@treeseed/sdk 0.10.24 → 0.10.26

package/dist/template-launch-requirements.js

@@ -0,0 +1,759 @@
+import {
+  PROJECT_ENVIRONMENT_NAMES,
+  PROJECT_LAUNCH_REQUIREMENT_KINDS,
+  TEMPLATE_CONFIG_MERGE_STRATEGIES,
+  TEMPLATE_CONFIG_WRITE_TARGETS,
+  TEMPLATE_CONFIG_WRITE_WHEN,
+  TEMPLATE_HOST_REQUIREMENT_TYPES,
+  TEMPLATE_RESOURCE_REQUIREMENT_TYPES,
+  TEMPLATE_SECRET_SENSITIVITIES,
+  TEMPLATE_SECRET_SOURCES,
+  TEMPLATE_SECRET_TARGETS
+} from "./sdk-types.js";
+function expectRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object.`);
+  }
+  return value;
+}
+function optionalRecord(value, label) {
+  if (value === void 0 || value === null) return void 0;
+  return expectRecord(value, label);
+}
+function expectString(value, label) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  return value.trim();
+}
+function optionalString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function expectBoolean(value, label) {
+  if (typeof value !== "boolean") {
+    throw new Error(`${label} must be a boolean.`);
+  }
+  return value;
+}
+function optionalStringArray(value, label) {
+  if (value === void 0 || value === null) return void 0;
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value.map((entry, index) => expectString(entry, `${label}[${index}]`));
+}
+function optionalRecordOfStrings(value, label) {
+  if (value === void 0 || value === null) return void 0;
+  const record = expectRecord(value, label);
+  const normalized = {};
+  for (const [key, entry] of Object.entries(record)) {
+    normalized[key] = expectString(entry, `${label}.${key}`);
+  }
+  return normalized;
+}
+function expectEnum(value, allowed, label) {
+  const text = expectString(value, label);
+  if (!allowed.includes(text)) {
+    throw new Error(`${label} uses unsupported value "${text}".`);
+  }
+  return text;
+}
+function optionalEnum(value, allowed, label) {
+  if (value === void 0 || value === null || value === "") return void 0;
+  return expectEnum(value, allowed, label);
+}
+function expectArray(value, label) {
+  if (value === void 0 || value === null) return [];
+  if (!Array.isArray(value)) throw new Error(`${label} must be an array.`);
+  return value;
+}
+function normalizeBoolean(value) {
+  return value === void 0 || value === null ? false : expectBoolean(value, "required");
+}
+function validateRequirementKey(key, label) {
+  if (!/^[A-Za-z][A-Za-z0-9_-]*$/u.test(key)) {
+    throw new Error(`${label} must start with a letter and contain only letters, numbers, underscores, or hyphens.`);
+  }
+  return key;
+}
+function validateConfigWritePath(path, label) {
+  const segments = path.split(".");
+  if (segments.some((segment) => !segment || segment === "..")) {
+    throw new Error(`${label} must be a safe dot path.`);
+  }
+  for (const segment of segments) {
+    if (!/^[A-Za-z0-9_-]+$/u.test(segment)) {
+      throw new Error(`${label} contains unsafe segment "${segment}".`);
+    }
+    if (segment === "__proto__" || segment === "prototype" || segment === "constructor") {
+      throw new Error(`${label} contains forbidden segment "${segment}".`);
+    }
+  }
+  return path;
+}
+function normalizeConfigWrite(value, label) {
+  const record = expectRecord(value, label);
+  return {
+    target: expectEnum(record.target, TEMPLATE_CONFIG_WRITE_TARGETS, `${label}.target`),
+    path: validateConfigWritePath(expectString(record.path, `${label}.path`), `${label}.path`),
+    valueFrom: expectString(record.valueFrom, `${label}.valueFrom`),
+    writeWhen: optionalEnum(record.writeWhen, TEMPLATE_CONFIG_WRITE_WHEN, `${label}.writeWhen`),
+    mergeStrategy: optionalEnum(record.mergeStrategy, TEMPLATE_CONFIG_MERGE_STRATEGIES, `${label}.mergeStrategy`)
+  };
+}
+function normalizeEnvironmentWrite(value, label) {
+  const record = expectRecord(value, label);
+  return {
+    env: expectString(record.env, `${label}.env`),
+    valueFrom: expectString(record.valueFrom, `${label}.valueFrom`),
+    targets: optionalStringArray(record.targets, `${label}.targets`)?.map((target, index) => expectEnum(target, TEMPLATE_SECRET_TARGETS, `${label}.targets[${index}]`)),
+    scopes: optionalStringArray(record.scopes, `${label}.scopes`)?.map((scope, index) => expectEnum(scope, PROJECT_ENVIRONMENT_NAMES, `${label}.scopes[${index}]`)),
+    sensitivity: optionalEnum(record.sensitivity, TEMPLATE_SECRET_SENSITIVITIES, `${label}.sensitivity`)
+  };
+}
