@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/secrets-capability.js

@@ -1,530 +0,0 @@
-const TREESEED_SECRET_CUSTODY_MODES = [
-  "github_actions_secret_enclave",
-  "client_encrypted_escrow",
-  "metadata_only_reentry",
-  "host_env_injection",
-  "bootstrap_service_secret",
-  "provider_owned_secret",
-  "external_vault_reference"
-];
-const TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS = ["github-app"];
-const TREESEED_SECRET_CLASSES = [
-  "repository_access",
-  "workflow_secret",
-  "host_runtime_secret",
-  "provider_runtime_secret",
-  "bootstrap_service_secret",
-  "customer_project_secret"
-];
-const TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES = [
-  "full_repository_workspace",
-  "brokered_file_collection",
-  "workflow_operation_only"
-];
-const TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES = ["allowlisted"];
-const TREESEED_SECRET_METADATA_RECORD_STATUSES = ["active", "migrated", "tombstoned", "blocked"];
-const TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES = ["active", "drifted", "revoked", "blocked"];
-const TREESEED_GITHUB_APP_INSTALLATION_STATUSES = ["active", "drifted", "revoked", "suspended", "blocked"];
-const TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES = ["issued", "expired", "revoked", "blocked"];
-const TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES = ["active", "blocked", "drifted", "archived"];
-const TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES = [
-  "queued",
-  "dispatched",
-  "running",
-  "succeeded",
-  "failed",
-  "cancelled",
-  "blocked"
-];
-const TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES = ["issued", "expired", "revoked", "blocked"];
-const TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS = [
-  "clone",
-  "fetch",
-  "save",
-  "commit",
-  "push",
-  "pull_request",
-  "repository_update"
-];
-const TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES = [
-  "github_grant_revoked",
-  "github_grant_drifted",
-  "github_installation_missing",
-  "github_installation_revoked",
-  "github_installation_suspended",
-  "github_repository_removed",
-  "github_account_mismatch",
-  "github_permission_drift",
-  "github_app_token_blocked",
-  "github_environment_missing",
-  "workflow_trust_drift",
-  "workflow_dispatch_blocked",
-  "treedx_credential_expired",
-  "treedx_credential_revoked",
-  "assignment_lease_revoked"
-];
-const TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES = [
-  "active",
-  "migrated",
-  "expired",
-  "tombstoned",
-  "reentry_required"
-];
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function stringArrayIncludes(values, value) {
-  return typeof value === "string" && values.includes(value);
-}
-function addProblem(problems, path, code, message) {
-  problems.push({ path, code, message });
-}
-function containsTreeseedPlaintextSecretMaterial(value) {
-  if (!isRecord(value)) return false;
-  const forbiddenKeys = /* @__PURE__ */ new Set([
-    "plaintext",
-    "plainText",
-    "value",
-    "raw",
-    "rawSecret",
-    "secretValue",
-    "unencrypted",
-    "token",
-    "accessToken",
-    "privateKey",
-    "sshPrivateKey",
-    "passphrase",
-    "password",
-    "derivedKey",
-    "decrypted",
-    "decryptedPayload",
-    "decryptedSecret"
-  ]);
-  for (const [key, nested] of Object.entries(value)) {
-    if (forbiddenKeys.has(key)) return true;
-    if (isRecord(nested) && containsTreeseedPlaintextSecretMaterial(nested)) return true;
-  }
-  return false;
-}
-function isTreeseedSecretCustodyMode(value) {
-  return stringArrayIncludes(TREESEED_SECRET_CUSTODY_MODES, value);
-}
-function isTreeseedV1RepositoryCredentialProvider(value) {
-  return stringArrayIncludes(TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS, value);
-}
-function requiresClientSideSecretMaterial(mode) {
-  return mode === "client_encrypted_escrow";
-}
-function isApiServiceDecryptableCustomerSecret(metadata) {
-  return metadata.owner?.kind === "customer" && metadata.apiDecryptable === true;
-}
-function validateTreeseedWritableSecretMetadata(input, path = "$") {
-  const problems = [];
-  if (!isRecord(input)) {
-    addProblem(problems, path, "invalid_registry", "Secret metadata must be an object.");
-    return problems;
-  }
