@malmhq/intermesh-cli 0.1.0

package/dist/generation/scripts/lead-input.mjs

@@ -0,0 +1,584 @@
+import { createHash } from 'node:crypto';
+import { chmod, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+
+import { validateSourceBrief } from './validate-source-brief.mjs';
+import { createWorkPackets, responsePattern, scaffoldPreparedWork } from './prepared-work.mjs';
+
+export const MAX_LEAD_INPUT_BYTES = 20 * 1024 * 1024;
+const HASH = /^[a-f0-9]{64}$/u;
+
+function fail(message) {
+  throw new TypeError(message);
+}
+
+function record(value, name) {
+  if (typeof value !== 'object' || value === null || Array.isArray(value))
+    fail(`${name} is invalid`);
+  return value;
+}
+
+function exactKeys(value, expected, name) {
+  const actual = Object.keys(value).sort();
+  if (actual.join('\0') !== [...expected].sort().join('\0')) fail(`${name} has unexpected fields`);
+}
+
+function text(value, name) {
+  if (typeof value !== 'string' || value.trim() === '') fail(`${name} is invalid`);
+  return value;
+}
+
+function hash(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+
+async function businessContext(workspace, context) {
+  return Promise.all(
+    context.map(async ({ path, sha256 }) => {
+      const bytes = await readFile(resolve(workspace, path));
+      if (hash(bytes) !== sha256) fail(`Context hash does not match: ${path}`);
+      return { path, sha256, content: bytes.toString('utf8') };
+    }),
+  );
+}
+
+function generatorInputBytes(bundle, leadInputHash, context) {
+  const bytes = Buffer.from(
+    `${JSON.stringify(
+      {
+        schema_version: '1.0.0',
+        lead_input_sha256: leadInputHash,
+        customer: bundle.customer,
+        constraints: bundle.constraints,
+        business_context: context,
+        starter: {
+          guide_path: 'package/GENERATION-PATTERNS.md',
+          protected_paths: bundle.foundation.protected_paths,
+        },
+        packets: bundle.work_packets,
+        components_by_pointer: bundle.components_by_pointer,
+      },
+      null,
+      2,
+    )}\n`,
+  );
+  if (bytes.length > MAX_LEAD_INPUT_BYTES) fail('Generator input exceeds 20 MiB');
+  return bytes;
+}
+
+function expectedHash(value, name) {
+  if (typeof value !== 'string' || !HASH.test(value)) fail(`${name} is invalid`);
+  return value;
+}
+
+async function jsonBytes(path, name) {
+  const bytes = await readFile(path);
+  let value;
+  try {
+    value = JSON.parse(bytes.toString('utf8'));
+  } catch {
+    fail(`${name} is invalid JSON`);
+  }
+  return { bytes, value: record(value, name) };
+}
+
+function decodePointer(pointer) {
+  if (typeof pointer !== 'string' || !pointer.startsWith('#/'))
+    fail(`Unsupported OpenAPI reference: ${String(pointer)}`);
+  return pointer
+    .slice(2)
+    .split('/')
+    .map((token) => {
+      if (/~(?:[^01]|$)/u.test(token)) fail(`Malformed OpenAPI reference: ${pointer}`);
+      return token.replaceAll('~1', '/').replaceAll('~0', '~');
+    });
+}
+
+function encodePointer(tokens) {
+  return `#/${tokens.map((token) => token.replaceAll('~', '~0').replaceAll('/', '~1')).join('/')}`;
+}
+
+function resolvePointer(document, pointer) {
+  const tokens = decodePointer(pointer);
+  let value = document;
+  for (const token of tokens) {
+    if (typeof value !== 'object' || value === null || !Object.hasOwn(value, token))
+      fail(`Unresolved OpenAPI reference: ${pointer}`);
+    value = value[token];
+  }
+  return { pointer: encodePointer(tokens), value };
+}
+
+function referencesIn(value, references) {
+  if (Array.isArray(value)) {
+    for (const item of value) referencesIn(item, references);
+    return;
+  }
+  if (typeof value !== 'object' || value === null) return;
+  for (const [key, item] of Object.entries(value)) {
+    if (key === '$ref') references.add(text(item, '$ref'));
+    else referencesIn(item, references);
+  }
+}
+
+function referenceClosure(document, operation) {
+  const pending = new Set();
+  referencesIn(operation, pending);
+  const values = new Map();
+  while (pending.size > 0) {
+    const requested = [...pending].sort()[0];
