@haus-tech/haus-workflow 0.27.1 → 0.28.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [0.28.0](https://github.com/WeAreHausTech/haus-workflow/compare/v0.27.1...v0.28.0) (2026-06-17)
+
+### Features
+
+- catalog compatibility for curated provenance and deprecations ([#121](https://github.com/WeAreHausTech/haus-workflow/issues/121)) ([1a8a790](https://github.com/WeAreHausTech/haus-workflow/commit/1a8a7902bf7c27462e905d01dfa4d0baac319b57))
+- **cloneandsetup:** add up-front data-access preflight + seed access/empty-ok ([#120](https://github.com/WeAreHausTech/haus-workflow/issues/120)) ([70e32ad](https://github.com/WeAreHausTech/haus-workflow/commit/70e32adba2f5ed25ade170a09d1f0cfb2bd198d7))
+
 ## [0.27.1](https://github.com/WeAreHausTech/haus-workflow/compare/v0.27.0...v0.27.1) (2026-06-16)
 
 ### Bug Fixes

package/dist/cli.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync4 } from "fs";
-import path35 from "path";
+import { readFileSync as readFileSync4 } from "node:fs";
+import path35 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
-import path13 from "path";
+import path13 from "node:path";
 import checkbox from "@inquirer/checkbox";
 
 // src/catalog/remote-catalog.ts
-import os from "os";
-import path2 from "path";
+import os from "node:os";
+import path2 from "node:path";
 import fs2 from "fs-extra";
 
 // src/utils/fs.ts
-import crypto from "crypto";
-import path from "path";
+import crypto from "node:crypto";
+import path from "node:path";
 import fg from "fast-glob";
 import fs from "fs-extra";
 var MalformedJsonFileError = class extends Error {
@@ -372,14 +372,71 @@ function validateCatalogItem(item, content2) {
   return { ok: true };
 }
 