-  const metadata = input;
-  if (isApiServiceDecryptableCustomerSecret(metadata)) {
-    addProblem(
-      problems,
-      `${path}.apiDecryptable`,
-      "api_decryptable_customer_secret",
-      "Customer project secrets must not be decryptable by the TreeSeed API service."
-    );
-  }
-  if (metadata.owner?.kind === "customer" && metadata.plaintextAllowed === true) {
-    addProblem(
-      problems,
-      `${path}.plaintextAllowed`,
-      "api_decryptable_customer_secret",
-      "Customer project secrets must not allow plaintext persistence."
-    );
-  }
-  if (containsTreeseedPlaintextSecretMaterial(input)) {
-    addProblem(
-      problems,
-      path,
-      "plaintext_escrow_material",
-      "Secret metadata must not include plaintext secret material."
-    );
-  }
-  if (metadata.custodyMode === "client_encrypted_escrow") {
-    const hasEscrowReference = typeof input.escrowRecordId === "string" || typeof input.escrow_record_id === "string";
-    if (!hasEscrowReference) {
-      addProblem(
-        problems,
-        path,
-        "invalid_secret_custody_target",
-        "Client-encrypted escrow secret metadata must reference an escrow record."
-      );
-    }
-  }
-  if (metadata.custodyMode === "github_actions_secret_enclave") {
-    const target = input.githubSecretTarget ?? input.github_secret_target;
-    if (!isRecord(target)) {
-      addProblem(
-        problems,
-        path,
-        "invalid_secret_custody_target",
-        "GitHub Actions secret enclave metadata must include a GitHub secret target."
-      );
-    }
-  }
-  return problems;
-}
-function assertTreeseedWritableSecretMetadata(input) {
-  const problems = validateTreeseedWritableSecretMetadata(input);
-  if (problems.length > 0) {
-    const message = problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
-    throw new Error(`Invalid Treeseed secret metadata.
-${message}`);
-  }
-  return input;
-}
-function validateTreeseedClientEncryptedEscrowMetadata(input, path = "$") {
-  const problems = [];
-  if (!isRecord(input)) {
-    addProblem(problems, path, "invalid_registry", "Client-encrypted escrow metadata must be an object.");
-    return problems;
-  }
-  if (containsTreeseedPlaintextSecretMaterial(input)) {
-    addProblem(
-      problems,
-      path,
-      "plaintext_escrow_material",
-      "Client-encrypted escrow records must contain ciphertext metadata only."
-    );
-  }
-  if (typeof input.ciphertextRef !== "string" || !input.ciphertextRef.trim()) {
-    addProblem(
-      problems,
-      `${path}.ciphertextRef`,
-      "invalid_secret_custody_target",
-      "Client-encrypted escrow records must include a ciphertext reference."
-    );
-  }
-  const hasInlineCiphertext = typeof input.ciphertext === "string" && input.ciphertext.trim();
-  if (hasInlineCiphertext) {
-    for (const key of ["algorithm", "nonce", "salt", "kdf", "wrappingKeyId", "encryptionVersion"]) {
-      if (typeof input[key] !== "string" || !String(input[key]).trim()) {
-        addProblem(
-          problems,
-          `${path}.${key}`,
-          "invalid_secret_custody_target",
-          `Inline client-encrypted escrow envelopes must include ${key}.`
-        );
-      }
-    }
-    if (!isRecord(input.kdfParams)) {
-      addProblem(
-        problems,
-        `${path}.kdfParams`,
-        "invalid_secret_custody_target",
-        "Inline client-encrypted escrow envelopes must include KDF parameters."
-      );
-    }
-  }
-  if (isRecord(input.deploymentIntent)) {
-    const targetMode = input.deploymentIntent.targetMode;
-    if (targetMode !== void 0 && ![
-      "github_actions_secret_enclave",
-      "host_env_injection",
-      "metadata_only_reentry"
-    ].includes(String(targetMode))) {
-      addProblem(
-        problems,
-        `${path}.deploymentIntent.targetMode`,
-        "invalid_secret_custody_target",
-        "Client-encrypted escrow deployment intent must target GitHub Secrets, host injection, or metadata-only re-entry."
-      );
-    }
-  }
-  return problems;
-}
-function assertTreeseedClientEncryptedEscrowMetadata(input) {
-  const problems = validateTreeseedClientEncryptedEscrowMetadata(input);
-  if (problems.length > 0) {
-    const message = problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
