@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/operations/services/github-automation.js

@@ -1,520 +0,0 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, relative, resolve } from "node:path";
-import { runTreeseedGit } from "./git-runner.js";
-import { resolveTreeseedEnvironmentRegistry } from "../../platform/environment.js";
-import { packageRoot, loadCliDeployConfig } from "./runtime-tools.js";
-import {
-  filterManagedHostGitHubEnvironment,
-  usesManagedHostOperationRequests
-} from "./managed-host-security.js";
-import {
-  createGitHubApiClient,
-  ensureGitHubRepository,
-  maybeGetGitHubRepository,
-  parseGitHubRepositorySlug,
-  listGitHubRepositorySecretNames,
-  listGitHubRepositoryVariableNames,
-  upsertGitHubRepositorySecret,
-  upsertGitHubRepositoryVariable,
-  waitForGitHubWorkflowRunCompletion
-} from "./github-api.js";
-import { resolveTreeseedGitHubToken } from "../../service-credentials.js";
-function envOrNull(key) {
-  const value = process.env[key];
-  return typeof value === "string" && value.length > 0 ? value : null;
-}
-function slugifySegment(value, fallback = "project") {
-  return String(value ?? "").trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 96) || fallback;
-}
-function getGitHubAutomationMode() {
-  return "real";
-}
-function parseGitHubRepositoryFromRemote(remoteUrl) {
-  if (!remoteUrl) {
-    return null;
-  }
-  const sshMatch = remoteUrl.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/);
-  if (sshMatch) {
-    return `${sshMatch[1]}/${sshMatch[2]}`;
-  }
-  const httpsMatch = remoteUrl.match(/^https:\/\/github\.com\/([^/]+)\/(.+?)(?:\.git)?$/);
-  if (httpsMatch) {
-    return `${httpsMatch[1]}/${httpsMatch[2]}`;
-  }
-  return null;
-}
-function runGit(args, { cwd, allowFailure = false, capture = true } = {}) {
-  const mutating = /^(add|commit|checkout|switch|merge|tag|push|fetch|worktree|submodule|reset|clean|restore|branch)$/u.test(args[0] ?? "");
-  const result = runTreeseedGit(args, {
-    cwd,
-    mode: mutating ? "mutate" : "read",
-    allowFailure
-  });
-  if (!capture && result.stdout.trim()) process.stdout.write(result.stdout);
-  if (!capture && result.stderr.trim()) process.stderr.write(result.stderr);
-  if (result.status !== 0 && !allowFailure) {
-    if (args[0] === "push" && !args.includes("--force")) {
-      const retryArgs = ["push", "--force", ...args.slice(1)];
-      const retry = runTreeseedGit(retryArgs, {
-        cwd,
-        mode: "mutate",
-        allowFailure: true
-      });
-      if (!capture && retry.stdout.trim()) process.stdout.write(retry.stdout);
-      if (!capture && retry.stderr.trim()) process.stderr.write(retry.stderr);
-      if (retry.status === 0) return retry;
-      const retryDetail = retry.stderr?.trim() || retry.stdout?.trim();
-      throw new Error(`git ${retryArgs.join(" ")} failed${retryDetail ? `: ${retryDetail}` : ""}`);
-    }
-    const detail = result.stderr?.trim() || result.stdout?.trim();
-    throw new Error(`git ${args.join(" ")} failed${detail ? `: ${detail}` : ""}`);
-  }
-  return result;
-}
-function resolveGitHubRemoteUrls(owner, name) {
-  const normalizedOwner = slugifySegment(owner, "owner");
-  const normalizedName = slugifySegment(name, "repo");
-  return {
-    slug: `${normalizedOwner}/${normalizedName}`,
-    owner: normalizedOwner,
-    name: normalizedName,
-    sshUrl: `git@github.com:${normalizedOwner}/${normalizedName}.git`,
-    httpsUrl: `https://github.com/${normalizedOwner}/${normalizedName}.git`,
-    url: `https://github.com/${normalizedOwner}/${normalizedName}`
