@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/managed-dependencies.js

@@ -1,1186 +0,0 @@
-import { createHash } from "node:crypto";
-import { createWriteStream, existsSync, mkdirSync, mkdtempSync, rmSync, renameSync, chmodSync, copyFileSync, readFileSync, readdirSync } from "node:fs";
-import { request as httpRequest } from "node:http";
-import { request as httpsRequest } from "node:https";
-import { platform as osPlatform, arch as osArch } from "node:os";
-import { basename, dirname, resolve } from "node:path";
-import { spawnSync } from "node:child_process";
-import { createRequire } from "node:module";
-import { withTreeseedServiceCredentialEnv } from "./service-credentials.js";
-const require2 = createRequire(import.meta.url);
-const GH_VERSION = "2.90.0";
-const GH_CHECKSUMS_SHA256 = "95cbb66008dc467cf402724025f07551d2a949b3cc830146206a2797b963966c";
-const GH_RELEASE_BASE_URL = `https://github.com/cli/cli/releases/download/v${GH_VERSION}`;
-const GH_ASSETS = [
-  { platform: "linux", arch: "x64", assetName: `gh_${GH_VERSION}_linux_amd64.tar.gz`, archiveKind: "tar.gz" },
-  { platform: "linux", arch: "arm64", assetName: `gh_${GH_VERSION}_linux_arm64.tar.gz`, archiveKind: "tar.gz" },
-  { platform: "darwin", arch: "x64", assetName: `gh_${GH_VERSION}_macOS_amd64.zip`, archiveKind: "zip" },
-  { platform: "darwin", arch: "arm64", assetName: `gh_${GH_VERSION}_macOS_arm64.zip`, archiveKind: "zip" }
-];
-const RAILWAY_VERSION = "5.23.2";
-const RAILWAY_RELEASE_BASE_URL = `https://github.com/railwayapp/cli/releases/download/v${RAILWAY_VERSION}`;
-const RAILWAY_ASSETS = [
-  {
-    platform: "linux",
-    arch: "x64",
-    assetName: `railway-v${RAILWAY_VERSION}-x86_64-unknown-linux-gnu.tar.gz`,
-    archiveKind: "tar.gz",
-    sha256: "ced014a566bc273ce87463678a2d1e5d9ee02f165a832d5d2fd27c201855145b"
-  },
-  {
-    platform: "linux",
-    arch: "arm64",
-    assetName: `railway-v${RAILWAY_VERSION}-aarch64-unknown-linux-musl.tar.gz`,
-    archiveKind: "tar.gz",
-    sha256: "b6100a01d0bd5d349f39e796a907e77f45dadb42f99eee558a1aa7bb254b973e"
-  },
-  {
-    platform: "darwin",
-    arch: "x64",
-    assetName: `railway-v${RAILWAY_VERSION}-x86_64-apple-darwin.tar.gz`,
-    archiveKind: "tar.gz",
-    sha256: "403721baa47c2afd0391190310ae8aaf9d671d3ac3d7db123219686b2762bea3"
-  },
-  {
-    platform: "darwin",
-    arch: "arm64",
-    assetName: `railway-v${RAILWAY_VERSION}-aarch64-apple-darwin.tar.gz`,
-    archiveKind: "tar.gz",
-    sha256: "83ddc35f9a5ec1a8adb4cf6a024f23227b109832b2d354633a9668c47acb02fa"
-  }
-];
-const NPM_TOOLS = [
-  { name: "wrangler", packageName: "wrangler", binName: "wrangler", version: "4.86.0" },
-  { name: "copilot", packageName: "@github/copilot", binName: "copilot", version: "1.0.39" },
-  { name: "copilot-language-server", packageName: "@github/copilot-language-server", binName: "copilot-language-server", version: "1.480.0" }
-];
-const NPM_PACKAGES = [
-  { name: "copilot-sdk", packageName: "@github/copilot-sdk", version: "0.3.0" }
-];
-function report(input) {
-  return {
-    binaryPath: input.binaryPath ?? null,
-    ...input
-  };
-}
-function sha256File(filePath) {
-  return createHash("sha256").update(readFileSync(filePath)).digest("hex");
-}
-function resolveToolsHome(env = process.env) {
-  if (env.TREESEED_TOOLS_HOME?.trim()) {
-    return resolve(env.TREESEED_TOOLS_HOME);
-  }
-  if (env.XDG_CACHE_HOME?.trim()) {
-    return resolve(env.XDG_CACHE_HOME, "treeseed", "tools");
-  }
-  return resolve(process.cwd(), ".treeseed", "tools");
-}
-function createTreeseedManagedToolEnv(env = process.env) {
-  const toolsHome = resolveToolsHome(env);
-  const ghBinDir = resolve(toolsHome, "gh", GH_VERSION, platformKey(), "bin");
-  const pathKey = process.platform === "win32" ? "Path" : "PATH";
-  const existingPath = env[pathKey] ?? env.PATH ?? "";
-  return {
-    ...withTreeseedServiceCredentialEnv(env),