+    pending.delete(requested);
+    const resolved = resolvePointer(document, requested);
+    if (values.has(resolved.pointer)) continue;
+    values.set(resolved.pointer, resolved.value);
+    const nested = new Set();
+    referencesIn(resolved.value, nested);
+    for (const reference of nested) {
+      const normalized = resolvePointer(document, reference).pointer;
+      if (!values.has(normalized)) pending.add(normalized);
+    }
+  }
+  return values;
+}
+
+function validateEvidence(value, name) {
+  const evidence = record(value, name);
+  exactKeys(evidence, ['document', 'location', 'excerpt'], name);
+  text(evidence.document, `${name}.document`);
+  text(evidence.location, `${name}.location`);
+  text(evidence.excerpt, `${name}.excerpt`);
+}
+
+function validateSortedUniqueStrings(value, name, allowEmpty = true) {
+  if (!Array.isArray(value) || (!allowEmpty && value.length === 0)) fail(`${name} is invalid`);
+  for (const item of value) text(item, name);
+  if (value.join('\0') !== [...new Set(value)].sort().join('\0'))
+    fail(`${name} must be sorted and unique`);
+}
+
+export function validateLeadInput(value) {
+  const bundle = record(value, 'Lead input');
+  exactKeys(
+    bundle,
+    [
+      'schema_version',
+      'source_hashes',
+      'customer',
+      'foundation',
+      'constraints',
+      'components_by_pointer',
+      'capabilities',
+      'work_packets',
+    ],
+    'Lead input',
+  );
+  if (bundle.schema_version !== '2.0.0') fail('Lead input schema version is invalid');
+  const hashes = record(bundle.source_hashes, 'source_hashes');
+  exactKeys(
+    hashes,
+    [
+      'run_request',
+      'openapi',
+      'operation_inventory',
+      'customer_profile',
+      'source_brief',
+      'starter_receipt',
+      'starter_checks',
+      'context',
+    ],
+    'source_hashes',
+  );
+  for (const name of [
+    'run_request',
+    'openapi',
+    'operation_inventory',
+    'customer_profile',
+    'source_brief',
+    'starter_receipt',
+    'starter_checks',
+  ])
+    expectedHash(hashes[name], `source_hashes.${name}`);
+  if (!Array.isArray(hashes.context) || hashes.context.length === 0)
+    fail('source_hashes.context is invalid');
+  for (const [index, value] of hashes.context.entries()) {
+    const item = record(value, `source_hashes.context[${index}]`);
+    exactKeys(item, ['path', 'sha256'], `source_hashes.context[${index}]`);
+    text(item.path, `source_hashes.context[${index}].path`);
+    expectedHash(item.sha256, `source_hashes.context[${index}].sha256`);
+  }
+  if (new Set(hashes.context.map((item) => item.path)).size !== hashes.context.length)
+    fail('source_hashes.context paths are duplicated');
+  const customer = record(bundle.customer, 'customer');
+  exactKeys(
+    customer,
+    [
+      'integration_id',
+      'package_name',
+      'binary',
+      'display_name',
+      'base_url',
+      'auth_environment_variable',
+      'login_prompt',
+    ],
+    'customer',
+  );
+  for (const name of Object.keys(customer)) text(customer[name], `customer.${name}`);
+  const foundation = record(bundle.foundation, 'foundation');
+  exactKeys(
+    foundation,
+    ['package_directory', 'starter_verified', 'protected_paths', 'prepared_hashes'],
+    'foundation',
+  );
+  text(foundation.package_directory, 'foundation.package_directory');
+  if (foundation.starter_verified !== true) fail('foundation.starter_verified is invalid');
+  validateSortedUniqueStrings(foundation.protected_paths, 'foundation.protected_paths');
+  const preparedHashes = record(foundation.prepared_hashes, 'foundation.prepared_hashes');
+  for (const [path, value] of Object.entries(preparedHashes)) {
+    text(path, 'foundation.prepared_hashes path');
+    expectedHash(value, `foundation.prepared_hashes.${path}`);
+  }
+  const constraints = record(bundle.constraints, 'constraints');
+  exactKeys(
+    constraints,
+    ['no_live_api_calls', 'no_credentials', 'offline_tests', 'human_release_review_required'],
+    'constraints',
+  );
+  if (Object.values(constraints).some((item) => item !== true))
