@sanity/workflow-cli 0.11.0 → 0.13.0

package/dist/commands/{tail.js → editorial-workflows/tail.js}

@@ -1,14 +1,15 @@
 import { styleText } from 'node:util';
 import { Args } from '@oclif/core';
-import { displayTitle, errorMessage } from '@sanity/workflow-engine';
+import { assertReadableModel, displayTitle, errorMessage, } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
-import { WorkflowCommand } from "../lib/base-command.js";
-import { findInstance, resolveReadTargets } from "../lib/context.js";
-import { fail, failureDetail } from "../lib/fail.js";
-import { tagFlags } from "../lib/flags.js";
-import { formatTimestamp } from "../lib/ui.js";
+import { WorkflowCommand } from "../../lib/base-command.js";
+import { findInstance, resolveReadTargets } from "../../lib/context.js";
+import { fail, failureDetail } from "../../lib/fail.js";
+import { tagFlags } from "../../lib/flags.js";
+import { formatTimestamp } from "../../lib/ui.js";
 const TAIL_TAG = 'tail';
 export default class Tail extends WorkflowCommand {
+    static aliases = ['tail'];
     static description = 'Stream new history entries on a workflow instance as they land in the dataset.';
     static examples = ['<%= config.bin %> tail wf-instance.abc123'];
     static args = {
@@ -64,9 +65,10 @@ export default class Tail extends WorkflowCommand {
         });
     }
     async printNewEntries({ client, instanceId, seen, }) {
-        const next = await client.getDocument(instanceId, { tag: TAIL_TAG });
-        if (!next)
+        const raw = await client.getDocument(instanceId, { tag: TAIL_TAG });
+        if (!raw)
             return seen;
+        const next = assertReadableModel(raw);
         const newEntries = next.history.slice(seen);
         for (const entry of newEntries) {
             this.log(`${styleText('dim', `[${formatTimestamp(entry.at)}]`)} ${styleText('cyan', displayTitle(entry._type))}`);

package/dist/hooks/finally/telemetry.js

@@ -1,8 +1,8 @@
-import { finishCliTelemetry, usedFlagNames } from "../../lib/telemetry.js";
+import { finishCliTelemetry, traceCommandId, usedFlagNames } from "../../lib/telemetry.js";
 const hook = async function (options) {
     try {
         await finishCliTelemetry({
-            command: options.id,
+            command: traceCommandId(options),
             flags: usedFlagNames(options.argv, options.Command?.flags),
             success: options.error === undefined,
         });

package/dist/hooks/prerun/telemetry.d.ts

@@ -1,8 +1,9 @@
 import type { Hook } from '@oclif/core';
 /** Builds and installs the invocation's telemetry shell before the command
  *  runs; the `finally` hook completes the trace and flushes. Never throws.
- *  An explicit `--share-defs` forces the store to send despite CI /
- *  `DO_NOT_TRACK` — resolved from raw argv here, since the store is built
- *  before oclif parses flags. */
+ *  A deploy that may share definitions—flagless by default or explicitly
+ *  enabled—forces the store to send despite CI / `DO_NOT_TRACK`. This is
+ *  resolved from raw argv because the store is built before oclif parses
+ *  flags. */
 declare const hook: Hook<'prerun'>;
 export default hook;

package/dist/lib/base-command.d.ts

@@ -1,11 +1,9 @@
 import { Command } from '@oclif/core';
 /**
- * Base for the API-backed workflow commands: the backstop that renders an
- * auth rejection (HTTP 401) escaping a command's `run` through the clean
- * {@link fail} path — with {@link failureDetail}'s recovery hint — instead
- * of an oclif error dump. Errors caught inside commands render the same
- * detail at their own `fail` sites; every other error propagates to oclif
- * unchanged.
+ * Base for workflow commands: prompt interrupts exit with the conventional
+ * SIGINT code and no stack, while an auth rejection escaping `run` renders
+ * through the clean {@link fail} path with {@link failureDetail}'s recovery
+ * hint. Every other error propagates to oclif unchanged.
  */
 export declare abstract class WorkflowCommand extends Command {
     protected catch(err: Error & {