-// src/catalog/manifest-schema.ts
-var POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+// src/catalog/manifest-item-fields.ts
+var USE_MODES = /* @__PURE__ */ new Set(["copy", "adapted", "wrapped", "rewritten", "reference-only"]);
+var LICENSE_CONFIDENCES = /* @__PURE__ */ new Set(["high", "medium", "low", "unknown"]);
+var REVIEW_STATUSES = /* @__PURE__ */ new Set([
+  "approved",
+  "candidate",
+  "needs-review",
+  "rejected",
+  "deprecated"
+]);
+var RISK_LEVELS = /* @__PURE__ */ new Set(["low", "medium", "high", "blocked"]);
 function isNonEmptyString(value) {
   return typeof value === "string" && value.length > 0;
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+function validateReferences(itemId, references) {
+  if (references === void 0) return null;
+  if (!isStringArray(references)) return `${itemId}: references must be a string array`;
+  for (const ref of references) {
+    if (/^https?:\/\//i.test(ref)) {
+      if (!/^https:\/\//i.test(ref)) {
+        return `${itemId}: reference must be https:// URL: ${ref}`;
+      }
+    }
+  }
+  return null;
+}
+function validateCuratedProvenance(item) {
+  if (item.source !== "curated") return null;
+  if (!isNonEmptyString(item.reviewStatus)) {
+    return `${item.id}: curated item missing reviewStatus`;
+  }
+  if (!REVIEW_STATUSES.has(item.reviewStatus)) {
+    return `${item.id}: invalid reviewStatus "${item.reviewStatus}"`;
+  }
+  if (!isNonEmptyString(item.riskLevel)) {
+    return `${item.id}: curated item missing riskLevel`;
+  }
+  if (!RISK_LEVELS.has(item.riskLevel)) {
+    return `${item.id}: invalid riskLevel "${item.riskLevel}"`;
+  }
+  if (item.useMode !== void 0 && !USE_MODES.has(String(item.useMode))) {
+    return `${item.id}: invalid useMode "${item.useMode}"`;
+  }
+  if (item.licenseConfidence !== void 0 && !LICENSE_CONFIDENCES.has(String(item.licenseConfidence))) {
+    return `${item.id}: invalid licenseConfidence "${item.licenseConfidence}"`;
+  }
+  if (item.originUrl !== void 0) {
+    if (typeof item.originUrl !== "string" || !item.originUrl.startsWith("https://")) {
+      return `${item.id}: originUrl must be an https:// URL`;
+    }
+  }
+  return null;
+}
+
+// src/catalog/manifest-schema.ts
+var POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function isNonEmptyString2(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isStringArray2(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
 var REQUIRES_ANY_KEYS = ["stack", "dependency", "packageNamePattern", "role"];
 function isRequiresAnyClause(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -409,7 +466,7 @@ function parseManifest(json) {
     return { ok: false, error: "manifest must be an object" };
   }
   const root = data;
-  if (!isNonEmptyString(root.version)) {
+  if (!isNonEmptyString2(root.version)) {
     return { ok: false, error: "missing version" };
   }
   if (!Array.isArray(root.items)) {
@@ -424,13 +481,13 @@ function parseManifest(json) {
       return { ok: false, error: `item[${i}]: invalid entry` };
     }
     const item = raw;
-    if (!isNonEmptyString(item.id)) {
+    if (!isNonEmptyString2(item.id)) {
       return { ok: false, error: `item[${i}]: missing id` };
     }
-    if (!isNonEmptyString(item.type)) {
+    if (!isNonEmptyString2(item.type)) {
       return { ok: false, error: `${item.id}: missing type` };
     }
-    if (!isNonEmptyString(item.path)) {
+    if (!isNonEmptyString2(item.path)) {
       return { ok: false, error: `${item.id}: missing path` };
     }
     if (seenIds.has(item.id)) {
@@ -442,18 +499,14 @@ function parseManifest(json) {
       return { ok: false, error: `${item.id}: duplicate path "${normPath}"` };
     }
     seenPaths.add(normPath);
-    if (item.source === "curated") {
-      if (!isNonEmptyString(item.reviewStatus)) {
-        return { ok: false, error: `${item.id}: curated item missing reviewStatus` };
-      }
-      if (!isNonEmptyString(item.riskLevel)) {
-        return { ok: false, error: `${item.id}: curated item missing riskLevel` };
-      }
-    }
-    if (!isStringArray(item.tags)) {
+    const provenanceError = validateCuratedProvenance(item);
+    if (provenanceError) return { ok: false, error: provenanceError };
+    const referencesError = validateReferences(String(item.id), item.references);
+    if (referencesError) return { ok: false, error: referencesError };
+    if (!isStringArray2(item.tags)) {
       return { ok: false, error: `${item.id}: tags must be a string array` };
     }
-    if (!isStringArray(item.repoRoles)) {
+    if (!isStringArray2(item.repoRoles)) {
       return { ok: false, error: `${item.id}: repoRoles must be a string array` };
     }
     if (item.requiresAny !== void 0 && !isRequiresAnyArray(item.requiresAny)) {
@@ -924,17 +977,17 @@ async function getCacheManifestAge() {
 }
 
 // src/claude/write-claude-files.ts
-import path12 from "path";
+import path12 from "node:path";
 import fs12 from "fs-extra";
 
 // src/catalog/load-catalog.ts
-import path4 from "path";
+import path4 from "node:path";
 
 // src/utils/paths.ts
-import { existsSync, readFileSync } from "fs";
-import os2 from "os";
-import path3 from "path";
-import { fileURLToPath } from "url";
+import { existsSync, readFileSync } from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+import { fileURLToPath } from "node:url";
 var HAUS_DIR = ".haus-workflow";
 function hausPath(root, ...parts) {
   return path3.join(root, HAUS_DIR, ...parts);
@@ -1019,7 +1072,7 @@ function catalogItemContentPath(contentRoot, item) {
 }
 
 // src/update/hash-installed.ts
-import path5 from "path";
+import path5 from "node:path";
 import fg2 from "fast-glob";
 import fs3 from "fs-extra";
 
@@ -1150,12 +1203,12 @@ function buildAllowRules() {
 }
 
 // src/install/settings-merge.ts
-import path7 from "path";
+import path7 from "node:path";
 import fs5 from "fs-extra";
 
 // src/install/manifest.ts
-import os3 from "os";
-import path6 from "path";
+import os3 from "node:os";
+import path6 from "node:path";
 var MANIFEST_SCHEMA = "haus-install-manifest/1";
 function globalClaudeDir() {
   return path6.join(os3.homedir(), ".claude");
@@ -1593,7 +1646,7 @@ async function applyProjectSettingsMerge(root) {
 }
 
 // src/claude/superpowers-install.ts
-import path8 from "path";
+import path8 from "node:path";
 import fg3 from "fast-glob";
 import fs6 from "fs-extra";
 var SUPERPOWERS_ORIGIN_SOURCE_ID = "superpowers-pcvelz";
@@ -1733,7 +1786,7 @@ async function verifyProjectSettingsHooksContract(root) {
 }
 
