?? '' };

package/dist/fence.js

@@ -782,8 +782,9 @@ function vercel(args, where, agreed, team, settlement = null) {
         return allow();
     if (sub === 'login')
         return deny('the Vercel sign-in is impeccable_ask\'s, with the id vercel-setup: it opens the browser from the sign-in screen');
+    // The gate is the person's yes to setting Vercel up, not the CLI's sign-in: a project Vercel deploys already needs no link for its login, which impeccable_vercel_bypass gets past (#310).
     if (!agreed)
-        return deny('sets Vercel up, and the person has not signed in to Vercel for that');
+        return deny("sets Vercel up, which waits for the person's yes to the Vercel setup (impeccable_ask vercel-setup), whether or not the CLI is signed in; a preview behind Vercel's login needs no vercel link, since impeccable_vercel_bypass finds the repository's project");
     const cwd = options.get('--cwd');
     if (cwd !== undefined && (typeof cwd !== 'string' || outside(cwd, where)))
         return deny('points the Vercel CLI outside the checkout');

package/dist/host-questions.js

@@ -224,6 +224,23 @@ export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
     return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
 }
+/** The one consent to making the Access application's own policies reusable, which the run's way through cf needs to add the token's policy (#327): the application named. */
+export function cloudflareAccessReusable(application) {
+    return {
+        id: 'cloudflare-access-reusable',
+        kind: 'confirm',
+        title: 'Your Access policies belong to one application',
+        hint: `The policies of your Access application "${application}" are its own, and the Cloudflare CLI can't add the token's policy beside those.\n\nThe run can make them reusable policies, as the dashboard makes them now: each keeps allowing exactly whom it allows today, and also shows under Access controls → Policies, where another application could use it. They stay reusable after the run.`,
+        prompt: 'Make the policies reusable?',
+        confirmLabel: 'Make reusable',
+        skipLabel: 'Skip',
+    };
+}
+/** The paste screen for a service token, with how to make one by hand where the run's way stopped on something the person does there (the account, the application and why). */
+export function cloudflareAccessPaste(manual) {
+    const screen = HOST_SCREENS['cloudflare-access-key'];
+    return manual ? { ...screen, prompt: `Cloudflare Access keeps your previews behind a login. ${manual} Paste its client ID and secret here. It is stored encrypted and used only to open previews.` } : screen;
+}
 /**
  * The paste screen for Vercel's bypass secret, saying what actually stopped the run's own way (the CLI's read, Vercel's
  * refusal in its own words, a secret made but not read back, or one that did not open the preview) rather than one fixed

package/dist/http.js

@@ -28,7 +28,8 @@ export async function requestJson(url, init, log) {
             return { ok: true, status: res.status, data };
         const said = data && typeof data === 'object' ? data.error : undefined;
         const error = typeof said === 'string' ? said : typeof data === 'string' && data ? data.slice(0, 200) : res.statusText || `HTTP ${res.status}`;
-        return { ok: false, status: res.status, data, error };
+        const retryAfter = res.status === 429 ? Number(res.headers.get('retry-after') ?? NaN) : NaN;
+        return { ok: false, status: res.status, data, error, ...(Number.isFinite(retryAfter) && retryAfter >= 0 ? { retryAfter } : {}) };
     }
     catch (err) {
         const error = err instanceof Error ? (err.name === 'TimeoutError' ? 'the request timed out' : err.message) : String(err);

package/dist/main.js

@@ -16,7 +16,7 @@ import { scanRecorder } from './scan.js';
 import { createReporter, reportingOff } from './report.js';
 import { createSessionSync, pageStatus, plainReport, syncExtension } from './sync.js';
 import { checkPushAccess, readPushAccess } from './push-access.js';
-import { appsSummary, createTools, ownPullRequest, resultLine } from './tools.js';
+import { appsSummary, createTools, ending, ownPullRequest, resultLine } from './tools.js';
 import { transcriptPaths } from './transcript.js';
 import { askPerson } from './ui/bridge.js';
 import { atExit, closeScreens, helpMark, onScreenExit, recordFrames, showIntro, showOutro, showPullRequest, showRun, showSignIn } from './ui/screens.js';
@@ -235,16 +235,16 @@ export async function main(argv) {
                 const saved = await settle(liveSync.flush(), 5000);
                 const { testPr } = report;
                 const setupPr = shownSetupPr(report.setupPr);
-                // On a repository with several apps, "You're all set up" means every app this run picked is: one left unproven is named, with its one step (#286).
+                // On a repository with several apps, "You're all set up" means every app this run picked is: one left unproven is named, with its one step (#286). A run short of that says what is not, and exits 1 (#321).
                 const apps = appsSummary(report.apps ?? []);
-                const allSetUp = Boolean(testPr) && !apps.notReady.length;
+                const end = ending(report);
                 // One pull request a screen, each opened in the browser and put on the clipboard as its screen appears: the test drive, then the setup pull request.
                 const hand = { open: openBrowser, copy: copyText };
                 if (testPr && setupPr)
                     await showPullRequest(testPr.url, hand);
                 await showOutro({
-                    outcome: allSetUp ? 'done' : 'partial',
-                    title: allSetUp ? "You're all set up" : apps.notReady.length ? `${apps.notReady.join(' and ')} ${apps.notReady.length === 1 ? 'is' : 'are'} not set up` : 'Settings saved',
+                    outcome: end.outcome,
+                    title: end.title,
                     result: [resultLine({ ...report, setupPr }), apps.line].filter(Boolean).join(' '),
                     link: (setupPr ?? testPr)?.url,
                     links: [
@@ -253,16 +253,16 @@ export async function main(argv) {
                         ...(setupPr ? [{ label: testPr ? 'Setup pull request, merge this' : 'Setup pull request', url: setupPr.url }] : []),
                         { label: 'Web page', url: page },
                     ],
-                    todo: [...apps.todo, ...report.left],
+                    todo: end.todo,
                     warnings: [...removed, ...(saved && !saved.ok ? [`The web page missed the last update (${saved.error}), so it may lag behind this.`] : [])],
                 }, hand);
-                // The web page has the report; when it missed it, or there is no test drive, whose why it holds, the report stays here as well.
-                if (!saved?.ok || !testPr)
+                // The web page has the report; when it missed it, or the run fell short of all set up, whose why it holds, the report stays here as well.
+                if (!saved?.ok || end.code)
                     say(`\n${plainReport(report.markdown)}`);
                 if (!saved?.ok)
                     reporter.step({ event: 'setup_command_stopped', outcome: 'update_lost' });
                 await reporter.done();
-                process.exit(0);
+                process.exit(end.code);
             }
             const waiting = liveSync.payload.phase === 'waiting' ? liveSync.payload.question?.prompt : undefined;
             const why = pageStatus(fatal ? `Impeccable stopped: ${fatal}` : waiting ? `Impeccable stopped while waiting for an answer: ${waiting}` : 'Impeccable stopped before the setup finished.');

package/dist/netlify.js

@@ -325,8 +325,9 @@ export async function connectNetlifySite(owner, repo, cwd, deps) {
     // the one site built from this repository with the app's folder as its base (#319). The checks below read it again as built from this
     // repository, so a site found here is never written to.
     const otherApp = site !== undefined && deps.directory !== undefined && ours(site) && folderOf(record(site.build_settings)?.base) !== deps.directory;
-    if (!siteId || otherApp) {
-        const linkedTo = otherApp ? "This folder is linked to the Netlify site of another app's folder" : 'This folder is linked to no Netlify site';
+    const elsewhere = site !== undefined && deps.ownSite === true && !ours(site);
+    if (!siteId || otherApp || elsewhere) {
+        const linkedTo = otherApp ? "This folder is linked to the Netlify site of another app's folder" : elsewhere ? 'This folder is linked to a Netlify site built from another repository' : 'This folder is linked to no Netlify site';
         const where = deps.directory !== undefined ? ` from ${deps.directory || "the repository's root"}` : '';
         let built;
         try {

package/dist/playbook/cases/cloudflare-previews.md

@@ -5,7 +5,7 @@ Cloudflare Pages deploys previews of the pull requests: impeccable_cloudflare_pr
 ### Steps
 
 1. **Prove the newest preview** with impeccable_prove_preview: the branch's alias (`alias`) of the newest listed preview whose state is success (or a page on it a visitor opens without signing in), and words the page shows that the checkout holds, such as the app's name in its title. The alias is the address the pattern saves, so it is the one proven; a preview listed without one is proven on its own address (`url`). Done when it answers `proven: true`; when an address no longer answers, try the next newest, three at most.
-2. **Save the method** with impeccable_write to `preview`: `{"previewUrlPattern": "<the proof's pattern>", "intendedMethod": "preview-deploy"}`. The proof stands in for the person's answer, so ask nothing. Done when the answer's `keys` show both stored or unchanged.
+2. **Save the method** with impeccable_write to `preview`: `{"previewUrlPattern": "<the proof's pattern>", "intendedMethod": "preview-deploy"}`, with the app's `appKey` in a monorepo, since each app's project has a pattern of its own. The proof stands in for the person's answer, so ask nothing. Done when the answer's `keys` show both stored or unchanged.
 
 ### Reference
 

package/dist/playbook/cases/netlify-previews.md

@@ -2,10 +2,12 @@
 
 Netlify deploys previews of the pull requests: impeccable_netlify_previews lists a built preview of a pull request (`state` success or ready), with its address. Ask it only where the repository is set up for Netlify (`netlify.toml`, `.netlify/`, `netlify-cli` or an `@netlify/*` package), but its record decides, not the checkout. Netlify builds and serves every preview, so these steps replace the playbook's step 3, and the repository needs no workflow and no setup pull request.
 
