@reddoorla/maintenance 0.82.0 → 0.84.0

package/dist/{init-3ZJ7Z5NG.js → init-FLGLJCMJ.js}

@@ -2,30 +2,30 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-ODC4PXZL.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   init
-} from "./chunk-ZXRRKKMR.js";
-import "./chunk-MGJ72BA4.js";
+} from "./chunk-6V7565O2.js";
+import "./chunk-UYCAF77E.js";
+import "./chunk-RJB3QUSP.js";
 import "./chunk-LS6QPANO.js";
 import "./chunk-J7SZQUCW.js";
-import "./chunk-FX7RAMGC.js";
-import "./chunk-K5JZ5KLO.js";
-import "./chunk-KRDLHAKK.js";
-import "./chunk-NT4WIP7I.js";
+import "./chunk-R6FPFMOS.js";
+import "./chunk-R4AB6GCT.js";
+import "./chunk-R53VL3RI.js";
 import "./chunk-Q276MZ7E.js";
 import "./chunk-73UFRZKY.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
-import "./chunk-T4FQ6TZT.js";
-import "./chunk-GASBX52O.js";
-import "./chunk-YAMRVXOD.js";
+import "./chunk-QRDB4NLB.js";
 import "./chunk-LKGVSM2O.js";
+import "./chunk-GASBX52O.js";
+import "./chunk-VRWUL4TR.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-A3WDWNN5.js";
 import "./chunk-2OP4JKIQ.js";
 import {
@@ -107,4 +107,4 @@ async function runInitCommand(site, opts) {
 export {
   runInitCommand
 };
-//# sourceMappingURL=init-3ZJ7Z5NG.js.map
+//# sourceMappingURL=init-FLGLJCMJ.js.map

package/dist/{launch-FRCDOB56.js → launch-AVKH2JVF.js}

@@ -1,18 +1,18 @@
 import {
   selfUpdating
-} from "./chunk-7ADQL5Y3.js";
+} from "./chunk-THEFTZ7F.js";
 import "./chunk-MNDIED4M.js";
 import {
   writeAuditsToAirtable
-} from "./chunk-2BHSGLWR.js";
+} from "./chunk-XDCRVYFL.js";
 import {
   hasRealScores,
   lighthouseScoresFromResult
-} from "./chunk-LMCO7CYQ.js";
+} from "./chunk-OQFOMKBP.js";
 import "./chunk-5L3FPQIJ.js";
 import {
   resolveSites
-} from "./chunk-ODC4PXZL.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   queueDraft
 } from "./chunk-62VF32IC.js";
@@ -30,12 +30,12 @@ import "./chunk-SEEA6RXF.js";
 import "./chunk-73UFRZKY.js";
 import {
   runAudits
-} from "./chunk-T4FQ6TZT.js";
-import "./chunk-GASBX52O.js";
-import "./chunk-YAMRVXOD.js";
+} from "./chunk-QRDB4NLB.js";
 import "./chunk-LKGVSM2O.js";
+import "./chunk-GASBX52O.js";
+import "./chunk-VRWUL4TR.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-A3WDWNN5.js";
 import "./chunk-2OP4JKIQ.js";
 import {
@@ -46,7 +46,7 @@ import "./chunk-U5SZ4FOP.js";
 import {
   listWebsites,
   siteSlug
-} from "./chunk-YRM6EED7.js";
+} from "./chunk-CLWNAMUX.js";
 import {
   openBase,
   readAirtableConfig
@@ -216,4 +216,4 @@ async function runLaunchCommand(site, opts) {
 export {
   runLaunchCommand
 };
-//# sourceMappingURL=launch-FRCDOB56.js.map
+//# sourceMappingURL=launch-AVKH2JVF.js.map

package/dist/{lighthouse-airtable-I46QCEIS.js → lighthouse-airtable-CHANWVO6.js}

@@ -2,11 +2,11 @@ import {
   hasRealScores,
   lighthouseScoresFromResult,
   resolveSlugFromCwd
-} from "./chunk-LMCO7CYQ.js";
-import "./chunk-YRM6EED7.js";
+} from "./chunk-OQFOMKBP.js";
+import "./chunk-CLWNAMUX.js";
 export {
   hasRealScores,
   lighthouseScoresFromResult,
   resolveSlugFromCwd
 };
-//# sourceMappingURL=lighthouse-airtable-I46QCEIS.js.map
+//# sourceMappingURL=lighthouse-airtable-CHANWVO6.js.map

