@treeseed/sdk 0.10.28 → 0.12.4

package/dist/secrets-capability.js

@@ -0,0 +1,530 @@
+const TREESEED_SECRET_CUSTODY_MODES = [
+  "github_actions_secret_enclave",
+  "client_encrypted_escrow",
+  "metadata_only_reentry",
+  "host_env_injection",
+  "bootstrap_service_secret",
+  "provider_owned_secret",
+  "external_vault_reference"
+];
+const TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS = ["github-app"];
+const TREESEED_SECRET_CLASSES = [
+  "repository_access",
+  "workflow_secret",
+  "host_runtime_secret",
+  "provider_runtime_secret",
+  "bootstrap_service_secret",
+  "customer_project_secret"
+];
+const TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES = [
+  "full_repository_workspace",
+  "brokered_file_collection",
+  "workflow_operation_only"
+];
+const TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES = ["allowlisted"];
+const TREESEED_SECRET_METADATA_RECORD_STATUSES = ["active", "migrated", "tombstoned", "blocked"];
+const TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES = ["active", "drifted", "revoked", "blocked"];
+const TREESEED_GITHUB_APP_INSTALLATION_STATUSES = ["active", "drifted", "revoked", "suspended", "blocked"];
+const TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES = ["issued", "expired", "revoked", "blocked"];
+const TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES = ["active", "blocked", "drifted", "archived"];
+const TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES = [
+  "queued",
+  "dispatched",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled",
+  "blocked"
+];
+const TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES = ["issued", "expired", "revoked", "blocked"];
+const TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS = [
+  "clone",
+  "fetch",
+  "save",
+  "commit",
+  "push",
+  "pull_request",
+  "repository_update"
+];
+const TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES = [
+  "github_grant_revoked",
+  "github_grant_drifted",
+  "github_installation_missing",
+  "github_installation_revoked",
+  "github_installation_suspended",
+  "github_repository_removed",
+  "github_account_mismatch",
+  "github_permission_drift",
+  "github_app_token_blocked",
+  "github_environment_missing",
+  "workflow_trust_drift",
+  "workflow_dispatch_blocked",
+  "treedx_credential_expired",
+  "treedx_credential_revoked",
+  "assignment_lease_revoked"
+];
+const TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES = [
+  "active",
+  "migrated",
+  "expired",
+  "tombstoned",
+  "reentry_required"
+];
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringArrayIncludes(values, value) {
+  return typeof value === "string" && values.includes(value);
+}
+function addProblem(problems, path, code, message) {
+  problems.push({ path, code, message });
+}
+function containsTreeseedPlaintextSecretMaterial(value) {
+  if (!isRecord(value)) return false;
+  const forbiddenKeys = /* @__PURE__ */ new Set([
+    "plaintext",
+    "plainText",
+    "value",
+    "raw",
+    "rawSecret",
+    "secretValue",
+    "unencrypted",
+    "token",
+    "accessToken",
+    "privateKey",
+    "sshPrivateKey",
+    "passphrase",
+    "password",
+    "derivedKey",
+    "decrypted",
+    "decryptedPayload",
+    "decryptedSecret"
+  ]);
+  for (const [key, nested] of Object.entries(value)) {
+    if (forbiddenKeys.has(key)) return true;
+    if (isRecord(nested) && containsTreeseedPlaintextSecretMaterial(nested)) return true;
+  }
+  return false;
+}
+function isTreeseedSecretCustodyMode(value) {
+  return stringArrayIncludes(TREESEED_SECRET_CUSTODY_MODES, value);
+}
+function isTreeseedV1RepositoryCredentialProvider(value) {
+  return stringArrayIncludes(TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS, value);
+}
+function requiresClientSideSecretMaterial(mode) {
+  return mode === "client_encrypted_escrow";
+}
+function isApiServiceDecryptableCustomerSecret(metadata) {
+  return metadata.owner?.kind === "customer" && metadata.apiDecryptable === true;
+}
+function validateTreeseedWritableSecretMetadata(input, path = "$") {
+  const problems = [];
+  if (!isRecord(input)) {
+    addProblem(problems, path, "invalid_registry", "Secret metadata must be an object.");
+    return problems;
+  }
+  const metadata = input;
+  if (isApiServiceDecryptableCustomerSecret(metadata)) {
+    addProblem(
+      problems,
+      `${path}.apiDecryptable`,
+      "api_decryptable_customer_secret",
+      "Customer project secrets must not be decryptable by the TreeSeed API service."
