@sanity/workflow-cli 0.12.0 → 0.14.0

package/dist/commands/{tail.js → editorial-workflows/tail.js}

@@ -2,13 +2,14 @@ import { styleText } from 'node:util';
 import { Args } from '@oclif/core';
 import { assertReadableModel, displayTitle, errorMessage, } from '@sanity/workflow-engine';
 import logSymbols from 'log-symbols';
-import { WorkflowCommand } from "../lib/base-command.js";
-import { findInstance, resolveReadTargets } from "../lib/context.js";
-import { fail, failureDetail } from "../lib/fail.js";
-import { tagFlags } from "../lib/flags.js";
-import { formatTimestamp } from "../lib/ui.js";
+import { WorkflowCommand } from "../../lib/base-command.js";
+import { findInstance, resolveReadTargets } from "../../lib/context.js";
+import { fail, failureDetail } from "../../lib/fail.js";
+import { tagFlags } from "../../lib/flags.js";
+import { formatTimestamp } from "../../lib/ui.js";
 const TAIL_TAG = 'tail';
 export default class Tail extends WorkflowCommand {
+    static aliases = ['tail'];
     static description = 'Stream new history entries on a workflow instance as they land in the dataset.';
     static examples = ['<%= config.bin %> tail wf-instance.abc123'];
     static args = {

package/dist/hooks/finally/telemetry.js

@@ -1,8 +1,8 @@
-import { finishCliTelemetry, usedFlagNames } from "../../lib/telemetry.js";
+import { finishCliTelemetry, traceCommandId, usedFlagNames } from "../../lib/telemetry.js";
 const hook = async function (options) {
     try {
         await finishCliTelemetry({
-            command: options.id,
+            command: traceCommandId(options),
             flags: usedFlagNames(options.argv, options.Command?.flags),
             success: options.error === undefined,
         });

package/dist/hooks/prerun/telemetry.d.ts

@@ -1,8 +1,9 @@
 import type { Hook } from '@oclif/core';
 /** Builds and installs the invocation's telemetry shell before the command
  *  runs; the `finally` hook completes the trace and flushes. Never throws.
- *  An explicit `--share-defs` forces the store to send despite CI /
- *  `DO_NOT_TRACK` — resolved from raw argv here, since the store is built
- *  before oclif parses flags. */
+ *  A deploy that may share definitions—flagless by default or explicitly
+ *  enabled—forces the store to send despite CI / `DO_NOT_TRACK`. This is
+ *  resolved from raw argv because the store is built before oclif parses
+ *  flags. */
 declare const hook: Hook<'prerun'>;
 export default hook;

package/dist/lib/base-command.d.ts

@@ -1,11 +1,9 @@
 import { Command } from '@oclif/core';
 /**
- * Base for the API-backed workflow commands: the backstop that renders an
- * auth rejection (HTTP 401) escaping a command's `run` through the clean
- * {@link fail} path — with {@link failureDetail}'s recovery hint — instead
- * of an oclif error dump. Errors caught inside commands render the same
- * detail at their own `fail` sites; every other error propagates to oclif
- * unchanged.
+ * Base for workflow commands: prompt interrupts exit with the conventional
+ * SIGINT code and no stack, while an auth rejection escaping `run` renders
+ * through the clean {@link fail} path with {@link failureDetail}'s recovery
+ * hint. Every other error propagates to oclif unchanged.
  */
 export declare abstract class WorkflowCommand extends Command {
     protected catch(err: Error & {

package/dist/lib/base-command.js

@@ -1,7 +1,13 @@
+import { styleText } from 'node:util';
 import { Command } from '@oclif/core';
+import { exitCodes } from '@sanity/cli-core';
 import { fail, failureDetail, isAuthRejection } from "./fail.js";
 export class WorkflowCommand extends Command {
     async catch(err) {
+        if (err.name === 'ExitPromptError' || err.message === 'SIGINT') {
+            this.logToStderr(`${styleText('yellow', '›')} Aborted by user`);
+            return this.exit(exitCodes.SIGINT);
+        }
         if (isAuthRejection(err)) {
             fail('Authentication failed:', failureDetail(err));
         }