package/dist/lib/base-command.js

@@ -1,7 +1,13 @@
+import { styleText } from 'node:util';
 import { Command } from '@oclif/core';
+import { exitCodes } from '@sanity/cli-core';
 import { fail, failureDetail, isAuthRejection } from "./fail.js";
 export class WorkflowCommand extends Command {
     async catch(err) {
+        if (err.name === 'ExitPromptError' || err.message === 'SIGINT') {
+            this.logToStderr(`${styleText('yellow', '›')} Aborted by user`);
+            return this.exit(exitCodes.SIGINT);
+        }
         if (isAuthRejection(err)) {
             fail('Authentication failed:', failureDetail(err));
         }

package/dist/lib/client.d.ts

@@ -1,5 +1,13 @@
 import { type SanityClient } from '@sanity/client';
 import { type WorkflowResource } from '@sanity/workflow-engine';
+/**
+ * The API host to hit: an explicit `SANITY_API_HOST` wins; otherwise mirror
+ * the Sanity CLI — staging routes to the staging API, prod falls through to
+ * `@sanity/client`'s default (`undefined` here). Pairs with
+ * {@link resolveToken}, which reads the matching session token. Exported so a
+ * destructive command can display the environment its clients will hit.
+ */
+export declare function resolveApiHost(): string | undefined;
 /**
  * Resolve the Sanity auth token. An explicit `SANITY_AUTH_TOKEN` wins (CI /
  * scripted use); otherwise fall back to the `sanity login` session token.

package/dist/lib/client.js

@@ -5,7 +5,7 @@ import { ENV, envAuthToken } from "./env.js";
 import { fail } from "./fail.js";
 const API_VERSION = ENGINE_API_VERSION;
 const STAGING_API_HOST = 'https://api.sanity.work';
-function resolveApiHost() {
+export function resolveApiHost() {
     return process.env[ENV.SANITY_API_HOST] ?? (isStaging() ? STAGING_API_HOST : undefined);
 }
 export async function resolveToken() {

package/dist/lib/context.d.ts

@@ -1,5 +1,5 @@
 import type { SanityClient } from '@sanity/client';
-import type { WorkflowConfig, WorkflowDeployment, WorkflowInstance, WorkflowResource } from '@sanity/workflow-engine';
+import { type WorkflowConfig, type WorkflowDeployment, type WorkflowInstance, type WorkflowResource } from '@sanity/workflow-engine';
 import type { EngineScope } from './operation-args.ts';
 export interface DeploymentContext {
     deployment: WorkflowDeployment;
@@ -40,9 +40,13 @@ export interface ReadTarget {
 export declare function resolveReadTargets(flags: {
     tag?: string | undefined;
 }): Promise<ReadTarget[]>;
+/** Distinct resources, keyed by their resource-shaped GDR (`<type>:<id>`).
+ *  The first occurrence wins its position, so a caller-ordered list (e.g. the
+ *  engine resource first) keeps its lead entry. */
+export declare function dedupeResources(resources: WorkflowResource[]): WorkflowResource[];
 /** The distinct resources a read targets: the tagged deployment's sole
  *  resource, or — untagged — every distinct one the config's deployments
- *  mention (deduped by `type:id`). */
+ *  mention ({@link dedupeResources}). */
 export declare function resolveReadResources(config: WorkflowConfig, tag: string | undefined): WorkflowResource[];
 /** The single resource a read should target, or fail asking which when the
  *  config spans more than one. For the paths that need one definite dataset