+It applies as well **before the first pull request**: a site built from this repository has Deploy Previews on (impeccable_netlify_previews lists none, and its `pullRequestPreviews` says `enabled: true`; on a repository with several apps, read with the app's `appKey`), so its deploy previews start with the test drive's draft, the site's first. Then there is nothing to prove in step 1 yet: impeccable_ask with `netlify-setup` is refused, since there is no sign-in, site or connection to make. Run impeccable_netlify_connect (with the app's `appKey`) first: it changes nothing on that site, and checks that Netlify's GitHub app still reads the repository, asking the person once for its access on GitHub when it does not (a connection left undone ends as netlify-setup's "A step fails before the test drive is pushed" says). Then go on to pull-requests' step 4, which opens the test drive as a draft, waits for its deploy preview (impeccable_netlify_previews with `pull`), proves the test drive's page there, past Netlify's lock as preview-protection says, and then step 2 saves the method.
+
 ### Steps
 
 1. **Prove the newest preview** with impeccable_prove_preview: the address of the newest listed preview whose state is success or ready (or a page on it a visitor opens without signing in), and words the page shows that the checkout holds, such as the app's name in its title. Done when it answers `proven: true`; when an address no longer answers, try the next newest, three at most.
-2. **Save the method** with impeccable_write to `preview`: `{"previewUrlPattern": "<the proof's pattern>", "intendedMethod": "preview-deploy"}`. The proof stands in for the person's answer, so ask nothing. Done when the answer's `keys` show both stored or unchanged.
+2. **Save the method** with impeccable_write to `preview`: `{"previewUrlPattern": "<the proof's pattern>", "intendedMethod": "preview-deploy"}`, with the app's `appKey` in a monorepo, since each app's site has a pattern of its own. The proof stands in for the person's answer, so ask nothing. Done when the answer's `keys` show both stored or unchanged.
 
 ### Reference
 
@@ -14,7 +16,7 @@ Netlify deploys previews of the pull requests: impeccable_netlify_previews lists
 - **Behind a password or Netlify's login** (`gate: "netlify-protection"`): the site password, or Netlify's team login, stands in front of the previews. That is the preview-protection case's, whose steps come before step 2: on the person's yes the password is stored, or the site behind the team login made public.
 - **Deploy Previews off now** (`pullRequestPreviews` in the answer, `enabled: false`, with its `reason`): the site built previews before, and its settings build none now. The aim holds: ask once with impeccable_enable_previews (`host: "netlify"`), after step 1's proof and preview-protection's steps and before the test drive is pushed, so the person sees the lock's question and this one back to back, at most one each. `enabled`: go on. `skipped` or `refused`: push no test drive (pull-requests' "No preview, no test drive"), and say under "What was skipped, and why" that Deploy Previews are off for the site, with the `reason`, and name the `page`; `left` stays empty, since the person was asked in this run. `enabled: 'unknown'`: say so in one line under "What is not verified" and go on.
 - **Another app, or no answer from any of the three**: Netlify's previews do not show this app. Set the preview up as server-previews or static-site says instead, and say under "What is not verified" what the Netlify address answered.
-- **Nothing listed**: Netlify's previews are not on record. Where the checkout is set up for Netlify that is the netlify-setup case's; else set the preview up as server-previews or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
+- **Nothing listed**: Netlify's previews are not on record. With a site of this repository whose Deploy Previews are on, that is the first pull request still to come, above. Else, where the checkout is set up for Netlify, that is the netlify-setup case's; else set the preview up as server-previews or static-site says. An `error` means a read failed, so a preview may exist that is not listed: say so under "What is not verified".
 - **The pull requests**: no setup pull request; the test drive branches from the default branch. Netlify builds a deploy preview only for a pull request, so the test drive opens as a draft, its deploy preview is waited for and the test drive's page proven on it, and then the draft is marked ready: pull-requests' step 4. In place of pull-requests' step 3, build the test drive branch once with the build Netlify runs (`netlify.toml`'s `[build]` `command`, else the package's `build` script), so a page that does not build is never pushed.
 - The evidence is read only: link, deploy and change nothing on Netlify, beyond what impeccable_netlify_password and impeccable_enable_previews do on the person's yes. Netlify does not report its previews as GitHub deployments, so Impeccable finds them by their address pattern: save the pattern the proof answered, and no other.
 - The report names the address that answered with this app under "What we found", and the pattern saved under "What was configured, and by whom". The test drive's own preview, which Netlify builds after the run, goes under "What is not verified".

package/dist/playbook/cases/netlify-setup.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-The checkout is set up for Netlify: a `netlify.toml`, a `.netlify/` folder, or a package script that runs the `netlify` command (a Netlify package alone, `@netlify/*` or `netlify-cli`, says nothing of where the repository deploys); or the person picked Netlify in server-previews. And no pull request has a Netlify deploy preview: impeccable_netlify_previews lists none, and no `error` (an error says nothing either way). These steps replace the playbook's step 3. As in netlify-previews, the repository needs no workflow and no setup pull request.
+The checkout is set up for Netlify: a `netlify.toml`, a `.netlify/` folder, or a package script that runs the `netlify` command (a Netlify package alone, `@netlify/*` or `netlify-cli`, says nothing of where the repository deploys); or the person picked Netlify in server-previews. And no pull request has a Netlify deploy preview: impeccable_netlify_previews lists none, and no `error` (an error says nothing either way). And no site built from this repository has Deploy Previews on: with `pullRequestPreviews` `enabled: true` the site previews the first pull request by itself, which is netlify-previews' (before the first pull request), not this case's. These steps replace the playbook's step 3. As in netlify-previews, the repository needs no workflow and no setup pull request.
 
 ### Steps
 

package/dist/playbook/cases/preview-protection.md

@@ -4,7 +4,7 @@ impeccable_prove_preview answered a `gate`: the host's own lock stands in front
 
 ### Steps
 
-1. **Get the key in place** (the Preview method task): impeccable_vercel_bypass for Vercel's login, under the status line *"Getting past Vercel's login"*; impeccable_netlify_password for Netlify's lock, under *"Getting past Netlify's password"*; impeccable_cloudflare_access for Cloudflare Access, under *"Getting past Cloudflare Access"*. The tool does the rest: it finds the project's secret labelled "Impeccable reviews", or reads what Netlify's settings say stands in front of the site; shows one screen asking to create the secret, to store the site password Netlify gives back, to make a site behind Netlify's team login public (signing the Netlify CLI in, in the browser, on that yes where it is signed out; where Netlify refuses, it opens Netlify's Visitor access page and asks the person to try again once they changed it there), or to create a service token (then Cloudflare's sign-in in the browser where cf here lacks it, and it creates the token as the person and allows it in the Access application's policy; a screen takes a Cloudflare API token only where that sign-in cannot), or, when it cannot make or read one, one screen taking a pasted one (Vercel's with the page where it is made opened); opens the preview with it; and saves it for reviews. The key never comes back to you. Done when it answered `status`:
+1. **Get the key in place** (the Preview method task): impeccable_vercel_bypass for Vercel's login, under the status line *"Getting past Vercel's login"*; impeccable_netlify_password for Netlify's lock, under *"Getting past Netlify's password"*; impeccable_cloudflare_access for Cloudflare Access, under *"Getting past Cloudflare Access"*. The tool does the rest: it finds Vercel's project with or without a `.vercel/` link (no `vercel link` is needed, and the tool signs the Vercel CLI in where it is signed out), then the project's secret labelled "Impeccable reviews", or reads what Netlify's settings say stands in front of the site; shows one screen asking to create the secret, to store the site password Netlify gives back, to make a site behind Netlify's team login public (signing the Netlify CLI in, in the browser, on that yes where it is signed out; where Netlify refuses, it opens Netlify's Visitor access page and asks the person to try again once they changed it there), or to create a service token (then Cloudflare's sign-in in the browser where cf here lacks it, and it creates the token as the person and allows it in the Access application's policy; a screen takes a Cloudflare API token only where that sign-in cannot), or, when it cannot make or read one, one screen taking a pasted one (Vercel's with the page where it is made opened); opens the preview with it; and saves it for reviews. The key never comes back to you. Done when it answered `status`:
    - `saved`: the preview is proven (`proven: true`); `secret`, `password` or `token` says whether it was created, existing or typed, and `project`, `site` or `application` which one holds or allows it; Cloudflare's `pattern` is the address pattern to save with the method, and `apiToken` says a Cloudflare API token the person made created the token. Step 2.
    - `opened` (Netlify): the site is public now and the preview proven (`proven: true`); `madePublic` says whether the run or the person made it public, and `site` which site. Step 2.
    - `login` (Netlify): Netlify kept its team login in front through the retries; `reason` says so. Step 3.

package/dist/playbook/cases/pull-requests.md

@@ -14,7 +14,7 @@ Every run, once the settings are saved. The person merges the setup pull request
 
    A host's wait that ran out shows its own screen, which opens the host's page where its builds are turned on and waits again on the person's yes. Done when the test drive's page is proven on its preview, and a host's method saved; when nothing proved it, the reference below says how the run goes on.
 5. **Open the test drive and record it**: `gh pr create --repo <owner>/<repo> --head impeccable/test-drive --base <defaultBranch>` with the title "Impeccable test drive (safe to close)" and a body that starts "This pull request only shows Impeccable reviewing a change. Close it when you are done; nothing here needs to be merged." and then names the pages its diff holds, no more, and lists the flaws planted for the review to find, one line each (a Netlify draft opened this way in step 4, and was marked ready there). Record it right away with impeccable_test_pr, so the web page follows its review; it refuses a draft, and a branch that changes no existing page. Done when impeccable_test_pr answered "Recorded".
-6. **Check the test drive's preview once**, while it is the newest open pull request: impeccable_write to `latest-pull-check` with the app's `appKey`. Done when it answered; this early a 409 `no-preview-running` or a job still starting is expected, and the preview goes under "What is not verified".
+6. **Check the test drive's preview once**, while it is the newest open pull request: impeccable_write to `latest-pull-check` with the app's `appKey`. Done when it answered; this early a 409 `no-preview-running` or a job still starting is expected, and the preview goes under "What is not verified". The setup API checks a repository once every 30 seconds, whichever app asks: the tool waits that out itself and tries again, so make each app's call in turn, and never wait with a command. A 429 it still answered means that app's check did not run: say so under "What is not verified".
 7. **Open the setup pull request**, when there is a setup commit: `git push -u origin impeccable/setup`, then `gh pr create --repo <owner>/<repo> --head impeccable/setup --base <defaultBranch>` with the title "Set up Impeccable previews" and a body that starts "Merge this to keep Impeccable's previews working." and then says what it carries and why, one line each. Record it with impeccable_test_pr: the test drive again, and this one in `setup_pr`. Done when impeccable_test_pr answered "Recorded".
 
