@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/platform/environment.js

@@ -1,778 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { runTreeseedGit } from "../operations/services/git-runner.js";
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { parse as parseYaml } from "yaml";
-import { discoverTreeseedApplications } from "../hosting/apps.js";
-import { githubRepositoryCredentialEnvName } from "../operations/services/github-credentials.js";
-import { discoverTreeseedPackageAdapters } from "../operations/services/package-adapters.js";
-import { loadTreeseedDeployConfig } from "./deploy-config.js";
-import { loadTreeseedPlugins } from "./plugins.js";
-import { loadTreeseedManifest } from "./tenant-config.js";
-const TREESEED_ENVIRONMENT_SCOPES = ["local", "staging", "prod"];
-const TREESEED_ENVIRONMENT_REQUIREMENTS = ["required", "conditional", "optional", "generated"];
-const TREESEED_ENVIRONMENT_TARGETS = [
-  "local-runtime",
-  "local-cloudflare",
-  "github-secret",
-  "github-variable",
-  "cloudflare-secret",
-  "cloudflare-var",
-  "railway-secret",
-  "railway-var",
-  "config-file"
-];
-const TREESEED_ENVIRONMENT_PURPOSES = ["dev", "save", "deploy", "destroy", "config"];
-const TREESEED_ENVIRONMENT_SENSITIVITY = ["secret", "plain", "derived"];
-const TREESEED_ENVIRONMENT_STORAGE = ["scoped", "shared"];
-const TREESEED_CONFIG_STARTUP_PROFILES = ["core", "optional", "advanced"];
-const TREESEED_ENVIRONMENT_VISIBILITY = ["user", "system"];
-const moduleDir = dirname(fileURLToPath(import.meta.url));
-function firstExistingPath(candidates) {
-  return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
-}
-function resolveSdkEnvironmentPath() {
-  const candidates = [
-    resolve(moduleDir, "env.yaml"),
-    resolve(moduleDir, "../../src/platform/env.yaml"),
-    resolve(moduleDir, "../../dist/platform/env.yaml"),
-    resolve(moduleDir, "../src/platform/env.yaml"),
-    resolve(moduleDir, "../dist/platform/env.yaml")
-  ];
-  return firstExistingPath(candidates);
-}
-function resolveSiblingPackageEnvironmentPath(packageDir) {
-  return firstExistingPath([
-    resolve(moduleDir, `../../../${packageDir}/src/env.yaml`),
-    resolve(moduleDir, `../../../${packageDir}/dist/env.yaml`),
-    resolve(moduleDir, `../../${packageDir}/src/env.yaml`),
-    resolve(moduleDir, `../../${packageDir}/dist/env.yaml`)
-  ]);
-}
-const TENANT_ENVIRONMENT_OVERLAY_PATH = "src/env.yaml";
-const DEFAULT_TREESEED_MARKET_BASE_URL = "https://api.treeseed.dev";
-function loadOptionalTenantConfig() {
-  try {
-    return loadTreeseedManifest();
-  } catch {
-    return void 0;
-  }
-}
-function turnstileEnabled(context) {
-  return context.deployConfig.turnstile?.enabled === true;
-}
-function smtpEnabled(context) {
-  return context.deployConfig.smtp?.enabled === true;
-}
-function platformSurfaceEnabled(context, surface) {
-  return context.deployConfig.surfaces?.[surface]?.enabled !== false;
-}
-function activeWorkflowPlane() {
-  const plane = process.env.TREESEED_WORKFLOW_PLANE;
-  if (plane === "all") {
-    return null;
-  }
-  return plane === "web" || plane === "processing" ? plane : null;
-}
-function workflowPlaneAllows(plane) {
-  const activePlane = activeWorkflowPlane();
-  return activePlane === null || activePlane === plane;
-}
-function managedServiceEnabled(context, service) {
-  return context.deployConfig.services?.[service]?.enabled !== false;
-}
-function webSurfaceEnabled(context) {
-  if (!workflowPlaneAllows("web")) {
-    return false;
-  }
-  return platformSurfaceEnabled(context, "web");
-}
-function apiSurfaceEnabled(context) {
-  if (!workflowPlaneAllows("processing")) {
-    return false;
-  }
-  const apiSurfaceExplicitlyEnabled = context.deployConfig.surfaces?.api?.enabled === true;
-  const apiServiceConfigured = context.deployConfig.services?.api != null && managedServiceEnabled(context, "api");
-  return (apiSurfaceExplicitlyEnabled || apiServiceConfigured) && managedServiceEnabled(context, "api");
-}
-function processingPlaneEnabled(context) {
-  if (!workflowPlaneAllows("processing")) {
-    return false;
-  }
-  const mode = context.deployConfig.processing?.mode ?? "market-assigned";