+    );
+  }
+  if (metadata.owner?.kind === "customer" && metadata.plaintextAllowed === true) {
+    addProblem(
+      problems,
+      `${path}.plaintextAllowed`,
+      "api_decryptable_customer_secret",
+      "Customer project secrets must not allow plaintext persistence."
+    );
+  }
+  if (containsTreeseedPlaintextSecretMaterial(input)) {
+    addProblem(
+      problems,
+      path,
+      "plaintext_escrow_material",
+      "Secret metadata must not include plaintext secret material."
+    );
+  }
+  if (metadata.custodyMode === "client_encrypted_escrow") {
+    const hasEscrowReference = typeof input.escrowRecordId === "string" || typeof input.escrow_record_id === "string";
+    if (!hasEscrowReference) {
+      addProblem(
+        problems,
+        path,
+        "invalid_secret_custody_target",
+        "Client-encrypted escrow secret metadata must reference an escrow record."
+      );
+    }
+  }
+  if (metadata.custodyMode === "github_actions_secret_enclave") {
+    const target = input.githubSecretTarget ?? input.github_secret_target;
+    if (!isRecord(target)) {
+      addProblem(
+        problems,
+        path,
+        "invalid_secret_custody_target",
+        "GitHub Actions secret enclave metadata must include a GitHub secret target."
+      );
+    }
+  }
+  return problems;
+}
+function assertTreeseedWritableSecretMetadata(input) {
+  const problems = validateTreeseedWritableSecretMetadata(input);
+  if (problems.length > 0) {
+    const message = problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
+    throw new Error(`Invalid Treeseed secret metadata.
+${message}`);
+  }
+  return input;
+}
+function validateTreeseedClientEncryptedEscrowMetadata(input, path = "$") {
+  const problems = [];
+  if (!isRecord(input)) {
+    addProblem(problems, path, "invalid_registry", "Client-encrypted escrow metadata must be an object.");
+    return problems;
+  }
+  if (containsTreeseedPlaintextSecretMaterial(input)) {
+    addProblem(
+      problems,
+      path,
+      "plaintext_escrow_material",
+      "Client-encrypted escrow records must contain ciphertext metadata only."
+    );
+  }
+  if (typeof input.ciphertextRef !== "string" || !input.ciphertextRef.trim()) {
+    addProblem(
+      problems,
+      `${path}.ciphertextRef`,
+      "invalid_secret_custody_target",
+      "Client-encrypted escrow records must include a ciphertext reference."
+    );
+  }
+  const hasInlineCiphertext = typeof input.ciphertext === "string" && input.ciphertext.trim();
+  if (hasInlineCiphertext) {
+    for (const key of ["algorithm", "nonce", "salt", "kdf", "wrappingKeyId", "encryptionVersion"]) {
+      if (typeof input[key] !== "string" || !String(input[key]).trim()) {
+        addProblem(
+          problems,
+          `${path}.${key}`,
+          "invalid_secret_custody_target",
+          `Inline client-encrypted escrow envelopes must include ${key}.`
+        );
+      }
+    }
+    if (!isRecord(input.kdfParams)) {
+      addProblem(
+        problems,
+        `${path}.kdfParams`,
+        "invalid_secret_custody_target",
+        "Inline client-encrypted escrow envelopes must include KDF parameters."
+      );
+    }
+  }
+  if (isRecord(input.deploymentIntent)) {
+    const targetMode = input.deploymentIntent.targetMode;
+    if (targetMode !== void 0 && ![
+      "github_actions_secret_enclave",
+      "host_env_injection",
+      "metadata_only_reentry"
+    ].includes(String(targetMode))) {
+      addProblem(
+        problems,
+        `${path}.deploymentIntent.targetMode`,
+        "invalid_secret_custody_target",
+        "Client-encrypted escrow deployment intent must target GitHub Secrets, host injection, or metadata-only re-entry."