 // src/claude/write-root-claude-md.ts
-import path9 from "path";
+import path9 from "node:path";
 import fs8 from "fs-extra";
 var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
 var BLOCK_END = "<!-- HAUS:END haus-imports -->";
@@ -1808,11 +1861,11 @@ async function writeRootClaudeMd(root, dryRun) {
 }
 
 // src/claude/write-workflow-config.ts
-import path11 from "path";
+import path11 from "node:path";
 import fs10 from "fs-extra";
 
 // src/claude/derive-workflow-config.ts
-import path10 from "path";
+import path10 from "node:path";
 import fs9 from "fs-extra";
 function binCmd(pm, bin, args) {
   const tail = args ? ` ${args}` : "";
@@ -2131,6 +2184,10 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   for (const item of catalogItems) {
     const manifestItem = manifestById.get(item.id);
     if (!manifestItem?.path) continue;
+    if (manifestItem.reviewStatus === "deprecated") {
+      warn(`Skipping ${item.id}: reviewStatus is deprecated`);
+      continue;
+    }
     if (manifestItem.source === "curated") {
       if (manifestItem.reviewStatus !== "approved") {
         curatedReviewStatusSkips++;
@@ -2363,8 +2420,8 @@ async function runCatalogAudit() {
 }
 
 // src/commands/clone.ts
-import { existsSync as existsSync2 } from "fs";
-import path14 from "path";
+import { existsSync as existsSync2 } from "node:fs";
+import path14 from "node:path";
 
 // src/utils/exec.ts
 import { execa } from "execa";
@@ -2436,11 +2493,11 @@ async function runClone(url, opts = {}) {
 }
 
 // src/commands/doctor.ts
-import path19 from "path";
+import path19 from "node:path";
 import fs14 from "fs-extra";
 
 // src/scanner/scan-project.ts
-import path18 from "path";
+import path18 from "node:path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -2467,7 +2524,7 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path15 from "path";
+import path15 from "node:path";
 import fs13 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
@@ -2690,7 +2747,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path16 from "path";
+import path16 from "node:path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -2750,8 +2807,8 @@ function collectUnsupportedSignals(files) {
 }
 
 // src/scanner/render.ts
-import { readFile } from "fs/promises";
-import path17 from "path";
+import { readFile } from "node:fs/promises";
+import path17 from "node:path";
 async function buildContentBlob(root, files) {
   const candidates = files.filter(
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
@@ -3254,7 +3311,7 @@ async function runExplainRecommendation(options) {
 }
 
 // src/commands/guard.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 
 // src/security/guard-bash.ts
 function matchesDenyToken(command, denyPhrase) {
@@ -3324,12 +3381,12 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path20 from "path";
+import path20 from "node:path";
 import fs15 from "fs-extra";
 
 // src/utils/prompts.ts
-import { stdin as input, stdout as output } from "process";
-import readline from "readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import readline from "node:readline/promises";
 async function ask(question) {
   const rl = readline.createInterface({ input, output });
   try {
@@ -3446,6 +3503,10 @@ async function recommend(root, context) {
       skip(item.id, "unsupported-policy", "Unsupported stack policy");
       continue;
     }
+    if (item.reviewStatus === "deprecated") {
+      skip(item.id, "deprecated", "Catalog item is deprecated", "reviewStatus:deprecated");
+      continue;
+    }
     if (item.source === "curated") {
       const rs = item.reviewStatus;
       if (!rs || rs !== "approved") {
@@ -3684,8 +3745,8 @@ async function runInit(options) {
 }
 
 // src/install/apply.ts
-import crypto2 from "crypto";
-import path21 from "path";
+import crypto2 from "node:crypto";
+import path21 from "node:path";
 import fs16 from "fs-extra";
 
 // src/install/header.ts
@@ -4076,7 +4137,7 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path22 from "path";
+import path22 from "node:path";
 import fs17 from "fs-extra";
 
 // src/claude/managed-paths.ts
@@ -4201,8 +4262,8 @@ User-owned .claude/ files will be preserved.`
 }
 
 // src/install/uninstall.ts
-import crypto3 from "crypto";
-import path23 from "path";
+import crypto3 from "node:crypto";
+import path23 from "node:path";
 import fs18 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
@@ -4277,7 +4338,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path25 from "path";
+import path25 from "node:path";
 