package/dist/lib/context.js

@@ -1,3 +1,4 @@
+import { assertReadableModel, resourceGdr, } from '@sanity/workflow-engine';
 import { clientFor, resolveTokenOrFail } from "./client.js";
 import { fail } from "./fail.js";
 import { loadWorkflowConfig } from "./load-config.js";
@@ -14,15 +15,14 @@ export async function resolveReadTargets(flags) {
     const token = await resolveTokenOrFail();
     return resources.map((resource) => ({ resource, client: clientFor(resource, token) }));
 }
+export function dedupeResources(resources) {
+    return [...new Map(resources.map((resource) => [resourceGdr(resource), resource])).values()];
+}
 export function resolveReadResources(config, tag) {
     if (tag !== undefined) {
         return [selectDeployment(config, { tag }).workflowResource];
     }
-    const byKey = new Map(config.deployments.map((d) => [
-        `${d.workflowResource.type}:${d.workflowResource.id}`,
-        d.workflowResource,
-    ]));
-    const resources = [...byKey.values()];
+    const resources = dedupeResources(config.deployments.map((d) => d.workflowResource));
     if (resources.length === 0) {
         fail('No deployments configured.');
     }
@@ -51,7 +51,7 @@ export async function loadInstanceOrFail(client, instanceId) {
     if (!instance) {
         fail(`Workflow instance ${instanceId} not found`);
     }
-    return instance;
+    return assertReadableModel(instance);
 }
 export function soleHitOrFail(hits, subject) {
     const [sole, ...rest] = hits;
@@ -65,7 +65,9 @@ export async function findInstance({ targets, instanceId, requestTag, }) {
         const instance = await target.client.getDocument(instanceId, {
             tag: requestTag,
         });
-        return instance === undefined ? undefined : { ...target, instance };
+        return instance === undefined
+            ? undefined
+            : { ...target, instance: assertReadableModel(instance) };
     }));
     const hits = probes
         .filter((probe) => probe.status === 'fulfilled')

package/dist/lib/definitions.js

@@ -1,4 +1,4 @@
-import { WORKFLOW_DEFINITION_TYPE, errorMessage, tagScopeFilter, validateDefinition, } from '@sanity/workflow-engine';
+import { WORKFLOW_DEFINITION_TYPE, assertReadableModel, errorMessage, tagScopeFilter, validateDefinition, } from '@sanity/workflow-engine';
 import { fail } from "./fail.js";
 export function buildDefinitionShowQuery(flags) {
     const params = { name: flags.name };
@@ -28,7 +28,7 @@ export async function fetchDeployedDefinition({ client, name, tag, version, }) {
     if (deployed === null && version !== undefined) {
         fail(`No deployed definition "${name}" v${version}.`);
     }
-    return deployed ?? undefined;
+    return deployed === null ? undefined : assertReadableModel(deployed);
 }
 export function selectDefinitions(allDefinitions, { only, context = '' }) {
     if (!only) {

package/dist/lib/flags.d.ts

@@ -1,7 +1,8 @@
 /** The environment tag (e.g. prod, test). For write commands it selects which
- *  deployment in the discovered `sanity.workflow` config to act on (omittable
- *  when only one is configured); for read commands it's an optional query
- *  filter — and the resource disambiguator when a config spans more than one. */
+ *  deployment in the discovered `sanity.workflow` config to act on. A sole
+ *  deployment needs no tag, and an interactive `deploy` asks when several are
+ *  configured. For read commands it's an optional query filter — and the
+ *  resource disambiguator when a config spans more than one. */
 export declare const tagFlags: {
     tag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
 };

