@reddoorla/maintenance 0.82.0 → 0.83.0

package/dist/{init-3ZJ7Z5NG.js → init-FLGLJCMJ.js}

@@ -2,30 +2,30 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-ODC4PXZL.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   init
-} from "./chunk-ZXRRKKMR.js";
-import "./chunk-MGJ72BA4.js";
+} from "./chunk-6V7565O2.js";
+import "./chunk-UYCAF77E.js";
+import "./chunk-RJB3QUSP.js";
 import "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-FX7RAMGC.js";
-import "./chunk-K5JZ5KLO.js";
-import "./chunk-KRDLHAKK.js";
-import "./chunk-NT4WIP7I.js";
+import "./chunk-R6FPFMOS.js";
+import "./chunk-R4AB6GCT.js";
+import "./chunk-R53VL3RI.js";
 import "./chunk-Q276MZ7E.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
-import "./chunk-T4FQ6TZT.js";
-import "./chunk-GASBX52O.js";
-import "./chunk-YAMRVXOD.js";
+import "./chunk-QRDB4NLB.js";
 import "./chunk-LKGVSM2O.js";
+import "./chunk-GASBX52O.js";
+import "./chunk-VRWUL4TR.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-A3WDWNN5.js";
 import "./chunk-2OP4JKIQ.js";
 import {
@@ -107,4 +107,4 @@ async function runInitCommand(site, opts) {
 export {
   runInitCommand
 };
-//# sourceMappingURL=init-3ZJ7Z5NG.js.map
+//# sourceMappingURL=init-FLGLJCMJ.js.map

package/dist/{launch-FRCDOB56.js → launch-AVKH2JVF.js}

@@ -1,18 +1,18 @@
 import {
   selfUpdating
-} from "./chunk-7ADQL5Y3.js";
+} from "./chunk-THEFTZ7F.js";
 import "./chunk-MNDIED4M.js";
 import {
   writeAuditsToAirtable
-} from "./chunk-2BHSGLWR.js";
+} from "./chunk-XDCRVYFL.js";
 import {
   hasRealScores,
   lighthouseScoresFromResult
-} from "./chunk-LMCO7CYQ.js";
+} from "./chunk-OQFOMKBP.js";
 import "./chunk-5L3FPQIJ.js";
 import {
   resolveSites
-} from "./chunk-ODC4PXZL.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   queueDraft
 } from "./chunk-62VF32IC.js";
@@ -30,12 +30,12 @@ import "./chunk-SEEA6RXF.js";
 import "./chunk-73UFRZKY.js";
 import {
   runAudits
-} from "./chunk-T4FQ6TZT.js";
-import "./chunk-GASBX52O.js";
-import "./chunk-YAMRVXOD.js";
+} from "./chunk-QRDB4NLB.js";
 import "./chunk-LKGVSM2O.js";
+import "./chunk-GASBX52O.js";
+import "./chunk-VRWUL4TR.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-A3WDWNN5.js";
 import "./chunk-2OP4JKIQ.js";
 import {
@@ -46,7 +46,7 @@ import "./chunk-U5SZ4FOP.js";
 import {
   listWebsites,
   siteSlug
-} from "./chunk-YRM6EED7.js";
+} from "./chunk-CLWNAMUX.js";
 import {
   openBase,
   readAirtableConfig
@@ -216,4 +216,4 @@ async function runLaunchCommand(site, opts) {
 export {
   runLaunchCommand
 };
-//# sourceMappingURL=launch-FRCDOB56.js.map
+//# sourceMappingURL=launch-AVKH2JVF.js.map

package/dist/{lighthouse-airtable-I46QCEIS.js → lighthouse-airtable-CHANWVO6.js}

@@ -2,11 +2,11 @@ import {
   hasRealScores,
   lighthouseScoresFromResult,
   resolveSlugFromCwd
-} from "./chunk-LMCO7CYQ.js";
-import "./chunk-YRM6EED7.js";
+} from "./chunk-OQFOMKBP.js";
+import "./chunk-CLWNAMUX.js";
 export {
   hasRealScores,
   lighthouseScoresFromResult,
   resolveSlugFromCwd
 };
-//# sourceMappingURL=lighthouse-airtable-I46QCEIS.js.map
+//# sourceMappingURL=lighthouse-airtable-CHANWVO6.js.map

package/dist/{onboard-45NPDMMW.js → onboard-HF4FTJDE.js}

@@ -5,18 +5,18 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-ODC4PXZL.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   onboard
-} from "./chunk-NT4WIP7I.js";
+} from "./chunk-UYCAF77E.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
@@ -70,4 +70,4 @@ async function runOnboardCommand(site, opts) {
 export {
   runOnboardCommand
 };
-//# sourceMappingURL=onboard-45NPDMMW.js.map
+//# sourceMappingURL=onboard-HF4FTJDE.js.map

package/dist/{orchestrate-34JYNIXT.js → orchestrate-5FMNYJEA.js}

@@ -4,7 +4,7 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-FFI7P74K.js";
+} from "./chunk-PBCGXXG6.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
@@ -14,7 +14,7 @@ import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
 import "./chunk-4SOCPK7A.js";
 import "./chunk-U5SZ4FOP.js";
-import "./chunk-YRM6EED7.js";
+import "./chunk-CLWNAMUX.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
 export {
@@ -24,4 +24,4 @@ export {
   sendApprovedReports,
   withGlobalCc
 };
-//# sourceMappingURL=orchestrate-34JYNIXT.js.map
+//# sourceMappingURL=orchestrate-5FMNYJEA.js.map

package/dist/{preflight-WVD32COX.js → preflight-HTWIX3MN.js}

@@ -1,8 +1,8 @@
 import {
   preflight
-} from "./chunk-5E4L7WKE.js";
+} from "./chunk-5P2HVNLZ.js";
 import "./chunk-D4FVAIEJ.js";
-import "./chunk-FFI7P74K.js";
+import "./chunk-PBCGXXG6.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
@@ -12,7 +12,7 @@ import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
 import "./chunk-4SOCPK7A.js";
 import "./chunk-U5SZ4FOP.js";
-import "./chunk-YRM6EED7.js";
+import "./chunk-CLWNAMUX.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
 
@@ -63,4 +63,4 @@ async function runPreflightCommand(site, opts) {
 export {
   runPreflightCommand
 };
-//# sourceMappingURL=preflight-WVD32COX.js.map
+//# sourceMappingURL=preflight-HTWIX3MN.js.map

