@treeseed/sdk 0.1.1 → 0.3.0

package/dist/operations/services/git-workflow.d.ts

@@ -0,0 +1,49 @@
+export declare const STAGING_BRANCH = "staging";
+export declare const PRODUCTION_BRANCH = "main";
+export declare function gitWorkflowRoot(cwd?: any): string;
+export declare function assertCleanWorktree(cwd?: any): string;
+export declare function branchExists(repoDir: any, branchName: any): boolean;
+export declare function remoteBranchExists(repoDir: any, branchName: any): boolean;
+export declare function fetchOrigin(repoDir: any): void;
+export declare function ensureLocalBranchTracking(repoDir: any, branchName: any): void;
+export declare function checkoutBranch(repoDir: any, branchName: any): void;
+export declare function syncBranchWithOrigin(repoDir: any, branchName: any): void;
+export declare function createFeatureBranchFromStaging(cwd: any, branchName: any): {
+    repoDir: string;
+    baseBranch: string;
+    branchName: any;
+};
+export declare function pushBranch(repoDir: any, branchName: any, { setUpstream }?: {
+    setUpstream?: boolean | undefined;
+}): void;
+export declare function deleteLocalBranch(repoDir: any, branchName: any): void;
+export declare function deleteRemoteBranch(repoDir: any, branchName: any): boolean;
+export declare function mergeCurrentBranchIntoStaging(cwd: any, featureBranch: any): string;
+export declare function currentManagedBranch(cwd?: any): string;
+export declare function isTaskBranch(branchName: any): boolean;
+export declare function assertFeatureBranch(cwd?: any): string;
+export declare function listTaskBranches(repoDir: any): {
+    name: string;
+    head: string;
+    lastCommitDate: string;
+    lastCommitSubject: string;
+    local: boolean;
+    remote: boolean;
+    current: boolean;
+}[];
+export declare function taskTagSlug(branchName: any): string;
+export declare function createDeprecatedTaskTag(repoDir: any, branchName: any, message: any): {
+    tagName: string;
+    head: string;
+};
+export declare function waitForStagingAutomation(repoDir: any): {
+    status: string;
+    reason: string;
+    branch?: undefined;
+} | {
+    status: string;
+    branch: string;
+    reason?: undefined;
+};
+export declare function prepareReleaseBranches(cwd?: any): string;
+export declare function mergeStagingIntoMain(cwd?: any): string;

package/dist/operations/services/git-workflow.js

@@ -0,0 +1,218 @@
+import { run, workspaceRoot } from "./workspace-tools.js";
+import { currentBranch, gitStatusPorcelain, repoRoot } from "./workspace-save.js";
+const STAGING_BRANCH = "staging";
+const PRODUCTION_BRANCH = "main";
+const RESERVED_BRANCHES = /* @__PURE__ */ new Set([STAGING_BRANCH, PRODUCTION_BRANCH]);
+function runGit(args, { cwd, capture = false } = {}) {
+  return run("git", args, { cwd, capture });
+}
+function gitWorkflowRoot(cwd = workspaceRoot()) {
+  return repoRoot(cwd);
+}
+function assertCleanWorktree(cwd = workspaceRoot()) {
+  const root = gitWorkflowRoot(cwd);
+  if (gitStatusPorcelain(root).length > 0) {
+    throw new Error("Treeseed requires a clean git worktree before changing branches.");
+  }
+  return root;
+}
+function branchExists(repoDir, branchName) {
+  try {
+    runGit(["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`], { cwd: repoDir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function remoteBranchExists(repoDir, branchName) {
+  try {
+    const output = runGit(["ls-remote", "--heads", "origin", branchName], { cwd: repoDir, capture: true });
+    return output.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+function fetchOrigin(repoDir) {
+  runGit(["fetch", "origin"], { cwd: repoDir });
+}
+function ensureLocalBranchTracking(repoDir, branchName) {
