@leed-ai/cli 0.0.0-stage → 6.19.0

package/dist/authShared-Dray38Ls.js

@@ -0,0 +1,1161 @@
+/**
+* SPDX-FileCopyrightText: © 2024-2025 Leed, Inc.
+* SPDX-License-Identifier: LicenseRef-Leed-EULA
+*/
+import { r as __exportAll } from "./chunk-1VJ9lAw7.js";
+import { n as createLogger } from "./leedLogger-Zkada5aO.js";
+import { t as EnvName } from "./env-B0bHiXJJ.js";
+import { n as leedConfigDir, r as CliUserError, t as withFileLock } from "./leed.mjs";
+import fs, { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { Option } from "commander";
+import { z } from "zod";
+import { homedir } from "node:os";
+import slugify from "@sindresorhus/slugify";
+import ky from "ky";
+import { execFileSync } from "node:child_process";
+//#region src/cli/output/jsonMode.ts
+/**
+* Resolution of the CLI's `--json` mode (#333 Phase 2).
+*
+* JSON mode is decided in exactly one place so every consumer agrees. It is on
+* when either the global `--json` flag is present or `LEED_JSON` is set to a
+* truthy value, and it implies non-interactive operation throughout: no color,
+* no prompts, no self-update check.
+*/
+/** The flag as registered on the root program. */
+const JSON_OPTION_FLAGS = "--json";
+/** Help text for the global flag; kept here so the wiring and the docs agree. */
+const JSON_OPTION_DESCRIPTION = "Emit a single machine-readable JSON document on stdout instead of formatted text";
+/** Environment opt-in, equivalent to passing the flag. */
+const JSON_ENV_VAR = "LEED_JSON";
+/** Values of `LEED_JSON` that turn JSON mode on. Anything else leaves it off. */
+const TRUTHY = new Set([
+	"1",
+	"true",
+	"yes",
+	"on"
+]);
+/**
+* Whether the environment opts into JSON mode.
+*
+* The variable is an opt-in only: `LEED_JSON=0` does not force JSON mode OFF
+* for a caller who passed `--json` explicitly, it simply fails to turn it on.
+*/
+function jsonModeFromEnv(env = process.env) {
+	const raw = env[JSON_ENV_VAR];
+	return raw !== void 0 && TRUTHY.has(raw.trim().toLowerCase());
+}
+/**
+* Whether this run is in JSON mode, for a helper that holds the parsed OPTIONS
+* rather than the Commander command.
+*
+* The flag reaches a helper through `optsWithGlobals()` as `options.json`, and
+* reading only that field is a real defect rather than a shortcut: it sees
+* `--json` and is blind to `LEED_JSON`, so the documented environment opt-in —
+* the one a harness uses when it cannot control argv — silently ran the
+* interactive login flow inside the auth guard and skipped the failure envelope
+* inside the build. Every such call site goes through here, so the two ways of
+* asking for JSON mode can never diverge again.
+*/
+function jsonModeFromOptions(options) {
+	if (options?.json === true) return true;
+	return jsonModeFromEnv();
+}
+/**
+* Whether this run is in JSON mode.
+*
+* `command` is any command in the tree — the flag lives on the root program and
+* reaches every descendant through `optsWithGlobals()`.
+*
+* **Defaults to `false` whenever the option is not registered**, and never
+* throws. Test harnesses assemble commands under a throwaway parent that has no
+* global options at all; a resolver that assumed the option existed would break
+* every one of them.
+*/
+function resolveJsonMode(command) {
+	if (jsonModeFromEnv()) return true;
+	if (!command) return false;
+	try {
+		return command.optsWithGlobals().json === true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/cli/output/progress.ts
+/**
+* The diagnostic / progress door (#333 Phase 3).
+*
+* Command *results* leave through `emit()`. Everything else the CLI says —
+* progress while a long step runs, an interactive prompt's narration, a
+* lifecycle announcement, an update notice — is a diagnostic, and diagnostics
+* go to stderr so that stdout carries the result and nothing else.
+*
+* Two rules make this the only sanctioned way to say something outside a
+* result, and they are why `console.*` is banned across `src/cli/**` (see
+* `noConsole.test.ts`):
+*
+*  - **stderr, always.** Under `--json` stdout carries a single document; on a
+*    human terminal stderr is where progress has always belonged, and Phase 3
+*    normalizes stream assignment anyway. A diagnostic on stdout is a bug in
+*    both modes.
+*  - **`process.stderr.write`, never `console.*`.** A console method is one of
+*    the doors `redirectStdoutToStderr()` has to patch (see `./streams.ts`).
+*    Writing straight to stderr sidesteps that machinery entirely: the line
+*    cannot be re-routed onto the JSON document, and it cannot be reordered
+*    relative to the document by a patch that is installed or torn down
+*    mid-run.
+*
+* A trailing newline is added here so callers pass lines, not byte strings, and
+* so nobody has to remember that `process.stderr.write` — unlike `console.log`
+* — appends nothing.
+*/
+/** Write one diagnostic or progress line to stderr. */
+function progress(line) {
+	process.stderr.write(`${line}\n`);
+}
+/** Write several diagnostic or progress lines to stderr, in order. */
+function progressLines(lines) {
+	for (const line of lines) progress(line);
+}
+/**
+* Write a human-mode FAILURE render to stderr.
+*
+* The counterpart of `writeResult` in `./streams.ts`, and the other half of one
+* rule: in human mode an `ok: true` render is the answer to the question the
+* caller asked and goes to stdout; an `ok: false` render is a diagnostic and
+* goes to stderr, exactly as the `console.error` calls it replaced did. That is
+* what keeps `leed site list > types.txt` from capturing an error message as if
+* it were a table, and what lets `2>/dev/null` silence a failure the way every
+* other command-line tool does.
+*
+* Under `--json` this is never used: the single document is the contract, so
+* `emit()` sends it to stdout through `writeResult` whatever `ok` says.
+*
+* It lives here rather than beside `writeResult` because it is a diagnostic
+* door like the two above and shares nothing with the redirection machinery:
+* `redirectStdoutToStderr()` only moves writes ONTO stderr, so there is nothing
+* for this to bypass. Keeping it out of `./streams.ts` also keeps that module
+* inside the size budget its no-relative-imports rule leaves it.
+*
+* Unlike `progress()` it appends no newline: it writes a render verbatim, and
+* the renderer decides where its lines break.
+*/
+function writeDiagnostic(text) {
+	process.stderr.write(text);
+}
+//#endregion
+//#region src/cli/legacyAiCleanup.ts
+/**
+* One-time removal of what older CLIs wrote into a site for AI agents (#438).