+      );
+    }
+  }
+  return problems;
+}
+function assertTreeseedClientEncryptedEscrowMetadata(input) {
+  const problems = validateTreeseedClientEncryptedEscrowMetadata(input);
+  if (problems.length > 0) {
+    const message = problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
+    throw new Error(`Invalid Treeseed client-encrypted escrow metadata.
+${message}`);
+  }
+  return input;
+}
+function buildTreeseedClientEncryptedEscrowEnvelope(input) {
+  return assertTreeseedClientEncryptedEscrowMetadata({
+    ...input,
+    metadata: input.metadata ?? {}
+  });
+}
+function summarizeTreeseedClientEncryptedEscrowStatus(input, now = /* @__PURE__ */ new Date()) {
+  const expired = Boolean(input.expiresAt && Date.parse(input.expiresAt) <= now.getTime());
+  const tombstoned = Boolean(input.tombstonedAt) || input.status === "tombstoned";
+  const migrated = Boolean(input.migratedTo) || input.status === "migrated";
+  const reentryRequired = input.status === "reentry_required" || expired && !migrated && !tombstoned;
+  const status = tombstoned ? "tombstoned" : migrated ? "migrated" : reentryRequired ? "reentry_required" : expired ? "expired" : input.status ?? "active";
+  return {
+    status,
+    escrowed: !migrated && !tombstoned,
+    migrated,
+    expired,
+    tombstoned,
+    reentryRequired,
+    migrationTarget: input.migratedTo ?? null,
+    expiresAt: input.expiresAt ?? null
+  };
+}
+function summarizeTreeseedWorkflowCloudAccessDiagnostics(operation) {
+  const trustPolicy = isRecord(operation.trustPolicy) ? operation.trustPolicy : isRecord(operation.metadata) && isRecord(operation.metadata.trustPolicy) ? operation.metadata.trustPolicy : {};
+  const cloudAccess = isRecord(trustPolicy.cloudAccess) ? trustPolicy.cloudAccess : {};
+  if (operation.secretBearing === true && cloudAccess.longLivedSecrets === true && cloudAccess.oidcPreferred !== true) {
+    return [{
+      code: "oidc_preferred_for_cloud_access",
+      severity: "warning",
+      message: "Secret-bearing cloud workflows should prefer GitHub OIDC over long-lived cloud API keys when the target cloud supports it."
+    }];
+  }
+  return [];
+}
+function validateTreeseedGitHubActionsEncryptedSecretDeployment(input, path = "$") {
+  const problems = [];
+  if (!isRecord(input)) {
+    addProblem(problems, path, "invalid_registry", "GitHub Actions encrypted secret deployment must be an object.");
+    return problems;
+  }
+  if (containsTreeseedPlaintextSecretMaterial(input)) {
+    addProblem(
+      problems,
+      path,
+      "plaintext_escrow_material",
+      "GitHub Actions secret deployment payloads must contain GitHub-encrypted values only."
+    );
+  }
+  for (const key of ["repository", "scope", "secretName", "encryptedValue", "keyId"]) {
+    if (typeof input[key] !== "string" || !String(input[key]).trim()) {
+      addProblem(
+        problems,
+        `${path}.${key}`,
+        "invalid_secret_custody_target",
+        `GitHub Actions encrypted secret deployment must include ${key}.`
+      );
+    }
+  }
+  if (input.scope === "environment" && (typeof input.environment !== "string" || !input.environment.trim())) {
+    addProblem(
+      problems,
+      `${path}.environment`,
+      "invalid_secret_custody_target",
+      "GitHub environment secret deployment must include an environment."
+    );
+  }
+  return problems;
+}
+function assertTreeseedGitHubActionsEncryptedSecretDeployment(input) {
+  const problems = validateTreeseedGitHubActionsEncryptedSecretDeployment(input);
+  if (problems.length > 0) {
+    const message = problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
+    throw new Error(`Invalid Treeseed GitHub Actions encrypted secret deployment.
