@reddoorla/maintenance 0.96.0 → 0.97.0

package/dist/{orchestrate-TGDFGY52.js → orchestrate-L2A5BZFY.js}

@@ -4,21 +4,24 @@ import {
   parseAddresses,
   sendApprovedReports,
   withGlobalCc
-} from "./chunk-P4A6D6HO.js";
-import "./chunk-F3JWOPTG.js";
+} from "./chunk-LDHRIQUW.js";
+import "./chunk-TEMQPSCM.js";
+import "./chunk-ASLDCWBF.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-IY6256GK.js";
+import "./chunk-YJBSB4LP.js";
 import "./chunk-HN6I2XWI.js";
-import "./chunk-Y5BVR4HW.js";
+import "./chunk-6THEZQLA.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-KJGKZLCT.js";
 import "./chunk-BGTYPVLT.js";
-import "./chunk-MZZDMBDT.js";
-import "./chunk-KN52PM63.js";
+import "./chunk-LZMAG73U.js";
+import "./chunk-TC4GANMX.js";
+import "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 import "./chunk-WEKL2HYJ.js";
-import "./chunk-EQQ4H6L3.js";
-import "./chunk-6INOBNRO.js";
-import "./chunk-T76MA2FH.js";
+import "./chunk-YXWBM26P.js";
+import "./chunk-MMSMZC7S.js";
+import "./chunk-IOTOOTII.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-6VAL7XJT.js";
 export {
@@ -28,4 +31,4 @@ export {
   sendApprovedReports,
   withGlobalCc
 };
-//# sourceMappingURL=orchestrate-TGDFGY52.js.map
+//# sourceMappingURL=orchestrate-L2A5BZFY.js.map

package/dist/parity-2JGVUCZD.js

@@ -0,0 +1,14 @@
+import {
+  checkFleetParity,
+  formatParityResult
+} from "./chunk-TVZ6QCOE.js";
+import "./chunk-BINFZQ2T.js";
+import "./chunk-LF2TJN4X.js";
+import "./chunk-ASLDCWBF.js";
+import "./chunk-VAD43MOR.js";
+import "./chunk-ICSRWW5Q.js";
+export {
+  checkFleetParity,
+  formatParityResult
+};
+//# sourceMappingURL=parity-2JGVUCZD.js.map

package/dist/{preflight-POZZI3GN.js → preflight-O7Q6FWHU.js}

@@ -1,22 +1,25 @@
 import {
   preflight
-} from "./chunk-OTEVKRAH.js";
+} from "./chunk-VMGHQUTV.js";
 import "./chunk-PZR4EBPY.js";
-import "./chunk-P4A6D6HO.js";
-import "./chunk-F3JWOPTG.js";
+import "./chunk-LDHRIQUW.js";
+import "./chunk-TEMQPSCM.js";
+import "./chunk-ASLDCWBF.js";
 import "./chunk-VAD43MOR.js";
-import "./chunk-IY6256GK.js";
+import "./chunk-YJBSB4LP.js";
 import "./chunk-HN6I2XWI.js";
-import "./chunk-Y5BVR4HW.js";
+import "./chunk-6THEZQLA.js";
 import "./chunk-GECESMVS.js";
 import "./chunk-KJGKZLCT.js";
 import "./chunk-BGTYPVLT.js";
-import "./chunk-MZZDMBDT.js";
-import "./chunk-KN52PM63.js";
+import "./chunk-LZMAG73U.js";
+import "./chunk-TC4GANMX.js";
+import "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 import "./chunk-WEKL2HYJ.js";
-import "./chunk-EQQ4H6L3.js";
-import "./chunk-6INOBNRO.js";
-import "./chunk-T76MA2FH.js";
+import "./chunk-YXWBM26P.js";
+import "./chunk-MMSMZC7S.js";
+import "./chunk-IOTOOTII.js";
 import "./chunk-RARREDQE.js";
 import "./chunk-6VAL7XJT.js";
 
@@ -31,6 +34,21 @@ function formatSite(r) {
   if (r.findings.length === 0) return `[${r.site}] \u2713 clean`;
   return r.findings.map((f) => `[${r.site}] ${MARK[f.level]} ${f.check}: ${f.message}`).join("\n");
 }
+function lazyFleetDb() {
+  let db = null;
+  return {
+    get: async () => {
+      if (!db) {
+        const { openDb, readDbConfig } = await import("./client-DGTO65WB.js");
+        db = await openDb(readDbConfig());
+      }
+      return db;
+    },
+    close: async () => {
+      if (db) await db.destroy();
+    }
+  };
+}
 async function runPreflightCommand(site, opts) {
   if (Boolean(site) === Boolean(opts.all)) {
     return { output: "Provide exactly one of <site> or --all.", code: 2 };
@@ -43,8 +61,12 @@ async function runPreflightCommand(site, opts) {
       code: 2
     };
   }
+  const { listSites, listAllReports } = await import("./fleet-state-RJROYXKO.js");
+  const fleetDb = lazyFleetDb();
   try {
     const { results, fleet } = await preflight({
+      roster: async () => listSites(await fleetDb.get()),
+      allReports: async () => listAllReports(await fleetDb.get()),
       ...site ? { site } : {},
       ...opts.all ? { all: true } : {},
       type
@@ -62,9 +84,11 @@ async function runPreflightCommand(site, opts) {
   } catch (err) {
     const e = err;
     return { output: e.message ?? String(err), code: e.exitCode ?? 1 };
+  } finally {
+    await fleetDb.close();
   }
 }
 export {
   runPreflightCommand
 };
-//# sourceMappingURL=preflight-POZZI3GN.js.map
+//# sourceMappingURL=preflight-O7Q6FWHU.js.map

package/dist/preflight-O7Q6FWHU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/preflight.ts"],"sourcesContent":["import {\n  preflight,\n  type PreflightSiteResult,\n  type PreflightFinding,\n} from \"../../reports/preflight.js\";\nimport type { ReportType } from \"../../reports/types.js\";\nimport type { Db } from \"../../db/client.js\";\n\nexport type PreflightCommandOptions = {\n  type?: string;\n  all?: boolean;\n  cwd?: string;\n};\n\nconst TYPES: Record<string, ReportType> = {\n  announcement: \"Announcement\",\n  maintenance: \"Maintenance\",\n  testing: \"Testing\",\n};\n\nconst MARK: Record<PreflightFinding[\"level\"], string> = { fail: \"✗\", warn: \"⚠\", info: \"ℹ\" };\n\nfunction formatSite(r: PreflightSiteResult): string {\n  if (r.findings.length === 0) return `[${r.site}] ✓ clean`;\n  return r.findings.map((f) => `[${r.site}] ${MARK[f.level]} ${f.check}: ${f.message}`).join(\"\\n\");\n}\n\n/**\n * `preflight [site]` — read-only pre-send checks over the live fleet rows: everything\n * that would make a report send fail, reach the wrong inbox, or surprise the operator.\n * Exit 0 = safe (warnings allowed, printed), 1 = at least one hard failure, 2 = bad args.\n */\n/** One lazily-opened, once-closed libSQL connection for this command's reads\n *  (#646 step 4). Lazy for the same reason as `report --digest`'s: a run that\n *  returns before any read must not need `TURSO_DATABASE_URL`. */\nfunction lazyFleetDb(): { get: () => Promise<Db>; close: () => Promise<void> } {\n  let db: Db | null = null;\n  return {\n    get: async () => {\n      if (!db) {\n        const { openDb, readDbConfig } = await import(\"../../db/client.js\");\n        db = await openDb(readDbConfig());\n      }\n      return db;\n    },\n    close: async () => {\n      if (db) await db.destroy();\n    },\n  };\n}\n\nexport async function runPreflightCommand(\n  site: string | undefined,\n  opts: PreflightCommandOptions,\n): Promise<{ output: string; code: number }> {\n  if (Boolean(site) === Boolean(opts.all)) {\n    return { output: \"Provide exactly one of <site> or --all.\", code: 2 };\n  }\n  const typeKey = (opts.type ?? \"announcement\").toLowerCase();\n  const type = TYPES[typeKey];\n  if (!type) {\n    return {\n      output: `Unknown --type '${opts.type}'. Supported: ${Object.keys(TYPES).join(\", \")}`,\n      code: 2,\n    };\n  }\n\n  // #646 step 4: the rows come from Turso. ONE connection for both reads, opened\n  // lazily on the first read and closed when the checks are done — a run that\n  // returns before reading (bad args, an injected preflight) needs no database.\n  const { listSites, listAllReports } = await import(\"../../db/fleet-state.js\");\n  const fleetDb = lazyFleetDb();\n  try {\n    const { results, fleet } = await preflight({\n      roster: async () => listSites(await fleetDb.get()),\n      allReports: async () => listAllReports(await fleetDb.get()),\n      ...(site ? { site } : {}),\n      ...(opts.all ? { all: true } : {}),\n      type,\n    });\n    if (results.length === 0) return { output: \"No matching sites.\", code: 1 };\n\n    const lines = results.map(formatSite);\n    for (const f of fleet) lines.push(`[fleet] ${MARK[f.level]} ${f.check}: ${f.message}`);\n\n    const all = [...results.flatMap((r) => r.findings), ...fleet];\n    const fails = all.filter((f) => f.level === \"fail\").length;\n    const warns = all.filter((f) => f.level === \"warn\").length;\n    lines.push(\n      `Preflight: ${results.length} site(s) — ${fails} fail, ${warns} warn. ${\n        fails > 0 ? \"NOT safe to send.\" : \"Safe to send (review warnings).\"\n      }`,\n    );\n    return { output: lines.join(\"\\n\"), code: fails > 0 ? 1 : 0 };\n  } catch (err) {\n    const e = err as { message?: string; exitCode?: number };\n    return { output: e.message ?? String(err), code: e.exitCode ?? 1 };\n  } finally {\n    await fleetDb.close();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,IAAM,QAAoC;AAAA,EACxC,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AACX;AAEA,IAAM,OAAkD,EAAE,MAAM,UAAK,MAAM,UAAK,MAAM,SAAI;AAE1F,SAAS,WAAW,GAAgC;AAClD,MAAI,EAAE,SAAS,WAAW,EAAG,QAAO,IAAI,EAAE,IAAI;AAC9C,SAAO,EAAE,SAAS,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,EAAE,KAAK,IAAI;AACjG;AAUA,SAAS,cAAsE;AAC7E,MAAI,KAAgB;AACpB,SAAO;AAAA,IACL,KAAK,YAAY;AACf,UAAI,CAAC,IAAI;AACP,cAAM,EAAE,QAAQ,aAAa,IAAI,MAAM,OAAO,sBAAoB;AAClE,aAAK,MAAM,OAAO,aAAa,CAAC;AAAA,MAClC;AACA,aAAO;AAAA,IACT;AAAA,IACA,OAAO,YAAY;AACjB,UAAI,GAAI,OAAM,GAAG,QAAQ;AAAA,IAC3B;AAAA,EACF;AACF;AAEA,eAAsB,oBACpB,MACA,MAC2C;AAC3C,MAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,GAAG,GAAG;AACvC,WAAO,EAAE,QAAQ,2CAA2C,MAAM,EAAE;AAAA,EACtE;AACA,QAAM,WAAW,KAAK,QAAQ,gBAAgB,YAAY;AAC1D,QAAM,OAAO,MAAM,OAAO;AAC1B,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL,QAAQ,mBAAmB,KAAK,IAAI,iBAAiB,OAAO,KAAK,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,MAClF,MAAM;AAAA,IACR;AAAA,EACF;AAKA,QAAM,EAAE,WAAW,eAAe,IAAI,MAAM,OAAO,2BAAyB;AAC5E,QAAM,UAAU,YAAY;AAC5B,MAAI;AACF,UAAM,EAAE,SAAS,MAAM,IAAI,MAAM,UAAU;AAAA,MACzC,QAAQ,YAAY,UAAU,MAAM,QAAQ,IAAI,CAAC;AAAA,MACjD,YAAY,YAAY,eAAe,MAAM,QAAQ,IAAI,CAAC;AAAA,MAC1D,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,MACvB,GAAI,KAAK,MAAM,EAAE,KAAK,KAAK,IAAI,CAAC;AAAA,MAChC;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,WAAW,EAAG,QAAO,EAAE,QAAQ,sBAAsB,MAAM,EAAE;AAEzE,UAAM,QAAQ,QAAQ,IAAI,UAAU;AACpC,eAAW,KAAK,MAAO,OAAM,KAAK,WAAW,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE;AAErF,UAAM,MAAM,CAAC,GAAG,QAAQ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,GAAG,KAAK;AAC5D,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,UAAU,MAAM,EAAE;AACpD,UAAM;AAAA,MACJ,cAAc,QAAQ,MAAM,mBAAc,KAAK,UAAU,KAAK,UAC5D,QAAQ,IAAI,sBAAsB,iCACpC;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,MAAM,KAAK,IAAI,GAAG,MAAM,QAAQ,IAAI,IAAI,EAAE;AAAA,EAC7D,SAAS,KAAK;AACZ,UAAM,IAAI;AACV,WAAO,EAAE,QAAQ,EAAE,WAAW,OAAO,GAAG,GAAG,MAAM,EAAE,YAAY,EAAE;AAAA,EACnE,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;","names":[]}