 ### Reference

package/dist/playbook/cases/workflow-as-person.md

@@ -10,7 +10,7 @@ The setup commit carries the workflow the state offers in the preview item's `fi
 2. **Sync the workflow** on the setup branch, once the settings are saved: impeccable_sync_workflow writes the state's file byte for byte and removes the retired file the state names. Done when it answers `ok: true`.
    - **`workflowStanding` is current**: nothing to write; leave the file as it is.
    - **absent, out-of-date, older-generation or retired**: the tool writes the fresh file.
-   - **unknown**: the current workflow could not be read. Leave the file as it is and sync nothing: the step is done, and the workflow goes under "What is not verified".
+   - **unknown**: Impeccable has not read the current workflow on GitHub yet (`workflowPending` true), or the read failed (`workflowError` says why). The tool waits on a pending read itself, reading the state again for up to five minutes, and writes the file once the read lands. When it still refuses, leave the file as it is and sync nothing: the step is done, and the workflow goes under "What is not verified" with the refusal's reason (a read still pending comes within the hour; a failed one names its cause).
    - **Refused for local edits**: nothing changed. Keep the person's edits, ask them through impeccable_ask to resolve the conflict, then sync again.
 3. **Commit** only the setup files: the workflow, the retired file's removal, a build fix. Then call impeccable_sync_workflow again. Done when `stagedMatches` and `committedMatches` are true, and `retiredRemoval.staged` and `retiredRemoval.committed` too when it names a retired file; null means nothing was compared.
 

package/dist/playbook.js

@@ -21,7 +21,7 @@ Set the repository up with whatever the host's CLI can do (Netlify's, Vercel's,
 
 1. **Read the state.** The setup API's instructions and state came with the first message, trimmed to this setup; impeccable_state reads the state again. Done when you know the preview item's status, \`file\` and \`workflowStanding\`, whether there is a \`signin\` item, whether there is an \`apps\` item (the monorepo case comes first then), and the titles in \`notPartOfThisSetup\`.
 2. **Read the repository**: manifests, the lockfile, scripts, framework config, CI workflows, env examples, the routes, the auth code and the seed. Done when you can name the package manager, the install, build and start commands, whether the pages need a server, how people sign in, and which pages a visitor opens without signing in.
-3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare Pages', as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says when the pages need a server, and as the static-site case says when they do not; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
+3. **Set up the preview** as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare Pages', as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says when the pages need a server, and as the static-site case says when they do not; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
 4. **Set up the sign-in** as the sign-in case says, when the app has its own. Done when that case's steps are done.
 5. **Run impeccable_checkup**, do what \`next\` says, and run it again. Done when \`status\` is complete, or all that is left is in \`forPerson\` or \`waitingFor\`.
 6. **Open the pull requests** as the pull-requests case says. What waits on the person holds neither back. Done when that case's steps are done.
@@ -61,7 +61,7 @@ Keep secrets out of files, settings and messages: the workflow names a repositor
 ## Voice
 The person reads your [STATUS] lines, task titles and questions, here and on the web page: calm, specific, one line each.
 - **[STATUS] lines**: start each step's message with one, a present-tense verb phrase of at most 70 characters saying what is happening (*"Running the build"*, *"Opening the test drive"*), or a short finding (*"Next.js 16, pnpm, Prisma on SQLite. No hosting found."*). impeccable_progress refuses a line that narrates like an assistant: write *"Reading the deploy workflows"*, not *"I'm trying to work out how the app deploys."* Detail belongs in the report.
-- **Tasks**: after each task, call impeccable_progress with the whole list. Titles are short noun phrases the person recognizes, the same every run where they fit: Read the repository, Apps (on a repository with several apps), Install and build, Preview method, Preview workflow, Sign-in, Test drive, Setup pull request. The list carries only what this run does: add a task when its case starts, never before, and leave off a task no case of this run takes, such as Preview workflow and Setup pull request where a host builds the previews (impeccable_progress refuses them once its previews are the method). Mark a task skipped only when the person skipped it, and failed only when it was tried and failed. One task is in progress at a time, and every status line is the detail of that task (*"Installing with pnpm"* while Install and build is in progress); impeccable_progress refuses a status line about another task.
+- **Tasks**: after each task, call impeccable_progress with the whole list. Titles are short noun phrases the person recognizes, the same every run where they fit: Read the repository, Apps (on a repository with several apps), Install and build, Preview method, Preview workflow, Sign-in, Test drive, Setup pull request. The list carries only what this run does: add a task when its case starts, never before, and leave off a task no case of this run takes, such as Preview workflow and Setup pull request where a host builds the previews (impeccable_progress refuses them once its previews are the method). Mark a task completed only once its result is saved, and a task completed stays so: Preview method once a method is saved, so where the test drive's preview is what proves the method (a host's previews with no pull request yet), it waits as pending while Test drive is in progress and is completed with the save. Mark a task skipped only when the person skipped it, and failed only when it was tried and failed. One task is in progress at a time, and every status line is the detail of that task (*"Installing with pnpm"* while Install and build is in progress); impeccable_progress refuses a status line about another task.
 - **Questions**: one sentence, at most one hint line, and a title that names the subject.
 
