@reddoorla/maintenance 0.82.0 → 0.83.0

package/dist/prismic-models-HXCAM4ZL.js

@@ -0,0 +1,1020 @@
+import {
+  describeDiff,
+  diffModels,
+  localModels,
+  noWorkingTreeFailure,
+  prismicTokenEnvName,
+  pushModels,
+  readPrismicConfig,
+  remoteModels,
+  resolvePrismicToken,
+  sendModel,
+  writeModelFile
+} from "./chunk-VNB5XBQ4.js";
+import {
+  appendSkipNotice,
+  fleetWorkdir,
+  prepareFleetSites
+} from "./chunk-ZMIPG6TR.js";
+import {
+  resolveSites
+} from "./chunk-MQUOUVQP.js";
+import {
+  PRETTIER_FLAG_NOTE,
+  formatWithPrettier
+} from "./chunk-R53VL3RI.js";
+import "./chunk-FDIFTIXC.js";
+import {
+  makeSpawn
+} from "./chunk-4DHQCN5H.js";
+import {
+  siteLabel
+} from "./chunk-XXTZBPUY.js";
+import "./chunk-XTK5VIQB.js";
+import "./chunk-U5SZ4FOP.js";
+import {
+  siteSlug
+} from "./chunk-CLWNAMUX.js";
+
+// src/cli/commands/prismic-models.ts
+import { readdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
+import { basename, join, resolve } from "path";
+
+// src/cli/commands/prismic-models-report.ts
+function isClean(diff) {
+  return diff.toCreate.length === 0 && diff.toUpdate.length === 0 && diff.remoteOnly.length === 0;
+}
+var key = (e) => `${e.kind}:${e.id}`;
+var keysOf = (xs) => new Set(xs.map(key));
+var minus = (a, b) => [...a].filter((k) => !b.has(k)).sort();
+var intersect = (a, b) => [...a].filter((k) => b.has(k)).sort();
+function reconcileReport(diff, opts) {
+  const out = [];
+  const work = keysOf([...diff.toCreate, ...diff.toUpdate.map((u) => u.local)]);
+  if (opts.failed !== void 0) {
+    for (const k of minus(keysOf(opts.failed), work))
+      out.push(`    reported as failed, but not a model this diff is pushing: ${k}`);
+  }
+  const report = opts.report;
+  if (report === void 0) return out;
+  if (report.mode === "apply" !== opts.apply) {
+    out.push(
+      `    mode: rendering as ${opts.apply ? "an APPLY" : "a DRY RUN"}, but the push run recorded mode "${report.mode}"`
+    );
+  }
+  const diffRemote = keysOf(diff.remoteOnly);
+  const reportRemote = keysOf(report.remoteOnlyReported);
+  for (const k of minus(diffRemote, reportRemote))
+    out.push(`    remote-only per the comparison, absent from the push report: ${k}`);
+  for (const k of minus(reportRemote, diffRemote))
+    out.push(`    remote-only per the push report, absent from the comparison: ${k}`);
+  if (opts.failed !== void 0) {
+    const callerFailed = keysOf(opts.failed);
+    const reportFailed = keysOf(report.failed);
+    for (const k of minus(callerFailed, reportFailed))
+      out.push(`    failed per the caller's list, absent from the push report: ${k}`);
+    for (const k of minus(reportFailed, callerFailed))
+      out.push(`    failed per the push report, absent from the caller's list: ${k}`);
+  }
+  const sent = keysOf(report.sent);
+  const failed = keysOf(report.failed);
+  const accounted = /* @__PURE__ */ new Set([...sent, ...failed]);
+  for (const k of minus(work, accounted))
+    out.push(`    in this diff's work list, but the push run neither sent nor failed it: ${k}`);
+  for (const k of minus(accounted, work))
+    out.push(`    sent or failed by the push run, but not in this diff's work list: ${k}`);
+  for (const k of intersect(sent, failed))
+    out.push(`    recorded BOTH sent and failed by the push run: ${k}`);
+  return out;
+}
+var isDestructive = (line) => line.startsWith("- ") || line === "~ (model) repeatable";
+function renderModelReport(repositoryName, diff, opts) {
+  const head = [`Prismic models \u2014 repository: ${repositoryName}`];
+  const disagreements = reconcileReport(diff, opts);
+  if (disagreements.length > 0) {
+    head.push(
+      `\u26A0 INCONSISTENT \u2014 the inputs to this report disagree with each other, so every figure in it is unreliable: they all came from the same inputs. Something upstream is broken (a diff and a push report from different runs, a stale diff, or a mismatched pair). Re-run; do not act on this.`,
+      ...disagreements
+    );
+  }
+  if (isClean(diff) && disagreements.length === 0) {
+    head.push(`${diff.unchanged.length} model(s) match Prismic \u2014 nothing to push.`);
+    if (diff.unchanged.length === 0) {
+      head.push(
+        `\u26A0 NOTHING WAS FOUND ON EITHER SIDE \u2014 the repo declared no models and Prismic holds none. For a live site that is a misconfiguration (a wrong repositoryName, or a slice library path that no longer resolves), not a clean run.`
+      );
+    }
+    return head.join("\n");
+  }
+  const body = [];
+  let destructive = 0;
+  for (const entry of diff.toCreate) {
+    body.push(`NEW  ${entry.kind} ${entry.id}  (${entry.path})`);
+  }
+  for (const { local, remote } of diff.toUpdate) {
+    body.push(`CHANGED  ${local.kind} ${local.id}  (${local.path})`);
+    for (const l of describeDiff(local.model, remote.model)) {
+      if (isDestructive(l)) destructive += 1;
+      body.push(`    ${l}`);
+    }
+  }
+  const matchedNothing = diff.remoteOnly.length > 0 && diff.toCreate.length + diff.toUpdate.length + diff.unchanged.length === 0;
+  if (diff.remoteOnly.length > 0) {
+    if (body.length > 0) body.push("");
+    body.push(
+      `REMOTE-ONLY \u2014 present in Prismic, absent from this repo. These are reported and never deleted by CI; pull them down with \`reddoor-maint prismic-models --pull\` or delete them in the Prismic dashboard.`
+    );
+    for (const entry of diff.remoteOnly) body.push(`    ${entry.kind} ${entry.id}`);
+  }
+  const failures = opts.failed ?? opts.report?.failed ?? [];
+  if (failures.length > 0) {
+    if (body.length > 0) body.push("");
+    for (const f of failures) body.push(`FAILED  ${f.kind} ${f.id}: ${f.error}`);
+    const auth = failures.filter((f) => f.status === 401 || f.status === 403).length;
+    if (auth > 0) {
+      body.push(
+        `\u26A0 ${auth} failure(s) came back 401/403 \u2014 that is the WRITE TOKEN, not the models. Fix the secret and re-run; a model Prismic actually rejected would be a 422.`
+      );
+    }
+  }
+  const n = diff.toCreate.length + diff.toUpdate.length;