package/dist/prismic-ci-BH225Q4L.js

@@ -0,0 +1,363 @@
+import {
+  noWorkingTreeFailure,
+  readPrismicConfig
+} from "./chunk-VNB5XBQ4.js";
+import {
+  runRecipeOverSites
+} from "./chunk-VPJ7N6P7.js";
+import {
+  appendSkipNotice,
+  fleetWorkdir,
+  prepareFleetSites
+} from "./chunk-ZMIPG6TR.js";
+import {
+  resolveSites
+} from "./chunk-MQUOUVQP.js";
+import {
+  PRETTIER_FLAG_NOTE,
+  formatWithPrettier,
+  resolveTargetPrettier
+} from "./chunk-R53VL3RI.js";
+import {
+  readGitHubConfig
+} from "./chunk-GASBX52O.js";
+import {
+  makeGitHub
+} from "./chunk-VRWUL4TR.js";
+import "./chunk-FDIFTIXC.js";
+import {
+  defaultSpawn
+} from "./chunk-4DHQCN5H.js";
+import {
+  siteLabel
+} from "./chunk-XXTZBPUY.js";
+import {
+  branchName,
+  checkoutBranch,
+  commit,
+  createBranch,
+  currentBranch,
+  deleteBranch,
+  isOwnerRepo,
+  isWorkingTreeClean,
+  push
+} from "./chunk-XTK5VIQB.js";
+import "./chunk-U5SZ4FOP.js";
+
+// src/cli/commands/prismic-ci.ts
+import { readdir } from "fs/promises";
+import { resolve } from "path";
+
+// src/recipes/prismic-ci/index.ts
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { dirname, join } from "path";
+
+// src/recipes/prismic-ci/template.ts
+var WORKFLOW_PATH = ".github/workflows/prismic-models.yml";
+var SECRET = "PRISMIC_WRITE_TOKEN";
+var REUSABLE_WORKFLOW = "reddoorla/.github/.github/workflows/prismic-models.yml";
+var APPLY_BRANCH = "main";
+var REUSABLE_WORKFLOW_PIN = {
+  sha: "558395431ddcb481ecba3dd84b78b38c338cfa03",
+  tag: "v1.4.0"
+};
+function isPinResolved(pin) {
+  return /^[0-9a-f]{40}$/.test(pin.sha);
+}
+function prismicCiWorkflow(pin) {
+  return `# Delivers this site's Prismic model changes. Managed by @reddoorla/maintenance
+# (\`reddoor-maint prismic-ci\`) \u2014 change it there and re-run, not here.
+#
+# On a PR touching a model: comment the delta, write nothing.
+# On merge to ${APPLY_BRANCH}: push those models to Prismic. Never delete.
+#
+# THE BRANCH FILTER ON \`push:\` IS LOAD-BEARING, not tidiness. The reusable
+# workflow's apply job also guards \`github.ref == 'refs/heads/${APPLY_BRANCH}'\`,
+# and its comment calls this the other half of that gate: an unfiltered
+# \`on: push:\` fires on every branch AND every tag, so a feature branch's models
+# would reach production with no pull request and therefore no review anywhere in
+# the sequence. Keep both halves.
+name: prismic-models
+
+on:
+  # No branch filter here, deliberately: a model PR into any base deserves its
+  # delta comment, and the dry job is INCAPABLE of writing \u2014 it never passes
+  # \`--apply\`, and it holds no job that does.
+  pull_request:
+    paths:
+      - "customtypes/**"
+      - "src/lib/slices/**/model.json"
+  push:
+    branches: [${APPLY_BRANCH}]
+    paths:
+      - "customtypes/**"
+      - "src/lib/slices/**/model.json"
+
+jobs:
+  prismic-models:
+    # A called workflow's jobs can only NARROW what the caller granted, so the
+    # PR-comment permission has to be granted here as well as there. Nothing in
+    # either job pushes code, so \`contents\` stays read.
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: ${REUSABLE_WORKFLOW}@${pin.sha} # ${pin.tag}
+    secrets:
+      # Spelled exactly as the reusable workflow declares it. A workflow-local
+      # alias would not be a rename \u2014 it would be an undeclared secret, and the
+      # required one would arrive empty.
+      ${SECRET}: \${{ secrets.${SECRET} }}
+`;
+}
+var PRISMIC_CI_WORKFLOW = prismicCiWorkflow(REUSABLE_WORKFLOW_PIN);
+
+// src/recipes/prismic-ci/index.ts
+var BRANCH_PREFIX = "maint/prismic-ci-";
+var PRETTIER_TIMEOUT_MS = 6e4;
+var resultOf = (site, status, notes, commits = []) => ({
+  recipe: "prismic-ci",
+  site: siteLabel(site),
+  status,
+  commits,
+  notes
+});
+var messageOf = (err) => err instanceof Error ? err.message : String(err);
+function sameWorkflow(current, canonical) {
+  const norm = (s) => s.replace(/\r\n/g, "\n").replace(/\s+$/, "");
+  return norm(current) === norm(canonical);
+}
+async function prismicCi(site, deps = {}) {
+  const repo = site.gitRepo;
+  if (!repo) {
+    return resultOf(site, "failed", "no Git repo on this site (set Airtable 'Git repo')");
+  }
+  if (!isOwnerRepo(repo)) {
+    return resultOf(
+      site,
+      "failed",
+      `refusing to act on malformed repo identity: expected "owner/repo", got ${JSON.stringify(repo)}`
+    );
+  }
+  let isPrismic;
+  try {
+    isPrismic = await readPrismicConfig(site.path) !== null;
+  } catch (err) {
+    return resultOf(site, "failed", `could not read the Prismic config: ${messageOf(err)}`);
+  }
+  if (!isPrismic) return resultOf(site, "noop", "not a Prismic site (no repositoryName) \u2014 skipped");
+  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;
+  if (!isPinResolved(pin)) {
+    return resultOf(
+      site,
+      "failed",
+      `reusable-workflow pin is unresolved (${pin.sha}) \u2014 publish + tag the workflow in reddoorla/.github and set REUSABLE_WORKFLOW_PIN before rolling out`
+    );
+  }
+  const workflow = pin === REUSABLE_WORKFLOW_PIN ? PRISMIC_CI_WORKFLOW : prismicCiWorkflow(pin);
+  const ghConfig = readGitHubConfig();
+  if (!deps.github && !ghConfig) return resultOf(site, "failed", "GITHUB_TOKEN not set");
+  const gh = deps.github ?? makeGitHub({ token: ghConfig.token });
+  const spawn = deps.spawn ?? defaultSpawn;
+  let hasSecret;
+  try {
+    hasSecret = await gh.secretExists(repo, SECRET);
+  } catch (err) {
+    return resultOf(
+      site,
+      "failed",
+      `could not determine whether ${repo} has the ${SECRET} secret (${messageOf(err)}) \u2014 refusing to install a workflow that may have no token`
+    );
+  }
+  if (!hasSecret) {
+    return resultOf(
+      site,
+      "failed",
+      `${repo} has no ${SECRET} Actions secret \u2014 the workflow reds the repo on its first model PR without it. Mint one, then: gh secret set ${SECRET} --repo ${repo}`
+    );
+  }
+  let base;
+  try {
+    base = await gh.defaultBranch(repo);
+  } catch (err) {
+    return resultOf(
+      site,
+      "failed",
+      `could not read the default branch of ${repo}: ${messageOf(err)}`
+    );
+  }
+  if (base !== APPLY_BRANCH) {
+    return resultOf(
+      site,
+      "failed",
+      `default branch of ${repo} is ${base}, not ${APPLY_BRANCH} \u2014 the reusable workflow's apply job guards refs/heads/${APPLY_BRANCH}, so merged model changes would never reach Prismic`
+    );
+  }
+  const existing = await gh.fileContentsOnBranch(repo, base, WORKFLOW_PATH);
+  if (existing !== null && sameWorkflow(existing, workflow)) {