+    fail('Lead input constraints are invalid');
+  const components = record(bundle.components_by_pointer, 'components_by_pointer');
+  const componentPointers = Object.keys(components);
+  if (componentPointers.join('\0') !== [...componentPointers].sort().join('\0'))
+    fail('components_by_pointer must be sorted');
+  for (const pointer of componentPointers) {
+    const normalized = encodePointer(decodePointer(pointer));
+    if (normalized !== pointer) fail(`Component pointer is not normalized: ${pointer}`);
+  }
+  if (!Array.isArray(bundle.capabilities) || bundle.capabilities.length === 0)
+    fail('Lead input capabilities are invalid');
+  const operationKeys = new Set();
+  const capabilityByKey = new Map();
+  for (const [index, value] of bundle.capabilities.entries()) {
+    const item = record(value, `capabilities[${index}]`);
+    exactKeys(
+      item,
+      [
+        'operation_key',
+        'effect',
+        'business_purpose',
+        'proposed_command',
+        'context_evidence',
+        'operation',
+        'component_refs',
+        'response_pattern',
+      ],
+      `capabilities[${index}]`,
+    );
+    for (const name of [
+      'operation_key',
+      'effect',
+      'business_purpose',
+      'proposed_command',
+      'response_pattern',
+    ])
+      text(item[name], `capabilities[${index}].${name}`);
+    if (!['json', 'text', 'file'].includes(item.response_pattern))
+      fail(`capabilities[${index}].response_pattern is invalid`);
+    record(item.operation, `capabilities[${index}].operation`);
+    const expectedOperationKey = `${text(item.operation.method, 'operation.method').toUpperCase()} ${text(item.operation.path, 'operation.path')}`;
+    if (item.operation_key !== expectedOperationKey)
+      fail(`capabilities[${index}].operation_key does not match its operation`);
+    if (operationKeys.has(item.operation_key)) fail(`Duplicate capability: ${item.operation_key}`);
+    operationKeys.add(item.operation_key);
+    capabilityByKey.set(item.operation_key, item);
+    if (!Array.isArray(item.context_evidence) || item.context_evidence.length === 0)
+      fail(`capabilities[${index}].context_evidence is invalid`);
+    item.context_evidence.forEach((evidence, evidenceIndex) =>
+      validateEvidence(evidence, `capabilities[${index}].context_evidence[${evidenceIndex}]`),
+    );
+    validateSortedUniqueStrings(item.component_refs, `capabilities[${index}].component_refs`);
+    for (const pointer of item.component_refs)
+      if (!Object.hasOwn(components, pointer))
+        fail(`Capability references a missing component: ${pointer}`);
+  }
+  const packets = record(bundle.work_packets, 'work_packets');
+  exactKeys(packets, ['cli', 'skill'], 'work_packets');
+  if (!Array.isArray(packets.cli) || packets.cli.length === 0) fail('work_packets.cli is invalid');
+  const assigned = new Set();
+  const writable = new Set();
+  const packetIds = new Set();
+  for (const [index, value] of packets.cli.entries()) {
+    const packet = record(value, `work_packets.cli[${index}]`);
+    exactKeys(
+      packet,
+      [
+        'id',
+        'kind',
+        'command_family',
+        'capabilities',
+        'writable_paths',
+        'helper_signatures',
+        'focused_check',
+      ],
+      `work_packets.cli[${index}]`,
+    );
+    if (packet.kind !== 'cli') fail(`work_packets.cli[${index}].kind is invalid`);
+    text(packet.id, 'packet.id');
+    if (packetIds.has(packet.id)) fail(`Duplicate work packet: ${packet.id}`);
+    packetIds.add(packet.id);
+    text(packet.command_family, 'packet.command_family');
+    if (!Array.isArray(packet.capabilities) || packet.capabilities.length === 0)
+      fail('packet.capabilities is invalid');
+    if (packet.capabilities.length > 3) fail('CLI work packet exceeds three operations');
+    for (const [capabilityIndex, packetCapabilityValue] of packet.capabilities.entries()) {
+      const packetCapability = record(
+        packetCapabilityValue,
+        `work_packets.cli[${index}].capabilities[${capabilityIndex}]`,
+      );