package/dist/lib/nuke.d.ts

@@ -0,0 +1,89 @@
+import { type WorkflowClient, type WorkflowResource } from '@sanity/workflow-engine';
+/** A resource a nuke may delete from, with the client that reads/writes it and
+ *  whether it is the engine's own resource — the only one that holds instances
+ *  and definitions (guards can co-locate with subjects in any resource). */
+export interface NukeTarget {
+    resource: WorkflowResource;
+    client: WorkflowClient;
+    holdsEngineDocs: boolean;
+}
+/** One resolved resource of a {@link NukePlan}: the ids to delete, by doc type. */
+export interface NukeResourcePlan {
+    resource: WorkflowResource;
+    /** The `project.dataset` (or `<type>:<id>`) label the operator confirms by. */
+    label: string;
+    client: WorkflowClient;
+    holdsEngineDocs: boolean;
+    instanceIds: string[];
+    definitionIds: string[];
+    guardIds: string[];
+}
+/** The dry-run plan: what a `nuke --tag <tag>` would delete, per resource. */
+export interface NukePlan {
+    tag: string;
+    resources: NukeResourcePlan[];
+}
+/** Per-doc-type totals across the whole plan, plus the count of resources that
+ *  actually hold something to delete ({@link involvedTargets}). */
+export interface PlanCounts {
+    instances: number;
+    definitions: number;
+    guards: number;
+    datasets: number;
+    total: number;
+}
+/**
+ * Resolve what a tag-scoped nuke would delete, per resource — the dry-run plan
+ * printed before any deletion. Instances and definitions are read only from the
+ * engine's own resource; guards are read from every target, since a guard
+ * co-locates with the subject it locks and may live in a foreign dataset.
+ *
+ * Every read uses the raw perspective, so a draft-form or otherwise
+ * perspective-hidden copy is still surfaced (and swept).
+ */
+export declare function resolveNukePlan(args: {
+    tag: string;
+    targets: NukeTarget[];
+}): Promise<NukePlan>;
+/**
+ * Does a guard doc belong to `tag`? A guard's `sourceInstanceId` is the id of
+ * the instance that registered it (`<tag>.wf-instance.<random>`), and its own
+ * `_id` embeds that same instance id
+ * (`temp.system.guard.<tag>.wf-instance.<random>.<name>`). Matching on either —
+ * with the trailing `.` so `prod` never matches `prod-eu` — catches guards
+ * whose `sourceInstanceId` was never written as well as guards whose instance
+ * is already gone.
+ */
+export declare function guardMatchesTag(guard: {
+    _id: string;
+    sourceInstanceId?: string;
+}, tag: string): boolean;
+/** The `project.dataset` labels of resources the plan actually deletes from —
+ *  the exact set the operator must type back to confirm. A resource with
+ *  nothing to delete is not "involved" and is omitted. */
+export declare function involvedTargets(plan: NukePlan): string[];
+/** Roll the plan up into per-doc-type totals for the summary and the
+ *  nothing-to-do short-circuit. */
+export declare function planCounts(plan: NukePlan): PlanCounts;
+/**
+ * Does the operator's typed confirmation name every involved target, and only
+ * those? Order-independent, whitespace-tolerant set equality: the operator
+ * pastes back all `project.dataset` targets the plan listed.
+ */
+export declare function confirmationMatches(input: string, targets: string[]): boolean;
+/** The dry-run plan as printable lines: a heading, the content-safety
+ *  invariant, the API host the deletes will hit (plan rows alone can't tell
+ *  same-named projects on different environments apart), and a per-resource,
+ *  per-doc-type count table. A guard-only foreign resource shows `—` for the
+ *  engine-only columns, since those docs can't live there. */
+export declare function renderNukePlan(plan: NukePlan, apiHost: string): string[];
+/** The success line: what was deleted, and across how many datasets. */
+export declare function formatNukeSummary(tag: string, counts: PlanCounts): string;
+/**
+ * Delete exactly what the plan printed, in uniform waves over every resource.
+ * Wave order is referrers-first — instances, then definitions, then guards —
+ * a nicety for an interrupted run (engine docs link by plain strings, so the
+ * lake enforces no order); non-engine resources simply carry empty
+ * instance/definition lists. Idempotent: an empty plan deletes nothing.
+ */
+export declare function executeNuke(plan: NukePlan): Promise<void>;