+    return resultOf(site, "noop", `delivery workflow already current on ${base}`);
+  }
+  const open = (await gh.openPullRequests(repo)).find((pr) => pr.headRef.startsWith(BRANCH_PREFIX));
+  if (open) {
+    return resultOf(site, "noop", `delivery workflow PR already open: ${open.url}`);
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    return resultOf(site, "failed", "working tree not clean \u2014 commit or stash first");
+  }
+  let original = null;
+  try {
+    original = await currentBranch(site.path);
+  } catch {
+  }
+  const branch = branchName("prismic-ci");
+  const commits = [];
+  let pushedOrOpened = false;
+  try {
+    await createBranch(site.path, branch);
+    const dest = join(site.path, WORKFLOW_PATH);
+    await mkdir(dirname(dest), { recursive: true });
+    await writeFile(dest, workflow, "utf-8");
+    const notes = [];
+    const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(site.path);
+    if (bin === null) {
+      notes.push(PRETTIER_FLAG_NOTE);
+    } else if (!await formatWithPrettier(spawn, site.path, [WORKFLOW_PATH], {
+      bin,
+      timeoutMs: PRETTIER_TIMEOUT_MS
+    })) {
+      notes.push(PRETTIER_FLAG_NOTE);
+    } else if (!sameWorkflow(await readFile(dest, "utf-8"), workflow)) {
+      notes.push(
+        "this site's prettier reformatted the workflow \u2014 re-runs will not match it as current"
+      );
+    }
+    const sha = await commit(site.path, "ci: deliver Prismic model changes from merged PRs");
+    if (!sha) {
+      return resultOf(
+        site,
+        "noop",
+        `${WORKFLOW_PATH} already present and identical in the checkout`
+      );
+    }
+    commits.push(sha);
+    pushedOrOpened = true;
+    await (deps.pushBranch ?? push)(site.path, branch);
+    const pr = await gh.openPullRequest(repo, {
+      head: branch,
+      base,
+      title: "Deliver Prismic model changes from merged PRs",
+      body: "Adds the `prismic-models` workflow. On a PR touching `customtypes/**` or `src/lib/slices/**/model.json` it comments the model delta and writes nothing; on merge to main it pushes those models to Prismic. It can create and update models but never delete \u2014 a model present only in Prismic is reported, not touched."
+    });
+    notes.unshift(`opened PR ${pr.url}`);
+    return resultOf(site, "applied", notes.join("; "), commits);
+  } catch (err) {
+    return resultOf(site, "failed", messageOf(err), commits);
+  } finally {
+    if (original !== null && original !== branch) {
+      try {
+        await checkoutBranch(site.path, original);
+        if (!pushedOrOpened) await deleteBranch(site.path, branch);
+      } catch (err) {
+        console.warn(
+          `warning: could not restore branch ${original} after prismic-ci: ${messageOf(err)}`
+        );
+      }
+    }
+  }
+}
+
+// src/cli/commands/prismic-ci.ts
+var messageOf2 = (err) => err instanceof Error ? err.message : String(err);
+var failedRow = (site, notes) => ({
+  recipe: "prismic-ci",
+  site,
+  status: "failed",
+  commits: [],
+  notes
+});
+function formatPrismicCiResults(results) {
+  const lines = results.map((r) => `[${r.site}] ${r.status}: ${r.notes ?? ""}`.trimEnd());
+  const n = (s) => results.filter((r) => r.status === s).length;
+  const failed = n("failed");
+  lines.push("");
+  if (failed > 0 && n("applied") === 0) {
+    lines.push(
+      `\u26D4 NO SITE GOT THE DELIVERY WORKFLOW. ${failed} of ${results.length} site(s) failed and not one pull request was opened, so no site's model changes reach Prismic on merge. Do NOT read this run as a rollout.`
+    );
+    lines.push("");
+  }
+  lines.push(`${n("applied")} applied, ${n("noop")} noop, ${failed} failed.`);
+  return lines.join("\n");
+}
+async function checkoutFailure(repoRoot) {
+  let entries;
+  try {
+    entries = await readdir(repoRoot);
+  } catch (e) {
+    return `cannot read this checkout at ${repoRoot}: ${messageOf2(e)}`;
+  }
+  return noWorkingTreeFailure(
+    repoRoot,
+    entries,
+    "No delivery workflow was proposed for it and no pull request was opened"
+  );
+}
+async function runPrismicCiCommand(site, opts, deps = {}) {
+  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    // Passed through because `--fleet airtable` derives each site's path from
+    // it; without it the keyword inventory would resolve paths under a different
+    // workdir than the one this run then prepares and commits in.
+    ...opts.workdir !== void 0 ? { workdir: opts.workdir } : {},
+    cwd
+  });
+  if (sites.length === 0) {
+    return {
+      output: `the inventory resolved NO SITES, so no site was offered the delivery workflow. This is not a delivered fleet \u2014 check the inventory (an Airtable view filter, an empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a rollout.`,
+      code: 1
+    };
+  }
+  let skipped = [];
+  if (opts.fleet) {
+    const prep = await prepareFleetSites(sites, { workdir: opts.workdir ?? fleetWorkdir() });
+    sites = prep.prepared;
+    skipped = prep.skipped;
+  }
+  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;
+  const pinUnresolved = !isPinResolved(pin) ? `\u26D4 the reusable-workflow pin is unresolved (${pin.sha}) \u2014 every site below would be REFUSED, not delivered. Publish and tag the workflow in reddoorla/.github, then set REUSABLE_WORKFLOW_PIN.` : "";
+  if (opts.dry) {
+    const lines = sites.map(
+      (s) => `[${siteLabel(s)}] would be offered the delivery workflow (no gate was evaluated: the secret, default-branch and already-delivered checks run only on a real run)`
+    );
+    return {
+      output: appendSkipNotice(
+        [pinUnresolved, lines.join("\n")].filter((s) => s !== "").join("\n\n"),
+        skipped
+      ),
+      code: pinUnresolved === "" ? 0 : 1
+    };
+  }
+  const run = deps.runRecipe ?? ((s) => prismicCi(s, { pin }));
+  const results = await runRecipeOverSites("prismic-ci", sites, async (s) => {
+    const failure = await checkoutFailure(s.path);
+    return failure ? failedRow(siteLabel(s), failure) : run(s);
+  });
+  for (const s of skipped) {
+    results.push(
+      failedRow(
+        s.site,
+        `could not prepare this checkout: ${s.reason}. No delivery workflow was proposed for it \u2014 this is NOT "this site already has one".`
+      )
+    );
+  }
+  return {
+    output: appendSkipNotice(formatPrismicCiResults(results), skipped),
+    code: results.some((r) => r.status === "failed") ? 1 : 0
+  };
+}
+export {
+  formatPrismicCiResults,
+  runPrismicCiCommand
+};
+//# sourceMappingURL=prismic-ci-BH225Q4L.js.map