package/dist/lib/context.d.ts

@@ -13,11 +13,12 @@ export interface InstanceContext {
 }
 /**
  * The resolution a WRITE shares: discover the config, pick the deployment for
- * `--tag` (or the sole one), and build an authenticated client for that
- * deployment's resource. A write acts on one specific deployment, so a
- * single, definite target is exactly what it needs.
+ * `--deployment` or `--tag` (or the sole one), and build an authenticated
+ * client for that deployment's resource. A write acts on one specific
+ * deployment, so a single, definite target is exactly what it needs.
  */
 export declare function resolveContext(flags: {
+    deployment?: string | undefined;
     tag?: string | undefined;
 }): Promise<DeploymentContext>;
 /** One resource a read inspects, with its authenticated client. */
@@ -34,8 +35,9 @@ export interface ReadTarget {
  *
  * Untagged, this is every distinct resource the config mentions — a read is
  * harmless to fan out, so "show me what's deployed" spans the whole config.
- * `--tag` narrows to that deployment's resource. The token resolves once for
- * the run, however many targets it spans.
+ * `--tag` narrows to the resources deployed under that tag (tags may repeat
+ * across deployments). The token resolves once for the run, however many
+ * targets it spans.
  */
 export declare function resolveReadTargets(flags: {
     tag?: string | undefined;
@@ -44,9 +46,9 @@ export declare function resolveReadTargets(flags: {
  *  The first occurrence wins its position, so a caller-ordered list (e.g. the
  *  engine resource first) keeps its lead entry. */
 export declare function dedupeResources(resources: WorkflowResource[]): WorkflowResource[];
-/** The distinct resources a read targets: the tagged deployment's sole
- *  resource, or — untagged — every distinct one the config's deployments
- *  mention ({@link dedupeResources}). */
+/** The distinct resources a read targets: every resource deployed under the
+ *  tag (tags may repeat across deployments), or — untagged — every distinct
+ *  one the config's deployments mention ({@link dedupeResources}). */
 export declare function resolveReadResources(config: WorkflowConfig, tag: string | undefined): WorkflowResource[];
 /** The single resource a read should target, or fail asking which when the
  *  config spans more than one. For the paths that need one definite dataset
@@ -60,15 +62,28 @@ export declare function resolveReadResource(config: WorkflowConfig, tag: string
  * config's declared deployments. An instance id is globally unique and carries
  * its own `tag`, so a command that names one acts on that instance regardless
  * of which tags the config happens to deploy; the config only locates the
- * resource (via {@link resolveReadResource}, no tag filter).
+ * resource (via {@link resolveInstanceResource}, no tag filter).
  *
  * Contrast {@link resolveContext}: the deploy/diff/delete path IS scoped to a
  * declared deployment because it acts on the authored definition set (or a
  * definition name, which — unlike an instance id — isn't unique across tags).
  */
 export declare function resolveInstanceContext(flags: {
+    deployment?: string | undefined;
     tag?: string | undefined;
 }, instanceId: string): Promise<InstanceContext>;
+/**
+ * Which resource an instance-keyed command reads from: the one `--deployment`
+ * names (resolved by its unique deployment name), else the sole or
+ * `--tag`-narrowed resource ({@link resolveReadResource}). The instance id is
+ * globally unique, so this only locates the resource to look in — never the
+ * instance's `tag` partition, which the caller takes from the loaded instance.
+ * The shared path behind all four instance-keyed commands.
+ */
+export declare function resolveInstanceResource(config: WorkflowConfig, { deployment, tag }: {
+    deployment?: string | undefined;
+    tag?: string | undefined;
+}): WorkflowResource;
 /** Fetch an instance by id, exiting cleanly when the resource has no such
  *  document — the diagnostic an operator sees on a mistyped id. Split out from
  *  {@link resolveInstanceContext} so the not-found path is unit-testable