+      const key = text(packetCapability.operation_key, 'packet capability operation_key');
+      if (!operationKeys.has(key) || assigned.has(key)) fail(`Invalid packet operation: ${key}`);
+      const trusted = capabilityByKey.get(key);
+      for (const name of ['effect', 'business_purpose', 'proposed_command', 'response_pattern'])
+        if (packetCapability[name] !== trusted[name])
+          fail(`Packet capability does not match trusted capability: ${key}`);
+      assigned.add(key);
+    }
+    validateSortedUniqueStrings([...packet.writable_paths].sort(), 'packet.writable_paths', false);
+    for (const path of packet.writable_paths) {
+      const packagePath = path.slice('package/'.length);
+      if (
+        !path.startsWith('package/') ||
+        path.includes('..') ||
+        writable.has(path) ||
+        foundation.protected_paths.includes(packagePath)
+      )
+        fail(`Invalid or overlapping writable path: ${path}`);
+      writable.add(path);
+    }
+    if (!Array.isArray(packet.helper_signatures) || packet.helper_signatures.length === 0)
+      fail('packet.helper_signatures is invalid');
+    packet.helper_signatures.forEach((item) => text(item, 'packet.helper_signatures'));
+    text(packet.focused_check, 'packet.focused_check');
+  }
+  if (assigned.size !== operationKeys.size) fail('Work packets do not cover every capability');
+  const skill = record(packets.skill, 'work_packets.skill');
+  exactKeys(
+    skill,
+    ['id', 'kind', 'capabilities', 'writable_paths', 'excluded_paths', 'focused_check'],
+    'work_packets.skill',
+  );
+  if (skill.kind !== 'skill') fail('work_packets.skill.kind is invalid');
+  validateSortedUniqueStrings(
+    [...skill.capabilities].sort(),
+    'work_packets.skill.capabilities',
+    false,
+  );
+  if (
+    new Set(skill.capabilities).size !== operationKeys.size ||
+    skill.capabilities.some((key) => !operationKeys.has(key))
+  )
+    fail('Skill packet does not cover every capability');
+  validateSortedUniqueStrings(
+    [...skill.writable_paths].sort(),
+    'work_packets.skill.writable_paths',
+    false,
+  );
+  validateSortedUniqueStrings(
+    [...skill.excluded_paths].sort(),
+    'work_packets.skill.excluded_paths',
+    false,
+  );
+  if (!skill.excluded_paths.some((path) => path.includes('-cli-management/')))
+    fail('Skill packet does not protect the CLI-management Skill');
+  text(skill.focused_check, 'work_packets.skill.focused_check');
+  return bundle;
+}
+
+export async function createLeadInput(options) {
+  if (!options.skipValidation)
+    await validateSourceBrief(
+      options.requestPath,
+      options.briefPath,
+      options.inventoryPath,
+      options.expectedRequestHash,
+    );
+  const requestSource = await jsonBytes(options.requestPath, 'Run request');
+  const briefSource = await jsonBytes(options.briefPath, 'Source brief');
+  const inventorySource = await jsonBytes(options.inventoryPath, 'Operation inventory');
+  const starterSource = await jsonBytes(options.starterPath, 'Starter receipt');
+  const checksSource = await jsonBytes(options.starterChecksPath, 'Starter checks');
+  if (hash(starterSource.bytes) !== expectedHash(options.expectedStarterHash, 'Starter hash'))
+    fail('Starter receipt hash does not match');
+  if (
+    hash(checksSource.bytes) !==
+    expectedHash(options.expectedStarterChecksHash, 'Starter checks hash')
+  )
+    fail('Starter checks hash does not match');
+  if (checksSource.value.passed !== true) fail('Starter checks did not pass');
+
+  const request = requestSource.value;
+  const workspace = dirname(dirname(resolve(options.requestPath)));
+  const openapiSource = await jsonBytes(resolve(workspace, request.openapi), 'OpenAPI');
+  const profileSource = await jsonBytes(
+    resolve(workspace, request.customer_profile),
+    'Customer profile',
+  );
+  const profile = profileSource.value;
+  const profilePackage = record(profile.package, 'Customer profile package');
+  const profileApi = record(profile.api, 'Customer profile API');
+  const profileAuth = record(profileApi.auth, 'Customer profile auth');