-  };
-}
-function ensureGitIdentity(cwd) {
-  const currentName = runGit(["config", "--get", "user.name"], { cwd, allowFailure: true }).stdout?.trim() ?? "";
-  const currentEmail = runGit(["config", "--get", "user.email"], { cwd, allowFailure: true }).stdout?.trim() ?? "";
-  if (!currentName) {
-    runGit(["config", "user.name", envOrNull("TREESEED_GITHUB_COMMITTER_NAME") ?? "Treeseed Launch"], { cwd });
-  }
-  if (!currentEmail) {
-    runGit(["config", "user.email", envOrNull("TREESEED_GITHUB_COMMITTER_EMAIL") ?? "launch@knowledge.coop"], { cwd });
-  }
-}
-function resolveGitHubRepositorySlug(tenantRoot) {
-  const remoteResult = runGit(["remote", "get-url", "origin"], { cwd: tenantRoot });
-  const remoteUrl = remoteResult.stdout?.trim() ?? "";
-  const repository = parseGitHubRepositoryFromRemote(remoteUrl);
-  if (!repository) {
-    throw new Error(`Unable to determine GitHub repository from origin remote "${remoteUrl}".`);
-  }
-  return repository;
-}
-function maybeResolveGitHubRepositorySlug(tenantRoot) {
-  try {
-    return resolveGitHubRepositorySlug(tenantRoot);
-  } catch {
-    return null;
-  }
-}
-function resolveDefaultGitHubOwner() {
-  const explicit = envOrNull("TREESEED_GITHUB_OWNER");
-  if (explicit) {
-    return explicit;
-  }
-  try {
-    const repository = maybeResolveGitHubRepositorySlug(process.cwd());
-    if (repository?.includes("/")) {
-      return repository.split("/")[0];
-    }
-  } catch {
-  }
-  return "treeseed-ai";
-}
-function normalizeGitHubVisibility(value) {
-  const normalized = String(value ?? "").trim().toLowerCase();
-  return normalized === "public" || normalized === "internal" || normalized === "private" ? normalized : "private";
-}
-function configuredValue(values, key) {
-  const value = values?.[key] ?? process.env[key];
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : "";
-}
-function resolveGitHubRepositoryTarget(tenantRoot, {
-  values = {},
-  defaultName
-} = {}) {
-  const origin = maybeResolveGitHubRepositorySlug(tenantRoot);
-  const parsedOrigin = origin ? parseGitHubRepositorySlug(origin) : null;
-  const owner = configuredValue(values, "TREESEED_GITHUB_OWNER") || parsedOrigin?.owner || "";
-  const name = configuredValue(values, "TREESEED_GITHUB_REPOSITORY_NAME") || parsedOrigin?.name || defaultName || "project";
-  if (!owner) {
-    throw new Error("Configure TREESEED_GITHUB_OWNER before GitHub repository bootstrap.");
-  }
-  return {
-    owner: slugifySegment(owner, "owner"),
-    name: slugifySegment(name, "project"),
-    visibility: normalizeGitHubVisibility(configuredValue(values, "TREESEED_GITHUB_REPOSITORY_VISIBILITY")),
-    source: configuredValue(values, "TREESEED_GITHUB_OWNER") || configuredValue(values, "TREESEED_GITHUB_REPOSITORY_NAME") ? "config" : parsedOrigin ? "origin" : "default"
-  };
-}
-function ensureGitRepositoryInitialized(cwd, defaultBranch) {
-  const insideWorkTree = runGit(["rev-parse", "--is-inside-work-tree"], { cwd, allowFailure: true }).stdout?.trim() === "true";
-  if (!insideWorkTree) {
-    runGit(["init", "-b", defaultBranch], { cwd });
-  }
-  ensureGitIdentity(cwd);
-}
-function ensureOriginRemote(cwd, repository, remoteName = "origin") {
-  const currentRemote = runGit(["remote", "get-url", remoteName], { cwd, allowFailure: true }).stdout?.trim() ?? "";
-  if (!currentRemote) {
-    runGit(["remote", "add", remoteName, repository.sshUrl], { cwd });
-    return { changed: true, previous: null, next: repository.sshUrl };
-  }