+*
+* Older CLIs copied their Claude skills into `raw-content/.claude/skills`
+* on every version change and recorded the directory names in
+* `leed.config.json` under `aiConfiguration.claude.installedSkills`, alongside a
+* `vscodeVersion` stamp for the VS Code files they also rewrote. The skills now
+* ship in the Leed Claude plugin and the VS Code files are written only by
+* `leed site vscode`, so the copies and both keys are dead weight — and the
+* copies would shadow the plugin's newer skills.
+*
+* The names come from a file the user can edit, so each one is untrusted: only
+* a plain directory name sitting directly under `.claude/skills` is ever
+* removed, a symlink is unlinked rather than followed, and anything else is
+* skipped. The rest of `.claude`, the `.code-workspace` and `.vscode/` are left
+* alone.
+*/
+const LEGACY_AI_CLEANUP_NOTICE = "Leed skills now come from the Leed Claude plugin; the CLI no longer installs them into .claude/skills.";
+function recordedSkills(aiConfiguration) {
+	if (!aiConfiguration || typeof aiConfiguration !== "object") return [];
+	const claude = aiConfiguration.claude;
+	if (!claude || typeof claude !== "object") return [];
+	const installed = claude.installedSkills;
+	if (!Array.isArray(installed)) return [];
+	return installed.filter((name) => typeof name === "string");
+}
+function isPlainName(name) {
+	return name !== "" && name !== "." && name !== ".." && !name.includes("/") && !name.includes("\\") && !name.includes("\0") && !path.isAbsolute(name) && path.basename(name) === name;
+}
+function cleanupLegacyAiConfig(rawConfig, rawContentRepo) {
+	const changed = !!rawConfig && typeof rawConfig === "object" && !Array.isArray(rawConfig) && ("aiConfiguration" in rawConfig || "vscodeVersion" in rawConfig);
+	if (!changed) return {
+		config: rawConfig,
+		changed: false,
+		removed: [],
+		skipped: []
+	};
+	const { aiConfiguration, vscodeVersion: _vscodeVersion, ...config } = rawConfig;
+	const skillsDir = path.resolve(rawContentRepo, ".claude", "skills");
+	const removed = [];
+	const skipped = [];
+	for (const name of recordedSkills(aiConfiguration)) {
+		if (!isPlainName(name)) {
+			skipped.push({
+				name,
+				reason: "not a plain directory name"
+			});
+			continue;
+		}
+		const target = path.join(skillsDir, name);
+		if (path.dirname(target) !== skillsDir) {
+			skipped.push({
+				name,
+				reason: "outside .claude/skills"
+			});
+			continue;
+		}
+		try {
+			const stat = fs.lstatSync(target);
+			if (stat.isSymbolicLink()) {
+				fs.unlinkSync(target);
+				removed.push(name);
+			} else if (stat.isDirectory()) {
+				fs.rmSync(target, {
+					recursive: true,
+					force: true
+				});
+				removed.push(name);
+			} else skipped.push({
+				name,
+				reason: "not a directory"
+			});
+		} catch (error) {
+			const code = error.code;
+			if (code !== "ENOENT") skipped.push({
+				name,
+				reason: code ?? String(error)
+			});
+		}
+	}
+	return {
+		config,
+		changed,
+		removed,
+		skipped,
+		notice: LEGACY_AI_CLEANUP_NOTICE
+	};
+}
+//#endregion
+//#region src/cli/rawContentSlot.ts
+/**
+* The one resolution of the `(environment, companyId)` slot the raw-content
+* credential is filed under (#413).
+*
+* `./rawContentCredential.ts` owns the store; this owns the KEY. Everything
+* that files the token and everything that reads it back resolves that key
+* here, and nowhere else, because the two halves disagreeing is the only way
+* this feature fails: the writer files under one slot, the reader looks in
+* another, and the single symptom is git reporting that it could not read a
+* username on a checkout that was working a moment earlier.
+*
+* **That is not hypothetical — it is the defect this module exists to end.** It
+* was fixed three times over #413: once in the writer, once in the reader, and
+* once more because those two fixes disagreed with each other. A shared
+* resolver is the only shape in which they cannot.
+*
+* The three sources, in precedence order:
+*
+*  1. **The site's `sites.json` entry** — what the command was configured with. First,
+*     because `../cli/params.ts`'s `siteCompanyId()` is config-first for the
+*     company half, and a key assembled from two different precedences is a
+*     third slot neither half ever writes.
+*  2. **`identity.json`** inside the raw-content checkout — the only one of the
+*     three a direct-mode checkout has, and the only one present when git runs
+*     `leed __credential` from the user's own shell, where `ENV_NAME` is not
+*     exported. `libs/data-types/src/automation/gitlabProvisioner.ts` commits
+*     it with `{ companyId, environment }`, so every clone carries both.
+*  3. **`ENV_NAME`**, else **no slot** (#462). There used to be a `production`
+*     fallback here; a slot guessed for an environment nothing named is one no
+*     reader would look in, so the resolver answers null and each caller says
+*     what that means for it.
+*/
+/** The file a raw-content checkout identifies itself with. */
+const IDENTITY_FILE_NAME = "identity.json";
+/** `value` when it is a non-empty string. */
+function nonEmpty(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+/**
+* A raw-content checkout's `identity.json`, or null when it has none.
+*
+* Read with `JSON.parse` and never allowed to throw: `leed __credential` runs
+* inside a git process and may not log, prompt or fail, and a malformed
+* identity file has to read as "this checkout names nothing" rather than as an
+* error. Both halves read it through here so neither can start honoring a
+* field the other ignores.
+*/
+function readSiteIdentity(directory) {
+	if (!directory) return null;
+	try {
+		const parsed = JSON.parse(readFileSync(path.join(directory, IDENTITY_FILE_NAME), "utf-8"));
+		if (typeof parsed !== "object" || parsed === null) return null;
+		const identity = parsed;
+		return {
+			companyId: nonEmpty(identity.companyId),
+			environment: nonEmpty(identity.environment)
+		};
+	} catch {
+		return null;
+	}
+}
+/** The absolute path of `directory`'s identity file. */
+function siteIdentityPath(directory) {
+	return path.join(directory, IDENTITY_FILE_NAME);
+}
+function rawContentSlot(sources) {
+	const named = nonEmpty(sources.configEnvironment) ?? sources.identity?.environment;
+	const environment = EnvName.safeParse(named).data ?? EnvName.safeParse(process.env.ENV_NAME).data;
+	if (!environment) return null;
+	return {
+		environment,
+		companyId: nonEmpty(sources.configCompanyId) ?? sources.identity?.companyId
+	};
+}
+//#endregion
+//#region src/cli/shared/checkoutRoot.ts
+/**
+* The root of the site checkout `start` is in, or null when there is none (#459): `start` itself when it holds
+* `identity.json`; else its `raw-content/` when that does — the company folder a checkout has always been set up in,
+* which commands were run from before the registry; else the NEAREST ancestor holding `identity.json`.
