@treeseed/sdk 0.11.0 → 0.12.5

package/dist/scenes/publish-plan.js

@@ -0,0 +1,248 @@
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { sceneErrorDiagnostic, sceneWarningDiagnostic } from "./diagnostics.js";
+import {
+  DEFAULT_TREESEED_SCENE_PUBLICATION_TARGETS,
+  createTreeseedScenePublishDestinations,
+  destinationIdsForTreeseedScenePublishedArtifact,
+  isTreeseedSceneExternalPublishTarget
+} from "./publish-destinations.js";
+import { resolveTreeseedSceneRunRoot } from "./inspect.js";
+import { validateTreeseedScene } from "./planner.js";
+import { publishTreeseedSceneEvidence } from "./publish.js";
+import { appendTreeseedScenePublishPlanPaths, writeTreeseedScenePublishPlanReport } from "./publish-plan-report.js";
+function readJson(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function safeExportPath(exportRoot, relativePath) {
+  return join(exportRoot, relativePath.replace(/^(\.\.[/\\])+/u, "").replace(/^[/\\]+/u, ""));
+}
+function failedReport(input) {
+  const blockers = input.blockers ?? input.diagnostics.filter((diagnostic) => diagnostic.severity === "error");
+  return {
+    ok: false,
+    phase: 11,
+    sceneId: input.sceneId ?? null,
+    sourceRunId: input.sourceRunId ?? null,
+    scenePath: input.scenePath,
+    runRoot: input.runRoot,
+    publishRoot: input.publishRoot ?? (input.runRoot ? join(input.runRoot, "publish") : null),
+    publishPlanRoot: input.publishPlanRoot ?? (input.runRoot ? join(input.runRoot, "publish-plan") : null),
+    manifest: input.manifest ?? null,
+    paths: input.paths ?? null,
+    diagnostics: input.diagnostics,
+    warnings: input.warnings ?? input.diagnostics.filter((diagnostic) => diagnostic.severity === "warning"),
+    blockers
+  };
+}
+function validateTargets(targets) {
+  return targets.filter((target) => !isTreeseedSceneExternalPublishTarget(target)).map((target) => sceneErrorDiagnostic("scene.publish_plan_target_unsupported", `Unsupported scene publication target "${String(target)}".`, "target"));
+}
+function buildTreeseedScenePublishPlanManifest(input) {
+  const diagnostics = [...input.publish.diagnostics, ...validateTargets(input.targets)];
+  if (input.targets.includes("release-evidence") && input.publish.workflowStatus !== "passed") {
+    diagnostics.push(sceneErrorDiagnostic("scene.publish_plan_release_blocked", "Release-evidence publication planning is blocked until the scene workflow passes.", "target"));
+  }
+  const validTargets = input.targets.filter(isTreeseedSceneExternalPublishTarget);
+  const destinations = createTreeseedScenePublishDestinations({ runRoot: input.runRoot, targets: validTargets });
+  const artifacts = input.publish.artifacts.map((artifact) => ({
+    id: artifact.id,
+    kind: artifact.kind,
+    sourcePath: artifact.publishedPath ?? artifact.sourcePath,
+    relativePath: artifact.relativePath,
+    destinationIds: destinationIdsForTreeseedScenePublishedArtifact({ artifact, targets: validTargets }),
+    sha256: artifact.sha256,
+    bytes: artifact.bytes,
+    redactionDecision: artifact.decision
+  })).filter((artifact) => artifact.destinationIds.length > 0);
+  if (artifacts.length === 0) {
+    diagnostics.push(sceneErrorDiagnostic("scene.publish_plan_no_artifacts", "No redacted published artifacts matched the selected publication targets.", "publish-plan"));
+  }
+  return {
+    schemaVersion: "treeseed.scene.publish-plan/v1",
+    phase: 11,
+    generatedAt: input.timestamp ?? nowIso(),
+    sourcePublishManifestPath: input.publishManifestPath,
+    sourceRunRoot: input.runRoot,
+    sceneId: input.publish.sceneId,
+    sourceRunId: input.publish.sourceRunId,
+    workflowStatus: input.publish.workflowStatus,
+    mode: input.mode,
+    targets: validTargets,
+    destinations,
+    artifacts,
+    reconciliationIntents: destinations.map((destination) => ({
+      id: `scene-publication-${destination.target}`,
+      target: destination.target,
+      action: "plan-only",
+      reason: "Phase 11 records publication intent for a future canonical reconciliation apply; it does not mutate external stores.",
+      desiredState: destination.reconciliationResource.desiredState