+  if (branchExists(repoDir, branchName)) {
+    return;
+  }
+  if (remoteBranchExists(repoDir, branchName)) {
+    runGit(["checkout", "-b", branchName, `origin/${branchName}`], { cwd: repoDir });
+    return;
+  }
+  runGit(["checkout", "--orphan", branchName], { cwd: repoDir });
+}
+function checkoutBranch(repoDir, branchName) {
+  runGit(["checkout", branchName], { cwd: repoDir });
+}
+function syncBranchWithOrigin(repoDir, branchName) {
+  fetchOrigin(repoDir);
+  if (!branchExists(repoDir, branchName) && remoteBranchExists(repoDir, branchName)) {
+    runGit(["checkout", "-b", branchName, `origin/${branchName}`], { cwd: repoDir });
+  } else {
+    checkoutBranch(repoDir, branchName);
+  }
+  if (remoteBranchExists(repoDir, branchName)) {
+    runGit(["pull", "--rebase", "origin", branchName], { cwd: repoDir });
+  }
+}
+function createFeatureBranchFromStaging(cwd, branchName) {
+  const repoDir = assertCleanWorktree(cwd);
+  fetchOrigin(repoDir);
+  if (branchExists(repoDir, branchName) || remoteBranchExists(repoDir, branchName)) {
+    throw new Error(`Branch "${branchName}" already exists locally or on origin.`);
+  }
+  syncBranchWithOrigin(repoDir, STAGING_BRANCH);
+  runGit(["checkout", "-b", branchName], { cwd: repoDir });
+  return {
+    repoDir,
+    baseBranch: STAGING_BRANCH,
+    branchName
+  };
+}
+function pushBranch(repoDir, branchName, { setUpstream = false } = {}) {
+  const args = setUpstream ? ["push", "-u", "origin", branchName] : ["push", "origin", branchName];
+  runGit(args, { cwd: repoDir });
+}
+function deleteLocalBranch(repoDir, branchName) {
+  if (!branchExists(repoDir, branchName)) {
+    return;
+  }
+  runGit(["branch", "-D", branchName], { cwd: repoDir });
+}
+function deleteRemoteBranch(repoDir, branchName) {
+  if (!remoteBranchExists(repoDir, branchName)) {
+    return false;
+  }
+  runGit(["push", "origin", "--delete", branchName], { cwd: repoDir });
+  return true;
+}
+function mergeCurrentBranchIntoStaging(cwd, featureBranch) {
+  const repoDir = assertCleanWorktree(cwd);
+  fetchOrigin(repoDir);
+  syncBranchWithOrigin(repoDir, STAGING_BRANCH);
+  runGit(["merge", "--no-ff", featureBranch, "-m", `merge: ${featureBranch} -> ${STAGING_BRANCH}`], { cwd: repoDir });
+  pushBranch(repoDir, STAGING_BRANCH);
+  return repoDir;
+}
+function currentManagedBranch(cwd = workspaceRoot()) {
+  return currentBranch(gitWorkflowRoot(cwd));
+}
+function isTaskBranch(branchName) {
+  return Boolean(branchName) && !RESERVED_BRANCHES.has(branchName) && !branchName.startsWith("deprecated/");
+}
+function assertFeatureBranch(cwd = workspaceRoot()) {
+  const branchName = currentManagedBranch(cwd);
+  if (!branchName) {
+    throw new Error("Unable to determine the current git branch.");
+  }
+  if (!isTaskBranch(branchName)) {
+    throw new Error(`Treeseed task commands only work on task branches. Current branch: ${branchName}`);
+  }
+  return branchName;
+}
+function gitLines(repoDir, args) {
+  return runGit(args, { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
+}
+function listTaskBranches(repoDir) {
+  try {
+    runGit(["fetch", "origin"], { cwd: repoDir, capture: true });
+  } catch {
+  }
+  const local = new Set(
+    gitLines(repoDir, ["for-each-ref", "--format=%(refname:short)", "refs/heads"]).filter(isTaskBranch)
+  );
+  const remote = new Set(
+    gitLines(repoDir, ["for-each-ref", "--format=%(refname:short)", "refs/remotes/origin"]).map((branchName) => branchName.replace(/^origin\//, "")).filter(isTaskBranch)
+  );
+  const current = currentBranch(repoDir);
+  const branches = [.../* @__PURE__ */ new Set([...local, ...remote])].sort((left, right) => left.localeCompare(right));
+  return branches.map((branchName) => {