package/dist/{onboard-45NPDMMW.js → onboard-HF4FTJDE.js}

@@ -5,18 +5,18 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-4NAOR44V.js";
+} from "./chunk-ZMIPG6TR.js";
 import {
   resolveSites
-} from "./chunk-ODC4PXZL.js";
+} from "./chunk-MQUOUVQP.js";
 import {
   onboard
-} from "./chunk-NT4WIP7I.js";
+} from "./chunk-UYCAF77E.js";
 import "./chunk-ZTPPCHDB.js";
 import "./chunk-OTGB6YQO.js";
 import "./chunk-LKGVSM2O.js";
 import "./chunk-FDIFTIXC.js";
-import "./chunk-HVOOCK6L.js";
+import "./chunk-4DHQCN5H.js";
 import "./chunk-XXTZBPUY.js";
 import "./chunk-XTK5VIQB.js";
 import "./chunk-U5SZ4FOP.js";
@@ -70,4 +70,4 @@ async function runOnboardCommand(site, opts) {
 export {
   runOnboardCommand
 };
-//# sourceMappingURL=onboard-45NPDMMW.js.map
+//# sourceMappingURL=onboard-HF4FTJDE.js.map

package/dist/{orchestrate-34JYNIXT.js → orchestrate-5FMNYJEA.js}

@@ -4,7 +4,7 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-FFI7P74K.js";
+} from "./chunk-PBCGXXG6.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
@@ -14,7 +14,7 @@ import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
 import "./chunk-4SOCPK7A.js";
 import "./chunk-U5SZ4FOP.js";
-import "./chunk-YRM6EED7.js";
+import "./chunk-CLWNAMUX.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
 export {
@@ -24,4 +24,4 @@ export {
   sendApprovedReports,
   withGlobalCc
 };
-//# sourceMappingURL=orchestrate-34JYNIXT.js.map
+//# sourceMappingURL=orchestrate-5FMNYJEA.js.map

package/dist/{preflight-WVD32COX.js → preflight-HTWIX3MN.js}

@@ -1,8 +1,8 @@
 import {
   preflight
-} from "./chunk-5E4L7WKE.js";
+} from "./chunk-5P2HVNLZ.js";
 import "./chunk-D4FVAIEJ.js";
-import "./chunk-FFI7P74K.js";
+import "./chunk-PBCGXXG6.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-6QRLRT3P.js";
 import "./chunk-MPBXOJ3N.js";
@@ -12,7 +12,7 @@ import "./chunk-QG6OSL4M.js";
 import "./chunk-DC5H7KEQ.js";
 import "./chunk-4SOCPK7A.js";
 import "./chunk-U5SZ4FOP.js";
-import "./chunk-YRM6EED7.js";
+import "./chunk-CLWNAMUX.js";
 import "./chunk-HN6I2XWI.js";
 import "./chunk-6VAL7XJT.js";
 
@@ -63,4 +63,4 @@ async function runPreflightCommand(site, opts) {
 export {
   runPreflightCommand
 };
-//# sourceMappingURL=preflight-WVD32COX.js.map
+//# sourceMappingURL=preflight-HTWIX3MN.js.map