-  if (mode === "team-owned" || mode === "project-owned" || mode === "local") {
-    return true;
-  }
-  return Object.entries(context.deployConfig.services ?? {}).some(
-    ([service, config]) => ["api", "manager", "worker", "workerRunner", "workdayStart", "workdayReport"].includes(service) && config && config.enabled !== false
-  );
-}
-function formsEnabled(context) {
-  return webSurfaceEnabled(context) && (context.deployConfig.providers?.forms ?? "store_only") !== "none";
-}
-function codexExecutionSelected(context) {
-  const execution = context.deployConfig.providers?.agents?.execution ?? "codex";
-  return execution === "codex" || execution === "codex_subscription";
-}
-function copilotExecutionSelected(context) {
-  return context.deployConfig.providers?.agents?.execution === "github_copilot";
-}
-function railwayManagedEnabled(context) {
-  if (!workflowPlaneAllows("processing")) {
-    return false;
-  }
-  if (!processingPlaneEnabled(context)) {
-    return false;
-  }
-  if (context.deployConfig.runtime?.mode === "treeseed_managed") {
-    return true;
-  }
-  if (context.deployConfig.runtime?.mode && context.deployConfig.runtime.mode !== "treeseed_managed") {
-    return false;
-  }
-  return Object.values(context.deployConfig.services ?? {}).some(
-    (service) => service && service.enabled !== false && (service.provider ?? "railway") === "railway"
-  );
-}
-function resolveHubMode(context) {
-  return context.deployConfig.hub?.mode ?? "treeseed_hosted";
-}
-function resolveRuntimeMode(context) {
-  return context.deployConfig.runtime?.mode ?? "none";
-}
-function resolveRuntimeRegistration(context) {
-  return context.deployConfig.runtime?.registration ?? "none";
-}
-function resolveHostingKind(context) {
-  return context.deployConfig.hosting?.kind ?? "self_hosted_project";
-}
-function resolveHostingRegistration(context) {
-  return context.deployConfig.hosting?.registration ?? "none";
-}
-function marketControlPlaneEnabled(context) {
-  return resolveHostingKind(context) === "treeseed_control_plane";
-}
-function hostedProjectEnabled(context) {
-  return resolveHostingKind(context) === "hosted_project";
-}
-function selfHostedProjectEnabled(context) {
-  return resolveHostingKind(context) === "self_hosted_project";
-}
-function projectRegistrationEnabled(context) {
-  return resolveRuntimeRegistration(context) === "optional" || resolveRuntimeRegistration(context) === "required";
-}
-function generatedSecret(bytes = 24) {
-  return randomBytes(bytes).toString("hex");
-}
-function localTimezoneDefault() {
-  return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
-}
-function localSmtpHostDefault() {
-  return "127.0.0.1";
-}
-function localSmtpPortDefault() {
-  return "1025";
-}
-function contactEmailDefault(context) {
-  return context.deployConfig.contactEmail?.trim() || "contact@example.com";
-}
-function workdayWindowsDefault() {
-  return JSON.stringify([{ days: [1, 2, 3, 4, 5], startTime: "09:00", endTime: "17:00" }]);
-}
-function localApiDatabaseUrlDefault(_context, _scope, values = {}) {
-  const port = values.TREESEED_MARKET_LOCAL_POSTGRES_PORT?.trim() || values.TREESEED_API_LOCAL_POSTGRES_PORT?.trim() || process.env.TREESEED_MARKET_LOCAL_POSTGRES_PORT?.trim() || "54329";
-  const database = values.TREESEED_MARKET_LOCAL_POSTGRES_DATABASE?.trim() || values.TREESEED_API_LOCAL_POSTGRES_DATABASE?.trim() || "treeseed_api";
-  const user = values.TREESEED_MARKET_LOCAL_POSTGRES_USER?.trim() || values.TREESEED_API_LOCAL_POSTGRES_USER?.trim() || "treeseed";
-  const password = values.TREESEED_MARKET_LOCAL_POSTGRES_PASSWORD?.trim() || values.TREESEED_API_LOCAL_POSTGRES_PASSWORD?.trim() || "treeseed-local-dev";
-  return `postgres://${encodeURIComponent(user)}:${encodeURIComponent(password)}@127.0.0.1:${port}/${encodeURIComponent(database)}`;
-}
-function normalizeUrl(value) {
-  return value.trim().replace(/\/$/u, "");
-}
-function primaryHostFromUrl(value) {
-  if (!value || value.trim().length === 0) {
-    return void 0;
-  }
-  try {
-    return new URL(value).host;
-  } catch {
-    return void 0;
-  }
-}
-function parseDomainList(value) {
-  return String(value ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
-}