+  const pushed = opts.report !== void 0 && opts.report.mode === "apply" ? opts.report.sent.length : n - failures.length;
+  const verdict = opts.apply ? `${pushed}/${n} model(s) pushed. ${diff.unchanged.length} already matched.` : `DRY RUN \u2014 nothing was sent. ${n} model(s) would be pushed; ${diff.unchanged.length} already match.`;
+  const warnings = [];
+  if (matchedNothing) {
+    warnings.push(
+      `\u26A0 THIS CHECKOUT MATCHED NOTHING \u2014 every model below is remote-only and the repo declared none at all. That is what a broken slice-library path looks like (a renamed directory, a typo in \`libraries\`, a partial checkout), not a repo that legitimately has no models.`
+    );
+  }
+  if (destructive > 0) {
+    warnings.push(
+      `\u26A0 DESTRUCTIVE \u2014 ${destructive} line(s) below remove a field, variation, or tab from a live model, or flip \`repeatable\`. Prismic drops the document data for a field the model no longer declares, with HTTP 200 and no warning. Read every \`-\` line before merging.`
+    );
+  }
+  return [...head, verdict, ...warnings, ...body.length > 0 ? ["", ...body] : []].join("\n");
+}
+
+// src/cli/commands/prismic-models.ts
+var defaultDeps = () => ({
+  remoteModels: (repo, token) => remoteModels(repo, token),
+  sendModel: (repo, token, entry, action) => sendModel(repo, token, entry, action),
+  env: process.env,
+  spawn: makeSpawn(),
+  // Imported HERE rather than at the top of the file: the Airtable client is a
+  // devDependency of this package, and a consuming fleet site running the in-repo
+  // check in its own CI has no `airtable` installed. A static import would make
+  // every one of those runs fail on module load.
+  openVerdictSink: async () => {
+    const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
+    const { listWebsites, updatePrismicModels } = await import("./websites-VITQ3WXN.js");
+    const base = openBase(readAirtableConfig());
+    const websites = await listWebsites(base);
+    return {
+      websites: websites.map((w) => ({ id: w.id, name: w.name })),
+      update: (recordId, models) => updatePrismicModels(base, recordId, models)
+    };
+  }
+});
+var describeThrown = (e) => {
+  try {
+    if (e instanceof Error && typeof e.message === "string") return e.message;
+  } catch {
+  }
+  try {
+    return String(e);
+  } catch {
+    return `<a thrown ${typeof e} that cannot be converted to a string>`;
+  }
+};
+var inputFailure = (output, status, code, repositoryName) => ({
+  ok: false,
+  failure: {
+    output,
+    code,
+    // `null` on EVERY one of these, so nothing downstream can read a failed read
+    // as a verdict about the site.
+    clean: null,
+    status,
+    ...repositoryName !== void 0 ? { repositoryName } : {}
+  }
+});
+async function readSiteInputs(repoRoot, deps, opts) {
+  let entries;
+  try {
+    entries = await readdir(repoRoot);
+  } catch (e) {
+    return inputFailure(
+      `cannot read this checkout at ${repoRoot}: ${describeThrown(e)}. ${opts.noEffect} \u2014 this is NOT "no Prismic in this repo". Check the path (a typo, a wrong working-directory, or a clone that failed).`,
+      "failed",
+      1
+    );
+  }
+  const noTree = noWorkingTreeFailure(repoRoot, entries, opts.noEffect);
+  if (noTree) return inputFailure(noTree, "failed", 1);
+  let cfg;
+  try {
+    cfg = await readPrismicConfig(repoRoot);
+  } catch (e) {
+    return inputFailure(
+      `Prismic config present but unusable: ${describeThrown(e)}. ${opts.noEffect} \u2014 this is NOT "no Prismic in this repo".`,
+      "failed",
+      1
+    );
+  }
+  if (!cfg) {
+    return inputFailure("not a Prismic site (no repositoryName) \u2014 skipped", "skipped", 0);
+  }
+  let canonicalEnv;
+  try {
+    canonicalEnv = prismicTokenEnvName(cfg.repositoryName);
+  } catch (e) {
+    return inputFailure(
+      `cannot work out which secret holds this repository's token: ${describeThrown(e)}`,
+      "failed",
+      1,
+      cfg.repositoryName
+    );
+  }
+  const resolved = resolvePrismicToken(cfg.repositoryName, deps.env, {
+    allowGeneric: opts.allowGenericToken
+  });
+  if (!resolved) {
+    const names = [canonicalEnv];
+    if (opts.allowGenericToken) names.push("PRISMIC_WRITE_TOKEN");
+    return inputFailure(
+      `no write token for Prismic repository "${cfg.repositoryName}" \u2014 set ${names.join(" or ")}`,
+      "failed",
+      1,
+      cfg.repositoryName
+    );
+  }
+  let local;
+  try {
+    local = await localModels(repoRoot, cfg.libraries);
+  } catch (e) {
+    return inputFailure(
+      `could not read this repo's own models: ${describeThrown(e)}. ${opts.noEffect}.`,
+      "failed",
+      1,
+      cfg.repositoryName
+    );
+  }
+  let remote;
+  try {
+    remote = await deps.remoteModels(cfg.repositoryName, resolved.token);
+  } catch (e) {
+    return inputFailure(
+      `could not read Prismic models: ${describeThrown(e)}`,
+      "failed",
+      1,
+      cfg.repositoryName
+    );
+  }
+  return { ok: true, cfg, token: resolved.token, local, remote };
+}
+async function checkOneSite(repoRoot, deps, opts) {
+  const inputs = await readSiteInputs(repoRoot, deps, {
+    allowGenericToken: opts.allowGenericToken,
+    noEffect: "Nothing was compared and nothing was pushed"
+  });
+  if (!inputs.ok) return inputs.failure;
+  const { cfg, token, local, remote } = inputs;
+  const diff = diffModels(local, remote);
+  const report = await pushModels(diff, {
+    apply: opts.apply,
+    send: (entry, _remote, action) => deps.sendModel(cfg.repositoryName, token, entry, action)
+  });
+  const foundNothingAnywhere = isClean(diff) && diff.unchanged.length === 0;
+  const reportOptions = { apply: opts.apply, report };
+  const inconsistencies = reconcileReport(diff, reportOptions);
+  return {
+    output: renderModelReport(cfg.repositoryName, diff, reportOptions),
+    // A dry run NEVER fails on drift: a model PR is supposed to differ from the
+    // remote, and the comment is the review artifact, not a gate. Only a real
+    // push failure — or one of the "we could not find out" returns above — is an
+    // error.
