@treeseed/sdk 0.10.28 → 0.12.4

package/dist/operations/agent-tools.d.ts

@@ -1,13 +1,8 @@
-export declare const AGENT_OPERATION_NAMES: readonly ["switch", "dev", "verify", "save", "stage", "merge_to_staging", "close", "release"];
+export declare const AGENT_OPERATION_NAMES: readonly ["switch", "dev", "verify", "save", "update", "stage", "close", "release"];
 export declare const AGENT_OPERATION_MODES: readonly ["dry_run", "read_only", "mutating"];
 export type AgentOperationName = (typeof AGENT_OPERATION_NAMES)[number];
 export type AgentOperationMode = (typeof AGENT_OPERATION_MODES)[number];
 export type AgentOperationStatus = 'completed' | 'waiting' | 'failed' | 'skipped' | 'retry_created';
-export interface AgentOperationApprovalRef {
-    id: string;
-    kind?: string;
-    state: 'pending' | 'approved' | 'rejected' | 'expired' | 'superseded';
-}
 export interface AgentOperationRequest {
     operation: AgentOperationName;
     mode: AgentOperationMode;
@@ -22,8 +17,6 @@ export interface AgentOperationRequest {
     worktreeRoot?: string;
     featureBranch?: string;
     stagingBranch?: string;
-    approvalId?: string;
-    approval?: AgentOperationApprovalRef;
     permissionGrantId?: string;
     allowedPaths?: string[];
     forbiddenPaths?: string[];
@@ -48,8 +41,6 @@ export interface AgentOperationGrant {
     environments?: string[];
     allowedPaths?: string[];
     forbiddenPaths?: string[];
-    requiresApproval?: boolean;
-    approvalIds?: string[];
     expiresAt?: string;
     metadata?: Record<string, unknown>;
 }
@@ -80,7 +71,7 @@ export interface AgentOperationResult {
     };
     metadata: Record<string, unknown>;
 }
-export type AgentOperationPermissionCode = 'allowed' | 'invalid_operation' | 'operation_permission_required' | 'operation_grant_inactive' | 'operation_grant_expired' | 'operation_mode_not_granted' | 'operation_role_not_granted' | 'operation_task_kind_not_granted' | 'operation_project_not_granted' | 'operation_environment_not_granted' | 'operation_approval_required' | 'operation_release_approval_required' | 'operation_worktree_required' | 'operation_allowed_paths_required' | 'operation_path_not_allowed' | 'operation_path_forbidden';
+export type AgentOperationPermissionCode = 'allowed' | 'invalid_operation' | 'operation_permission_required' | 'operation_grant_inactive' | 'operation_grant_expired' | 'operation_mode_not_granted' | 'operation_role_not_granted' | 'operation_task_kind_not_granted' | 'operation_project_not_granted' | 'operation_environment_not_granted' | 'operation_worktree_required' | 'operation_allowed_paths_required' | 'operation_path_not_allowed' | 'operation_path_forbidden';
 export interface AgentOperationPermissionDecision {
     allowed: boolean;
     status: 'completed' | 'waiting' | 'failed';

package/dist/operations/agent-tools.js

@@ -3,8 +3,8 @@ const AGENT_OPERATION_NAMES = [
   "dev",
   "verify",
   "save",
+  "update",
   "stage",
-  "merge_to_staging",
   "close",
   "release"
 ];
@@ -73,12 +73,6 @@ function decideAgentOperationPermission(input) {
   if (!isAgentOperationName(request.operation)) {
     return deny("invalid_operation", `Unsupported agent operation "${String(request.operation)}".`, { status: "failed" });
   }
-  if (request.operation === "release") {
-    const approval = request.approval;
-    if (!approval || approval.state !== "approved" || request.approvalId && approval.id !== request.approvalId) {
-      return deny("operation_release_approval_required", "Release requires an explicit approved release approval.");
-    }
-  }
   const grant = resolveAgentOperationGrant(request, input.grants, now);
   if (!grant) {
     return deny("operation_permission_required", `No operation grant allows ${request.agentRole} to run ${request.operation}.`);
@@ -102,19 +96,13 @@ function decideAgentOperationPermission(input) {
   if (!listMatches(request.environment, grant.environments)) {
     return deny("operation_environment_not_granted", `Operation grant ${grant.id} does not allow environment ${request.environment}.`, { grant });
   }
-  if (grant.requiresApproval && (!request.approval || request.approval.state !== "approved")) {
-    return deny("operation_approval_required", `Operation grant ${grant.id} requires approval.`, { grant });
-  }
-  if (grant.approvalIds?.length && (!request.approval || !grant.approvalIds.includes(request.approval.id) || request.approval.state !== "approved")) {
-    return deny("operation_approval_required", `Operation grant ${grant.id} requires one of its approved approval ids.`, { grant });
-  }
   if (request.mode === "mutating" && !request.worktreeRoot && request.operation !== "release") {
     return deny("operation_worktree_required", `Mutating operation ${request.operation} requires an assigned worktree root.`, { grant });
   }
   const allowedPaths = request.allowedPaths?.length ? request.allowedPaths : grant.allowedPaths ?? [];
   const forbiddenPaths = [...grant.forbiddenPaths ?? [], ...request.forbiddenPaths ?? []];
   const changedPaths = request.changedPaths ?? [];
-  if ((request.operation === "stage" || request.operation === "merge_to_staging") && allowedPaths.length === 0) {
+  if (request.operation === "stage" && allowedPaths.length === 0) {
     return deny("operation_allowed_paths_required", `${request.operation} requires allowed paths.`, { grant });
   }
   for (const changedPath of changedPaths) {