package/dist/lib/nuke.js

@@ -0,0 +1,111 @@
+import { styleText } from 'node:util';
+import { GUARD_DOC_TYPE, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, tagScopeFilter, } from '@sanity/workflow-engine';
+import { formatTable, resourceLabel, sectionHeader } from "./ui.js";
+const CHUNK = 200;
+const REQUEST_TAG = 'nuke';
+export async function resolveNukePlan(args) {
+    const { tag, targets } = args;
+    const resources = await Promise.all(targets.map((target) => resolveResourcePlan({ tag, target })));
+    return { tag, resources };
+}
+async function resolveResourcePlan(args) {
+    const { tag, target } = args;
+    const { resource, client, holdsEngineDocs } = target;
+    const noIds = [];
+    const [instanceIds, definitionIds, guardIds] = await Promise.all([
+        holdsEngineDocs ? engineDocIds({ client, type: WORKFLOW_INSTANCE_TYPE, tag }) : noIds,
+        holdsEngineDocs ? engineDocIds({ client, type: WORKFLOW_DEFINITION_TYPE, tag }) : noIds,
+        tagGuardIds({ client, tag }),
+    ]);
+    return {
+        resource,
+        label: resourceLabel(resource),
+        client,
+        holdsEngineDocs,
+        instanceIds,
+        definitionIds,
+        guardIds,
+    };
+}
+function engineDocIds(args) {
+    return args.client.fetch(`*[_type == $type && ${tagScopeFilter()}]._id`, { type: args.type, tag: args.tag }, { perspective: 'raw', tag: REQUEST_TAG });
+}
+async function tagGuardIds(args) {
+    const guards = await args.client.fetch(`*[_type == $type]{_id, sourceInstanceId}`, { type: GUARD_DOC_TYPE }, { perspective: 'raw', tag: REQUEST_TAG });
+    return guards.filter((guard) => guardMatchesTag(guard, args.tag)).map((guard) => guard._id);
+}
+export function guardMatchesTag(guard, tag) {
+    const instancePrefix = `${tag}.wf-instance.`;
+    const guardIdPrefix = `${GUARD_DOC_TYPE}.${instancePrefix}`;
+    return ((guard.sourceInstanceId?.startsWith(instancePrefix) ?? false) ||
+        guard._id.startsWith(guardIdPrefix));
+}
+export function involvedTargets(plan) {
+    return plan.resources
+        .filter((resource) => resourceTotal(resource) > 0)
+        .map((resource) => resource.label);
+}
+function resourceTotal(resource) {
+    return resource.instanceIds.length + resource.definitionIds.length + resource.guardIds.length;
+}
+export function planCounts(plan) {
+    const totals = plan.resources.reduce((acc, resource) => ({
+        instances: acc.instances + resource.instanceIds.length,
+        definitions: acc.definitions + resource.definitionIds.length,
+        guards: acc.guards + resource.guardIds.length,
+    }), { instances: 0, definitions: 0, guards: 0 });
+    return {
+        ...totals,
+        datasets: involvedTargets(plan).length,
+        total: totals.instances + totals.definitions + totals.guards,
+    };
+}
+export function confirmationMatches(input, targets) {
+    const typed = new Set(input.trim().split(/\s+/).filter(Boolean));
+    const expected = new Set(targets);
+    return typed.size === expected.size && [...expected].every((target) => typed.has(target));
+}
+export function renderNukePlan(plan, apiHost) {
+    const rows = plan.resources.map((resource) => [
+        resource.label,
+        resource.holdsEngineDocs ? String(resource.instanceIds.length) : styleText('dim', '—'),
+        resource.holdsEngineDocs ? String(resource.definitionIds.length) : styleText('dim', '—'),
+        String(resource.guardIds.length),
+    ]);
+    return [
+        sectionHeader(`nuke — tag "${plan.tag}"`),
+        styleText('dim', 'engine-owned documents only — content is never touched'),
+        styleText('dim', `API host: ${apiHost}`),
+        ...formatTable(['target', 'instances', 'definitions', 'guards'], rows),
+    ];
+}
+export function formatNukeSummary(tag, counts) {
+    const parts = [
+        pluralize(counts.instances, 'instance'),
+        pluralize(counts.definitions, 'definition'),
+        pluralize(counts.guards, 'guard'),
+    ].join(', ');
+    return `Nuked tag "${tag}": ${parts} across ${pluralize(counts.datasets, 'dataset')}.`;
+}
+function pluralize(count, noun) {
+    return `${count} ${noun}${count === 1 ? '' : 's'}`;
+}
+export async function executeNuke(plan) {
+    for (const resource of plan.resources) {
+        await deleteIds(resource.client, resource.instanceIds);
+    }
+    for (const resource of plan.resources) {
+        await deleteIds(resource.client, resource.definitionIds);
+    }
+    for (const resource of plan.resources) {
+        await deleteIds(resource.client, resource.guardIds);
+    }
+}
+async function deleteIds(client, ids) {
+    for (let start = 0; start < ids.length; start += CHUNK) {
+        const tx = client.transaction();
+        for (const id of ids.slice(start, start + CHUNK))
+            tx.delete(id);
+        await tx.commit({ tag: REQUEST_TAG });
+    }
+}