+    //
+    // An inconsistency IS such an error, on both modes. Drift is a fact about
+    // the site; an inconsistency is a fact about the report, which says every
+    // figure in it is unreliable. Letting that pass green is a reviewer
+    // approving a merge from numbers the report itself disowns.
+    code: report.failed.length > 0 || inconsistencies.length > 0 ? 1 : 0,
+    // `false`, not `null`, and for the same reason as `foundNothingAnywhere`
+    // above: the check ran to completion and produced a finding — its inputs
+    // disagree — so a human needs to look. `null` means "we never found out".
+    //
+    // An earlier version of this comment justified that by saying `null` would
+    // count toward Task 17's majority-failure rule; Task 17 falsified it. That
+    // rule counts `status`, and this row is `status: "checked"` on either value,
+    // so the sweep's exit code would not move — which is the point. `clean` is
+    // the PER-SITE verdict: the field the sweep carries for each row and the one
+    // Task 19 writes to Airtable and the cockpit alarms on. `null` there writes
+    // no verdict at all for a check that ran to completion and found something,
+    // so the loudest failure this renderer can report would be the one row the
+    // fleet never hears about.
+    clean: inconsistencies.length > 0 ? false : isClean(diff) && !foundNothingAnywhere,
+    status: "checked",
+    repositoryName: cfg.repositoryName
+  };
+}
+var SITE_COL = 28;
+var REPO_COL = 26;
+var ENV_COL = 40;
+var NO_VALUE = "\u2014";
+var DOCTOR_HEADER = [
+  "Prismic write-token doctor \u2014 which secret each site needs, and whether it is set.",
+  "",
+  "The naming rule is PRISMIC_TOKEN_<REPOSITORY NAME>, upper-snaked from the PRISMIC",
+  "repository name, which is routinely not the repo directory name: reddoor-website's",
+  "repository is reddoor-la, data-dynamiq's is reddoor-wireframer, and",
+  "beachfront-dentistry's is 48bb12d1. Prefix-first is deliberate \u2014 it guarantees a",
+  "leading letter, and 48BB12D1_PRISMIC is rejected both by shell sourcing and by this",
+  "repo's own credentials parser.",
+  "",
+  "The generic PRISMIC_WRITE_TOKEN is NOT consulted here. It is the in-repo CI fallback",
+  "for whichever single repository a workflow is checked out against; this table is the",
+  "per-repository checklist, and a fallback cannot tick a repository's own box.",
+  "",
+  "Nothing below was verified against Prismic and no token value is ever printed \u2014 this",
+  "reads the environment for emptiness only. A secret that is set is reported as",
+  "PRESENT (not verified); run `reddoor-maint prismic-models` in the site to find out",
+  "whether it actually works.",
+  "",
+  `${"repo".padEnd(SITE_COL)} ${"Prismic repository".padEnd(REPO_COL)} ${"secret".padEnd(ENV_COL)} verdict`
+];
+function renderTokenDoctor(probes) {
+  const lines = [...DOCTOR_HEADER];
+  let ok = 0;
+  let missing = 0;
+  let failing = 0;
+  let unverified = 0;
+  let unreadable = 0;
+  let skipped = 0;
+  for (const p of probes) {
+    const cols = `${p.site.padEnd(SITE_COL)} ${(p.repositoryName ?? NO_VALUE).padEnd(REPO_COL)} ${(p.expectedEnv ?? NO_VALUE).padEnd(ENV_COL)}`;
+    let verdict;
+    if (p.status === "failed") {
+      unreadable++;
+      verdict = `CANNOT TELL \u2014 ${p.error ?? "this site could not be read"}. Nothing was established about this site's secret.`;
+    } else if (p.status === "skipped") {
+      skipped++;
+      verdict = "no Prismic config (skipped) \u2014 this site needs no token";
+    } else if (!p.present) {
+      missing++;
+      verdict = "MISSING \u2014 mint this secret";
+    } else if (p.reads === false) {
+      failing++;
+      verdict = `PRESENT BUT 403/FAILED \u2014 ${p.error ?? "read failed"}`;
+    } else if (p.reads === true) {
+      ok++;
+      verdict = "OK";
+    } else {
+      unverified++;
+      verdict = "PRESENT (not verified)";
+    }
+    lines.push(`${cols} ${verdict}`);
+  }
+  lines.push("");
+  if (unreadable > 0) {
+    lines.push(
+      `\u26A0 ${unreadable} site(s) could not be read at all. Those are NOT sites without Prismic \u2014 nothing was established about their secrets, so do not read this table as a complete checklist.`
+    );
+  }
+  lines.push(
+    `${ok} ok, ${missing} missing, ${failing} failing, ${unverified} unverified, ${unreadable} unreadable, ${skipped} skipped.`
+  );
+  return lines.join("\n");
+}
+async function probeSiteToken(repoRoot, env, label) {
+  const site = label !== void 0 && label.trim() !== "" ? label : basename(repoRoot) || repoRoot;
+  const blank = {
+    site,
+    repositoryName: null,
+    expectedEnv: null,
+    present: false,
+    reads: null
+  };
+  let entries;
+  try {
+    entries = await readdir(repoRoot);
+  } catch (e) {
+    return {
+      ...blank,
+      status: "failed",
+      error: `cannot read this checkout at ${repoRoot}: ${describeThrown(e)}`
+    };
+  }
+  const noTree = noWorkingTreeFailure(
+    repoRoot,
+    entries,
+    "Nothing was established about this repo's token"
+  );
+  if (noTree) return { ...blank, status: "failed", error: noTree };
+  let cfg;
+  try {
+    cfg = await readPrismicConfig(repoRoot);
+  } catch (e) {
+    return {
+      ...blank,
+      status: "failed",
+      error: `Prismic config present but unusable: ${describeThrown(e)}`
+    };
+  }
+  if (!cfg) return { ...blank, status: "skipped" };
+  let expectedEnv;
+  try {
+    expectedEnv = prismicTokenEnvName(cfg.repositoryName);
+  } catch (e) {
+    return {
+      ...blank,
+      status: "failed",
+      repositoryName: cfg.repositoryName,
+      error: `cannot work out which secret holds this repository's token: ${describeThrown(e)}`
+    };
+  }
+  return {
+    site,
+    status: "checked",
+    repositoryName: cfg.repositoryName,
+    expectedEnv,
+    // The one read of the environment, and only its emptiness survives this
+    // expression. `.trim()` matches `resolvePrismicToken` exactly: a
+    // whitespace-only secret is one the pipeline itself refuses, so a doctor
+    // that called it present would tick a box the push would then fail on.