package/dist/prismic-ci-BH225Q4L.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/prismic-ci.ts","../src/recipes/prismic-ci/index.ts","../src/recipes/prismic-ci/template.ts"],"sourcesContent":["// The fleet face of the `prismic-ci` recipe: land the Prismic model delivery\n// workflow across the fleet, as ONE PULL REQUEST PER REPOSITORY.\n//\n// The blast radius is fifteen live client repositories, and the failure this\n// file is written against is not a bad PR — the recipe's gates handle that, and\n// nothing here can push to a client's main. It is the QUIET one: a run that\n// touched nothing and exited 0, read as a finished rollout. Three facts only the\n// fleet layer can get wrong produce it, and each has a refusal below:\n//\n//   - an inventory that resolved NOBODY prints \"0 applied, 0 noop, 0 failed.\"\n//     and exits 0, which is indistinguishable from a fleet with nothing left to\n//     do. The Airtable inventory is view-filtered; one filter change empties it\n//     with no error anywhere.\n//   - a site that could not be PREPARED is isolated into `skipped` by\n//     `prepareFleetSites` (correctly — one bad row must not abort the fleet) and\n//     then disappears from a summary built out of `prepared` alone. It gets a\n//     `failed` ROW, because the count is the only thing a machine reads.\n//   - a checkout holding `.git` and nothing else answers \"not a Prismic site\" to\n//     every read inside it, so the site noops out of the rollout for good — a\n//     fleet workdir reuses any non-empty directory forever. Guarded BEFORE the\n//     recipe runs: a tree nobody established is not a tree to branch from.\n//\n// SEQUENTIAL, one site at a time, like every other fleet recipe command — see\n// `runRecipeOverSites`. Each site does git work in its own checkout plus a\n// handful of GitHub calls; there is no Airtable write on this path (so the\n// fleet's ≤4.5 req/s throttle does not apply) and nothing parallelism would buy\n// except a burst of writes against fifteen repositories at once.\nimport { readdir } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { prismicCi } from \"../../recipes/prismic-ci/index.js\";\nimport {\n  REUSABLE_WORKFLOW_PIN,\n  isPinResolved,\n  type ReusableWorkflowPin,\n} from \"../../recipes/prismic-ci/template.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { noWorkingTreeFailure } from \"../../util/working-tree.js\";\nimport { appendSkipNotice, prepareFleetSites, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { runRecipeOverSites } from \"../fleet/run-recipe-over-sites.js\";\n\nexport type PrismicCiCommandOptions = {\n  fleet?: string;\n  workdir?: string;\n  dry?: boolean;\n  cwd?: string;\n};\n\n/** Injected only by tests, so the fleet layer's aggregation — counts, exit code,\n *  refusals — is exercised without git, GitHub or a network. Production runs the\n *  real recipe. */\nexport type PrismicCiCommandDeps = {\n  runRecipe?: (site: Site) => Promise<RecipeResult>;\n  /**\n   * Which `reddoorla/.github` commit this run would pin. Injected only by tests;\n   * production uses the shipped {@link REUSABLE_WORKFLOW_PIN}.\n   *\n   * It is injectable because the unresolved-pin refusal is a SAFETY behaviour\n   * that must be tested in both directions at all times, and a test that reads\n   * the shipped constant can only ever exercise whichever direction the constant\n   * currently happens to be in. Two tests here did exactly that, and the release\n   * that resolved the pin turned them from \"the refusal works\" into a red suite\n   * with the refusal itself no longer covered by anything.\n   */\n  pin?: ReusableWorkflowPin;\n};\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\nconst failedRow = (site: string, notes: string): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site,\n  status: \"failed\",\n  commits: [],\n  notes,\n});\n\n/**\n * One line per site plus a counts summary — the shape every fleet rollout\n * prints, so a sweep over fifteen repos is scannable.\n *\n * The banner above the counts is not decoration. A rollout in which every site\n * failed prints fifteen `[site] failed:` lines and then an arithmetic exercise;\n * the one fact an operator needs from that run — NOT ONE repository got the\n * workflow — has to be stated. It is keyed on \"sites were attempted and none was\n * applied\", not on \"nothing was applied\": a fleet that is already fully\n * delivered applies nothing every time it runs, and a banner that shouts at that\n * run is a banner nobody reads at the run above.\n */\nexport function formatPrismicCiResults(results: RecipeResult[]): string {\n  const lines = results.map((r) => `[${r.site}] ${r.status}: ${r.notes ?? \"\"}`.trimEnd());\n  const n = (s: RecipeResult[\"status\"]) => results.filter((r) => r.status === s).length;\n  const failed = n(\"failed\");\n  lines.push(\"\");\n  if (failed > 0 && n(\"applied\") === 0) {\n    lines.push(\n      `⛔ NO SITE GOT THE DELIVERY WORKFLOW. ${failed} of ${results.length} site(s) failed and` +\n        ` not one pull request was opened, so no site's model changes reach Prismic on merge.` +\n        ` Do NOT read this run as a rollout.`,\n    );\n    lines.push(\"\");\n  }\n  lines.push(`${n(\"applied\")} applied, ${n(\"noop\")} noop, ${failed} failed.`);\n  return lines.join(\"\\n\");\n}\n\n/**\n * Is there a checkout here at all, or the named reason there is not?\n *\n * Runs BEFORE the recipe, for both the reason in {@link noWorkingTreeFailure}\n * and one this command adds: the recipe's next steps create a branch, write a\n * file and commit it. A directory nobody managed to check out is not a tree to\n * do that in, and the answer the recipe would otherwise reach — \"not a Prismic\n * site\" — is the one answer that quietly removes the site from the rollout.\n *\n * A `readdir` that THROWS is its own failure and never the skip: a path that\n * does not exist, or one this process cannot read, is not a repo without\n * Prismic in it.\n */\nasync function checkoutFailure(repoRoot: string): Promise<string | null> {\n  let entries: string[];\n  try {\n    entries = await readdir(repoRoot);\n  } catch (e) {\n    return `cannot read this checkout at ${repoRoot}: ${messageOf(e)}`;\n  }\n  return noWorkingTreeFailure(\n    repoRoot,\n    entries,\n    \"No delivery workflow was proposed for it and no pull request was opened\",\n  );\n}\n\n/**\n * Roll the delivery workflow out to one site or to the fleet.\n *\n * `resolveSites` is allowed to THROW (a positional site alongside `--fleet`, an\n * unsupported inventory extension, an Airtable read that failed). Those are \"the\n * fleet itself could not be established\", which has no per-site row to live in\n * and must not be reported as a rollout across zero sites; `bin.ts` prints the\n * message and exits with the error's own `exitCode`.\n */\nexport async function runPrismicCiCommand(\n  site: string | undefined,\n  opts: PrismicCiCommandOptions,\n  deps: PrismicCiCommandDeps = {},\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    // Passed through because `--fleet airtable` derives each site's path from\n    // it; without it the keyword inventory would resolve paths under a different\n    // workdir than the one this run then prepares and commits in.