+    })),
+    diagnostics
+  };
+}
+function writeTreeseedScenePublishPlan(input) {
+  const publishPlanRoot = join(input.runRoot, "publish-plan");
+  const exportRoot = input.manifest.mode === "local-export" ? join(publishPlanRoot, "export") : null;
+  const paths = {
+    publishPlanRoot,
+    manifestPath: join(publishPlanRoot, "manifest.json"),
+    reportPath: join(publishPlanRoot, "report.md"),
+    exportRoot,
+    exportManifestPath: exportRoot ? join(exportRoot, "export-manifest.json") : null
+  };
+  if (exportRoot) {
+    const copied = [];
+    for (const destination of input.manifest.destinations) {
+      mkdirSync(destination.root, { recursive: true });
+      for (const artifact of input.manifest.artifacts.filter((entry) => entry.destinationIds.includes(destination.id))) {
+        if (destination.target === "artifact-store") {
+          copied.push({
+            artifactId: artifact.id,
+            destinationId: destination.id,
+            sourcePath: artifact.sourcePath,
+            exportedPath: null,
+            relativePath: artifact.relativePath
+          });
+          continue;
+        }
+        if (!existsSync(artifact.sourcePath)) continue;
+        const targetPath = safeExportPath(destination.root, artifact.relativePath);
+        mkdirSync(dirname(targetPath), { recursive: true });
+        copyFileSync(artifact.sourcePath, targetPath);
+        copied.push({
+          artifactId: artifact.id,
+          destinationId: destination.id,
+          sourcePath: artifact.sourcePath,
+          exportedPath: targetPath,
+          relativePath: artifact.relativePath
+        });
+      }
+    }
+    writeJson(paths.exportManifestPath, {
+      schemaVersion: "treeseed.scene.publication-export/v1",
+      phase: 11,
+      generatedAt: input.manifest.generatedAt,
+      sceneId: input.manifest.sceneId,
+      sourceRunId: input.manifest.sourceRunId,
+      targets: input.manifest.targets,
+      destinations: input.manifest.destinations,
+      artifacts: copied
+    });
+  }
+  writeTreeseedScenePublishPlanReport({ manifest: input.manifest, paths });
+  return paths;
+}
+async function loadOrGenerateLocalPublish(input) {
+  const publishManifestPath = join(input.runRoot, "publish", "local", "manifest.json");
+  if (existsSync(publishManifestPath)) {
+    return { publish: readJson(publishManifestPath), publishManifestPath, diagnostics: [], warnings: [] };
+  }
+  const report = await publishTreeseedSceneEvidence({
+    projectRoot: input.projectRoot,
+    scene: input.scene,
+    from: input.from,
+    target: "local",
+    timestamp: input.timestamp
+  });
+  if (!report.ok || !report.manifest || !report.paths) {
+    return { publish: null, publishManifestPath, diagnostics: report.diagnostics, warnings: report.warnings };
+  }
+  const warning = sceneWarningDiagnostic("scene.publish_plan_missing_publish", "Local Phase 10 publish manifest was missing, so Phase 11 generated a local redacted publish bundle first.", "publish/local/manifest.json");
+  return {
+    publish: report.manifest,
+    publishManifestPath: report.paths.manifestPath,
+    diagnostics: [warning, ...report.diagnostics],
+    warnings: [warning, ...report.warnings]
+  };
+}
+async function runPublicationPlan(input) {
+  const resolved = resolveTreeseedSceneRunRoot(input.projectRoot, input.from);
+  if (!resolved.runRoot) return failedReport({ scenePath: input.scene, runRoot: null, diagnostics: resolved.diagnostics });
+  const scenePath = join(resolved.runRoot, "scene.normalized.json");
+  const runPath = join(resolved.runRoot, "run.json");
+  const blockers = [];
+  if (!existsSync(scenePath)) blockers.push(sceneErrorDiagnostic("scene.publish_plan_missing_scene", `Normalized scene artifact not found: ${scenePath}.`, "scene"));
+  if (!existsSync(runPath)) blockers.push(sceneErrorDiagnostic("scene.publish_plan_missing_run", `Run report artifact not found: ${runPath}.`, "from"));
+  if (blockers.length > 0) return failedReport({ scenePath: input.scene, runRoot: resolved.runRoot, diagnostics: [...resolved.diagnostics, ...blockers], blockers });