+    present: (env[expectedEnv] ?? "").trim() !== "",
+    reads: null
+  };
+}
+var tokenDoctorActionable = (probes) => probes.some(
+  (p) => p.status === "failed" || p.status === "checked" && (!p.present || p.reads === false)
+);
+async function runTokenDoctor(repoRoot, deps) {
+  const probes = [await probeSiteToken(repoRoot, deps.env)];
+  return { output: renderTokenDoctor(probes), code: tokenDoctorActionable(probes) ? 1 : 0 };
+}
+async function pullRemoteOnly(repoRoot, deps) {
+  const inputs = await readSiteInputs(repoRoot, deps, {
+    // TRUE, for the same reason the in-repo check sets it: one checkout, one
+    // Prismic repository, and `--pull` is refused outright in fleet mode — where
+    // a single generic token would attach the wrong credential to every site
+    // after the first.
+    allowGenericToken: true,
+    noEffect: "Nothing was pulled and nothing was written"
+  });
+  if (!inputs.ok) return { output: inputs.failure.output, code: inputs.failure.code };
+  const { cfg, local, remote } = inputs;
+  const diff = diffModels(local, remote);
+  if (diff.remoteOnly.length === 0) {
+    return { output: `nothing to pull \u2014 no remote-only models in ${cfg.repositoryName}`, code: 0 };
+  }
+  const library = cfg.libraries[0] ?? "";
+  const format = (root, paths, fmtOpts) => formatWithPrettier(deps.spawn, root, paths, fmtOpts);
+  const lines = [`Prismic pull-down \u2014 repository: ${cfg.repositoryName}`];
+  if (cfg.libraries.length === 0) {
+    lines.push(
+      `slice library: NONE \u2014 this site's Prismic config declares no slice library, so no slice can be placed. Custom types are unaffected.`
+    );
+  } else {
+    lines.push(
+      `slice library: ${library}` + (cfg.libraries.length > 1 ? ` (the first of ${cfg.libraries.length} declared; the others are not written to)` : "")
+    );
+  }
+  lines.push("");
+  let unformatted = 0;
+  let refused = 0;
+  for (const entry of diff.remoteOnly) {
+    try {
+      const res = await writeModelFile(format, repoRoot, entry, library);
+      if (!res.formatted) unformatted++;
+      lines.push(
+        `pulled   ${entry.kind} ${entry.id}  -> ${res.path}${res.formatted ? "" : "  (unformatted)"}`
+      );
+    } catch (e) {
+      refused++;
+      lines.push(`REFUSED  ${entry.kind} ${entry.id}  \u2014 ${describeThrown(e)}`);
+    }
+  }
+  if (unformatted > 0) lines.push(`\u26A0 ${PRETTIER_FLAG_NOTE}`);
+  lines.push("");
+  lines.push(
+    `${diff.remoteOnly.length - refused} of ${diff.remoteOnly.length} model(s) pulled` + (refused > 0 ? `, ${refused} refused` : "") + `.`
+  );
+  if (refused < diff.remoteOnly.length) lines.push("Review, commit, and open a PR.");
+  if (refused > 0) {
+    lines.push(
+      `A refusal leaves that model ONLY in Prismic \u2014 nothing was deleted there and nothing was overwritten here. Act on each REFUSED line above.`
+    );
+  }
+  return { output: lines.join("\n"), code: refused > 0 ? 1 : 0 };
+}
+function prismicSweepExitCode(checked, failed) {
+  return failed > checked ? 1 : 0;
+}
+function uniqueBySite(rows) {
+  const seen = /* @__PURE__ */ new Set();
+  return rows.filter((r) => seen.has(r.site) ? false : (seen.add(r.site), true));
+}
+function findRepositoryCollisions(rows) {
+  const byRepository = /* @__PURE__ */ new Map();
+  for (const r of uniqueBySite(rows)) {
+    if (r.repositoryName === null) continue;
+    const list = byRepository.get(r.repositoryName) ?? [];
+    list.push(r.site);
+    byRepository.set(r.repositoryName, list);
+  }
+  return [...byRepository.entries()].filter(([, sites]) => sites.length > 1).map(([repositoryName, sites]) => ({ repositoryName, sites: [...sites].sort() })).sort((a, b) => a.repositoryName.localeCompare(b.repositoryName));
+}
+function findTokenEnvCollisions(rows) {
+  const byEnv = /* @__PURE__ */ new Map();
+  for (const r of uniqueBySite(rows)) {
+    if (r.repositoryName === null) continue;
+    let envName;
+    try {
+      envName = prismicTokenEnvName(r.repositoryName);
+    } catch {
+      continue;
+    }
+    const list = byEnv.get(envName) ?? [];
+    list.push({ site: r.site, repositoryName: r.repositoryName });
+    byEnv.set(envName, list);
+  }
+  return [...byEnv.entries()].filter(([, entries]) => new Set(entries.map((e) => e.repositoryName)).size > 1).map(([envName, entries]) => ({
+    envName,
+    entries: [...entries].sort((a, b) => a.site.localeCompare(b.site))
+  })).sort((a, b) => a.envName.localeCompare(b.envName));
+}
+function describeTokenEnvCollisions(collisions) {
+  if (collisions.length === 0) return "";
+  return [
+    "## \u26D4 One token secret derived by more than one Prismic repository",
+    "",
+    ...collisions.map(
+      (c) => `- **${c.envName}** is derived by ${c.entries.map((e) => `${e.site} (${e.repositoryName})`).join(" and ")}. These are DIFFERENT Prismic repositories reading ONE secret, so whichever token is set is sent to both \u2014 one client's credential at another client's repository. Neither repo's config is wrong, so do not "fix" one of them: the env var NAME is derived from the repository name and collapses them. Rename one Prismic repository, or give the derivation a disambiguator. Until then, treat both sites' verdicts as unproven.`
+    )
+  ].join("\n");
+}
+function findDuplicateSiteRows(rows) {