\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  // NOTHING RESOLVED IS NOT A DELIVERED FLEET — the refusal `runFleetSweep` and\n  // the token doctor both open with, for the same reason: the summary below\n  // would print \"0 applied, 0 noop, 0 failed.\" over no rows at all and exit 0,\n  // which is exactly what a finished rollout looks like.\n  if (sites.length === 0) {\n    return {\n      output:\n        `the inventory resolved NO SITES, so no site was offered the delivery workflow.` +\n        ` This is not a delivered fleet — check the inventory (an Airtable view filter, an` +\n        ` empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a` +\n        ` rollout.`,\n      code: 1,\n    };\n  }\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const prep = await prepareFleetSites(sites, { workdir: opts.workdir ?? fleetWorkdir() });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  // THE PIN, checked here as well as in the recipe — not a second copy of the\n  // gate but the same exported predicate on the same pin, asked at the one point\n  // the recipe cannot answer for: a `--dry` run never reaches the recipe at all,\n  // and a preview that promised fifteen pull requests the real run would refuse\n  // is a preview of something that cannot happen.\n  //\n  // ONE pin object serves both this preview and the recipe below, so the preview\n  // can never be answering about a different pin than the run it previews.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  const pinUnresolved = !isPinResolved(pin)\n    ? `⛔ the reusable-workflow pin is unresolved (${pin.sha}) — every site` +\n      ` below would be REFUSED, not delivered. Publish and tag the workflow in` +\n      ` reddoorla/.github, then set REUSABLE_WORKFLOW_PIN.`\n    : \"\";\n\n  if (opts.dry) {\n    const lines = sites.map(\n      (s) =>\n        `[${siteLabel(s)}] would be offered the delivery workflow (no gate was evaluated:` +\n        ` the secret, default-branch and already-delivered checks run only on a real run)`,\n    );\n    return {\n      output: appendSkipNotice(\n        [pinUnresolved, lines.join(\"\\n\")].filter((s) => s !== \"\").join(\"\\n\\n\"),\n        skipped,\n      ),\n      code: pinUnresolved === \"\" ? 0 : 1,\n    };\n  }\n\n  const run = deps.runRecipe ?? ((s: Site) => prismicCi(s, { pin }));\n  const results = await runRecipeOverSites(\"prismic-ci\", sites, async (s) => {\n    const failure = await checkoutFailure(s.path);\n    return failure ? failedRow(siteLabel(s), failure) : run(s);\n  });\n\n  // A SITE THAT COULD NOT BE PREPARED IS A SITE THAT DID NOT GET THE WORKFLOW,\n  // and it gets a row. `prepareFleetSites` isolates the clone failure into\n  // `skipped`, which is right and is also exactly how a site disappears: a\n  // summary walking `prepared` alone counts a fleet-wide clone outage — an\n  // expired App token, GitHub down, a full disk — as \"0 applied, 0 failed\",\n  // exit 0. The notice below stays; the row is what makes the site countable.\n  for (const s of skipped) {\n    results.push(\n      failedRow(\n        s.site,\n        `could not prepare this checkout: ${s.reason}. No delivery workflow was proposed` +\n          ` for it — this is NOT \"this site already has one\".`,\n      ),\n    );\n  }\n\n  return {\n    output: appendSkipNotice(formatPrismicCiResults(results), skipped),\n    code: results.some((r) => r.status === \"failed\") ? 1 : 0,\n  };\n}\n","import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { readGitHubConfig } from \"../../github/config.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport { readPrismicConfig } from \"../../prismic/models/index.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport {\n  branchName,\n  checkoutBranch,\n  commit as gitCommit,\n  createBranch,\n  currentBranch,\n  deleteBranch,\n  isOwnerRepo,\n  isWorkingTreeClean,\n  push as gitPush,\n} from \"../../util/git.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { formatWithPrettier, resolveTargetPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport {\n  APPLY_BRANCH,\n  PRISMIC_CI_WORKFLOW,\n  REUSABLE_WORKFLOW_PIN,\n  SECRET,\n  WORKFLOW_PATH,\n  isPinResolved,\n  prismicCiWorkflow,\n  type ReusableWorkflowPin,\n} from \"./template.js\";\n\n/** Head-branch prefix of every PR this recipe opens. `branchName(\"prismic-ci\")`\n *  produces `maint/prismic-ci-<timestamp>`, and the re-run guard matches on this\n *  prefix — the same idiom as `findOpenSelfUpdatingPR`. */\nconst BRANCH_PREFIX = \"maint/prismic-ci-\";\n\n/** How long the target's prettier gets. Also what makes the fleet's default\n *  spawn detach the child, so the kill reaches prettier and not just a wrapper.\n *  Matches the pull-down path's budget in `src/prismic/models/write.ts`. */\nconst PRETTIER_TIMEOUT_MS = 60_000;\n\n/** Just the GitHub surface this recipe touches, so a test fake is five methods\n *  rather than thirty. `makeGitHub()` satisfies it structurally. */\nexport type PrismicCiGitHub = Pick<\n  GitHub,\n  \"defaultBranch\" | \"secretExists\" | \"fileContentsOnBranch\" | \"openPullRequest\" | \"openPullRequests\"\n>;\n\nexport type PrismicCiDeps = {\n  github?: PrismicCiGitHub;\n  pushBranch?: (cwd: string, branch: string) => Promise<void>;\n  spawn?: SpawnFn;\n  /** Resolve the TARGET repo's own prettier. Injected so a test can assert the\n   *  absolute-path spawn without a populated `node_modules`. */\n  resolvePrettier?: (repoRoot: string) => Promise<string | null>;\n  /** Which `reddoorla/.github` commit the written workflow pins. Injected only\n   *  by tests; production uses the shipped pin. */\n  pin?: ReusableWorkflowPin;\n};\n\nconst resultOf = (\n  site: Site,\n  status: RecipeResult[\"status\"],\n  notes: string,\n  commits: string[] = [],\n): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site: siteLabel(site),\n  status,\n  commits,\n  notes,\n});\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\n/** Same normalization as `self-updating`'s config comparison: CRLF and a stray\n *  trailing newline are not drift, and treating them as drift opens a needless\n *  PR on every run. Any real content difference still differs. */\nfunction sameWorkflow(current: string, canonical: string): boolean {\n  const norm = (s: string) => s.replace(/\\r\\n/g, \"\\n\").replace(/\\s+$/, \"\");\n  return norm(current) === norm(canonical);\n}\n\n/**\n * Land the Prismic model delivery workflow in one repo, as a pull request.\n *\n * Everything before the first mutation is a gate, and the gates exist because\n * this recipe's output is the only path in the project that writes to a live\n * client's Prismic repository. Two of them are worth naming:\n *\n *  - THE SECRET. A workflow whose `PRISMIC_WRITE_TOKEN` does not exist yet goes\n *    red on the repo's first model PR. Landing 15 of those turns a rollout into\n *    15 red repos, so a definitively-absent secret FAILS the site rather than\n *    nooping it: \"this site was skipped and a human must act\" is not the same\n *    report as \"this site was already done\", and a rollout summary where those\n *    two look alike is how a site silently never gets model delivery. A secret\n *    whose existence could not be DETERMINED fails too, with different wording —\n *    they are different facts and the operator's next move differs.\n *\n *  - THE DEFAULT BRANCH. The reusable workflow's apply job hard-codes\n *    `refs/heads/main`. On a repo whose default branch is anything else, every\n *    model PR would merge green and never reach Prismic. Refuse instead.