-function deriveApiDomainFromProjectDomain(domain) {
-  if (!domain) {
-    return void 0;
-  }
-  if (domain.startsWith("api.")) {
-    return domain;
-  }
-  const segments = domain.split(".").filter(Boolean);
-  if (segments.length <= 2) {
-    return `api.${domain}`;
-  }
-  return `api.${segments.slice(1).join(".")}`;
-}
-function projectDomainsDefault(context, scope) {
-  if (scope === "staging") {
-    return context.deployConfig.surfaces?.web?.environments?.staging?.domain ?? primaryHostFromUrl(context.deployConfig.surfaces?.web?.environments?.staging?.baseUrl) ?? primaryHostFromUrl(context.deployConfig.siteUrl);
-  }
-  if (scope === "prod") {
-    return context.deployConfig.surfaces?.web?.environments?.prod?.domain ?? primaryHostFromUrl(context.deployConfig.surfaces?.web?.environments?.prod?.baseUrl) ?? primaryHostFromUrl(context.deployConfig.surfaces?.web?.publicBaseUrl) ?? primaryHostFromUrl(context.deployConfig.siteUrl);
-  }
-  return primaryHostFromUrl(context.deployConfig.siteUrl);
-}
-function resolveConfiguredApiBaseUrl(context, scope, values = {}) {
-  const localBaseUrl = context.deployConfig.services?.api?.environments?.local?.baseUrl ?? context.deployConfig.surfaces?.api?.localBaseUrl ?? "http://127.0.0.1:3000";
-  if (scope === "local") {
-    return normalizeUrl(localBaseUrl);
-  }
-  const scopedBaseUrl = context.deployConfig.services?.api?.environments?.[scope]?.baseUrl ?? context.deployConfig.services?.api?.publicBaseUrl ?? context.deployConfig.surfaces?.api?.publicBaseUrl;
-  if (scopedBaseUrl) {
-    return normalizeUrl(scopedBaseUrl);
-  }
-  const projectDomains = [
-    ...parseDomainList(values.TREESEED_PROJECT_DOMAINS),
-    primaryHostFromUrl(context.deployConfig.siteUrl)
-  ].filter(Boolean);
-  for (const domain of projectDomains) {
-    const apiDomain = deriveApiDomainFromProjectDomain(domain);
-    if (apiDomain) {
-      return `https://${apiDomain}`;
-    }
-  }
-  return void 0;
-}
-function resolveWebServiceId(_values = {}) {
-  return "web";
-}
-function resolveApiWebServiceId(values = {}) {
-  return values.TREESEED_WEB_SERVICE_ID?.trim() || "web";
-}
-function resolvePagesProjectName(context) {
-  return context.deployConfig.slug;
-}
-function resolvePagesPreviewProjectName(context, _scope, values = {}) {
-  return values.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME?.trim() || context.deployConfig.cloudflare.pages?.projectName?.trim() || context.deployConfig.slug;
-}
-function resolveContentBucketName(context) {
-  return `${context.deployConfig.slug}-content`;
-}
-function resolveContentBucketBinding(context) {
-  return context.deployConfig.cloudflare.r2?.binding?.trim() || "TREESEED_CONTENT_BUCKET";
-}
-function resolveMarketBaseUrl(context, _scope, values = {}) {
-  return values.TREESEED_API_BASE_URL?.trim() || values.TREESEED_CENTRAL_MARKET_API_BASE_URL?.trim() || process.env.TREESEED_API_BASE_URL?.trim() || process.env.TREESEED_CENTRAL_MARKET_API_BASE_URL?.trim() || context.deployConfig.runtime?.marketBaseUrl?.trim() || context.deployConfig.hosting?.marketBaseUrl?.trim() || DEFAULT_TREESEED_MARKET_BASE_URL;
-}
-function resolveCentralMarketBaseUrl(context, scope, values = {}) {
-  return values.TREESEED_CENTRAL_MARKET_API_BASE_URL?.trim() || process.env.TREESEED_CENTRAL_MARKET_API_BASE_URL?.trim() || resolveMarketBaseUrl(context, scope, values) || DEFAULT_TREESEED_MARKET_BASE_URL;
-}
-function resolveCatalogMarketBaseUrls(context, scope, values = {}) {
-  return values.TREESEED_CATALOG_MARKET_API_BASE_URLS?.trim() || values.TREESEED_API_BASE_URL?.trim() || values.TREESEED_CENTRAL_MARKET_API_BASE_URL?.trim() || process.env.TREESEED_CATALOG_MARKET_API_BASE_URLS?.trim() || resolveCentralMarketBaseUrl(context, scope, values);
-}
-function resolveHostedTeamId(context) {
-  return context.deployConfig.slug;
-}
-function resolveHostedProjectId(context) {
-  return context.deployConfig.slug;
-}
-function resolveRailwayWorkspaceDefault() {
-  return "knowledge-coop";
-}
-function resolvePlatformRunnerIdDefault(_context, scope) {
-  return scope === "prod" ? "treeseed-ops-prod-1" : scope === "staging" ? "treeseed-ops-staging-1" : "treeseed-ops-local-1";
-}