+${message}`);
+  }
+  return input;
+}
+function validateTreeseedSecretsCapabilityRegistry(input) {
+  const problems = [];
+  if (!isRecord(input)) {
+    addProblem(problems, "$", "invalid_registry", "Secrets capability registry must be an object.");
+    return { ok: false, problems, registry: null };
+  }
+  const registry = input;
+  const repositoryCredentialProviders = isRecord(input.repositoryCredentialProviders) ? input.repositoryCredentialProviders : {};
+  for (const key of Object.keys(repositoryCredentialProviders)) {
+    if (key !== "githubApp") {
+      addProblem(
+        problems,
+        `repositoryCredentialProviders.${key}`,
+        "unsupported_repository_credential_provider",
+        "Only GitHub App repository credential providers are supported in v1."
+      );
+    }
+  }
+  const githubApp = repositoryCredentialProviders.githubApp;
+  if (githubApp !== void 0 && isRecord(githubApp) && githubApp.type !== "github-app") {
+    addProblem(
+      problems,
+      "repositoryCredentialProviders.githubApp.type",
+      "unsupported_repository_credential_provider",
+      'GitHub App provider config must use type "github-app".'
+    );
+  }
+  const secrets = Array.isArray(input.secrets) ? input.secrets : [];
+  secrets.forEach((secret, index) => {
+    if (!isRecord(secret)) return;
+    problems.push(...validateTreeseedWritableSecretMetadata(secret, `secrets.${index}`));
+  });
+  const operations = isRecord(input.workflowOperations) && Array.isArray(input.workflowOperations.operations) ? input.workflowOperations.operations : [];
+  operations.forEach((operation, index) => {
+    if (!isRecord(operation)) return;
+    const dispatch = isRecord(operation.dispatch) ? operation.dispatch : {};
+    if (operation.secretBearing === true && (dispatch.mode !== "allowlisted" || dispatch.arbitraryDispatch === true)) {
+      addProblem(
+        problems,
+        `workflowOperations.operations.${index}.dispatch`,
+        "arbitrary_secret_workflow_dispatch",
+        "Secret-bearing workflow operations must use allowlisted dispatch only."
+      );
+    }
+    if (operation.secretBearing === true && operation.providerSuppliedCommandsAllowed === true) {
+      addProblem(
+        problems,
+        `workflowOperations.operations.${index}.providerSuppliedCommandsAllowed`,
+        "arbitrary_secret_workflow_dispatch",
+        "Secret-bearing workflow operations must not run provider-supplied commands."
+      );
+    }
+    const trustPolicy = isRecord(operation.trustPolicy) ? operation.trustPolicy : isRecord(operation.metadata) && isRecord(operation.metadata.trustPolicy) ? operation.metadata.trustPolicy : {};
+    if (operation.secretBearing === true) {
+      if (!Array.isArray(trustPolicy.protectedRefs) || trustPolicy.protectedRefs.length === 0) {
+        addProblem(
+          problems,
+          `workflowOperations.operations.${index}.trustPolicy.protectedRefs`,
+          "arbitrary_secret_workflow_dispatch",
+          "Secret-bearing workflow operations must declare protected refs."
+        );
+      }
+      if (!Array.isArray(trustPolicy.allowedWorkflowFiles) || trustPolicy.allowedWorkflowFiles.length === 0) {
+        addProblem(
+          problems,
+          `workflowOperations.operations.${index}.trustPolicy.allowedWorkflowFiles`,
+          "arbitrary_secret_workflow_dispatch",
+          "Secret-bearing workflow operations must declare allowlisted workflow files."
+        );
+      }
+      if (trustPolicy.allowUntrustedCheckout === true) {
+        addProblem(
+          problems,
+          `workflowOperations.operations.${index}.trustPolicy.allowUntrustedCheckout`,
+          "arbitrary_secret_workflow_dispatch",
+          "Secret-bearing workflow operations must not run untrusted branch code."
+        );
+      }
+      if (trustPolicy.allowLocalActions === true) {
+        addProblem(
+          problems,
+          `workflowOperations.operations.${index}.trustPolicy.allowLocalActions`,
+          "arbitrary_secret_workflow_dispatch",
+          "Secret-bearing workflow operations must not execute repository-local actions unless a future trusted action scanner is implemented."