package/dist/lib/context.js

@@ -2,11 +2,11 @@ import { assertReadableModel, resourceGdr, } from '@sanity/workflow-engine';
 import { clientFor, resolveTokenOrFail } from "./client.js";
 import { fail } from "./fail.js";
 import { loadWorkflowConfig } from "./load-config.js";
-import { selectDeployment } from "./select-deployment.js";
+import { availableDeployments, deploymentsForTag, selectDeployment } from "./select-deployment.js";
 import { resourceLabel } from "./ui.js";
 export async function resolveContext(flags) {
     const config = await loadWorkflowConfig();
-    const deployment = selectDeployment(config, { tag: flags.tag });
+    const deployment = selectDeployment(config, { name: flags.deployment, tag: flags.tag });
     return { deployment, client: clientFor(deployment.workflowResource, await resolveTokenOrFail()) };
 }
 export async function resolveReadTargets(flags) {
@@ -20,7 +20,7 @@ export function dedupeResources(resources) {
 }
 export function resolveReadResources(config, tag) {
     if (tag !== undefined) {
-        return [selectDeployment(config, { tag }).workflowResource];
+        return dedupeResources(deploymentsForTag(config, tag).map((deployment) => deployment.workflowResource));
     }
     const resources = dedupeResources(config.deployments.map((d) => d.workflowResource));
     if (resources.length === 0) {
@@ -34,16 +34,25 @@ export function resolveReadResource(config, tag) {
     if (resources.length === 1 && sole !== undefined) {
         return sole;
     }
-    const tags = config.deployments.map((d) => d.tag).join(', ');
-    fail('Config spans multiple resources — pass --tag to choose one.', `Available tags: ${tags}`);
+    if (tag === undefined) {
+        fail('Config spans multiple resources — pass --deployment or --tag to choose one.', availableDeployments(config));
+    }
+    const carriers = config.deployments.filter((d) => d.tag === tag);
+    fail(`Tag "${tag}" spans multiple resources — pass --deployment to choose one.`, availableDeployments(config, carriers));
 }
 export async function resolveInstanceContext(flags, instanceId) {
     const config = await loadWorkflowConfig();
-    const workflowResource = resolveReadResource(config, flags.tag);
+    const workflowResource = resolveInstanceResource(config, flags);
     const client = clientFor(workflowResource, await resolveTokenOrFail());
     const instance = await loadInstanceOrFail(client, instanceId);
     return { client, scope: { tag: instance.tag, workflowResource } };
 }
+export function resolveInstanceResource(config, { deployment, tag }) {
+    if (deployment !== undefined) {
+        return selectDeployment(config, { name: deployment, tag: undefined }).workflowResource;
+    }
+    return resolveReadResource(config, tag);
+}
 export async function loadInstanceOrFail(client, instanceId) {
     const instance = await client.getDocument(instanceId, {
         tag: 'instance.load',

package/dist/lib/flags.d.ts

@@ -1,10 +1,33 @@
-/** The environment tag (e.g. prod, test). For write commands it selects which
- *  deployment in the discovered `sanity.workflow` config to act on (omittable
- *  when only one is configured); for read commands it's an optional query
- *  filter — and the resource disambiguator when a config spans more than one. */
+/** The environment tag (e.g. prod, test). Tags group deployments by
+ *  environment and may repeat across a config. For the read commands that
+ *  consume this directly it's an optional query filter — and the resource
+ *  disambiguator when a config spans more than one. Write commands layer
+ *  selection semantics on top via {@link deploymentFlags}; instance-keyed
+ *  commands add `--deployment` alongside it via {@link instanceFlags}. */
 export declare const tagFlags: {
     tag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
 };
+/** The selectors an instance-keyed command (`diagnose`, `abort`, `set-stage`,
+ *  `fire-action`) takes. An instance id is globally unique and carries its own
+ *  `tag`, so these only pick WHICH resource to read it from — never the
+ *  instance's partition, which always comes from the loaded instance.
+ *  `--deployment` names one deployment and reads from the resource it targets;
+ *  `--tag` stays the optional narrower {@link tagFlags} describes. Mutually
+ *  exclusive; a sole-resource config needs neither. */
+export declare const instanceFlags: {
+    deployment: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    tag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+};
+/** The selectors a single-deployment (write) command takes: `--deployment` —
+ *  the deployment's unique name identity — or `--tag`, which resolves while the
+ *  tag names exactly one deployment and errors asking for `--deployment` when
+ *  it spans several. Mutually exclusive; a sole-deployment config needs neither.
+ *  `deploy` overrides the `tag` description with its group semantics (every
+ *  deployment carrying the tag). */
+export declare const deploymentFlags: {
+    deployment: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    tag: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+};
 export declare const jsonFlags: {
     json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
 };