+*
+* Every site repo and every sandbox carries that file at its root, so it is what identifies a checkout wherever the
+* user put the folder. The sandbox guard (`../sandbox/placeholders.ts`) and the site registry (`../sites/`) both find
+* the checkout through here, so a real checkout nested under a sandbox (or the reverse) is judged by the checkout the
+* command is actually in, the same way by both. The root is returned as its physical path (see `canonicalPath`).
+*/
+function findCheckoutRoot(start = process.cwd()) {
+	const from = path.resolve(start);
+	if (existsSync(siteIdentityPath(from))) return canonicalPath(from);
+	const below = path.join(from, "raw-content");
+	if (existsSync(siteIdentityPath(below))) return canonicalPath(below);
+	let current = path.dirname(from);
+	for (;;) {
+		if (existsSync(siteIdentityPath(current))) return canonicalPath(current);
+		const parent = path.dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+}
+/**
+* `p` as one spelling of the folder: absolute, with every symlink resolved, so a path recorded through a symlink (on
+* macOS, `/tmp` is one) and the physical working directory compare equal. For a path that does not exist yet, such
+* as a checkout about to be cloned or one since moved, the nearest existing ancestor is resolved and the rest kept.
+*/
+function canonicalPath(p) {
+	const absolute = path.resolve(p);
+	try {
+		return realpathSync(absolute);
+	} catch {
+		const parent = path.dirname(absolute);
+		return parent === absolute ? absolute : path.join(canonicalPath(parent), path.basename(absolute));
+	}
+}
+//#endregion
+//#region src/cli/shared/ciMode.ts
+/**
+* Whether the CLI runs as a CI build (#459): the `--ci` flag, or `CI=true` in the environment.
+*
+* The one test for it in site resolution, the site registry and the upload, so they cannot disagree about whether
+* a run is CI — and CI never reads or writes `sites.json`. Pass the parsed `--ci` option where the command has one.
+*/
+function isCI(ciFlag) {
+	return !!ciFlag || process.env.CI === "true";
+}
+//#endregion
+//#region src/cli/shared/privateJson.ts
+/**
+* Write a per-user JSON store the way `../credentials.ts` writes `auth.json` (#459): a 600 file inside a 700
+* directory, written to a temp file and renamed into place, so a reader never sees half a file. A write that fails
+* takes its temp file with it.
+*/
+function writePrivateJson(file, value) {
+	const dir = path.dirname(file);
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	chmodSync(dir, 448);
+	const tmpPath = `${file}.tmp-${process.pid}`;
+	try {
+		writeFileSync(tmpPath, `${JSON.stringify(value, null, 2)}\n`, { mode: 384 });
+		renameSync(tmpPath, file);
+	} catch (e) {
+		rmSync(tmpPath, { force: true });
+		throw e;
+	}
+	chmodSync(file, 384);
+}
+//#endregion
+//#region src/cli/sites/sitesStore.ts
+/**
+* The per-user site registry, `$XDG_CONFIG_HOME/leed/sites.json` (default `~/.config/leed/sites.json`) (#459).
+*
+* One entry per site the user has set up: a real site is keyed by `(companyId, environment)`; a sandbox — every one of
+* which names the same placeholder company — is keyed by its checkout path and named by its folder. Nothing about a
+* site lives outside its repo any more: a checkout is identified by its own `identity.json`, and `paths` is only a
+* cache of where its clones were last seen, refreshed by every command run inside one.
+*
+* Stored the way `../credentials.ts` stores `auth.json`: a 600 file inside a 700 directory, written to a temp file and
+* renamed into place, and changed only under a cross-process lock (`../shared/fileLock.ts`) that re-reads the file
+* after taking it, so two CLI processes writing at once never lose each other's entry or leave a torn file.
+*
+* Readers never write and never throw: a missing file is an empty registry, and an entry this build cannot read is
+* skipped (and kept on disk). Only a file that is not JSON at all reads as empty; the next write sets it aside as
+* `sites.json.corrupt-<ms>` rather than overwriting it.
+*/
+const log$2 = createLogger("site:sites");
+const SiteEntry = z.object({
+	companyId: z.string().min(1).describe("CMS company identifier (the sandbox placeholder for a sandbox)"),
+	environment: EnvName.describe("The CMS environment this site targets"),
+	domain: z.string().default("").describe("The company's public site domain; empty for a sandbox"),
+	companyName: z.string().optional().describe("The site's title, for naming it in commands and output"),
+	paths: z.array(z.string()).default([]).describe("Absolute paths of the site's raw-content checkouts, most recently used first"),
+	remote: z.string().optional().describe("The checkout's git origin URL, without credentials"),
+	userId: z.string().optional().describe("The Leed user who set the site up"),
+	initialized: z.boolean().default(false).describe("Whether `leed site init` has finished for this site"),
+	huskyVersion: z.string().default("").describe("CLI version whose git hooks were last installed in the checkout"),
+	sandbox: z.literal(true).optional().describe("Set on a sandbox site, which has no CMS company behind it"),
+	name: z.string().optional().describe("A sandbox's name: its folder name")
+});
+const SitesFile = z.object({
+	version: z.literal(1),
+	sites: z.array(SiteEntry).default([]),
+	migratedFrom: z.array(z.string()).default([]).describe("leed.config.json files already imported; they are never read again")
+});
+function getSitesPath() {
+	return path.join(leedConfigDir(), "sites.json");
+}
+function emptySites() {
+	return {
+		version: 1,
+		sites: [],
+		migratedFrom: []
+	};
+}
+function readOutcome() {
+	const sitesPath = getSitesPath();
+	const empty = {
+		file: emptySites(),
+		unreadable: [],
+		corrupt: false,
+		readError: null,
+		newer: null
+	};
+	if (!existsSync(sitesPath)) return empty;
+	let text;
+	try {
+		text = readFileSync(sitesPath, "utf-8");
+	} catch (e) {
+		log$2.debug(`Could not read ${sitesPath}: ${e.message}`);
+		return {
+			...empty,
+			readError: e.message
+		};
+	}
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch (e) {
+		log$2.debug(`Ignoring ${sitesPath}, which is not valid JSON: ${e.message}`);
+		return {
+			...empty,
+			corrupt: true
+		};
+	}
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+		log$2.debug(`Ignoring ${sitesPath}: it is not a JSON object`);
+		return {
+			...empty,
+			corrupt: true
+		};
+	}
+	const { version, sites, migratedFrom } = raw;
+	const newer = typeof version === "number" && version > 1 ? version : null;
+	const outcome = {
+		...empty,
+		newer
+	};
+	for (const candidate of Array.isArray(sites) ? sites : []) {
+		const parsed = SiteEntry.safeParse(candidate);
+		if (parsed.success) outcome.file.sites.push(parsed.data);
+		else {
+			log$2.debug(`Skipping an unreadable entry in ${sitesPath}: ${parsed.error.message}`);
+			outcome.unreadable.push(candidate);
+		}
+	}
+	if (Array.isArray(migratedFrom)) outcome.file.migratedFrom = migratedFrom.filter((file) => typeof file === "string");
+	return outcome;
+}
+/** The registry as it is on disk. Synchronous, read-only, and never throws. */
+function readSites() {
+	return readOutcome().file;
+}
+/**
+* Change the registry: take the lock, re-read the file, let `mutator` change it in place, and write it back when it
+* changed. The only writer, so every change is a read-modify-write under the lock. Entries this build cannot read are
+* written back untouched; a file a newer CLI wrote, or one that cannot be read at all, is refused rather than
+* rewritten.