 // src/claude/refresh-project.ts
 import fs19 from "fs-extra";
@@ -4316,8 +4377,8 @@ function summarizeLockDiff(before, after) {
 }
 
 // src/update/lockfile.ts
-import { mkdir, readFile as readFile2, copyFile } from "fs/promises";
-import path24 from "path";
+import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
+import path24 from "node:path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every(
@@ -4489,11 +4550,11 @@ async function detectGlobalInstallDrift() {
 }
 
 // src/commands/validate-catalog.ts
-import path27 from "path";
+import path27 from "node:path";
 
 // src/catalog/validate-core.ts
-import fs20 from "fs";
-import path26 from "path";
+import fs20 from "node:fs";
+import path26 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var MANIFEST_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
 function isSafeCatalogPath2(itemPath) {
@@ -4527,6 +4588,10 @@ function auditManifestStructure(manifestVersion, items) {
       failures.push(`item[${i}]: missing id`);
       continue;
     }
+    const provenanceError = validateCuratedProvenance(item);
+    if (provenanceError) failures.push(provenanceError);
+    const referencesError = validateReferences(item.id, item.references);
+    if (referencesError) failures.push(referencesError);
     if (!item.type) {
       failures.push(`${item.id}: missing type`);
       continue;
@@ -4554,19 +4619,11 @@ function auditManifestStructure(manifestVersion, items) {
         else seenPaths.set(norm, item.id);
       }
       const isHaus = item.source === "haus";
-      const isCuratedApproved = item.source === "curated" && item.reviewStatus === "approved";
-      if (!isHaus && !isCuratedApproved) {
-        failures.push(`${item.id}: source must be "haus" or curated with reviewStatus "approved"`);
-      }
-      for (const ref of item.references ?? []) {
-        if (/^https?:\/\//i.test(ref)) {
-          if (!ref.startsWith("https://")) {
-            failures.push(`${item.id}: reference must be https:// URL: ${ref}`);
-          }
-          if (HTTP_URL_PATTERN.test(ref)) {
-            failures.push(`${item.id}: reference uses insecure http:// URL: ${ref}`);
-          }
-        }
+      const isCuratedUsableState = item.source === "curated" && (item.reviewStatus === "approved" || item.reviewStatus === "deprecated");
+      if (!isHaus && !isCuratedUsableState) {
+        failures.push(
+          `${item.id}: source must be "haus" or curated with reviewStatus "approved"/"deprecated"`
+        );
       }
     }
   }
@@ -4714,8 +4771,8 @@ async function runValidateCatalog(manifestPath2) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync5, statSync as statSync2 } from "fs";
-import path34 from "path";
+import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
+import path34 from "node:path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -4769,7 +4826,7 @@ ${summaries.map(
 }
 
 // src/commands/workspace/config.ts
-import path28 from "path";
+import path28 from "node:path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -4796,7 +4853,7 @@ async function readWorkspaceConfig(workspaceRoot) {
 }
 
 // src/commands/workspace/discover.ts
-import path29 from "path";
+import path29 from "node:path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -4919,12 +4976,12 @@ async function runDiscover(workspaceRoot, opts = {}) {
 }
 
 // src/commands/workspace/doctor.ts
-import { existsSync as existsSync3 } from "fs";
-import path31 from "path";
+import { existsSync as existsSync3 } from "node:fs";
+import path31 from "node:path";
 
 // src/commands/workspace/manifest.ts
-import { readFileSync as readFileSync3 } from "fs";
-import path30 from "path";
+import { readFileSync as readFileSync3 } from "node:fs";
+import path30 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
@@ -5070,11 +5127,11 @@ function emit(args) {
 }
 
 // src/commands/workspace/setup.ts
-import { existsSync as existsSync4, statSync } from "fs";
-import path33 from "path";
+import { existsSync as existsSync4, statSync } from "node:fs";
+import path33 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path32 from "path";
+import path32 from "node:path";
 import fs21 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);

package/library/global/commands/haus-cloneandsetup.md

@@ -15,8 +15,25 @@ Before any setup work, probe **everything** the workspace will need and surface
 - **PHP environment** — `valet`, `herd`, `ddev`, or `php` on PATH, if any repo is a PHP/WordPress site.
 - **WP-CLI** — `wp --version`, if any repo's `seed:` pulls a WordPress DB.
 - **Node versions** — the versions named in each repo's `.nvmrc` / `engines.node` are installable via `nvm`.
+- **Data-access preflight** — for every data load the workspace will run (each repo's `seed` **and** the workspace `seeds`), check up front that the user can actually reach the source, so nobody ends up with a half-set-up environment that only fails at the seed step. See below.
 