package/dist/lib/flags.js

@@ -1,7 +1,23 @@
 import { Flags } from '@oclif/core';
+const tagAsFilterDescription = 'Workflow environment tag (e.g. prod, test) — an optional query filter, and the resource disambiguator when the config spans several.';
 export const tagFlags = {
+    tag: Flags.string({ description: tagAsFilterDescription }),
+};
+export const instanceFlags = {
+    deployment: Flags.string({
+        description: 'Deployment name — read the instance from the resource that deployment targets; the tag partition still comes from the loaded instance.',
+        exclusive: ['tag'],
+    }),
+    tag: Flags.string({ description: tagAsFilterDescription, exclusive: ['deployment'] }),
+};
+export const deploymentFlags = {
+    deployment: Flags.string({
+        description: 'Deployment name — the unique identity of one deployment in the config.',
+        exclusive: ['tag'],
+    }),
     tag: Flags.string({
-        description: 'Workflow environment tag (e.g. prod, test) — the deployment to target for writes; an optional filter for reads.',
+        description: 'Workflow environment tag (e.g. prod, test) — selects the deployment to act on while the tag names exactly one; pass --deployment when it spans several.',
+        exclusive: ['deployment'],
     }),
 };
 export const jsonFlags = {

package/dist/lib/nuke.d.ts

@@ -1,4 +1,4 @@
-import { type WorkflowClient, type WorkflowResource } from '@sanity/workflow-engine';
+import { type WorkflowClient, type WorkflowDeployment, type WorkflowResource } from '@sanity/workflow-engine';
 /** A resource a nuke may delete from, with the client that reads/writes it and
  *  whether it is the engine's own resource — the only one that holds instances
  *  and definitions (guards can co-locate with subjects in any resource). */
@@ -32,6 +32,20 @@ export interface PlanCounts {
     datasets: number;
     total: number;
 }
+/** Every resource a deployment's nuke sweeps: its own workflow resource (which
+ *  holds instances + definitions + guards) plus each alias-bound resource
+ *  (guards co-locate with the subjects they lock). */
+export declare function sweptResources(deployment: WorkflowDeployment): WorkflowResource[];
+/**
+ * Fail before any nuke work when another same-tag deployment sweeps a resource
+ * the selected one does. Guard document ids embed only the tag
+ * (`temp.system.guard.<tag>.wf-instance.*`), so within a shared resource the
+ * sweep cannot tell such deployments' guards apart — nuking one would delete
+ * the others' live locks, invisibly to the plan. Config validation already
+ * forbids sharing tag + workflow resource, so an overlap can only arrive
+ * through alias bindings.
+ */
+export declare function refuseOverlappingNuke(deployments: WorkflowDeployment[], selected: WorkflowDeployment): void;
 /**
  * Resolve what a tag-scoped nuke would delete, per resource — the dry-run plan
  * printed before any deletion. Instances and definitions are read only from the