package/dist/lib/operation-args.d.ts

@@ -3,7 +3,9 @@ import { type EngineScopeArgs, type OperationArgs, type WorkflowTelemetryLogger
  * The engine-scope a CLI verb needs: which tag partition and which resource
  * the engine's own data lives in — {@link EngineScopeArgs} minus the client.
  * A {@link import('@sanity/workflow-engine').WorkflowDeployment} satisfies it,
- * so commands pass their resolved deployment straight through.
+ * so commands pass their resolved deployment straight through. The CLI passes
+ * no `resourceClients`, so its writes admit runtime-supplied refs to the
+ * workflow resource only.
  */
 export type EngineScope = Pick<EngineScopeArgs, 'tag' | 'workflowResource'>;
 /**

package/dist/lib/ops-report.d.ts

@@ -38,7 +38,8 @@ export declare function cascadeTail(cascaded: number): string;
  * emit the report — warn and bail on a no-op (`changed: false`), otherwise
  * succeed and print the ops block. A throw fails the spinner and exits
  * through {@link fail}. The one spinner + report + catch shape every write
- * command (abort, set-stage, fire-action, start, definition delete) shares.
+ * command (abort, set-stage, fire-action, start, definition delete, nuke)
+ * shares.
  */
 export declare function runWriteVerb<T>({ startLabel, failLabel, failHeadline, run, report, log, }: {
     startLabel: string;

package/dist/lib/prompt.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Can this process ask a question on stderr? A strict superset of the
+ * {@link isInteractive} gate cli-core's own prompts enforce (stdin TTY,
+ * `TERM` not dumb, no `CI` — so its `NonInteractiveError` can never escape a
+ * caller that checked here first), adding stderr-TTY because this package's
+ * prompts render on stderr: a redirected stderr must refuse rather than block
+ * on stdin with the question swallowed. It classifies whether definition
+ * sharing can show its full first-run disclosure and guards interactive
+ * prompts such as nuke's confirmation.
+ */
+export declare function canPromptOnStderr(): boolean;

package/dist/lib/prompt.js

@@ -0,0 +1,4 @@
+import { isInteractive } from '@sanity/cli-core';
+export function canPromptOnStderr() {
+    return isInteractive() && process.stderr.isTTY === true;
+}

package/dist/lib/select-deployment.d.ts

@@ -1,4 +1,11 @@
 import { type DeployTarget, type WorkflowConfig, type WorkflowDeployment } from '@sanity/workflow-engine';
+type ChooseDeploymentTag = (deployments: WorkflowDeployment[]) => Promise<string>;
+interface DeploymentSelectionOptions {
+    tag: string | undefined;
+    allTags: boolean;
+    interactive?: boolean;
+    chooseTag?: ChooseDeploymentTag;
+}
 /**
  * Pick the deployment for the requested `--tag`. Tags are unique across a
  * config (enforced by defineWorkflowConfig), so a tag names at most one
@@ -15,17 +22,15 @@ export declare function selectDeployment(config: WorkflowConfig, { tag, orAltern
 }): WorkflowDeployment;
 /**
  * The deployments a `deploy` run acts on: every one with `--all-tags`,
- * otherwise a single target via {@link selectDeployment} and its failure
- * modes. Deploying everything is an explicit opt-in — never a default — so an
- * ambiguous bare `deploy` can't fan a write out across environments.
+ * otherwise a single target via {@link selectDeployment}. An ambiguous bare
+ * interactive run asks for a tag; a run that cannot prompt keeps the explicit
+ * flag guidance. Deploying everything is an explicit opt-in — never a default.
  */
-export declare function selectDeployments(config: WorkflowConfig, { tag, allTags }: {
-    tag: string | undefined;
-    allTags: boolean;
-}): WorkflowDeployment[];
+export declare function selectDeployments(config: WorkflowConfig, { tag, allTags, interactive, chooseTag }: DeploymentSelectionOptions): Promise<WorkflowDeployment[]>;
 /**
  * Project a deployment into the engine's {@link DeployTarget} — the shape the
  * deploy/diff verbs (`deployDefinitions`, `computeDiffEntries`, `diffEntry`)
  * consume — expanding its handle bindings into the alias map in the same step.
  */
 export declare function deploymentToTarget(deployment: WorkflowDeployment): DeployTarget;
+export {};