-  if (currentRemote !== repository.sshUrl && currentRemote !== repository.httpsUrl) {
-    runGit(["remote", "set-url", remoteName, repository.sshUrl], { cwd });
-    return { changed: true, previous: currentRemote, next: repository.sshUrl };
-  }
-  return { changed: false, previous: currentRemote, next: currentRemote };
-}
-function pushAllGitHubRefs(cwd, remoteName = "origin") {
-  runGit(["push", "-u", remoteName, "--all"], { cwd, capture: false });
-  runGit(["push", remoteName, "--tags"], { cwd, capture: false });
-}
-async function ensureGitHubBootstrapRepository(tenantRoot, {
-  values = {},
-  defaultName,
-  onProgress
-} = {}) {
-  const target = resolveGitHubRepositoryTarget(tenantRoot, { values, defaultName });
-  const remotes = resolveGitHubRemoteUrls(target.owner, target.name);
-  const slug = remotes.slug;
-  onProgress?.(`[local][github][repo] Preparing ${slug} from ${target.source}...`);
-  const client = createGitHubApiClient({
-    env: {
-      TREESEED_GITHUB_TOKEN: resolveTreeseedGitHubToken(values)
-    }
-  });
-  const existing = await maybeGetGitHubRepository({ owner: target.owner, name: target.name }, { client });
-  const repository = existing ?? await ensureGitHubRepository({
-    owner: target.owner,
-    name: target.name,
-    visibility: target.visibility
-  }, { client });
-  const created = !existing;
-  onProgress?.(`[local][github][repo] ${created ? "Created" : "Verified"} ${repository.slug}.`);
-  ensureGitRepositoryInitialized(tenantRoot, repository.defaultBranch || "main");
-  const remote = ensureOriginRemote(tenantRoot, repository);
-  if (remote.changed) {
-    onProgress?.(`[local][github][repo] Updated origin remote to ${repository.slug}.`);
-  }
-  if (created) {
-    onProgress?.(`[local][github][repo] Pushing all local branches and tags to ${repository.slug}...`);
-    pushAllGitHubRefs(tenantRoot);
-    onProgress?.(`[local][github][repo] Pushed all local branches and tags to ${repository.slug}.`);
-  }
-  return {
-    repository: repository.slug,
-    target,
-    created,
-    remote,
-    pushed: created,
-    mode: "real"
-  };
-}
-async function createGitHubRepository(input, { env = process.env } = {}) {
-  const visibility = input.visibility ?? "private";
-  const remotes = resolveGitHubRemoteUrls(input.owner, input.name);
-  return await ensureGitHubRepository({
-    owner: remotes.owner,
-    name: remotes.name,
-    description: input.description ?? null,
-    homepageUrl: input.homepageUrl ?? null,
-    visibility,
-    topics: Array.isArray(input.topics) ? input.topics.map((topic) => slugifySegment(topic, "treeseed")) : []
-  }, {
-    client: createGitHubApiClient({ env })
-  });
-}
-function initializeGitHubRepositoryWorkingTree(cwd, repository, {
-  defaultBranch = "main",
-  createStaging = true,
-  commitMessage = "Initialize TreeSeed hub",
-  remoteName = "origin",
-  push = true,
-  forcePush = false
-} = {}) {
-  runGit(["init", "-b", defaultBranch], { cwd, allowFailure: true });
-  ensureGitIdentity(cwd);
-  const currentRemote = runGit(["remote", "get-url", remoteName], { cwd, allowFailure: true }).stdout?.trim() ?? "";
-  if (!currentRemote) {
-    runGit(["remote", "add", remoteName, repository.sshUrl], { cwd });
-  } else if (currentRemote !== repository.sshUrl && currentRemote !== repository.httpsUrl) {
-    runGit(["remote", "set-url", remoteName, repository.sshUrl], { cwd });
-  }
-  runGit(["add", "-A"], { cwd });
-  const hasChanges = runGit(["status", "--porcelain"], { cwd }).stdout?.trim().length > 0;
-  if (hasChanges) {