 ## The report

package/dist/tools.js

@@ -10,14 +10,14 @@ import { defineTool } from '@earendil-works/pi-coding-agent';
 import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { APPS_QUESTION, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, sentTo, startedIn, vercelBypassPaste } from './host-questions.js';
+import { APPS_QUESTION, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, sentTo, startedIn, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
 import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews } from './hosted.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
-import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
+import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelRepoProject, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
 import { redact } from './log.js';
@@ -108,14 +108,17 @@ export function resolveWrite(instructions, setupApi, repo, path) {
     }
     return { error: `No PUT or POST in the instructions' "endpoints" matches ${pathname}. Pick one from there.` };
 }
+/** How many times a preview check the setup API turned away for its rate (one a repository every 30 seconds) is tried again (#338). */
+const CHECK_RETRIES = 3;
 /** The last screen's words for a run on several apps: the picked apps not set up, by name, the line naming which are and which are not, and a line for each that is not. */
 export function appsSummary(apps) {
     const picked = apps.filter((a) => a.state !== 'unpicked');
     const ready = picked.filter((a) => a.state === 'ready');
     const rest = picked.filter((a) => a.state !== 'ready');
     const names = (list) => list.map((a) => a.name).join(', ');
-    const line = [...(ready.length ? [`Set up: ${names(ready)}.`] : []), ...(rest.length ? [`Not set up: ${names(rest)}.`] : [])].join(' ');
-    return { notReady: rest.map((a) => a.name), line, todo: rest.flatMap((a) => (a.left ? [a.left] : [])) };
+    const unchecked = ready.filter((a) => a.unchecked);
+    const line = [...(ready.length ? [`Set up: ${names(ready)}.`] : []), ...(unchecked.length ? [`Not checked: ${names(unchecked)}.`] : []), ...(rest.length ? [`Not set up: ${names(rest)}.`] : [])].join(' ');
+    return { notReady: rest.map((a) => a.name), line, todo: [...rest, ...unchecked].flatMap((a) => (a.left ? [a.left] : [])) };
 }
 /** A host's lock in front of a preview, as impeccable_prove_preview names it: how the person reads it, the tool that gets a key past it, and the step left where none was saved (preview-protection's step 3). */
 const LOCKS = {
@@ -133,13 +136,35 @@ function stageError(status, tasks) {
     const task = running[0];
     if (!task || fitsTask(status, task.title))
         return null;
-    return `Refused: the status "${status.trim()}" is about ${stagesOf(status).join(' and ')}, but the task in progress is "${task.title}". The status line is the detail of the task in progress: mark the task it is about in progress, or say what "${task.title}" is doing. ${again}`;
+    return `Refused: the status "${status.trim()}" is about ${stagesOf(status).join(' and ')}, but the task in progress is "${task.title}". The status line is the detail of the task in progress: mark the task it is about in progress, or say what "${task.title}" is doing. Mark "${task.title}" completed only once its result is saved, never to get past this. ${again}`;
 }
-/** The line under the last screen's heading ("You're all set up", or "Settings saved" without a test drive), about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. */
+/** The line under the last screen's heading, about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. Without a test drive, what stopped it, from what the run saved and met (#321). */
 export function resultLine(report) {
-    const lead = !report.testPr ? 'No test drive: the report says why, printed here when this screen closes.' : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+    const lead = !report.testPr ? `${noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     return report.setupPr || !report.hostedBy ? lead : `${lead} ${nothingToMerge(report.hostedBy)}`;
 }
+/** Why a run opened no test drive, as far as what it saved and met tells. */
+const noTestDrive = ({ methodSaved, lock }) => methodSaved ? 'A preview method is saved, but no test drive opened, so nothing shows Impeccable reviewing yet.'
+    : lock ? `The previews are behind ${LOCKS[lock].lock} and no key was saved, so no preview method was saved and no test drive opened.`
+        : 'No preview method was saved and no test drive opened, so Impeccable has nothing to review yet.';
+/**
+ * How the last screen reads and the command exits (#321): "You're all set up" and 0 only with a test drive and every
+ * picked app set up; otherwise a heading that says what is not, the host's step first where its lock stopped the run,
+ * and 1, so a script tells a run that set nothing up from one that set everything up.
+ */
+export function ending(report) {
+    const apps = appsSummary(report.apps ?? []);
+    // On a repository with several apps, each locked app's own line says it.
+    const step = !report.apps && !report.methodSaved && report.lock ? [LOCKS[report.lock].left] : [];
+    const todo = [...new Set([...step, ...apps.todo, ...report.left])];
+    if (report.testPr && !apps.notReady.length)
+        return { outcome: 'done', title: "You're all set up", todo, code: 0 };
+    const outcome = report.methodSaved ? 'partial' : 'stopped';
+    if (apps.notReady.length)
+        return { outcome, title: `${apps.notReady.join(' and ')} ${apps.notReady.length === 1 ? 'is' : 'are'} not set up`, todo, code: 1 };
+    const title = report.methodSaved ? 'No test drive opened' : `Not set up: ${report.lock ? `the previews are behind ${LOCKS[report.lock].lock}` : 'no preview method was saved'}`;
+    return { outcome, title, todo, code: 1 };
+}
 /** Said once, here and in the report, when the host builds the previews and the repository needed no change. */
 export const nothingToMerge = (host) => `Nothing to merge: ${host} hosts your previews, so the repository needed no change.`;
 const PROGRESS = {
@@ -1265,7 +1290,11 @@ export async function refreshWorkflowBase(owner, repo, defaultBranch, root, depe
         return fail(dependencies.signal?.aborted ? 'cancelled' : stage);
     }
 }
-export function createWorkflowSynchronizer() {
+/**
+ * `pending`: how long a state whose workflow standing is unknown because Impeccable has not read GitHub yet
+ * (`workflowPending`, pristine#2698) is read again before the sync gives up on it; `status` says so meanwhile.
+ */
+export function createWorkflowSynchronizer(opts = {}) {
     const CURRENT = '.github/workflows/impeccable-preview.yml';
     const RETIRED = '.github/workflows/pristine-preview.yml';
     const MAX_BYTES = 1_000_000;
@@ -1339,6 +1368,13 @@ export function createWorkflowSynchronizer() {
             || (file.index !== owned.baselineIndex && !ownIndex))
             refuse('The workflow changed since this run wrote it. Keep those edits and resolve them before syncing.');
     }
+    /** Whether the state's workflow standing is unknown only because Impeccable has not read GitHub yet. */
+    function pendingRead(state, repoName) {
+        const repos = obj(state)?.repos;
+        const matches = Array.isArray(repos) ? repos.map(obj).filter((repo) => repo?.name === repoName) : [];
+        const preview = matches.length === 1 ? obj(obj(matches[0]?.items)?.preview) : null;
+        return preview?.workflowStanding === 'unknown' && preview.workflowPending === true;
+    }
     function offeredPreview(state, repoName) {
         const repos = obj(state)?.repos;
         const matches = Array.isArray(repos) ? repos.map(obj).filter((repo) => repo?.name === repoName) : [];
@@ -1347,8 +1383,13 @@ export function createWorkflowSynchronizer() {
         if (!preview || preview.status === 'not-selected' || preview.status === 'skipped'
             || !standings.includes(standing))
             refuse('The selected repository has no verified workflow state. Nothing was changed.');
-        if (standing === 'unknown')
-            refuse('The current workflow could not be read. Its drift is unknown; nothing was changed.');
+        if (standing === 'unknown') {
+            // Which unknown it is (pristine#2698): a read not made yet, or one that failed, and why.
+            if (preview.workflowPending === true)
+                refuse("Impeccable has not read the current workflow on GitHub yet, and it was still not read after waiting: its reads wait while the GitHub account's hourly budget is spent, so it comes within the hour. Its drift is unknown; nothing was changed.");
+            const error = typeof preview.workflowError === 'string' ? preview.workflowError.replace(/\s+/g, ' ').trim().slice(0, 200) : '';
+            refuse(error ? `Impeccable could not read the current workflow on GitHub: ${error.replace(/\.$/, '')}. Its drift is unknown; nothing was changed.` : 'The current workflow could not be read. Its drift is unknown; nothing was changed.');
+        }
         return { preview, standing: standing };
     }
     function offeredBytes(preview) {
@@ -1378,7 +1419,15 @@ export function createWorkflowSynchronizer() {
                 const topLevel = (await git(root, ['rev-parse', '--show-toplevel'], signal)).toString('utf8').trim();
                 if (await realpath(topLevel) !== root)
                     refuse('Run workflow sync from the selected repository root. Nothing was changed.');
-                const { preview, standing } = offeredPreview(await readState(), repo);
+                // A workflow Impeccable has not read on GitHub yet is waited for, the state read again until the read lands (#330).
+                let state = await readState();
+                const wait = opts.pending ?? { totalMs: 300_000, everyMs: 30_000 };
+                for (const end = Date.now() + wait.totalMs; pendingRead(state, repo) && Date.now() < end;) {
+                    opts.status?.('Waiting for Impeccable to read the workflow on GitHub');
+                    await sleep(wait.everyMs, undefined, { signal });
+                    state = await readState();
+                }
+                const { preview, standing } = offeredPreview(state, repo);
                 const retired = preview.workflowRetiredPath;
                 if (retired != null && retired !== RETIRED && retired !== CURRENT)
                     refuse('State named an unsupported retired workflow path. Nothing was changed.');
@@ -1513,13 +1562,28 @@ export function createTools(ctx) {
     const publicProduction = new Set();
     const cloudflareListed = new Set();
     let hostedPreviewProven = false;
-    let provenPattern;
+    /**
+     * The address pattern each proof answered, by the app it was proven for, and the last one under '' for a repository
+     * of one app. A monorepo's apps may each be a project of their own on a host of their own, so one app's proof never
+     * replaces another's pattern (#332).
+     */
+    const provenPatterns = new Map();
+    const provePattern = (pattern, appKey) => {
+        if (!pattern)
+            return;
+        provenPatterns.set('', pattern);
+        if (appKey)
+            provenPatterns.set(appKey, pattern);
+    };
     /** The host whose preview a proof answered with this app, and the one whose previews impeccable_write then saved as the method. */
     let provenHost;
     let savedHost;
     /** Whether the repository's last saved method is a host's previews, and whether any write named an app: a monorepo's apps each go their own way, and only a run whose host builds them all opens no workflow and no setup pull request. */
     let hostMethod = false;
     let perApp = false;
+    /** Whether any preview write with a method was taken this run, and the host's lock the last gated proof met: the last screen names it when no preview ever opened (#321), and Preview method is completed only once a method is saved (#322). */
+    let methodSaved = false;
+    let lastLock;
     /**
      * A host's build, waited for on the screen as the task in progress, naming `host`, with the time so far: `read` again
      * every so often until `built` says the evidence is final, or the wait runs out. The status line names the host and what it builds.
@@ -1606,7 +1670,7 @@ export function createTools(ctx) {
     /** What impeccable_cloudflare_connect answered: asked once, so that answer stands. */
     let connectOutcome;
     // Keep ownership of files for this one run; never recreate it per call.
-    const workflowSynchronizer = ctx.workflowSynchronizer ?? createWorkflowSynchronizer();