+*/
+async function updateSites(mutator) {
+	return withFileLock(`${getSitesPath()}.lock`, async () => {
+		const { file, unreadable, corrupt, readError, newer } = readOutcome();
+		if (readError !== null) throw new CliUserError(`${getSitesPath()} could not be read (${readError}), so it is left unchanged.`, "Check the file's permissions: it should belong to you, with mode 600", "validation_failed");
+		if (newer !== null) throw new CliUserError(`${getSitesPath()} was written by a newer Leed CLI (format ${newer}; this one understands 1), so it is left unchanged.`, "Update the CLI with `leed self-update`", "validation_failed");
+		const before = JSON.stringify(file);
+		const result = mutator(file);
+		if (corrupt) {
+			const aside = `${getSitesPath()}.corrupt-${Date.now()}`;
+			renameSync(getSitesPath(), aside);
+			log$2.warn(`${getSitesPath()} was not valid JSON and has been moved to ${aside}; starting a new one.`);
+		}
+		if (corrupt || JSON.stringify(file) !== before) {
+			const parsed = SitesFile.parse(file);
+			writePrivateJson(getSitesPath(), {
+				...parsed,
+				sites: [...parsed.sites, ...unreadable]
+			});
+		}
+		return result;
+	});
+}
+/** Whether two entries are the same site: the same company and environment, or for a sandbox a shared checkout. */
+function sameSite(a, b) {
+	if (a.sandbox || b.sandbox) {
+		const theirs = new Set(b.paths.map(canonicalPath));
+		return !!a.sandbox && !!b.sandbox && a.paths.some((p) => theirs.has(canonicalPath(p)));
+	}
+	return a.companyId === b.companyId && a.environment === b.environment;
+}
+/**
+* Merge `input` into the entry for the same site, or add it. Fields `input` names replace the entry's; its paths go
+* to the front of the entry's, without duplicates. Paths are recorded as physical paths (see `canonicalPath`), so a
+* checkout reached through a symlink is one checkout, not two.
+*/
+function mergeSite(file, input) {
+	const parsed = SiteEntry.parse(input);
+	const incoming = {
+		...parsed,
+		paths: [...new Set(parsed.paths.map(canonicalPath))]
+	};
+	const existing = file.sites.find((entry) => sameSite(entry, incoming));
+	if (!existing) {
+		file.sites.push(incoming);
+		return incoming;
+	}
+	const named = Object.keys(input).filter((key) => input[key] !== void 0);
+	const defined = Object.fromEntries(named.map((key) => [key, incoming[key]]));
+	const paths = [...new Set([...incoming.paths, ...existing.paths.map(canonicalPath)])];
+	Object.assign(existing, defined, { paths });
+	return existing;
+}
+/** Record `input` in the registry, merging it into the entry for the same site. */
+function upsertSite(input) {
+	return updateSites((file) => mergeSite(file, input));
+}
+//#endregion
+//#region src/cli/sites/legacyConfigImport.ts
+/**
+* The one-time import of `leed.config.json` files into `sites.json` (#459).
+*
+* CLIs before the registry kept one `leed.config.json` per site, in the folder above the checkout
+* (`<dir>/<customer>/leed.config.json` beside `<dir>/<customer>/raw-content`), and the installer left an
+* uninitialized one in the project directory it created (`~/leed` by default). Each file the CLI meets — in the
+* working directory, any folder above it, `~/leed` or a folder directly inside `~/leed` — is imported once: its site
+* is merged into the registry and its path is recorded in `migratedFrom`, so it is never read again. The file itself
+* is left in place.
+*
+* The keys older CLIs wrote for their AI files (`aiConfiguration`, `vscodeVersion`) are not carried over; the skills
+* they recorded are removed from the checkout here, once, by `../legacyAiCleanup.ts`.
+*
+* The `~/leed` scan uses the real home directory (the `home` parameter exists for tests). Never run in CI, where the
+* CLI uses `identity.json` and the environment alone.