-    runGit(["commit", "-m", commitMessage], { cwd });
-  }
-  if (push) {
-    runGit(["push", ...forcePush ? ["--force"] : [], "-u", remoteName, defaultBranch], { cwd, capture: false });
-  }
-  if (createStaging) {
-    runGit(["checkout", "-B", "staging"], { cwd });
-    if (push) {
-      runGit(["push", ...forcePush ? ["--force"] : [], "-u", remoteName, "staging"], { cwd, capture: false });
-    }
-    runGit(["checkout", defaultBranch], { cwd });
-  }
-  return {
-    repository,
-    remoteName,
-    defaultBranch,
-    stagingBranch: createStaging ? "staging" : null,
-    pushed: push
-  };
-}
-function resolveGitRepositoryRoot(tenantRoot) {
-  const result = runGit(["rev-parse", "--show-toplevel"], { cwd: tenantRoot, allowFailure: true });
-  return result.status === 0 ? result.stdout.trim() : tenantRoot;
-}
-function requiredGitHubEnvironment(tenantRoot, { scope = "prod", purpose = "save", managedHostMode = "auto" } = {}) {
-  const deployConfig = loadCliDeployConfig(tenantRoot);
-  const registry = resolveTreeseedEnvironmentRegistry({ deployConfig });
-  const relevant = registry.entries.filter(
-    (entry) => entry.scopes.includes(scope) && entry.purposes.includes(purpose) && (!entry.isRelevant || entry.isRelevant(registry.context, scope, purpose))
-  );
-  const required = {
-    secrets: [...new Set(relevant.filter((entry) => entry.targets.includes("github-secret")).map((entry) => entry.id))],
-    variables: [...new Set(relevant.filter((entry) => entry.targets.includes("github-variable")).map((entry) => entry.id))]
-  };
-  const managedBoundary = managedHostMode === "managed" || managedHostMode === "auto" && usesManagedHostOperationRequests(deployConfig);
-  return managedBoundary ? filterManagedHostGitHubEnvironment(required) : required;
-}
-function requiredGitHubSecrets(tenantRoot) {
-  return requiredGitHubEnvironment(tenantRoot).secrets;
-}
-function renderTenantWorkflowActionCommand() {
-  return [
-    "EXTRA_ARGS=()",
-    'if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi',
-    'if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi',
-    "if test -f ./packages/sdk/scripts/tenant-workflow-action.ts; then",
-    '  tsx ./packages/sdk/scripts/tenant-workflow-action.ts --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"',
-    "elif test -f ./node_modules/@treeseed/sdk/dist/scripts/tenant-workflow-action.js; then",
-    '  node ./node_modules/@treeseed/sdk/dist/scripts/tenant-workflow-action.js --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"',
-    "else",
-    '  echo "Unable to resolve @treeseed/sdk tenant workflow entrypoint."',
-    "  exit 1",
-    "fi"
-  ].join("\n");
-}
-function renderWorkflowTemplate(templateName, { workingDirectory }) {
-  const normalizedWorkingDirectory = workingDirectory && workingDirectory !== "." ? workingDirectory : ".";
-  const workingDirectoryLine = normalizedWorkingDirectory === "." ? "" : `    defaults:
-      run:
-        working-directory: ${normalizedWorkingDirectory}
-`;
-  const templatePath = resolve(packageRoot, "templates", "github", templateName);
-  const template = readFileSync(templatePath, "utf8");
-  const tenantWorkflowActionCommand = renderTenantWorkflowActionCommand().split("\n").map((line) => `          ${line}`).join("\n");
-  return template.split("__WORKING_DIRECTORY_BLOCK__").join(workingDirectoryLine).replace("__TENANT_WORKFLOW_ACTION_COMMAND_BLOCK__", tenantWorkflowActionCommand).split("__CACHE_DEPENDENCY_PATH__").join(
-    normalizedWorkingDirectory === "." ? "package-lock.json" : `${normalizedWorkingDirectory}/package-lock.json`