package/dist/{prismic-ci-AHY5ULJR.js → prismic-ci-NAPWOXXD.js}

@@ -9,23 +9,23 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-SHGIDTYF.js";
+} from "./chunk-DYTYPKFN.js";
 import {
   resolveSites
-} from "./chunk-H445EH33.js";
+} from "./chunk-FP6HOW6J.js";
+import {
+  RESTORED_NOTE,
+  refusedByGit,
+  undoRefusedWrites
+} from "./chunk-TJLKWQOX.js";
 import {
   PRETTIER_FLAG_NOTE,
   formatWithPrettier,
   resolveTargetPrettier
 } from "./chunk-5CJVUPJU.js";
-import {
-  RESTORED_NOTE,
-  refusedByGit,
-  undoRefusedWrites
-} from "./chunk-4UTJ4G6P.js";
 import {
   readGitHubConfig
-} from "./chunk-CGQZFQAY.js";
+} from "./chunk-MVKNU4QD.js";
 import {
   makeGitHub
 } from "./chunk-43SW3FGW.js";
@@ -49,7 +49,7 @@ import {
   push,
   resolveOwnerRepo,
   sameOwnerRepo
-} from "./chunk-EASYCD6F.js";
+} from "./chunk-WMF5S2MB.js";
 
 // src/cli/commands/prismic-ci.ts
 import { readdir } from "fs/promises";
@@ -422,7 +422,7 @@ async function runPrismicCiCommand(site, opts, deps = {}) {
   let sites = await resolveSites({
     ...site !== void 0 ? { site } : {},
     ...opts.fleet !== void 0 ? { fleet: opts.fleet } : {},
-    // Passed through because `--fleet airtable` derives each site's path from
+    // Passed through because `--fleet turso` derives each site's path from
     // it; without it the keyword inventory would resolve paths under a different
     // workdir than the one this run then prepares and commits in.
     ...opts.workdir !== void 0 ? { workdir: opts.workdir } : {},
@@ -476,4 +476,4 @@ export {
   formatPrismicCiResults,
   runPrismicCiCommand
 };
-//# sourceMappingURL=prismic-ci-AHY5ULJR.js.map
+//# sourceMappingURL=prismic-ci-NAPWOXXD.js.map