+  const sourceScene = readJson(scenePath);
+  const run = readJson(runPath);
+  const validation = validateTreeseedScene({ projectRoot: input.projectRoot, scene: input.scene });
+  if (!validation.ok) return failedReport({ scenePath: validation.scenePath, runRoot: resolved.runRoot, diagnostics: validation.diagnostics, sceneId: sourceScene.id, sourceRunId: run.runId });
+  if (validation.scene?.id !== sourceScene.id) {
+    const diagnostic = sceneErrorDiagnostic("scene.publish_plan_scene_mismatch", `Scene manifest "${validation.scene?.id ?? "(unknown)"}" does not match source run scene "${sourceScene.id}".`, "scene");
+    return failedReport({ scenePath: validation.scenePath, runRoot: resolved.runRoot, diagnostics: [diagnostic], blockers: [diagnostic], sceneId: sourceScene.id, sourceRunId: run.runId });
+  }
+  const targets = input.targets ?? DEFAULT_TREESEED_SCENE_PUBLICATION_TARGETS;
+  const targetDiagnostics = validateTargets(targets);
+  if (targetDiagnostics.length > 0) {
+    return failedReport({ scenePath: validation.scenePath, runRoot: resolved.runRoot, diagnostics: targetDiagnostics, blockers: targetDiagnostics, sceneId: sourceScene.id, sourceRunId: run.runId });
+  }
+  const publishResult = await loadOrGenerateLocalPublish({ projectRoot: input.projectRoot, scene: input.scene, from: input.from, runRoot: resolved.runRoot, timestamp: input.timestamp });
+  if (!publishResult.publish) {
+    return failedReport({ scenePath: validation.scenePath, runRoot: resolved.runRoot, diagnostics: publishResult.diagnostics, warnings: publishResult.warnings, blockers: publishResult.diagnostics.filter((diagnostic) => diagnostic.severity === "error"), sceneId: sourceScene.id, sourceRunId: run.runId });
+  }
+  const manifest = buildTreeseedScenePublishPlanManifest({
+    publish: publishResult.publish,
+    publishManifestPath: publishResult.publishManifestPath,
+    runRoot: resolved.runRoot,
+    targets,
+    mode: input.mode,
+    timestamp: input.timestamp
+  });
+  const manifestErrors = manifest.diagnostics.filter((diagnostic) => diagnostic.severity === "error" && diagnostic.code.startsWith("scene.publish_plan_"));
+  if (manifestErrors.length > 0) {
+    return failedReport({
+      scenePath: validation.scenePath,
+      runRoot: resolved.runRoot,
+      diagnostics: [...publishResult.diagnostics, ...manifest.diagnostics],
+      warnings: publishResult.warnings,
+      blockers: manifestErrors,
+      sceneId: sourceScene.id,
+      sourceRunId: run.runId,
+      manifest
+    });
+  }
+  try {
+    const paths = writeTreeseedScenePublishPlan({ runRoot: resolved.runRoot, manifest });
+    const updateWarnings = appendTreeseedScenePublishPlanPaths({ runPath, paths });
+    return {
+      ok: true,
+      phase: 11,
+      sceneId: sourceScene.id,
+      sourceRunId: run.runId,
+      scenePath: validation.scenePath,
+      runRoot: resolved.runRoot,
+      publishRoot: join(resolved.runRoot, "publish"),
+      publishPlanRoot: paths.publishPlanRoot,
+      manifest,
+      paths,
+      diagnostics: [...publishResult.diagnostics, ...updateWarnings],
+      warnings: [...publishResult.warnings, ...updateWarnings],
+      blockers: []
+    };
+  } catch (error) {
+    const diagnostic = sceneErrorDiagnostic(input.mode === "local-export" ? "scene.publish_plan_export_failed" : "scene.publish_plan_write_failed", `Publish plan artifacts could not be written. ${error instanceof Error ? error.message : String(error ?? "")}`.trim(), "publish-plan");
+    return failedReport({ scenePath: validation.scenePath, runRoot: resolved.runRoot, diagnostics: [diagnostic], warnings: publishResult.warnings, blockers: [diagnostic], sceneId: sourceScene.id, sourceRunId: run.runId, manifest });
+  }
+}
+function planTreeseedScenePublication(input) {
+  return runPublicationPlan({ ...input, mode: input.mode ?? "plan" });
+}
+function exportTreeseedScenePublication(input) {
+  return runPublicationPlan({ ...input, mode: "local-export" });
+}
+export {
+  buildTreeseedScenePublishPlanManifest,
+  exportTreeseedScenePublication,
+  planTreeseedScenePublication,
+  writeTreeseedScenePublishPlan
+};