+*/
+const log$1 = createLogger("site:sites");
+const LEGACY_CONFIG_FILE_NAME = "leed.config.json";
+/** Every `leed.config.json` the CLI looks for: the working directory and its ancestors, then `~/leed` and its children. */
+function legacyConfigCandidates(cwd, home = homedir()) {
+	const found = [];
+	const add = (file) => {
+		if (!found.includes(file) && existsSync(file)) found.push(file);
+	};
+	let current = path.resolve(cwd);
+	for (;;) {
+		add(path.join(current, LEGACY_CONFIG_FILE_NAME));
+		const parent = path.dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	const installerDir = path.join(home, "leed");
+	add(path.join(installerDir, LEGACY_CONFIG_FILE_NAME));
+	try {
+		for (const child of readdirSync(installerDir, { withFileTypes: true })) if (child.isDirectory()) add(path.join(installerDir, child.name, LEGACY_CONFIG_FILE_NAME));
+	} catch {}
+	return found;
+}
+/** The checkout a legacy file describes: the first candidate location holding `identity.json`. */
+function legacyCheckout(file, raw) {
+	const dir = path.dirname(file);
+	const customer = typeof raw.domain === "string" && raw.domain ? slugify(raw.domain) : null;
+	const location = typeof raw.location === "string" && raw.location ? raw.location : null;
+	return [
+		path.join(dir, "raw-content"),
+		...customer ? [path.join(dir, customer, "raw-content")] : [],
+		...customer && location ? [path.join(location, customer, "raw-content")] : []
+	].find((candidate) => existsSync(siteIdentityPath(candidate))) ?? null;
+}
+const text = (value) => typeof value === "string" && value ? value : void 0;
+/** The registry entry a parsed legacy file maps to, or null when it names no company to key it by. */
+function legacyEntry(raw, checkout) {
+	const identity = readSiteIdentity(checkout ?? void 0);
+	const companyId = text(raw.companyId) ?? identity?.companyId;
+	const environment = EnvName.safeParse(raw.environment ?? identity?.environment ?? "production");
+	if (!companyId || !environment.success) return null;
+	return {
+		companyId,
+		environment: environment.data,
+		domain: text(raw.domain) ?? "",
+		paths: checkout ? [checkout] : [],
+		...text(raw.userId) ? { userId: text(raw.userId) } : {},
+		...typeof raw.initialized === "boolean" ? { initialized: raw.initialized } : {},
+		...text(raw.huskyVersion) ? { huskyVersion: text(raw.huskyVersion) } : {}
+	};
+}
+function readRaw(file) {
+	try {
+		const parsed = JSON.parse(readFileSync(file, "utf-8"));
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Add an imported entry, or fill in the entry already registered for the same site. What the registry already holds
+* wins — an installer's leftover uninitialized file must not undo a finished `leed site init` — and the file's
+* checkout joins the entry's paths at the end.
+*/
+function fileLegacyEntry(sites, input) {
+	const incoming = SiteEntry.parse(input);
+	const existing = sites.sites.find((entry) => sameSite(entry, incoming));
+	if (!existing) {
+		mergeSite(sites, input);
+		return;
+	}
+	const known = new Set(existing.paths.map(canonicalPath));
+	existing.paths.push(...incoming.paths.map(canonicalPath).filter((p) => !known.has(p)));
+	existing.userId ??= incoming.userId;
+	existing.domain ||= incoming.domain;
+	existing.huskyVersion ||= incoming.huskyVersion;
+	existing.initialized ||= incoming.initialized;
+}
+/** The one-time notice for an imported file. */
+function legacyImportNotice(file) {
+	return `Imported ${file} into ${getSitesPath()}; ${LEGACY_CONFIG_FILE_NAME} is no longer read and can be deleted.`;
+}
+/**
+* File each of `pending` into `sites`, recording it in `migratedFrom`, and return the files that named a site. With
+* `cleanup`, the legacy skills each file recorded are removed from its checkout as well.
+*/
+function fileLegacyConfigs(sites, pending, cleanup) {
+	const imported = [];
+	for (const file of pending) {
+		if (sites.migratedFrom.includes(file)) continue;
+		sites.migratedFrom.push(file);
+		const raw = readRaw(file);
+		if (!raw) {
+			log$1.debug(`Skipping unreadable ${file}`);
+			continue;
+		}
+		const checkout = legacyCheckout(file, raw);
+		const entry = legacyEntry(raw, checkout);
+		if (!entry) {
+			log$1.debug(`Skipping ${file}: it names no company`);
+			continue;
+		}
+		if (checkout && cleanup) {
+			const legacy = cleanupLegacyAiConfig(raw, checkout);
+			for (const { name, reason } of legacy.skipped) log$1.debug(`Left legacy skill entry ${name}: ${reason}`);
+			if (legacy.notice) log$1.info(legacy.notice);
+		}
+		fileLegacyEntry(sites, entry);
+		imported.push(file);
+	}
+	return imported;
+}
+/** The legacy files near `cwd` not yet imported. */
+function pendingLegacyConfigs(known, cwd, home) {
+	const migrated = new Set(known.migratedFrom);
+	return legacyConfigCandidates(cwd, home).filter((file) => !migrated.has(file));
+}
+/**
+* Import every legacy file not yet imported, and return the files imported. Cheap when there is nothing to do: one
+* read of the registry and a few `existsSync`, with the lock taken only when an unimported file exists.
+*/
+async function importLegacyConfigs(cwd = process.cwd(), home = homedir()) {
+	const pending = pendingLegacyConfigs(readSites(), cwd, home);
+	if (pending.length === 0) return [];
+	return updateSites((sites) => fileLegacyConfigs(sites, pending, true));
+}
+/**
+* The registry as the next import would leave it, for the commands that must not write (`leed site list`,
+* `leed auth status`, a `--dry-run`): the legacy files nearby are merged in memory, and nothing is written, imported
+* or cleaned up. Never throws; in CI it is the registry alone.
+*/
+function sitesWithLegacy(cwd = process.cwd(), home = homedir()) {
+	const sites = readSites();
+	if (isCI()) return sites;
+	try {
+		fileLegacyConfigs(sites, pendingLegacyConfigs(sites, cwd, home), false);
+	} catch (e) {
+		log$1.debug(`Legacy configs not read: ${e.message}`);
+	}
+	return sites;
+}
+/**
+* Import what is nearby and print the one-time notice for each file imported, unless `quiet` (`--json`). Never in CI,
+* and never fatal: a registry that cannot be written leaves the files to be imported on a later run.
+*/
+async function importAndAnnounce(quiet, cwd = process.cwd()) {
+	if (isCI()) return;
+	try {
+		const imported = await importLegacyConfigs(cwd);
+		if (!quiet) for (const file of imported) progress(legacyImportNotice(file));
+	} catch (e) {
+		log$1.debug(`Legacy config import skipped: ${e.message}`);
+	}
+}
+//#endregion
+//#region src/cli/sandbox/placeholders.ts
+/**
+* The sandbox site and its placeholder ids (#457).
+*
+* A sandbox is a site checkout with no CMS behind it: `leed site init --sandbox` writes it from the fixture set in
+* `static/templates/sandbox/`, and it builds and previews offline. Its `identity.json` names a company that cannot
+* exist — real company ids are six lowercase letters or digits, and this one has hyphens — so the file doubles as the
+* marker every command checks before it does any auth.