-function resolvePlatformRunnerEnvironmentDefault(_context, scope) {
-  return scope === "prod" ? "production" : scope;
-}
-function parseGitHubRepositorySlugFromRemote(remoteUrl) {
-  const normalized = String(remoteUrl ?? "").trim();
-  const sshMatch = normalized.match(/^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/u);
-  if (sshMatch) {
-    return { owner: sshMatch[1], name: sshMatch[2] };
-  }
-  const httpsMatch = normalized.match(/^https:\/\/github\.com\/([^/]+)\/(.+?)(?:\.git)?$/u);
-  if (httpsMatch) {
-    return { owner: httpsMatch[1], name: httpsMatch[2] };
-  }
-  return null;
-}
-function resolveGitHubOriginRepository(context) {
-  const rootResult = runTreeseedGit(["rev-parse", "--show-toplevel"], {
-    cwd: context.tenantRoot,
-    mode: "read",
-    allowFailure: true
-  });
-  if (rootResult.status !== 0 || resolve(rootResult.stdout.trim()) !== resolve(context.tenantRoot)) {
-    return null;
-  }
-  const result = runTreeseedGit(["remote", "get-url", "origin"], {
-    cwd: context.tenantRoot,
-    mode: "read",
-    allowFailure: true
-  });
-  if (result.status !== 0) {
-    return null;
-  }
-  return parseGitHubRepositorySlugFromRemote(result.stdout);
-}
-function resolveGitHubOwnerDefault(context) {
-  return resolveGitHubOriginRepository(context)?.owner;
-}
-function resolveGitHubRepositoryNameDefault(context) {
-  return resolveGitHubOriginRepository(context)?.name || context.deployConfig.slug;
-}
-const VALUE_RESOLVERS = {
-  generatedSecret: () => generatedSecret(),
-  localFormsBypassDefault: () => "true",
-  localSmtpHostDefault: () => localSmtpHostDefault(),
-  localSmtpPortDefault: () => localSmtpPortDefault(),
-  localApiDatabaseUrlDefault: (context, scope, values) => localApiDatabaseUrlDefault(context, scope, values),
-  contactEmailDefault: (context) => contactEmailDefault(context),
-  projectDomainsDefault: (context, scope) => projectDomainsDefault(context, scope),
-  apiBaseUrlDefault: (context, scope, values) => resolveConfiguredApiBaseUrl(context, scope, values),
-  webServiceIdDefault: (_context, _scope, values) => resolveWebServiceId(values),
-  apiWebServiceIdDefault: (_context, _scope, values) => resolveApiWebServiceId(values),
-  pagesProjectNameDefault: (context) => resolvePagesProjectName(context),
-  pagesPreviewProjectNameDefault: (context) => resolvePagesPreviewProjectName(context),
-  contentBucketNameDefault: (context) => resolveContentBucketName(context),
-  contentBucketBindingDefault: (context) => resolveContentBucketBinding(context),
-  hostingKindDefault: (context) => resolveHostingKind(context),
-  hostingRegistrationDefault: (context) => resolveHostingRegistration(context),
-  hubModeDefault: (context) => resolveHubMode(context),
-  runtimeModeDefault: (context) => resolveRuntimeMode(context),
-  runtimeRegistrationDefault: (context) => resolveRuntimeRegistration(context),
-  marketBaseUrlDefault: (context, scope, values) => resolveMarketBaseUrl(context, scope, values),
-  centralMarketBaseUrlDefault: (context, scope, values) => resolveCentralMarketBaseUrl(context, scope, values),
-  catalogMarketBaseUrlsDefault: (context, scope, values) => resolveCatalogMarketBaseUrls(context, scope, values),
-  hostingTeamIdDefault: (context) => resolveHostedTeamId(context),
-  hostingProjectIdDefault: (context) => resolveHostedProjectId(context),
-  railwayWorkspaceDefault: () => resolveRailwayWorkspaceDefault(),
-  platformRunnerIdDefault: (context, scope) => resolvePlatformRunnerIdDefault(context, scope),
-  platformRunnerEnvironmentDefault: (context, scope) => resolvePlatformRunnerEnvironmentDefault(context, scope),
-  platformRunnerDataDirDefault: () => "/data",
-  treedxDockerImageDefault: () => "treeseed/treedx:latest",
-  githubOwnerDefault: (context) => resolveGitHubOwnerDefault(context),
-  githubRepositoryNameDefault: (context) => resolveGitHubRepositoryNameDefault(context),
-  githubRepositoryVisibilityDefault: () => "private",
-  agentPoolMinWorkersDefault: () => "0",
-  agentPoolMaxWorkersDefault: () => "2",
-  agentPoolTargetQueueDepthDefault: () => "1",
-  agentPoolCooldownSecondsDefault: () => "60",
-  workdayTimezoneDefault: () => localTimezoneDefault(),
-  workdayWindowsDefault: () => workdayWindowsDefault(),