+        );
+      }
+      if (trustPolicy.artifactPolicy !== void 0 && !["none", "metadata_only"].includes(String(trustPolicy.artifactPolicy))) {
+        addProblem(
+          problems,
+          `workflowOperations.operations.${index}.trustPolicy.artifactPolicy`,
+          "arbitrary_secret_workflow_dispatch",
+          "Secret-bearing workflow operations may only expose no artifacts or metadata-only artifact observations in v1."
+        );
+      }
+      if (trustPolicy.cachePolicy !== void 0 && !["disabled", "metadata_only"].includes(String(trustPolicy.cachePolicy))) {
+        addProblem(
+          problems,
+          `workflowOperations.operations.${index}.trustPolicy.cachePolicy`,
+          "arbitrary_secret_workflow_dispatch",
+          "Secret-bearing workflow operations may only disable cache use or expose metadata-only cache observations in v1."
+        );
+      }
+    }
+  });
+  const trustedExecutionSets = isRecord(input.workflowOperations) && Array.isArray(input.workflowOperations.trustedExecutionSets) ? input.workflowOperations.trustedExecutionSets : [];
+  trustedExecutionSets.forEach((executionSet, index) => {
+    if (!isRecord(executionSet)) return;
+    if (executionSet.allowProviderSuppliedCommands === true) {
+      addProblem(
+        problems,
+        `workflowOperations.trustedExecutionSets.${index}.allowProviderSuppliedCommands`,
+        "arbitrary_secret_workflow_dispatch",
+        "Trusted execution sets must not allow provider-supplied commands in v1."
+      );
+    }
+    if (executionSet.allowLocalActions === true) {
+      addProblem(
+        problems,
+        `workflowOperations.trustedExecutionSets.${index}.allowLocalActions`,
+        "arbitrary_secret_workflow_dispatch",
+        "Trusted execution sets for secret-bearing operations must not allow repository-local actions in v1."
+      );
+    }
+    if (executionSet.allowUntrustedCheckout === true) {
+      addProblem(
+        problems,
+        `workflowOperations.trustedExecutionSets.${index}.allowUntrustedCheckout`,
+        "arbitrary_secret_workflow_dispatch",
+        "Trusted execution sets for secret-bearing operations must not allow untrusted branch checkout in v1."
+      );
+    }
+  });
+  if (isRecord(input.capacityProviderWorkspaceDefaults)) {
+    if (input.capacityProviderWorkspaceDefaults.receivesSecrets !== false) {
+      addProblem(
+        problems,
+        "capacityProviderWorkspaceDefaults.receivesSecrets",
+        "provider_secret_delegation",
+        "Capacity providers must receive handles or workspace access, not customer secrets."
+      );
+    }
+    if (input.capacityProviderWorkspaceDefaults.directSecretDelegation === true) {
+      addProblem(
+        problems,
+        "capacityProviderWorkspaceDefaults.directSecretDelegation",
+        "provider_secret_delegation",
+        "Direct provider/customer secret delegation is not supported."
+      );
+    }
+  }
+  if (isRecord(input.clientEncryptedEscrow) && Array.isArray(input.clientEncryptedEscrow.metadataRecords)) {
+    input.clientEncryptedEscrow.metadataRecords.forEach((record, index) => {
+      problems.push(...validateTreeseedClientEncryptedEscrowMetadata(record, `clientEncryptedEscrow.metadataRecords.${index}`));
+    });
+  }
+  return { ok: problems.length === 0, problems, registry };
+}
+function assertTreeseedSecretsCapabilityRegistry(input) {
+  const validation = validateTreeseedSecretsCapabilityRegistry(input);
+  if (!validation.ok || validation.registry === null) {
+    const message = validation.problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
+    throw new Error(`Invalid Treeseed secrets capability registry.