+function normalizeHostRequirement(value, index) {
+  const label = `launchRequirements.hosts[${index}]`;
+  const record = expectRecord(value, label);
+  const kind = record.kind === void 0 ? "host" : expectString(record.kind, `${label}.kind`);
+  if (kind !== "host") throw new Error(`${label}.kind must be "host".`);
+  return {
+    kind: "host",
+    key: validateRequirementKey(expectString(record.key, `${label}.key`), `${label}.key`),
+    type: expectEnum(record.type, TEMPLATE_HOST_REQUIREMENT_TYPES, `${label}.type`),
+    required: normalizeBoolean(record.required),
+    compatibleProviders: optionalStringArray(record.compatibleProviders, `${label}.compatibleProviders`),
+    displayName: expectString(record.displayName, `${label}.displayName`),
+    purpose: expectString(record.purpose, `${label}.purpose`),
+    defaultSelection: optionalEnum(record.defaultSelection, ["team-default", "managed", "none"], `${label}.defaultSelection`),
+    configWrites: expectArray(record.configWrites, `${label}.configWrites`).map((entry, writeIndex) => normalizeConfigWrite(entry, `${label}.configWrites[${writeIndex}]`)),
+    environmentWrites: expectArray(record.environmentWrites, `${label}.environmentWrites`).map((entry, writeIndex) => normalizeEnvironmentWrite(entry, `${label}.environmentWrites[${writeIndex}]`))
+  };
+}
+function normalizeResourceRequirement(value, index) {
+  const label = `launchRequirements.resources[${index}]`;
+  const record = expectRecord(value, label);
+  const kind = record.kind === void 0 ? "resource" : expectString(record.kind, `${label}.kind`);
+  if (kind !== "resource") throw new Error(`${label}.kind must be "resource".`);
+  return {
+    kind: "resource",
+    key: validateRequirementKey(expectString(record.key, `${label}.key`), `${label}.key`),
+    type: expectEnum(record.type, TEMPLATE_RESOURCE_REQUIREMENT_TYPES, `${label}.type`),
+    required: normalizeBoolean(record.required),
+    compatibleProviders: optionalStringArray(record.compatibleProviders, `${label}.compatibleProviders`),
+    displayName: expectString(record.displayName, `${label}.displayName`),
+    purpose: expectString(record.purpose, `${label}.purpose`),
+    configWrites: expectArray(record.configWrites, `${label}.configWrites`).map((entry, writeIndex) => normalizeConfigWrite(entry, `${label}.configWrites[${writeIndex}]`)),
+    environmentWrites: expectArray(record.environmentWrites, `${label}.environmentWrites`).map((entry, writeIndex) => normalizeEnvironmentWrite(entry, `${label}.environmentWrites[${writeIndex}]`))
+  };
+}
+function normalizeSecretRequirement(value, index) {
+  const label = `launchRequirements.secrets[${index}]`;
+  const record = expectRecord(value, label);
+  const kind = record.kind === void 0 ? "secret" : expectString(record.kind, `${label}.kind`);
+  if (kind !== "secret") throw new Error(`${label}.kind must be "secret".`);
+  return {
+    kind: "secret",
+    key: validateRequirementKey(expectString(record.key, `${label}.key`), `${label}.key`),
+    env: expectString(record.env, `${label}.env`),
+    required: normalizeBoolean(record.required),
+    sensitivity: expectEnum(record.sensitivity, TEMPLATE_SECRET_SENSITIVITIES, `${label}.sensitivity`),
+    targets: expectArray(record.targets, `${label}.targets`).map((target, targetIndex) => expectEnum(target, TEMPLATE_SECRET_TARGETS, `${label}.targets[${targetIndex}]`)),
+    source: expectEnum(record.source, TEMPLATE_SECRET_SOURCES, `${label}.source`)
+  };
+}
+function normalizeTemplateLaunchRequirements(value, label = "launchRequirements") {
+  if (value === void 0 || value === null) return void 0;
+  const record = expectRecord(value, label);
+  const version = record.version === void 0 || record.version === null ? void 0 : Number(record.version);
+  if (version !== void 0 && (!Number.isInteger(version) || version < 1)) {
+    throw new Error(`${label}.version must be a positive integer.`);
+  }
+  return {
+    version,
+    hosts: expectArray(record.hosts, `${label}.hosts`).map(normalizeHostRequirement),
+    resources: expectArray(record.resources, `${label}.resources`).map(normalizeResourceRequirement),
+    secrets: expectArray(record.secrets, `${label}.secrets`).map(normalizeSecretRequirement)
+  };
+}
+function validateTemplateLaunchRequirements(value, label = "launchRequirements") {
+  normalizeTemplateLaunchRequirements(value, label);
+}