+    const ref = local.has(branchName) ? branchName : `origin/${branchName}`;
+    return {
+      name: branchName,
+      head: runGit(["rev-parse", ref], { cwd: repoDir, capture: true }).trim(),
+      lastCommitDate: runGit(["log", "-1", "--format=%cI", ref], { cwd: repoDir, capture: true }).trim(),
+      lastCommitSubject: runGit(["log", "-1", "--format=%s", ref], { cwd: repoDir, capture: true }).trim(),
+      local: local.has(branchName),
+      remote: remote.has(branchName),
+      current: branchName === current
+    };
+  });
+}
+function taskTagSlug(branchName) {
+  return String(branchName).trim().replaceAll("\\", "/").replace(/[^A-Za-z0-9._/-]+/g, "-").replace(/\/+/g, "-").replace(/^-+|-+$/g, "") || "task";
+}
+function createDeprecatedTaskTag(repoDir, branchName, message) {
+  const head = runGit(["rev-parse", branchName], { cwd: repoDir, capture: true }).trim();
+  const shortSha = head.slice(0, 12);
+  const tagName = `deprecated/${taskTagSlug(branchName)}/${shortSha}`;
+  runGit(["tag", "-a", tagName, head, "-m", message], { cwd: repoDir });
+  runGit(["push", "origin", tagName], { cwd: repoDir, capture: true });
+  return { tagName, head };
+}
+function waitForStagingAutomation(repoDir) {
+  if (process.env.TREESEED_STAGE_WAIT_MODE === "skip" || process.env.TREESEED_GITHUB_AUTOMATION_MODE === "stub") {
+    return { status: "skipped", reason: "stubbed" };
+  }
+  try {
+    run("gh", ["run", "watch", "--branch", STAGING_BRANCH, "--exit-status"], { cwd: repoDir });
+    return { status: "completed", branch: STAGING_BRANCH };
+  } catch (error) {
+    throw new Error([
+      "Treeseed stage could not confirm the staging deploy/checks completed.",
+      error instanceof Error ? error.message : String(error),
+      "Inspect GitHub Actions with `gh run list --branch staging` or your deployment provider logs."
+    ].join("\n"));
+  }
+}
+function prepareReleaseBranches(cwd = workspaceRoot()) {
+  const repoDir = assertCleanWorktree(cwd);
+  fetchOrigin(repoDir);
+  syncBranchWithOrigin(repoDir, STAGING_BRANCH);
+  if (remoteBranchExists(repoDir, PRODUCTION_BRANCH) || branchExists(repoDir, PRODUCTION_BRANCH)) {
+    syncBranchWithOrigin(repoDir, PRODUCTION_BRANCH);
+    syncBranchWithOrigin(repoDir, STAGING_BRANCH);
+  }
+  return repoDir;
+}
+function mergeStagingIntoMain(cwd = workspaceRoot()) {
+  const repoDir = prepareReleaseBranches(cwd);
+  checkoutBranch(repoDir, PRODUCTION_BRANCH);
+  if (remoteBranchExists(repoDir, PRODUCTION_BRANCH)) {
+    runGit(["pull", "--rebase", "origin", PRODUCTION_BRANCH], { cwd: repoDir });
+  }
+  runGit(["merge", "--no-ff", STAGING_BRANCH, "-m", `release: ${STAGING_BRANCH} -> ${PRODUCTION_BRANCH}`], { cwd: repoDir });
+  pushBranch(repoDir, STAGING_BRANCH);
+  pushBranch(repoDir, PRODUCTION_BRANCH);
+  return repoDir;
+}
+export {
+  PRODUCTION_BRANCH,
+  STAGING_BRANCH,
+  assertCleanWorktree,
+  assertFeatureBranch,
+  branchExists,
+  checkoutBranch,
+  createDeprecatedTaskTag,
+  createFeatureBranchFromStaging,
+  currentManagedBranch,
+  deleteLocalBranch,
+  deleteRemoteBranch,
+  ensureLocalBranchTracking,
+  fetchOrigin,
+  gitWorkflowRoot,
+  isTaskBranch,
+  listTaskBranches,
+  mergeCurrentBranchIntoStaging,
+  mergeStagingIntoMain,
+  prepareReleaseBranches,
+  pushBranch,
+  remoteBranchExists,
+  syncBranchWithOrigin,
+  taskTagSlug,
+  waitForStagingAutomation
+};

package/dist/operations/services/github-automation.d.ts

@@ -0,0 +1,156 @@
+export declare function getGitHubAutomationMode(): "stub" | "real";
+export declare function parseGitHubRepositoryFromRemote(remoteUrl: any): string | null;
+export declare function resolveGitHubRepositorySlug(tenantRoot: any): string;
+export declare function maybeResolveGitHubRepositorySlug(tenantRoot: any): string | null;