package/dist/operations/providers/default.d.ts

@@ -1,4 +1,4 @@
-import type { TreeseedOperationImplementation, TreeseedOperationMetadata, TreeseedOperationProvider } from '../../operations-types.ts';
+import type { TreeseedOperationImplementation, TreeseedOperationMetadata, TreeseedOperationProvider } from '../../operations-types.js';
 export declare class DefaultTreeseedOperationsProvider implements TreeseedOperationProvider {
     readonly id = "default";
     private readonly operations;

package/dist/operations/providers/default.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdtempSync, mkdirSync, readdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { join, relative, resolve } from "node:path";
-import { tmpdir } from "node:os";
 import { RemoteTreeseedAuthClient, RemoteTreeseedClient } from "../../remote.js";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "../../operations/services/git-runner.js";
 import {
   findTreeseedOperation,
   TRESEED_OPERATION_SPECS
@@ -28,11 +28,6 @@ import {
   finalizeDeploymentState,
   loadDeployState
 } from "../../operations/services/deploy.js";
-import {
-  dockerIsAvailable,
-  findRunningMailpitContainer,
-  stopKnownMailpitContainers
-} from "../../operations/services/mailpit-runtime.js";
 import {
   loadCliDeployConfig,
   packageScriptPath,
@@ -67,7 +62,6 @@ import {
   parseProjectLaunchHostBindingSpecs,
   resolveProjectLaunchHostBindings
 } from "../../template-launch-requirements.js";
-import { run } from "../../operations/services/workspace-tools.js";
 import { resolveTreeseedWorkflowState } from "../../workflow-state.js";
 import { TreeseedWorkflowError, TreeseedWorkflowSdk } from "../../workflow.js";
 import {
@@ -75,6 +69,14 @@ import {
   formatTreeseedDependencyReport,
   installTreeseedDependencies
 } from "../../managed-dependencies.js";
+function runGit(args, options) {
+  return runTreeseedGitText(args, {
+    cwd: options.cwd,
+    mode: classifyTreeseedGitMode(args),
+    timeoutMs: options.timeoutMs,
+    maxBuffer: options.maxBuffer
+  });
+}
 function operationResult(metadata, payload, options = {}) {
   return {
     operation: metadata.id,
@@ -184,12 +186,17 @@ function copyFileIfExists(sourceFile, targetFile) {
   mkdirSync(resolve(targetFile, ".."), { recursive: true });
   writeFileSync(targetFile, readFileSync(sourceFile));
 }
+function providerTempRoot(tenantRoot, scope) {
+  const base = resolve(tenantRoot, ".treeseed", "tmp", scope);
+  mkdirSync(base, { recursive: true });
+  return base;
+}
 function prepareContentPublishRoot(tenantRoot, contentRepositoryRoot) {
   if (!contentRepositoryRoot || resolve(contentRepositoryRoot) === resolve(tenantRoot)) {
     return { root: tenantRoot, cleanup: () => {
     } };
   }
-  const tempRoot = mkdtempSync(join(tmpdir(), "treeseed-content-repo-publish-"));
+  const tempRoot = mkdtempSync(join(providerTempRoot(tenantRoot, "content-repo-publish"), "treeseed-content-repo-publish-"));
   copyFileIfExists(resolve(tenantRoot, "treeseed.site.yaml"), resolve(tempRoot, "treeseed.site.yaml"));
   copyFileIfExists(resolve(tenantRoot, "package.json"), resolve(tempRoot, "package.json"));
   copyFileIfExists(resolve(tenantRoot, "src", "manifest.yaml"), resolve(tempRoot, "src", "manifest.yaml"));
@@ -1092,12 +1099,13 @@ class RollbackOperation extends BaseOperation {
     }
     const gitRoot = repoRoot(tenantRoot);