+function normalizeEnvironmentScopes(value, label) {
+  return optionalStringArray(value, label)?.map((scope, index) => expectEnum(scope, PROJECT_ENVIRONMENT_NAMES, `${label}[${index}]`));
+}
+function normalizeBinding(value, key) {
+  const label = `hostBindings.${key}`;
+  const record = expectRecord(value, label);
+  const requirementKind = optionalEnum(record.requirementKind ?? record.kind, PROJECT_LAUNCH_REQUIREMENT_KINDS, `${label}.requirementKind`);
+  const normalized = {
+    requirementKey: validateRequirementKey(optionalString(record.requirementKey) ?? key, `${label}.requirementKey`),
+    requirementKind: requirementKind ?? "host",
+    type: expectString(record.type, `${label}.type`),
+    provider: expectString(record.provider, `${label}.provider`),
+    hostId: optionalString(record.hostId) ?? null,
+    managedHostKey: optionalString(record.managedHostKey) ?? null,
+    mode: optionalString(record.mode) ?? null,
+    displayName: optionalString(record.displayName),
+    environmentScopes: normalizeEnvironmentScopes(record.environmentScopes, `${label}.environmentScopes`),
+    configValues: optionalRecord(record.configValues, `${label}.configValues`),
+    environmentValues: optionalRecordOfStrings(record.environmentValues, `${label}.environmentValues`),
+    secretRefs: optionalRecordOfStrings(record.secretRefs, `${label}.secretRefs`),
+    selectedBy: optionalEnum(record.selectedBy, ["user", "team-default", "managed-default", "template-default"], `${label}.selectedBy`)
+  };
+  return normalized;
+}
+function defaultScopes(input) {
+  return normalizeEnvironmentScopes(input.targetEnvironments, "targetEnvironments") ?? ["staging", "prod"];
+}
+function deriveLegacyBindings(input) {
+  const intent = optionalRecord(input.intent, "intent");
+  const repository = optionalRecord(intent?.repository, "intent.repository");
+  const bindings = {};
+  const scopes = defaultScopes(input);
+  const repositoryHostId = optionalString(repository?.hostId) ?? optionalString(input.repositoryHostId) ?? "platform:github:hosted-hubs";
+  bindings.sourceRepository = {
+    requirementKey: "sourceRepository",
+    requirementKind: "host",
+    type: "repository",
+    provider: "github",
+    hostId: repositoryHostId,
+    mode: repositoryHostId.startsWith("platform:") ? "treeseed_managed" : void 0,
+    environmentScopes: scopes,
+    selectedBy: repositoryHostId.startsWith("platform:") ? "managed-default" : "user"
+  };
+  const cloudflareHostMode = optionalString(input.cloudflareHostMode);
+  const cloudflareHostId = optionalString(input.cloudflareHostId);
+  if (cloudflareHostMode || cloudflareHostId) {
+    bindings.publicWeb = {
+      requirementKey: "publicWeb",
+      requirementKind: "host",
+      type: "web",
+      provider: "cloudflare",
+      hostId: cloudflareHostMode === "team_owned" ? cloudflareHostId ?? null : null,
+      managedHostKey: cloudflareHostMode === "treeseed_managed" ? "treeseed-managed-cloudflare" : null,
+      mode: cloudflareHostMode ?? null,
+      environmentScopes: scopes,
+      selectedBy: cloudflareHostMode === "treeseed_managed" ? "managed-default" : "user"
+    };
+  }
+  const emailHostMode = optionalString(input.emailHostMode);
+  const emailHostId = optionalString(input.emailHostId);
+  if (emailHostMode || emailHostId) {
+    bindings.transactionalEmail = {
+      requirementKey: "transactionalEmail",
+      requirementKind: "host",
+      type: "email",
+      provider: "smtp",
+      hostId: emailHostMode === "team_owned" ? emailHostId ?? null : null,
+      managedHostKey: emailHostMode === "treeseed_managed" ? "treeseed-managed-email" : null,
+      mode: emailHostMode ?? null,
+      environmentScopes: scopes,
+      selectedBy: emailHostMode === "treeseed_managed" ? "managed-default" : "user"
+    };
+  }
+  return bindings;
+}
+function normalizeProjectLaunchHostBindings(input) {
+  const record = expectRecord(input, "project launch request");
+  const normalized = {};
+  for (const [key, binding] of Object.entries(optionalRecord(record.hostBindings, "hostBindings") ?? {})) {
+    normalized[validateRequirementKey(key, `hostBindings key "${key}"`)] = normalizeBinding(binding, key);
+  }
+  for (const [key, binding] of Object.entries(deriveLegacyBindings(record))) {
+    if (!normalized[key]) normalized[key] = binding;
+  }
+  return normalized;
+}
+function hostMetadataType(host) {