-  );
-}
-function renderDeployWebWorkflow({ workingDirectory }) {
-  return renderWorkflowTemplate("deploy-web.workflow.yml", { workingDirectory });
-}
-function renderHostedProjectWorkflow({ workingDirectory }) {
-  return renderWorkflowTemplate("hosted-project.workflow.yml", { workingDirectory });
-}
-function ensureWorkflowFile(tenantRoot, fileName, expected) {
-  const workflowPath = resolve(tenantRoot, ".github", "workflows", fileName);
-  const current = existsSync(workflowPath) ? readFileSync(workflowPath, "utf8") : null;
-  if (current === expected) {
-    return { workflowPath, changed: false };
-  }
-  mkdirSync(dirname(workflowPath), { recursive: true });
-  writeFileSync(workflowPath, expected, "utf8");
-  return { workflowPath, changed: true };
-}
-function ensureDeployWorkflow(tenantRoot) {
-  const repositoryRoot = resolveGitRepositoryRoot(tenantRoot);
-  const workingDirectory = relative(repositoryRoot, tenantRoot).replaceAll("\\", "/") || ".";
-  const web = ensureWorkflowFile(tenantRoot, "deploy-web.yml", renderDeployWebWorkflow({ workingDirectory }));
-  return {
-    workflowPath: web.workflowPath,
-    changed: web.changed,
-    workingDirectory,
-    executionBoundary: "market-web-api",
-    additionalWorkflows: []
-  };
-}
-function ensureHostedProjectWorkflow(tenantRoot) {
-  const repositoryRoot = resolveGitRepositoryRoot(tenantRoot);
-  const workingDirectory = relative(repositoryRoot, tenantRoot).replaceAll("\\", "/") || ".";
-  const expected = renderHostedProjectWorkflow({ workingDirectory });
-  return {
-    ...ensureWorkflowFile(tenantRoot, "hosted-project.yml", expected),
-    workingDirectory
-  };
-}
-function ensureStandardizedGitHubWorkflows(tenantRoot) {
-  const deployConfig = loadCliDeployConfig(tenantRoot);
-  const deploy = ensureDeployWorkflow(tenantRoot);
-  const workflows = [deploy, ...deploy.additionalWorkflows ?? []];
-  if ((deployConfig.hosting?.kind ?? "self_hosted_project") === "treeseed_control_plane") {
-    workflows.push(ensureHostedProjectWorkflow(tenantRoot));
-  }
-  return workflows;
-}
-async function listGitHubSecretNames(repository, tenantRoot) {
-  void tenantRoot;
-  return await listGitHubRepositorySecretNames(repository, { client: createGitHubApiClient() });
-}
-async function listGitHubVariableNames(repository, tenantRoot) {
-  void tenantRoot;
-  return await listGitHubRepositoryVariableNames(repository, { client: createGitHubApiClient() });
-}
-function formatMissingSecretsReport(repository, missingSecrets, reason = "missing_local_env") {
-  const lines = [
-    "Treeseed GitHub secret sync failed.",
-    `Repository: ${repository}`,
-    `Reason: ${reason}`,
-    "Missing secrets:"
-  ];
-  for (const secret of missingSecrets) {
-    lines.push(`- ${secret.name}: localEnv=${secret.localEnvPresent ? "present" : "missing"} remote=${secret.remotePresent ? "present" : "missing"}`);
-  }
-  return lines.join("\n");
-}
-async function ensureGitHubSecrets(tenantRoot, { planOnly = false } = {}) {
-  return (await ensureGitHubEnvironment(tenantRoot, { planOnly })).secrets;
-}
-function nonEmptyValues(values = {}) {
-  return Object.fromEntries(
-    Object.entries(values).filter(([, value]) => typeof value === "string" && value.length > 0)
-  );
-}
-async function ensureGitHubEnvironment(tenantRoot, { planOnly = false, scope = "prod", purpose = "save", valuesOverlay = {}, managedHostMode = "auto" } = {}) {
-  const repository = maybeResolveGitHubRepositorySlug(tenantRoot);
-  if (!repository) {