-    throw new Error(`Invalid Treeseed client-encrypted escrow metadata.
-${message}`);
-  }
-  return input;
-}
-function buildTreeseedClientEncryptedEscrowEnvelope(input) {
-  return assertTreeseedClientEncryptedEscrowMetadata({
-    ...input,
-    metadata: input.metadata ?? {}
-  });
-}
-function summarizeTreeseedClientEncryptedEscrowStatus(input, now = /* @__PURE__ */ new Date()) {
-  const expired = Boolean(input.expiresAt && Date.parse(input.expiresAt) <= now.getTime());
-  const tombstoned = Boolean(input.tombstonedAt) || input.status === "tombstoned";
-  const migrated = Boolean(input.migratedTo) || input.status === "migrated";
-  const reentryRequired = input.status === "reentry_required" || expired && !migrated && !tombstoned;
-  const status = tombstoned ? "tombstoned" : migrated ? "migrated" : reentryRequired ? "reentry_required" : expired ? "expired" : input.status ?? "active";
-  return {
-    status,
-    escrowed: !migrated && !tombstoned,
-    migrated,
-    expired,
-    tombstoned,
-    reentryRequired,
-    migrationTarget: input.migratedTo ?? null,
-    expiresAt: input.expiresAt ?? null
-  };
-}
-function summarizeTreeseedWorkflowCloudAccessDiagnostics(operation) {
-  const trustPolicy = isRecord(operation.trustPolicy) ? operation.trustPolicy : isRecord(operation.metadata) && isRecord(operation.metadata.trustPolicy) ? operation.metadata.trustPolicy : {};
-  const cloudAccess = isRecord(trustPolicy.cloudAccess) ? trustPolicy.cloudAccess : {};
-  if (operation.secretBearing === true && cloudAccess.longLivedSecrets === true && cloudAccess.oidcPreferred !== true) {
-    return [{
-      code: "oidc_preferred_for_cloud_access",
-      severity: "warning",
-      message: "Secret-bearing cloud workflows should prefer GitHub OIDC over long-lived cloud API keys when the target cloud supports it."
-    }];
-  }
-  return [];
-}
-function validateTreeseedGitHubActionsEncryptedSecretDeployment(input, path = "$") {
-  const problems = [];
-  if (!isRecord(input)) {
-    addProblem(problems, path, "invalid_registry", "GitHub Actions encrypted secret deployment must be an object.");
-    return problems;
-  }
-  if (containsTreeseedPlaintextSecretMaterial(input)) {
-    addProblem(
-      problems,
-      path,
-      "plaintext_escrow_material",
-      "GitHub Actions secret deployment payloads must contain GitHub-encrypted values only."
-    );
-  }
-  for (const key of ["repository", "scope", "secretName", "encryptedValue", "keyId"]) {
-    if (typeof input[key] !== "string" || !String(input[key]).trim()) {
-      addProblem(
-        problems,
-        `${path}.${key}`,
-        "invalid_secret_custody_target",
-        `GitHub Actions encrypted secret deployment must include ${key}.`
-      );
-    }
-  }
-  if (input.scope === "environment" && (typeof input.environment !== "string" || !input.environment.trim())) {
-    addProblem(
-      problems,
-      `${path}.environment`,
-      "invalid_secret_custody_target",
-      "GitHub environment secret deployment must include an environment."
-    );
-  }
-  return problems;
-}
-function assertTreeseedGitHubActionsEncryptedSecretDeployment(input) {
-  const problems = validateTreeseedGitHubActionsEncryptedSecretDeployment(input);
-  if (problems.length > 0) {
-    const message = problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
-    throw new Error(`Invalid Treeseed GitHub Actions encrypted secret deployment.
-${message}`);
-  }
-  return input;
-}
-function validateTreeseedSecretsCapabilityRegistry(input) {
-  const problems = [];
-  if (!isRecord(input)) {
-    addProblem(problems, "$", "invalid_registry", "Secrets capability registry must be an object.");
-    return { ok: false, problems, registry: null };
-  }
-  const registry = input;
-  const repositoryCredentialProviders = isRecord(input.repositoryCredentialProviders) ? input.repositoryCredentialProviders : {};
-  for (const key of Object.keys(repositoryCredentialProviders)) {
-    if (key !== "githubApp") {
-      addProblem(
-        problems,
-        `repositoryCredentialProviders.${key}`,
-        "unsupported_repository_credential_provider",
-        "Only GitHub App repository credential providers are supported in v1."
-      );
-    }
-  }