+  const inventory = inventorySource.value;
+  const operations = Array.isArray(inventory.operations)
+    ? inventory.operations
+    : fail('Operation inventory has no operations');
+  const operationMap = new Map();
+  for (const value of operations) {
+    const item = record(value, 'Operation inventory item');
+    const key = `${text(item.method, 'operation.method').toUpperCase()} ${text(item.path, 'operation.path')}`;
+    if (operationMap.has(key)) fail(`Operation inventory is duplicated: ${key}`);
+    operationMap.set(key, item);
+  }
+  const briefCapabilities = Array.isArray(briefSource.value.capabilities)
+    ? briefSource.value.capabilities
+    : fail('Source brief capabilities are invalid');
+  const components = new Map();
+  const capabilities = briefCapabilities.map((value, index) => {
+    const capability = record(value, `Source brief capability ${index}`);
+    const operationRef = record(capability.operation, `Source brief capability ${index} operation`);
+    const operationKey = `${text(operationRef.method, 'operation.method').toUpperCase()} ${text(operationRef.path, 'operation.path')}`;
+    const operation = operationMap.get(operationKey);
+    if (!operation) fail(`Source brief operation is unavailable: ${operationKey}`);
+    const closure = referenceClosure(openapiSource.value, operation);
+    for (const [pointer, component] of closure) components.set(pointer, component);
+    return {
+      operation_key: operationKey,
+      effect: capability.effect,
+      business_purpose: capability.business_purpose,
+      proposed_command: capability.proposed_command,
+      context_evidence: capability.context_evidence,
+      requested_response_pattern: capability.response_pattern,
+      operation,
+      component_refs: [...closure.keys()].sort(),
+    };
+  });
+  const starter = starterSource.value;
+  const foundation = record(starter.foundation, 'Starter foundation');
+  const context = Array.isArray(request.context)
+    ? request.context
+    : fail('Run request context is invalid');
+  const preparedCapabilities = capabilities.map((capability) => ({
+    ...capability,
+    response_pattern: responsePattern(capability),
+  }));
+  const workPackets = createWorkPackets(capabilities, profilePackage.binary);
+  const bundle = {
+    schema_version: '2.0.0',
+    source_hashes: {
+      run_request: hash(requestSource.bytes),
+      openapi: request.openapi_hash,
+      operation_inventory: request.operation_inventory_hash,
+      customer_profile: request.customer_profile_hash,
+      source_brief: hash(briefSource.bytes),
+      starter_receipt: hash(starterSource.bytes),
+      starter_checks: hash(checksSource.bytes),
+      context: context.map((value) => ({ path: value.path, sha256: value.hash })),
+    },
+    customer: {
+      integration_id: profile.integration_id,
+      package_name: profilePackage.name,
+      binary: profilePackage.binary,
+      display_name: profilePackage.display_name,
+      base_url: profileApi.base_url,
+      auth_environment_variable: profileAuth.environment_variable,
+      login_prompt: profileAuth.login_prompt,
+    },
+    foundation: {
+      package_directory: starter.package_directory,
+      starter_verified: true,
+      protected_paths: [
+        ...Object.keys(foundation),
+        'capabilities.json',
+        'mock/routes.ts',
+        'src/commands.ts',
+      ].sort(),
+      prepared_hashes: {},
+    },
+    constraints: {
+      no_live_api_calls: true,
+      no_credentials: true,
+      offline_tests: true,
+      human_release_review_required: true,
+    },
+    components_by_pointer: Object.fromEntries(
+      [...components.entries()].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)),
+    ),
+    capabilities: preparedCapabilities.map((item) => {
+      const capability = { ...item };
+      delete capability.requested_response_pattern;
+      return capability;
+    }),
+    work_packets: workPackets,
+  };
+  bundle.foundation.prepared_hashes = await scaffoldPreparedWork(
+    resolve(workspace, bundle.foundation.package_directory),