package/dist/prismic-ci-4PDATHU6.js

@@ -0,0 +1,447 @@
+import {
+  noWorkingTreeFailure,
+  readPrismicConfig
+} from "./chunk-VNB5XBQ4.js";
+import {
+  runRecipeOverSites
+} from "./chunk-VPJ7N6P7.js";
+import {
+  appendSkipNotice,
+  fleetWorkdir,
+  prepareFleetSites
+} from "./chunk-ZMIPG6TR.js";
+import {
+  resolveSites
+} from "./chunk-MQUOUVQP.js";
+import {
+  PRETTIER_FLAG_NOTE,
+  formatWithPrettier,
+  resolveTargetPrettier
+} from "./chunk-R53VL3RI.js";
+import {
+  readGitHubConfig
+} from "./chunk-GASBX52O.js";
+import {
+  makeGitHub
+} from "./chunk-VRWUL4TR.js";
+import "./chunk-FDIFTIXC.js";
+import {
+  defaultSpawn
+} from "./chunk-4DHQCN5H.js";
+import {
+  siteLabel
+} from "./chunk-XXTZBPUY.js";
+import {
+  branchName,
+  checkoutBranch,
+  commit,
+  createBranch,
+  currentBranch,
+  deleteBranch,
+  isOwnerRepo,
+  isWorkingTreeClean,
+  push
+} from "./chunk-XTK5VIQB.js";
+import "./chunk-U5SZ4FOP.js";
+
+// src/cli/commands/prismic-ci.ts
+import { readdir } from "fs/promises";
+import { resolve } from "path";
+
+// src/recipes/prismic-ci/index.ts
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import { dirname, join as join2 } from "path";
+
+// src/recipes/prismic-ci/template.ts
+var WORKFLOW_PATH = ".github/workflows/prismic-models.yml";
+var SECRET = "PRISMIC_WRITE_TOKEN";
+var REUSABLE_WORKFLOW = "reddoorla/.github/.github/workflows/prismic-models.yml";
+var APPLY_BRANCH = "main";
+var REUSABLE_WORKFLOW_PIN = {
+  sha: "558395431ddcb481ecba3dd84b78b38c338cfa03",
+  tag: "v1.4.0"
+};
+function isPinResolved(pin) {
+  return /^[0-9a-f]{40}$/.test(pin.sha);
+}
+function prismicCiWorkflow(pin) {
+  return `# Delivers this site's Prismic model changes. Managed by @reddoorla/maintenance
+# (\`reddoor-maint prismic-ci\`) \u2014 change it there and re-run, not here.
+#
+# On a PR touching a model: comment the delta, write nothing.
+# On merge to ${APPLY_BRANCH}: push those models to Prismic. Never delete.
+#
+# THE BRANCH FILTER ON \`push:\` IS LOAD-BEARING, not tidiness. The reusable
+# workflow's apply job also guards \`github.ref == 'refs/heads/${APPLY_BRANCH}'\`,
+# and its comment calls this the other half of that gate: an unfiltered
+# \`on: push:\` fires on every branch AND every tag, so a feature branch's models
+# would reach production with no pull request and therefore no review anywhere in
+# the sequence. Keep both halves.
+name: prismic-models
+
+on:
+  # No branch filter here, deliberately: a model PR into any base deserves its
+  # delta comment, and the dry job is INCAPABLE of writing \u2014 it never passes
+  # \`--apply\`, and it holds no job that does.
+  pull_request:
+    paths:
+      - "customtypes/**"
+      - "src/lib/slices/**/model.json"
+  push:
+    branches: [${APPLY_BRANCH}]
+    paths:
+      - "customtypes/**"
+      - "src/lib/slices/**/model.json"
+
+jobs:
+  prismic-models:
+    # A called workflow's jobs can only NARROW what the caller granted, so the
+    # PR-comment permission has to be granted here as well as there. Nothing in
+    # either job pushes code, so \`contents\` stays read.
+    permissions:
+      contents: read
+      pull-requests: write
+    uses: ${REUSABLE_WORKFLOW}@${pin.sha} # ${pin.tag}
+    secrets:
+      # Spelled exactly as the reusable workflow declares it. A workflow-local
+      # alias would not be a rename \u2014 it would be an undeclared secret, and the
+      # required one would arrive empty.
+      ${SECRET}: \${{ secrets.${SECRET} }}
+`;
+}
+var PRISMIC_CI_WORKFLOW = prismicCiWorkflow(REUSABLE_WORKFLOW_PIN);
+
+// src/recipes/prismic-ci/cli-version.ts
+import { readFile } from "fs/promises";
+import { join } from "path";
+var MIN_CLI_VERSION = "0.83.0";
+var PACKAGE = "@reddoorla/maintenance";
+function atLeast(version, min) {
+  const parse = (v) => {
+    const [core = "", ...rest] = v.split("-");
+    return {
+      nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0),
+      pre: rest.length > 0
+    };
+  };
+  const a = parse(version);
+  const b = parse(min);
+  for (let i = 0; i < 3; i++) {
+    const av = a.nums[i] ?? 0;