+  const metadataType = typeof host.metadata?.hostType === "string" ? host.metadata.hostType : host.type;
+  if (metadataType === "repository_host" || metadataType === "repository") return "repository";
+  if (metadataType === "web_host" || metadataType === "cloudflare" || metadataType === "web") return "web";
+  if (metadataType === "email_host" || metadataType === "smtp" || metadataType === "email") return "email";
+  if (metadataType === "ai_host" || metadataType === "ai") return "ai";
+  if (host.provider === "smtp") return "email";
+  if (host.provider === "cloudflare") return "web";
+  if (host.provider === "github") return "repository";
+  return metadataType ?? "";
+}
+function allRequirements(launchRequirements) {
+  return [
+    ...launchRequirements?.hosts ?? [],
+    ...launchRequirements?.resources ?? [],
+    ...launchRequirements?.secrets ?? []
+  ];
+}
+function normalizeSpecList(specs) {
+  if (!specs) return [];
+  return (Array.isArray(specs) ? specs : [specs]).flatMap((entry) => String(entry).split(",")).map((entry) => entry.trim()).filter(Boolean);
+}
+function safeLocalIdSegment(value) {
+  return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "local";
+}
+function portableHostConfigValues(requirement, provider, alias) {
+  const values = {
+    localAlias: alias,
+    provider
+  };
+  if (requirement.type === "repository" && provider === "github") {
+    values.owner = alias;
+    values.github = { owner: alias };
+    return values;
+  }
+  if (requirement.type === "web" && provider === "cloudflare") {
+    values.cloudflare = { account: alias };
+    return values;
+  }
+  if (requirement.type === "email" && provider === "smtp") {
+    values.smtp = { profile: alias };
+    return values;
+  }
+  return values;
+}
+function localHostMetadata(requirement, managed) {
+  return {
+    hostType: requirement.type,
+    managed,
+    configured: true,
+    local: true
+  };
+}
+function parseProjectLaunchHostBindingSpecs(options) {
+  const specs = normalizeSpecList(options.specs);
+  const hostRequirements = new Map((options.launchRequirements?.hosts ?? []).map((requirement) => [requirement.key, requirement]));
+  const hostBindings = {};
+  const repositoryHosts = [];
+  const teamHosts = [];
+  const managedHosts = [];
+  const summaries = [];
+  const omitted = [];
+  for (const spec of specs) {
+    const separatorIndex = spec.indexOf("=");
+    if (separatorIndex < 1 || separatorIndex === spec.length - 1) {
+      throw new Error(`Invalid host binding spec "${spec}". Expected <requirement>=<provider>:<alias> or <requirement>=none.`);
+    }
+    const key = validateRequirementKey(spec.slice(0, separatorIndex).trim(), `host binding spec "${spec}" requirement`);
+    const value = spec.slice(separatorIndex + 1).trim();
+    const requirement = hostRequirements.get(key);
+    if (!requirement) {
+      throw new Error(`Unknown host binding requirement "${key}".`);
+    }
+    if (value === "none") {
+      if (requirement.required) {
+        throw new Error(`${key} is required and cannot be set to none.`);
+      }
+      omitted.push({
+        requirementKey: key,
+        requirementKind: "host",
+        type: requirement.type,
+        provider: null,
+        alias: null,
+        mode: "none",
+        displayName: requirement.displayName
+      });
+      delete hostBindings[key];
+      continue;
+    }
+    const [rawProvider, ...aliasParts] = value.split(":");
+    const provider = expectString(rawProvider, `${key} provider`);
+    const alias = expectString(aliasParts.join(":"), `${key} alias`);
+    if (requirement.compatibleProviders?.length && !requirement.compatibleProviders.includes(provider)) {
+      throw new Error(`${key} requires provider ${requirement.compatibleProviders.join(", ")}, but received "${provider}".`);
+    }
+    if (String(requirement.type) === "capacity-provider" || provider === "capacity-provider") {
+      throw new Error(`${key} capacity-provider host bindings are not accepted for standard project launch.`);
+    }
+    const managed = alias === "managed";
+    const localSegment = `${safeLocalIdSegment(key)}-${safeLocalIdSegment(provider)}-${safeLocalIdSegment(alias)}`;
+    const hostId = managed ? `local-managed:${localSegment}` : `local:${localSegment}`;
+    const displayName = managed ? `Managed ${requirement.displayName}` : `${requirement.displayName} (${alias})`;
+    const host = {