package/dist/lib/select-deployment.js

@@ -1,5 +1,7 @@
+import { select } from '@sanity/cli-core/ux';
 import { resourceAliasesToMap, } from '@sanity/workflow-engine';
 import { fail } from "./fail.js";
+import { canPromptOnStderr } from "./prompt.js";
 export function selectDeployment(config, { tag, orAlternative = '' }) {
     if (tag === undefined) {
         if (config.deployments.length > 1) {
@@ -17,19 +19,42 @@ export function selectDeployment(config, { tag, orAlternative = '' }) {
     }
     return deployment;
 }
-export function selectDeployments(config, { tag, allTags }) {
+export async function selectDeployments(config, { tag, allTags, interactive, chooseTag = chooseDeploymentTag }) {
     if (allTags) {
         return config.deployments;
     }
+    if (tag === undefined && config.deployments.length > 1) {
+        if (!(interactive ?? canPromptOnStderr())) {
+            return [
+                selectDeployment(config, {
+                    tag,
+                    orAlternative: ', or --all-tags to deploy every deployment',
+                }),
+            ];
+        }
+        const selectedTag = await chooseTag(config.deployments);
+        return [selectDeployment(config, { tag: selectedTag })];
+    }
     return [
         selectDeployment(config, { tag, orAlternative: ', or --all-tags to deploy every deployment' }),
     ];
 }
+async function chooseDeploymentTag(deployments) {
+    return select({
+        message: 'Select a deployment tag',
+        choices: deployments.map(({ name, tag }) => ({
+            name: tag,
+            value: tag,
+            description: name,
+        })),
+    }, { output: process.stderr });
+}
 function availableTags(config) {
     return `Available tags: ${config.deployments.map((candidate) => candidate.tag).join(', ')}`;
 }
 export function deploymentToTarget(deployment) {
     return {
+        expectedMinReaderModel: deployment.expectedMinReaderModel,
         tag: deployment.tag,
         workflowResource: deployment.workflowResource,
         resourceAliases: resourceAliasesToMap(deployment.resourceAliases),