-    if (planOnly) {
-      return {
-        repository: null,
-        secrets: { existing: [], created: [] },
-        variables: { existing: [], created: [] },
-        skipped: "missing_repository"
-      };
-    }
-    throw new Error("Unable to determine GitHub repository from the current tenant. Configure an origin remote before syncing GitHub secrets.");
-  }
-  const required = requiredGitHubEnvironment(tenantRoot, { scope, purpose, managedHostMode });
-  const requiredSecrets = required.secrets;
-  const requiredVariables = required.variables;
-  const client = createGitHubApiClient();
-  const existingSecrets = await listGitHubRepositorySecretNames(repository, { client });
-  const existingVariables = await listGitHubRepositoryVariableNames(repository, { client });
-  const missingRemote = requiredSecrets.filter((name) => !existingSecrets.has(name));
-  const missingRemoteVariables = requiredVariables.filter((name) => !existingVariables.has(name));
-  const resolvedValues = {
-    ...process.env,
-    ...nonEmptyValues(valuesOverlay)
-  };
-  const localValue = (name) => {
-    const value = resolvedValues[name];
-    return typeof value === "string" && value.trim().length > 0 ? value.trim() : "";
-  };
-  const missingLocal = missingRemote.filter((name) => !localValue(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
-  const missingLocalVariables = missingRemoteVariables.filter((name) => !localValue(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
-  if (missingLocal.length > 0 || missingLocalVariables.length > 0) {
-    throw new Error(formatMissingSecretsReport(repository, [...missingLocal, ...missingLocalVariables]));
-  }
-  const createdSecrets = [];
-  for (const name of missingRemote) {
-    if (planOnly) {
-      createdSecrets.push(name);
-      continue;
-    }
-    await upsertGitHubRepositorySecret(repository, name, localValue(name), { client });
-    createdSecrets.push(name);
-  }
-  const createdVariables = [];
-  for (const name of missingRemoteVariables) {
-    if (planOnly) {
-      createdVariables.push(name);
-      continue;
-    }
-    await upsertGitHubRepositoryVariable(repository, name, localValue(name), { client });
-    createdVariables.push(name);
-  }
-  return {
-    repository,
-    secrets: {
-      existing: requiredSecrets.filter((name) => existingSecrets.has(name)),
-      created: createdSecrets
-    },
-    variables: {
-      existing: requiredVariables.filter((name) => existingVariables.has(name)),
-      created: createdVariables
-    }
-  };
-}
-async function ensureGitHubDeployAutomation(tenantRoot, { planOnly = false, valuesOverlay = {} } = {}) {
-  const workflows = ensureStandardizedGitHubWorkflows(tenantRoot);
-  const environment = await ensureGitHubEnvironment(tenantRoot, { planOnly, valuesOverlay });
-  return {
-    mode: getGitHubAutomationMode(),
-    workflow: workflows[0],
-    workflows,
-    secrets: environment.secrets,
-    variables: environment.variables,
-    environment
-  };
-}
-async function waitForGitHubWorkflowCompletion(tenantRoot, {
-  repository,
-  workflow = "publish.yml",
-  headSha,
-  branch,
-  timeoutSeconds = 600,
-  pollSeconds = 5,
-  dispatchIfMissing = false,
-  dispatchAfterSeconds,
-  dispatchInputs,
-  onProgress,
-  env
-} = {}) {
-  const repo = repository ?? resolveGitHubRepositorySlug(tenantRoot);
-  return await waitForGitHubWorkflowRunCompletion(repo, {
-    client: createGitHubApiClient({ env }),
-    workflow,
-    headSha,
-    branch,
-    timeoutSeconds,
-    pollSeconds,
