@treeseed/sdk 0.11.0 → 0.12.5

package/dist/operations/services/release-history.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { spawnSync } from "node:child_process";
+import { runTreeseedGit } from "./git-runner.js";
 const SECTION_ORDER = [
   "Added",
   "Changed",
@@ -10,10 +10,9 @@ const SECTION_ORDER = [
   "Dependencies"
 ];
 function runGit(repoDir, args) {
-  const result = spawnSync("git", args, {
+  const result = runTreeseedGit(args, {
     cwd: repoDir,
-    stdio: "pipe",
-    encoding: "utf8"
+    mode: "read"
   });
   if (result.status !== 0) {
     throw new Error(result.stderr?.trim() || result.stdout?.trim() || `git ${args.join(" ")} failed`);

package/dist/operations/services/release-proof-ledger.d.ts

@@ -0,0 +1,13 @@
+import { type TreeseedProofDriver, type TreeseedProofInput, type TreeseedProofRecord } from './release-proof.js';
+export declare function readProofLedger(root: string): TreeseedProofRecord[];
+export declare function writeProofRecord(root: string, record: TreeseedProofRecord): void;
+export declare function findReusableProof(root: string, input: TreeseedProofInput & {
+    requiredDriver?: TreeseedProofDriver;
+}): TreeseedProofRecord | null;
+export declare function invalidateProofs(root: string, predicate: (record: TreeseedProofRecord) => boolean): void;
+export declare function cleanProofLedger(root: string, options: {
+    olderThanMs: number;
+    now?: number;
+}): {
+    removed: number;
+};

package/dist/operations/services/release-proof-ledger.js

@@ -0,0 +1,81 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import {
+  computeProofInputHash,
+  proofIdFor
+} from "./release-proof.js";
+const PROOF_DIR = ".treeseed/workflow/proofs";
+function proofRoot(root) {
+  return resolve(root, PROOF_DIR);
+}
+function proofPath(root, proofId) {
+  return resolve(proofRoot(root), `${proofId}.json`);
+}
+function isProofRecord(value) {
+  return Boolean(value && typeof value === "object" && value.schemaVersion === 1 && typeof value.proofId === "string" && typeof value.status === "string");
+}
+function readProofLedger(root) {
+  const dir = proofRoot(root);
+  if (!existsSync(dir)) return [];
+  const records = [];
+  for (const entry of readdirSync(dir)) {
+    if (!entry.endsWith(".json")) continue;
+    try {
+      const parsed = JSON.parse(readFileSync(resolve(dir, entry), "utf8"));
+      if (isProofRecord(parsed)) records.push(parsed);
+    } catch {
+    }
+  }
+  return records.sort((left, right) => String(right.finishedAt ?? "").localeCompare(String(left.finishedAt ?? "")));
+}
+function writeProofRecord(root, record) {
+  const filePath = proofPath(root, record.proofId);
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, `${JSON.stringify(record, null, 2)}
+`, "utf8");
+}
+function findReusableProof(root, input) {
+  const inputHash = input.inputs.inputHash || computeProofInputHash({
+    subject: input.subject,
+    driver: input.driver,
+    inputs: {
+      ...input.inputs,
+      dependencyProofIds: [...input.inputs.dependencyProofIds].sort(),
+      inputHash: void 0
+    }
+  });
+  const proofId = proofIdFor({
+    subject: input.subject,
+    driver: input.driver,
+    inputs: {
+      ...input.inputs,
+      inputHash,
+      dependencyProofIds: [...input.inputs.dependencyProofIds].sort()
+    }
+  });
+  return readProofLedger(root).find((record) => record.proofId === proofId && record.status === "passed" && record.reusable === true && record.inputs.inputHash === inputHash && record.driver === (input.requiredDriver ?? input.driver)) ?? null;
+}
+function invalidateProofs(root, predicate) {
+  for (const record of readProofLedger(root)) {
+    if (!predicate(record)) continue;
+    rmSync(proofPath(root, record.proofId), { force: true });
+  }
+}
+function cleanProofLedger(root, options) {
+  const now = options.now ?? Date.now();
+  let removed = 0;
+  for (const record of readProofLedger(root)) {
+    const finished = Date.parse(record.finishedAt ?? record.startedAt);
+    if (!Number.isFinite(finished) || now - finished < options.olderThanMs) continue;
+    rmSync(proofPath(root, record.proofId), { force: true });
+    removed += 1;
+  }
+  return { removed };
+}
+export {
+  cleanProofLedger,
+  findReusableProof,
+  invalidateProofs,
+  readProofLedger,
+  writeProofRecord
+};