-    GH_CONFIG_DIR: env.TREESEED_GH_CONFIG_DIR ?? resolve(toolsHome, "gh-config"),
-    GH_PROMPT_DISABLED: "1",
-    GH_NO_UPDATE_NOTIFIER: "1",
-    [pathKey]: [ghBinDir, existingPath].filter(Boolean).join(process.platform === "win32" ? ";" : ":")
-  };
-}
-function platformKey(platform = osPlatform(), arch = osArch()) {
-  return `${platform}-${arch}`;
-}
-function currentPlatformAsset() {
-  const platform = osPlatform();
-  const arch = osArch();
-  if (platform !== "linux" && platform !== "darwin") {
-    return null;
-  }
-  if (arch !== "x64" && arch !== "arm64") {
-    return null;
-  }
-  return GH_ASSETS.find((asset) => asset.platform === platform && asset.arch === arch) ?? null;
-}
-function currentRailwayPlatformAsset() {
-  const platform = osPlatform();
-  const arch = osArch();
-  if (platform !== "linux" && platform !== "darwin") return null;
-  if (arch !== "x64" && arch !== "arm64") return null;
-  return RAILWAY_ASSETS.find((asset) => asset.platform === platform && asset.arch === arch) ?? null;
-}
-function managedGhBin(env = process.env) {
-  return resolve(resolveToolsHome(env), "gh", GH_VERSION, platformKey(), "bin", "gh");
-}
-function managedRailwayBin(env = process.env) {
-  return resolve(resolveToolsHome(env), "railway", RAILWAY_VERSION, platformKey(), "bin", "railway");
-}
-function tokenEnv(env = process.env) {
-  const translated = withTreeseedServiceCredentialEnv(env);
-  const ghToken = translated.GH_TOKEN?.trim() || translated.GITHUB_TOKEN?.trim() || "";
-  return ghToken ? {
-    ...translated,
-    GH_TOKEN: ghToken,
-    GITHUB_TOKEN: ghToken
-  } : translated;
-}
-function cleanCommandPathOutput(output) {
-  const lines = output.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
-  for (let index = lines.length - 1; index >= 0; index -= 1) {
-    if (lines[index]?.startsWith("/")) {
-      return lines[index] ?? null;
-    }
-  }
-  return lines[lines.length - 1] ?? null;
-}
-function redactSensitiveOutput(output) {
-  return output.replace(/^(\s*-\s*Token:\s*).+$/gim, "$1***").replace(/\b(?:github_pat|ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_*.-]+/gu, "***");
-}
-function locateSystemBinary(command, spawn = spawnSync, env = process.env) {
-  if (process.platform === "win32") {
-    return null;
-  }
-  const result = spawn("bash", ["-lc", `command -v ${command}`], {
-    stdio: "pipe",
-    encoding: "utf8",
-    env
-  });
-  return result.status === 0 ? cleanCommandPathOutput(String(result.stdout ?? "")) : null;
-}
-function checkCommand(command, args, options = {}) {
-  const run = options.spawn ?? spawnSync;
-  const result = run(command, args, {
-    cwd: options.cwd,
-    env: options.env,
-    stdio: "pipe",
-    encoding: "utf8",
-    timeout: 15e3
-  });
-  return {
-    ok: result.status === 0,
-    status: result.status ?? 1,
-    stdout: String(result.stdout ?? "").trim(),
-    stderr: String(result.stderr ?? "").trim(),
-    detail: `${result.stderr ?? ""}
-${result.stdout ?? ""}`.trim() || result.error?.message || ""
-  };
-}
-function resolvePackageJsonPath(packageName) {
-  try {
-    const packageJsonPath = require2.resolve(`${packageName}/package.json`);
-    if (existsSync(packageJsonPath)) {
-      return packageJsonPath;
-    }
-  } catch {
-  }
-  for (const searchPath of require2.resolve.paths(packageName) ?? []) {
-    const candidate = resolve(searchPath, packageName, "package.json");
-    if (existsSync(candidate)) {
-      return candidate;
-    }
-  }
-  throw new Error(`Unable to resolve package manifest for "${packageName}".`);
-}
-function resolvePackageJsonPathOptional(packageName) {
-  try {
-    return resolvePackageJsonPath(packageName);
-  } catch {
-    return null;
-  }
-}
-function resolvePackageBinary(packageName, binName) {
-  const packageJsonPath = resolvePackageJsonPath(packageName);
-  const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-  const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName];