package/dist/prismic-ci-NAPWOXXD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/commands/prismic-ci.ts","../src/recipes/prismic-ci/index.ts","../src/recipes/prismic-ci/template.ts","../src/recipes/prismic-ci/cli-version.ts"],"sourcesContent":["// The fleet face of the `prismic-ci` recipe: land the Prismic model delivery\n// workflow across the fleet, as ONE PULL REQUEST PER REPOSITORY.\n//\n// The blast radius is fifteen live client repositories, and the failure this\n// file is written against is not a bad PR — the recipe's gates handle that, and\n// nothing here can push to a client's main. It is the QUIET one: a run that\n// touched nothing and exited 0, read as a finished rollout. Three facts only the\n// fleet layer can get wrong produce it, and each has a refusal below:\n//\n//   - an inventory that resolved NOBODY prints \"0 applied, 0 noop, 0 failed.\"\n//     and exits 0, which is indistinguishable from a fleet with nothing left to\n//     do. The Airtable inventory is view-filtered; one filter change empties it\n//     with no error anywhere.\n//   - a site that could not be PREPARED is isolated into `skipped` by\n//     `prepareFleetSites` (correctly — one bad row must not abort the fleet) and\n//     then disappears from a summary built out of `prepared` alone. It gets a\n//     `failed` ROW, because the count is the only thing a machine reads.\n//   - a checkout holding `.git` and nothing else answers \"not a Prismic site\" to\n//     every read inside it, so the site noops out of the rollout for good — a\n//     fleet workdir reuses any non-empty directory forever. Guarded BEFORE the\n//     recipe runs: a tree nobody established is not a tree to branch from.\n//\n// SEQUENTIAL, one site at a time, like every other fleet recipe command — see\n// `runRecipeOverSites`. Each site does git work in its own checkout plus a\n// handful of GitHub calls; there is no Airtable write on this path (so the\n// fleet's ≤4.5 req/s throttle does not apply) and nothing parallelism would buy\n// except a burst of writes against fifteen repositories at once.\nimport { readdir } from \"node:fs/promises\";\nimport { resolve } from \"node:path\";\nimport { prismicCi } from \"../../recipes/prismic-ci/index.js\";\nimport {\n  REUSABLE_WORKFLOW_PIN,\n  isPinResolved,\n  type ReusableWorkflowPin,\n} from \"../../recipes/prismic-ci/template.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport { fleetWorkdir } from \"../../util/fleet-workdir.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { noWorkingTreeFailure } from \"../../util/working-tree.js\";\nimport { appendSkipNotice, prepareFleetSites, type SkippedSite } from \"../fleet/prepare-sites.js\";\nimport { resolveSites } from \"../fleet/resolve-sites.js\";\nimport { runRecipeOverSites } from \"../fleet/run-recipe-over-sites.js\";\n\nexport type PrismicCiCommandOptions = {\n  fleet?: string;\n  workdir?: string;\n  dry?: boolean;\n  cwd?: string;\n};\n\n/** Injected only by tests, so the fleet layer's aggregation — counts, exit code,\n *  refusals — is exercised without git, GitHub or a network. Production runs the\n *  real recipe. */\nexport type PrismicCiCommandDeps = {\n  runRecipe?: (site: Site) => Promise<RecipeResult>;\n  /**\n   * Which `reddoorla/.github` commit this run would pin. Injected only by tests;\n   * production uses the shipped {@link REUSABLE_WORKFLOW_PIN}.\n   *\n   * It is injectable because the unresolved-pin refusal is a SAFETY behaviour\n   * that must be tested in both directions at all times, and a test that reads\n   * the shipped constant can only ever exercise whichever direction the constant\n   * currently happens to be in. Two tests here did exactly that, and the release\n   * that resolved the pin turned them from \"the refusal works\" into a red suite\n   * with the refusal itself no longer covered by anything.\n   */\n  pin?: ReusableWorkflowPin;\n};\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\nconst failedRow = (site: string, notes: string): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site,\n  status: \"failed\",\n  commits: [],\n  notes,\n});\n\n/**\n * One line per site plus a counts summary — the shape every fleet rollout\n * prints, so a sweep over fifteen repos is scannable.\n *\n * The banner above the counts is not decoration. A rollout in which every site\n * failed prints fifteen `[site] failed:` lines and then an arithmetic exercise;\n * the one fact an operator needs from that run — NOT ONE repository got the\n * workflow — has to be stated. It is keyed on \"sites were attempted and none was\n * applied\", not on \"nothing was applied\": a fleet that is already fully\n * delivered applies nothing every time it runs, and a banner that shouts at that\n * run is a banner nobody reads at the run above.\n */\nexport function formatPrismicCiResults(results: RecipeResult[]): string {\n  const lines = results.map((r) => `[${r.site}] ${r.status}: ${r.notes ?? \"\"}`.trimEnd());\n  const n = (s: RecipeResult[\"status\"]) => results.filter((r) => r.status === s).length;\n  const failed = n(\"failed\");\n  lines.push(\"\");\n  if (failed > 0 && n(\"applied\") === 0) {\n    lines.push(\n      `⛔ NO SITE GOT THE DELIVERY WORKFLOW. ${failed} of ${results.length} site(s) failed and` +\n        ` not one pull request was opened, so no site's model changes reach Prismic on merge.` +\n        ` Do NOT read this run as a rollout.`,\n    );\n    lines.push(\"\");\n  }\n  lines.push(`${n(\"applied\")} applied, ${n(\"noop\")} noop, ${failed} failed.`);\n  return lines.join(\"\\n\");\n}\n\n/**\n * Is there a checkout here at all, or the named reason there is not?\n *\n * Runs BEFORE the recipe, for both the reason in {@link noWorkingTreeFailure}\n * and one this command adds: the recipe's next steps create a branch, write a\n * file and commit it. A directory nobody managed to check out is not a tree to\n * do that in, and the answer the recipe would otherwise reach — \"not a Prismic\n * site\" — is the one answer that quietly removes the site from the rollout.\n *\n * A `readdir` that THROWS is its own failure and never the skip: a path that\n * does not exist, or one this process cannot read, is not a repo without\n * Prismic in it.\n */\nasync function checkoutFailure(repoRoot: string): Promise<string | null> {\n  let entries: string[];\n  try {\n    entries = await readdir(repoRoot);\n  } catch (e) {\n    return `cannot read this checkout at ${repoRoot}: ${messageOf(e)}`;\n  }\n  return noWorkingTreeFailure(\n    repoRoot,\n    entries,\n    \"No delivery workflow was proposed for it and no pull request was opened\",\n  );\n}\n\n/**\n * Roll the delivery workflow out to one site or to the fleet.\n *\n * `resolveSites` is allowed to THROW (a positional site alongside `--fleet`, an\n * unsupported inventory extension, an Airtable read that failed). Those are \"the\n * fleet itself could not be established\", which has no per-site row to live in\n * and must not be reported as a rollout across zero sites; `bin.ts` prints the\n * message and exits with the error's own `exitCode`.\n */\nexport async function runPrismicCiCommand(\n  site: string | undefined,\n  opts: PrismicCiCommandOptions,\n  deps: PrismicCiCommandDeps = {},\n): Promise<{ output: string; code: number }> {\n  const cwd = opts.cwd ? resolve(opts.cwd) : process.cwd();\n  let sites = await resolveSites({\n    ...(site !== undefined ? { site } : {}),\n    ...(opts.fleet !== undefined ? { fleet: opts.fleet } : {}),\n    // Passed through because `--fleet turso` derives each site's path from\n    // it; without it the keyword inventory would resolve paths under a different\n    // workdir than the one this run then prepares and commits in.\n    ...(opts.workdir !== undefined ? { workdir: opts.workdir } : {}),\n    cwd,\n  });\n\n  // NOTHING RESOLVED IS NOT A DELIVERED FLEET — the refusal `runFleetSweep` and\n  // the token doctor both open with, for the same reason: the summary below\n  // would print \"0 applied, 0 noop, 0 failed.\" over no rows at all and exit 0,\n  // which is exactly what a finished rollout looks like.\n  if (sites.length === 0) {\n    return {\n      output:\n        `the inventory resolved NO SITES, so no site was offered the delivery workflow.` +\n        ` This is not a delivered fleet — check the inventory (an Airtable view filter, an` +\n        ` empty JSON file, a dynamic inventory returning []). Do NOT read this exit as a` +\n        ` rollout.`,\n      code: 1,\n    };\n  }\n\n  let skipped: SkippedSite[] = [];\n  if (opts.fleet) {\n    const prep = await prepareFleetSites(sites, { workdir: opts.workdir ?? fleetWorkdir() });\n    sites = prep.prepared;\n    skipped = prep.skipped;\n  }\n\n  // THE PIN, checked here as well as in the recipe — not a second copy of the\n  // gate but the same exported predicate on the same pin, asked at the one point\n  // the recipe cannot answer for: a `--dry` run never reaches the recipe at all,\n  // and a preview that promised fifteen pull requests the real run would refuse\n  // is a preview of something that cannot happen.\n  //\n  // ONE pin object serves both this preview and the recipe below, so the preview\n  // can never be answering about a different pin than the run it previews.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  const pinUnresolved = !isPinResolved(pin)\n    ? `⛔ the reusable-workflow pin is unresolved (${pin.sha}) — every site` +\n      ` below would be REFUSED, not delivered. Publish and tag the workflow in` +\n      ` reddoorla/.github, then set REUSABLE_WORKFLOW_PIN.`\n    : \"\";\n\n  if (opts.dry) {\n    const lines = sites.map(\n      (s) =>\n        `[${siteLabel(s)}] would be offered the delivery workflow (no gate was evaluated:` +\n        ` the secret, default-branch and already-delivered checks run only on a real run)`,\n    );\n    return {\n      output: appendSkipNotice(\n        [pinUnresolved, lines.join(\"\\n\")].filter((s) => s !== \"\").join(\"\\n\\n\"),\n        skipped,\n      ),\n      code: pinUnresolved === \"\" ? 0 : 1,\n    };\n  }\n\n  const run = deps.runRecipe ?? ((s: Site) => prismicCi(s, { pin }));\n  const results = await runRecipeOverSites(\"prismic-ci\", sites, async (s) => {\n    const failure = await checkoutFailure(s.path);\n    return failure ? failedRow(siteLabel(s), failure) : run(s);\n  });\n\n  // A SITE THAT COULD NOT BE PREPARED IS A SITE THAT DID NOT GET THE WORKFLOW,\n  // and it gets a row. `prepareFleetSites` isolates the clone failure into\n  // `skipped`, which is right and is also exactly how a site disappears: a\n  // summary walking `prepared` alone counts a fleet-wide clone outage — an\n  // expired App token, GitHub down, a full disk — as \"0 applied, 0 failed\",\n  // exit 0. The notice below stays; the row is what makes the site countable.