package/dist/operations/services/release-proof-planner.d.ts

@@ -0,0 +1,48 @@
+import { type TreeseedPackageAdapter, type TreeseedPackageCommand } from './package-adapters.js';
+import { type TreeseedProofDriver, type TreeseedProofInput, type TreeseedProofRecord } from './release-proof.js';
+export type TreeseedProofTarget = 'local' | 'staging' | 'prod';
+export type TreeseedProofPlanMode = 'plan' | 'run' | 'status' | 'failures' | 'explain';
+export type TreeseedProofPlanSubject = TreeseedProofInput & {
+    workflow: string | null;
+    command: string | null;
+    commandSpec: TreeseedPackageCommand | null;
+    authority: 'authoritative' | 'advisory';
+    reusableProof: TreeseedProofRecord | null;
+    rerunReasons: string[];
+};
+export type TreeseedProofPlan = {
+    target: TreeseedProofTarget;
+    driver: TreeseedProofDriver;
+    subjects: TreeseedProofPlanSubject[];
+    summary: {
+        subjects: number;
+        reusable: number;
+        pending: number;
+    };
+};
+export declare function hostedWorkflowForPackage(adapter: TreeseedPackageAdapter): string;
+export declare function buildTreeseedProofPlan(input: {
+    root: string;
+    target?: TreeseedProofTarget;
+    driver?: TreeseedProofDriver;
+    subject?: string | null;
+}): TreeseedProofPlan;
+export declare function summarizeTreeseedProofLedger(root: string): {
+    records: TreeseedProofRecord[];
+    latest: TreeseedProofRecord;
+    failures: TreeseedProofRecord[];
+    slowest: {
+        subject: string;
+        driver: TreeseedProofDriver;
+        durationMs: number | null;
+        status: import("./release-proof.js").TreeseedProofStatus;
+        reason: string;
+    }[];
+    summary: {
+        records: number;
+        passed: number;
+        failed: number;
+        pending: number;
+        reusable: number;
+    };
+};