+    const bv = b.nums[i] ?? 0;
+    if (av !== bv) return av > bv;
+  }
+  if (a.pre && !b.pre) return false;
+  return true;
+}
+async function readLockedCliVersion(repoRoot) {
+  let raw;
+  try {
+    raw = await readFile(join(repoRoot, "pnpm-lock.yaml"), "utf-8");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      return {
+        ok: false,
+        reason: `no pnpm-lock.yaml in the checkout \u2014 cannot tell which ${PACKAGE} version CI would run`
+      };
+    }
+    return { ok: false, reason: `pnpm-lock.yaml is present but unreadable (${String(err)})` };
+  }
+  const lines = raw.split("\n");
+  const importersAt = lines.findIndex((l) => /^importers:\s*$/.test(l));
+  if (importersAt === -1) {
+    return {
+      ok: false,
+      reason: "pnpm-lock.yaml has no `importers:` section \u2014 unrecognised lockfile shape"
+    };
+  }
+  const end = lines.findIndex((l, i) => i > importersAt && /^[a-zA-Z]/.test(l));
+  const importers = lines.slice(importersAt + 1, end === -1 ? lines.length : end);
+  const found = /* @__PURE__ */ new Set();
+  for (let i = 0; i < importers.length; i++) {
+    if (!new RegExp(`^\\s+'?${PACKAGE.replace("/", "\\/")}'?:\\s*$`).test(importers[i])) continue;
+    for (let j = i + 1; j < Math.min(i + 4, importers.length); j++) {
+      const m = /^\s+version:\s*(\S+)\s*$/.exec(importers[j]);
+      if (!m) continue;
+      found.add(m[1].split("(")[0]);
+      break;
+    }
+  }
+  if (found.size === 0) {
+    return { ok: false, reason: `${PACKAGE} is not a dependency in this repo's lockfile` };
+  }
+  if (found.size > 1) {
+    return {
+      ok: false,
+      reason: `lockfile resolves ${PACKAGE} to more than one version (${[...found].sort().join(", ")}) \u2014 refusing to guess which one CI would run`
+    };
+  }
+  return { ok: true, version: [...found][0] };
+}
+
+// src/recipes/prismic-ci/index.ts
+var BRANCH_PREFIX = "maint/prismic-ci-";
+var PRETTIER_TIMEOUT_MS = 6e4;
+var resultOf = (site, status, notes, commits = []) => ({
+  recipe: "prismic-ci",
+  site: siteLabel(site),
+  status,
+  commits,
+  notes
+});
+var messageOf = (err) => err instanceof Error ? err.message : String(err);
+function sameWorkflow(current, canonical) {
+  const norm = (s) => s.replace(/\r\n/g, "\n").replace(/\s+$/, "");
+  return norm(current) === norm(canonical);
+}
+async function prismicCi(site, deps = {}) {
+  const repo = site.gitRepo;
+  if (!repo) {
+    return resultOf(site, "failed", "no Git repo on this site (set Airtable 'Git repo')");
+  }
+  if (!isOwnerRepo(repo)) {
+    return resultOf(
+      site,
+      "failed",
+      `refusing to act on malformed repo identity: expected "owner/repo", got ${JSON.stringify(repo)}`
+    );
+  }
+  let isPrismic;
+  try {
+    isPrismic = await readPrismicConfig(site.path) !== null;
+  } catch (err) {
+    return resultOf(site, "failed", `could not read the Prismic config: ${messageOf(err)}`);
+  }
+  if (!isPrismic) return resultOf(site, "noop", "not a Prismic site (no repositoryName) \u2014 skipped");
+  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;
+  if (!isPinResolved(pin)) {
+    return resultOf(
+      site,
+      "failed",
+      `reusable-workflow pin is unresolved (${pin.sha}) \u2014 publish + tag the workflow in reddoorla/.github and set REUSABLE_WORKFLOW_PIN before rolling out`
+    );
+  }
+  const workflow = pin === REUSABLE_WORKFLOW_PIN ? PRISMIC_CI_WORKFLOW : prismicCiWorkflow(pin);
+  const locked = await readLockedCliVersion(site.path);
+  if (!locked.ok) {
+    return resultOf(
+      site,
+      "failed",
+      `cannot establish which @reddoorla/maintenance version this repo's CI would run (${locked.reason}) \u2014 refusing to install a workflow that may not run`
+    );
+  }
+  if (!atLeast(locked.version, MIN_CLI_VERSION)) {
+    return resultOf(
+      site,
+      "failed",
+      `this repo's lockfile pins @reddoorla/maintenance ${locked.version}, which has no \`prismic-models\` command (first shipped in ${MIN_CLI_VERSION}) \u2014 bump the dependency and commit the lockfile first, or the workflow fails on its first model PR`