-  const githubApp = repositoryCredentialProviders.githubApp;
-  if (githubApp !== void 0 && isRecord(githubApp) && githubApp.type !== "github-app") {
-    addProblem(
-      problems,
-      "repositoryCredentialProviders.githubApp.type",
-      "unsupported_repository_credential_provider",
-      'GitHub App provider config must use type "github-app".'
-    );
-  }
-  const secrets = Array.isArray(input.secrets) ? input.secrets : [];
-  secrets.forEach((secret, index) => {
-    if (!isRecord(secret)) return;
-    problems.push(...validateTreeseedWritableSecretMetadata(secret, `secrets.${index}`));
-  });
-  const operations = isRecord(input.workflowOperations) && Array.isArray(input.workflowOperations.operations) ? input.workflowOperations.operations : [];
-  operations.forEach((operation, index) => {
-    if (!isRecord(operation)) return;
-    const dispatch = isRecord(operation.dispatch) ? operation.dispatch : {};
-    if (operation.secretBearing === true && (dispatch.mode !== "allowlisted" || dispatch.arbitraryDispatch === true)) {
-      addProblem(
-        problems,
-        `workflowOperations.operations.${index}.dispatch`,
-        "arbitrary_secret_workflow_dispatch",
-        "Secret-bearing workflow operations must use allowlisted dispatch only."
-      );
-    }
-    if (operation.secretBearing === true && operation.providerSuppliedCommandsAllowed === true) {
-      addProblem(
-        problems,
-        `workflowOperations.operations.${index}.providerSuppliedCommandsAllowed`,
-        "arbitrary_secret_workflow_dispatch",
-        "Secret-bearing workflow operations must not run provider-supplied commands."
-      );
-    }
-    const trustPolicy = isRecord(operation.trustPolicy) ? operation.trustPolicy : isRecord(operation.metadata) && isRecord(operation.metadata.trustPolicy) ? operation.metadata.trustPolicy : {};
-    if (operation.secretBearing === true) {
-      if (!Array.isArray(trustPolicy.protectedRefs) || trustPolicy.protectedRefs.length === 0) {
-        addProblem(
-          problems,
-          `workflowOperations.operations.${index}.trustPolicy.protectedRefs`,
-          "arbitrary_secret_workflow_dispatch",
-          "Secret-bearing workflow operations must declare protected refs."
-        );
-      }
-      if (!Array.isArray(trustPolicy.allowedWorkflowFiles) || trustPolicy.allowedWorkflowFiles.length === 0) {
-        addProblem(
-          problems,
-          `workflowOperations.operations.${index}.trustPolicy.allowedWorkflowFiles`,
-          "arbitrary_secret_workflow_dispatch",
-          "Secret-bearing workflow operations must declare allowlisted workflow files."
-        );
-      }
-      if (trustPolicy.allowUntrustedCheckout === true) {
-        addProblem(
-          problems,
-          `workflowOperations.operations.${index}.trustPolicy.allowUntrustedCheckout`,
-          "arbitrary_secret_workflow_dispatch",
-          "Secret-bearing workflow operations must not run untrusted branch code."
-        );
-      }
-      if (trustPolicy.allowLocalActions === true) {
-        addProblem(
-          problems,
-          `workflowOperations.operations.${index}.trustPolicy.allowLocalActions`,
-          "arbitrary_secret_workflow_dispatch",
-          "Secret-bearing workflow operations must not execute repository-local actions unless a future trusted action scanner is implemented."
-        );
-      }
-      if (trustPolicy.artifactPolicy !== void 0 && !["none", "metadata_only"].includes(String(trustPolicy.artifactPolicy))) {
-        addProblem(
-          problems,
-          `workflowOperations.operations.${index}.trustPolicy.artifactPolicy`,
-          "arbitrary_secret_workflow_dispatch",
-          "Secret-bearing workflow operations may only expose no artifacts or metadata-only artifact observations in v1."
-        );
-      }
-      if (trustPolicy.cachePolicy !== void 0 && !["disabled", "metadata_only"].includes(String(trustPolicy.cachePolicy))) {
-        addProblem(
-          problems,
-          `workflowOperations.operations.${index}.trustPolicy.cachePolicy`,
-          "arbitrary_secret_workflow_dispatch",
-          "Secret-bearing workflow operations may only disable cache use or expose metadata-only cache observations in v1."
-        );
-      }
-    }