package/dist/operations/services/release-proof-planner.js

@@ -0,0 +1,195 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { basename, resolve } from "node:path";
+import { discoverTreeseedPackageAdapters } from "./package-adapters.js";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "./git-runner.js";
+import {
+  computeProofInputHash
+} from "./release-proof.js";
+import { findReusableProof, readProofLedger } from "./release-proof-ledger.js";
+function runGit(args, cwd) {
+  try {
+    return runTreeseedGitText(args, {
+      cwd,
+      mode: classifyTreeseedGitMode(args),
+      timeoutMs: 12e4,
+      maxBuffer: 1024 * 1024 * 8
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function fileSha256(filePath) {
+  if (!existsSync(filePath)) return null;
+  return createHash("sha256").update(readFileSync(filePath)).digest("hex");
+}
+function repositoryFor(adapter) {
+  const repository = adapter.metadata.repository;
+  if (typeof repository === "string" && repository.trim()) return repository.trim();
+  if (repository && typeof repository === "object" && !Array.isArray(repository)) {
+    const url = repository.url;
+    if (typeof url === "string") {
+      return url.replace(/^git\+/u, "").replace(/^ssh:\/\/git@github\.com[:/]/u, "").replace(/^git@github\.com:/u, "").replace(/^https:\/\/github\.com\//u, "").replace(/\.git$/u, "").replace(/\/$/u, "");
+    }
+  }
+  return null;
+}
+function hostedWorkflowForPackage(adapter) {
+  const configured = adapter.metadata.hostedVerifyWorkflow;
+  if (typeof configured === "string" && configured.trim()) return configured.trim().replace(/^\.github\/workflows\//u, "");
+  const workflowCheck = adapter.releaseChecks.find((check) => check.kind === "github-workflow");
+  if (workflowCheck?.detail) return basename(workflowCheck.detail);
+  if (adapter.id === "treedx" || adapter.kind === "beam-elixir-rust") return "release-gate.yml";
+  return "verify.yml";
+}
+function commandForPackage(adapter, driver) {
+  const command = commandSpecForPackage(adapter, driver);
+  return command ? [command.command, ...command.args].join(" ") : null;
+}
+function commandSpecForPackage(adapter, driver) {
+  if (driver === "act") return adapter.verifyCommands.local ? {
+    ...adapter.verifyCommands.local,
+    label: "verify:action",
+    command: "npm",
+    args: ["run", "verify:action"]
+  } : null;
+  if (driver !== "local") return null;
+  return adapter.verifyCommands.release ?? adapter.verifyCommands.local ?? adapter.verifyCommands.fast;
+}
+function subjectForPackage(adapter) {
+  return {
+    kind: "package",
+    id: `package:${adapter.id}`,
+    name: adapter.id,
+    repoPath: adapter.dir,
+    repository: repositoryFor(adapter),
+    branch: runGit(["branch", "--show-current"], adapter.dir),
+    headSha: runGit(["rev-parse", "HEAD"], adapter.dir)
+  };
+}
+function internalDependencyHeadShas(adapter, adaptersByName) {
+  const packageJsonPath = resolve(adapter.dir, "package.json");
+  if (!existsSync(packageJsonPath)) return {};
+  const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+  const sections = ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"];
+  const heads = {};
+  for (const section of sections) {
+    const entries = parsed[section] && typeof parsed[section] === "object" && !Array.isArray(parsed[section]) ? parsed[section] : {};
+    for (const name of Object.keys(entries)) {
+      const dependency = adaptersByName.get(name);
+      if (!dependency) continue;
+      heads[name] = runGit(["rev-parse", "HEAD"], dependency.dir);
+    }
+  }
+  return heads;
+}
+function proofInputForPackage(root, adapter, driver, dependencyProofIds, adaptersByName) {
+  const workflow = hostedWorkflowForPackage(adapter);
+  const dockerfile = adapter.artifacts.find((artifact) => artifact.dockerfile)?.dockerfile;
+  const sourceHashes = {
+    head: runGit(["rev-parse", "HEAD"], adapter.dir),
+    ...Object.fromEntries(Object.entries(internalDependencyHeadShas(adapter, adaptersByName)).map(([name, sha]) => [`dependency:${name}`, sha]))
+  };
+  const baseInputs = {
+    topologyHash: computeProofInputHash({
+      packageId: adapter.id,
+      kind: adapter.kind,