     const tenantRelativePath = relative(gitRoot, tenantRoot);
-    const tempRoot = mkdtempSync(join(tmpdir(), "treeseed-rollback-"));
+    const rollbackBase = providerTempRoot(tenantRoot, "rollback");
+    const tempRoot = mkdtempSync(join(rollbackBase, "treeseed-rollback-"));
     const tempTenantRoot = resolve(tempRoot, tenantRelativePath);
     const currentNodeModules = resolve(tenantRoot, "node_modules");
     let finalizedState = null;
     try {
-      run("git", ["worktree", "add", "--detach", tempRoot, rollbackCommit], { cwd: gitRoot, capture: true });
+      runGit(["worktree", "add", "--detach", tempRoot, rollbackCommit], { cwd: gitRoot, capture: true });
       copyTreeseedOperationalState(tenantRoot, tempTenantRoot);
       if (existsSync(currentNodeModules) && !existsSync(resolve(tempTenantRoot, "node_modules"))) {
         symlinkSync(currentNodeModules, resolve(tempTenantRoot, "node_modules"), "dir");
@@ -1129,7 +1137,7 @@ class RollbackOperation extends BaseOperation {
       }
     } finally {
       try {
-        run("git", ["worktree", "remove", "--force", tempRoot], { cwd: gitRoot, capture: true });
+        runGit(["worktree", "remove", "--force", tempRoot], { cwd: gitRoot, capture: true });
       } catch {
       }
     }
@@ -1142,29 +1150,6 @@ class RollbackOperation extends BaseOperation {
     });
   }
 }
-class MailpitUpOperation extends BaseOperation {
-  async execute(_input, context) {
-    if (!dockerIsAvailable()) {
-      return failureResult(this.metadata, "Docker is required for Treeseed form email testing.");
-    }
-    const existing = findRunningMailpitContainer();
-    if (existing) {
-      return operationResult(this.metadata, { reused: true, container: existing });
-    }
-    return runNodeScript(this.metadata, "ensure-mailpit", [], context);
-  }
-}
-class MailpitDownOperation extends BaseOperation {
-  async execute(_input, _context) {
-    const stopped = stopKnownMailpitContainers();
-    return operationResult(this.metadata, { stopped }, { ok: stopped, exitCode: stopped ? 0 : 1 });
-  }
-}
-class MailpitLogsOperation extends BaseOperation {
-  async execute(_input, context) {
-    return runNodeScript(this.metadata, "logs-mailpit", [], context);
-  }
-}
 class DefaultTreeseedOperationsProvider {
   id = "default";
   operations;
@@ -1175,6 +1160,7 @@ class DefaultTreeseedOperationsProvider {
       new WorkflowOperation("tasks"),
       new WorkflowOperation("switch", "switch"),
       new WorkflowOperation("save"),
+      new WorkflowOperation("update"),
       new WorkflowOperation("close"),
       new WorkflowOperation("stage"),
       new WorkflowOperation("resume"),
@@ -1231,9 +1217,6 @@ class DefaultTreeseedOperationsProvider {
       new ScriptOperation("test:release:full", "workspace-release-verify", ["--full-smoke"]),
       new ScriptOperation("release:publish:changed", "workspace-publish-changed-packages"),
       new ScriptOperation("astro", "tenant-astro-command"),
-      new MailpitUpOperation("mailpit:up"),
-      new MailpitDownOperation("mailpit:down"),
-      new MailpitLogsOperation("mailpit:logs"),
       new ScriptOperation("d1:migrate:local", "tenant-d1-migrate-local"),
       new ScriptOperation("cleanup:markdown", "cleanup-markdown", ["--write"]),
       new ScriptOperation("cleanup:markdown:check", "cleanup-markdown", ["--check"]),