package/dist/lib/nuke.js

@@ -1,8 +1,29 @@
 import { styleText } from 'node:util';
-import { GUARD_DOC_TYPE, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, tagScopeFilter, } from '@sanity/workflow-engine';
+import { GUARD_DOC_TYPE, WORKFLOW_DEFINITION_TYPE, WORKFLOW_INSTANCE_TYPE, resourceGdr, tagScopeFilter, } from '@sanity/workflow-engine';
+import { fail } from "./fail.js";
+import { deploymentLabel } from "./select-deployment.js";
 import { formatTable, resourceLabel, sectionHeader } from "./ui.js";
 const CHUNK = 200;
 const REQUEST_TAG = 'nuke';
+export function sweptResources(deployment) {
+    return [
+        deployment.workflowResource,
+        ...(deployment.resourceAliases ?? []).map((binding) => binding.resource),
+    ];
+}
+export function refuseOverlappingNuke(deployments, selected) {
+    const swept = new Set(sweptResources(selected).map(resourceGdr));
+    const clashing = deployments.filter((candidate) => candidate.name !== selected.name &&
+        candidate.tag === selected.tag &&
+        sweptResources(candidate).some((resource) => swept.has(resourceGdr(resource))));
+    if (clashing.length === 0) {
+        return;
+    }
+    fail(`Refusing to nuke "${deploymentLabel(selected)}" — its guards are indistinguishable ` +
+        `from ${clashing.map(deploymentLabel).join(', ')}'s in the shared resource(s).`, `Guard ids embed only the tag, and these deployments share tag "${selected.tag}" plus ` +
+        "a swept resource — the sweep would delete the other deployments' live guards. " +
+        'Give them distinct tags first.');
+}
 export async function resolveNukePlan(args) {
     const { tag, targets } = args;
     const resources = await Promise.all(targets.map((target) => resolveResourcePlan({ tag, target })));

package/dist/lib/prompt.d.ts

@@ -4,7 +4,8 @@
  * `TERM` not dumb, no `CI` — so its `NonInteractiveError` can never escape a
  * caller that checked here first), adding stderr-TTY because this package's
  * prompts render on stderr: a redirected stderr must refuse rather than block
- * on stdin with the question swallowed. The one predicate every prompt site
- * (the deploy consent prompt, nuke's confirmation) shares.
+ * on stdin with the question swallowed. It classifies whether definition
+ * sharing can show its full first-run disclosure and guards interactive
+ * prompts such as nuke's confirmation.
  */
 export declare function canPromptOnStderr(): boolean;