-    dispatchIfMissing,
-    dispatchAfterSeconds,
-    dispatchInputs,
-    onProgress
-  });
-}
-export {
-  createGitHubRepository,
-  ensureDeployWorkflow,
-  ensureGitHubBootstrapRepository,
-  ensureGitHubDeployAutomation,
-  ensureGitHubEnvironment,
-  ensureGitHubSecrets,
-  ensureHostedProjectWorkflow,
-  ensureStandardizedGitHubWorkflows,
-  formatMissingSecretsReport,
-  getGitHubAutomationMode,
-  initializeGitHubRepositoryWorkingTree,
-  listGitHubSecretNames,
-  listGitHubVariableNames,
-  maybeResolveGitHubRepositorySlug,
-  parseGitHubRepositoryFromRemote,
-  renderDeployWebWorkflow,
-  renderHostedProjectWorkflow,
-  requiredGitHubEnvironment,
-  requiredGitHubSecrets,
-  resolveDefaultGitHubOwner,
-  resolveGitHubRemoteUrls,
-  resolveGitHubRepositorySlug,
-  resolveGitHubRepositoryTarget,
-  resolveGitRepositoryRoot,
-  waitForGitHubWorkflowCompletion
-};

package/dist/operations/services/github-credentials.d.ts

@@ -1,13 +0,0 @@
-export type TreeseedGitHubCredentialResolution = {
-    repository: string;
-    envName: string;
-    configured: boolean;
-    fallbackUsed: boolean;
-    source: 'repository' | 'fallback' | 'missing';
-    token: string | null;
-};
-export declare function githubRepositoryCredentialEnvName(repository: string): string;
-export declare function resolveGitHubCredentialForRepository(repository: string, { values, env, }?: {
-    values?: Record<string, string | undefined>;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-}): TreeseedGitHubCredentialResolution;

package/dist/operations/services/github-credentials.js

@@ -1,59 +0,0 @@
-import { resolveTreeseedGitHubToken } from "../../service-credentials.js";
-function cleanRepositorySlug(repository) {
-  const raw = String(repository ?? "").trim().replace(/^https?:\/\/github\.com\//iu, "").replace(/^git@github\.com:/iu, "").replace(/^ssh:\/\/git@github\.com\//iu, "").replace(/\.git$/iu, "").replace(/^\/+|\/+$/gu, "");
-  const [owner, repo, ...extra] = raw.split("/").filter(Boolean);
-  if (!owner || !repo || extra.length > 0) {
-    throw new Error(`Invalid GitHub repository "${repository}". Expected owner/name.`);
-  }
-  return `${owner}/${repo}`;
-}
-function githubRepositoryCredentialEnvName(repository) {
-  const slug = cleanRepositorySlug(repository);
-  const suffix = slug.toUpperCase().replace(/[^A-Z0-9]+/gu, "_").replace(/^_+|_+$/gu, "").replace(/_+/gu, "_");
-  return `TREESEED_GITHUB_TOKEN_${suffix}`;
-}
-function configuredValue(values, key) {
-  const value = values?.[key];
-  return typeof value === "string" && value.trim() ? value.trim() : "";
-}
-function resolveGitHubCredentialForRepository(repository, {
-  values,
-  env = process.env
-} = {}) {
-  const normalizedRepository = cleanRepositorySlug(repository);
-  const envName = githubRepositoryCredentialEnvName(normalizedRepository);
-  const repositoryToken = configuredValue(values, envName) || configuredValue(env, envName);
-  if (repositoryToken) {
-    return {
-      repository: normalizedRepository,
-      envName,
-      configured: true,
-      fallbackUsed: false,
-      source: "repository",
-      token: repositoryToken
-    };
-  }
-  const fallbackToken = resolveTreeseedGitHubToken(values ?? {}) || resolveTreeseedGitHubToken(env);
-  if (fallbackToken) {
-    return {
-      repository: normalizedRepository,
-      envName,
-      configured: true,
-      fallbackUsed: true,
-      source: "fallback",
-      token: fallbackToken
-    };
-  }
-  return {
-    repository: normalizedRepository,
-    envName,
-    configured: false,