package/dist/operations/repository-operations.d.ts

@@ -1,4 +1,4 @@
-import { type ApplyProjectLaunchHostBindingConfigOptions } from './services/template-host-bindings.ts';
+import { type ApplyProjectLaunchHostBindingConfigOptions } from './services/template-host-bindings.js';
 export declare const PLATFORM_CONTENT_COLLECTIONS: readonly ["objectives", "questions", "notes", "proposals", "decisions", "agents"];
 export declare const PLATFORM_WORK_CONTENT_COLLECTIONS: readonly ["objectives", "questions", "notes", "proposals", "decisions"];
 export type PlatformContentCollection = (typeof PLATFORM_CONTENT_COLLECTIONS)[number];
@@ -50,11 +50,30 @@ export interface PlatformRepositoryOperationInput {
     teamId?: string;
     createdBy?: string;
     repository: PlatformRepositoryDescriptor;
+    architecture?: Record<string, unknown>;
+    scaffoldFiles?: PlatformRepositoryScaffoldFile[];
     collection?: string;
     parentCollection?: string;
     parentSlug?: string;
     targetCollection?: string;
     proposalSlugs?: string[];
+    proposalSlug?: string;
+    proposalId?: string;
+    proposalVersion?: number;
+    proposalContentHash?: string;
+    proposalSnapshot?: Record<string, unknown>;
+    contentProposalSlug?: string;
+    contentDecisionSlug?: string;
+    governanceDecision?: Record<string, unknown>;
+    governanceDecisionId?: string;
+    governanceProviderId?: string;
+    governanceRule?: Record<string, unknown>;
+    electorateSnapshot?: Record<string, unknown>;
+    voteResult?: Record<string, unknown>;
+    voterReasons?: Record<string, unknown>[];
+    decidedAt?: string;
+    decisionSnapshotHash?: string;
+    authority?: string;
     decisionType?: string;
     reason?: string;
     title?: string;
@@ -69,6 +88,11 @@ export interface PlatformRepositoryOperationInput {
     launchInput?: ApplyProjectLaunchHostBindingConfigOptions['launchInput'];
     derived?: ApplyProjectLaunchHostBindingConfigOptions['derived'];
 }
+export interface PlatformRepositoryScaffoldFile {
+    path: string;
+    content: string;
+    overwrite?: boolean;
+}
 export interface PlatformRepositoryOperationOptions {
     workspaceRoot: string;
     environment?: string;
@@ -131,4 +155,4 @@ export declare function normalizePlatformContentInput(collection: string, body:
 export declare function derivePlatformRepositoryKey(repository: PlatformRepositoryDescriptor): string;
 export declare function resolvePlatformRepositoryWorkspacePath(workspaceRoot: string, repository: PlatformRepositoryDescriptor): string;
 export declare function createPlatformRepositoryClaim(input: PlatformRepositoryClaimInput): PlatformRepositoryClaim;
-export declare function executePlatformRepositoryOperation(operation: 'write_content_record' | 'create_related_content' | 'create_decision_from_proposals' | 'apply_host_binding_config' | 'audit_host_binding_config' | string, input: PlatformRepositoryOperationInput, options: PlatformRepositoryOperationOptions): Promise<PlatformRepositoryOperationResult>;
+export declare function executePlatformRepositoryOperation(operation: 'write_content_record' | 'create_related_content' | 'create_decision_from_proposals' | 'create_decision_from_governance_proposal' | 'apply_host_binding_config' | 'audit_host_binding_config' | string, input: PlatformRepositoryOperationInput, options: PlatformRepositoryOperationOptions): Promise<PlatformRepositoryOperationResult>;