-  workdayTaskCreditBudgetDefault: () => "20",
-  managerMaxQueuedTasksDefault: () => "5",
-  managerMaxQueuedCreditsDefault: () => "20",
-  managerPriorityModelsDefault: () => "objective,question,note,page,book,knowledge",
-  taskCreditWeightsDefault: () => "[]",
-  workerPoolScalerDefault: (context) => railwayManagedEnabled(context) ? "railway" : "noop"
-};
-const PREDICATES = {
-  turnstileEnabled: (context) => turnstileEnabled(context),
-  turnstileNonLocal: (context, scope) => turnstileEnabled(context) && scope !== "local",
-  smtpEnabled: (context) => smtpEnabled(context),
-  smtpNonLocal: (context, scope) => smtpEnabled(context) && scope !== "local",
-  webSurfaceEnabled: (context) => webSurfaceEnabled(context),
-  apiSurfaceEnabled: (context) => apiSurfaceEnabled(context),
-  processingPlaneEnabled: (context) => processingPlaneEnabled(context),
-  formsEnabled: (context) => formsEnabled(context),
-  codexExecutionSelected: (context) => codexExecutionSelected(context),
-  copilotExecutionSelected: (context) => copilotExecutionSelected(context),
-  railwayManagedEnabled: (context) => railwayManagedEnabled(context),
-  hubTreeseedHosted: (context) => resolveHubMode(context) === "treeseed_hosted",
-  hubCustomerHosted: (context) => resolveHubMode(context) === "customer_hosted",
-  runtimeNone: (context) => resolveRuntimeMode(context) === "none",
-  runtimeByoAttached: (context) => resolveRuntimeMode(context) === "byo_attached",
-  runtimeTreeseedManaged: (context) => resolveRuntimeMode(context) === "treeseed_managed",
-  marketControlPlaneEnabled: (context) => marketControlPlaneEnabled(context),
-  hostedProjectEnabled: (context) => hostedProjectEnabled(context),
-  selfHostedProjectEnabled: (context) => selfHostedProjectEnabled(context),
-  projectRegistrationEnabled: (context) => projectRegistrationEnabled(context)
-};
-function deepMerge(left, right) {
-  if (Array.isArray(left) && Array.isArray(right)) {
-    return [...right];
-  }
-  if (left && typeof left === "object" && !Array.isArray(left) && right && typeof right === "object" && !Array.isArray(right)) {
-    const result = { ...left };
-    for (const [key, value] of Object.entries(right)) {
-      result[key] = key in result ? deepMerge(result[key], value) : value;
-    }
-    return result;
-  }
-  return right;
-}
-function normalizeOverlay(raw, label) {
-  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
-    throw new Error(`Invalid Treeseed environment registry overlay from ${label}.`);
-  }
-  const overlay = raw;
-  if (overlay.entries === void 0) {
-    return { entries: {} };
-  }
-  if (!overlay.entries || typeof overlay.entries !== "object" || Array.isArray(overlay.entries)) {
-    throw new Error(`Invalid Treeseed environment registry overlay entries in ${label}.`);
-  }
-  return overlay;
-}
-function readYamlOverlayIfPresent(filePath) {
-  if (!existsSync(filePath)) {
-    return null;
-  }
-  return normalizeOverlay(parseYaml(readFileSync(filePath, "utf8")), filePath);
-}
-function pluginEnvironmentCandidates(baseDir) {
-  const dir = resolve(baseDir);
-  return [
-    resolve(dir, "env.yaml"),
-    resolve(dir, "src/env.yaml"),
-    resolve(dir, "../env.yaml"),
-    resolve(dir, "../src/env.yaml"),
-    resolve(dir, "../../env.yaml"),
-    resolve(dir, "../../src/env.yaml")
-  ];
-}
-function readPluginEnvironmentOverlay(baseDir) {
-  for (const candidate of pluginEnvironmentCandidates(baseDir)) {
-    const overlay = readYamlOverlayIfPresent(candidate);
-    if (overlay) {
-      return { path: candidate, overlay };
-    }
-  }
-  return null;
-}
-function packageRepositoryCredentialOverlay(tenantRoot) {
-  const entries = {};
-  let packages = [];
-  try {
-    packages = discoverTreeseedPackageAdapters(tenantRoot);
-  } catch {
-    packages = [];
-  }
-  for (const pkg of packages) {
-    const repository = typeof pkg.metadata.repository === "string" && pkg.metadata.repository.trim() ? pkg.metadata.repository.trim() : null;
-    if (!repository) continue;
-    let id = "";
-    try {
-      id = githubRepositoryCredentialEnvName(repository);
-    } catch {
-      continue;
-    }
-    entries[id] = {
-      label: `${pkg.name} GitHub token`,