\n  for (const s of skipped) {\n    results.push(\n      failedRow(\n        s.site,\n        `could not prepare this checkout: ${s.reason}. No delivery workflow was proposed` +\n          ` for it — this is NOT \"this site already has one\".`,\n      ),\n    );\n  }\n\n  return {\n    output: appendSkipNotice(formatPrismicCiResults(results), skipped),\n    code: results.some((r) => r.status === \"failed\") ? 1 : 0,\n  };\n}\n","import { mkdir, readFile, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { defaultSpawn, type SpawnFn } from \"../../audits/util/spawn.js\";\nimport { readGitHubConfig } from \"../../github/config.js\";\nimport { makeGitHub, type GitHub } from \"../../github/gh.js\";\nimport { readPrismicConfig } from \"../../prismic/models/index.js\";\nimport type { RecipeResult, Site } from \"../../types.js\";\nimport {\n  branchName,\n  checkoutBranch,\n  commit as gitCommit,\n  createBranch,\n  currentBranch,\n  deleteBranch,\n  getRemoteUrl,\n  isWorkingTreeClean,\n  push as gitPush,\n  resolveOwnerRepo,\n  sameOwnerRepo,\n} from \"../../util/git.js\";\nimport { siteLabel } from \"../../util/site.js\";\nimport { formatWithPrettier, resolveTargetPrettier, PRETTIER_FLAG_NOTE } from \"../_prettier.js\";\nimport { refusedByGit, undoRefusedWrites, RESTORED_NOTE } from \"../_head-guard.js\";\nimport {\n  APPLY_BRANCH,\n  PRISMIC_CI_WORKFLOW,\n  REUSABLE_WORKFLOW_PIN,\n  SECRET,\n  WORKFLOW_PATH,\n  isPinResolved,\n  prismicCiWorkflow,\n  type ReusableWorkflowPin,\n} from \"./template.js\";\nimport { MIN_CLI_VERSION, atLeast, readLockedCliVersion } from \"./cli-version.js\";\n\n/** Head-branch prefix of every PR this recipe opens. `branchName(\"prismic-ci\")`\n *  produces `maint/prismic-ci-<timestamp>`, and the re-run guard matches on this\n *  prefix — the same idiom as `findOpenSelfUpdatingPR`. */\nconst BRANCH_PREFIX = \"maint/prismic-ci-\";\n\n/** How long the target's prettier gets. Also what makes the fleet's default\n *  spawn detach the child, so the kill reaches prettier and not just a wrapper.\n *  Matches the pull-down path's budget in `src/prismic/models/write.ts`. */\nconst PRETTIER_TIMEOUT_MS = 60_000;\n\n/** Just the GitHub surface this recipe touches, so a test fake is five methods\n *  rather than thirty. `makeGitHub()` satisfies it structurally. */\nexport type PrismicCiGitHub = Pick<\n  GitHub,\n  \"defaultBranch\" | \"secretExists\" | \"fileContentsOnBranch\" | \"openPullRequest\" | \"openPullRequests\"\n>;\n\nexport type PrismicCiDeps = {\n  github?: PrismicCiGitHub;\n  pushBranch?: (cwd: string, branch: string) => Promise<void>;\n  spawn?: SpawnFn;\n  /** Resolve the TARGET repo's own prettier. Injected so a test can assert the\n   *  absolute-path spawn without a populated `node_modules`. */\n  resolvePrettier?: (repoRoot: string) => Promise<string | null>;\n  /** Which `reddoorla/.github` commit the written workflow pins. Injected only\n   *  by tests; production uses the shipped pin. */\n  pin?: ReusableWorkflowPin;\n};\n\nconst resultOf = (\n  site: Site,\n  status: RecipeResult[\"status\"],\n  notes: string,\n  commits: string[] = [],\n): RecipeResult => ({\n  recipe: \"prismic-ci\",\n  site: siteLabel(site),\n  status,\n  commits,\n  notes,\n});\n\nconst messageOf = (err: unknown): string => (err instanceof Error ? err.message : String(err));\n\n/** Same normalization as `self-updating`'s config comparison: CRLF and a stray\n *  trailing newline are not drift, and treating them as drift opens a needless\n *  PR on every run. Any real content difference still differs. */\nfunction sameWorkflow(current: string, canonical: string): boolean {\n  const norm = (s: string) => s.replace(/\\r\\n/g, \"\\n\").replace(/\\s+$/, \"\");\n  return norm(current) === norm(canonical);\n}\n\n/**\n * Land the Prismic model delivery workflow in one repo, as a pull request.\n *\n * Everything before the first mutation is a gate, and the gates exist because\n * this recipe's output is the only path in the project that writes to a live\n * client's Prismic repository. Two of them are worth naming:\n *\n *  - THE SECRET. A workflow whose `PRISMIC_WRITE_TOKEN` does not exist yet goes\n *    red on the repo's first model PR. Landing 15 of those turns a rollout into\n *    15 red repos, so a definitively-absent secret FAILS the site rather than\n *    nooping it: \"this site was skipped and a human must act\" is not the same\n *    report as \"this site was already done\", and a rollout summary where those\n *    two look alike is how a site silently never gets model delivery. A secret\n *    whose existence could not be DETERMINED fails too, with different wording —\n *    they are different facts and the operator's next move differs.\n *\n *  - THE DEFAULT BRANCH. The reusable workflow's apply job hard-codes\n *    `refs/heads/main`. On a repo whose default branch is anything else, every\n *    model PR would merge green and never reach Prismic. Refuse instead.\n *\n * Nothing here can delete a model: the workflow it installs calls a module that\n * exports no delete path.\n */\nexport async function prismicCi(site: Site, deps: PrismicCiDeps = {}): Promise<RecipeResult> {\n  // 1. Repo identity — from Airtable's 'Git repo' or, on a positional run, the\n  //    checkout's origin. `failed`, not `noop`: a rollout that silently skips a site\n  //    is the failure this whole recipe is guarding against one level up. The\n  //    strict shape check runs BEFORE the first `gh` call, so a typo'd or\n  //    attacker-controlled value can never be interpolated into an API path.\n  let repo: string | null;\n  try {\n    repo = await resolveOwnerRepo(site);\n  } catch (err) {\n    // A malformed identity aborts before any `gh` write — surfaced as a recipe\n    // failure rather than being interpolated into an API path.\n    return resultOf(site, \"failed\", `could not resolve the repo identity: ${messageOf(err)}`);\n  }\n  if (!repo) {\n    return resultOf(\n      site,\n      \"failed\",\n      \"could not determine a GitHub repo for this site — set Airtable 'Git repo', or give \" +\n        \"the checkout an origin remote whose URL is a GitHub owner/repo\",\n    );\n  }\n\n  // 1b. The two identities must agree (#713). `gitPush` goes to the CHECKOUT's\n  //     origin; `openPullRequest` goes to `repo`, which Airtable's 'Git repo'\n  //     wins when set. When they name different repositories the branch lands\n  //     in one and the PR is filed in the other with a head that does not\n  //     exist there — a 422, but only AFTER a real push into a client repo,\n  //     which the `finally` restore below does not undo. A stale cell after a\n  //     rename, a fork as origin, a row copy-pasted from another client: all\n  //     operator-data problems, so refuse before the first write rather than\n  //     guess which side is right. A checkout with NO origin is left alone —\n  //     the push itself will fail there, before anything reaches GitHub.\n  if (site.gitRepo) {\n    let originUrl: string | null;\n    try {\n      originUrl = await getRemoteUrl(site.path);\n    } catch {\n      originUrl = null;\n    }\n    if (originUrl !== null && !sameOwnerRepo(repo, originUrl)) {\n      return resultOf(\n        site,\n        \"failed\",\n        `'Git repo' ${repo} does not match the checkout's origin ${originUrl} — refusing to ` +\n          \"push into one repo and open the PR in another; fix the Airtable cell or the remote\",\n      );\n    }\n  }\n\n  // 2. Is this a Prismic site? `readPrismicConfig` returns null for \"no Prismic\n  //    here\" and THROWS for a present-but-unreadable config — the distinction is\n  //    the point, so the throw becomes `failed` rather than being caught into\n  //    the skip branch.\n  let isPrismic: boolean;\n  try {\n    isPrismic = (await readPrismicConfig(site.path)) !== null;\n  } catch (err) {\n    return resultOf(site, \"failed\", `could not read the Prismic config: ${messageOf(err)}`);\n  }\n  if (!isPrismic) return resultOf(site, \"noop\", \"not a Prismic site (no repositoryName) — skipped\");\n\n  // 3. The pin. Checked before any network call: while it is unresolved NOTHING\n  //    can roll out, and 15 pointless API round-trips are not worth spending to\n  //    find that out per site.\n  const pin = deps.pin ?? REUSABLE_WORKFLOW_PIN;\n  if (!isPinResolved(pin)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `reusable-workflow pin is unresolved (${pin.sha}) — publish + tag the workflow in ` +\n        `reddoorla/.github and set REUSABLE_WORKFLOW_PIN before rolling out`,\n    );\n  }\n  const workflow = pin === REUSABLE_WORKFLOW_PIN ? PRISMIC_CI_WORKFLOW : prismicCiWorkflow(pin);\n\n  // 3b. THE BINARY THAT WILL ACTUALLY RUN. The reusable workflow does not\n  //     install this CLI — it runs `pnpm install --frozen-lockfile` and then the\n  //     site's OWN installed bin, so the version that executes is whatever this\n  //     repo's lockfile pins. Installing the caller next to a binary with no\n  //     `prismic-models` command yields a workflow that fails on the first model\n  //     PR, in a client repo, with an error naming an unknown command rather\n  //     than a rollout that ran too early.\n  //\n  //     Local and cheap, so it sits with the pin gate ahead of the first network\n  //     call. And it is a REFUSAL on \"could not establish\", not a pass: the\n  //     asymmetry is deliberate, because the cost of waiting is a re-run and the\n  //     cost of being wrong is broken CI on someone else's repository.\n  const locked = await readLockedCliVersion(site.path);\n  if (!locked.ok) {\n    return resultOf(\n      site,\n      \"failed\",\n      `cannot establish which @reddoorla/maintenance version this repo's CI would run ` +\n        `(${locked.reason}) — refusing to install a workflow that may not run`,\n    );\n  }\n  if (!atLeast(locked.version, MIN_CLI_VERSION)) {\n    return resultOf(\n      site,\n      \"failed\",\n      `this repo's lockfile pins @reddoorla/maintenance ${locked.version}, which has no ` +\n        `\\`prismic-models\\` command (first shipped in ${MIN_CLI_VERSION}) — bump the dependency ` +\n        `and commit the lockfile first, or the workflow fails on its first model PR`,\n    );\n  }\n\n  const ghConfig = readGitHubConfig();\n  if (!deps.github && !ghConfig) return resultOf(site, \"failed\", \"GITHUB_TOKEN not set\");\n  const gh = deps.github ?? makeGitHub({ token: ghConfig!.token });\n  const spawn = deps.spawn ?? defaultSpawn;\n\n  // 4. The secret. Absent and unreadable are separate answers with separate\n  //    wording; neither proceeds.