-Then list the repos and what each will run (node, deps, localdev steps), **report every gap at once**, and get a single go-ahead. For **reused** local clones, ask whether to re-run setup. For each gap, name what it blocks; the user decides whether to fix it now (**ask before any global/system install**) or proceed and skip the affected steps. Don't begin per-repo work until this gate is acknowledged.
+### Data-access preflight
+
+The single most common way cloneAndSetup leaves a **half-completed environment** is discovering at the `seed:` step — after cloning, installing, and bringing up services — that the user lacks the AWS/SSH/etc. access to pull the data. Catch it **here**, before any heavy work, and make the data outcome a deliberate choice.
+
+1. **Collect every seed:** each repo's `seed` plus the workspace `seeds`. For each, determine its required access:
+   - If `seed` is an **object with `access`**, run each entry's `check` (a read-only probe; exit 0 = reachable).
+   - If `seed` is a **bare string**, infer the channel and probe generically: `aws …`/SSM → `aws sts get-caller-identity`; `dep db:pull …` / `ssh`/`scp`/`rsync <user@host>` → `ssh -o BatchMode=yes -o ConnectTimeout=5 <host> true`; `northflank …` → `northflank whoami`. A purely local seed (no remote) needs nothing.
+2. **Report one table** alongside the rest of the gate — per data source: its `label`, the access it needs, and ✓ reachable / ✗ + the `login` remedy (verbatim).
+3. **Resolve every ✗ with one consolidated choice**, then remember it for the run:
+   - **Set up access now** → print the `login` text, let the user do it, **re-check**, then seed normally.
+   - **Create that DB EMPTY for now** (only when `empty-ok` is true — the default) → the datastore comes up empty (schema via migrations/`needs:`), the app still boots, and the user can run that one seed later. Name the exact command to fill it.
+   - **Abort.**
+4. **Only a gap on a seed with `empty-ok: false` is a HARD STOP** (the repo is genuinely broken without data — log in or abort). Every other gap offers the empty path; one source's missing access never blocks another's.
+
+This is the one prompt the "no half-completed environment" goal justifies. The two valid end-states are **seeded** or **deliberately empty** — never a third "did the expensive work then died at seed."
+
+Then list the repos and what each will run (node, deps, localdev steps, **data sources + the chosen seed/empty plan**), **report every gap at once**, and get a single go-ahead. For **reused** local clones, ask whether to re-run setup. For each gap, name what it blocks; the user decides whether to fix it now (**ask before any global/system install**) or proceed and skip the affected steps. Don't begin per-repo work until this gate is acknowledged.
 