+      id: hostId,
+      type: requirement.type,
+      provider,
+      ownership: managed ? "treeseed_managed" : "team_owned",
+      name: displayName,
+      accountLabel: alias,
+      organizationOrOwner: requirement.type === "repository" ? alias : void 0,
+      allowedEnvironments: ["local", "staging", "prod"],
+      status: "active",
+      metadata: localHostMetadata(requirement, managed)
+    };
+    if (managed) {
+      managedHosts.push(host);
+    } else if (requirement.type === "repository") {
+      repositoryHosts.push(host);
+    } else {
+      teamHosts.push(host);
+    }
+    hostBindings[key] = {
+      requirementKey: key,
+      requirementKind: "host",
+      type: requirement.type,
+      provider,
+      hostId: managed ? null : hostId,
+      managedHostKey: managed ? hostId : null,
+      mode: managed ? "treeseed_managed" : "team_owned",
+      displayName,
+      environmentScopes: ["local", "staging", "prod"],
+      configValues: portableHostConfigValues(requirement, provider, alias),
+      environmentValues: {},
+      secretRefs: {},
+      selectedBy: managed ? "managed-default" : "user"
+    };
+    summaries.push({
+      requirementKey: key,
+      requirementKind: "host",
+      type: requirement.type,
+      provider,
+      alias,
+      mode: managed ? "treeseed_managed" : "team_owned",
+      displayName
+    });
+  }
+  return {
+    hostBindings,
+    repositoryHosts,
+    teamHosts,
+    managedHosts,
+    summaries,
+    omitted
+  };
+}
+function defaultHostIds(defaultHosts, requirementKey, type) {
+  const keys = [
+    requirementKey,
+    type,
+    requirementKey === "sourceRepository" ? "repository" : null,
+    requirementKey === "publicWeb" ? "web" : null,
+    requirementKey === "transactionalEmail" ? "email" : null
+  ].filter(Boolean);
+  for (const key of keys) {
+    const value = defaultHosts?.[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return null;
+}
+function hostMatchesRequirement(host, requirement, environmentScopes) {
+  if (hostMetadataType(host) !== requirement.type) return false;
+  if (requirement.compatibleProviders?.length && !requirement.compatibleProviders.includes(host.provider)) return false;
+  if (host.allowedEnvironments?.length) {
+    return environmentScopes.every((scope) => host.allowedEnvironments?.includes(scope));
+  }
+  return true;
+}
+function hostUsabilityError(host, requirement, required) {
+  if (!required) return null;
+  const status = typeof host.status === "string" ? host.status : "active";
+  if (status === "active" || status === "ready") return null;
+  return `${requirement.key} selected host "${host.name ?? host.id}" is not active (${status}).`;
+}
+function resolveManagedHost(requirement, managedHosts, environmentScopes) {
+  return managedHosts.find((host) => hostMatchesRequirement(host, requirement, environmentScopes)) ?? null;
+}
+function resolveTeamHost(requirement, hosts, environmentScopes, id) {
+  return hosts.find((host) => (!id || host.id === id) && hostMatchesRequirement(host, requirement, environmentScopes)) ?? null;
+}
+function normalizeHostSnapshot(host) {
+  if (!host) return null;
+  return {
+    id: host.id,
+    name: host.name ?? null,
+    ownership: host.ownership ?? null,
+    status: host.status ?? null,
+    accountLabel: host.accountLabel ?? null,
+    organizationOrOwner: host.organizationOrOwner ?? null,
+    metadata: host.metadata ? {
+      hostType: host.metadata.hostType,
+      dns: host.metadata.dns,
+      managed: host.metadata.managed,
+      configured: host.metadata.configured,
+      missingConfigKeys: host.metadata.missingConfigKeys
+    } : void 0
+  };
+}
+function normalizeResourceSnapshot(binding) {
+  const id = binding.hostId ?? binding.managedHostKey ?? null;
+  if (!id) return null;
+  return {
+    id,
+    name: binding.displayName ?? id,
+    ownership: binding.managedHostKey ? "treeseed_managed" : "team_owned",
+    status: "active",
+    accountLabel: null,
+    organizationOrOwner: null,
+    metadata: {
+      hostType: binding.type,
+      resource: true
+    }
+  };
+}
+function bindingSelectedBy(binding, host, fallback) {
+  if (binding?.selectedBy) return binding.selectedBy;
+  if (host?.ownership === "treeseed_managed") return "managed-default";
+  return fallback;
+}
+function resolveHostRequirementBinding(requirement, input, options, selectedAt) {