\n  let hasSecret: boolean;\n  try {\n    hasSecret = await gh.secretExists(repo, SECRET);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not determine whether ${repo} has the ${SECRET} secret (${messageOf(err)}) — ` +\n        `refusing to install a workflow that may have no token`,\n    );\n  }\n  if (!hasSecret) {\n    return resultOf(\n      site,\n      \"failed\",\n      `${repo} has no ${SECRET} Actions secret — the workflow reds the repo on its first ` +\n        `model PR without it. Mint one, then: gh secret set ${SECRET} --repo ${repo}`,\n    );\n  }\n\n  // 5. The default branch. NOT `.catch(() => \"main\")`: \"I could not read the\n  //    default branch\" and \"the default branch is main\" are opposite facts, and\n  //    guessing the second targets a PR (and an apply gate) at a branch nobody\n  //    confirmed.\n  let base: string;\n  try {\n    base = await gh.defaultBranch(repo);\n  } catch (err) {\n    return resultOf(\n      site,\n      \"failed\",\n      `could not read the default branch of ${repo}: ${messageOf(err)}`,\n    );\n  }\n  if (base !== APPLY_BRANCH) {\n    return resultOf(\n      site,\n      \"failed\",\n      `default branch of ${repo} is ${base}, not ${APPLY_BRANCH} — the reusable workflow's ` +\n        `apply job guards refs/heads/${APPLY_BRANCH}, so merged model changes would never reach Prismic`,\n    );\n  }\n\n  // 6. Already delivered? Content-compared, not existence-compared, so a\n  //    present-but-STALE workflow (an older pin) is corrected rather than left\n  //    forever.\n  const existing = await gh.fileContentsOnBranch(repo, base, WORKFLOW_PATH);\n  if (existing !== null && sameWorkflow(existing, workflow)) {\n    return resultOf(site, \"noop\", `delivery workflow already current on ${base}`);\n  }\n\n  // 7. Already proposed? Without this, every run before the PR merges opens\n  //    another one. `fileContentsOnBranch` also answers null for a read it could\n  //    not perform (gh exits non-zero on both a 404 and an auth failure), which\n  //    makes this the backstop for that collapse as well.\n  const open = (await gh.openPullRequests(repo)).find((pr) => pr.headRef.startsWith(BRANCH_PREFIX));\n  if (open) {\n    return resultOf(site, \"noop\", `delivery workflow PR already open: ${open.url}`);\n  }\n\n  if (!(await isWorkingTreeClean(site.path))) {\n    return resultOf(site, \"failed\", \"working tree not clean — commit or stash first\");\n  }\n\n  // Capture the operator's branch BEFORE creating ours so the `finally` can put\n  // them back. Best-effort: if we cannot read it we skip the restore rather than\n  // guess at a branch to check out.\n  let original: string | null = null;\n  try {\n    original = await currentBranch(site.path);\n  } catch {\n    // Stays null (detached HEAD, git error) — the restore below is then skipped\n    // rather than aiming a checkout at a branch name we had to invent.\n  }\n  const branch = branchName(\"prismic-ci\");\n  const commits: string[] = [];\n  let pushedOrOpened = false;\n\n  try {\n    await createBranch(site.path, branch);\n    const dest = join(site.path, WORKFLOW_PATH);\n    // What the path held before this run, so a write git then refuses can be put\n    // back exactly as it was (null = the file did not exist).\n    const before = new Map<string, string | null>([\n      [WORKFLOW_PATH, await readFile(dest, \"utf-8\").catch(() => null)],\n    ]);\n    await mkdir(dirname(dest), { recursive: true });\n    await writeFile(dest, workflow, \"utf-8\");\n\n    // Format with the SITE's own prettier, resolved POSITIVELY and run by\n    // absolute path. `pnpm exec prettier` here would run a full `pnpm install`\n    // in the client's repo first (an unrequested mutation of a live client repo\n    // by a rollout that is supposed to add one file), and in a repo without\n    // prettier would then format with the CALLING repo's binary and exit 0.\n    const notes: string[] = [];\n    const bin = await (deps.resolvePrettier ?? resolveTargetPrettier)(site.path);\n    if (bin === null) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (\n      !(await formatWithPrettier(spawn, site.path, [WORKFLOW_PATH], {\n        bin,\n        timeoutMs: PRETTIER_TIMEOUT_MS,\n      }))\n    ) {\n      notes.push(PRETTIER_FLAG_NOTE);\n    } else if (!sameWorkflow(await readFile(dest, \"utf-8\"), workflow)) {\n      // The site's prettier config disagrees with the template's shape (single\n      // quotes, a different tab width). Harmless for the workflow — but the\n      // step-6 comparison is byte-based, so this site will not recognise its own\n      // delivered workflow as current and will propose it again after each\n      // merge. Say so rather than let it be discovered as a mystery PR.\n      notes.push(\n        \"this site's prettier reformatted the workflow — re-runs will not match it as current\",\n      );\n    }\n\n    const sha = await gitCommit(site.path, \"ci: deliver Prismic model changes from merged PRs\");\n\n    // Did git TAKE the workflow? Here the drop does not even read as a failure:\n    // with the path ignored, `commit()` stages nothing, returns null, and the\n    // branch below reports \"already present and identical in the checkout\" — a\n    // statement about a file that is in no commit at all. Checked BEFORE the\n    // push, so nothing reaches the client repo on a refusal (#741).\n    const refusal = await refusedByGit(site.path, [WORKFLOW_PATH], \"the Prismic delivery workflow\");\n    if (refusal) {\n      await undoRefusedWrites(site.path, before, refusal.missing);\n      return resultOf(site, \"failed\", refusal.notes + RESTORED_NOTE, sha ? [sha] : []);\n    }\n\n    if (!sha) {\n      // Git saw no change: the checkout already holds this exact workflow even\n      // though the default branch does not. Nothing to push and nothing to\n      // review — and pushing a commit-less branch would fail at PR creation.\n      return resultOf(\n        site,\n        \"noop\",\n        `${WORKFLOW_PATH} already present and identical in the checkout`,\n      );\n    }\n    commits.push(sha);\n    pushedOrOpened = true;\n    await (deps.pushBranch ?? gitPush)(site.path, branch);\n    const pr = await gh.openPullRequest(repo, {\n      head: branch,\n      base,\n      title: \"Deliver Prismic model changes from merged PRs\",\n      body:\n        \"Adds the `prismic-models` workflow. On a PR touching `customtypes/**` or \" +\n        \"`src/lib/slices/**/model.json` it comments the model delta and writes nothing; \" +\n        \"on merge to main it pushes those models to Prismic. It can create and update \" +\n        \"models but never delete — a model present only in Prismic is reported, not touched.\",\n    });\n    notes.unshift(`opened PR ${pr.url}`);\n    return resultOf(site, \"applied\", notes.join(\"; \"), commits);\n  } catch (err) {\n    return resultOf(site, \"failed\", messageOf(err), commits);\n  } finally {\n    // Restore the operator's branch on success AND on failure — otherwise a push\n    // error strands the checkout on the recipe branch with an unpushed commit,\n    // and the retry dies at createBranch. Best-effort; never masks the result.\n    if (original !== null && original !== branch) {\n      try {\n        await checkoutBranch(site.path, original);\n        // Nothing was pushed and no PR exists, so the local branch is litter and\n        // a re-run would leave another. Only ever the branch WE created.\n        if (!pushedOrOpened) await deleteBranch(site.path, branch);\n      } catch (err) {\n        console.warn(\n          `warning: could not restore branch ${original} after prismic-ci: ${messageOf(err)}`,\n        );\n      }\n    }\n  }\n}\n","/**\n * The caller workflow every Prismic site gets.\n *\n * Fully generic — no per-site values — because the token is the site's own\n * `PRISMIC_WRITE_TOKEN` secret, the name every site's code already reads.\n * Contrast `ci.yml`, which is deliberately NOT templated anywhere in this\n * package because it carries per-site `netlify-site:` / `node-version:` values\n * a byte template would strip fleet-wide.\n */\n\n/** Where the file lands in a site repo. Also the `gh api .../contents/<path>`\n *  segment, so it must stay traversal-free (`assertUrlSegment` re-checks). */\nexport const WORKFLOW_PATH = \".github/workflows/prismic-models.yml\";\n\n/** The Actions secret the reusable workflow declares as `required: true`, and\n *  the environment variable the CLI reads. Spelled ONCE, here, because the\n *  failure mode of a second spelling is silent: a caller passing a name the\n *  callee never declared supplies nothing, and the callee's required secret\n *  arrives empty at the one step that writes to a live client's Prismic repo. */\nexport const SECRET = \"PRISMIC_WRITE_TOKEN\";\n\n/** The reusable workflow, without a ref. */\nexport const REUSABLE_WORKFLOW = \"reddoorla/.github/.github/workflows/prismic-models.yml\";\n\n/**\n * The ONE branch this delivery path can run its apply job on.\n *\n * Not a preference — the reusable workflow's apply job hard-codes\n * `github.ref == 'refs/heads/main'`. On a repo whose default branch is anything\n * else, a merged model PR would produce a green check and never reach Prismic,\n * which is why the recipe refuses such a repo instead of installing a workflow\n * that silently cannot fire.\n */\nexport const APPLY_BRANCH = \"main\";\n\n/** A commit in `reddoorla/.github`, plus the release tag that commit carries.\n *  Both are written into the workflow: the SHA is what Actions resolves, the tag\n *  is what a human (and Renovate's github-actions manager) reads. */\nexport type ReusableWorkflowPin = { sha: string; tag: string };\n\n/**\n * What the shipped pin says while the reusable workflow has not been published\n * to `reddoorla/.github` and tagged yet (plan Task 25).\n *\n * DELIBERATELY NOT 40 HEX CHARACTERS. A placeholder shaped like a real SHA is\n * indistinguishable from a real one in review, and would install a workflow\n * referencing a commit that does not exist into 15 client repositories — where\n * it fails at workflow-load time, on every model PR, with an error that names\n * neither this file nor the reason. Unresolved must be unmistakable, and\n * {@link isPinResolved} is what the recipe gates on.\n */\nexport const UNRESOLVED_PIN_SHA = \"UNRESOLVED-publish-and-tag-reddoorla-dot-github-first\";\n\n/**\n * The pin the fleet rolls out.