-  });
-  const trustedExecutionSets = isRecord(input.workflowOperations) && Array.isArray(input.workflowOperations.trustedExecutionSets) ? input.workflowOperations.trustedExecutionSets : [];
-  trustedExecutionSets.forEach((executionSet, index) => {
-    if (!isRecord(executionSet)) return;
-    if (executionSet.allowProviderSuppliedCommands === true) {
-      addProblem(
-        problems,
-        `workflowOperations.trustedExecutionSets.${index}.allowProviderSuppliedCommands`,
-        "arbitrary_secret_workflow_dispatch",
-        "Trusted execution sets must not allow provider-supplied commands in v1."
-      );
-    }
-    if (executionSet.allowLocalActions === true) {
-      addProblem(
-        problems,
-        `workflowOperations.trustedExecutionSets.${index}.allowLocalActions`,
-        "arbitrary_secret_workflow_dispatch",
-        "Trusted execution sets for secret-bearing operations must not allow repository-local actions in v1."
-      );
-    }
-    if (executionSet.allowUntrustedCheckout === true) {
-      addProblem(
-        problems,
-        `workflowOperations.trustedExecutionSets.${index}.allowUntrustedCheckout`,
-        "arbitrary_secret_workflow_dispatch",
-        "Trusted execution sets for secret-bearing operations must not allow untrusted branch checkout in v1."
-      );
-    }
-  });
-  if (isRecord(input.capacityProviderWorkspaceDefaults)) {
-    if (input.capacityProviderWorkspaceDefaults.receivesSecrets !== false) {
-      addProblem(
-        problems,
-        "capacityProviderWorkspaceDefaults.receivesSecrets",
-        "provider_secret_delegation",
-        "Capacity providers must receive handles or workspace access, not customer secrets."
-      );
-    }
-    if (input.capacityProviderWorkspaceDefaults.directSecretDelegation === true) {
-      addProblem(
-        problems,
-        "capacityProviderWorkspaceDefaults.directSecretDelegation",
-        "provider_secret_delegation",
-        "Direct provider/customer secret delegation is not supported."
-      );
-    }
-  }
-  if (isRecord(input.clientEncryptedEscrow) && Array.isArray(input.clientEncryptedEscrow.metadataRecords)) {
-    input.clientEncryptedEscrow.metadataRecords.forEach((record, index) => {
-      problems.push(...validateTreeseedClientEncryptedEscrowMetadata(record, `clientEncryptedEscrow.metadataRecords.${index}`));
-    });
-  }
-  return { ok: problems.length === 0, problems, registry };
-}
-function assertTreeseedSecretsCapabilityRegistry(input) {
-  const validation = validateTreeseedSecretsCapabilityRegistry(input);
-  if (!validation.ok || validation.registry === null) {
-    const message = validation.problems.map((problem) => `${problem.path}: ${problem.message}`).join("\n");
-    throw new Error(`Invalid Treeseed secrets capability registry.
-${message}`);
-  }
-  return validation.registry;
-}
-export {
-  TREESEED_CLIENT_ENCRYPTED_ESCROW_STATUSES,
-  TREESEED_GITHUB_APP_INSTALLATION_STATUSES,
-  TREESEED_GITHUB_APP_TOKEN_ISSUANCE_STATUSES,
-  TREESEED_GITHUB_REPOSITORY_GRANT_STATUSES,
-  TREESEED_PROVIDER_WORKSPACE_ACCESS_MODES,
-  TREESEED_SECRET_CAPABILITY_FAIL_CLOSED_CODES,
-  TREESEED_SECRET_CLASSES,
-  TREESEED_SECRET_CUSTODY_MODES,
-  TREESEED_SECRET_METADATA_RECORD_STATUSES,
-  TREESEED_TREEDX_CREDENTIAL_BRIDGE_OPERATIONS,
-  TREESEED_TREEDX_CREDENTIAL_ISSUANCE_STATUSES,
-  TREESEED_V1_REPOSITORY_CREDENTIAL_PROVIDERS,
-  TREESEED_WORKFLOW_DISPATCH_RECORD_STATUSES,
-  TREESEED_WORKFLOW_OPERATION_DISPATCH_MODES,
-  TREESEED_WORKFLOW_OPERATION_RECORD_STATUSES,
-  assertTreeseedClientEncryptedEscrowMetadata,
-  assertTreeseedGitHubActionsEncryptedSecretDeployment,
-  assertTreeseedSecretsCapabilityRegistry,
-  assertTreeseedWritableSecretMetadata,
-  buildTreeseedClientEncryptedEscrowEnvelope,
-  containsTreeseedPlaintextSecretMaterial,
-  isApiServiceDecryptableCustomerSecret,
-  isTreeseedSecretCustodyMode,
-  isTreeseedV1RepositoryCredentialProvider,
-  requiresClientSideSecretMaterial,
-  summarizeTreeseedClientEncryptedEscrowStatus,
-  summarizeTreeseedWorkflowCloudAccessDiagnostics,
-  validateTreeseedClientEncryptedEscrowMetadata,
-  validateTreeseedGitHubActionsEncryptedSecretDeployment,
-  validateTreeseedSecretsCapabilityRegistry,
-  validateTreeseedWritableSecretMetadata
-};