+export declare function resolveGitRepositoryRoot(tenantRoot: any): any;
+export declare function requiredGitHubEnvironment(tenantRoot: any, { scope, purpose }?: {
+    scope?: string | undefined;
+    purpose?: string | undefined;
+}): {
+    secrets: string[];
+    variables: string[];
+};
+export declare function requiredGitHubSecrets(tenantRoot: any): string[];
+export declare function renderDeployWorkflow({ workingDirectory }: {
+    workingDirectory: any;
+}): string;
+export declare function ensureDeployWorkflow(tenantRoot: any): {
+    workflowPath: string;
+    changed: boolean;
+    workingDirectory: string;
+    mode: string;
+} | {
+    workflowPath: string;
+    changed: boolean;
+    workingDirectory: string;
+    mode?: undefined;
+};
+export declare function listGitHubSecretNames(repository: any, tenantRoot: any): Set<unknown>;
+export declare function listGitHubVariableNames(repository: any, tenantRoot: any): Set<unknown>;
+export declare function formatMissingSecretsReport(repository: any, missingSecrets: any, reason?: string): string;
+export declare function ensureGitHubSecrets(tenantRoot: any, { dryRun }?: {
+    dryRun?: boolean | undefined;
+}): {
+    existing: never[];
+    created: never[];
+} | {
+    existing: never[];
+    created: never[];
+} | {
+    existing: string[];
+    created: string[];
+};
+export declare function ensureGitHubEnvironment(tenantRoot: any, { dryRun, scope, purpose }?: {
+    dryRun?: boolean | undefined;
+    scope?: string | undefined;
+    purpose?: string | undefined;
+}): {
+    repository: string | null;
+    secrets: {
+        existing: never[];
+        created: never[];
+    };
+    variables: {
+        existing: never[];
+        created: never[];
+    };
+    skipped: string;
+    mode: string;
+} | {
+    repository: null;
+    secrets: {
+        existing: never[];
+        created: never[];
+    };
+    variables: {
+        existing: never[];
+        created: never[];
+    };
+    skipped: string;
+    mode?: undefined;
+} | {
+    repository: string;
+    secrets: {
+        existing: string[];
+        created: string[];
+    };
+    variables: {
+        existing: string[];
+        created: string[];
+    };
+    skipped?: undefined;
+    mode?: undefined;
+};
+export declare function ensureGitHubDeployAutomation(tenantRoot: any, { dryRun }?: {
+    dryRun?: boolean | undefined;
+}): {
+    mode: string;
+    workflow: {
+        workflowPath: string;
+        changed: boolean;
+        workingDirectory: string;
+        mode: string;
+    } | {
+        workflowPath: string;
+        changed: boolean;
+        workingDirectory: string;
+        mode?: undefined;
+    };
+    secrets: {
+        existing: never[];
+        created: never[];
+    } | {
+        existing: never[];
+        created: never[];
+    } | {
+        existing: string[];
+        created: string[];
+    };
+    variables: {
+        existing: never[];
+        created: never[];
+    } | {
+        existing: never[];
+        created: never[];
+    } | {
+        existing: string[];
+        created: string[];
+    };
+    environment: {
+        repository: string | null;
+        secrets: {
+            existing: never[];
+            created: never[];
+        };
+        variables: {
+            existing: never[];
+            created: never[];
+        };
+        skipped: string;
+        mode: string;
+    } | {
+        repository: null;
+        secrets: {
+            existing: never[];
+            created: never[];
+        };
+        variables: {
+            existing: never[];
+            created: never[];
+        };
+        skipped: string;
+        mode?: undefined;