+  const bySite = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    const list = bySite.get(r.site) ?? [];
+    list.push(r.repositoryName);
+    bySite.set(r.site, list);
+  }
+  return [...bySite.entries()].filter(([, names]) => names.length > 1).map(([site, names]) => ({
+    site,
+    count: names.length,
+    repositoryNames: [...new Set(names.filter((n) => n !== null))].sort()
+  })).sort((a, b) => a.site.localeCompare(b.site));
+}
+function describeDuplicateSiteRows(duplicates) {
+  if (duplicates.length === 0) return "";
+  return [
+    "## \u26A0 A site is listed more than once in the inventory",
+    "",
+    ...duplicates.map((d) => {
+      const names = d.repositoryNames.length === 0 ? "no repositoryName was established for it" : `repositoryName ${d.repositoryNames.join(" and ")}`;
+      return `- **${d.site}** appears ${d.count}\xD7 (${names}). It was swept ${d.count}\xD7, so the counts below are inflated by ${d.count - 1}. This is an INVENTORY problem, not a conflict between two sites \u2014 do not change a slicemachine.config.json for it.`;
+    })
+  ].join("\n");
+}
+function describeCollisions(collisions) {
+  if (collisions.length === 0) return "";
+  return [
+    "## \u26D4 Prismic repository claimed by more than one site",
+    "",
+    ...collisions.map(
+      (c) => `- **${c.repositoryName}** is claimed by ${c.sites.join(" and ")}. Each repo's CI pushes to it on merge, so they overwrite each other \u2014 and neither repo can detect this on its own. Fix the slicemachine.config.json in whichever repo is not the owner.`
+    )
+  ].join("\n");
+}
+function countSweep(rows) {
+  return {
+    checked: rows.filter((r) => r.status === "checked").length,
+    failed: rows.filter((r) => r.status === "failed").length,
+    skipped: rows.filter((r) => r.status === "skipped").length
+  };
+}
+function summariseSweep(rows) {
+  const { checked, failed, skipped } = countSweep(rows);
+  const lines = [];
+  if (failed > 0) {
+    lines.push(
+      `\u26A0 ${failed} site(s) could not be read at all. Those are NOT sites without Prismic \u2014 nothing was established about their models, so do not read this sweep as a complete picture of the fleet.`
+    );
+  }
+  lines.push(
+    `${checked} checked, ${failed} failed, ${skipped} skipped (no Prismic config), of ${rows.length} site(s).`
+  );
+  lines.push(
+    `Each site was compared AS ITS CHECKOUT STANDS ON DISK. This sweep never fetches, pulls or resets a checkout, so the commit marked "@" beside each site above \u2014 not that repo's default branch \u2014 is what its verdict describes.`
+  );
+  return lines.join("\n");
+}
+function describeNothingChecked(rows) {
+  if (rows.length === 0) return "";
+  if (countSweep(rows).checked > 0) return "";
+  return `\u26D4 NOT ONE SITE WAS CHECKED. All ${rows.length} site(s) in this inventory came back skipped or unreadable, so nothing was compared against Prismic and this run learned nothing about the fleet's models. That is not a clean fleet: a skip is inferred from a MISSING config file, so anything that empties the checkouts makes every site in the fleet look like a repo that simply has no Prismic in it, and exit 0. Do NOT read this exit as a result.`;
+}
+async function resolveCheckoutCommit(repoRoot) {
+  const isSha = (s) => /^[0-9a-f]{7,64}$/i.test(s);
+  try {
+    const dotGit = join(repoRoot, ".git");
+    const s = await stat(dotGit);
+    let gitDir = dotGit;
+    if (!s.isDirectory()) {
+      const pointer = /^gitdir:\s*(.+)$/m.exec(await readFile(dotGit, "utf-8"))?.[1]?.trim();
+      if (!pointer) return { unresolved: `.git is a file that names no gitdir` };
+      gitDir = resolve(repoRoot, pointer);
+    }
+    const head = (await readFile(join(gitDir, "HEAD"), "utf-8")).trim();
+    if (isSha(head)) return { resolved: head };
+    const ref = /^ref:\s*(.+)$/.exec(head)?.[1]?.trim();
+    if (!ref) return { unresolved: `HEAD is neither a commit id nor a ref (${head.slice(0, 60)})` };
+    try {
+      const loose = (await readFile(join(gitDir, ref), "utf-8")).trim();
+      return isSha(loose) ? { resolved: loose } : { unresolved: `${ref} holds no commit id` };
+    } catch {
+      const packed = await readFile(join(gitDir, "packed-refs"), "utf-8");
+      for (const line of packed.split("\n")) {
+        const [sha, name] = line.trim().split(/\s+/);
+        if (name === ref && sha !== void 0 && isSha(sha)) return { resolved: sha };
+      }
+      return { unresolved: `${ref} is in neither this checkout's loose refs nor packed-refs` };
+    }
+  } catch (e) {
+    return { unresolved: describeThrown(e) };
+  }
+}
+function describeCheckoutCommit(commit) {
+  if (commit === null) return "";
+  return "resolved" in commit ? ` @ ${commit.resolved.slice(0, 12)}` : ` @ COMMIT NOT RESOLVED (${commit.unresolved})`;
+}
+async function sweepOneSite(s, deps) {
+  const label = siteLabel(s);
+  const commit = await resolveCheckoutCommit(s.path);
+  try {
+    const r = await checkOneSite(s.path, deps, {
+      apply: false,
+      // Fleet mode forbids the generic token: one PRISMIC_WRITE_TOKEN in the
+      // environment while iterating every fleet repository would attach the wrong
+      // credential to every site after the first. In-repo mode is the opposite,
+      // and that asymmetry is the whole point of the flag.