package/dist/seeds/errors.d.ts

@@ -1,5 +0,0 @@
-import type { SeedDiagnostic } from './types.js';
-export declare function errorDiagnostic(code: string, message: string, path?: string): SeedDiagnostic;
-export declare function warningDiagnostic(code: string, message: string, path?: string): SeedDiagnostic;
-export declare function hasSeedErrors(diagnostics: SeedDiagnostic[]): boolean;
-export declare function formatSeedDiagnostics(diagnostics: SeedDiagnostic[]): string[];

package/dist/seeds/errors.js

@@ -1,22 +0,0 @@
-function errorDiagnostic(code, message, path) {
-  return { severity: "error", code, message, path };
-}
-function warningDiagnostic(code, message, path) {
-  return { severity: "warning", code, message, path };
-}
-function hasSeedErrors(diagnostics) {
-  return diagnostics.some((diagnostic) => diagnostic.severity === "error");
-}
-function formatSeedDiagnostics(diagnostics) {
-  return diagnostics.map((diagnostic) => {
-    const prefix = diagnostic.severity === "error" ? "ERROR" : "WARN";
-    const location = diagnostic.path ? ` ${diagnostic.path}` : "";
-    return `${prefix} ${diagnostic.code}${location}: ${diagnostic.message}`;
-  });
-}
-export {
-  errorDiagnostic,
-  formatSeedDiagnostics,
-  hasSeedErrors,
-  warningDiagnostic
-};

package/dist/seeds/index.d.ts

@@ -1,20 +0,0 @@
-import type { SeedPlan } from './types.js';
-export { formatSeedDiagnostics, hasSeedErrors } from './errors.js';
-export { formatSeedPlan } from './planner.js';
-export type * from './types.js';
-export declare function loadAndPlanSeed(input: {
-    projectRoot: string;
-    seedName: string;
-    environments?: string;
-    mode: SeedPlan['mode'];
-}): {
-    ok: boolean;
-    plan: null;
-    diagnostics: import("./types.js").SeedDiagnostic[];
-    manifestPath: string;
-} | {
-    ok: boolean;
-    plan: SeedPlan;
-    diagnostics: import("./types.js").SeedDiagnostic[];
-    manifestPath: string;
-};