+*
+* Every record id a sandbox holds is a readable placeholder, `ph-<kind>-<n>`. The sandbox move
+* (`/leed:site-sandbox-move`) creates each record in the CMS and swaps each placeholder for the real id, so the
+* format has to make the ids trivial to find and impossible to confuse with a real one. The plugin's move scripts
+* carry their own copy of the kind list and the token pattern (`skills/site-sandbox-move/scripts/lib`); the plugin's
+* tests read this file and fail when the two disagree.
+*/
+/** The `companyId` of every sandbox's `identity.json`. Not a real company id, by construction. */
+const SANDBOX_COMPANY_ID = "non-cms-company";
+const KIND_ALTERNATION = [
+	"pt",
+	"page",
+	"label",
+	"author",
+	"menu",
+	"menuitem",
+	"form",
+	"asset",
+	"cta",
+	"index",
+	"autolink"
+].join("|");
+new RegExp(`^ph-(${KIND_ALTERNATION})-[1-9]\\d*$`);
+new RegExp(`(?<![A-Za-z0-9_])ph-(${KIND_ALTERNATION})-([1-9]\\d*)(?![A-Za-z0-9_])`, "g");
+/** Whether an `identity.json` names the sandbox company. */
+function isSandboxIdentity(identity) {
+	return identity?.companyId === SANDBOX_COMPANY_ID;
+}
+/**
+* The root of the sandbox `start` is inside, or null.
+*
+* Decides on the NEAREST `identity.json` alone (`findCheckoutRoot`), so a real checkout nested under a sandbox (or the
+* reverse) is judged by the checkout the command is actually in.
+*/
+function findSandboxRoot(start = process.cwd()) {
+	const root = findCheckoutRoot(start);
+	return root && isSandboxIdentity(readSiteIdentity(root)) ? root : null;
+}
+/** Where the shipped sandbox fixture set lives under the CLI's app root (`dist/` once bundled). */
+function sandboxTemplateDir(appRoot) {
+	return path.join(appRoot, "static", "templates", "sandbox");
+}
+//#endregion
+//#region src/cli/sites/siteLookup.ts
+/**
+* Finding a site in the registry (#459): the site a checkout belongs to, and the site a `--site` reference names.
+*
+* Pure over a `SitesFile` already read, so the sync callers (option defaults, the git credential helper) and the
+* async ones resolve a site the same way.
+*/
+/**
+* The entry for the checkout rooted at `root`, whose `identity.json` says `identity`.
+*
+* An entry that lists `root` among its paths wins, provided it agrees with the checkout's own `identity.json` (see
+* `agreesWithIdentity`) and, when `env` is given, is for that environment: paths are a cache, and a folder reused for
+* another site must not resolve to the old one. Paths compare as physical paths, so one recorded through a symlink
+* still matches. Otherwise, for a real site, the initialized entry for the identity's company in the identity's
+* environment (or `env`, when the identity names none); with no environment to go on, the company's only initialized
+* entry. An entry still waiting for `leed site init` (an installer's leftover, say) claims no checkout it was not
+* recorded at, so a clone of that company made by hand stays in direct mode. A sandbox is matched by path alone, since
+* every sandbox names the same placeholder company.
+*/
+function findSiteForCheckout(file, root, identity, env) {
+	const resolved = canonicalPath(root);
+	const byPath = file.sites.filter((entry) => entry.paths.some((p) => canonicalPath(p) === resolved) && agreesWithIdentity(entry, identity));
+	const pathMatch = env ? byPath.find((entry) => entry.environment === env) : byPath[0];
+	if (pathMatch) return pathMatch;
+	if (!identity?.companyId || isSandboxIdentity(identity)) return null;
+	const company = file.sites.filter((entry) => !entry.sandbox && entry.initialized && entry.companyId === identity.companyId);
+	const wanted = identity.environment ?? env;
+	if (wanted) return company.find((entry) => entry.environment === wanted) ?? null;
+	return company.length === 1 ? company[0] : null;
+}
+/**
+* Whether `entry` can be the site of a checkout whose `identity.json` says `identity`: a sandbox entry for a sandbox,
+* and for a real site the same company, in the same environment when the identity names one. A checkout whose
+* identity cannot be read, or names no company, agrees with any entry, as it did before the identity was checked.
+*/
+function agreesWithIdentity(entry, identity) {
+	if (!identity?.companyId) return true;
+	if (isSandboxIdentity(identity)) return !!entry.sandbox;
+	if (entry.sandbox || entry.companyId !== identity.companyId) return false;
+	return !identity.environment || entry.environment === identity.environment;
+}
+/** Whether `entry` answers to `ref`: its companyId, its domain or its name, compared without case. */
+function answersTo(entry, ref) {
+	const wanted = ref.trim().toLowerCase();
+	return [
+		entry.companyId,
+		entry.domain,
+		entry.companyName,
+		entry.name
+	].some((name) => !!name && name.toLowerCase() === wanted);
+}
+/**
+* The entry `ref` names — a companyId, a domain, a site's name or a sandbox's folder name — narrowed to `env` when
+* one is given. Several matches (one company in two environments, say, with no `env`) are ambiguous, not a guess.
+*/
+function resolveSiteRef(file, ref, env) {
+	const named = file.sites.filter((entry) => answersTo(entry, ref));
+	const matches = env ? named.filter((entry) => entry.environment === env) : named;
+	if (matches.length === 1) return {
+		ok: true,
+		entry: matches[0]
+	};
+	if (matches.length === 0) return {
+		ok: false,
+		code: "not_found",
+		candidates: file.sites
+	};
+	return {
+		ok: false,
+		code: "site_ambiguous",
+		candidates: matches
+	};
+}
+/**
+* The first of the entry's paths that still holds this site's checkout — an `identity.json` that agrees with the
+* entry (see `agreesWithIdentity`) — or null when none does. A folder since reused for another site is not this
+* site's checkout, however much it still exists.
+*/
+function livePath(entry) {
+	return entry.paths.find((p) => existsSync(siteIdentityPath(p)) && agreesWithIdentity(entry, readSiteIdentity(p))) ?? null;
+}
+/** How a site is named in output: its name, else its domain, else its companyId. */
+function siteLabel(entry) {
+	return entry.companyName || entry.name || entry.domain || entry.companyId;
+}
+/** One line per site, for the messages that list the registered sites. */
+function describeSites(entries) {
+	return entries.map((entry) => {
+		const where = livePath(entry) ?? entry.paths[0] ?? "no checkout";
+		const kind = entry.sandbox ? "sandbox" : entry.environment;
+		return `  ${siteLabel(entry)} (${kind}, ${entry.companyId}) ${where}`;
+	}).join("\n");
+}
+//#endregion
+//#region src/cli/sites/siteConfig.ts
+/**
+* The site the CLI is working on, as every command sees it (#459).