-      group: "github",
-      cluster: `github:${repository}`,
-      description: `GitHub token used by Treeseed package workflows for ${pkg.name} in ${repository}.`,
-      howToGet: `Create a GitHub token with Actions workflow and environment secret permissions for ${repository}, then store it as ${id}.`,
-      sensitivity: "secret",
-      targets: ["local-runtime"],
-      scopes: ["staging", "prod"],
-      storage: "shared",
-      requirement: "optional",
-      purposes: ["deploy", "config"],
-      validation: {
-        kind: "nonempty",
-        minLength: 8
-      },
-      sourcePriority: ["machine-config", "process-env"]
-    };
-  }
-  return { entries };
-}
-function loadTreeseedEnvironmentOverlay(tenantRoot) {
-  const overlayPath = resolve(tenantRoot, TENANT_ENVIRONMENT_OVERLAY_PATH);
-  return {
-    path: overlayPath,
-    overlay: readYamlOverlayIfPresent(overlayPath) ?? { entries: {} }
-  };
-}
-function resolveNamedValueResolver(ref) {
-  if (!ref) return void 0;
-  const resolver = VALUE_RESOLVERS[ref];
-  if (!resolver) {
-    throw new Error(`Unknown Treeseed environment value resolver "${ref}".`);
-  }
-  return resolver;
-}
-function resolveNamedPredicate(ref) {
-  if (!ref) return void 0;
-  const predicate = PREDICATES[ref];
-  if (!predicate) {
-    throw new Error(`Unknown Treeseed environment predicate "${ref}".`);
-  }
-  return predicate;
-}
-function materializeEntry(id, entry) {
-  return {
-    ...entry,
-    id,
-    cluster: entry.cluster ?? `${entry.group}:${id}`,
-    onboardingFeature: entry.onboardingFeature,
-    visibility: entry.visibility ?? "user",
-    startupProfile: entry.startupProfile ?? (entry.onboardingFeature ? "optional" : entry.group === "auth" || entry.id === "TREESEED_FORM_TOKEN_SECRET" || entry.group === "local-development" ? "core" : "advanced"),
-    storage: entry.storage ?? "scoped",
-    defaultValue: resolveNamedValueResolver(entry.defaultValueRef),
-    localDefaultValue: resolveNamedValueResolver(entry.localDefaultValueRef),
-    isRelevant: resolveNamedPredicate(entry.relevanceRef),
-    requiredWhen: resolveNamedPredicate(entry.requiredWhenRef)
-  };
-}
-function mergeEntryYaml(baseEntry, id, override) {
-  const merged = baseEntry ? deepMerge(baseEntry, override) : override;
-  if (typeof merged.label !== "string" || typeof merged.group !== "string" || merged.cluster !== void 0 && typeof merged.cluster !== "string" || merged.onboardingFeature !== void 0 && typeof merged.onboardingFeature !== "string" || merged.startupProfile !== void 0 && !TREESEED_CONFIG_STARTUP_PROFILES.includes(merged.startupProfile) || typeof merged.description !== "string" || typeof merged.howToGet !== "string" || !Array.isArray(merged.targets) || !Array.isArray(merged.scopes) || typeof merged.requirement !== "string" || !Array.isArray(merged.purposes) || typeof merged.sensitivity !== "string") {
-    throw new Error(`Treeseed environment registry entry "${id}" is missing required metadata after merge.`);
-  }
-  return merged;
-}
-function collectOverlaySources(context) {
-  const sources = [];
-  const sdkEnvironmentPath = resolveSdkEnvironmentPath();
-  const sdkOverlay = readYamlOverlayIfPresent(sdkEnvironmentPath);
-  if (!sdkOverlay) {
-    throw new Error(`Treeseed SDK environment registry file was not found at ${sdkEnvironmentPath}.`);
-  }
-  sources.push({ label: sdkEnvironmentPath, overlay: sdkOverlay });
-  if (webSurfaceEnabled(context)) {
-    const coreEnvironmentPath = resolveSiblingPackageEnvironmentPath("core");
-    const coreOverlay = readYamlOverlayIfPresent(coreEnvironmentPath);
-    if (coreOverlay) {
-      sources.push({ label: coreEnvironmentPath, overlay: coreOverlay });
-    }
-  }
-  if (apiSurfaceEnabled(context) || processingPlaneEnabled(context)) {
-    const apiEnvironmentPath = resolveSiblingPackageEnvironmentPath("api");
-    const apiOverlay = readYamlOverlayIfPresent(apiEnvironmentPath);
-    if (apiOverlay) {
-      sources.push({ label: apiEnvironmentPath, overlay: apiOverlay });
-    }
-    const agentEnvironmentPath = resolveSiblingPackageEnvironmentPath("agent");
-    const agentOverlay = readYamlOverlayIfPresent(agentEnvironmentPath);