package/dist/operations/repository-operations.js

@@ -51,7 +51,7 @@ const CONTENT_DEFAULTS = {
     extension: "mdx",
     fields: {
       name: "",
-      handler: "planner",
+      handler: "plan",
       enabled: true,
       operator: "TreeSeed platform",
       runtimeStatus: "active",
@@ -182,6 +182,14 @@ function normalizePlatformContentInput(collection, body) {
     frontmatter.relatedQuestions = normalizePlatformRelationArray(body.relatedQuestions);
     frontmatter.relatedNotes = normalizePlatformRelationArray(body.relatedNotes);
     frontmatter.decision = optionalTrimmedString(body.decision) ?? void 0;
+    frontmatter.governanceId = optionalTrimmedString(body.governanceId) ?? void 0;
+    frontmatter.governanceProviderId = optionalTrimmedString(body.governanceProviderId) ?? void 0;
+    frontmatter.governancePolicyId = optionalTrimmedString(body.governancePolicyId) ?? void 0;
+    frontmatter.governanceStatus = optionalTrimmedString(body.governanceStatus) ?? void 0;
+    frontmatter.proposalVersion = Number.isInteger(Number(body.proposalVersion)) ? Number(body.proposalVersion) : void 0;
+    frontmatter.proposalContentHash = optionalTrimmedString(body.proposalContentHash) ?? void 0;
+    frontmatter.votingStartsAt = optionalTrimmedString(body.votingStartsAt) ?? void 0;
+    frontmatter.votingEndsAt = optionalTrimmedString(body.votingEndsAt) ?? void 0;
   } else if (collection === "decisions") {
     frontmatter.primaryContributor = optionalTrimmedString(body.primaryContributor) ?? frontmatter.primaryContributor;
     frontmatter.decisionType = enumValue(body.decisionType, DECISION_TYPE_VALUES, String(frontmatter.decisionType));
@@ -191,6 +199,18 @@ function normalizePlatformContentInput(collection, body) {
     frontmatter.relatedQuestions = normalizePlatformRelationArray(body.relatedQuestions);
     frontmatter.relatedNotes = normalizePlatformRelationArray(body.relatedNotes);
     frontmatter.relatedProposals = normalizePlatformRelationArray(body.relatedProposals);
+    frontmatter.immutable = body.immutable === true ? true : void 0;
+    frontmatter.governanceDecisionId = optionalTrimmedString(body.governanceDecisionId) ?? void 0;
+    frontmatter.governanceProviderId = optionalTrimmedString(body.governanceProviderId) ?? void 0;
+    frontmatter.sourceProposalGovernanceId = optionalTrimmedString(body.sourceProposalGovernanceId) ?? void 0;
+    frontmatter.sourceProposalVersion = Number.isInteger(Number(body.sourceProposalVersion)) ? Number(body.sourceProposalVersion) : void 0;
+    frontmatter.sourceProposalHash = optionalTrimmedString(body.sourceProposalHash) ?? void 0;
+    frontmatter.governanceRule = body.governanceRule && typeof body.governanceRule === "object" && !Array.isArray(body.governanceRule) ? body.governanceRule : void 0;
+    frontmatter.electorateSnapshot = body.electorateSnapshot && typeof body.electorateSnapshot === "object" && !Array.isArray(body.electorateSnapshot) ? body.electorateSnapshot : void 0;
+    frontmatter.voteResult = body.voteResult && typeof body.voteResult === "object" && !Array.isArray(body.voteResult) ? body.voteResult : void 0;
+    frontmatter.voterReasons = Array.isArray(body.voterReasons) ? body.voterReasons : void 0;
+    frontmatter.decidedAt = optionalTrimmedString(body.decidedAt) ?? void 0;
+    frontmatter.decisionSnapshotHash = optionalTrimmedString(body.decisionSnapshotHash) ?? void 0;
   }
   return {
     slug,
@@ -283,6 +303,54 @@ function assertAllowedPath(repoPath, targetPath) {
   }
   return relativePath;
 }
+function safeRepositoryRelativePath(repoPath, rawPath) {
+  const value = typeof rawPath === "string" ? rawPath.trim() : "";
+  if (!value || value.startsWith("/") || value.includes("\0")) {
+    throw new Error("Repository initialization scaffold path must be repository-relative.");
+  }
+  const target = resolve(repoPath, value);
+  const relativePath = relative(repoPath, target);
+  if (relativePath.startsWith("..") || relativePath.includes("..") || relativePath.startsWith("/")) {
+    throw new Error(`Repository initialization scaffold path is outside the repository: ${value}`);
+  }
+  return { target, relativePath };
+}
+function secretLookingText(value) {