+    const workflowSynchronizer = ctx.workflowSynchronizer ?? createWorkflowSynchronizer({ status: (line) => said(line) });
     const workflowRefusal = (reason) => ({ ok: false, reason, actions: [] });
     const workflowReady = (access) => access.authenticated === true
         && access.originMatches === true && access.defaultBranch !== null && !access.needsWorkflowScope
@@ -1686,12 +1750,16 @@ export function createTools(ctx) {
     /** On a repository with several apps: the app each production address a host tool answered is the live app of, read for that app's own project or site, and the apps whose host preview a proof opened. */
     const liveApps = new Map();
     const provenApps = new Set();
+    /** The apps whose preview check (connection-check or latest-pull-check) the setup API answered in this run ('' for the repository): a ready app missing here is named on the last screen (#338). */
+    const checkedApps = new Set();
     /** On a repository with several apps (#286): the method each app's preview write saved; the host's lock a proof of each app's preview met; and the apps whose lock was met with no key tool called for them since, which holds every other app's steps until it is. */
     const appMethods = new Map();
     const lockMet = new Map();
     const lockPending = new Map();
     /** The projects whose deployments Vercel made of this repository, as impeccable_hosted_previews read them, by the app read for ('' for the repository): a repository Vercel deploys already needs no Vercel setup, since its previews start with the first pull request (#286). */
     const vercelDeployed = new Map();
+    /** The Netlify sites built from this repository whose settings build Deploy Previews, as impeccable_netlify_previews read them, by the app read for ('' for the repository): their previews start with the first pull request, so there is no Netlify setup to ask about (#311). */
+    const netlifyPreviewing = new Map();
     /** Each Vercel project's production address, read from Vercel, by origin, and the project it was read from: the one live address the project's own bypass secret is sent to, since a secret is one project's, and the link file can name another project of this repository between the two reads. */
     const vercelProductions = new Map();
     /** The person's Vercel teams as the CLI listed them this run, once: a project's dashboard page is named by its own team, never the CLI's current scope or Vercel's picker, which open whatever project they like. */
@@ -1834,14 +1902,14 @@ export function createTools(ctx) {
         }, signal);
     }
     /** The connection of the linked Netlify site with this repository, through Netlify's site settings and its GitHub app, with the app's access asked when it cannot read the repository. */
-    async function netlifyConnect(pi, settings, signal, directory) {
-        // The site's settings change on the host: only once the person opened the Netlify setup, as the fence holds for the CLI.
-        if (!hostSetupAgreed(ctx.log, 'netlify'))
+    async function netlifyConnect(pi, settings, signal, directory, previewing = false) {
+        // The site's settings change on the host: only once the person opened the Netlify setup, as the fence holds for the CLI. A site built from this repository with Deploy Previews on needs no setup (#311): the connection changes nothing on it, and only checks that Netlify's GitHub app still reads the repository, asking for its access when it does not.
+        if (!hostSetupAgreed(ctx.log, 'netlify') && !previewing)
             return { connected: false, reason: 'The Netlify sign-in comes first: impeccable_ask with the id netlify-setup.' };
         const netlify = (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal });
         const gh = (ctx.hostRunner ?? commandRunner)('gh', pi.cwd, { signal });
         const clone = ctx.hostWait?.clone;
-        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, linked: linkedByRun(ctx.log), settings, signal, ...(clone ? { wait: clone } : {}), ...(directory !== undefined ? { directory } : {}) });
+        const result = await connectNetlifySite(ctx.owner, ctx.repo, pi.cwd, { netlify, gh, linked: linkedByRun(ctx.log), settings, signal, ...(clone ? { wait: clone } : {}), ...(directory !== undefined ? { directory } : {}), ...(previewing ? { ownSite: true } : {}) });
         netlifySite = result.site?.name ?? netlifySite;
         if (result.pullRequestPreviews)
             previewFacts.set('netlify', result.pullRequestPreviews);
@@ -2105,8 +2173,12 @@ export function createTools(ctx) {
             const proven = provenApps.has(key);
             if (!pickedApps?.has(key))
                 return { key, name, folder, state: 'unpicked' };
-            if (method !== undefined && (method !== 'preview-deploy' || proven))
-                return { key, name, folder, state: 'ready' };
+            if (method !== undefined && (method !== 'preview-deploy' || proven)) {
+                // With a test drive open, each app's preview is checked once (pull-requests' step 6): one the setup API never answered is named (#338).
+                return ctx.sync.payload.test_pr && !checkedApps.has(key)
+                    ? { key, name, folder, state: 'ready', unchecked: true, left: `${name}: Impeccable's check of its preview did not run here; the test drive's review shows whether it reaches it.` }
+                    : { key, name, folder, state: 'ready' };
+            }
             if (gate && !proven)
                 return { key, name, folder, state: 'locked', left: `${name}: its previews are behind ${LOCKS[gate].lock}, and no key was saved. ${LOCKS[gate].left}.` };
             return { key, name, folder, state: 'unset', left: `${name}: no preview method was saved; the report says why.` };
@@ -2117,7 +2189,7 @@ export function createTools(ctx) {
         const where = `${a.name} (${a.folder || '/'})`;
         const lock = lockMet.has(a.key) ? LOCKS[lockMet.get(a.key)].lock : undefined;
         if (a.state === 'ready')
-            return `- ${where}: set up. Method: ${appMethods.get(a.key)}${provenApps.has(a.key) ? `, its preview proven${lock ? ` past ${lock}` : ''}` : ''}.`;
+            return `- ${where}: set up. Method: ${appMethods.get(a.key)}${provenApps.has(a.key) ? `, its preview proven${lock ? ` past ${lock}` : ''}` : ''}.${a.unchecked ? " Impeccable's check of its preview did not run." : ''}`;
         if (a.state === 'locked')
             return `- ${where}: not set up. Its previews are behind ${lock}, and no key was saved for it.`;
         if (a.state === 'unset')
@@ -2265,8 +2337,8 @@ export function createTools(ctx) {
                 return `Refused: prove a preview address with impeccable_prove_preview first: the host's previews become the method only once one answered with this app${appsRepo ? `, read for it with its appKey (${String(object(p.body)?.appKey)})` : ''}. Nothing was saved.`;
             }
             const saved = object(p.body);
-            if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPattern)) {
-                return 'Refused: the only address pattern saved is the one impeccable_prove_preview answered for a Netlify or Cloudflare Pages preview. Nothing was saved.';
+            if (target.url.endsWith('/preview') && saved && 'previewUrlPattern' in saved && (typeof saved.previewUrlPattern !== 'string' || saved.previewUrlPattern.trim() !== provenPatterns.get(appsRepo ? String(saved.appKey) : ''))) {
+                return `Refused: the only address pattern saved is the one impeccable_prove_preview answered for ${appsRepo ? `this app's (${String(saved.appKey)})` : 'a'} Netlify or Cloudflare Pages preview. Nothing was saved.`;
             }
             // The before is the live app's address, and only one a proof opened with this app: an address no key opens is not set, and one the person saved is never cleared from here.
             if (target.url.endsWith('/preview') && saved && 'beforeUrl' in saved && (typeof saved.beforeUrl !== 'string' || !URL.canParse(saved.beforeUrl) || !provenLive.has(new URL(saved.beforeUrl).origin))) {
@@ -2294,7 +2366,20 @@ export function createTools(ctx) {
                 body = { ...object(body), accounts: list.map((account) => ({ ...object(account), password: typed.get(String(object(account)?.password)) })) };
             }
             const checkedHead = previews.active && target.url.endsWith('/latest-pull-check') ? await observe(signal) : undefined;
-            const response = await call(pi, target.url, { method: target.method, body });
+            let response = await call(pi, target.url, { method: target.method, body });
+            // The setup API checks a repository's preview once per 30 seconds, whichever app asks: the next app's check waits its turn here, a bounded wait in place of the sleep the fence refuses (#338).
+            const check = /\/(connection-check|latest-pull-check)$/.test(target.url);
+            for (let tries = 0; check && response.status === 429 && tries < CHECK_RETRIES && !signal?.aborted; tries++) {
+                const seconds = Math.min(Math.max(Math.ceil(response.retryAfter ?? 30), 1), 60);
+                said(`Waiting ${seconds} s for the next preview check`);
+                await (ctx.checkWait ?? ((ms, stop) => sleep(ms, undefined, { signal: stop })))(seconds * 1000, signal).catch(() => undefined);
+                if (signal?.aborted)
+                    break;
+                response = await call(pi, target.url, { method: target.method, body });
+            }
+            // A check that answered, a preview not running yet included, ran for its app; one still turned away did not.
+            if (check && (response.ok || response.status === 409))
+                checkedApps.add(typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '');
             if (target.url.endsWith('/apps') && response.ok && object(p.body)?.action === 'confirm')
                 confirmedApps = true;
             if (target.url.endsWith('/preview') && response.ok) {
@@ -2311,6 +2396,8 @@ export function createTools(ctx) {
                     appMethods.set(String(saved.appKey), saved.intendedMethod);
                 if (saved && 'intendedMethod' in saved)
                     hostMethod = saved.intendedMethod === 'preview-deploy';
+                if (typeof saved?.intendedMethod === 'string')
+                    methodSaved = true;
                 for (const key of Object.keys(object(p.body) ?? {}))
                     if (PREVIEW_FIELDS.has(key) && keys?.[key] === 'stored')
                         previews.changes.add(key);
@@ -2343,7 +2430,12 @@ export function createTools(ctx) {
             const deployed = appsRepo ? pickedApps !== undefined && pickedApps.size > 0 && [...pickedApps].every((key) => vercelDeployed.has(key)) : vercelDeployed.has('');
             if (asked.id === 'vercel-setup' && deployed && !hostSignIns.has('vercel')) {
                 const projects = [...vercelDeployed.values()].filter(Boolean);
-                return `Refused: Vercel deploys this repository already${projects.length ? ` (${projects.join(', ')})` : ''}: it made deployments of it, production included, so its previews start with the first pull request, and there is no Vercel sign-in, project or connection to make. Go on as vercel-previews says: build and push the test drive as pull-requests' step 4 says, wait for Vercel's deployment of the pushed branch with impeccable_hosted_previews and branch, prove the test drive's page there (past Vercel's login as preview-protection says), and save the method.`;
+                return `Refused: Vercel deploys this repository already${projects.length ? ` (${projects.join(', ')})` : ''}: it made deployments of it, production included, so its previews start with the first pull request, and there is no Vercel sign-in, project or connection to make. Go on as vercel-previews says: build and push the test drive as pull-requests' step 4 says, wait for Vercel's deployment of the pushed branch with impeccable_hosted_previews and branch, prove the test drive's page there (past Vercel's login as preview-protection says: impeccable_vercel_bypass finds the project with no vercel link, and signs the Vercel CLI in itself where it is signed out), and save the method.`;
+            }
+            // The Netlify setup is for a repository no Netlify site previews yet: a site built from it with Deploy Previews on (every app's, on a repository with several) builds the first pull request's deploy preview by itself (#311).