package/dist/lib/select-deployment.d.ts

@@ -1,31 +1,58 @@
 import { type DeployTarget, type WorkflowConfig, type WorkflowDeployment } from '@sanity/workflow-engine';
+type ChooseDeploymentName = (deployments: WorkflowDeployment[]) => Promise<string>;
+interface DeploymentSelectionOptions {
+    name: string | undefined;
+    tag: string | undefined;
+    allTags: boolean;
+    interactive?: boolean;
+    chooseName?: ChooseDeploymentName;
+}
+/** The one identity format for a deployment in output — banners, failure
+ *  summaries, and "available deployments" listings all render it the same
+ *  way. */
+export declare function deploymentLabel({ name, tag }: Pick<WorkflowDeployment, 'name' | 'tag'>): string;
 /**
- * Pick the deployment for the requested `--tag`. Tags are unique across a
- * config (enforced by defineWorkflowConfig), so a tag names at most one
- * deployment.
+ * Pick the deployment for the requested `--deployment` or `--tag`. Names are
+ * unique across a config (enforced by defineWorkflowConfig), so a name resolves
+ * exactly one deployment. Tags are repeatable — a tag resolves only while it
+ * names exactly one deployment; when it spans several, the failure lists them
+ * so `--deployment` can disambiguate.
  *
- * With no tag: fall back to the sole deployment when there's exactly one
- * (the common single-environment case), otherwise fail asking for `--tag` —
- * a multi-deployment config is ambiguous without it. `orAlternative` extends
- * that ambiguity message for callers with another way out (deploy's `--all-tags`).
+ * With no selector: fall back to the sole deployment when there's exactly one
+ * (the common single-environment case), otherwise fail asking for
+ * `--deployment` or `--tag` — a multi-deployment config is ambiguous without
+ * one. `orAlternative`
+ * extends that ambiguity message for callers with another way out (deploy's
+ * `--all-tags`).
  */
-export declare function selectDeployment(config: WorkflowConfig, { tag, orAlternative }: {
+export declare function selectDeployment(config: WorkflowConfig, { name, tag, orAlternative, }: {
+    name: string | undefined;
     tag: string | undefined;
     orAlternative?: string;
 }): WorkflowDeployment;
 /**
- * The deployments a `deploy` run acts on: every one with `--all-tags`,
- * otherwise a single target via {@link selectDeployment} and its failure
- * modes. Deploying everything is an explicit opt-in — never a default — so an
- * ambiguous bare `deploy` can't fan a write out across environments.
+ * Every deployment carrying `tag`, failing when the tag matches none — the
+ * shared resolution for the callers that accept a whole tag group (deploy's
+ * tag-as-environment run, the read paths' resource narrowing).
  */
-export declare function selectDeployments(config: WorkflowConfig, { tag, allTags }: {
-    tag: string | undefined;
-    allTags: boolean;
-}): WorkflowDeployment[];
+export declare function deploymentsForTag(config: WorkflowConfig, tag: string): WorkflowDeployment[];
+/**
+ * The deployments a `deploy` run acts on: every one with `--all-tags`, one
+ * definite deployment via `--deployment`, every deployment carrying the tag with
+ * `--tag` (a tag is an environment group), otherwise the sole deployment. An
+ * ambiguous bare interactive run asks which deployment; a run that cannot
+ * prompt keeps the explicit flag guidance. Deploying everything is an
+ * explicit opt-in — never a default.
+ */
+export declare function selectDeployments(config: WorkflowConfig, { name, tag, allTags, interactive, chooseName }: DeploymentSelectionOptions): Promise<WorkflowDeployment[]>;
+/** The "Available deployments: name (tag), …" hint every ambiguity failure
+ *  prints — one vocabulary across the write and instance-keyed paths, so a
+ *  reader always sees both the `--deployment` names and their `--tag`s. */
+export declare function availableDeployments(config: WorkflowConfig, deployments?: WorkflowDeployment[]): string;
 /**
  * Project a deployment into the engine's {@link DeployTarget} — the shape the
  * deploy/diff verbs (`deployDefinitions`, `computeDiffEntries`, `diffEntry`)
  * consume — expanding its handle bindings into the alias map in the same step.
  */
 export declare function deploymentToTarget(deployment: WorkflowDeployment): DeployTarget;
+export {};