package/dist/lib/share-definitions.d.ts

@@ -10,12 +10,11 @@
  * Consent model: opt-OUT. A deploy that creates new definition versions
  * donates by default. The choice is skipped by an explicit flag:
  * `--share-defs` (donate, no prompt) or `--no-share-defs` (don't). Without a
- * flag, an interactive terminal takes a ONE-TIME acknowledgement (persisted
- * in the shared Sanity user config, so it is asked once ever) before the
- * first donation — notice must precede the send, since we cannot disclose
- * taking content after taking it. Unattended runs (CI / `DO_NOT_TRACK` / a
- * non-TTY pipe) can't prompt, so they donate nothing — the standard Sanity-CLI
- * "silent in CI / `DO_NOT_TRACK`" rule; opt in per run with `--share-defs`.
+ * flag, the CLI shares. An interactive terminal gets a ONE-TIME notice
+ * (persisted in the shared Sanity user config) before the first donation;
+ * every later flagless deploy, and every unattended deploy, prints a concise
+ * reminder. CI, `DO_NOT_TRACK`, and non-TTY execution do not change the
+ * content-sharing default. Only `--no-share-defs` opts out.
  */
 import { type DeployDefinitionResult, type DeployedDefinition, type WorkflowResource } from '@sanity/workflow-engine';
 import type { UserConfigStore } from './telemetry-setup.ts';
@@ -50,22 +49,20 @@ export interface ShareCandidate {
  *  routed project-agnostically through the API gateway). */
 export declare const SHARE_ENDPOINT_URI = "/workflow/definition-feedback";
 /**
- * The first-run consent prompt — a product contract, pinned by test. It must
+ * The first-run disclosure — a product contract, pinned by test. It must
  * name the recipient (Sanity), state that the document ships VERBATIM with its
  * deployment coordinates and is kept, name what is never shared, and disclose
- * that the answer is remembered machine-wide (not just for this deploy) with
- * the per-run override. Shown once (persisted) before the first donation on an
- * interactive terminal; the answer decides and is remembered.
+ * that the notice is remembered machine-wide and name the per-run opt-out.
+ * This is a notice, not a choice: sharing is the default unless the invocation
+ * supplies `--no-share-defs`.
  */
-export declare const SHARE_CONSENT_PROMPT: string;
+export declare const SHARE_FIRST_RUN_NOTICE: string;
 /**
- * The one-line reminders printed on every flagless interactive deploy after the
- * first — product contracts, pinned by test. They keep an ongoing donation (or
- * a remembered decline) visible every run, never silent, and name the per-run
- * override. `_ON` shows when the remembered answer shares, `_OFF` when it does not.
+ * The status block printed on every flagless deploy that does not show the
+ * first-run disclosure. It keeps the default donation obvious in terminals and
+ * unattended logs and names both explicit controls.
  */
-export declare const SHARE_REMINDER_ON: string;
-export declare const SHARE_REMINDER_OFF: string;
+export declare const SHARE_REMINDER: string;
 /**
  * The content-free telemetry marker for one shared definition — projected
  * from the engine's own deploy-event derivation ({@link definitionDeployedData})
@@ -80,9 +77,9 @@ export declare function definitionShareMarker(args: {
 }): WorkflowDefinitionSharedData;
 /**
  * Whether the invocation's telemetry should send despite the environment
- * denial (CI / `DO_NOT_TRACK`). Only an explicit `--share-defs` that actually
- * donates forces it — a command-line arg beats env vars, and a `--share-defs`
- * donation must never be recorded-less. Account-level consent is never
+ * denial (CI / `DO_NOT_TRACK`). Every flagless or explicitly enabled deploy
+ * that can create versions forces it, because definition donation defaults on
+ * in those environments too. Account-level consent is never
  * overridden (the intake still reads `/intake/telemetry-status`).
  *
  * Computed from raw argv because the prerun hook builds the store before oclif
@@ -98,12 +95,12 @@ export declare function shouldForceShareTelemetry(args: {
     argv: string[];
 }): boolean;
 /**
- * The whole post-deploy sharing flow. Resolves the opt-out decision (explicit
- * flag, one-time acknowledgement, or standing policy), donates when it lands
- * on share, and always records the content-free per-invocation decision so
- * adoption dashboards can measure opt-out rate. No newly created versions
- * (unchanged re-deploys, dry runs, nothing succeeded) means no decision, no
- * prompt, and no POST.
+ * The whole post-deploy sharing flow. An explicit flag decides directly;
+ * otherwise sharing defaults on after emitting either the one-time disclosure
+ * or recurring reminder. It always records the content-free per-invocation
+ * decision so adoption dashboards can measure opt-out rate. No newly created
+ * versions (unchanged re-deploys, dry runs, nothing succeeded) means no
+ * decision, notice, or POST.
  *
  * The optional args exist for the flow's dependencies, mirroring
  * `setupCliTelemetry` — omitted, the real process surfaces apply.
@@ -113,8 +110,6 @@ export declare function shareDefinitionsAfterDeploy(args: {
     candidates: ShareCandidate[];
     warn: (message: string) => void;
     interactive?: boolean;
-    envDenied?: boolean;
     writeStderr?: (message: string) => void;
     userConfig?: UserConfigStore;
-    confirmShare?: () => Promise<boolean>;
 }): Promise<void>;