\n *\n * Nothing here can delete a model: the workflow it installs calls a module that\n * exports no delete path.\n */\nexport async function prismicCi(site: Site, deps: PrismicCiDeps = {}): Promise<RecipeResult> {\n  // 1. Repo identity. `failed`, not `noop`: a rollout that silently skips a site\n  //    is the failure this whole recipe is guarding against one level up. The\n  //    strict shape check runs BEFORE the first `gh` call, so a typo'd or\n  //    attacker-controlled value can never be interpolated into an API path.\n  const repo = site.gitRepo;\n  if (!repo) {\n    return resultOf(site, \"failed\", \"no Git repo on this site (set Airtable 'Git repo')\");\n  }\n  if (!isOwnerRepo(repo)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `refusing to act on malformed repo identity: expected \"owner/repo\", got ${JSON.stringify(repo)}`,\n    );\n  }\n\n  // 2. Is this a Prismic site? `readPrismicConfig` returns null for \"no Prismic\n  //    here\" and THROWS for a present-but-unreadable config — the distinction is\n  //    the point, so the throw becomes `failed` rather than being caught into\n  //    the skip branch.\n  let isPrismic: boolean;\n  try {\n    isPrismic = (await readPrismicConfig(site.path)) !== null;\n  } catch (err) {\n    return resultOf(site, \"failed\", `could not read the Prismic config: ${messageOf(err)}`);\n  }\n  if (!isPrismic) return resultOf(site, \"noop\", \"not a Prismic site (no repositoryName) — skipped\");\n\n  // 3. The pin. Checked before any network call: while it is unresolved NOTHING\n  //    can roll out, and 15 pointless API round-trips are not worth spending to\n  //    find that out per site.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  if (!isPinResolved(pin)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `reusable-workflow pin is unresolved (${pin.sha}) — publish + tag the workflow in ` +\n        `reddoorla/.github and set REUSABLE_WORKFLOW_PIN before rolling out`,\n    );\n  }\n  const workflow = pin === REUSABLE_WORKFLOW_PIN ? PRISMIC_CI_WORKFLOW : prismicCiWorkflow(pin);\n\n  const ghConfig = readGitHubConfig();\n  if (!deps.github && !ghConfig) return resultOf(site, \"failed\", \"GITHUB_TOKEN not set\");\n  const gh = deps.github ?? makeGitHub({ token: ghConfig!.token });\n  const spawn = deps.spawn ?? defaultSpawn;\n\n  // 4. The secret. Absent and unreadable are separate answers with separate\n  //    wording; neither proceeds.\n  let hasSecret: boolean;\n  try {\n    hasSecret = await gh.secretExists(repo, SECRET);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not determine whether ${repo} has the ${SECRET} secret (${messageOf(err)}) — ` +\n        `refusing to install a workflow that may have no token`,\n    );\n  }\n  if (!hasSecret) {\n    return resultOf(\n      site,\n      \"failed\",\n      `${repo} has no ${SECRET} Actions secret — the workflow reds the repo on its first ` +\n        `model PR without it. Mint one, then: gh secret set ${SECRET} --repo ${repo}`,\n    );\n  }\n\n  // 5. The default branch. NOT `.catch(() => \"main\")`: \"I could not read the\n  //    default branch\" and \"the default branch is main\" are opposite facts, and\n  //    guessing the second targets a PR (and an apply gate) at a branch nobody\n  //    confirmed.\n  let base: string;\n  try {\n    base = await gh.defaultBranch(repo);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not read the default branch of ${repo}: ${messageOf(err)}`,\n    );\n  }\n  if (base !== APPLY_BRANCH) {\n    return resultOf(\n      site,\n      \"failed\",\n      `default branch of ${repo} is ${base}, not ${APPLY_BRANCH} — the reusable workflow's ` +\n        `apply job guards refs/heads/${APPLY_BRANCH}, so merged model changes would never reach Prismic`,\n    );\n  }\n\n  // 6. Already delivered? Content-compared, not existence-compared, so a\n  //    present-but-STALE workflow (an older pin) is corrected rather than left\n  //    forever.\n  const existing = await gh.fileContentsOnBranch(repo, base, WORKFLOW_PATH);\n  if (existing !== null && sameWorkflow(existing, workflow)) {\n    return resultOf(site, \"noop\", `delivery workflow already current on ${base}`);\n  }\n\n  // 7. Already proposed? Without this, every run before the PR merges opens\n  //    another one. `fileContentsOnBranch` also answers null for a read it could\n  //    not perform (gh exits non-zero on both a 404 and an auth failure), which\n  //    makes this the backstop for that collapse as well.\n  const open = (await gh.openPullRequests(repo)).find((pr) => pr.headRef.startsWith(BRANCH_PREFIX));\n  if (open) {\n    return resultOf(site, \"noop\", `delivery workflow PR already open: ${open.url}`);\n  }\n\n  if (!(await isWorkingTreeClean(site.path))) {\n    return resultOf(site, \"failed\", \"working tree not clean — commit or stash first\");\n  }\n\n  // Capture the operator's branch BEFORE creating ours so the `finally` can put\n  // them back. Best-effort: if we cannot read it we skip the restore rather than\n  // guess at a branch to check out.\n  let original: string | null = null;\n  try {\n    original = await currentBranch(site.path);\n  } catch {\n    // Stays null (detached HEAD, git error) — the restore below is then skipped\n    // rather than aiming a checkout at a branch name we had to invent.\n  }\n  const branch = branchName(\"prismic-ci\");\n  const commits: string[] = [];\n  let pushedOrOpened = false;\n\n  try {\n    await createBranch(site.path, branch);\n    const dest = join(site.path, WORKFLOW_PATH);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, workflow, \"utf-8\");\n\n    // Format with the SITE's own prettier, resolved POSITIVELY and run by\n    // absolute path. `pnpm exec prettier` here would run a full `pnpm install`\n    // in the client's repo first (an unrequested mutation of a live client repo\n    // by a rollout that is supposed to add one file), and in a repo without\n    // prettier would then format with the CALLING repo's binary and exit 0.\n    const notes: string[] = [];\n    const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(site.path);\n    if (bin === null) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (\n      !(await formatWithPrettier(spawn, site.path, [WORKFLOW_PATH], {\n        bin,\n        timeoutMs: PRETTIER_TIMEOUT_MS,\n      }))\n    ) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (!sameWorkflow(await readFile(dest, \"utf-8\"), workflow)) {\n      // The site's prettier config disagrees with the template's shape (single\n      // quotes, a different tab width). Harmless for the workflow — but the\n      // step-6 comparison is byte-based, so this site will not recognise its own\n      // delivered workflow as current and will propose it again after each\n      // merge. Say so rather than let it be discovered as a mystery PR.\n      notes.push(\n        \"this site's prettier reformatted the workflow — re-runs will not match it as current\",\n      );\n    }\n\n    const sha = await gitCommit(site.path, \"ci: deliver Prismic model changes from merged PRs\");\n    if (!sha) {\n      // Git saw no change: the checkout already holds this exact workflow even\n      // though the default branch does not. Nothing to push and nothing to\n      // review — and pushing a commit-less branch would fail at PR creation.