package/dist/lib/select-deployment.js

@@ -1,35 +1,86 @@
+import { select } from '@sanity/cli-core/ux';
 import { resourceAliasesToMap, } from '@sanity/workflow-engine';
 import { fail } from "./fail.js";
-export function selectDeployment(config, { tag, orAlternative = '' }) {
-    if (tag === undefined) {
-        if (config.deployments.length > 1) {
-            fail(`Multiple deployments configured — pass --tag${orAlternative}.`, availableTags(config));
+import { canPromptOnStderr } from "./prompt.js";
+export function deploymentLabel({ name, tag }) {
+    return `${name} (${tag})`;
+}
+export function selectDeployment(config, { name, tag, orAlternative = '', }) {
+    if (name !== undefined) {
+        const deployment = config.deployments.find((candidate) => candidate.name === name);
+        if (deployment === undefined) {
+            fail(`No deployment named "${name}".`, availableDeployments(config));
         }
-        const [sole] = config.deployments;
-        if (sole === undefined) {
-            fail('No deployments configured.');
+        return deployment;
+    }
+    if (tag !== undefined) {
+        const matches = deploymentsForTag(config, tag);
+        const [sole, ...rest] = matches;
+        if (sole === undefined || rest.length > 0) {
+            fail(`Multiple deployments tagged "${tag}" — pass --deployment to choose one.`, availableDeployments(config, matches));
         }
         return sole;
     }
-    const deployment = config.deployments.find((candidate) => candidate.tag === tag);
-    if (deployment === undefined) {
-        fail(`No deployment for tag "${tag}".`, availableTags(config));
+    if (config.deployments.length > 1) {
+        fail(`Multiple deployments configured — pass --deployment or --tag${orAlternative}.`, availableDeployments(config));
+    }
+    const [sole] = config.deployments;
+    if (sole === undefined) {
+        fail('No deployments configured.');
+    }
+    return sole;
+}
+export function deploymentsForTag(config, tag) {
+    const matches = config.deployments.filter((candidate) => candidate.tag === tag);
+    if (matches.length === 0) {
+        fail(`No deployment for tag "${tag}".`, availableDeployments(config));
     }
-    return deployment;
+    return matches;
 }
-export function selectDeployments(config, { tag, allTags }) {
+export async function selectDeployments(config, { name, tag, allTags, interactive, chooseName = chooseDeploymentName }) {
     if (allTags) {
         return config.deployments;
     }
+    if (tag !== undefined) {
+        return deploymentsForTag(config, tag);
+    }
+    if (name === undefined && config.deployments.length > 1) {
+        if (!(interactive ?? canPromptOnStderr())) {
+            return [
+                selectDeployment(config, {
+                    name,
+                    tag,
+                    orAlternative: ', or --all-tags to deploy every deployment',
+                }),
+            ];
+        }
+        const selectedName = await chooseName(config.deployments);
+        return [selectDeployment(config, { name: selectedName, tag: undefined })];
+    }
     return [
-        selectDeployment(config, { tag, orAlternative: ', or --all-tags to deploy every deployment' }),
+        selectDeployment(config, {
+            name,
+            tag,
+            orAlternative: ', or --all-tags to deploy every deployment',
+        }),
     ];
 }
-function availableTags(config) {
-    return `Available tags: ${config.deployments.map((candidate) => candidate.tag).join(', ')}`;
+async function chooseDeploymentName(deployments) {
+    return select({
+        message: 'Select a deployment',
+        choices: deployments.map(({ name, tag }) => ({
+            name,
+            value: name,
+            description: `tag: ${tag}`,
+        })),
+    }, { output: process.stderr });
+}
+export function availableDeployments(config, deployments = config.deployments) {
+    return `Available deployments: ${deployments.map(deploymentLabel).join(', ')}`;
 }
 export function deploymentToTarget(deployment) {
     return {
+        expectedMinReaderModel: deployment.expectedMinReaderModel,
         tag: deployment.tag,
         workflowResource: deployment.workflowResource,
         resourceAliases: resourceAliasesToMap(deployment.resourceAliases),