+    } | {
+        repository: string;
+        secrets: {
+            existing: string[];
+            created: string[];
+        };
+        variables: {
+            existing: string[];
+            created: string[];
+        };
+        skipped?: undefined;
+        mode?: undefined;
+    };
+};

package/dist/operations/services/github-automation.js

@@ -0,0 +1,256 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { resolveTreeseedEnvironmentRegistry } from "../../platform/environment.js";
+import { corePackageRoot, loadCliDeployConfig } from "./runtime-tools.js";
+function envOrNull(key) {
+  const value = process.env[key];
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+function getGitHubAutomationMode() {
+  return process.env.TREESEED_GITHUB_AUTOMATION_MODE === "stub" ? "stub" : "real";
+}
+function isGitHubAutomationStubbed() {
+  return getGitHubAutomationMode() === "stub";
+}
+function parseGitHubRepositoryFromRemote(remoteUrl) {
+  if (!remoteUrl) {
+    return null;
+  }
+  const sshMatch = remoteUrl.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/);
+  if (sshMatch) {
+    return `${sshMatch[1]}/${sshMatch[2]}`;
+  }
+  const httpsMatch = remoteUrl.match(/^https:\/\/github\.com\/([^/]+)\/(.+?)(?:\.git)?$/);
+  if (httpsMatch) {
+    return `${httpsMatch[1]}/${httpsMatch[2]}`;
+  }
+  return null;
+}
+function runGit(args, { cwd, allowFailure = false, capture = true } = {}) {
+  const result = spawnSync("git", args, {
+    cwd,
+    stdio: capture ? "pipe" : "inherit",
+    encoding: "utf8"
+  });
+  if (result.status !== 0 && !allowFailure) {
+    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `git ${args.join(" ")} failed`);
+  }
+  return result;
+}
+function runGh(args, { cwd, allowFailure = false, capture = true, input } = {}) {
+  const result = spawnSync("gh", args, {
+    cwd,
+    stdio: capture || input !== void 0 ? ["pipe", "pipe", "pipe"] : "inherit",
+    encoding: "utf8",
+    input
+  });
+  if (result.error && result.error.code === "ENOENT") {
+    throw new Error("GitHub CLI `gh` is required for Treeseed GitHub automation.");
+  }
+  if (result.status !== 0 && !allowFailure) {
+    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `gh ${args.join(" ")} failed`);
+  }
+  return result;
+}
+function resolveGitHubRepositorySlug(tenantRoot) {
+  const remoteResult = runGit(["remote", "get-url", "origin"], { cwd: tenantRoot });
+  const remoteUrl = remoteResult.stdout?.trim() ?? "";
+  const repository = parseGitHubRepositoryFromRemote(remoteUrl);
+  if (!repository) {
+    throw new Error(`Unable to determine GitHub repository from origin remote "${remoteUrl}".`);
+  }
+  return repository;
+}
+function maybeResolveGitHubRepositorySlug(tenantRoot) {
+  try {
+    return resolveGitHubRepositorySlug(tenantRoot);
+  } catch {
+    return null;
+  }
+}
+function resolveGitRepositoryRoot(tenantRoot) {
+  const result = runGit(["rev-parse", "--show-toplevel"], { cwd: tenantRoot, allowFailure: true });
+  return result.status === 0 ? result.stdout.trim() : tenantRoot;
+}
+function requiredGitHubEnvironment(tenantRoot, { scope = "prod", purpose = "save" } = {}) {
+  const deployConfig = loadCliDeployConfig(tenantRoot);
+  const registry = resolveTreeseedEnvironmentRegistry({ deployConfig });
+  const relevant = registry.entries.filter(
+    (entry) => entry.scopes.includes(scope) && entry.purposes.includes(purpose) && (!entry.isRelevant || entry.isRelevant(registry.context, scope, purpose))
+  );
+  return {
+    secrets: [...new Set(relevant.filter((entry) => entry.targets.includes("github-secret")).map((entry) => entry.id))],
+    variables: [...new Set(relevant.filter((entry) => entry.targets.includes("github-variable")).map((entry) => entry.id))]