package/dist/scenes/publish-redaction.d.ts

@@ -0,0 +1,16 @@
+import type { TreeseedSceneDiagnostic, TreeseedSceneEvidenceArtifactKind, TreeseedSceneRedactionPolicy, TreeseedSceneRedactionRule, TreeseedScenePublishTarget, TreeseedSceneRunStatus } from './types.js';
+export declare function createDefaultTreeseedSceneRedactionPolicy(target: TreeseedScenePublishTarget): TreeseedSceneRedactionPolicy;
+export declare function validateTreeseedSceneRedactionPolicy(input: {
+    policy: unknown;
+    path?: string;
+}): TreeseedSceneDiagnostic[];
+export declare function readTreeseedSceneRedactionPolicyFile(path: string): {
+    policy: TreeseedSceneRedactionPolicy | null;
+    diagnostics: TreeseedSceneDiagnostic[];
+};
+export declare function resolveTreeseedSceneRedactionRule(input: {
+    policy: TreeseedSceneRedactionPolicy;
+    artifactKind: TreeseedSceneEvidenceArtifactKind;
+    target: TreeseedScenePublishTarget;
+    workflowStatus: TreeseedSceneRunStatus;
+}): TreeseedSceneRedactionRule | null;

package/dist/scenes/publish-redaction.js

@@ -0,0 +1,148 @@
+import { parse as parseYaml } from "yaml";
+import { readFileSync } from "node:fs";
+import { extname } from "node:path";
+import { sceneErrorDiagnostic } from "./diagnostics.js";
+const EVIDENCE_ARTIFACT_KINDS = /* @__PURE__ */ new Set([
+  "run-report",
+  "markdown-report",
+  "timeline",
+  "setup",
+  "progress",
+  "segment",
+  "checkpoint",
+  "screenshot",
+  "render-report",
+  "render-video",
+  "training-output",
+  "log-summary"
+]);
+const RUN_STATUSES = /* @__PURE__ */ new Set(["passed", "failed", "blocked", "skipped"]);
+const PUBLISH_TARGETS = /* @__PURE__ */ new Set(["local", "release"]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringArray(value) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) return null;
+  return value;
+}
+function ruleApplies(input) {
+  const target = input.rule.allowWhen?.target;
+  if (target && !target.includes(input.target)) return false;
+  const workflowStatus = input.rule.allowWhen?.workflowStatus;
+  if (workflowStatus && !workflowStatus.includes(input.workflowStatus)) return false;
+  return true;
+}
+function createDefaultTreeseedSceneRedactionPolicy(target) {
+  void target;
+  const include = (artifactKind, reason) => ({
+    id: `include-${artifactKind}`,
+    artifactKind,
+    include: true,
+    reason
+  });
+  return {
+    schemaVersion: "treeseed.scene.redaction-policy/v1",
+    id: "treeseed.scene.redaction.default",
+    mode: "deny-by-default",
+    rules: [
+      include("run-report", "Run report metadata is safe for local evidence publication."),
+      include("markdown-report", "Markdown summary is safe for local evidence publication."),
+      include("timeline", "Timeline metadata is safe for local evidence publication."),
+      include("setup", "Setup summary is safe for local evidence publication."),
+      include("progress", "Progress events are safe for local evidence publication."),
+      include("segment", "Segment metadata is safe for local evidence publication."),
+      include("checkpoint", "Checkpoint metadata is safe for local evidence publication."),
+      include("screenshot", "Only screenshots already selected by sanitized evidence are safe for publication."),
+      include("render-report", "Render report metadata is safe for local evidence publication."),
+      include("training-output", "Deterministic training sidecars are safe for local evidence publication.")
+    ]
+  };
+}
+function validateTreeseedSceneRedactionPolicy(input) {
+  const diagnostics = [];
+  const policy = input.policy;
+  if (!isRecord(policy)) {
+    return [sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy must be an object.", input.path)];
+  }
+  if (policy.schemaVersion !== "treeseed.scene.redaction-policy/v1") {
+    diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", 'Redaction policy schemaVersion must be "treeseed.scene.redaction-policy/v1".', input.path ? `${input.path}.schemaVersion` : "schemaVersion"));
+  }
+  if (typeof policy.id !== "string" || policy.id.trim().length === 0) {