+*
+* The checkout is the nearest folder holding `identity.json`; the site is that checkout's entry in `sites.json`.
+* `currentSite` is synchronous and read-only, for the callers that resolve a site at module load (option defaults)
+* or may not write at all (the git credential helper). `refreshSite` is the one writer: run by a command inside a
+* checkout, it moves the checkout to the front of the entry's paths and refreshes its remote and name, so a moved
+* or renamed folder fixes itself on the next command.
+*/
+const log = createLogger("site:sites");
+/**
+* The checkout the working directory is in, and its entry in `sites` (the registry on disk unless given). Null
+* outside any checkout.
+*/
+function currentSite(cwd = process.cwd(), env, sites = readSites()) {
+	const root = findCheckoutRoot(cwd);
+	if (!root) return null;
+	const identity = readSiteIdentity(root);
+	const entry = findSiteForCheckout(sites, root, identity, env);
+	return {
+		root,
+		identity,
+		entry,
+		sandbox: isSandboxIdentity(identity) || !!entry?.sandbox
+	};
+}
+/**
+* The company, environment and domain of the checkout the working directory is in: the registry entry's, else the
+* checkout's own `identity.json` (which names no domain). Null outside a checkout and in a sandbox, which has no
+* company to name. Never throws and never writes.
+*/
+function siteFacts(cwd = process.cwd()) {
+	try {
+		const site = currentSite(cwd);
+		if (!site || site.sandbox) return null;
+		const companyId = site.entry?.companyId ?? site.identity?.companyId;
+		const environment = site.entry?.environment ?? EnvName.safeParse(site.identity?.environment).data;
+		const domain = site.entry?.domain || void 0;
+		return {
+			...companyId ? { companyId } : {},
+			...environment ? { environment } : {},
+			...domain ? { domain } : {}
+		};
+	} catch (e) {
+		log.debug(`No site facts: ${e.message}`);
+		return null;
+	}
+}
+/** The checkout's origin URL without any credential in it, or undefined when git cannot say. */
+function originUrl(root) {
+	try {
+		const url = execFileSync("git", [
+			"-C",
+			root,
+			"remote",
+			"get-url",
+			"origin"
+		], {
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			timeout: 5e3
+		}).trim();
+		if (!url) return void 0;
+		try {
+			const parsed = new URL(url);
+			parsed.username = "";
+			parsed.password = "";
+			return parsed.toString();
+		} catch {
+			return url;
+		}
+	} catch {
+		return;
+	}
+}
+/** The site's title from its own `src/src.11tydata.json`, or undefined. */
+function siteTitle(root) {
+	try {
+		const data = JSON.parse(readFileSync(path.join(root, "src", "src.11tydata.json"), "utf-8"));
+		return typeof data?.siteTitle === "string" && data.siteTitle.trim() ? data.siteTitle.trim() : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* A sandbox entry that has lost its checkout: the same folder name, and none of its paths exists any more. A moved
+* sandbox is re-found this way, since nothing inside a sandbox tells two of them apart.
+*/
+function movedSandbox(sites, root) {
+	const name = path.basename(root);
+	return sites.find((entry) => entry.sandbox && entry.name === name && !entry.paths.some((p) => existsSync(p)));
+}
+/** Take the checkout's root out of the paths of every entry its `identity.json` says it no longer belongs to. */
+function dropStalePaths(sites, site) {
+	for (const entry of sites) if (entry.paths.some((p) => canonicalPath(p) === site.root) && !agreesWithIdentity(entry, site.identity)) entry.paths = entry.paths.filter((p) => canonicalPath(p) !== site.root);
+}
+/**
+* Record where the checkout is now: its root goes to the front of the entry's paths, and its remote and title are
+* refreshed, and any other entry still listing the root for a site its `identity.json` no longer names loses it. An
+* unregistered sandbox is registered (sandboxes made before the registry, or moved). An unregistered
+* real checkout is left alone — it is a direct-mode checkout, and direct mode never touches the registry. Best
+* effort: a registry that cannot be written is logged, never fatal. Returns the entry as it now stands.
+*/
+async function refreshSite(site) {
+	if (!site.entry && !site.sandbox) return null;
+	const remote = originUrl(site.root);
+	const companyName = site.sandbox ? void 0 : siteTitle(site.root);
+	try {
+		return await updateSites((file) => {
+			const target = (site.entry ? file.sites.find((candidate) => sameSite(candidate, site.entry)) : null) ?? (site.sandbox ? movedSandbox(file.sites, site.root) : void 0);
+			dropStalePaths(file.sites, site);
+			if (target) {
+				target.paths = [...new Set([site.root, ...target.paths.map(canonicalPath)])];
+				if (remote) target.remote = remote;
+				if (companyName) target.companyName = companyName;
+				return target;
+			}
+			if (!site.sandbox) return null;
+			return mergeSite(file, {
+				companyId: site.identity?.companyId ?? "non-cms-company",
+				environment: "dev",
+				sandbox: true,
+				name: path.basename(site.root),
+				paths: [site.root],
+				initialized: true,
+				...remote ? { remote } : {}
+			});
+		});
+	} catch (e) {
+		log.debug(`Could not record ${site.root} in ${getSitesPath()}: ${e.message}`);
+		return site.entry;
+	}
+}
+/**
+* The `config` object site commands receive, built from a registry entry: the shape `leed.config.json` gave them,
+* so callers did not change. `location` is the folder two above the checkout, as it always was; callers use the
+* checkout path itself (`rawContentRepo`), never a path rebuilt from `location`.
+*/
+function siteConfigFromEntry(entry, root) {
+	return {
+		environment: entry.environment,
+		domain: entry.domain,
+		companyId: entry.companyId,
+		userId: entry.userId ?? "",
+		initialized: entry.initialized,
+		huskyVersion: entry.huskyVersion,
+		location: path.dirname(path.dirname(root)),
+		configPath: getSitesPath()
+	};
+}
+/** Change fields of the registered entry for the same site as `entry`. */
+function saveSiteConfig(entry, patch) {
+	return updateSites((file) => {
+		const target = file.sites.find((candidate) => sameSite(candidate, entry));
+		if (target) Object.assign(target, patch);
+	});
+}
+//#endregion
+//#region src/cli/authShared.ts
+var authShared_exports = /* @__PURE__ */ __exportAll({
+	cliApi: () => cliApi,
+	companyOption: () => companyOption,
+	detectSiteCompany: () => detectSiteCompany,
+	envOption: () => envOption,
+	loadSiteContext: () => loadSiteContext,
+	notASiteCheckout: () => notASiteCheckout,
+	siteEnvironment: () => siteEnvironment,
+	siteRepoScope: () => siteRepoScope
+});
+/**
+* The pieces every `leed auth` subcommand shares (#333 Phase 3).