+    );
+  }
+  const ghConfig = readGitHubConfig();
+  if (!deps.github && !ghConfig) return resultOf(site, "failed", "GITHUB_TOKEN not set");
+  const gh = deps.github ?? makeGitHub({ token: ghConfig.token });
+  const spawn = deps.spawn ?? defaultSpawn;
+  let hasSecret;
+  try {
+    hasSecret = await gh.secretExists(repo, SECRET);
+  } catch (err) {
+    return resultOf(
+      site,
+      "failed",
+      `could not determine whether ${repo} has the ${SECRET} secret (${messageOf(err)}) \u2014 refusing to install a workflow that may have no token`
+    );
+  }
+  if (!hasSecret) {
+    return resultOf(
+      site,
+      "failed",
+      `${repo} has no ${SECRET} Actions secret \u2014 the workflow reds the repo on its first model PR without it. Mint one, then: gh secret set ${SECRET} --repo ${repo}`
+    );
+  }
+  let base;
+  try {
+    base = await gh.defaultBranch(repo);
+  } catch (err) {
+    return resultOf(
+      site,
+      "failed",
+      `could not read the default branch of ${repo}: ${messageOf(err)}`
+    );
+  }
+  if (base !== APPLY_BRANCH) {
+    return resultOf(
+      site,
+      "failed",
+      `default branch of ${repo} is ${base}, not ${APPLY_BRANCH} \u2014 the reusable workflow's apply job guards refs/heads/${APPLY_BRANCH}, so merged model changes would never reach Prismic`
+    );
+  }
+  const existing = await gh.fileContentsOnBranch(repo, base, WORKFLOW_PATH);
+  if (existing !== null && sameWorkflow(existing, workflow)) {
+    return resultOf(site, "noop", `delivery workflow already current on ${base}`);
+  }
+  const open = (await gh.openPullRequests(repo)).find((pr) => pr.headRef.startsWith(BRANCH_PREFIX));
+  if (open) {
+    return resultOf(site, "noop", `delivery workflow PR already open: ${open.url}`);
+  }
+  if (!await isWorkingTreeClean(site.path)) {
+    return resultOf(site, "failed", "working tree not clean \u2014 commit or stash first");
+  }
+  let original = null;
+  try {
+    original = await currentBranch(site.path);
+  } catch {
+  }
+  const branch = branchName("prismic-ci");
+  const commits = [];
+  let pushedOrOpened = false;
+  try {
+    await createBranch(site.path, branch);
+    const dest = join2(site.path, WORKFLOW_PATH);
+    await mkdir(dirname(dest), { recursive: true });
+    await writeFile(dest, workflow, "utf-8");
+    const notes = [];
+    const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(site.path);
+    if (bin === null) {
+      notes.push(PRETTIER_FLAG_NOTE);
+    } else if (!await formatWithPrettier(spawn, site.path, [WORKFLOW_PATH], {
+      bin,
+      timeoutMs: PRETTIER_TIMEOUT_MS
+    })) {
+      notes.push(PRETTIER_FLAG_NOTE);
+    } else if (!sameWorkflow(await readFile2(dest, "utf-8"), workflow)) {
+      notes.push(
+        "this site's prettier reformatted the workflow \u2014 re-runs will not match it as current"
+      );
+    }
+    const sha = await commit(site.path, "ci: deliver Prismic model changes from merged PRs");
+    if (!sha) {
+      return resultOf(
+        site,
+        "noop",
+        `${WORKFLOW_PATH} already present and identical in the checkout`
+      );
+    }
+    commits.push(sha);
+    pushedOrOpened = true;
+    await (deps.pushBranch ?? push)(site.path, branch);
+    const pr = await gh.openPullRequest(repo, {
+      head: branch,
+      base,
+      title: "Deliver Prismic model changes from merged PRs",
+      body: "Adds the `prismic-models` workflow. On a PR touching `customtypes/**` or `src/lib/slices/**/model.json` it comments the model delta and writes nothing; on merge to main it pushes those models to Prismic. It can create and update models but never delete \u2014 a model present only in Prismic is reported, not touched."
+    });
+    notes.unshift(`opened PR ${pr.url}`);
+    return resultOf(site, "applied", notes.join("; "), commits);
+  } catch (err) {
+    return resultOf(site, "failed", messageOf(err), commits);
+  } finally {
+    if (original !== null && original !== branch) {
+      try {
+        await checkoutBranch(site.path, original);
+        if (!pushedOrOpened) await deleteBranch(site.path, branch);