+  const environmentScopes = input?.environmentScopes ?? ["staging", "prod"];
+  if (options.standardProjectLaunch !== false && (input?.type === "capacity-provider" || input?.provider === "capacity-provider")) {
+    throw new Error(`${requirement.key} capacity-provider host bindings are not accepted for standard project launch.`);
+  }
+  if (input && input.requirementKind !== "host") {
+    throw new Error(`${requirement.key} must bind a host requirement.`);
+  }
+  if (input && input.type !== requirement.type) {
+    throw new Error(`${requirement.key} requires host type "${requirement.type}", but received "${input.type}".`);
+  }
+  if (input && requirement.compatibleProviders?.length && !requirement.compatibleProviders.includes(input.provider)) {
+    throw new Error(`${requirement.key} requires provider ${requirement.compatibleProviders.join(", ")}, but received "${input.provider}".`);
+  }
+  const inventory = requirement.type === "repository" ? options.repositoryHosts ?? [] : [...options.teamHosts ?? [], ...options.managedHosts ?? []];
+  const teamInventory = requirement.type === "repository" ? options.repositoryHosts ?? [] : options.teamHosts ?? [];
+  let host = null;
+  let managedHostKey = input?.managedHostKey ?? null;
+  let hostId = input?.hostId ?? null;
+  let provider = input?.provider ?? requirement.compatibleProviders?.[0] ?? "";
+  let selectedBy = input?.selectedBy ?? "user";
+  if (input) {
+    if (input.mode === "treeseed_managed" || input.managedHostKey) {
+      host = requirement.type === "repository" ? resolveTeamHost(requirement, inventory, environmentScopes, input.hostId ?? null) : resolveManagedHost(requirement, options.managedHosts ?? [], environmentScopes);
+      if (!host) throw new Error(`${requirement.key} requires a compatible managed ${requirement.type} host.`);
+      provider = host.provider;
+      managedHostKey = input.managedHostKey ?? host.id;
+      hostId = requirement.type === "repository" ? input.hostId ?? host.id : null;
+    } else if (input.hostId) {
+      host = resolveTeamHost(requirement, inventory, environmentScopes, input.hostId);
+      if (!host) throw new Error(`${requirement.key} selected host "${input.hostId}" is not available or compatible.`);
+      provider = host.provider;
+      hostId = host.id;
+    } else if (requirement.required) {
+      throw new Error(`${requirement.key} is required and must select a compatible host.`);
+    }
+  } else if (requirement.defaultSelection === "team-default") {
+    const defaultHostId = defaultHostIds(options.defaultHosts, requirement.key, requirement.type);
+    host = defaultHostId ? resolveTeamHost(requirement, teamInventory, environmentScopes, defaultHostId) : null;
+    if (!host && !defaultHostId) host = resolveTeamHost(requirement, teamInventory, environmentScopes);
+    if (!host) host = resolveManagedHost(requirement, options.managedHosts ?? [], environmentScopes);
+    if (host) {
+      provider = host.provider;
+      hostId = host.id;
+      managedHostKey = host.ownership === "treeseed_managed" ? host.id : null;
+      selectedBy = defaultHostId ? "team-default" : host.ownership === "treeseed_managed" ? "managed-default" : "team-default";
+    }
+  } else if (requirement.defaultSelection === "managed") {
+    host = resolveManagedHost(requirement, options.managedHosts ?? [], environmentScopes);
+    if (host) {
+      provider = host.provider;
+      managedHostKey = host.id;
+      hostId = requirement.type === "repository" ? host.id : null;
+      selectedBy = "managed-default";
+    }
+  }
+  if (!host && requirement.required) {
+    throw new Error(`${requirement.key} is required and no compatible ${requirement.type} host is available.`);
+  }
+  if (host) {
+    const usabilityError = hostUsabilityError(host, requirement, requirement.required);
+    if (usabilityError) throw new Error(usabilityError);
+  }
+  return {
+    requirementKey: requirement.key,
+    requirementKind: "host",
+    type: requirement.type,
+    provider,
+    hostId,
+    managedHostKey,
+    displayName: input?.displayName ?? requirement.displayName,
+    environmentScopes,
+    configValues: input?.configValues ?? {},
+    environmentValues: input?.environmentValues ?? {},
+    secretRefs: input?.secretRefs ?? {},
+    provenance: {
+      selectedBy: bindingSelectedBy(input, host, selectedBy),
+      selectedAt
+    },
+    host: normalizeHostSnapshot(host)