+    bundle,
+  );
+  validateLeadInput(bundle);
+  const bytes = Buffer.from(`${JSON.stringify(bundle, null, 2)}\n`);
+  if (bytes.length > MAX_LEAD_INPUT_BYTES) fail('Lead input exceeds 20 MiB');
+  const leadInputHash = hash(bytes);
+  await writeFile(options.outputPath, bytes, { flag: 'wx', mode: 0o444 });
+  await chmod(options.outputPath, 0o444);
+  const contextDocuments = await businessContext(workspace, bundle.source_hashes.context);
+  const generatorInput = generatorInputBytes(bundle, leadInputHash, contextDocuments);
+  const generatorInputPath = join(dirname(options.outputPath), 'generator-input.json');
+  await writeFile(generatorInputPath, generatorInput, {
+    flag: 'wx',
+    mode: 0o444,
+  });
+  await chmod(generatorInputPath, 0o444);
+  return { sha256: leadInputHash, sizeBytes: bytes.length, capabilityCount: capabilities.length };
+}
+
+export async function verifyLeadInput(path, expected) {
+  const bytes = await readFile(path);
+  if (bytes.length > MAX_LEAD_INPUT_BYTES) fail('Lead input exceeds 20 MiB');
+  if (hash(bytes) !== expectedHash(expected, 'Expected lead input hash'))
+    fail('Lead input hash does not match');
+  const bundle = validateLeadInput(JSON.parse(bytes.toString('utf8')));
+  const workspace = dirname(dirname(resolve(path)));
+  const contextDocuments = await businessContext(workspace, bundle.source_hashes.context);
+  const expectedGeneratorInput = generatorInputBytes(bundle, hash(bytes), contextDocuments);
+  const actualGeneratorInput = await readFile(join(dirname(path), 'generator-input.json'));
+  if (!actualGeneratorInput.equals(expectedGeneratorInput)) fail('Generator input is invalid');
+  for (const [file, expectedFileHash] of Object.entries(bundle.foundation.prepared_hashes)) {
+    const actual = await readFile(resolve(workspace, bundle.foundation.package_directory, file));
+    if (hash(actual) !== expectedFileHash) fail(`Prepared foundation changed: ${file}`);
+  }
+  return hash(bytes);
+}
+
+if (
+  globalThis.__INTERMESH_BUNDLED__ !== true &&
+  process.argv[1] === new URL(import.meta.url).pathname
+) {
+  const [command, ...args] = process.argv.slice(2);
+  if (command === 'create') {
+    if (args.length !== 9)
+      fail('Expected request, brief, inventory, starter, checks, output and hashes');
+    const result = await createLeadInput({
+      requestPath: args[0],
+      briefPath: args[1],
+      inventoryPath: args[2],
+      starterPath: args[3],
+      starterChecksPath: args[4],
+      outputPath: args[5],
+      expectedRequestHash: args[6],
+      expectedStarterHash: args[7],
+      expectedStarterChecksHash: args[8],
+    });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+  } else if (command === 'verify') {
+    if (args.length !== 2) fail('Expected lead input path and hash');
+    process.stdout.write(`${await verifyLeadInput(args[0], args[1])}\n`);
+  } else fail('Expected create or verify');
+}

package/dist/generation/scripts/prepare-opencode.mjs

@@ -0,0 +1,33 @@
+import { execFile } from 'node:child_process';
+import { access, copyFile, mkdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+
+const execute = promisify(execFile);
+const bundledAssets = join(dirname(fileURLToPath(import.meta.url)), '..');
+
+export async function prepareOpenCodeDependencies(directories) {
+  const environment = { ...process.env };
+  delete environment.DEEPSEEK_API_KEY;
+  delete environment.OPENROUTER_API_KEY;
+  for (const directory of directories) {
+    const installed = await access(join(directory, 'node_modules')).then(
+      () => true,
+      () => false,
+    );
+    if (installed) continue;
+    await mkdir(directory, { recursive: true });
+    const seed = join(
+      process.env.INTERMESH_ASSETS_ROOT ?? bundledAssets,
+      'templates/opencode-bootstrap',
+    );
+    for (const file of ['package.json', 'package-lock.json'])
+      await copyFile(join(seed, file), join(directory, file));
+    await execute('npm', ['ci', '--ignore-scripts', '--no-audit', '--no-fund'], {
+      cwd: directory,
+      timeout: 120_000,
+      env: environment,
+    });
+  }
+}