+  };
+}
+function requiredGitHubSecrets(tenantRoot) {
+  return requiredGitHubEnvironment(tenantRoot).secrets;
+}
+function renderDeployWorkflow({ workingDirectory }) {
+  const normalizedWorkingDirectory = workingDirectory && workingDirectory !== "." ? workingDirectory : ".";
+  const workingDirectoryLine = normalizedWorkingDirectory === "." ? "" : `    defaults:
+      run:
+        working-directory: ${normalizedWorkingDirectory}
+`;
+  const templatePath = resolve(corePackageRoot, "templates", "github", "deploy.workflow.yml");
+  const template = readFileSync(templatePath, "utf8");
+  return template.replace("__WORKING_DIRECTORY_BLOCK__", workingDirectoryLine).replace(
+    "__CACHE_DEPENDENCY_PATH__",
+    normalizedWorkingDirectory === "." ? "package-lock.json" : `${normalizedWorkingDirectory}/package-lock.json`
+  );
+}
+function ensureDeployWorkflow(tenantRoot) {
+  if (isGitHubAutomationStubbed()) {
+    return {
+      workflowPath: resolve(tenantRoot, ".github", "workflows", "deploy.yml"),
+      changed: false,
+      workingDirectory: ".",
+      mode: "stub"
+    };
+  }
+  const repositoryRoot = resolveGitRepositoryRoot(tenantRoot);
+  const workflowPath = resolve(tenantRoot, ".github", "workflows", "deploy.yml");
+  const workingDirectory = relative(repositoryRoot, tenantRoot).replaceAll("\\", "/") || ".";
+  const expected = renderDeployWorkflow({ workingDirectory });
+  const current = existsSync(workflowPath) ? readFileSync(workflowPath, "utf8") : null;
+  if (current === expected) {
+    return { workflowPath, changed: false, workingDirectory };
+  }
+  mkdirSync(dirname(workflowPath), { recursive: true });
+  writeFileSync(workflowPath, expected, "utf8");
+  return { workflowPath, changed: true, workingDirectory };
+}
+function listGitHubSecretNames(repository, tenantRoot) {
+  const result = runGh(["secret", "list", "--repo", repository, "--json", "name"], {
+    cwd: tenantRoot
+  });
+  return new Set(
+    JSON.parse(result.stdout || "[]").map((entry) => entry?.name).filter((value) => typeof value === "string" && value.length > 0)
+  );
+}
+function listGitHubVariableNames(repository, tenantRoot) {
+  const result = runGh(["variable", "list", "--repo", repository, "--json", "name"], {
+    cwd: tenantRoot
+  });
+  return new Set(
+    JSON.parse(result.stdout || "[]").map((entry) => entry?.name).filter((value) => typeof value === "string" && value.length > 0)
+  );
+}
+function formatMissingSecretsReport(repository, missingSecrets, reason = "missing_local_env") {
+  const lines = [
+    "Treeseed GitHub secret sync failed.",
+    `Repository: ${repository}`,
+    `Reason: ${reason}`,
+    "Missing secrets:"
+  ];
+  for (const secret of missingSecrets) {
+    lines.push(`- ${secret.name}: localEnv=${secret.localEnvPresent ? "present" : "missing"} remote=${secret.remotePresent ? "present" : "missing"}`);
+  }
+  return lines.join("\n");
+}
+function ensureGitHubSecrets(tenantRoot, { dryRun = false } = {}) {
+  return ensureGitHubEnvironment(tenantRoot, { dryRun }).secrets;
+}
+function ensureGitHubEnvironment(tenantRoot, { dryRun = false, scope = "prod", purpose = "save" } = {}) {
+  if (isGitHubAutomationStubbed()) {
+    return {
+      repository: maybeResolveGitHubRepositorySlug(tenantRoot),
+      secrets: {
+        existing: [],
+        created: []
+      },
+      variables: {
+        existing: [],
+        created: []
+      },
+      skipped: "stubbed",
+      mode: "stub"
+    };
+  }
+  const repository = maybeResolveGitHubRepositorySlug(tenantRoot);
+  if (!repository) {
+    if (dryRun) {
+      return {
+        repository: null,
+        secrets: { existing: [], created: [] },