+  };
+}
+function resolveResourceRequirementBinding(requirement, input, selectedAt) {
+  if (!input) {
+    if (requirement.required) {
+      throw new Error(`${requirement.key} is required and must select a compatible resource.`);
+    }
+    return null;
+  }
+  const environmentScopes = input.environmentScopes ?? ["staging", "prod"];
+  if (input.requirementKind !== "resource") {
+    throw new Error(`${requirement.key} must bind a resource requirement.`);
+  }
+  if (input.type !== requirement.type) {
+    throw new Error(`${requirement.key} requires resource type "${requirement.type}", but received "${input.type}".`);
+  }
+  if (requirement.compatibleProviders?.length && !requirement.compatibleProviders.includes(input.provider)) {
+    throw new Error(`${requirement.key} requires provider ${requirement.compatibleProviders.join(", ")}, but received "${input.provider}".`);
+  }
+  return {
+    requirementKey: requirement.key,
+    requirementKind: "resource",
+    type: requirement.type,
+    provider: input.provider,
+    hostId: input.hostId ?? null,
+    managedHostKey: input.managedHostKey ?? null,
+    displayName: input.displayName ?? requirement.displayName,
+    environmentScopes,
+    configValues: input.configValues ?? {},
+    environmentValues: input.environmentValues ?? {},
+    secretRefs: input.secretRefs ?? {},
+    provenance: {
+      selectedBy: input.selectedBy ?? "user",
+      selectedAt
+    },
+    host: normalizeResourceSnapshot(input)
+  };
+}
+function resolveAdHocBinding(key, input, options, selectedAt) {
+  if (options.standardProjectLaunch !== false && (input.type === "capacity-provider" || input.provider === "capacity-provider")) {
+    throw new Error(`${key} capacity-provider host bindings are not accepted for standard project launch.`);
+  }
+  const environmentScopes = input.environmentScopes ?? ["staging", "prod"];
+  const inventory = input.type === "repository" ? options.repositoryHosts ?? [] : [...options.teamHosts ?? [], ...options.managedHosts ?? []];
+  let host = null;
+  if (input.mode === "treeseed_managed" || input.managedHostKey) {
+    host = inventory.find((entry) => hostMetadataType(entry) === input.type && entry.provider === input.provider && entry.ownership === "treeseed_managed") ?? null;
+  } else if (input.hostId) {
+    host = inventory.find((entry) => entry.id === input.hostId && hostMetadataType(entry) === input.type && entry.provider === input.provider) ?? null;
+  }
+  return {
+    requirementKey: input.requirementKey ?? key,
+    requirementKind: input.requirementKind,
+    type: input.type,
+    provider: input.provider,
+    hostId: input.hostId ?? host?.id ?? null,
+    managedHostKey: input.managedHostKey ?? (host?.ownership === "treeseed_managed" ? host.id : null),
+    displayName: input.displayName ?? host?.name ?? key,
+    environmentScopes,
+    configValues: input.configValues ?? {},
+    environmentValues: input.environmentValues ?? {},
+    secretRefs: input.secretRefs ?? {},
+    provenance: {
+      selectedBy: bindingSelectedBy(input, host, input.selectedBy ?? "user"),
+      selectedAt
+    },
+    host: normalizeHostSnapshot(host)
+  };
+}
+function compatibilityFromBindings(bindings) {
+  const sourceRepository = bindings.sourceRepository;
+  const publicWeb = bindings.publicWeb;
+  const transactionalEmail = bindings.transactionalEmail;
+  const publicWebSelected = Boolean(publicWeb?.host || publicWeb?.hostId || publicWeb?.managedHostKey);
+  const transactionalEmailSelected = Boolean(transactionalEmail?.host || transactionalEmail?.hostId || transactionalEmail?.managedHostKey);
+  return {
+    repositoryHostId: sourceRepository?.hostId ?? null,
+    cloudflareHostMode: publicWebSelected && publicWeb ? publicWeb.provenance.selectedBy === "managed-default" || publicWeb.host?.ownership === "treeseed_managed" || publicWeb.managedHostKey ? "treeseed_managed" : "team_owned" : null,
+    cloudflareHostId: publicWebSelected && publicWeb?.host?.ownership === "team_owned" ? publicWeb.host.id : publicWebSelected && publicWeb?.hostId && !publicWeb.managedHostKey ? publicWeb.hostId : null,
+    emailHostMode: transactionalEmailSelected && transactionalEmail ? transactionalEmail.provenance.selectedBy === "managed-default" || transactionalEmail.host?.ownership === "treeseed_managed" || transactionalEmail.managedHostKey ? "treeseed_managed" : "team_owned" : null,