+${message}`);
+  }
+  return validation.registry;
+}
+export {
+  TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES,
+  TREESEED_GITHUB_APP_INSTALLATION_STATUSES,
+  TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES,
+  TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES,
+  TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES,
+  TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES,
+  TREESEED_SECRET_CLASSES,
+  TREESEED_SECRET_CUSTODY_MODES,
+  TREESEED_SECRET_METADATA_RECORD_STATUSES,
+  TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS,
+  TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES,
+  TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS,
+  TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES,
+  TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES,
+  TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES,
+  assertTreeseedClientEncryptedEscrowMetadata,
+  assertTreeseedGitHubActionsEncryptedSecretDeployment,
+  assertTreeseedSecretsCapabilityRegistry,
+  assertTreeseedWritableSecretMetadata,
+  buildTreeseedClientEncryptedEscrowEnvelope,
+  containsTreeseedPlaintextSecretMaterial,
+  isApiServiceDecryptableCustomerSecret,
+  isTreeseedSecretCustodyMode,
+  isTreeseedV1RepositoryCredentialProvider,
+  requiresClientSideSecretMaterial,
+  summarizeTreeseedClientEncryptedEscrowStatus,
+  summarizeTreeseedWorkflowCloudAccessDiagnostics,
+  validateTreeseedClientEncryptedEscrowMetadata,
+  validateTreeseedGitHubActionsEncryptedSecretDeployment,
+  validateTreeseedSecretsCapabilityRegistry,
+  validateTreeseedWritableSecretMetadata
+};

package/dist/seeds/normalize.js

@@ -83,6 +83,7 @@ function normalizeSeedResources(manifest, selected) {
         description: project.description ?? null,
         kind: project.kind ?? null,
         repository: project.repository,
+        architecture: project.architecture,
         metadata: withMetadata(manifest, project.key, project.metadata)
       }
     });

package/dist/seeds/planner.js

@@ -40,9 +40,38 @@ function toAction(resource, currentByKey) {
     action: "create"
   };
 }
+function orderRecipeSteps(recipe) {
+  const byId = new Map(recipe.steps.map((step) => [step.id, step]));
+  const ordered = [];
+  const visited = /* @__PURE__ */ new Set();
+  const visit = (step) => {
+    if (visited.has(step.id)) return;
+    for (const dependency of step.dependsOn) {
+      const dependencyStep = byId.get(dependency);
+      if (dependencyStep) visit(dependencyStep);
+    }
+    visited.add(step.id);
+    ordered.push(step);
+  };
+  for (const step of recipe.steps) {
+    visit(step);
+  }
+  return ordered;
+}
+function planRecipes(manifest, environments) {
+  return manifest.operationRecipes.map((recipe) => {
+    const selected = recipe.environments.some((environment) => environments.includes(environment));
+    return {
+      ...recipe,
+      selected,
+      orderedSteps: selected ? orderRecipeSteps(recipe) : []
+    };
+  });
+}
 function createSeedPlan(input) {
   const currentByKey = new Map((input.currentResources ?? []).map((resource) => [resource.key, resource]));
   const actions = normalizeSeedResources(input.manifest, input.environments).map((resource) => toAction(resource, currentByKey));
+  const recipes = planRecipes(input.manifest, input.environments);
   const summary = emptySummary();
   for (const action of actions) {
     summary[action.action] += 1;
@@ -58,6 +87,7 @@ function createSeedPlan(input) {
     environments: input.environments,
     summary,
     actions,
+    recipes,
     diagnostics: input.diagnostics ?? [],
     manifestPath: input.manifestPath
   };
@@ -95,6 +125,14 @@ function formatSeedPlan(plan) {
   if (lines[lines.length - 1] !== "") {
     lines.push("");
   }
+  const selectedRecipes = plan.recipes.filter((recipe) => recipe.selected);
+  if (selectedRecipes.length > 0) {
+    lines.push("Recipes:");
+    for (const recipe of selectedRecipes) {
+      lines.push(`  ${recipe.id}: ${recipe.orderedSteps.length} step${recipe.orderedSteps.length === 1 ? "" : "s"}`);
+    }
+    lines.push("");
+  }
   lines.push(
     "Summary:",
     `  create: ${plan.summary.create}`,