+  return /(?:ghp_|github_pat_|sk-[A-Za-z0-9]|xox[baprs]-|BEGIN (?:RSA |OPENSSH |EC )?PRIVATE KEY|TREESEED_GITHUB_TOKEN\s*=|password\s*=|passphrase\s*=|secretValue|rawSecret|unencrypted)/iu.test(value);
+}
+async function initializeLinkedRepository(repoPath, input) {
+  const architecture = input.architecture && typeof input.architecture === "object" && !Array.isArray(input.architecture) ? {
+    topology: input.architecture.topology ?? null,
+    rootPath: input.architecture.rootPath ?? ".",
+    sitePath: input.architecture.sitePath ?? null,
+    contentPath: input.architecture.contentPath ?? null,
+    contentRuntimeSource: input.architecture.contentRuntimeSource ?? null,
+    localContentMaterialization: input.architecture.localContentMaterialization ?? null
+  } : null;
+  const scaffoldFiles = Array.isArray(input.scaffoldFiles) ? input.scaffoldFiles : [];
+  const scaffoldedPaths = [];
+  for (const file of scaffoldFiles) {
+    if (!file || typeof file !== "object") throw new Error("Repository initialization scaffold files must be objects.");
+    const content = typeof file.content === "string" ? file.content : null;
+    if (content == null) throw new Error("Repository initialization scaffold file content must be a string.");
+    if (secretLookingText(content) || secretLookingText(file.path)) {
+      throw new Error("Repository initialization scaffold files must not contain token-like or plaintext secret material.");
+    }
+    const { target, relativePath } = safeRepositoryRelativePath(repoPath, file.path);
+    if (existsSync(target) && file.overwrite !== true) continue;
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, content, "utf8");
+    scaffoldedPaths.push(relativePath);
+  }
+  return {
+    kind: "linked_repository_initialization",
+    projectId: input.projectId ?? null,
+    teamId: input.teamId ?? null,
+    mode: scaffoldedPaths.length > 0 ? "template_scaffold" : "adopt_existing",
+    architecture,
+    scaffoldedPaths
+  };
+}
 async function readContentRecord(repoPath, collection, slug) {
   if (!WORK_CONTENT_COLLECTION_SET.has(collection)) throw new Error("Unsupported content collection.");
   const target = safeContentPath(repoPath, collection, slug);
@@ -463,6 +531,92 @@ async function createDecisionFromProposals(repoPath, input) {
     changedPaths: changedPaths2
   };
 }
+async function createDecisionFromGovernanceProposal(repoPath, input) {
+  const proposalSnapshot = input.proposalSnapshot && typeof input.proposalSnapshot === "object" ? input.proposalSnapshot : {};
+  const governanceDecision = input.governanceDecision && typeof input.governanceDecision === "object" ? input.governanceDecision : {};
+  const proposalSlug = slugifyPlatformContent(
+    input.contentProposalSlug ?? input.proposalSlug ?? proposalSnapshot.slug ?? proposalSnapshot.contentProposalSlug ?? governanceDecision.contentProposalSlug ?? ""
+  );
+  if (!proposalSlug) throw new Error("A safe source proposal slug is required.");
+  const sourceHash = optionalTrimmedString(input.proposalContentHash) ?? optionalTrimmedString(proposalSnapshot.contentHash) ?? optionalTrimmedString(proposalSnapshot.proposalContentHash);
+  if (!sourceHash) throw new Error("Accepted proposal content hash is required.");
+  const proposalVersion = Number(input.proposalVersion ?? proposalSnapshot.version ?? proposalSnapshot.proposalVersion ?? 1);
+  if (!Number.isInteger(proposalVersion) || proposalVersion < 1) throw new Error("Accepted proposal version is invalid.");
+  const title = optionalTrimmedString(input.title) ?? optionalTrimmedString(governanceDecision.title) ?? optionalTrimmedString(proposalSnapshot.title) ?? `Decision for ${proposalSlug}`;
+  const summary = optionalTrimmedString(input.summary) ?? optionalTrimmedString(governanceDecision.summary) ?? optionalTrimmedString(proposalSnapshot.summary) ?? "Accepted governance decision.";
+  const decisionSlug = slugifyPlatformContent(input.slug || input.contentDecisionSlug || governanceDecision.contentDecisionSlug || title);
+  if (!decisionSlug) throw new Error("A safe decision slug is required.");
+  const decisionTarget = safeContentPath(repoPath, "decisions", decisionSlug, "mdx");
+  if (existsSync(decisionTarget)) throw new Error("A decision with that slug already exists.");
+  let proposal = null;
+  try {