+            const previewing = appsRepo ? pickedApps !== undefined && pickedApps.size > 0 && [...pickedApps].every((key) => netlifyPreviewing.has(key)) : netlifyPreviewing.has('');
+            if (asked.id === 'netlify-setup' && previewing && !hostSignIns.has('netlify')) {
+                return `Refused: Netlify builds this repository already (${[...new Set(netlifyPreviewing.values())].join(', ')}), with Deploy Previews on, so its deploy previews start with the first pull request, and there is no Netlify sign-in, site or connection to make. Go on as netlify-previews says before the first pull request: impeccable_netlify_connect${appsRepo ? ' with the app\'s appKey' : ''} first, which changes nothing on the site and checks that Netlify's GitHub app still reads the repository (asking the person for its access when it does not), then build the test drive once with the build Netlify runs, push it and open it as a draft as pull-requests' step 4 says, wait for its deploy preview with impeccable_netlify_previews and pull, prove the test drive's page there, save the method, and mark the draft ready.`;
             }
             if (host?.[2] === 'setup')
                 return JSON.stringify(await hostSignIn(host[1], pi, signal));
@@ -2387,13 +2479,20 @@ export function createTools(ctx) {
             typed.set(reference, (q.kind === 'account' ? answer.password : answer.value) ?? '');
             return JSON.stringify(q.kind === 'account' ? { username: answer.username ?? '', password: reference } : { value: reference });
         }),
-        tool('impeccable_progress', 'Progress', 'Show the person where things stand, here and on the web page: the [STATUS] line and the whole task list. It refuses, saving nothing, a status line out of the playbook\'s voice, more than one task in progress, a status line about another task than the one in progress, and a Preview workflow or Setup pull request task once a host\'s previews are the method.', PROGRESS, async (p) => {
+        tool('impeccable_progress', 'Progress', 'Show the person where things stand, here and on the web page: the [STATUS] line and the whole task list. It refuses, saving nothing, a status line out of the playbook\'s voice, more than one task in progress, a status line about another task than the one in progress, a task once completed that is no longer, Preview method completed before a method is saved, and a Preview workflow or Setup pull request task once a host\'s previews are the method.', PROGRESS, async (p) => {
             const status = p.status.trim();
             const tasks = withAttempts(p.tasks);
             const own = p.tasks.filter((t) => !t.id.startsWith('preview-attempt-'));
             const voice = statusVoiceError(status) ?? stageError(status, own);
             if (voice)
                 return voice;
+            // The list only moves forward (#322): a task done stays done, and Preview method is done only once a method is saved.
+            const undone = ctx.sync.payload.tasks.filter((t) => t.status === 'completed' && !t.id.startsWith('preview-attempt-') && own.find((n) => n.id === t.id)?.status !== 'completed');
+            if (undone.length)
+                return `Refused: ${undone.map((t) => `"${t.title}"`).join(' and ')} ${undone.length === 1 ? 'shows' : 'show'} as done, and a task done stays done and on the list, so the count never goes down. Keep ${undone.length === 1 ? 'it' : 'them'} completed, and mark what failed since on the task it belongs to. Nothing was saved: call impeccable_progress again.`;
+            const early = methodSaved ? undefined : own.find((t) => t.status === 'completed' && stagesOf(t.title).includes('Preview method'));
+            if (early)
+                return `Refused: "${early.title}" is done only once a preview method is saved (impeccable_write to preview with its intendedMethod, taken by the setup API; one an earlier run saved is written again as it is), and none is yet. Keep it in progress while its work goes on, pending while another task is, and failed when the run saves none. Nothing was saved: call impeccable_progress again.`;
             const unneeded = hostMethod && !perApp && !ctx.sync.payload.setup_pr ? own.filter((t) => /\bsetup pull request\b/i.test(t.title) || stagesOf(t.title).includes('Preview workflow')) : [];
             if (unneeded.length)
                 return `Refused: ${savedHost ?? 'the host'} builds this run's previews, so the repository needs no workflow and no setup pull request. Leave ${unneeded.map((t) => `"${t.title}"`).join(' and ')} off the list: a task the run never does is not shown, not even as skipped. Nothing was saved: call impeccable_progress again.`;
@@ -2511,7 +2610,7 @@ export function createTools(ctx) {
                 return `Error: the report was refused (${res.status}: ${res.error}). Fix what it says and call impeccable_report again.`;
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
-            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -2652,6 +2751,13 @@ export function createTools(ctx) {
             }
             if (evidence.pullRequestPreviews)
                 previewFacts.set('netlify', evidence.pullRequestPreviews);
+            // A site built from this repository (this app's, read by its folder) with Deploy Previews on previews the next pull request, listed or not (#311).
+            if (pull === undefined) {
+                if (!evidence.unmatched && evidence.pullRequestPreviews?.enabled === true)
+                    netlifyPreviewing.set(appKey ?? '', evidence.pullRequestPreviews.project);
+                else
+                    netlifyPreviewing.delete(appKey ?? '');
+            }
             noteProduction(evidence.production, 'netlify', liveSite(evidence), appKey);
             const site = evidence.unmatched ? undefined : liveSite(evidence);
             if (site)
@@ -2756,8 +2862,10 @@ export function createTools(ctx) {
                 lockPending.set(app.appKey, proof.gate);
                 provenApps.delete(app.appKey);
             }
-            if (proof.proven && proof.pattern)
-                provenPattern = proof.pattern;
+            if (proof.gate && Object.hasOwn(LOCKS, proof.gate))
+                lastLock = proof.gate;
+            if (proof.proven)
+                provePattern(proof.pattern, app?.appKey);
             if (proof.gate === 'vercel-protection' || proof.gate === 'netlify-protection')
                 gated = { url, expect: p.expect, gate: proof.gate, ...(proof.teamLogin ? { teamLogin: proof.teamLogin } : {}), ...(app ? { app } : {}) };
             if (proof.gate === 'cloudflare-access' && cloudflareListed.has(new URL(url).origin))
@@ -2781,7 +2889,7 @@ export function createTools(ctx) {
             const directory = appKey !== undefined ? await appFolder(pi, appKey) : undefined;
             if (appKey !== undefined && directory === undefined)
                 return JSON.stringify({ appKey, connected: false, reason: `The setup state names no folder for the app ${appKey}.` });
-            const result = await netlifyConnect(pi, { command, publish }, signal, directory);
+            const result = await netlifyConnect(pi, { command, publish }, signal, directory, netlifyPreviewing.has(appKey ?? ''));
             if (result.how && result.site)
                 noteApp(appKey, { host_project: result.site.name });
             return JSON.stringify(appKey !== undefined ? { appKey, ...result } : result);
@@ -2901,7 +3009,7 @@ export function createTools(ctx) {
             noteProduction(answer.productionUrl, 'vercel', undefined, connectedApp);
             return JSON.stringify(answer);
         }),
-        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts) and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_vercel_bypass', "Vercel's login", 'Get past the Vercel login that impeccable_prove_preview met (gate "vercel-protection") in front of a preview Vercel made, the way Vercel documents for tools: a bypass secret of the Vercel project, sent to it in a header. It does the rest with the Vercel CLI signed in as the person: it reads the project this folder is linked to (.vercel/project.json; once this run\'s own vercel link wrote that file, only what it wrote counts), or, with no such file, the one Vercel lists as connected to this repository, so no vercel link is needed (where the CLI is signed out, the consent screen comes first and its yes signs it in, in the browser), and refuses unless that project is connected to this repository, shows Deployment Protection in its settings (a page that looks like Vercel\'s login is the deployment\'s own to serve, so with none set the sign-in is the app\'s own: prove a page a visitor opens without signing in) and made the preview\'s deployment (among its latest, or read by its address), since the secret goes only to a preview the linked project serves; then it finds the project\'s secret labelled "Impeccable reviews", or shows one screen asking to create one, or, when the CLI cannot, one screen taking a pasted one; opens the preview with it; and saves it for reviews. Answers {"status": …}: saved (the preview is proven, so the method may be saved; secret says whether it was created, existing or typed, and project which Vercel project holds it), skipped (the person skipped the screen; reason says what came before), refused (no secret opened the preview; reason says what the address answered) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No secret ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (gated?.gate !== 'vercel-protection' || !vercelMade.has(new URL(gated.url).origin))
                 return 'Refused: this is for a preview that Vercel made, listed by impeccable_hosted_previews, which impeccable_prove_preview answered with gate "vercel-protection". Prove one first.';
             const at = gated;
@@ -2914,26 +3022,81 @@ export function createTools(ctx) {
             if (asked?.status === 'skipped')
                 return JSON.stringify(asked);
             // Whose preview this is: a deployment status anyone with push access records gives any address, and the page there says nothing, so the project has to have
-            // made the deployment before any secret of it goes there. That project is the app's own on a repository with several apps (#281), else the one the link file names.
-            const link = at.app?.link ?? (await readLink(pi.cwd));
-            if (!link)
-                return `Refused: nothing was sent to ${at.url}. This folder is linked to no Vercel project (.vercel/project.json), and a bypass secret goes only to a preview the linked project serves.`;
+            // made the deployment before any secret of it goes there. That project is the app's own on a repository with several apps (#281), else the one the link file names,
+            // else the one Vercel lists as connected to this repository (#310).
+            const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
+            const fileLink = at.app ? null : await readLink(pi.cwd);
+            /** The consent screen's yes, given before Vercel's sign-in, stands for the secret: it is not asked again. */
+            let consented = false;
+            /**
+             * Signed out, the CLI reads nothing, linked or not: the consent screen comes first, and its yes signs the CLI in, in the browser, rather than leaving the
+             * run at a dead end. Null once it is signed in; else what the tool answers.
+             */
+            const signIn = async () => {
+                /** A skip, of the consent or of the sign-in, stands for the run: it is asked once, as the consent alone is. */
+                const skip = (reason) => {
+                    const outcome = { status: 'skipped', reason };
+                    bypassOutcomes.set(store, outcome);
+                    return JSON.stringify(outcome);
+                };
+                if ((await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped)
+                    return skip('The person skipped creating a bypass secret.');
+                consented = true;
+                const agreed = hostSetupAgreed(ctx.log, 'vercel');
+                const had = hostSignIns.get('vercel');
+                hostSignIns.set('vercel', 'confirmed');
+                const signedIn = await hostSignIn('vercel', pi, signal);
+                // The sign-in was for the secret alone: the Vercel setup stays as it was, so the fence neither opens the CLI's setup commands nor holds pushes for a connection nobody makes.
+                if (!agreed) {
+                    endHostSetup(ctx.log, 'vercel');
+                    teamChoices.delete('vercel');
+                }
+                if (had)