\n *\n * RESOLVED 2026-08-14. `reddoorla/.github#30` merged as\n * 558395431ddcb481ecba3dd84b78b38c338cfa03 and that commit was tagged v1.4.0;\n * `gh api repos/reddoorla/.github/commits/v1.4.0 --jq .sha` returns the SHA\n * below. `validate` (the digest-pinning + Renovate-preset check that is the\n * only CI in that repo) passed on the merge commit.\n *\n * TO RE-RESOLVE after a future `reddoorla/.github` release: set `sha` to\n * `gh api repos/reddoorla/.github/commits/<tag> --jq .sha` and `tag` to that\n * tag — then VERIFY PROPAGATION rather than assuming it. Renovate does bump\n * this ref: 17 site repos took v1.2.0 -> v1.3.0 in the weeks after v1.3.0\n * was tagged 2026-07-14, on Renovate's weekly `renovate/all-minor-patch`\n * branches (some of which were already open before the tag, so a PR's\n * creation date can predate the version it ends up bumping). It runs self-hosted here and its author identity has already\n * changed once mid-window (operator PAT, authoring as `tucksravin`, until\n * 2026-08-02; `reddoor-renovate[bot]` since), so no single author filter\n * matches all 17 and `app/renovate` matches none of them. Search the\n * `renovate/*` head branch, not an author; an empty author-filtered search\n * is not evidence. But it proposed neither\n * of the last two tags for `ci.yml`: v1.4.0 (2026-08-14) was never offered,\n * and v1.4.1 (2026-09-01) reached the fleet only because ci.yml was swept BY\n * HAND across 21 repos that day (beachfront-dentistry#36). Treat propagation\n * as three steps to run, not a guarantee: (1) re-resolve this constant,\n * (2) release @reddoorla/maintenance, (3) `reddoor-maint prismic-ci --fleet\n * airtable` — the already-delivered gate content-compares the installed file\n * and opens a corrective PR per stale repo — plus ONE POSITIONAL RUN PER\n * PRE-LAUNCH SITE, which the Airtable inventory excludes\n * (`src/inventory/airtable.ts:50` filters `building`/`launching`).\n */\nexport const REUSABLE_WORKFLOW_PIN: ReusableWorkflowPin = {\n  sha: \"558395431ddcb481ecba3dd84b78b38c338cfa03\",\n  tag: \"v1.4.0\",\n};\n\n/**\n * Is this pin a real commit reference?\n *\n * A full 40-hex SHA and nothing else. Not a tag, not a branch: this repo pins\n * every `uses:` to a commit (see `src/recipes/sync-configs/templates.ts`, whose\n * renovate template spells out why — a retagged `@v3` runs attacker code with\n * whatever token the workflow holds). Do not assume the pin bumps itself:\n * Renovate has proposed this ref in the past but did not for either of the\n * last two tags — see the propagation note on\n * {@link REUSABLE_WORKFLOW_PIN} above.\n */\nexport function isPinResolved(pin: ReusableWorkflowPin): boolean {\n  return /^[0-9a-f]{40}$/.test(pin.sha);\n}\n\n/**\n * Render the caller workflow for a pin.\n *\n * Path-filtered on both triggers: this must not run on every commit, only when\n * a model changes.\n */\nexport function prismicCiWorkflow(pin: ReusableWorkflowPin): string {\n  return `# Delivers this site's Prismic model changes. Managed by @reddoorla/maintenance\n# (\\`reddoor-maint prismic-ci\\`) — change it there and re-run, not here.\n#\n# On a PR touching a model: comment the delta, write nothing.\n# On merge to ${APPLY_BRANCH}: push those models to Prismic. Never delete.\n#\n# THE BRANCH FILTER ON \\`push:\\` IS LOAD-BEARING, not tidiness. The reusable\n# workflow's apply job also guards \\`github.ref == 'refs/heads/${APPLY_BRANCH}'\\`,\n# and its comment calls this the other half of that gate: an unfiltered\n# \\`on: push:\\` fires on every branch AND every tag, so a feature branch's models\n# would reach production with no pull request and therefore no review anywhere in\n# the sequence. Keep both halves.\nname: prismic-models\n\non:\n  # No branch filter here, deliberately: a model PR into any base deserves its\n  # delta comment, and the dry job is INCAPABLE of writing — it never passes\n  # \\`--apply\\`, and it holds no job that does.\n  pull_request:\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n  push:\n    branches: [${APPLY_BRANCH}]\n    paths:\n      - \"customtypes/**\"\n      - \"src/lib/slices/**/model.json\"\n\njobs:\n  prismic-models:\n    # A called workflow's jobs can only NARROW what the caller granted, so the\n    # PR-comment permission has to be granted here as well as there. Nothing in\n    # either job pushes code, so \\`contents\\` stays read.\n    permissions:\n      contents: read\n      pull-requests: write\n    uses: ${REUSABLE_WORKFLOW}@${pin.sha} # ${pin.tag}\n    secrets:\n      # Spelled exactly as the reusable workflow declares it. A workflow-local\n      # alias would not be a rename — it would be an undeclared secret, and the\n      # required one would arrive empty.\n      ${SECRET}: \\${{ secrets.${SECRET} }}\n`;\n}\n\n/** The workflow as currently shipped. Unusable — and refused by the recipe —\n *  until {@link REUSABLE_WORKFLOW_PIN} is resolved. */\nexport const PRISMIC_CI_WORKFLOW = prismicCiWorkflow(REUSABLE_WORKFLOW_PIN);\n","import { readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\n/**\n * The first published version whose `reddoor-maint` bin carries `prismic-models`.\n *\n * VERIFIED BY INSTALLING IT, not by reading a changelog: `npm i\n * @reddoorla/maintenance@0.83.0` in an empty directory, then `reddoor-maint\n * prismic-models --help`, prints the command's usage. Every earlier published\n * version — 0.82.0 included — exits with \"unknown command\".\n *\n * This matters because the reusable workflow does NOT install the CLI. It runs\n * `pnpm install --frozen-lockfile` and then the site's own installed bin, so the\n * version that executes in a client repo is whatever that repo's lockfile pins.\n * Installing the caller workflow next to an older binary produces a workflow\n * that fails at the first model PR, in a client repo, with an error about an\n * unknown command rather than about a rollout that ran too early.\n */\nexport const MIN_CLI_VERSION = \"0.83.0\";\n\n/** The dependency whose version decides whether the workflow can run at all. */\nconst PACKAGE = \"@reddoorla/maintenance\";\n\n/**\n * `version >= min`, compared NUMERICALLY, position by position.\n *\n * Not a string comparison, and not `localeCompare`: as strings `\"0.9.0\" >\n * \"0.83.0\"`, so a lexicographic gate waves through a site pinned seventy-four\n * releases before the command existed. That is the single most likely way for\n * this gate to be wrong while looking right.\n *\n * A prerelease (`0.83.0-beta.1`) sorts BELOW the release it precedes, per\n * semver. The fleet publishes no prereleases today; the rule is here so that if\n * one ever appears it is not silently treated as the release.\n */\nexport function atLeast(version: string, min: string): boolean {\n  const parse = (v: string): { nums: number[]; pre: boolean } => {\n    const [core = \"\", ...rest] = v.split(\"-\");\n    return {\n      nums: core.split(\".\").map((n) => Number.parseInt(n, 10) || 0),\n      pre: rest.length > 0,\n    };\n  };\n  const a = parse(version);\n  const b = parse(min);\n  for (let i = 0; i < 3; i++) {\n    const av = a.nums[i] ?? 0;\n    const bv = b.nums[i] ?? 0;\n    if (av !== bv) return av > bv;\n  }\n  // Cores equal: a prerelease of the minimum is below it; anything else is equal.\n  if (a.pre && !b.pre) return false;\n  return true;\n}\n\n/** Either the version pnpm resolved, or WHY that could not be established.\n *  The two are deliberately different shapes: a caller cannot read \"I could not\n *  tell\" as a version by forgetting to check a flag. */\nexport type LockedCliVersion = { ok: true; version: string } | { ok: false; reason: string };\n\n/**\n * The version of {@link PACKAGE} the repo's committed pnpm lockfile resolves.\n *\n * Reads the LOCKFILE, never `package.json`. The declared range is not what\n * executes: espada declares `^0.81.0` and its lockfile resolves 0.69.0, and CI\n * installs `--frozen-lockfile`. A gate reading the range would pass a site whose\n * install is two dozen releases behind it.\n *\n * Parsed with a targeted scan rather than a YAML dependency — this needs one\n * field out of one block, the repo carries no YAML parser, and adding one to\n * read a single `version:` line is not a trade worth making. The scan is\n * deliberately narrow: it reads only `importers:` entries (what is installed),\n * never the `packages:`/`snapshots:` sections, which list every transitively\n * resolvable version and would happily report one nobody installed.\n *\n * Every failure is a NAMED reason, never a version and never a silent default.\n * A gate that cannot tell \"too old\" from \"could not read\" reports one as the\n * other, which is the absent-vs-unreadable collapse this whole feature exists to\n * prevent — arriving here at the last step before writing to a client repo.\n */\nexport async function readLockedCliVersion(repoRoot: string): Promise<LockedCliVersion> {\n  let raw: string;\n  try {\n    raw = await readFile(join(repoRoot, \"pnpm-lock.yaml\"), \"utf-8\");\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    // ENOENT is the only error meaning \"this repo has no lockfile\". EACCES and\n    // friends mean it is there and unreadable — a different answer, and one that\n    // must not read as \"not a pnpm site\".\n    if (code === \"ENOENT\") {\n      return {\n        ok: false,\n        reason: `no pnpm-lock.yaml in the checkout — cannot tell which ${PACKAGE} version CI would run`,\n      };\n    }\n    return { ok: false, reason: `pnpm-lock.yaml is present but unreadable (${String(err)})` };\n  }\n\n  // Only inside `importers:` — see the note above on packages:/snapshots:.\n  const lines = raw.split(\"\\n\");\n  const importersAt = lines.findIndex((l) => /^importers:\\s*$/.test(l));\n  if (importersAt === -1) {\n    return {\n      ok: false,\n      reason: \"pnpm-lock.yaml has no `importers:` section — unrecognised lockfile shape\",\n    };\n  }\n  const end = lines.findIndex((l, i) => i > importersAt && /^[a-zA-Z]/.test(l));\n  const importers = lines.slice(importersAt + 1, end === -1 ? lines.length : end);\n\n  const found = new Set<string>();\n  for (let i = 0; i < importers.length; i++) {\n    if (!new RegExp(`^\\\\s+'?${PACKAGE.replace(\"/\", \"\\\\/\")}'?:\\\\s*$`).test(importers[i]!)) continue;\n    // The entry's own `version:` sits within the next few lines, alongside\n    // `specifier:`. Bounded so a malformed block cannot walk into the next\n    // dependency and attribute its version to this one.