+      workflow,
+      command: commandForPackage(adapter, driver),
+      artifacts: adapter.artifacts,
+      dependencyProofIds
+    }),
+    packageJsonHash: fileSha256(resolve(adapter.dir, "package.json")),
+    lockfileHash: adapter.kind === "node-typescript" ? fileSha256(resolve(adapter.dir, "package-lock.json")) : fileSha256(resolve(adapter.dir, "Cargo.lock")) ?? fileSha256(resolve(adapter.dir, "mix.lock")),
+    manifestHash: fileSha256(adapter.manifestPath ?? resolve(adapter.dir, "treeseed.package.yaml")),
+    workflowHash: fileSha256(resolve(adapter.dir, ".github", "workflows", workflow)),
+    dockerfileHash: dockerfile ? fileSha256(resolve(adapter.dir, dockerfile)) : null,
+    sourceHashes,
+    dependencyProofIds
+  };
+  return {
+    subject: subjectForPackage(adapter),
+    driver,
+    inputs: {
+      ...baseInputs,
+      inputHash: computeProofInputHash({
+        root,
+        subject: subjectForPackage(adapter),
+        driver,
+        ...baseInputs
+      })
+    }
+  };
+}
+function selectAdapters(root, subject) {
+  const adapters = discoverTreeseedPackageAdapters(root);
+  if (!subject) return adapters;
+  const normalized = subject.replace(/^package:/u, "");
+  return adapters.filter((adapter) => adapter.id === normalized || adapter.name === normalized || `package:${adapter.id}` === subject);
+}
+function buildTreeseedProofPlan(input) {
+  const target = input.target ?? "staging";
+  const driver = input.driver ?? "github-hosted";
+  const subjects = [];
+  const proofIds = /* @__PURE__ */ new Map();
+  const selectedAdapters = selectAdapters(input.root, input.subject);
+  const adaptersByName = new Map(discoverTreeseedPackageAdapters(input.root).flatMap((adapter) => [[adapter.id, adapter], [adapter.name, adapter]]));
+  for (const adapter of selectedAdapters) {
+    const dependencyProofIds = [];
+    const proofInput = proofInputForPackage(input.root, adapter, driver, dependencyProofIds, adaptersByName);
+    const reusableProof = findReusableProof(input.root, proofInput);
+    if (reusableProof) proofIds.set(adapter.id, reusableProof.proofId);
+    const workflow = driver === "github-hosted" ? hostedWorkflowForPackage(adapter) : null;
+    const command = driver === "github-hosted" ? null : commandForPackage(adapter, driver);
+    const commandSpec = driver === "github-hosted" ? null : commandSpecForPackage(adapter, driver);
+    subjects.push({
+      ...proofInput,
+      workflow,
+      command,
+      commandSpec,
+      authority: driver === "github-hosted" ? "authoritative" : "advisory",
+      reusableProof,
+      rerunReasons: reusableProof ? [] : ["No reusable passed proof record matches this subject, driver, and input hash."]
+    });
+  }
+  return {
+    target,
+    driver,
+    subjects,
+    summary: {
+      subjects: subjects.length,
+      reusable: subjects.filter((subject) => subject.reusableProof).length,
+      pending: subjects.filter((subject) => !subject.reusableProof).length
+    }
+  };
+}
+function summarizeTreeseedProofLedger(root) {
+  const records = readProofLedger(root);
+  const failures = records.filter((record) => record.status === "failed" || record.status === "blocked");
+  const latest = records[0] ?? null;
+  const slowest = [...records].filter((record) => typeof record.durationMs === "number").sort((left, right) => (right.durationMs ?? 0) - (left.durationMs ?? 0)).slice(0, 10).map((record) => ({
+    subject: record.subject.id,
+    driver: record.driver,
+    durationMs: record.durationMs,
+    status: record.status,
+    reason: record.invalidationReasons[0] ?? (record.reusable ? "Proof record is reusable." : "Proof record is not reusable.")
+  }));
+  return {
+    records,
+    latest,
+    failures,
+    slowest,
+    summary: {
+      records: records.length,
+      passed: records.filter((record) => record.status === "passed").length,
+      failed: failures.length,
+      pending: records.filter((record) => record.status === "pending").length,
+      reusable: records.filter((record) => record.reusable).length
+    }
+  };
+}
+export {
+  buildTreeseedProofPlan,
+  hostedWorkflowForPackage,
+  summarizeTreeseedProofLedger
+};