+                    hostSignIns.set('vercel', had);
+                else
+                    hostSignIns.delete('vercel');
+                if (signedIn.signedIn === true)
+                    return null;
+                return skip(typeof signedIn.reason === 'string' ? signedIn.reason : "The person skipped Vercel's sign-in, which the bypass secret needs.");
+            };
+            // A folder Vercel deploys from GitHub has no link file unless vercel link ran in it (the file is gitignored), so the project is found on Vercel by this repository,
+            // with the CLI signed in as the person.
+            let found;
+            if (!at.app && !fileLink) {
+                const cli = (await vercelStatus(vercel)).cli;
+                const stop = cli === 'signed-out' ? await signIn() : null;
+                if (stop)
+                    return stop;
+                const listed = cli === 'missing' ? { reason: 'The Vercel CLI is not installed here.' } : await vercelRepoProject(vercel, repository);
+                if ('reason' in listed)
+                    return `Refused: nothing was sent to ${at.url}. This folder is linked to no Vercel project (.vercel/project.json), and Vercel named none for this repository: ${listed.reason} A bypass secret goes only to a preview the repository's project serves.`;
+                found = listed;
+            }
+            const link = at.app?.link ?? fileLink ?? found.link;
             // Once this run's own vercel link wrote the file, only that link counts, as impeccable_vercel_connect holds it: rewritten since, it would name another project of the person's. A project the person linked before the run has no such record, and the reads below vouch for it.
-            // An app's project is read from Vercel's list of this repository's projects, never from the file.
+            // An app's project, and one found with no link file, are read from Vercel's list of this repository's projects, never from the file.
             const links = linkedByRun(ctx.log);
             const own = links.get(link.projectId);
-            if (!at.app && [...links.values()].some((l) => l.orgId !== undefined) && own?.orgId !== link.orgId)
+            if (fileLink && [...links.values()].some((l) => l.orgId !== undefined) && own?.orgId !== link.orgId)
                 return `Refused: nothing was sent to ${at.url}. This folder's .vercel/project.json is not what this run's vercel link wrote (another project, or another team), and a bypass secret goes only to a preview the linked project serves.`;
-            const vercel = (ctx.hostRunner ?? commandRunner)('vercel', pi.cwd, { signal });
-            const project = await readOwnProject(vercel, link, repository);
-            const which = at.app ? 'The Vercel project that builds this app' : 'The Vercel project this folder is linked to';
+            let project = await readOwnProject(vercel, link, repository);
+            // A linked project, or an app's, read nothing because the CLI is signed out: the same sign-in, then the read again.
+            if ('reason' in project && !consented && (await vercelStatus(vercel)).cli === 'signed-out') {
+                const stop = await signIn();
+                if (stop)
+                    return stop;
+                project = await readOwnProject(vercel, link, repository);
+            }
+            const which = at.app ? 'The Vercel project that builds this app' : found ? 'The Vercel project connected to this repository' : 'The Vercel project this folder is linked to';
             if ('reason' in project)
                 return `Refused: nothing was sent to ${at.url}. ${project.reason} A bypass secret goes only to a preview the linked project serves.`;
             // The page at the address is the deployment's to word, whatever host it is on, so the lock is told from the project's settings, read as the person: with none, no login of Vercel's stood in front.
+            if (!project.previewsProtected && lastLock === 'vercel-protection')
+                lastLock = undefined;
             if (!project.previewsProtected)
                 return `Refused: nothing was sent to ${at.url}. Vercel's settings show no Deployment Protection on the project${project.name ? ` (${project.name})` : ''}, so what the address answered is the deployment's own page and the sign-in is the app's own: prove a page a visitor opens without signing in. A bypass secret goes only to a preview the linked project serves.`;
             if (!(await projectMadeDeployment(vercel, link, project, host)))
-                return `Refused: nothing was sent to ${at.url}. ${which}${project.name ? ` (${project.name})` : ''} did not make the deployment at ${host}, and a bypass secret goes only to a preview ${at.app ? 'that project' : 'the linked project'} serves.`;
+                return `Refused: nothing was sent to ${at.url}. ${which}${project.name ? ` (${project.name})` : ''} did not make the deployment at ${host}, and a bypass secret goes only to a preview ${at.app || found ? 'that project' : 'the linked project'} serves.`;
             /** The secret opened this address and is saved: proofs of it send that secret, and the app's preview is proven. */
             const opened = () => {
                 bypassOrigins.set(origin, store);
@@ -2953,9 +3116,9 @@ export function createTools(ctx) {
             const { value, ...told } = await passVercelLogin({
                 run: vercel,
                 link: async () => link,
-                // A project the folder is not linked to is named on the CLI's reads and makes; the reads are held to its id all the same.
-                ...(at.app?.name ? { project: at.app.name } : {}),
-                consent: async () => !(await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped,
+                // A project the folder is not linked to is named on the CLI's reads and makes, in its own team; the reads are held to its id all the same.
+                ...(at.app?.name ? { project: at.app.name } : found ? { project: found.name, ...(found.scope ? { scope: found.scope } : {}) } : {}),
+                consent: async () => consented || !(await ask(sentTo(HOST_SCREENS['vercel-bypass'], at.url))).skipped,
                 paste: async (stopped) => {
                     // This project's own settings page, under its own team (the one its ids name, as the CLI lists the person's teams): never another project of the account's.
                     (ctx.openBrowser ?? openBrowser)(await vercelPageFor(vercel, link, 'settings/deployment-protection', project.name));
@@ -3010,7 +3173,7 @@ export function createTools(ctx) {
             if (stands?.status === 'opened') {
                 // A site made public stands while the address opens with nothing sent; behind the login again, it is read again.
                 if ((await prove(undefined)).proven) {
-                    provenPattern = pattern ?? provenPattern;
+                    provePattern(pattern, at.app?.appKey);
                     if (at.app)
                         proveApp(at.app.appKey, at.url);
                     return JSON.stringify(stands);
@@ -3021,7 +3184,7 @@ export function createTools(ctx) {
                 return JSON.stringify(stands);
             // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
             if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
-                provenPattern = pattern ?? provenPattern;
+                provePattern(pattern, at.app?.appKey);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
                 return JSON.stringify(passwordSaved);
@@ -3064,6 +3227,9 @@ export function createTools(ctx) {
                 remember: noteSensitiveAnswer,
             });
             const passwordOutcome = { ...told, ...(told.status === 'saved' || told.status === 'opened' ? { proven: true } : {}) };
+            // Netlify's settings show no lock on the site (none, or none left once it was made public): the last screen blames none (#321).
+            if (told.protection === 'none' && lastLock === 'netlify-protection')
+                lastLock = undefined;
             if (told.status === 'skipped' || told.status === 'login' || told.status === 'opened')
                 passwordStands.set(site, passwordOutcome);
             if (told.status === 'opened') {
@@ -3072,7 +3238,7 @@ export function createTools(ctx) {
                 provenHost = 'Netlify';
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
-                provenPattern = pattern ?? provenPattern;
+                provePattern(pattern, at.app?.appKey);
             }
             if (value) {
                 // What is in hand follows the store: a new password is the one saved now, and the site the last one opened no longer stands.
@@ -3083,7 +3249,7 @@ export function createTools(ctx) {
                 provenHost = 'Netlify';
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
-                provenPattern = pattern ?? provenPattern;
+                provePattern(pattern, at.app?.appKey);
                 passwordSaved = passwordOutcome;
             }
             else if (told.status === 'save-failed' && stored) {
@@ -3094,7 +3260,7 @@ export function createTools(ctx) {
             }
             return JSON.stringify(passwordOutcome);
         }),
-        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview; one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_cloudflare_access', 'Cloudflare Access', 'Get past the Cloudflare Access login that impeccable_prove_preview met (gate "cloudflare-access") in front of a Cloudflare Pages preview, the way Cloudflare documents for tools: a service token, sent in two headers, that a Service Auth policy of the Access application allows. It does the rest as the person: one screen asking to create the token, Cloudflare\'s sign-in in the browser where cf, Cloudflare\'s CLI, is not signed in here with Access (with a retry), then the token named "Impeccable reviews" created through cf and allowed in the policy of the application in front of the preview (an application whose policies are its own gets one screen asking to make them reusable first, and on its skip the paste screen says how to make the token by hand); one screen taking a Cloudflare API token only where that sign-in cannot create it; on a skip, or where that cannot be done, one screen taking a pasted client id and secret, only once an Access application in the person\'s accounts was read to cover the preview (none read: refused, with the reason, since the token goes to no other address). It opens the preview with the token and saves it for reviews. Answers {"status": …}: saved (the preview is proven, and pattern is the address pattern to save with the method; token says whether it was created or typed, application which Access application allows it, expires when a created one runs out, apiToken true when the person\'s Cloudflare API token created it), skipped (nothing was saved; reason says what stopped it), refused (no Access application of the person\'s covers the preview, or the typed token did not open it; reason says which) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No token ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             if (!accessGated)
                 return 'Refused: this is for a Cloudflare Pages preview impeccable_cloudflare_previews listed, which impeccable_prove_preview answered with gate "cloudflare-access". Prove one first.';
             const at = accessGated;
@@ -3141,8 +3307,9 @@ export function createTools(ctx) {
                         const typed = await ask(HOST_SCREENS['cloudflare-access-api']);
                         return typed.skipped ? undefined : typed.value;
                     },
-                    paste: async () => {
-                        const typed = await ask(sentTo(HOST_SCREENS['cloudflare-access-key'], at.url));
+                    reusable: async (application) => !(await ask(cloudflareAccessReusable(application))).skipped,
+                    paste: async (manual) => {
+                        const typed = await ask(sentTo(cloudflareAccessPaste(manual), at.url));
                         return typed.skipped ? undefined : { id: typed.username, secret: typed.password };
                     },
                     prove,
@@ -3170,8 +3337,7 @@ export function createTools(ctx) {
                 provenHost = 'Cloudflare Pages';
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
-                if (pattern)
-                    provenPattern = pattern;
+                provePattern(pattern, at.app?.appKey);
             }
             return JSON.stringify(accessOutcome);
         }),