+*
+* `src/cli/auth.ts` was 596 lines and five commands deep before the refactor;
+* it is now one file per subcommand, and this is what they have in common: the
+* HTTP client, the `--env` option, and the site context that `rotate`, `reset`
+* and `status` all resolve the same way.
+*/
+/** An HTTP client that identifies the CLI and its platform to the CMS. */
+function cliApi(version) {
+	return ky.create({ headers: { "User-Agent": `leed-cli/${version} (${process.platform} ${process.arch})` } });
+}
+/** The environment the current checkout's site targets, or null outside a checkout (and in a sandbox). */
+function siteEnvironment() {
+	return siteFacts()?.environment ?? null;
+}
+/**
+* The checkout's company for `env` (#347), or undefined outside a checkout, when the checkout names no company, or
+* when it targets another environment — companies are per environment, so a production site's id means nothing on
+* staging. Only the checkout the working directory is in counts (#459: its `sites.json` entry, else its own
+* `identity.json`), never a site above it.
+*/
+function detectSiteCompany(env) {
+	const site = siteFacts();
+	if (!site?.companyId) return void 0;
+	if ((site.environment ?? EnvName.safeParse(process.env.ENV_NAME).data) !== env) return void 0;
+	return {
+		companyId: site.companyId,
+		...site.domain ? { domain: site.domain } : {}
+	};
+}
+/**
+* What the current checkout says about where it lives (#351): null outside a checkout, else the companyId and
+* environment it names — each absent when it does not name it, never defaulted.
+*/
+function siteRepoScope() {
+	return siteFacts();
+}
+/** The `--company` option shared by the per-company `auth` subcommands. */
+function companyOption() {
+	return new Option("--company <company>", "Company to act on (companyId or domain)");
+}
+/**
+* The `--env` option shared by `auth login` and `auth logout`.
+*
+* A factory rather than a shared instance: the two commands now live in
+* separate modules, and Commander options carry per-command state. It has no
+* default (#462): unset, the command reads the checkout's environment at action
+* time, and outside a checkout it refuses rather than assume one.
+*/
+function envOption() {
+	return new Option("-e, --env <name>", "Target environment").env("ENV_NAME").choices(EnvName.options).hideHelp();
+}
+/**
+* Load the site context of the checkout the working directory is in (#459): its `sites.json` entry, else — for a
+* checkout that is not registered — its own `identity.json`, the way direct mode reads it. Any `leed.config.json` an
+* older CLI left nearby is imported first. With `readOnly` (a command that must not change disk, such as
+* `leed auth status` or a `--dry-run`) nothing is imported or refreshed: the legacy files are only read.
+*
+* Throws a `CliUserError` outside a checkout: `rotate` and `reset` both need a site context to know which company
+* they are operating against, and under `--json` `runAndEmit` turns that throw into a `not_a_site_repo` envelope
+* carrying the same sentence.
+*/
+async function loadSiteContext(options = {}) {
+	let site;
+	if (options.readOnly) site = currentSite(process.cwd(), void 0, sitesWithLegacy());
+	else {
+		await importAndAnnounce(jsonModeFromEnv() || process.argv.includes("--json"));
+		site = currentSite();
+	}
+	if (site?.entry && !site.sandbox) {
+		const entry = (options.readOnly ? null : await refreshSite(site)) ?? site.entry;
+		const config = siteConfigFromEntry(entry, site.root);
+		return {
+			env: entry.environment,
+			config,
+			customer: slugify(entry.domain),
+			rawContentRepo: site.root
+		};
+	}
+	if (site && !site.sandbox && site.identity?.companyId) {
+		const env = identityEnvironment(site.identity.environment);
+		return {
+			env,
+			config: {
+				environment: env,
+				domain: "",
+				companyId: site.identity.companyId,
+				userId: "",
+				initialized: true,
+				huskyVersion: "",
+				location: path.dirname(path.dirname(site.root)),
+				configPath: ""
+			},
+			customer: path.basename(path.dirname(site.root)),
+			rawContentRepo: site.root
+		};
+	}
+	throw notASiteCheckout();
+}
+/**
+* The environment of a checkout known only by its `identity.json`: the one it names, else `ENV_NAME`, else a
+* refusal — never production (#462). The working directory is a checkout, so the refusal says what it lacks rather
+* than `not_a_site_repo`.
+*/
+function identityEnvironment(named) {
+	const env = EnvName.safeParse(named).data ?? EnvName.safeParse(process.env.ENV_NAME).data;
+	if (env) return env;
+	throw new CliUserError("This site checkout's identity.json names no environment, and ENV_NAME is not set, so the environment is unknown.", "Set ENV_NAME=dev|staging|production, or pass -e <env> where the command takes it", "invalid_arguments");
+}
+/** What `loadSiteContext` throws outside a site checkout. */
+function notASiteCheckout() {
+	return new CliUserError("This command must be run from inside a Leed site checkout.", "cd into your site's checkout (the folder holding identity.json; see leed site list) and try again.", "not_a_site_repo");
+}
+//#endregion
+export { isCI as A, JSON_OPTION_FLAGS as B, importAndAnnounce as C, sameSite as D, readSites as E, siteIdentityPath as F, jsonModeFromOptions as H, progress as I, progressLines as L, findCheckoutRoot as M, rawContentSlot as N, upsertSite as O, readSiteIdentity as P, writeDiagnostic as R, sandboxTemplateDir as S, getSitesPath as T, resolveJsonMode as U, jsonModeFromEnv as V, resolveSiteRef as _, envOption as a, findSandboxRoot as b, siteRepoScope as c, saveSiteConfig as d, siteConfigFromEntry as f, livePath as g, findSiteForCheckout as h, detectSiteCompany as i, canonicalPath as j, writePrivateJson as k, currentSite as l, describeSites as m, cliApi as n, loadSiteContext as o, agreesWithIdentity as p, companyOption as r, siteEnvironment as s, authShared_exports as t, refreshSite as u, siteLabel as v, sitesWithLegacy as w, isSandboxIdentity as x, SANDBOX_COMPANY_ID as y, JSON_OPTION_DESCRIPTION as z };