package/dist/seeds/index.js

@@ -1,53 +0,0 @@
-import { errorDiagnostic, hasSeedErrors } from "./errors.js";
-import { loadSeedManifest } from "./loader.js";
-import { resolveSelectedSeedEnvironments } from "./normalize.js";
-import { createSeedPlan } from "./planner.js";
-import { parseSeedManifest } from "./schema.js";
-import { formatSeedDiagnostics, hasSeedErrors as hasSeedErrors2 } from "./errors.js";
-import { formatSeedPlan } from "./planner.js";
-function loadAndPlanSeed(input) {
-  const loaded = loadSeedManifest(input.projectRoot, input.seedName);
-  const diagnostics = [...loaded.diagnostics];
-  const manifest = parseSeedManifest(loaded.value, diagnostics);
-  if (!manifest) {
-    return {
-      ok: false,
-      plan: null,
-      diagnostics,
-      manifestPath: loaded.path
-    };
-  }
-  if (manifest.name !== input.seedName) {
-    diagnostics.push(errorDiagnostic("seed.name_mismatch", `Manifest name ${manifest.name} does not match requested seed ${input.seedName}.`, "name"));
-  }
-  const selected = resolveSelectedSeedEnvironments(manifest, input.environments);
-  for (const message of selected.errors) {
-    diagnostics.push(errorDiagnostic("seed.environment_selection", message, "environments"));
-  }
-  if (hasSeedErrors(diagnostics)) {
-    return {
-      ok: false,
-      plan: null,
-      diagnostics,
-      manifestPath: loaded.path
-    };
-  }
-  return {
-    ok: true,
-    plan: createSeedPlan({
-      manifest,
-      manifestPath: loaded.path,
-      environments: selected.environments,
-      mode: input.mode,
-      diagnostics
-    }),
-    diagnostics,
-    manifestPath: loaded.path
-  };
-}
-export {
-  formatSeedDiagnostics,
-  formatSeedPlan,
-  hasSeedErrors2 as hasSeedErrors,
-  loadAndPlanSeed
-};

package/dist/seeds/loader.d.ts

@@ -1,8 +0,0 @@
-import type { SeedDiagnostic } from './types.js';
-export type LoadedSeedDocument = {
-    path: string;
-    value: unknown;
-    diagnostics: SeedDiagnostic[];
-};
-export declare function resolveSeedManifestPath(projectRoot: string, seedName: string): string;
-export declare function loadSeedManifest(projectRoot: string, seedName: string): LoadedSeedDocument;

package/dist/seeds/loader.js

@@ -1,32 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { parseDocument } from "yaml";
-import { errorDiagnostic } from "./errors.js";
-function resolveSeedManifestPath(projectRoot, seedName) {
-  return resolve(projectRoot, "seeds", `${seedName}.yaml`);
-}
-function loadSeedManifest(projectRoot, seedName) {
-  const path = resolveSeedManifestPath(projectRoot, seedName);
-  const diagnostics = [];
-  if (!/^[a-z0-9][a-z0-9._-]*$/u.test(seedName)) {
-    diagnostics.push(errorDiagnostic("seed.invalid_name", `Seed name must be a simple file-safe identifier: ${seedName}.`, "name"));
-    return { path, value: null, diagnostics };
-  }
-  if (!existsSync(path)) {
-    diagnostics.push(errorDiagnostic("seed.not_found", `Seed manifest not found at ${path}.`, "manifest"));
-    return { path, value: null, diagnostics };
-  }
-  const source = readFileSync(path, "utf8");
-  const document = parseDocument(source, { prettyErrors: false });
-  for (const parseError of document.errors) {
-    diagnostics.push(errorDiagnostic("seed.yaml_parse_error", parseError.message, "manifest"));
-  }
-  if (diagnostics.length > 0) {
-    return { path, value: null, diagnostics };
-  }
-  return { path, value: document.toJSON(), diagnostics };
-}
-export {
-  loadSeedManifest,
-  resolveSeedManifestPath
-};

package/dist/seeds/normalize.d.ts

@@ -1,13 +0,0 @@
-import type { NormalizedSeedResource, SeedEnvironment, SeedManifest } from './types.js';
-export declare function seedOwnershipMetadata(seed: SeedManifest, resourceKey: string): {
-    seed: {
-        name: string;
-        resourceKey: string;
-        version: 1;
-    };
-};
-export declare function normalizeSeedResources(manifest: SeedManifest, selected: SeedEnvironment[]): NormalizedSeedResource[];
-export declare function resolveSelectedSeedEnvironments(manifest: SeedManifest, requested: string | undefined): {
-    environments: SeedEnvironment[];
-    errors: string[];
-};