+    diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy id is required.", input.path ? `${input.path}.id` : "id"));
+  }
+  if (policy.mode !== "deny-by-default") {
+    diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", 'Redaction policy mode must be "deny-by-default".', input.path ? `${input.path}.mode` : "mode"));
+  }
+  if (!Array.isArray(policy.rules)) {
+    diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy rules must be an array.", input.path ? `${input.path}.rules` : "rules"));
+    return diagnostics;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, rawRule] of policy.rules.entries()) {
+    const path = input.path ? `${input.path}.rules[${index}]` : `rules[${index}]`;
+    if (!isRecord(rawRule)) {
+      diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy rule must be an object.", path));
+      continue;
+    }
+    const id = rawRule.id;
+    if (typeof id !== "string" || id.trim().length === 0) {
+      diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy rule id is required.", `${path}.id`));
+    } else if (seen.has(id)) {
+      diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", `Duplicate redaction policy rule id "${id}".`, `${path}.id`));
+    } else {
+      seen.add(id);
+    }
+    if (typeof rawRule.artifactKind !== "string" || !EVIDENCE_ARTIFACT_KINDS.has(rawRule.artifactKind)) {
+      diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", `Unsupported redaction artifact kind "${String(rawRule.artifactKind ?? "")}".`, `${path}.artifactKind`));
+    }
+    if (typeof rawRule.include !== "boolean") {
+      diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy rule include must be boolean.", `${path}.include`));
+    }
+    if (typeof rawRule.reason !== "string" || rawRule.reason.trim().length === 0) {
+      diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy rule reason is required.", `${path}.reason`));
+    }
+    if (rawRule.allowWhen !== void 0) {
+      if (!isRecord(rawRule.allowWhen)) {
+        diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy allowWhen must be an object.", `${path}.allowWhen`));
+      } else {
+        const targets = rawRule.allowWhen.target;
+        if (targets !== void 0) {
+          const values = stringArray(targets);
+          if (!values || values.some((value) => !PUBLISH_TARGETS.has(value))) {
+            diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy allowWhen.target contains unsupported publish targets.", `${path}.allowWhen.target`));
+          }
+        }
+        const statuses = rawRule.allowWhen.workflowStatus;
+        if (statuses !== void 0) {
+          const values = stringArray(statuses);
+          if (!values || values.some((value) => !RUN_STATUSES.has(value))) {
+            diagnostics.push(sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", "Redaction policy allowWhen.workflowStatus contains unsupported run statuses.", `${path}.allowWhen.workflowStatus`));
+          }
+        }
+      }
+    }
+  }
+  return diagnostics;
+}
+function readTreeseedSceneRedactionPolicyFile(path) {
+  try {
+    const raw = readFileSync(path, "utf8");
+    const parsed = extname(path).toLowerCase() === ".json" ? JSON.parse(raw) : parseYaml(raw);
+    const diagnostics = validateTreeseedSceneRedactionPolicy({ policy: parsed, path });
+    return { policy: diagnostics.length > 0 ? null : parsed, diagnostics };
+  } catch (error) {
+    return {
+      policy: null,
+      diagnostics: [sceneErrorDiagnostic("scene.publish_redaction_policy_invalid", `Redaction policy could not be read. ${error instanceof Error ? error.message : String(error ?? "")}`.trim(), path)]
+    };
+  }
+}
+function resolveTreeseedSceneRedactionRule(input) {
+  return input.policy.rules.find((rule) => rule.artifactKind === input.artifactKind && ruleApplies({ rule, target: input.target, workflowStatus: input.workflowStatus })) ?? null;
+}
+export {
+  createDefaultTreeseedSceneRedactionPolicy,
+  readTreeseedSceneRedactionPolicyFile,
+  resolveTreeseedSceneRedactionRule,
+  validateTreeseedSceneRedactionPolicy
+};