package/dist/operations/services/release-proof-runner.d.ts

@@ -0,0 +1,16 @@
+import { type TreeseedProofDriver, type TreeseedProofRecord } from './release-proof.js';
+import { type TreeseedProofPlan, type TreeseedProofTarget } from './release-proof-planner.js';
+export type TreeseedProofRunResult = {
+    plan: TreeseedProofPlan;
+    records: TreeseedProofRecord[];
+    reused: TreeseedProofRecord[];
+    failures: TreeseedProofRecord[];
+    ok: boolean;
+};
+export declare function runTreeseedProof(input: {
+    root: string;
+    target?: TreeseedProofTarget;
+    driver?: TreeseedProofDriver;
+    subject?: string | null;
+    write?: (line: string, stream?: 'stdout' | 'stderr') => void;
+}): Promise<TreeseedProofRunResult>;

package/dist/operations/services/release-proof-runner.js

@@ -0,0 +1,169 @@
+import {
+  createProofRecord
+} from "./release-proof.js";
+import { spawnSync } from "node:child_process";
+import { maybeResolveGitHubRepositorySlug } from "./github-automation.js";
+import { writeProofRecord } from "./release-proof-ledger.js";
+import { buildTreeseedProofPlan } from "./release-proof-planner.js";
+import { inspectGitHubActionsVerification } from "./github-actions-verification.js";
+function workflowRecordFromInspection(input) {
+  const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+  return createProofRecord({
+    subject: input.subject.subject,
+    inputs: input.subject.inputs,
+    driver: input.subject.driver,
+    status: input.status,
+    startedAt: input.startedAt,
+    finishedAt,
+    reusable: input.status === "passed",
+    invalidationReasons: input.status === "passed" ? [] : [input.workflow?.message ?? "Hosted GitHub workflow did not pass."],
+    result: input.workflow && input.subject.subject.repository ? {
+      workflow: {
+        repository: input.subject.subject.repository,
+        workflow: input.workflow.workflow,
+        runId: input.workflow.runId,
+        url: input.workflow.url,
+        conclusion: input.workflow.conclusion,
+        failedJobs: input.workflow.failedJobs.map((job) => ({
+          id: job.id,
+          name: job.name,
+          url: job.url,
+          failedSteps: job.failedSteps.map((step) => step.name),
+          ...job.logExcerpt ? { logExcerpt: job.logExcerpt } : {}
+        }))
+      }
+    } : {}
+  });
+}
+async function runHostedProof(root, subject) {
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (!subject.subject.repository && maybeResolveGitHubRepositorySlug(subject.subject.repoPath) == null) {
+    return createProofRecord({
+      subject: subject.subject,
+      inputs: subject.inputs,
+      driver: subject.driver,
+      status: "skipped",
+      startedAt,
+      reusable: false,
+      invalidationReasons: ["Proof subject is not backed by a GitHub repository in this local test workspace."]
+    });
+  }
+  if (!subject.subject.repository || !subject.subject.branch || !subject.subject.headSha || !subject.workflow) {
+    return createProofRecord({
+      subject: subject.subject,
+      inputs: subject.inputs,
+      driver: subject.driver,
+      status: "blocked",
+      startedAt,
+      reusable: false,
+      invalidationReasons: ["Repository, branch, head SHA, or workflow is unavailable for hosted proof."]
+    });
+  }
+  const report = await inspectGitHubActionsVerification([{
+    name: subject.subject.name,
+    repoPath: subject.subject.repoPath,
+    repository: subject.subject.repository,
+    branch: subject.subject.branch,
+    headSha: subject.subject.headSha,
+    workflows: [subject.workflow],
+    kind: subject.subject.kind === "root" ? "root" : "package",
+    missingIsFailure: true
+  }], {
+    includeLogs: true,
+    logLines: 120
+  });
+  const workflow = report.repositories[0]?.workflows[0] ?? null;
+  const status = workflow?.state === "success" ? "passed" : workflow?.state === "pending" ? "pending" : "failed";
+  return workflowRecordFromInspection({ root, subject, workflow, startedAt, status });
+}
+function advisorySkippedProof(subject) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return createProofRecord({
+    subject: subject.subject,
+    inputs: subject.inputs,
+    driver: subject.driver,
+    status: "skipped",
+    startedAt: now,
+    finishedAt: now,
+    reusable: false,
+    invalidationReasons: [
+      subject.driver === "act" ? "Local action simulation is advisory and cannot satisfy authoritative hosted proof." : "Only github-hosted proof execution is enabled for this proof runner slice."
+    ],
+    result: subject.command ? {
+      command: { command: subject.command, cwd: subject.subject.repoPath, exitCode: null }
+    } : {}
+  });
+}
+function runLocalProof(subject) {
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  if (!subject.commandSpec) {
+    return createProofRecord({
+      subject: subject.subject,
+      inputs: subject.inputs,
+      driver: subject.driver,
+      status: "blocked",
+      startedAt,
+      reusable: false,
+      invalidationReasons: ["No local proof command is declared for this subject."]
+    });
+  }
+  const result = spawnSync(subject.commandSpec.command, subject.commandSpec.args, {
+    cwd: subject.commandSpec.cwd || subject.subject.repoPath,
+    env: {
+      ...process.env,
+      TREESEED_VERIFY_DRIVER: "direct",
+      TMPDIR: process.env.TMPDIR ?? "/tmp"
+    },
+    stdio: "inherit",
+    shell: false
+  });
+  const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const exitCode = typeof result.status === "number" ? result.status : null;
+  const errorMessage = result.error instanceof Error ? result.error.message : null;
+  return createProofRecord({
+    subject: subject.subject,
+    inputs: subject.inputs,
+    driver: subject.driver,
+    status: exitCode === 0 ? "passed" : "failed",
+    startedAt,
+    finishedAt,
+    reusable: exitCode === 0,
+    invalidationReasons: exitCode === 0 ? [] : [`Local proof command failed${errorMessage ? `: ${errorMessage}` : exitCode == null ? "." : ` with exit code ${exitCode}.`}`],
+    result: {
+      command: {
+        command: [subject.commandSpec.command, ...subject.commandSpec.args].join(" "),
+        cwd: subject.commandSpec.cwd || subject.subject.repoPath,
+        exitCode
+      }
+    }
+  });
+}
+async function runTreeseedProof(input) {
+  const plan = buildTreeseedProofPlan(input);
+  const records = [];
+  const reused = [];
+  for (const subject of plan.subjects) {
+    if (subject.reusableProof) {
+      reused.push(subject.reusableProof);
+      continue;
+    }
+    input.write?.(`[proof] Proving ${subject.subject.id} with ${subject.driver}${subject.workflow ? ` (${subject.workflow})` : ""}.`);
+    const record = subject.driver === "github-hosted" ? await runHostedProof(input.root, subject) : subject.driver === "local" ? runLocalProof(subject) : advisorySkippedProof(subject);
+    writeProofRecord(input.root, record);
+    records.push(record);
+    if (record.status === "failed" || record.status === "blocked") {
+      break;
+    }
+  }
+  const failures = [...records, ...reused].filter((record) => record.status === "failed" || record.status === "blocked" || record.driver === "github-hosted" && record.status === "pending");
+  return {
+    plan,
+    records,
+    reused,
+    failures,
+    ok: failures.length === 0 && records.every((record) => record.status === "passed" || record.status === "skipped")
+  };
+}
+export {
+  runTreeseedProof
+};