package/dist/lib/share-definitions.d.ts

@@ -10,12 +10,11 @@
  * Consent model: opt-OUT. A deploy that creates new definition versions
  * donates by default. The choice is skipped by an explicit flag:
  * `--share-defs` (donate, no prompt) or `--no-share-defs` (don't). Without a
- * flag, an interactive terminal takes a ONE-TIME acknowledgement (persisted
- * in the shared Sanity user config, so it is asked once ever) before the
- * first donation — notice must precede the send, since we cannot disclose
- * taking content after taking it. Unattended runs (CI / `DO_NOT_TRACK` / a
- * non-TTY pipe) can't prompt, so they donate nothing — the standard Sanity-CLI
- * "silent in CI / `DO_NOT_TRACK`" rule; opt in per run with `--share-defs`.
+ * flag, the CLI shares. An interactive terminal gets a ONE-TIME notice
+ * (persisted in the shared Sanity user config) before the first donation;
+ * every later flagless deploy, and every unattended deploy, prints a concise
+ * reminder. CI, `DO_NOT_TRACK`, and non-TTY execution do not change the
+ * content-sharing default. Only `--no-share-defs` opts out.
  */
 import { type DeployDefinitionResult, type DeployedDefinition, type WorkflowResource } from '@sanity/workflow-engine';
 import type { UserConfigStore } from './telemetry-setup.ts';
@@ -50,22 +49,20 @@ export interface ShareCandidate {
  *  routed project-agnostically through the API gateway). */
 export declare const SHARE_ENDPOINT_URI = "/workflow/definition-feedback";
 /**
- * The first-run consent prompt — a product contract, pinned by test. It must
+ * The first-run disclosure — a product contract, pinned by test. It must
  * name the recipient (Sanity), state that the document ships VERBATIM with its
  * deployment coordinates and is kept, name what is never shared, and disclose
- * that the answer is remembered machine-wide (not just for this deploy) with
- * the per-run override. Shown once (persisted) before the first donation on an
- * interactive terminal; the answer decides and is remembered.
+ * that the notice is remembered machine-wide and name the per-run opt-out.
+ * This is a notice, not a choice: sharing is the default unless the invocation
+ * supplies `--no-share-defs`.
  */
-export declare const SHARE_CONSENT_PROMPT: string;
+export declare const SHARE_FIRST_RUN_NOTICE: string;
 /**
- * The one-line reminders printed on every flagless interactive deploy after the
- * first — product contracts, pinned by test. They keep an ongoing donation (or
- * a remembered decline) visible every run, never silent, and name the per-run
- * override. `_ON` shows when the remembered answer shares, `_OFF` when it does not.
+ * The status block printed on every flagless deploy that does not show the
+ * first-run disclosure. It keeps the default donation obvious in terminals and
+ * unattended logs and names both explicit controls.
  */
-export declare const SHARE_REMINDER_ON: string;
-export declare const SHARE_REMINDER_OFF: string;
+export declare const SHARE_REMINDER: string;
 /**
  * The content-free telemetry marker for one shared definition — projected
  * from the engine's own deploy-event derivation ({@link definitionDeployedData})
@@ -80,9 +77,9 @@ export declare function definitionShareMarker(args: {
 }): WorkflowDefinitionSharedData;
 /**
  * Whether the invocation's telemetry should send despite the environment
- * denial (CI / `DO_NOT_TRACK`). Only an explicit `--share-defs` that actually
- * donates forces it — a command-line arg beats env vars, and a `--share-defs`
- * donation must never be recorded-less. Account-level consent is never
+ * denial (CI / `DO_NOT_TRACK`). Every flagless or explicitly enabled deploy
+ * that can create versions forces it, because definition donation defaults on
+ * in those environments too. Account-level consent is never
  * overridden (the intake still reads `/intake/telemetry-status`).
  *
  * Computed from raw argv because the prerun hook builds the store before oclif
@@ -98,12 +95,12 @@ export declare function shouldForceShareTelemetry(args: {
     argv: string[];
 }): boolean;
 /**
- * The whole post-deploy sharing flow. Resolves the opt-out decision (explicit
- * flag, one-time acknowledgement, or standing policy), donates when it lands
- * on share, and always records the content-free per-invocation decision so
- * adoption dashboards can measure opt-out rate. No newly created versions
- * (unchanged re-deploys, dry runs, nothing succeeded) means no decision, no
- * prompt, and no POST.
+ * The whole post-deploy sharing flow. An explicit flag decides directly;
+ * otherwise sharing defaults on after emitting either the one-time disclosure
+ * or recurring reminder. It always records the content-free per-invocation
+ * decision so adoption dashboards can measure opt-out rate. No newly created
+ * versions (unchanged re-deploys, dry runs, nothing succeeded) means no
+ * decision, notice, or POST.
  *
  * The optional args exist for the flow's dependencies, mirroring
  * `setupCliTelemetry` — omitted, the real process surfaces apply.
@@ -113,8 +110,6 @@ export declare function shareDefinitionsAfterDeploy(args: {
     candidates: ShareCandidate[];
     warn: (message: string) => void;
     interactive?: boolean;
-    envDenied?: boolean;
     writeStderr?: (message: string) => void;
     userConfig?: UserConfigStore;
-    confirmShare?: () => Promise<boolean>;
 }): Promise<void>;