+    emailHostId: transactionalEmailSelected && transactionalEmail?.host?.ownership === "team_owned" ? transactionalEmail.host.id : transactionalEmailSelected && transactionalEmail?.hostId && !transactionalEmail.managedHostKey ? transactionalEmail.hostId : null
+  };
+}
+function resolveProjectLaunchHostBindings(options) {
+  const selectedAt = options.selectedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const inputs = options.hostBindings ?? {};
+  const hostBindings = {};
+  const configWritePlan = [];
+  const secretItems = [];
+  const requirementKeys = /* @__PURE__ */ new Set();
+  for (const requirement of allRequirements(options.launchRequirements)) {
+    requirementKeys.add(requirement.key);
+    if (requirement.kind === "host") {
+      const binding = resolveHostRequirementBinding(requirement, inputs[requirement.key], options, selectedAt);
+      if (binding.host || requirement.required || inputs[requirement.key]) {
+        hostBindings[requirement.key] = binding;
+        for (const write of requirement.configWrites ?? []) {
+          configWritePlan.push({
+            ...write,
+            requirementKey: requirement.key,
+            requirementKind: "host",
+            requirementType: requirement.type,
+            provider: binding.provider
+          });
+        }
+        for (const write of requirement.environmentWrites ?? []) {
+          secretItems.push({
+            requirementKey: requirement.key,
+            requirementKind: "host",
+            env: write.env,
+            sensitivity: write.sensitivity ?? "plain",
+            source: write.valueFrom,
+            targets: write.targets ?? [],
+            scopes: write.scopes ?? binding.environmentScopes,
+            sourceHostId: binding.hostId ?? binding.host?.id ?? null
+          });
+        }
+      }
+      continue;
+    }
+    if (options.standardProjectLaunch !== false && requirement.kind === "resource") {
+      throw new Error(`${requirement.key} resource requirements are not accepted for standard project launch yet.`);
+    }
+    if (requirement.kind === "resource") {
+      const binding = resolveResourceRequirementBinding(requirement, inputs[requirement.key], selectedAt);
+      if (binding) {
+        hostBindings[requirement.key] = binding;
+        for (const write of requirement.configWrites ?? []) {
+          configWritePlan.push({
+            ...write,
+            requirementKey: requirement.key,
+            requirementKind: "resource",
+            requirementType: requirement.type,
+            provider: binding.provider
+          });
+        }
+        for (const write of requirement.environmentWrites ?? []) {
+          secretItems.push({
+            requirementKey: requirement.key,
+            requirementKind: "resource",
+            env: write.env,
+            sensitivity: write.sensitivity ?? "plain",
+            source: write.valueFrom,
+            targets: write.targets ?? [],
+            scopes: write.scopes ?? binding.environmentScopes,
+            sourceHostId: binding.hostId ?? binding.managedHostKey ?? binding.host?.id ?? null
+          });
+        }
+      }
+      continue;
+    }
+    if (requirement.kind === "secret") {
+      if (requirement.required && requirement.source === "selected-host" && !inputs[requirement.key]) {
+        throw new Error(`${requirement.key} is required and must resolve from a selected host.`);
+      }
+      secretItems.push({
+        requirementKey: requirement.key,
+        requirementKind: "secret",
+        env: requirement.env,
+        sensitivity: requirement.sensitivity,
+        source: requirement.source,
+        targets: requirement.targets,
+        scopes: ["staging", "prod"],
+        sourceHostId: inputs[requirement.key]?.hostId ?? null
+      });
+    }
+  }
+  for (const [key, input] of Object.entries(inputs)) {
+    if (!requirementKeys.has(key)) {
+      hostBindings[key] = resolveAdHocBinding(key, input, options, selectedAt);
+    }
+  }
+  return {
+    hostBindings,
+    compatibility: compatibilityFromBindings(hostBindings),
+    configWritePlan,
+    secretDeploymentPlan: { items: secretItems },
+    diagnostics: []
+  };
+}
+export {
+  normalizeProjectLaunchHostBindings,
+  normalizeTemplateLaunchRequirements,
+  parseProjectLaunchHostBindingSpecs,
+  resolveProjectLaunchHostBindings,
+  validateTemplateLaunchRequirements
+};