package/dist/operations/services/release-proof.d.ts

@@ -0,0 +1,81 @@
+export type TreeseedProofSubjectKind = 'package' | 'root' | 'hosted-app' | 'provider-resource' | 'workflow' | 'scene';
+export type TreeseedProofStatus = 'passed' | 'failed' | 'pending' | 'blocked' | 'skipped';
+export type TreeseedProofDriver = 'local' | 'act' | 'github-hosted' | 'railway-live' | 'cloudflare-live' | 'reconcile-live';
+export type TreeseedProofSubject = {
+    kind: TreeseedProofSubjectKind;
+    id: string;
+    name: string;
+    repoPath: string;
+    repository: string | null;
+    branch: string | null;
+    headSha: string | null;
+};
+export type TreeseedProofInputs = {
+    inputHash: string;
+    topologyHash: string;
+    packageJsonHash?: string | null;
+    lockfileHash?: string | null;
+    manifestHash?: string | null;
+    workflowHash?: string | null;
+    dockerfileHash?: string | null;
+    sourceHashes?: Record<string, string | null>;
+    dependencyProofIds: string[];
+};
+export type TreeseedProofRecord = {
+    schemaVersion: 1;
+    proofId: string;
+    subject: TreeseedProofSubject;
+    inputs: TreeseedProofInputs;
+    driver: TreeseedProofDriver;
+    status: TreeseedProofStatus;
+    startedAt: string;
+    finishedAt: string | null;
+    durationMs: number | null;
+    result: {
+        workflow?: {
+            repository: string;
+            workflow: string;
+            runId: number | null;
+            url: string | null;
+            conclusion: string | null;
+            failedJobs: Array<{
+                id: number;
+                name: string;
+                url: string | null;
+                failedSteps: string[];
+                logExcerpt?: string | null;
+            }>;
+        };
+        command?: {
+            command: string;
+            cwd: string;
+            exitCode: number | null;
+        };
+        liveVerification?: Record<string, unknown>;
+    };
+    reusable: boolean;
+    invalidationReasons: string[];
+};
+export type TreeseedProofInput = {
+    subject: TreeseedProofSubject;
+    inputs: Omit<TreeseedProofInputs, 'inputHash'> & {
+        inputHash?: string;
+    };
+    driver: TreeseedProofDriver;
+};
+export declare function sha256(value: string): string;
+export declare function computeProofInputHash(input: TreeseedProofInput | Record<string, unknown>): string;
+export declare function proofIdFor(input: TreeseedProofInput): string;
+export declare function createProofRecord(input: {
+    subject: TreeseedProofSubject;
+    inputs: Omit<TreeseedProofInputs, 'inputHash'> & {
+        inputHash?: string;
+    };
+    driver: TreeseedProofDriver;
+    status: TreeseedProofStatus;
+    startedAt: string;
+    finishedAt?: string | null;
+    result?: TreeseedProofRecord['result'];
+    reusable?: boolean;
+    invalidationReasons?: string[];
+}): TreeseedProofRecord;