\n      return resultOf(\n        site,\n        \"noop\",\n        `${WORKFLOW_PATH} already present and identical in the checkout`,\n      );\n    }\n    commits.push(sha);\n    pushedOrOpened = true;\n    await (deps.pushBranch ?? gitPush)(site.path, branch);\n    const pr = await gh.openPullRequest(repo, {\n      head: branch,\n      base,\n      title: \"Deliver Prismic model changes from merged PRs\",\n      body:\n        \"Adds the `prismic-models` workflow. On a PR touching `customtypes/**` or \" +\n        \"`src/lib/slices/**/model.json` it comments the model delta and writes nothing; \" +\n        \"on merge to main it pushes those models to Prismic. It can create and update \" +\n        \"models but never delete — a model present only in Prismic is reported, not touched.\",\n    });\n    notes.unshift(`opened PR ${pr.url}`);\n    return resultOf(site, \"applied\", notes.join(\"; \"), commits);\n  } catch (err) {\n    return resultOf(site, \"failed\", messageOf(err), commits);\n  } finally {\n    // Restore the operator's branch on success AND on failure — otherwise a push\n    // error strands the checkout on the recipe branch with an unpushed commit,\n    // and the retry dies at createBranch. Best-effort; never masks the result.\n    if (original !== null && original !== branch) {\n      try {\n        await checkoutBranch(site.path, original);\n        // Nothing was pushed and no PR exists, so the local branch is litter and\n        // a re-run would leave another. Only ever the branch WE created.\n        if (!pushedOrOpened) await deleteBranch(site.path, branch);\n      } catch (err) {\n        console.warn(\n          `warning: could not restore branch ${original} after prismic-ci: ${messageOf(err)}`,\n        );\n      }\n    }\n  }\n}\n","/**\n * The caller workflow every Prismic site gets.\n *\n * Fully generic — no per-site values — because the token is the site's own\n * `PRISMIC_WRITE_TOKEN` secret, the name every site's code already reads.\n * Contrast `ci.yml`, which is deliberately NOT templated anywhere in this\n * package because it carries per-site `netlify-site:` / `node-version:` values\n * a byte template would strip fleet-wide.\n */\n\n/** Where the file lands in a site repo. Also the `gh api .../contents/<path>`\n *  segment, so it must stay traversal-free (`assertUrlSegment` re-checks). */\nexport const WORKFLOW_PATH = \".github/workflows/prismic-models.yml\";\n\n/** The Actions secret the reusable workflow declares as `required: true`, and\n *  the environment variable the CLI reads. Spelled ONCE, here, because the\n *  failure mode of a second spelling is silent: a caller passing a name the\n *  callee never declared supplies nothing, and the callee's required secret\n *  arrives empty at the one step that writes to a live client's Prismic repo. */\nexport const SECRET = \"PRISMIC_WRITE_TOKEN\";\n\n/** The reusable workflow, without a ref. */\nexport const REUSABLE_WORKFLOW = \"reddoorla/.github/.github/workflows/prismic-models.yml\";\n\n/**\n * The ONE branch this delivery path can run its apply job on.\n *\n * Not a preference — the reusable workflow's apply job hard-codes\n * `github.ref == 'refs/heads/main'`. On a repo whose default branch is anything\n * else, a merged model PR would produce a green check and never reach Prismic,\n * which is why the recipe refuses such a repo instead of installing a workflow\n * that silently cannot fire.\n */\nexport const APPLY_BRANCH = \"main\";\n\n/** A commit in `reddoorla/.github`, plus the release tag that commit carries.\n *  Both are written into the workflow: the SHA is what Actions resolves, the tag\n *  is what a human (and Renovate's github-actions manager) reads. */\nexport type ReusableWorkflowPin = { sha: string; tag: string };\n\n/**\n * What the shipped pin says while the reusable workflow has not been published\n * to `reddoorla/.github` and tagged yet (plan Task 25).\n *\n * DELIBERATELY NOT 40 HEX CHARACTERS. A placeholder shaped like a real SHA is\n * indistinguishable from a real one in review, and would install a workflow\n * referencing a commit that does not exist into 15 client repositories — where\n * it fails at workflow-load time, on every model PR, with an error that names\n * neither this file nor the reason. Unresolved must be unmistakable, and\n * {@link isPinResolved} is what the recipe gates on.\n */\nexport const UNRESOLVED_PIN_SHA = \"UNRESOLVED-publish-and-tag-reddoorla-dot-github-first\";\n\n/**\n * The pin the fleet rolls out.\n *\n * RESOLVED 2026-08-14. `reddoorla/.github#30` merged as\n * 558395431ddcb481ecba3dd84b78b38c338cfa03 and that commit was tagged v1.4.0;\n * `gh api repos/reddoorla/.github/commits/v1.4.0 --jq .sha` returns the SHA\n * below. `validate` (the digest-pinning + Renovate-preset check that is the\n * only CI in that repo) passed on the merge commit.\n *\n * TO RE-RESOLVE after a future `reddoorla/.github` release: set `sha` to\n * `gh api repos/reddoorla/.github/commits/<tag> --jq .sha` and `tag` to that\n * tag. Nothing else changes. Renovate's github-actions manager bumps the\n * already-installed `uses:` line per site repo; this constant is what NEW\n * rollouts install, so a stale value here is not a broken fleet, only a fleet\n * whose newest members start one version behind.\n */\nexport const REUSABLE_WORKFLOW_PIN: ReusableWorkflowPin = {\n  sha: \"558395431ddcb481ecba3dd84b78b38c338cfa03\",\n  tag: \"v1.4.0\",\n};\n\n/**\n * Is this pin a real commit reference?\n *\n * A full 40-hex SHA and nothing else. Not a tag, not a branch: this repo pins\n * every `uses:` to a commit (see `src/recipes/sync-configs/templates.ts`, whose\n * renovate template spells out why — a retagged `@v3` runs attacker code with\n * whatever token the workflow holds), and Renovate's github-actions manager\n * bumps the pin per repo when `reddoorla/.github` tags a new version.\n */\nexport function isPinResolved(pin: ReusableWorkflowPin): boolean {\n  return /^[0-9a-f]{40}$/.test(pin.sha);\n}\n\n/**\n * Render the caller workflow for a pin.\n *\n * Path-filtered on both triggers: this must not run on every commit, only when\n * a model changes.\n */\nexport function prismicCiWorkflow(pin: ReusableWorkflowPin): string {\n  return `# Delivers this site's Prismic model changes. Managed by @reddoorla/maintenance\n# (\\`reddoor-maint prismic-ci\\`) — change it there and re-run, not here.\n#\n# On a PR touching a model: comment the delta, write nothing.\n# On merge to ${APPLY_BRANCH}: push those models to Prismic. Never delete.\n#\n# THE BRANCH FILTER ON \\`push:\\` IS LOAD-BEARING, not tidiness. The reusable\n# workflow's apply job also guards \\`github.ref == 'refs/heads/${APPLY_BRANCH}'\\`,\n# and its comment calls this the other half of that gate: an unfiltered\n# \\`on: push:\\` fires on every branch AND every tag, so a feature branch's models\n# would reach production with no pull request and therefore no review anywhere in\n# the sequence. Keep both halves.\nname: prismic-models\n\non:\n  # No branch filter here, deliberately: a model PR into any base deserves its\n  # delta comment, and the dry job is INCAPABLE of writing — it never passes\n  # \\`--apply\\`, and it holds no job that does.