 ## Step 3 — Per-repo dependency pass
 
@@ -50,6 +67,16 @@ needs: [mysql] # services this repo requires; provisioned in Docker, env wired t
 needsEnv: [WP_HOME, DB_NAME] # env keys that must be present to run/serve
 build: 'yarn build' # optional: the build command (run after deps)
 seed: 'dep db:pull staging-oderland' # optional: how to load data; remote/destructive → confirm first
+# `seed` may also be an OBJECT when the load needs external access (AWS, SSH, …) so the
+# Step-2 data-access preflight can check it up front and offer an empty-DB fallback:
+seed:
+  run: './scripts/pull-aws-db.sh --yes' # the seed command
+  empty-ok: true # default true: skipping yields a coherent EMPTY DB (schema via migrations).
+  #              # false = the repo is broken without data → a missing-access gap HARD-STOPS.
+  access: # what the user must have to run `run`; each entry probed in the Step-2 preflight
+    - label: 'AWS CLI credentials — eu-north-1 / 842675986884'
+      check: 'aws sts get-caller-identity --region eu-north-1' # read-only probe; exit 0 = OK
+      login: 'Set up the AWS CLI (brew install awscli; aws configure …) — or pick empty DB.'
 serve: # optional: how it runs (printed as a next-step, never auto-started)
   via: herd # herd | valet | docker | command — for PHP envs, bring-your-own (don't install)
   url: 'https://example.test'
@@ -77,6 +104,16 @@ env:
     # source: { repo: <repo>, provides: '<value>' }   # … a value produced by another repo
     sinks:
       - { repo: <repo>, key: DB_NAME } # written under `key` into each sink's .env
+seeds: # optional: data sources NOT owned by a manifest repo (e.g. a shared WordPress host
+  #    pulled by a workspace script). Same shape as a per-repo `seed` object; included in
+  #    the Step-2 data-access preflight.
+  - label: 'WordPress host (example.se)'
+    run: './scripts/pull-wp-example.sh'
+    empty-ok: true
+    access:
+      - label: 'SSH user@host'
+        check: 'ssh -o BatchMode=yes -o ConnectTimeout=5 user@host true'
+        login: 'Add your SSH key to the host (ssh-add …) / request access — or skip the pull.'
 ```
 
 ### Run order
@@ -87,7 +124,7 @@ env:
    - **`needs`** → add the service to the **workspace compose project** and `docker compose up -d` if not already running (namespaced by `COMPOSE_PROJECT_NAME`, free host ports per instance; not the repo's own bind-mounting compose). Comes up **empty**; record host ports in the workspace `localdev.yml` `env` map — data lands in `seed:`.
    - **`build`** → run it (honor any node version the repo's docs note).
    - **`serve`** → for `via: herd` / PHP envs, install nothing — verify the dev's environment serves `web/`, and report the URL.
-   - **`seed`** → populate the empty datastore. **Always a distinct, confirm-gated step, separate from `needs:` bring-up** (don't conflate "DB up" with "DB has data"). Before running, **check its prerequisites and report any gap instead of running blind** — e.g. WP-CLI present (for `wp` / `db:pull` seeds), the target repo's **`.env` written** (the seed reads connection values from it — done in the Env step above), the **SSH alias resolves** (for remote pulls like `dep db:pull staging-oderland`). **Confirm first** for every remote (SSH) or destructive (overwrites data) seed — every run, even on re-run. Missing prerequisite → skip with a clear message, don't guess.
+   - **`seed`** → populate the empty datastore (`seed.run`, or the bare-string form). **Always a distinct, confirm-gated step, separate from `needs:` bring-up** (don't conflate "DB up" with "DB has data"). **Honor the data plan chosen in the Step-2 data-access preflight** — don't re-discover access here: if the user chose _empty_ for this source, skip it (the DB stays empty, schema via migrations) and print the command to fill it later; if they chose _seed_, run it. Still verify the run-time prerequisites the preflight couldn't (the target repo's **`.env` written** — done in the Env step above; WP-CLI present for `wp`/`db:pull` seeds) and **confirm first** for every remote (SSH/AWS) or destructive (overwrites data) seed — every run, even on re-run. Missing prerequisite → skip with a clear message, don't guess.
    - **`steps`** (escape hatch) → run in order, selecting `node:` per step, `optional:` failures continue, **confirming before any `remote:`/`destructive:` step** — every run, even on re-run.
 4. **Links** (workspace-owned, performed generically — do NOT call a repo's own `setup-dev-mode.sh`, which is deprecated):
    - `symlink` → `ln -s <from> <to>`; replace an existing symlink, but never clobber a real directory without confirmation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haus-tech/haus-workflow",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "Haus AI workflow CLI for Claude Code.",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
     "CHANGELOG.md"
   ],
   "scripts": {
-    "build": "tsup src/cli.ts --format esm --dts --clean --out-dir dist --external @inquirer/checkbox",
+    "build": "rm -rf dist && esbuild src/cli.ts --bundle --packages=external --platform=node --format=esm --outdir=dist --external:@inquirer/checkbox",
     "dev": "tsx src/cli.ts",
     "test": "node scripts/run-tests.mjs tests/**/*.test.js",
     "test:fast": "node scripts/test-fast.mjs",
@@ -58,13 +58,13 @@
     "@typescript-eslint/eslint-plugin": "8.59.3",
     "@typescript-eslint/parser": "8.59.3",
     "c8": "11.0.0",
+    "esbuild": "0.28.1",
     "eslint": "9.39.4",
     "eslint-plugin-import": "2.32.0",
     "lefthook": "1.13.6",
     "prettier": "3.8.3",
     "release-it": "20.0.1",
-    "tsup": "8.5.1",
-    "tsx": "4.21.0",
+    "tsx": "4.22.4",
     "typescript": "5.9.3"
   },
   "engines": {

package/dist/cli.d.ts

@@ -1 +0,0 @@
-#!/usr/bin/env node