+        variables: { existing: [], created: [] },
+        skipped: "missing_repository"
+      };
+    }
+    throw new Error("Unable to determine GitHub repository from the current tenant. Configure an origin remote before syncing GitHub secrets.");
+  }
+  const required = requiredGitHubEnvironment(tenantRoot, { scope, purpose });
+  const requiredSecrets = required.secrets;
+  const requiredVariables = required.variables;
+  const existingSecrets = listGitHubSecretNames(repository, tenantRoot);
+  const existingVariables = listGitHubVariableNames(repository, tenantRoot);
+  const missingRemote = requiredSecrets.filter((name) => !existingSecrets.has(name));
+  const missingRemoteVariables = requiredVariables.filter((name) => !existingVariables.has(name));
+  const missingLocal = missingRemote.filter((name) => !envOrNull(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
+  const missingLocalVariables = missingRemoteVariables.filter((name) => !envOrNull(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
+  if (missingLocal.length > 0 || missingLocalVariables.length > 0) {
+    throw new Error(formatMissingSecretsReport(repository, [...missingLocal, ...missingLocalVariables]));
+  }
+  const createdSecrets = [];
+  for (const name of missingRemote) {
+    if (dryRun) {
+      createdSecrets.push(name);
+      continue;
+    }
+    runGh(["secret", "set", name, "--repo", repository, "--body", envOrNull(name) ?? ""], {
+      cwd: tenantRoot
+    });
+    createdSecrets.push(name);
+  }
+  const createdVariables = [];
+  for (const name of missingRemoteVariables) {
+    if (dryRun) {
+      createdVariables.push(name);
+      continue;
+    }
+    runGh(["variable", "set", name, "--repo", repository, "--body", envOrNull(name) ?? ""], {
+      cwd: tenantRoot
+    });
+    createdVariables.push(name);
+  }
+  return {
+    repository,
+    secrets: {
+      existing: requiredSecrets.filter((name) => existingSecrets.has(name)),
+      created: createdSecrets
+    },
+    variables: {
+      existing: requiredVariables.filter((name) => existingVariables.has(name)),
+      created: createdVariables
+    }
+  };
+}
+function ensureGitHubDeployAutomation(tenantRoot, { dryRun = false } = {}) {
+  const workflow = ensureDeployWorkflow(tenantRoot);
+  const environment = ensureGitHubEnvironment(tenantRoot, { dryRun });
+  return {
+    mode: getGitHubAutomationMode(),
+    workflow,
+    secrets: environment.secrets,
+    variables: environment.variables,
+    environment
+  };
+}
+export {
+  ensureDeployWorkflow,
+  ensureGitHubDeployAutomation,
+  ensureGitHubEnvironment,
+  ensureGitHubSecrets,
+  formatMissingSecretsReport,
+  getGitHubAutomationMode,
+  listGitHubSecretNames,
+  listGitHubVariableNames,
+  maybeResolveGitHubRepositorySlug,
+  parseGitHubRepositoryFromRemote,
+  renderDeployWorkflow,
+  requiredGitHubEnvironment,
+  requiredGitHubSecrets,
+  resolveGitHubRepositorySlug,
+  resolveGitRepositoryRoot
+};

package/dist/operations/services/local-dev.d.ts

@@ -0,0 +1,9 @@
+export declare function runStep(command: any, args: any, options?: {}): void;
+export declare function runNodeScript(scriptRelativePath: any, args?: never[], options?: {}): void;
+export declare function spawnProcess(command: any, args: any, options?: {}): import("child_process").ChildProcessWithoutNullStreams;
+export declare function syncDevVars(overrides?: {}): void;
+export declare function runLocalD1Migration(persistTo: any): void;
+export declare function prepareCloudflareLocalRuntime({ envOverrides, persistTo, outDir }?: {
+    envOverrides?: {} | undefined;
+}): void;
+export declare function startWranglerDev(args?: never[], options?: {}): import("child_process").ChildProcessWithoutNullStreams;