package/dist/scenes/publish-release-record.d.ts

@@ -0,0 +1,13 @@
+import type { TreeseedScenePublishManifest } from './types.js';
+export declare function treeseedSceneReleaseEvidenceRecordPath(input: {
+    projectRoot: string;
+    sceneId: string | null;
+    runId: string | null;
+}): string;
+export declare function writeTreeseedSceneReleaseEvidenceRecord(input: {
+    projectRoot: string;
+    manifest: TreeseedScenePublishManifest;
+    manifestPath: string;
+    reportPath: string;
+    bundleRoot: string;
+}): string;

package/dist/scenes/publish-release-record.js

@@ -0,0 +1,34 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+function safePathPart(value) {
+  return (value ?? "unknown").toLowerCase().replace(/[^a-z0-9._-]/gu, "-").replace(/^-+|-+$/gu, "") || "unknown";
+}
+function treeseedSceneReleaseEvidenceRecordPath(input) {
+  return join(input.projectRoot, ".treeseed", "workflow", "scene-evidence", safePathPart(input.sceneId), `${safePathPart(input.runId)}.json`);
+}
+function writeTreeseedSceneReleaseEvidenceRecord(input) {
+  const path = treeseedSceneReleaseEvidenceRecordPath({
+    projectRoot: input.projectRoot,
+    sceneId: input.manifest.sceneId,
+    runId: input.manifest.sourceRunId
+  });
+  const record = {
+    schemaVersion: "treeseed.scene.release-evidence/v1",
+    generatedAt: input.manifest.generatedAt,
+    sceneId: input.manifest.sceneId,
+    sourceRunId: input.manifest.sourceRunId,
+    workflowStatus: input.manifest.workflowStatus,
+    publishManifestPath: input.manifestPath,
+    publishReportPath: input.reportPath,
+    publishBundleRoot: input.bundleRoot,
+    sourceEvidenceManifestPath: input.manifest.sourceEvidenceManifestPath
+  };
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(record, null, 2)}
+`, "utf8");
+  return path;
+}
+export {
+  treeseedSceneReleaseEvidenceRecordPath,
+  writeTreeseedSceneReleaseEvidenceRecord
+};

package/dist/scenes/publish-report.d.ts

@@ -0,0 +1,10 @@
+import type { TreeseedSceneDiagnostic, TreeseedScenePublishManifest, TreeseedScenePublishPaths } from './types.js';
+export declare function formatTreeseedScenePublishMarkdownReport(manifest: TreeseedScenePublishManifest): string;
+export declare function writeTreeseedScenePublishReport(input: {
+    manifest: TreeseedScenePublishManifest;
+    paths: TreeseedScenePublishPaths;
+}): void;
+export declare function appendTreeseedScenePublishPaths(input: {
+    runPath: string;
+    paths: TreeseedScenePublishPaths;
+}): TreeseedSceneDiagnostic[];