+    proposal = await readContentRecord(repoPath, "proposals", proposalSlug);
+  } catch {
+    throw new Error(`Proposal ${proposalSlug} was not found.`);
+  }
+  const voteResult = input.voteResult && typeof input.voteResult === "object" ? input.voteResult : governanceDecision.voteResult ?? {};
+  const voterReasons = Array.isArray(input.voterReasons) ? input.voterReasons : Array.isArray(governanceDecision.voterReasons) ? governanceDecision.voterReasons : [];
+  const decidedAt = optionalTrimmedString(input.decidedAt) ?? (/* @__PURE__ */ new Date()).toISOString();
+  const body = optionalTrimmedString(input.payload?.body) ?? [
+    "## Accepted Proposal Snapshot",
+    optionalTrimmedString(proposalSnapshot.body) ?? proposal.body.trim(),
+    "",
+    "## Governance Result",
+    JSON.stringify(voteResult, null, 2)
+  ].join("\n");
+  const decision = await writeContentRecord(repoPath, "decisions", {
+    ...input.payload ?? {},
+    projectId: input.projectId,
+    teamId: input.teamId,
+    slug: decisionSlug,
+    title,
+    status: "live",
+    decisionType: "approved",
+    description: optionalTrimmedString(input.payload?.description) ?? summary,
+    summary,
+    rationale: optionalTrimmedString(input.reason) ?? "Accepted by governance.",
+    authority: optionalTrimmedString(input.authority) ?? "governance",
+    relatedProposals: [proposalSlug],
+    immutable: true,
+    governanceDecisionId: optionalTrimmedString(input.governanceDecisionId) ?? optionalTrimmedString(governanceDecision.id),
+    governanceProviderId: optionalTrimmedString(input.governanceProviderId) ?? optionalTrimmedString(governanceDecision.governanceProviderId),
+    sourceProposalGovernanceId: optionalTrimmedString(input.proposalId) ?? optionalTrimmedString(governanceDecision.proposalId),
+    sourceProposalVersion: proposalVersion,
+    sourceProposalHash: sourceHash,
+    governanceRule: input.governanceRule ?? governanceDecision.governanceRule ?? {},
+    electorateSnapshot: input.electorateSnapshot ?? governanceDecision.electorateSnapshot ?? {},
+    voteResult,
+    voterReasons,
+    decidedAt,
+    decisionSnapshotHash: optionalTrimmedString(input.decisionSnapshotHash),
+    body
+  });
+  const originalProposal = {
+    ...proposal,
+    frontmatter: { ...proposal.frontmatter },
+    body: proposal.body
+  };
+  const changedPaths2 = [decision.path];
+  try {
+    proposal.frontmatter.decision = decisionSlug;
+    proposal.frontmatter.governanceStatus = "accepted";
+    proposal.frontmatter.proposalVersion = proposalVersion;
+    proposal.frontmatter.proposalContentHash = sourceHash;
+    changedPaths2.push(await writeParsedRecord(repoPath, proposal));
+  } catch (error) {
+    await rm(decisionTarget, { force: true }).catch(() => {
+    });
+    await writeParsedRecord(repoPath, originalProposal).catch(() => {
+    });
+    throw error;
+  }
+  return {
+    decision,
+    proposal: { collection: "proposals", slug: proposalSlug, href: `/app/work/proposals/${encodeURIComponent(proposalSlug)}` },
+    href: decision.href,
+    changedPaths: changedPaths2
+  };
+}
 async function changedPaths(repoPath) {
   const output = await runGit(["status", "--porcelain", "--untracked-files=all"], repoPath).catch(() => "");
   return output.split("\n").map((line) => line.slice(3).trim()).filter(Boolean);
@@ -609,6 +763,8 @@ async function executePlatformRepositoryOperation(operation, input, options) {
     output = await createRelatedContent(repoPath, input);
   } else if (operation === "create_decision_from_proposals") {
     output = await createDecisionFromProposals(repoPath, input);
+  } else if (operation === "create_decision_from_governance_proposal") {
+    output = await createDecisionFromGovernanceProposal(repoPath, input);
   } else if (operation === "apply_host_binding_config") {
     const hostBindingConfig = applyProjectLaunchHostBindingConfig({
       projectRoot: repoPath,
@@ -633,6 +789,8 @@ async function executePlatformRepositoryOperation(operation, input, options) {
       hostBindingAudit,
       changedPaths: []
     };
+  } else if (operation === "initialize_linked_repository") {
+    output = await initializeLinkedRepository(repoPath, input);
   } else {
     throw new Error(`Unsupported repository operation "${operation}".`);
   }