\n    for (let j = i + 1; j < Math.min(i + 4, importers.length); j++) {\n      const m = /^\\s+version:\\s*(\\S+)\\s*$/.exec(importers[j]!);\n      if (!m) continue;\n      // Strip the peer-dependency suffix: real fleet lockfiles run it past 400\n      // characters after the semver.\n      found.add(m[1]!.split(\"(\")[0]!);\n      break;\n    }\n  }\n\n  if (found.size === 0) {\n    return { ok: false, reason: `${PACKAGE} is not a dependency in this repo's lockfile` };\n  }\n  if (found.size > 1) {\n    // Picking one would be a coin flip deciding whether a client repo gets a\n    // workflow its binary cannot run.\n    return {\n      ok: false,\n      reason: `lockfile resolves ${PACKAGE} to more than one version (${[...found].sort().join(\", \")}) — refusing to guess which one CI would run`,\n    };\n  }\n  return { ok: true, version: [...found][0]! };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAS,eAAe;AACxB,SAAS,eAAe;;;AC5BxB,SAAS,OAAO,YAAAA,WAAU,iBAAiB;AAC3C,SAAS,SAAS,QAAAC,aAAY;;;ACWvB,IAAM,gBAAgB;AAOtB,IAAM,SAAS;AAGf,IAAM,oBAAoB;AAW1B,IAAM,eAAe;AAmDrB,IAAM,wBAA6C;AAAA,EACxD,KAAK;AAAA,EACL,KAAK;AACP;AAaO,SAAS,cAAc,KAAmC;AAC/D,SAAO,iBAAiB,KAAK,IAAI,GAAG;AACtC;AAQO,SAAS,kBAAkB,KAAkC;AAClE,SAAO;AAAA;AAAA;AAAA;AAAA,gBAIO,YAAY;AAAA;AAAA;AAAA,iEAGqC,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iBAgB5D,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAajB,iBAAiB,IAAI,IAAI,GAAG,MAAM,IAAI,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA,QAK7C,MAAM,kBAAkB,MAAM;AAAA;AAEtC;AAIO,IAAM,sBAAsB,kBAAkB,qBAAqB;;;AC9J1E,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAiBd,IAAM,kBAAkB;AAG/B,IAAM,UAAU;AAcT,SAAS,QAAQ,SAAiB,KAAsB;AAC7D,QAAM,QAAQ,CAAC,MAAgD;AAC7D,UAAM,CAAC,OAAO,IAAI,GAAG,IAAI,IAAI,EAAE,MAAM,GAAG;AACxC,WAAO;AAAA,MACL,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,KAAK,CAAC;AAAA,MAC5D,KAAK,KAAK,SAAS;AAAA,IACrB;AAAA,EACF;AACA,QAAM,IAAI,MAAM,OAAO;AACvB,QAAM,IAAI,MAAM,GAAG;AACnB,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,KAAK,EAAE,KAAK,CAAC,KAAK;AACxB,UAAM,KAAK,EAAE,KAAK,CAAC,KAAK;AACxB,QAAI,OAAO,GAAI,QAAO,KAAK;AAAA,EAC7B;AAEA,MAAI,EAAE,OAAO,CAAC,EAAE,IAAK,QAAO;AAC5B,SAAO;AACT;AA2BA,eAAsB,qBAAqB,UAA6C;AACtF,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,SAAS,KAAK,UAAU,gBAAgB,GAAG,OAAO;AAAA,EAChE,SAAS,KAAK;AACZ,UAAM,OAAQ,IAA8B;AAI5C,QAAI,SAAS,UAAU;AACrB,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,8DAAyD,OAAO;AAAA,MAC1E;AAAA,IACF;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,6CAA6C,OAAO,GAAG,CAAC,IAAI;AAAA,EAC1F;AAGA,QAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,QAAM,cAAc,MAAM,UAAU,CAAC,MAAM,kBAAkB,KAAK,CAAC,CAAC;AACpE,MAAI,gBAAgB,IAAI;AACtB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,MAAM,MAAM,UAAU,CAAC,GAAG,MAAM,IAAI,eAAe,YAAY,KAAK,CAAC,CAAC;AAC5E,QAAM,YAAY,MAAM,MAAM,cAAc,GAAG,QAAQ,KAAK,MAAM,SAAS,GAAG;AAE9E,QAAM,QAAQ,oBAAI,IAAY;AAC9B,WAAS,IAAI,GAAG,IAAI,UAAU,QAAQ,KAAK;AACzC,QAAI,CAAC,IAAI,OAAO,UAAU,QAAQ,QAAQ,KAAK,KAAK,CAAC,UAAU,EAAE,KAAK,UAAU,CAAC,CAAE,EAAG;AAItF,aAAS,IAAI,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI,GAAG,UAAU,MAAM,GAAG,KAAK;AAC9D,YAAM,IAAI,2BAA2B,KAAK,UAAU,CAAC,CAAE;AACvD,UAAI,CAAC,EAAG;AAGR,YAAM,IAAI,EAAE,CAAC,EAAG,MAAM,GAAG,EAAE,CAAC,CAAE;AAC9B;AAAA,IACF;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,GAAG;AACpB,WAAO,EAAE,IAAI,OAAO,QAAQ,GAAG,OAAO,+CAA+C;AAAA,EACvF;AACA,MAAI,MAAM,OAAO,GAAG;AAGlB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ,qBAAqB,OAAO,8BAA8B,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,IAChG;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,SAAS,CAAC,GAAG,KAAK,EAAE,CAAC,EAAG;AAC7C;;;AFpGA,IAAM,gBAAgB;AAKtB,IAAM,sBAAsB;AAqB5B,IAAM,WAAW,CACf,MACA,QACA,OACA,UAAoB,CAAC,OACH;AAAA,EAClB,QAAQ;AAAA,EACR,MAAM,UAAU,IAAI;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,YAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAK5F,SAAS,aAAa,SAAiB,WAA4B;AACjE,QAAM,OAAO,CAAC,MAAc,EAAE,QAAQ,SAAS,IAAI,EAAE,QAAQ,QAAQ,EAAE;AACvE,SAAO,KAAK,OAAO,MAAM,KAAK,SAAS;AACzC;AAyBA,eAAsB,UAAU,MAAY,OAAsB,CAAC,GAA0B;AAM3F,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,iBAAiB,IAAI;AAAA,EACpC,SAAS,KAAK;AAGZ,WAAO,SAAS,MAAM,UAAU,wCAAwC,UAAU,GAAG,CAAC,EAAE;AAAA,EAC1F;AACA,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAYA,MAAI,KAAK,SAAS;AAChB,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,aAAa,KAAK,IAAI;AAAA,IAC1C,QAAQ;AACN,kBAAY;AAAA,IACd;AACA,QAAI,cAAc,QAAQ,CAAC,cAAc,MAAM,SAAS,GAAG;AACzD,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,cAAc,IAAI,yCAAyC,SAAS;AAAA,MAEtE;AAAA,IACF;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,gBAAa,MAAM,kBAAkB,KAAK,IAAI,MAAO;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,sCAAsC,UAAU,GAAG,CAAC,EAAE;AAAA,EACxF;AACA,MAAI,CAAC,UAAW,QAAO,SAAS,MAAM,QAAQ,uDAAkD;AAKhG,QAAM,MAAM,KAAK,OAAO;AACxB,MAAI,CAAC,cAAc,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,GAAG;AAAA,IAEjD;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,wBAAwB,sBAAsB,kBAAkB,GAAG;AAc5F,QAAM,SAAS,MAAM,qBAAqB,KAAK,IAAI;AACnD,MAAI,CAAC,OAAO,IAAI;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,mFACM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,eAAe,GAAG;AAC7C,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,oDAAoD,OAAO,OAAO,+DAChB,eAAe;AAAA,IAEnE;AAAA,EACF;AAEA,QAAM,WAAW,iBAAiB;AAClC,MAAI,CAAC,KAAK,UAAU,CAAC,SAAU,QAAO,SAAS,MAAM,UAAU,sBAAsB;AACrF,QAAM,KAAK,KAAK,UAAU,WAAW,EAAE,OAAO,SAAU,MAAM,CAAC;AAC/D,QAAM,QAAQ,KAAK,SAAS;AAI5B,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,GAAG,aAAa,MAAM,MAAM;AAAA,EAChD,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,+BAA+B,IAAI,YAAY,MAAM,YAAY,UAAU,GAAG,CAAC;AAAA,IAEjF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,GAAG,IAAI,WAAW,MAAM,qHACgC,MAAM,WAAW,IAAI;AAAA,IAC/E;AAAA,EACF;AAMA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,GAAG,cAAc,IAAI;AAAA,EACpC,SAAS,KAAK;AACZ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,wCAAwC,IAAI,KAAK,UAAU,GAAG,CAAC;AAAA,IACjE;AAAA,EACF;AACA,MAAI,SAAS,cAAc;AACzB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,qBAAqB,IAAI,OAAO,IAAI,SAAS,YAAY,+DACxB,YAAY;AAAA,IAC/C;AAAA,EACF;AAKA,QAAM,WAAW,MAAM,GAAG,qBAAqB,MAAM,MAAM,aAAa;AACxE,MAAI,aAAa,QAAQ,aAAa,UAAU,QAAQ,GAAG;AACzD,WAAO,SAAS,MAAM,QAAQ,wCAAwC,IAAI,EAAE;AAAA,EAC9E;AAMA,QAAM,QAAQ,MAAM,GAAG,iBAAiB,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,QAAQ,WAAW,aAAa,CAAC;AAChG,MAAI,MAAM;AACR,WAAO,SAAS,MAAM,QAAQ,sCAAsC,KAAK,GAAG,EAAE;AAAA,EAChF;AAEA,MAAI,CAAE,MAAM,mBAAmB,KAAK,IAAI,GAAI;AAC1C,WAAO,SAAS,MAAM,UAAU,qDAAgD;AAAA,EAClF;AAKA,MAAI,WAA0B;AAC9B,MAAI;AACF,eAAW,MAAM,cAAc,KAAK,IAAI;AAAA,EAC1C,QAAQ;AAAA,EAGR;AACA,QAAM,SAAS,WAAW,YAAY;AACtC,QAAM,UAAoB,CAAC;AAC3B,MAAI,iBAAiB;AAErB,MAAI;AACF,UAAM,aAAa,KAAK,MAAM,MAAM;AACpC,UAAM,OAAOC,MAAK,KAAK,MAAM,aAAa;AAG1C,UAAM,SAAS,oBAAI,IAA2B;AAAA,MAC5C,CAAC,eAAe,MAAMC,UAAS,MAAM,OAAO,EAAE,MAAM,MAAM,IAAI,CAAC;AAAA,IACjE,CAAC;AACD,UAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9C,UAAM,UAAU,MAAM,UAAU,OAAO;AAOvC,UAAM,QAAkB,CAAC;AACzB,UAAM,MAAM,OAAO,KAAK,mBAAmB,uBAAuB,KAAK,IAAI;AAC3E,QAAI,QAAQ,MAAM;AAChB,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WACE,CAAE,MAAM,mBAAmB,OAAO,KAAK,MAAM,CAAC,aAAa,GAAG;AAAA,MAC5D;AAAA,MACA,WAAW;AAAA,IACb,CAAC,GACD;AACA,YAAM,KAAK,kBAAkB;AAAA,IAC/B,WAAW,CAAC,aAAa,MAAMA,UAAS,MAAM,OAAO,GAAG,QAAQ,GAAG;AAMjE,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM,MAAM,OAAU,KAAK,MAAM,mDAAmD;AAO1F,UAAM,UAAU,MAAM,aAAa,KAAK,MAAM,CAAC,aAAa,GAAG,+BAA+B;AAC9F,QAAI,SAAS;AACX,YAAM,kBAAkB,KAAK,MAAM,QAAQ,QAAQ,OAAO;AAC1D,aAAO,SAAS,MAAM,UAAU,QAAQ,QAAQ,eAAe,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;AAAA,IACjF;AAEA,QAAI,CAAC,KAAK;AAIR,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,GAAG,aAAa;AAAA,MAClB;AAAA,IACF;AACA,YAAQ,KAAK,GAAG;AAChB,qBAAiB;AACjB,WAAO,KAAK,cAAc,MAAS,KAAK,MAAM,MAAM;AACpD,UAAM,KAAK,MAAM,GAAG,gBAAgB,MAAM;AAAA,MACxC,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,MACE;AAAA,IAIJ,CAAC;AACD,UAAM,QAAQ,aAAa,GAAG,GAAG,EAAE;AACnC,WAAO,SAAS,MAAM,WAAW,MAAM,KAAK,IAAI,GAAG,OAAO;AAAA,EAC5D,SAAS,KAAK;AACZ,WAAO,SAAS,MAAM,UAAU,UAAU,GAAG,GAAG,OAAO;AAAA,EACzD,UAAE;AAIA,QAAI,aAAa,QAAQ,aAAa,QAAQ;AAC5C,UAAI;AACF,cAAM,eAAe,KAAK,MAAM,QAAQ;AAGxC,YAAI,CAAC,eAAgB,OAAM,aAAa,KAAK,MAAM,MAAM;AAAA,MAC3D,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,qCAAqC,QAAQ,sBAAsB,UAAU,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;;;ADxUA,IAAMC,aAAY,CAAC,QAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE5F,IAAM,YAAY,CAAC,MAAc,WAAiC;AAAA,EAChE,QAAQ;AAAA,EACR;AAAA,EACA,QAAQ;AAAA,EACR,SAAS,CAAC;AAAA,EACV;AACF;AAcO,SAAS,uBAAuB,SAAiC;AACtE,QAAM,QAAQ,QAAQ,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,KAAK,EAAE,MAAM,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;AACtF,QAAM,IAAI,CAAC,MAA8B,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE;AAC/E,QAAM,SAAS,EAAE,QAAQ;AACzB,QAAM,KAAK,EAAE;AACb,MAAI,SAAS,KAAK,EAAE,SAAS,MAAM,GAAG;AACpC,UAAM;AAAA,MACJ,6CAAwC,MAAM,OAAO,QAAQ,MAAM;AAAA,IAGrE;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AACA,QAAM,KAAK,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,UAAU,MAAM,UAAU;AAC1E,SAAO,MAAM,KAAK,IAAI;AACxB;AAeA,eAAe,gBAAgB,UAA0C;AACvE,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,QAAQ;AAAA,EAClC,SAAS,GAAG;AACV,WAAO,gCAAgC,QAAQ,KAAKA,WAAU,CAAC,CAAC;AAAA,EAClE;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAWA,eAAsB,oBACpB,MACA,MACA,OAA6B,CAAC,GACa;AAC3C,QAAM,MAAM,KAAK,MAAM,QAAQ,KAAK,GAAG,IAAI,QAAQ,IAAI;AACvD,MAAI,QAAQ,MAAM,aAAa;AAAA,IAC7B,GAAI,SAAS,SAAY,EAAE,KAAK,IAAI,CAAC;AAAA,IACrC,GAAI,KAAK,UAAU,SAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA,IAIxD,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAMD,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO;AAAA,MACL,QACE;AAAA,MAIF,MAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,UAAyB,CAAC;AAC9B,MAAI,KAAK,OAAO;AACd,UAAM,OAAO,MAAM,kBAAkB,OAAO,EAAE,SAAS,KAAK,WAAW,aAAa,EAAE,CAAC;AACvF,YAAQ,KAAK;AACb,cAAU,KAAK;AAAA,EACjB;AAUA,QAAM,MAAM,KAAK,OAAO;AACxB,QAAM,gBAAgB,CAAC,cAAc,GAAG,IACpC,mDAA8C,IAAI,GAAG,kJAGrD;AAEJ,MAAI,KAAK,KAAK;AACZ,UAAM,QAAQ,MAAM;AAAA,MAClB,CAAC,MACC,IAAI,UAAU,CAAC,CAAC;AAAA,IAEpB;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,CAAC,eAAe,MAAM,KAAK,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,EAAE,EAAE,KAAK,MAAM;AAAA,QACrE;AAAA,MACF;AAAA,MACA,MAAM,kBAAkB,KAAK,IAAI;AAAA,IACnC;AAAA,EACF;AAEA,QAAM,MAAM,KAAK,cAAc,CAAC,MAAY,UAAU,GAAG,EAAE,IAAI,CAAC;AAChE,QAAM,UAAU,MAAM,mBAAmB,cAAc,OAAO,OAAO,MAAM;AACzE,UAAM,UAAU,MAAM,gBAAgB,EAAE,IAAI;AAC5C,WAAO,UAAU,UAAU,UAAU,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC;AAAA,EAC3D,CAAC;AAQD,aAAW,KAAK,SAAS;AACvB,YAAQ;AAAA,MACN;AAAA,QACE,EAAE;AAAA,QACF,oCAAoC,EAAE,MAAM;AAAA,MAE9C;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,iBAAiB,uBAAuB,OAAO,GAAG,OAAO;AAAA,IACjE,MAAM,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,EACzD;AACF;","names":["readFile","join","join","readFile","messageOf"]}