-    if (agentOverlay) {
-      sources.push({ label: agentEnvironmentPath, overlay: agentOverlay });
-    }
-  }
-  let discoveredApiApps = [];
-  try {
-    discoveredApiApps = discoverTreeseedApplications(context.tenantRoot).filter((application) => application.root !== context.tenantRoot && application.roles.some((role) => role === "api" || role === "operations-runner" || role === "treeseed-control-plane"));
-  } catch {
-    discoveredApiApps = [];
-  }
-  const discoveredApiEnvironmentPath = resolveSiblingPackageEnvironmentPath("api");
-  if (discoveredApiApps.length > 0 && !sources.some((source) => source.label === discoveredApiEnvironmentPath)) {
-    const apiOverlay = readYamlOverlayIfPresent(discoveredApiEnvironmentPath);
-    if (apiOverlay) {
-      sources.push({ label: discoveredApiEnvironmentPath, overlay: apiOverlay });
-    }
-  }
-  for (const application of discoveredApiApps) {
-    const overlay = readYamlOverlayIfPresent(resolve(application.root, "src/env.yaml"));
-    if (overlay) {
-      sources.push({ label: resolve(application.root, "src/env.yaml"), overlay });
-    }
-  }
-  const packageCredentialOverlay = packageRepositoryCredentialOverlay(context.tenantRoot);
-  if (Object.keys(packageCredentialOverlay.entries ?? {}).length > 0) {
-    sources.push({ label: "discovered package repository credentials", overlay: packageCredentialOverlay });
-  }
-  for (const pluginEntry of context.plugins) {
-    const fileOverlay = readPluginEnvironmentOverlay(pluginEntry.baseDir);
-    if (fileOverlay) {
-      sources.push({ label: fileOverlay.path, overlay: fileOverlay.overlay });
-    }
-    const overlaySource = pluginEntry.plugin.environmentRegistry;
-    if (!overlaySource) {
-      continue;
-    }
-    const pluginContext = {
-      projectRoot: context.tenantRoot,
-      tenantConfig: context.tenantConfig,
-      deployConfig: context.deployConfig,
-      pluginConfig: pluginEntry.config
-    };
-    const overlay = typeof overlaySource === "function" ? overlaySource(pluginContext) : overlaySource;
-    if (overlay) {
-      sources.push({
-        label: `plugin ${pluginEntry.package}`,
-        overlay: normalizeOverlay(overlay, `plugin ${pluginEntry.package}`)
-      });
-    }
-  }
-  const tenantOverlay = loadTreeseedEnvironmentOverlay(context.tenantRoot);
-  sources.push({ label: tenantOverlay.path, overlay: tenantOverlay.overlay });
-  return sources;
-}
-function resolveTreeseedEnvironmentContext(options = {}) {
-  const deployConfig = options.deployConfig ?? loadTreeseedDeployConfig();
-  const tenantConfig = options.tenantConfig ?? loadOptionalTenantConfig();
-  const plugins = options.plugins ?? loadTreeseedPlugins(deployConfig);
-  const tenantRoot = deployConfig.__tenantRoot ?? tenantConfig?.__tenantRoot ?? process.cwd();
-  return {
-    deployConfig,
-    tenantConfig,
-    plugins,
-    tenantRoot
-  };
-}
-function resolveTreeseedEnvironmentRegistry(options = {}) {
-  const context = resolveTreeseedEnvironmentContext(options);
-  const entriesById = /* @__PURE__ */ new Map();
-  const order = [];
-  for (const source of collectOverlaySources(context)) {
-    for (const [id, override] of Object.entries(source.overlay.entries ?? {})) {
-      const current = entriesById.get(id);
-      entriesById.set(id, mergeEntryYaml(current, id, override ?? {}));
-      if (!current) {
-        order.push(id);
-      }
-    }
-  }
-  return {
-    context,
-    entries: order.map((id) => materializeEntry(id, entriesById.get(id)))
-  };
-}
-function isTreeseedEnvironmentEntryRelevant(entry, context, scope, purpose) {
-  if (!entry.scopes.includes(scope)) {
-    return false;
-  }
-  if (purpose && !entry.purposes.includes(purpose)) {
-    return false;
-  }
-  if (entry.isRelevant) {
-    return entry.isRelevant(context, scope, purpose);
-  }
-  return true;
-}
-function isEntryRequired(entry, context, scope, purpose) {
-  if (entry.requirement === "required") {
-    return true;
-  }
-  if (entry.requirement === "conditional") {
-    return entry.requiredWhen ? entry.requiredWhen(context, scope, purpose) : true;
-  }
-  return false;
-}
-function materializeDefaultValue(entry, context, scope, values = {}) {