package/dist/operations/runtime.d.ts

@@ -1,7 +1,7 @@
-import { type TreeseedOperationContext, type TreeseedOperationRequest } from '../operations-types.ts';
+import { type TreeseedOperationContext, type TreeseedOperationRequest } from '../operations-types.js';
 export declare class TreeseedOperationsSdk {
-    listOperations(): import("../operations-types.ts").TreeseedOperationMetadata[];
-    findOperation(name: string | null | undefined): import("../operations-types.ts").TreeseedOperationMetadata | null;
+    listOperations(): import("../operations-types.js").TreeseedOperationMetadata[];
+    findOperation(name: string | null | undefined): import("../operations-types.js").TreeseedOperationMetadata | null;
     resolveProvider(cwd?: string): any;
     execute(request: TreeseedOperationRequest, contextOverrides?: Partial<TreeseedOperationContext>): Promise<any>;
 }

package/dist/operations/services/bootstrap-runner.d.ts

@@ -1,4 +1,4 @@
-import { type TreeseedTimingEntry } from '../../timing.ts';
+import { type TreeseedTimingEntry } from '../../timing.js';
 export type TreeseedBootstrapExecution = 'parallel' | 'sequential';
 export type TreeseedBootstrapStream = 'stdout' | 'stderr';
 export type TreeseedBootstrapWriter = (line: string, stream?: TreeseedBootstrapStream) => void;
@@ -24,14 +24,16 @@ export declare function runTreeseedBootstrapDag<TResult = unknown>({ nodes, exec
     timings?: TreeseedTimingEntry[];
 }): Promise<Map<string, TResult>>;
 export declare function sleep(milliseconds: number): Promise<void>;
-export declare function runPrefixedCommand(command: string, args: string[], { cwd, env, input, write, prefix, }: {
+export declare function runPrefixedCommand(command: string, args: string[], { cwd, env, input, write, prefix, timeoutMs, }: {
     cwd: string;
     env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
     input?: string;
     write?: TreeseedBootstrapWriter;
     prefix: TreeseedBootstrapTaskPrefix;
+    timeoutMs?: number;
 }): Promise<{
     status: number | null;
     stdout: string;
     stderr: string;
+    timedOut?: boolean;
 }>;

package/dist/operations/services/bootstrap-runner.js

@@ -99,7 +99,8 @@ async function runPrefixedCommand(command, args, {
   env = process.env,
   input,
   write,
-  prefix
+  prefix,
+  timeoutMs
 }) {
   return await new Promise((resolvePromise, reject) => {
     const childEnv = {};
@@ -117,6 +118,19 @@ async function runPrefixedCommand(command, args, {
     let stderr = "";
     let stdoutBuffer = "";
     let stderrBuffer = "";
+    let timedOut = false;
+    let forceKillTimer = null;
+    const timeoutTimer = Number.isFinite(timeoutMs) && Number(timeoutMs) > 0 ? setTimeout(() => {
+      timedOut = true;
+      const message = `Command timed out after ${Math.round(Number(timeoutMs) / 1e3)}s: ${command} ${args.join(" ")}`;
+      stderr += `${stderr.endsWith("\n") || stderr.length === 0 ? "" : "\n"}${message}
+`;
+      stderrBuffer += `${stderrBuffer.endsWith("\n") || stderrBuffer.length === 0 ? "" : "\n"}${message}
+`;
+      flush("stderr");
+      child.kill("SIGTERM");
+      forceKillTimer = setTimeout(() => child.kill("SIGKILL"), 5e3);
+    }, Number(timeoutMs)) : null;
     const flush = (stream, force = false) => {
       let buffer = stream === "stdout" ? stdoutBuffer : stderrBuffer;
       let newlineIndex = buffer.search(/\r?\n/u);
@@ -150,9 +164,15 @@ async function runPrefixedCommand(command, args, {
     });
     child.on("error", reject);
     child.on("close", (status) => {
+      if (timeoutTimer) {
+        clearTimeout(timeoutTimer);
+      }
+      if (forceKillTimer) {
+        clearTimeout(forceKillTimer);
+      }
       flush("stdout", true);
       flush("stderr", true);
-      resolvePromise({ status, stdout, stderr });
+      resolvePromise({ status, stdout, stderr, ...timedOut ? { timedOut: true } : {} });
     });
     if (input !== void 0) {
       child.stdin.end(input);

package/dist/operations/services/build-warning-policy.d.ts

@@ -0,0 +1,34 @@
+export interface BuildWarningRule {
+    label: string;
+    pattern: RegExp;
+}
+export interface BuildWarningScanOptions {
+    useDefaultPolicy?: boolean;
+    allow?: Array<string | RegExp>;
+}
+export type BuildWarningClassification = {
+    kind: 'not-warning';
+} | {
+    kind: 'allowed';
+    label: string;
+} | {
+    kind: 'unexpected';
+    line: string;
+};
+export interface BuildWarningSummary {
+    allowedWarnings: Map<string, number>;
+    unexpectedWarnings: string[];
+    record(line: unknown, options?: BuildWarningScanOptions): BuildWarningClassification;
+}
+export declare const DEFAULT_BUILD_WARNING_RULES: BuildWarningRule[];
+export declare function normalizeBuildWarningLine(line: unknown): string;
+export declare function createBuildWarningRules(options?: BuildWarningScanOptions): BuildWarningRule[];
+export declare function classifyBuildWarningLine(line: unknown, options?: BuildWarningScanOptions): BuildWarningClassification;
+export declare function createBuildWarningSummary(): BuildWarningSummary;
+export declare function mergeAllowedBuildWarnings(target: Map<string, number>, source: Map<string, number>): Map<string, number>;
+export declare function countAllowedBuildWarnings(allowedWarnings: Map<string, number>): number;
+export declare function formatAllowedBuildWarnings(allowedWarnings: Map<string, number>): string[];
+export declare function scanBuildWarningText(text: unknown, options?: BuildWarningScanOptions): {
+    allowedWarnings: Map<string, number>;
+    unexpectedWarnings: string[];
+};