+      } catch (err) {
+        console.warn(
+          `warning: could not restore branch ${original} after prismic-ci: ${messageOf(err)}`
+        );
+      }
+    }
+  }
+}
+
+// src/cli/commands/prismic-ci.ts
+var messageOf2 = (err) => err instanceof Error ? err.message : String(err);
+var failedRow = (site, notes) => ({
+  recipe: "prismic-ci",
+  site,
+  status: "failed",
+  commits: [],
+  notes
+});
+function formatPrismicCiResults(results) {
+  const lines = results.map((r) => `[${r.site}] ${r.status}: ${r.notes ?? ""}`.trimEnd());
+  const n = (s) => results.filter((r) => r.status === s).length;
+  const failed = n("failed");
+  lines.push("");
+  if (failed > 0 && n("applied") === 0) {
+    lines.push(
+      `\u26D4 NO SITE GOT THE DELIVERY WORKFLOW. ${failed} of ${results.length} site(s) failed and not one pull request was opened, so no site's model changes reach Prismic on merge. Do NOT read this run as a rollout.`
+    );
+    lines.push("");
+  }
+  lines.push(`${n("applied")} applied, ${n("noop")} noop, ${failed} failed.`);
+  return lines.join("\n");
+}
+async function checkoutFailure(repoRoot) {
+  let entries;
+  try {
+    entries = await readdir(repoRoot);
+  } catch (e) {
+    return `cannot read this checkout at ${repoRoot}: ${messageOf2(e)}`;
+  }
+  return noWorkingTreeFailure(
+    repoRoot,
+    entries,
+    "No delivery workflow was proposed for it and no pull request was opened"
+  );
+}
+async function runPrismicCiCommand(site, opts, deps = {}) {
+  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();
+  let sites = await resolveSites({
+    ...site !== void 0 ? { site } : {},
+    ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
+    // Passed through because `--fleet airtable` derives each site's path from
+    // it; without it the keyword inventory would resolve paths under a different
+    // workdir than the one this run then prepares and commits in.
+    ...opts.workdir !== void 0 ? { workdir: opts.workdir } : {},
+    cwd
+  });
+  if (sites.length === 0) {
+    return {
+      output: `the inventory resolved NO SITES, so no site was offered the delivery workflow. This is not a delivered fleet \u2014 check the inventory (an Airtable view filter, an empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a rollout.`,
+      code: 1
+    };
+  }
+  let skipped = [];
+  if (opts.fleet) {
+    const prep = await prepareFleetSites(sites, { workdir: opts.workdir ?? fleetWorkdir() });
+    sites = prep.prepared;
+    skipped = prep.skipped;
+  }
+  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;
+  const pinUnresolved = !isPinResolved(pin) ? `\u26D4 the reusable-workflow pin is unresolved (${pin.sha}) \u2014 every site below would be REFUSED, not delivered. Publish and tag the workflow in reddoorla/.github, then set REUSABLE_WORKFLOW_PIN.` : "";
+  if (opts.dry) {
+    const lines = sites.map(
+      (s) => `[${siteLabel(s)}] would be offered the delivery workflow (no gate was evaluated: the secret, default-branch and already-delivered checks run only on a real run)`
+    );
+    return {
+      output: appendSkipNotice(
+        [pinUnresolved, lines.join("\n")].filter((s) => s !== "").join("\n\n"),
+        skipped
+      ),
+      code: pinUnresolved === "" ? 0 : 1
+    };
+  }
+  const run = deps.runRecipe ?? ((s) => prismicCi(s, { pin }));
+  const results = await runRecipeOverSites("prismic-ci", sites, async (s) => {
+    const failure = await checkoutFailure(s.path);
+    return failure ? failedRow(siteLabel(s), failure) : run(s);
+  });
+  for (const s of skipped) {
+    results.push(
+      failedRow(
+        s.site,
+        `could not prepare this checkout: ${s.reason}. No delivery workflow was proposed for it \u2014 this is NOT "this site already has one".`
+      )
+    );
+  }
+  return {
+    output: appendSkipNotice(formatPrismicCiResults(results), skipped),
+    code: results.some((r) => r.status === "failed") ? 1 : 0
+  };
+}
+export {
+  formatPrismicCiResults,
+  runPrismicCiCommand
+};
+//# sourceMappingURL=prismic-ci-4PDATHU6.js.map