-    fallbackUsed: false,
-    source: "missing",
-    token: null
-  };
-}
-export {
-  githubRepositoryCredentialEnvName,
-  resolveGitHubCredentialForRepository
-};

package/dist/operations/services/hosted-service-checks.d.ts

@@ -1,82 +0,0 @@
-export type TreeseedHostedServiceCheckStatus = 'passed' | 'failed' | 'skipped' | 'warning';
-export type TreeseedHostedServiceTarget = 'local' | 'staging' | 'prod';
-export type TreeseedHostedServiceProvider = 'cloudflare' | 'railway' | 'http' | 'dns' | 'github';
-export type TreeseedHostedServiceType = 'web' | 'api' | 'operationsRunner' | 'capacityProviderManager' | 'capacityProviderRunner' | 'treeseedDatabase' | 'customDomain' | 'dnsRecord' | 'githubWorkflow' | 'unknown';
-export interface TreeseedHostedServiceCheck {
-    id: string;
-    provider: TreeseedHostedServiceProvider;
-    serviceKey?: string;
-    serviceType: TreeseedHostedServiceType;
-    target: TreeseedHostedServiceTarget;
-    description: string;
-    expected?: Record<string, unknown>;
-    observed?: Record<string, unknown>;
-    status: TreeseedHostedServiceCheckStatus;
-    issues: string[];
-    remediation?: string;
-}
-export interface TreeseedHostedServiceCheckReport {
-    target: TreeseedHostedServiceTarget;
-    tenantRoot: string;
-    generatedAt: string;
-    summary: {
-        passed: number;
-        failed: number;
-        skipped: number;
-        warning: number;
-    };
-    checks: TreeseedHostedServiceCheck[];
-}
-export interface TreeseedObservedRailwayServiceState {
-    projectName?: string | null;
-    environmentName?: string | null;
-    serviceName?: string | null;
-    serviceId?: string | null;
-    rootDirectory?: string | null;
-    buildCommand?: string | null;
-    dockerfilePath?: string | null;
-    startCommand?: string | null;
-    healthcheckPath?: string | null;
-    healthcheckTimeoutSeconds?: number | null;
-    runtimeMode?: string | null;
-    deploymentStatus?: string | null;
-    deploymentHealthy?: boolean | null;
-    deploymentBranch?: string | null;
-    deploymentRepo?: string | null;
-    deploymentRootDirectory?: string | null;
-    deploymentCommitHash?: string | null;
-    deploymentRequiredMountPath?: string | null;
-    deploymentVolumeMounts?: string[];
-    volumeName?: string | null;
-    volumeId?: string | null;
-    volumeMountPath?: string | null;
-    volumeServiceId?: string | null;
-    volumeEnvironmentId?: string | null;
-    volumeState?: string | null;
-    volumePendingDeletion?: boolean | null;
-    volumeDeletedAt?: string | null;
-    variables?: Record<string, unknown> | string[];
-    secrets?: Record<string, unknown> | string[];
-    health?: 'ready' | 'failed' | 'unknown' | string | null;
-}
-export interface TreeseedHostedServiceCheckOptions {
-    tenantRoot: string;
-    target?: TreeseedHostedServiceTarget;
-    appId?: string;
-    serviceKeys?: string[];
-    now?: Date;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-    valuesOverlay?: Record<string, string | undefined>;
-    observedRailwayServices?: Record<string, TreeseedObservedRailwayServiceState | undefined>;
-    httpChecks?: Record<string, {
-        status?: number;
-        ok?: boolean;
-        skipped?: boolean;
-        error?: string;
-        fallbackUrl?: string;
-        fallbackStatus?: number;
-        fallbackOk?: boolean;
-        fallbackError?: string;
-    } | undefined>;
-}
-export declare function collectTreeseedHostedServiceChecks(options: TreeseedHostedServiceCheckOptions): TreeseedHostedServiceCheckReport;