package/dist/scenes/publish-report.js

@@ -0,0 +1,67 @@
+import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { sceneWarningDiagnostic } from "./diagnostics.js";
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function writeText(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, value, "utf8");
+}
+function formatTreeseedScenePublishMarkdownReport(manifest) {
+  const included = manifest.artifacts.filter((artifact) => artifact.decision === "include");
+  const excluded = manifest.artifacts.filter((artifact) => artifact.decision !== "include");
+  const lines = [
+    `# Treeseed Scene Publish: ${manifest.sceneId ?? "(unknown scene)"}`,
+    "",
+    `Scene: ${manifest.sceneId ?? "(unknown)"}`,
+    `Source run: ${manifest.sourceRunId ?? "(unknown)"}`,
+    `Target: ${manifest.target}`,
+    `Workflow: ${manifest.workflowStatus}`,
+    `Policy: ${manifest.redactionPolicy.id}`,
+    `Included artifacts: ${included.length}`,
+    `Excluded artifacts: ${excluded.length}`,
+    `Release record: ${manifest.releaseRecordPath ?? "(none)"}`,
+    "",
+    "## Included Artifacts",
+    "",
+    "| Kind | Source | Published | SHA-256 |",
+    "| --- | --- | --- | --- |",
+    ...included.length > 0 ? included.map((artifact) => `| ${artifact.kind} | ${artifact.relativePath} | ${artifact.publishedPath ?? "(none)"} | ${artifact.sha256 ?? "(none)"} |`) : ["| (none) | (none) | (none) | (none) |"],
+    "",
+    "## Redaction Decisions",
+    "",
+    "| Kind | Source | Decision | Reason |",
+    "| --- | --- | --- | --- |",
+    ...excluded.length > 0 ? excluded.map((artifact) => `| ${artifact.kind} | ${artifact.relativePath} | ${artifact.decision} | ${artifact.reason} |`) : ["| (none) | (none) | (none) | (none) |"],
+    ""
+  ];
+  return lines.join("\n");
+}
+function writeTreeseedScenePublishReport(input) {
+  writeJson(input.paths.manifestPath, input.manifest);
+  writeText(input.paths.reportPath, formatTreeseedScenePublishMarkdownReport(input.manifest));
+}
+function appendTreeseedScenePublishPaths(input) {
+  try {
+    if ((statSync(input.runPath).mode & 146) === 0) {
+      throw new Error("run.json is not writable.");
+    }
+    const run = JSON.parse(readFileSync(input.runPath, "utf8"));
+    writeJson(input.runPath, {
+      ...run,
+      publishPaths: input.paths,
+      logs: run.logs ? { ...run.logs, publish: input.paths.publishRoot } : run.logs
+    });
+    return [];
+  } catch (error) {
+    return [sceneWarningDiagnostic("scene.publish_run_update_failed", `Publish artifacts were written but run.json could not be updated. ${error instanceof Error ? error.message : String(error ?? "")}`.trim(), "run.json")];
+  }
+}
+export {
+  appendTreeseedScenePublishPaths,
+  formatTreeseedScenePublishMarkdownReport,
+  writeTreeseedScenePublishReport
+};

package/dist/scenes/publish.d.ts

@@ -0,0 +1,16 @@
+import type { TreeseedSceneEvidenceManifest, TreeseedScenePublishManifest, TreeseedScenePublishOptions, TreeseedScenePublishPaths, TreeseedScenePublishReport, TreeseedScenePublishTarget, TreeseedSceneRedactionPolicy } from './types.js';
+export declare function buildTreeseedScenePublishManifest(input: {
+    evidence: TreeseedSceneEvidenceManifest;
+    evidencePath: string;
+    runRoot: string;
+    target: TreeseedScenePublishTarget;
+    redactionPolicy?: TreeseedSceneRedactionPolicy;
+    timestamp?: string;
+}): TreeseedScenePublishManifest;
+export declare function writeTreeseedScenePublish(input: {
+    runRoot: string;
+    manifest: TreeseedScenePublishManifest;
+    evidence: TreeseedSceneEvidenceManifest;
+    projectRoot?: string;
+}): TreeseedScenePublishPaths;
+export declare function publishTreeseedSceneEvidence(input: TreeseedScenePublishOptions): Promise<TreeseedScenePublishReport>;