+      allowGenericToken: false
+    });
+    return {
+      site: label,
+      repositoryName: r.repositoryName ?? null,
+      commit,
+      // Carry `status` THROUGH — never re-derive a verdict here.
+      status: r.status,
+      clean: r.clean,
+      detail: r.output
+    };
+  } catch (e) {
+    return {
+      site: label,
+      repositoryName: null,
+      commit,
+      status: "failed",
+      clean: null,
+      detail: `unexpected error while checking this site: ${describeThrown(e)}. Nothing was compared for it \u2014 this is NOT "no Prismic in this repo".`
+    };
+  }
+}
+async function prepareFleet(site, opts, cwd) {
+  const sites = await resolveSites({
+    // Passed through so `resolveSites` can refuse `prismic-models espada --fleet
+    // inv.json` (exit 2). Dropping it would silently sweep the whole fleet for
+    // an operator who named one site.
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    ...opts.workdir !== void 0 ? { workdir: opts.workdir } : {},
+    cwd
+  });
+  const workdir = opts.workdir ?? fleetWorkdir();
+  return { prep: await prepareFleetSites(sites, { workdir }), resolved: sites.length };
+}
+async function sweepFleet(site, opts, deps, cwd) {
+  const { prep, resolved } = await prepareFleet(site, opts, cwd);
+  const rows = [];
+  for (const s of prep.prepared) rows.push(await sweepOneSite(s, deps));
+  for (const s of prep.skipped) {
+    rows.push({
+      site: s.site,
+      repositoryName: null,
+      // No checkout was established, so there is no commit to name. `null` here
+      // is "there is no tree", NOT "we could not read one" — that is the
+      // `unresolved` case, and they must not render alike.
+      commit: null,
+      status: "failed",
+      clean: null,
+      detail: `could not prepare this checkout: ${s.reason}. Nothing was compared for it \u2014 this is NOT "no Prismic in this repo".`
+    });
+  }
+  return { rows, skipped: prep.skipped, resolved };
+}
+var NO_VERDICT_BANNER = "\u26A0 NO VERDICT \u2014 this site's check FAILED, so nothing was established about its models:";
+function sweepRowWriteback(row, checkedAt) {
+  if (row.status === "skipped") return { verdict: null, checkedAt, detail: row.detail };
+  if (row.status === "failed" || row.clean === null) {
+    return { verdict: "unknown", checkedAt, detail: `${NO_VERDICT_BANNER}
+${row.detail}` };
+  }
+  return {
+    verdict: row.clean ? "pass" : "fail",
+    checkedAt,
+    // A clean site clears its detail: leaving yesterday's drift text under a
+    // `pass` is a finding that reads as current and is not.
+    detail: row.clean ? null : row.detail
+  };
+}
+async function writeSweepToAirtable(rows, websites, update, checkedAt) {
+  const bySlug = /* @__PURE__ */ new Map();
+  for (const w of websites) {
+    const slug = siteSlug(w.name);
+    const list = bySlug.get(slug) ?? [];
+    list.push(w);
+    bySlug.set(slug, list);
+  }
+  const result = { written: [], failed: [] };
+  for (const row of rows) {
+    const slug = siteSlug(row.site);
+    const matches = bySlug.get(slug) ?? [];
+    const target = matches.length === 1 ? matches[0] : void 0;
+    if (!target) {
+      result.failed.push({
+        slug,
+        error: matches.length === 0 ? `no Websites row matched "${row.site}" \u2014 its verdict was NOT recorded anywhere, so the cockpit will keep whatever this site's row said before (or nothing). Check the inventory name against the Websites Name column.` : `${matches.length} Websites rows match "${row.site}" (${matches.map((m) => m.name).join(", ")}) \u2014 refusing to guess which one owns this verdict, because writing it to the wrong row is worse than not writing it.`
+      });
+      continue;
+    }
+    try {
+      await update(target.id, sweepRowWriteback(row, checkedAt));
+      result.written.push({
+        siteName: target.name,
+        writes: [{ audit: "prismic-models", counts: {} }]
+      });
+    } catch (e) {
+      result.failed.push({ slug, error: describeThrown(e) });
+    }
+  }
+  return result;
+}
+async function persistSweep(rows, deps) {
+  let sink;
+  let formatSummary;
+  try {
+    formatSummary = (await import("./write-audits-to-airtable-3SOXLKJK.js")).formatFleetWriteSummary;
+    sink = await deps.openVerdictSink();
+  } catch (e) {
+    return {
+      output: `\u26D4 --write-airtable was asked for and NOTHING WAS WRITTEN: ${describeThrown(e)}. Every verdict above is unrecorded, so the cockpit and the digest keep whatever they held before \u2014 which for a site that has broken since is a green tick. Do NOT read the report above as having reached the fleet's record.`,
+      code: 1
+    };
+  }
+  const result = await writeSweepToAirtable(
+    rows,
+    sink.websites,
+    sink.update,
+    (/* @__PURE__ */ new Date()).toISOString()
+  );
+  return { output: formatSummary(result), code: 0 };
+}
+async function runFleetSweep(site, opts, deps, cwd) {
+  const { rows, skipped, resolved } = await sweepFleet(site, opts, deps, cwd);
+  if (resolved === 0) {
+    return {
+      output: `the inventory resolved NO SITES, so no sites were swept and nothing was compared. This is not a clean fleet \u2014 check the inventory (an Airtable view filter, an empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a result.`,
+      code: 1
+    };
+  }
+  const { checked, failed } = countSweep(rows);
+  const body = rows.map((r) => `[${r.site}]${describeCheckoutCommit(r.commit)} ${r.detail}`).join("\n\n");
+  const collisions = findRepositoryCollisions(rows);
+  const envCollisions = findTokenEnvCollisions(rows);
+  const duplicates = findDuplicateSiteRows(rows);
+  const nothingChecked = describeNothingChecked(rows);
+  const output = appendSkipNotice(
+    [
+      describeCollisions(collisions),
+      describeTokenEnvCollisions(envCollisions),
+      describeDuplicateSiteRows(duplicates),
+      body,
+      summariseSweep(rows),
+      nothingChecked
+    ].filter((s) => s !== "").join("\n\n"),
+    skipped
+  );