\n  pull_request:\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n  push:\n    branches: [${APPLY_BRANCH}]\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n\njobs:\n  prismic-models:\n    # A called workflow's jobs can only NARROW what the caller granted, so the\n    # PR-comment permission has to be granted here as well as there. Nothing in\n    # either job pushes code, so \\`contents\\` stays read.\n    permissions:\n      contents: read\n      pull-requests: write\n    uses: ${REUSABLE_WORKFLOW}@${pin.sha} # ${pin.tag}\n    secrets:\n      # Spelled exactly as the reusable workflow declares it. A workflow-local\n      # alias would not be a rename — it would be an undeclared secret, and the\n      # required one would arrive empty.\n      ${SECRET}: \\${{ secrets.${SECRET} }}\n`;\n}\n\n/** The workflow as currently shipped. Unusable — and refused by the recipe —\n *  until {@link REUSABLE_WORKFLOW_PIN} is resolved. */\nexport const PRISMIC_CI_WORKFLOW = prismicCiWorkflow(REUSABLE_WORKFLOW_PIN);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,eAAe;AACxB,SAAS,eAAe;;;AC5BxB,SAAS,OAAO,UAAU,iBAAiB;AAC3C,SAAS,SAAS,YAAY;;;ACWvB,IAAM,gBAAgB;AAOtB,IAAM,SAAS;AAGf,IAAM,oBAAoB;AAW1B,IAAM,eAAe;AAoCrB,IAAM,wBAA6C;AAAA,EACxD,KAAK;AAAA,EACL,KAAK;AACP;AAWO,SAAS,cAAc,KAAmC;AAC/D,SAAO,iBAAiB,KAAK,IAAI,GAAG;AACtC;AAQO,SAAS,kBAAkB,KAAkC;AAClE,SAAO;AAAA;AAAA;AAAA;AAAA,gBAIO,YAAY;AAAA;AAAA;AAAA,iEAGqC,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAgB5D,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAajB,iBAAiB,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,QAK7C,MAAM,kBAAkB,MAAM;AAAA;AAEtC;AAIO,IAAM,sBAAsB,kBAAkB,qBAAqB;;;AD3G1E,IAAM,gBAAgB;AAKtB,IAAM,sBAAsB;AAqB5B,IAAM,WAAW,CACf,MACA,QACA,OACA,UAAoB,CAAC,OACH;AAAA,EAClB,QAAQ;AAAA,EACR,MAAM,UAAU,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,YAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAK5F,SAAS,aAAa,SAAiB,WAA4B;AACjE,QAAM,OAAO,CAAC,MAAc,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,QAAQ,EAAE;AACvE,SAAO,KAAK,OAAO,MAAM,KAAK,SAAS;AACzC;AAyBA,eAAsB,UAAU,MAAY,OAAsB,CAAC,GAA0B;AAK3F,QAAM,OAAO,KAAK;AAClB,MAAI,CAAC,MAAM;AACT,WAAO,SAAS,MAAM,UAAU,oDAAoD;AAAA,EACtF;AACA,MAAI,CAAC,YAAY,IAAI,GAAG;AACtB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,0EAA0E,KAAK,UAAU,IAAI,CAAC;AAAA,IAChG;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,gBAAa,MAAM,kBAAkB,KAAK,IAAI,MAAO;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,sCAAsC,UAAU,GAAG,CAAC,EAAE;AAAA,EACxF;AACA,MAAI,CAAC,UAAW,QAAO,SAAS,MAAM,QAAQ,uDAAkD;AAKhG,QAAM,MAAM,KAAK,OAAO;AACxB,MAAI,CAAC,cAAc,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,GAAG;AAAA,IAEjD;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,wBAAwB,sBAAsB,kBAAkB,GAAG;AAE5F,QAAM,WAAW,iBAAiB;AAClC,MAAI,CAAC,KAAK,UAAU,CAAC,SAAU,QAAO,SAAS,MAAM,UAAU,sBAAsB;AACrF,QAAM,KAAK,KAAK,UAAU,WAAW,EAAE,OAAO,SAAU,MAAM,CAAC;AAC/D,QAAM,QAAQ,KAAK,SAAS;AAI5B,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,GAAG,aAAa,MAAM,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,+BAA+B,IAAI,YAAY,MAAM,YAAY,UAAU,GAAG,CAAC;AAAA,IAEjF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAG,IAAI,WAAW,MAAM,qHACgC,MAAM,WAAW,IAAI;AAAA,IAC/E;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,GAAG,cAAc,IAAI;AAAA,EACpC,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,KAAK,UAAU,GAAG,CAAC;AAAA,IACjE;AAAA,EACF;AACA,MAAI,SAAS,cAAc;AACzB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,qBAAqB,IAAI,OAAO,IAAI,SAAS,YAAY,+DACxB,YAAY;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,GAAG,qBAAqB,MAAM,MAAM,aAAa;AACxE,MAAI,aAAa,QAAQ,aAAa,UAAU,QAAQ,GAAG;AACzD,WAAO,SAAS,MAAM,QAAQ,wCAAwC,IAAI,EAAE;AAAA,EAC9E;AAMA,QAAM,QAAQ,MAAM,GAAG,iBAAiB,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,WAAW,aAAa,CAAC;AAChG,MAAI,MAAM;AACR,WAAO,SAAS,MAAM,QAAQ,sCAAsC,KAAK,GAAG,EAAE;AAAA,EAChF;AAEA,MAAI,CAAE,MAAM,mBAAmB,KAAK,IAAI,GAAI;AAC1C,WAAO,SAAS,MAAM,UAAU,qDAAgD;AAAA,EAClF;AAKA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,cAAc,KAAK,IAAI;AAAA,EAC1C,QAAQ;AAAA,EAGR;AACA,QAAM,SAAS,WAAW,YAAY;AACtC,QAAM,UAAoB,CAAC;AAC3B,MAAI,iBAAiB;AAErB,MAAI;AACF,UAAM,aAAa,KAAK,MAAM,MAAM;AACpC,UAAM,OAAO,KAAK,KAAK,MAAM,aAAa;AAC1C,UAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,UAAU,OAAO;AAOvC,UAAM,QAAkB,CAAC;AACzB,UAAM,MAAM,OAAO,KAAK,mBAAmB,uBAAuB,KAAK,IAAI;AAC3E,QAAI,QAAQ,MAAM;AAChB,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WACE,CAAE,MAAM,mBAAmB,OAAO,KAAK,MAAM,CAAC,aAAa,GAAG;AAAA,MAC5D;AAAA,MACA,WAAW;AAAA,IACb,CAAC,GACD;AACA,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WAAW,CAAC,aAAa,MAAM,SAAS,MAAM,OAAO,GAAG,QAAQ,GAAG;AAMjE,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,OAAU,KAAK,MAAM,mDAAmD;AAC1F,QAAI,CAAC,KAAK;AAIR,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,GAAG,aAAa;AAAA,MAClB;AAAA,IACF;AACA,YAAQ,KAAK,GAAG;AAChB,qBAAiB;AACjB,WAAO,KAAK,cAAc,MAAS,KAAK,MAAM,MAAM;AACpD,UAAM,KAAK,MAAM,GAAG,gBAAgB,MAAM;AAAA,MACxC,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,MACE;AAAA,IAIJ,CAAC;AACD,UAAM,QAAQ,aAAa,GAAG,GAAG,EAAE;AACnC,WAAO,SAAS,MAAM,WAAW,MAAM,KAAK,IAAI,GAAG,OAAO;AAAA,EAC5D,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,UAAU,GAAG,GAAG,OAAO;AAAA,EACzD,UAAE;AAIA,QAAI,aAAa,QAAQ,aAAa,QAAQ;AAC5C,UAAI;AACF,cAAM,eAAe,KAAK,MAAM,QAAQ;AAGxC,YAAI,CAAC,eAAgB,OAAM,aAAa,KAAK,MAAM,MAAM;AAAA,MAC3D,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,qCAAqC,QAAQ,sBAAsB,UAAU,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ADnPA,IAAMA,aAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE5F,IAAM,YAAY,CAAC,MAAc,WAAiC;AAAA,EAChE,QAAQ;AAAA,EACR;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,CAAC;AAAA,EACV;AACF;AAcO,SAAS,uBAAuB,SAAiC;AACtE,QAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;AACtF,QAAM,IAAI,CAAC,MAA8B,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;AAC/E,QAAM,SAAS,EAAE,QAAQ;AACzB,QAAM,KAAK,EAAE;AACb,MAAI,SAAS,KAAK,EAAE,SAAS,MAAM,GAAG;AACpC,UAAM;AAAA,MACJ,6CAAwC,MAAM,OAAO,QAAQ,MAAM;AAAA,IAGrE;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AACA,QAAM,KAAK,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,MAAM,UAAU;AAC1E,SAAO,MAAM,KAAK,IAAI;AACxB;AAeA,eAAe,gBAAgB,UAA0C;AACvE,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,QAAQ;AAAA,EAClC,SAAS,GAAG;AACV,WAAO,gCAAgC,QAAQ,KAAKA,WAAU,CAAC,CAAC;AAAA,EAClE;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAWA,eAAsB,oBACpB,MACA,MACA,OAA6B,CAAC,GACa;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,IAIxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAMD,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,QACE;AAAA,MAIF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,SAAS,KAAK,WAAW,aAAa,EAAE,CAAC;AACvF,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAUA,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,gBAAgB,CAAC,cAAc,GAAG,IACpC,mDAA8C,IAAI,GAAG,kJAGrD;AAEJ,MAAI,KAAK,KAAK;AACZ,UAAM,QAAQ,MAAM;AAAA,MAClB,CAAC,MACC,IAAI,UAAU,CAAC,CAAC;AAAA,IAEpB;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,CAAC,eAAe,MAAM,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,MAAM;AAAA,QACrE;AAAA,MACF;AAAA,MACA,MAAM,kBAAkB,KAAK,IAAI;AAAA,IACnC;AAAA,EACF;AAEA,QAAM,MAAM,KAAK,cAAc,CAAC,MAAY,UAAU,GAAG,EAAE,IAAI,CAAC;AAChE,QAAM,UAAU,MAAM,mBAAmB,cAAc,OAAO,OAAO,MAAM;AACzE,UAAM,UAAU,MAAM,gBAAgB,EAAE,IAAI;AAC5C,WAAO,UAAU,UAAU,UAAU,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC;AAAA,EAC3D,CAAC;AAQD,aAAW,KAAK,SAAS;AACvB,YAAQ;AAAA,MACN;AAAA,QACE,EAAE;AAAA,QACF,oCAAoC,EAAE,MAAM;AAAA,MAE9C;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,iBAAiB,uBAAuB,OAAO,GAAG,OAAO;AAAA,IACjE,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,EACzD;AACF;","names":["messageOf"]}