package/dist/{prismic-models-URYGODNY.js → prismic-models-LL6ORTQ2.js}

@@ -15,17 +15,19 @@ import {
   appendSkipNotice,
   fleetWorkdir,
   prepareFleetSites
-} from "./chunk-SHGIDTYF.js";
+} from "./chunk-DYTYPKFN.js";
 import {
   resolveSites
-} from "./chunk-H445EH33.js";
+} from "./chunk-FP6HOW6J.js";
 import {
   PRETTIER_FLAG_NOTE,
   formatWithPrettier
 } from "./chunk-5CJVUPJU.js";
+import "./chunk-TC4GANMX.js";
 import {
   siteSlug
-} from "./chunk-KN52PM63.js";
+} from "./chunk-ICSRWW5Q.js";
+import "./chunk-RQJFGK3A.js";
 import "./chunk-Z3JXLULD.js";
 import {
   makeSpawn
@@ -34,7 +36,7 @@ import "./chunk-RARREDQE.js";
 import {
   siteLabel
 } from "./chunk-XXTZBPUY.js";
-import "./chunk-EASYCD6F.js";
+import "./chunk-WMF5S2MB.js";
 
 // src/cli/commands/prismic-models.ts
 import { readdir, readFile, rename, rm, stat, writeFile } from "fs/promises";
@@ -166,10 +168,11 @@ var defaultDeps = () => ({
   // every one of those runs fail on module load.
   openVerdictSink: async () => {
     const { openBase, readAirtableConfig } = await import("./client-EPVO3FEH.js");
-    const { listWebsites, updatePrismicModels } = await import("./websites-6DHIHJ2D.js");
+    const { updatePrismicModels } = await import("./websites-Y6FN2XFD.js");
+    const { readFleetRoster } = await import("./roster-GDNSIRAK.js");
     const base = openBase(readAirtableConfig());
-    const websites = await listWebsites(base);
-    const { makeSiteMirror } = await import("./site-mirror-H2FYMN55.js");
+    const websites = await readFleetRoster();
+    const { makeSiteMirror } = await import("./site-mirror-WR7ACXOV.js");
     const mirror = await makeSiteMirror();
     return {
       websites: websites.map((w) => ({ id: w.id, name: w.name })),
@@ -769,11 +772,11 @@ async function persistSweep(rows, deps) {
   let sink;
   let formatSummary;
   try {
-    formatSummary = (await import("./write-audits-to-airtable-BIK6LNVC.js")).formatFleetWriteSummary;
+    formatSummary = (await import("./write-audits-to-airtable-TI3JMWSY.js")).formatFleetWriteSummary;
     sink = await deps.openVerdictSink();
   } catch (e) {
     return {
-      output: `\u26D4 --write-airtable was asked for and NOTHING WAS WRITTEN: ${describeThrown(e)}. Every verdict above is unrecorded, so the cockpit and the digest keep whatever they held before \u2014 which for a site that has broken since is a green tick. Do NOT read the report above as having reached the fleet's record.`,
+      output: `\u26D4 --write-back was asked for and NOTHING WAS WRITTEN: ${describeThrown(e)}. Every verdict above is unrecorded, so the cockpit and the digest keep whatever they held before \u2014 which for a site that has broken since is a green tick. Do NOT read the report above as having reached the fleet's record.`,
       code: 1
     };
   }
@@ -812,7 +815,7 @@ async function runFleetSweep(site, opts, deps, cwd) {
   );
   const alarms = collisions.length + envCollisions.length;
   const code = alarms > 0 || nothingChecked !== "" ? 1 : prismicSweepExitCode(checked, failed);
-  if (!requested(opts.writeAirtable)) return { output, code };
+  if (!requested(opts.writeBack)) return { output, code };
   const persisted = await persistSweep(rows, deps);
   return {
     output: `${output}
@@ -882,8 +885,8 @@ function modeConflict(opts) {
     if (opts.commentFile !== void 0) {
       return "cannot combine --tokens with --comment-file. The comment file is the in-repo model check's review artifact; the token doctor writes no report for a PR. Nothing was written \u2014 redirect the output instead.";
     }
-    if (requested(opts.writeAirtable)) {
-      return "cannot combine --tokens with --write-airtable. --write-airtable persists a fleet sweep's per-site MODEL verdicts to the Websites table, and the token doctor produces none \u2014 it compares no models and calls Prismic not at all, so there is nothing for it to write. Accepting it would print a checklist, write nothing and exit 0. Nothing was read or written \u2014 run the sweep for verdicts, the doctor for secrets.";
+    if (requested(opts.writeBack)) {
+      return "cannot combine --tokens with --write-back. --write-back persists a fleet sweep's per-site MODEL verdicts to the Websites table, and the token doctor produces none \u2014 it compares no models and calls Prismic not at all, so there is nothing for it to write. Accepting it would print a checklist, write nothing and exit 0. Nothing was read or written \u2014 run the sweep for verdicts, the doctor for secrets.";
     }
   }
   if (requested(opts.fleet)) {
@@ -894,8 +897,8 @@ function modeConflict(opts) {
       return "cannot combine --fleet with --comment-file. The comment file is ONE repo's review artifact, posted on ONE pull request; a fleet sweep has no pull request to post to. Accepting it and writing nothing would leave a workflow waiting on a file that never appears. Nothing was swept or written \u2014 redirect the output instead.";
     }
   }
-  if (requested(opts.writeAirtable) && !requested(opts.fleet)) {
-    return "--write-airtable needs --fleet. It persists a fleet sweep's per-site verdicts to the Websites table, and the in-repo check has no sweep to write \u2014 its review artifact is the PR comment (--comment-file). Accepting the flag and comparing this one repo instead would exit 0 having written nothing. Nothing was compared, pushed or written.";
+  if (requested(opts.writeBack) && !requested(opts.fleet)) {
+    return "--write-back needs --fleet. It persists a fleet sweep's per-site verdicts to the Websites table, and the in-repo check has no sweep to write \u2014 its review artifact is the PR comment (--comment-file). Accepting the flag and comparing this one repo instead would exit 0 having written nothing. Nothing was compared, pushed or written.";
   }
   return null;
 }
@@ -931,7 +934,7 @@ async function runPrismicModelsCommand(site, opts, deps = defaultDeps()) {
   const fleetInventory = opts.fleet;
   if (requested(fleetInventory) && (typeof fleetInventory !== "string" || !fleetInventory.trim())) {
     return {
-      output: `--fleet was given ${typeof fleetInventory === "string" ? "an empty value" : `a ${typeof fleetInventory}`}, which is not an inventory. Nothing was swept and nothing was compared. An unset workflow variable expands to an empty string, and an empty --fleet reads as "no fleet" \u2014 one directory swept and reported as the whole fleet. Pass an inventory path or "airtable". Do NOT read this exit as a result.`,
+      output: `--fleet was given ${typeof fleetInventory === "string" ? "an empty value" : `a ${typeof fleetInventory}`}, which is not an inventory. Nothing was swept and nothing was compared. An unset workflow variable expands to an empty string, and an empty --fleet reads as "no fleet" \u2014 one directory swept and reported as the whole fleet. Pass an inventory path or "turso". Do NOT read this exit as a result.`,
       code: 2
     };
   }
@@ -1022,4 +1025,4 @@ export {
   sweepRowWriteback,
   writeSweepToAirtable
 };
-//# sourceMappingURL=prismic-models-URYGODNY.js.map
+//# sourceMappingURL=prismic-models-LL6ORTQ2.js.map