package/dist/vercel-bypass.js

@@ -18,10 +18,12 @@ export const SECRET_NOTE = 'Impeccable reviews';
 export const isBypassSecret = (value) => typeof value === 'string' && /^[A-Za-z0-9]{32}$/.test(value);
 /** The CLI's read of the linked project's protection, or with `name` that project's: `protectionBypass` maps each secret to its note and creation time. */
 export const READ = ['project', 'protection', '--format', 'json', '--non-interactive'];
-const readArgs = (name) => (name ? ['project', 'protection', name, ...READ.slice(2)] : READ);
+/** A team other than the CLI's current scope, which its own commands name with `--scope`. */
+const inScope = (args, scope) => (scope ? [...args, '--scope', scope] : args);
+const readArgs = (name, scope) => inScope(name ? ['project', 'protection', name, ...READ.slice(2)] : READ, scope);
 /** The CLI's own way to make a secret, which carries no label, for a CLI without `api`; with `name`, on that project. */
 export const MAKE_CLI = ['project', 'protection', 'enable', '--protection-bypass', '--non-interactive'];
-const makeArgs = (name) => (name ? ['project', 'protection', 'enable', name, ...MAKE_CLI.slice(3)] : MAKE_CLI);
+const makeArgs = (name, scope) => inScope(name ? ['project', 'protection', 'enable', name, ...MAKE_CLI.slice(3)] : MAKE_CLI, scope);
 /** `vercel api` (beta) for PATCH /v1/projects/{id}/protection-bypass with `generate.note`, so the secret carries the label; a team's project needs its team on the request. */
 export const makeApi = (link) => [
     'api',
@@ -47,10 +49,10 @@ export async function readLink(cwd) {
     }
 }
 /** The linked project's name and automation secrets; null when the CLI could not say: signed out, not linked, or the role does not allow it; or when what it read is not the project `link` names. */
-async function readProject(run, link, name) {
+async function readProject(run, link, name, scope) {
     let settings;
     try {
-        const printed = await run(readArgs(name));
+        const printed = await run(readArgs(name, scope));
         settings = record(JSON.parse(printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1)));
     }
     catch {
@@ -99,7 +101,7 @@ const REFUSED = /forbidden|not authorized|not_authorized|permission|\b403\b/i;
  * command, which the same role check stops. Once made, which kind the project now holds (labelled through `api`, or the
  * CLI's own without a label); else why not, in Vercel's words where it gave any, the role named only where Vercel refused.
  */
-async function make(run, link, name) {
+async function make(run, link, name, scope) {
     const said = [];
     if (link) {
         try {
@@ -112,7 +114,7 @@ async function make(run, link, name) {
         }
     }
     try {
-        await run(makeArgs(name));
+        await run(makeArgs(name, scope));
         return { made: 'unlabelled' };
     }
     catch (err) {
@@ -143,7 +145,7 @@ async function admitted(secret, deps) {
  */
 export async function passVercelLogin(deps) {
     const link = await deps.link();
-    const project = await readProject(deps.run, link, deps.project);
+    const project = await readProject(deps.run, link, deps.project, deps.scope);
     const from = project?.name ? { project: project.name } : {};
     const wait = deps.wait ?? { totalMs: 30_000, everyMs: 3_000 };
     const finish = async (secret, how) => {
@@ -174,7 +176,7 @@ export async function passVercelLogin(deps) {
             if (!(await deps.consent()))
                 return { status: 'skipped', reason: 'The person skipped creating a bypass secret.', ...from };
             const before = new Set(project.secrets.map((s) => s.value));
-            const made = await make(deps.run, link, deps.project);
+            const made = await make(deps.run, link, deps.project, deps.scope);
             if ('reason' in made)
                 stopped = made.reason;
             else {
@@ -183,7 +185,7 @@ export async function passVercelLogin(deps) {
                 // Read back by its label, again for a few seconds while the settings do not list it yet.
                 let ours;
                 for (const end = Date.now() + wait.totalMs;;) {
-                    ours = pick((await readProject(deps.run, link, deps.project))?.secrets ?? [], before);
+                    ours = pick((await readProject(deps.run, link, deps.project, deps.scope))?.secrets ?? [], before);
                     if (ours || Date.now() >= end || deps.signal?.aborted)
                         break;
                     await sleep(wait.everyMs, undefined, { signal: deps.signal });

package/dist/vercel.js

@@ -167,11 +167,12 @@ const PROJECT_NAME = /^[a-z0-9][a-z0-9._-]{0,99}$/;
 /**
  * The Vercel project that builds `directory` of `repository`, on a repository with several apps: of the projects Vercel
  * lists as connected to the repository (GET /v10/projects?repoUrl=), in the team `team` names (the root link's) or the
- * CLI's current scope, the one whose Root Directory is that folder. Never the newest, nor the one the root link names:
- * none, or several, is a `reason`, so one app never borrows another's project.
+ * CLI's current scope, the one whose Root Directory is that folder; with no `directory`, the one project connected to
+ * the repository, whatever folder it builds. Never the newest, nor the one the root link names: none (`none`), or
+ * several, is a `reason`, so one app never borrows another's project.
  */
 export async function vercelProjectFor(vercel, repository, directory, team) {
-    const where = directory ? `the folder ${directory}` : "the repository's root";
+    const where = directory === undefined ? 'this repository' : directory ? `the folder ${directory}` : "the repository's root";
     let listed;
     try {
         const query = `repoUrl=${encodeURIComponent(`https://github.com/${repository}`)}&limit=100${team?.startsWith('team_') ? `&teamId=${encodeURIComponent(team)}` : ''}`;
@@ -185,7 +186,7 @@ export async function vercelProjectFor(vercel, repository, directory, team) {
         return { reason: "The Vercel CLI could not list this repository's projects (vercel api): it is signed out, or this CLI has no api command." };
     const builds = listed.map(record).filter((p) => {
         const git = record(p?.link);
-        return git?.type === 'github' && `${git.org}/${git.repo}`.toLowerCase() === repository.toLowerCase() && folderOf(p.rootDirectory) === folderOf(directory);
+        return git?.type === 'github' && `${git.org}/${git.repo}`.toLowerCase() === repository.toLowerCase() && (directory === undefined || folderOf(p.rootDirectory) === folderOf(directory));
     });
     const found = builds.flatMap((p) => {
         const link = asLink(p.id, p.accountId);
@@ -194,9 +195,26 @@ export async function vercelProjectFor(vercel, repository, directory, team) {
     if (builds.length > 1)
         return { reason: `Several Vercel projects build ${where} (${found.map((p) => p.name).join(', ') || 'unnamed'}), so which one is this app's cannot be told.` };
     if (!found.length)
-        return { reason: `No Vercel project of this repository builds ${where} (its Root Directory), as far as the Vercel CLI here can see.` };
+        return { reason: directory === undefined ? 'No Vercel project is connected to this repository, as far as the Vercel CLI here can see.' : `No Vercel project of this repository builds ${where} (its Root Directory), as far as the Vercel CLI here can see.`, none: true };
     return found[0];
 }
+/**
+ * The Vercel project of a repository Vercel deploys from GitHub, for a folder `vercel link` never linked: the link file
+ * is gitignored, so a clone has none (#310). The one project connected to the repository in the CLI's current scope,
+ * else in another of the person's teams, with that team's slug (`scope`) for the CLI's own commands, which take the
+ * current scope otherwise.
+ */
+export async function vercelRepoProject(vercel, repository) {
+    const here = await vercelProjectFor(vercel, repository);
+    if (!('none' in here))
+        return here;
+    for (const team of (await vercelTeams(vercel)).filter((t) => !t.current && t.id)) {
+        const there = await vercelProjectFor(vercel, repository, undefined, team.id);
+        if (!('reason' in there))
+            return { ...there, scope: team.value };
+    }
+    return here;
+}
 /**
  * Whether the project made the deployment at `host`: one of its latest, as the project read lists them; else, since a
  * project lists its newest deployments alone while an older pull request's preview stays served, the deployment read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,