-  const source = scope === "local" && entry.localDefaultValue !== void 0 ? entry.localDefaultValue : entry.defaultValue;
-  if (source === void 0) {
-    return void 0;
-  }
-  return typeof source === "function" ? source(context, scope, values) : source;
-}
-function getTreeseedEnvironmentSuggestedValues(options) {
-  const registry = resolveTreeseedEnvironmentRegistry(options);
-  const suggestedValues = {};
-  const seedValues = { ...options.values ?? {} };
-  for (const entry of registry.entries.filter(
-    (candidate) => isTreeseedEnvironmentEntryRelevant(candidate, registry.context, options.scope, options.purpose)
-  )) {
-    const value = materializeDefaultValue(entry, registry.context, options.scope, { ...suggestedValues, ...seedValues });
-    if (value === void 0) {
-      continue;
-    }
-    suggestedValues[entry.id] = value;
-  }
-  return suggestedValues;
-}
-function isTreeseedEnvironmentEntryRequired(entry, context, scope, purpose) {
-  return isEntryRequired(entry, context, scope, purpose);
-}
-function valuePresent(value) {
-  return typeof value === "string" && value.trim().length > 0;
-}
-function validateValue(entry, value) {
-  if (!entry.validation) {
-    return null;
-  }
-  switch (entry.validation.kind) {
-    case "string":
-    case "nonempty": {
-      if (!valuePresent(value)) {
-        return `${entry.id} must be a non-empty string.`;
-      }
-      if (typeof entry.validation.minLength === "number" && value.trim().length < entry.validation.minLength) {
-        return `${entry.id} must be at least ${entry.validation.minLength} characters.`;
-      }
-      return null;
-    }
-    case "boolean":
-      return /^(true|false|1|0)$/i.test(value) ? null : `${entry.id} must be true or false.`;
-    case "number":
-      return Number.isFinite(Number(value)) ? null : `${entry.id} must be a number.`;
-    case "url":
-      try {
-        new URL(value);
-        return null;
-      } catch {
-        return `${entry.id} must be a valid URL.`;
-      }
-    case "email":
-      return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) ? null : `${entry.id} must be a valid email address.`;
-    case "enum":
-      return entry.validation.values.includes(value) ? null : `${entry.id} must be one of: ${entry.validation.values.join(", ")}.`;
-    default:
-      return null;
-  }
-}
-function validateTreeseedEnvironmentValues(options) {
-  const registry = resolveTreeseedEnvironmentRegistry(options);
-  const relevantEntries = registry.entries.filter(
-    (entry) => isTreeseedEnvironmentEntryRelevant(entry, registry.context, options.scope, options.purpose)
-  );
-  const requiredEntries = relevantEntries.filter(
-    (entry) => isEntryRequired(entry, registry.context, options.scope, options.purpose)
-  );
-  const missing = [];
-  const invalid = [];
-  for (const entry of requiredEntries) {
-    const value = options.values[entry.id];
-    if (!valuePresent(value)) {
-      missing.push({
-        id: entry.id,
-        label: entry.label,
-        reason: "missing",
-        message: `${entry.id} is required for ${options.purpose} (${options.scope}). ${entry.howToGet}`,
-        entry
-      });
-      continue;
-    }
-    const validationMessage = validateValue(entry, value);
-    if (validationMessage) {
-      invalid.push({
-        id: entry.id,
-        label: entry.label,
-        reason: "invalid",
-        message: validationMessage,
-        entry
-      });
-    }
-  }
-  return {
-    ok: missing.length === 0 && invalid.length === 0,
-    entries: relevantEntries,
-    required: requiredEntries,
-    missing,
-    invalid
-  };
-}
-export {
-  TREESEED_CONFIG_STARTUP_PROFILES,
-  TREESEED_ENVIRONMENT_PURPOSES,
-  TREESEED_ENVIRONMENT_REQUIREMENTS,
-  TREESEED_ENVIRONMENT_SCOPES,
-  TREESEED_ENVIRONMENT_SENSITIVITY,
-  TREESEED_ENVIRONMENT_STORAGE,
-  TREESEED_ENVIRONMENT_TARGETS,
-  TREESEED_ENVIRONMENT_VISIBILITY,
-  getTreeseedEnvironmentSuggestedValues,
-  isTreeseedEnvironmentEntryRelevant,
-  isTreeseedEnvironmentEntryRequired,
-  loadTreeseedEnvironmentOverlay,
-  resolveTreeseedEnvironmentContext,
-  resolveTreeseedEnvironmentRegistry,
-  validateTreeseedEnvironmentValues
-};