+  const alarms = collisions.length + envCollisions.length;
+  const code = alarms > 0 || nothingChecked !== "" ? 1 : prismicSweepExitCode(checked, failed);
+  if (!requested(opts.writeAirtable)) return { output, code };
+  const persisted = await persistSweep(rows, deps);
+  return {
+    output: `${output}
+
+${persisted.output}`,
+    code: code !== 0 ? code : persisted.code
+  };
+}
+async function runFleetTokenDoctor(site, opts, deps, cwd) {
+  const { prep, resolved } = await prepareFleet(site, opts, cwd);
+  if (resolved === 0) {
+    return {
+      output: `the inventory resolved NO SITES, so no site's token requirement was established. This is not a fleet that needs no secrets \u2014 check the inventory (an Airtable view filter, an empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a checklist.`,
+      code: 1
+    };
+  }
+  const probes = [];
+  for (const s of prep.prepared) probes.push(await probeSiteToken(s.path, deps.env, siteLabel(s)));
+  for (const s of prep.skipped) {
+    probes.push({
+      site: s.site,
+      status: "failed",
+      repositoryName: null,
+      expectedEnv: null,
+      present: false,
+      reads: null,
+      error: `could not prepare this checkout: ${s.reason}`
+    });
+  }
+  const envCollisions = findTokenEnvCollisions(probes);
+  const duplicates = findDuplicateSiteRows(probes);
+  const nothingProbed = probes.some((p) => p.status === "checked") || probes.length === 0 ? "" : `\u26D4 NOT ONE SITE'S TOKEN REQUIREMENT WAS ESTABLISHED. All ${probes.length} site(s) in this inventory came back unreadable or without a Prismic config, so this run learnt nothing about which secrets the fleet needs. That is not a fleet that is already provisioned: a skip is inferred from a MISSING config file, so anything that empties the checkouts makes every site look like a repo with no Prismic in it. Do NOT read this exit as a result.`;
+  const output = appendSkipNotice(
+    [
+      describeTokenEnvCollisions(envCollisions),
+      describeDuplicateSiteRows(duplicates),
+      renderTokenDoctor(probes),
+      nothingProbed
+    ].filter((s) => s !== "").join("\n\n"),
+    prep.skipped
+  );
+  return {
+    output,
+    code: tokenDoctorActionable(probes) || envCollisions.length > 0 || nothingProbed !== "" ? 1 : 0
+  };
+}
+var requested = (v) => v !== void 0 && v !== false;
+function modeConflict(opts) {
+  if (requested(opts.pull) && requested(opts.tokens)) {
+    return "cannot combine --pull with --tokens. They are two different modes: one writes remote-only models into this working tree, the other prints which secret each site needs. Nothing was pulled, written or read \u2014 ask for one of them.";
+  }
+  if (requested(opts.pull)) {
+    if (opts.apply === true) {
+      return "cannot combine --pull with --apply \u2014 pull, review, then push. Running both in one invocation would push this repo's models and adopt Prismic's in the same breath, with no review in between. Nothing was pulled, written or pushed.";
+    }
+    if (requested(opts.fleet)) {
+      return "cannot combine --pull with --fleet: --pull is single-repo only, because it WRITES INTO A WORKING TREE and the result is meant to land as one reviewed PR. Nothing was pulled or written.";
+    }
+    if (opts.commentFile !== void 0) {
+      return "cannot combine --pull with --comment-file. The comment file is the in-repo model check's review artifact; a pull-down's review artifact is the diff it leaves in the working tree. Nothing was pulled or written.";
+    }
+  }
+  if (requested(opts.tokens)) {
+    if (opts.apply === true) {
+      return "cannot combine --tokens with --apply. --tokens is a read-only checklist of which secret each site needs; it pushes nothing. Nothing was compared, pushed or written \u2014 drop one of the two flags.";
+    }
+    if (opts.commentFile !== void 0) {
+      return "cannot combine --tokens with --comment-file. The comment file is the in-repo model check's review artifact; the token doctor writes no report for a PR. Nothing was written \u2014 redirect the output instead.";
+    }
+    if (requested(opts.writeAirtable)) {
+      return "cannot combine --tokens with --write-airtable. --write-airtable persists a fleet sweep's per-site MODEL verdicts to the Websites table, and the token doctor produces none \u2014 it compares no models and calls Prismic not at all, so there is nothing for it to write. Accepting it would print a checklist, write nothing and exit 0. Nothing was read or written \u2014 run the sweep for verdicts, the doctor for secrets.";
+    }
+  }
+  if (requested(opts.fleet)) {
+    if (opts.apply === true) {
+      return "cannot combine --fleet with --apply. The fleet sweep is READ-ONLY BY CONSTRUCTION \u2014 `apply` is not plumbed through it at all, because a fleet-wide model push outside CI is \u{1F534} under AUTONOMY.md. Accepting the flag and sweeping read-only anyway would exit 0 having pushed nothing, which reads as a successful push. Nothing was compared, pushed or written \u2014 push per repo, through that repo's own CI.";
+    }
+    if (opts.commentFile !== void 0) {
+      return "cannot combine --fleet with --comment-file. The comment file is ONE repo's review artifact, posted on ONE pull request; a fleet sweep has no pull request to post to. Accepting it and writing nothing would leave a workflow waiting on a file that never appears. Nothing was swept or written \u2014 redirect the output instead.";
+    }
+  }
+  if (requested(opts.writeAirtable) && !requested(opts.fleet)) {
+    return "--write-airtable needs --fleet. It persists a fleet sweep's per-site verdicts to the Websites table, and the in-repo check has no sweep to write \u2014 its review artifact is the PR comment (--comment-file). Accepting the flag and comparing this one repo instead would exit 0 having written nothing. Nothing was compared, pushed or written.";
+  }
+  return null;
+}
+async function writeCommentFileAtomically(path, body) {
+  const tmp = `${path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+  try {
+    await writeFile(tmp, body, "utf-8");
+    await rename(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true }).catch(() => void 0);
+    throw e;
+  }
+}
+var runStamp = (env, repositoryName) => {
+  const bits = ["reddoor-maint prismic-models", repositoryName ?? "no Prismic repository resolved"];
+  if (env.GITHUB_RUN_ID) bits.push(`run ${env.GITHUB_RUN_ID}`);
+  if (env.GITHUB_RUN_ATTEMPT) bits.push(`attempt ${env.GITHUB_RUN_ATTEMPT}`);
+  if (env.GITHUB_SHA) bits.push(`commit ${env.GITHUB_SHA}`);
+  if (!env.GITHUB_RUN_ID) bits.push(`local pid ${process.pid}`);
+  bits.push((/* @__PURE__ */ new Date()).toISOString());
+  return bits.join(" \xB7 ");
+};
+async function runPrismicModelsCommand(site, opts, deps = defaultDeps()) {
+  const conflict = modeConflict(opts);
+  if (conflict) return { output: conflict, code: 2 };
+  const commentFile = opts.commentFile;
+  if (commentFile !== void 0 && (typeof commentFile !== "string" || !commentFile.trim())) {
+    return {
+      output: `--comment-file was given ${typeof commentFile === "string" ? "an empty value" : `a ${typeof commentFile}`}, which is not a path. Nothing was compared and nothing was pushed. An unset workflow variable expands to an empty string \u2014 pass a real path, or drop the flag. Do NOT read this exit as a result.`,
+      code: 1
+    };
+  }
+  const fleetInventory = opts.fleet;
+  if (requested(fleetInventory) && (typeof fleetInventory !== "string" || !fleetInventory.trim())) {
+    return {
+      output: `--fleet was given ${typeof fleetInventory === "string" ? "an empty value" : `a ${typeof fleetInventory}`}, which is not an inventory. Nothing was swept and nothing was compared. An unset workflow variable expands to an empty string, and an empty --fleet reads as "no fleet" \u2014 one directory swept and reported as the whole fleet. Pass an inventory path or "airtable". Do NOT read this exit as a result.`,
+      code: 2
+    };
+  }
+  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+  const repoRoot = site ? resolve(cwd, site) : cwd;
+  if (requested(opts.tokens)) {
+    return requested(opts.fleet) ? runFleetTokenDoctor(site, opts, deps, cwd) : runTokenDoctor(repoRoot, deps);
+  }
+  if (requested(opts.pull)) return pullRemoteOnly(repoRoot, deps);
+  if (requested(opts.fleet)) return runFleetSweep(site, opts, deps, cwd);
+  const result = await checkOneSite(repoRoot, deps, {
+    // `=== true` rather than truthiness, so the ONE place that decides whether
+    // anything goes on the wire cannot be flipped by a stray string from a flag
+    // parser. Dry is the default and the only default.
+    apply: opts.apply === true,
+    // TRUE here, and false in fleet mode — the modes are opposites and this is
+    // the right side of it. An in-repo CI run has exactly one Prismic repository
+    // in scope, and `PRISMIC_WRITE_TOKEN` is the name the reusable workflow puts
+    // that repository's own Actions secret into (Task 24), rolled out per repo by
+    // Task 26. It is NOT a name sites already read: measured 2026-08-13 across
+    // the 15 in-scope repos from each one's origin/HEAD (`git grep`, never a
+    // working tree), 10 never mention it at all and the 5 that do only in
+    // one-shot migration scripts and docs — none in application code. A fleet run
+    // iterates every repository against one environment, where a generic token
+    // would attach the wrong credential to every site after the first.
+    allowGenericToken: true
+  });
+  let { output, code } = result;
+  if (commentFile !== void 0) {
+    let path = commentFile;
+    try {
+      path = resolve(cwd, commentFile);
+      const stamped = `${runStamp(deps.env, result.repositoryName)}
+
+${output}`;
+      await writeCommentFileAtomically(path, forComment(stamped));
+    } catch (e) {
+      output = `${output}
+
+\u26A0 COULD NOT WRITE THE COMMENT FILE (${path}): ${describeThrown(e)}. No comment will be posted, so do not read a passing check as "reviewed".`;
+      code = code === 0 ? 1 : code;
+    }
+  }
+  return { output, code };
+}
+var GITHUB_COMMENT_LIMIT = 65536;
+var COMMENT_WRAPPER_HEADROOM = 2048;
+var DEFAULT_COMMENT_LIMIT = GITHUB_COMMENT_LIMIT - COMMENT_WRAPPER_HEADROOM;
+function forComment(body, limit = DEFAULT_COMMENT_LIMIT) {
+  const headMarker = `\u26A0 TRUNCATED \u2014 this is not the whole report; the cut is explained at the end.
+
+`;
+  const notice = `
+
+\u26A0 TRUNCATED \u2014 this report is ${body.length} characters and the budget for this comment body is ${limit} (GitHub caps the whole comment, wrapper included, at ${GITHUB_COMMENT_LIMIT}). Everything below the cut is missing, including any further destructive lines. Run \`reddoor-maint prismic-models\` locally \u2014 dry is the default \u2014 for the whole report before approving.
+`;
+  if (limit < headMarker.length + notice.length) {
+    throw new Error(
+      `forComment: limit ${limit} is smaller than the truncation warning itself (${headMarker.length + notice.length} characters), so a shortened report could not say that it was shortened. Raise the limit; do not drop the warning.`
+    );
+  }
+  if (body.length <= limit) return body;
+  let head = body.slice(0, Math.max(0, limit - notice.length - headMarker.length));
+  const last = head.charCodeAt(head.length - 1);
+  if (last >= 55296 && last <= 56319) head = head.slice(0, -1);
+  return headMarker + head + notice;
+}
+export {
+  DEFAULT_COMMENT_LIMIT,
+  checkOneSite,
+  countSweep,
+  defaultDeps,
+  describeCheckoutCommit,
+  describeCollisions,
+  describeDuplicateSiteRows,
+  describeNothingChecked,
+  describeTokenEnvCollisions,
+  findDuplicateSiteRows,
+  findRepositoryCollisions,
+  findTokenEnvCollisions,
+  forComment,
+  prismicSweepExitCode,
+  renderTokenDoctor,
+  resolveCheckoutCommit,
+  runPrismicModelsCommand,
+  summariseSweep,
+  sweepFleet,
+  sweepRowWriteback,
+  writeSweepToAirtable
+};
+//# sourceMappingURL=prismic-models-HXCAM4ZL.js.map