-  if (!relativeBin) {
-    throw new Error(`Unable to resolve binary "${binName}" from package "${packageName}".`);
-  }
-  const resolvedBin = resolve(dirname(packageJsonPath), relativeBin);
-  if (existsSync(resolvedBin) || !relativeBin.startsWith("../")) {
-    return resolvedBin;
-  }
-  const packageLocalFallback = resolve(dirname(packageJsonPath), relativeBin.replace(/^\.\.\//u, ""));
-  return existsSync(packageLocalFallback) ? packageLocalFallback : resolvedBin;
-}
-function resolvePackageBinaryOptional(packageName, binName) {
-  const packageJsonPath = resolvePackageJsonPathOptional(packageName);
-  if (!packageJsonPath) {
-    return null;
-  }
-  try {
-    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
-    const relativeBin = typeof packageJson.bin === "string" ? packageJson.bin : packageJson.bin?.[binName];
-    if (!relativeBin) {
-      return null;
-    }
-    const resolvedBin = resolve(dirname(packageJsonPath), relativeBin);
-    if (existsSync(resolvedBin) || !relativeBin.startsWith("../")) {
-      return resolvedBin;
-    }
-    const packageLocalFallback = resolve(dirname(packageJsonPath), relativeBin.replace(/^\.\.\//u, ""));
-    return existsSync(packageLocalFallback) ? packageLocalFallback : resolvedBin;
-  } catch {
-    return null;
-  }
-}
-function resolvePackageRoot(packageName) {
-  return dirname(resolvePackageJsonPath(packageName));
-}
-function findNpmTool(name) {
-  return NPM_TOOLS.find((tool) => tool.name === name) ?? null;
-}
-function resolveNpmToolRuntimeBinary(tool) {
-  const packageJsonPath = resolvePackageJsonPathOptional(tool.packageName);
-  if (!packageJsonPath) {
-    return null;
-  }
-  const packageRoot = dirname(packageJsonPath);
-  const packageBin = resolvePackageBinaryOptional(tool.packageName, tool.binName);
-  if (!packageBin || !existsSync(packageBin)) {
-    return null;
-  }
-  if (!tool.runtimeBinary) {
-    return packageBin;
-  }
-  const runtimeBinary = tool.runtimeBinary(packageRoot);
-  return existsSync(runtimeBinary) ? runtimeBinary : null;
-}
-function npmToolMissingDetail(tool) {
-  const packageJsonPath = resolvePackageJsonPathOptional(tool.packageName);
-  if (!packageJsonPath) {
-    return `${tool.packageName} is missing from the installed package graph.`;
-  }
-  const packageRoot = dirname(packageJsonPath);
-  const packageBin = resolvePackageBinaryOptional(tool.packageName, tool.binName);
-  if (!packageBin || !existsSync(packageBin)) {
-    return `${tool.packageName} binary ${tool.binName} is missing from the installed package.`;
-  }
-  if (tool.runtimeBinary) {
-    const runtimeBinary = tool.runtimeBinary(packageRoot);
-    if (!existsSync(runtimeBinary)) {
-      return `${tool.packageName} runtime binary ${runtimeBinary} is missing. Run \`npx trsd install --json\` or npm install without --ignore-scripts.`;
-    }
-  }
-  return `${tool.packageName} is unavailable.`;
-}
-function npmBackedDependenciesAvailable() {
-  try {
-    for (const tool of NPM_TOOLS) {
-      const binaryPath = resolveNpmToolRuntimeBinary(tool);
-      if (!binaryPath || !existsSync(binaryPath)) {
-        return false;
-      }
-    }
-    for (const pkg of NPM_PACKAGES) {
-      const packageRoot = resolvePackageRoot(pkg.packageName);
-      if (!existsSync(packageRoot)) {
-        return false;
-      }
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
-function resolveNpmInstallCommand(env = process.env) {
-  const installArgs = ["install", "--ignore-scripts", "--prefer-offline", "--workspaces=false", "--no-audit", "--no-fund"];
-  const npmCommandOverride = env.TREESEED_NPM_INSTALL_COMMAND;
-  if (npmCommandOverride?.trim()) {
-    return {
-      command: npmCommandOverride,
-      args: installArgs,
-      display: [npmCommandOverride, ...installArgs]
-    };
-  }
-  const npmExecPath = env.npm_execpath || env.NPM_EXEC_PATH;
-  if (npmExecPath?.trim()) {
-    return {
-      command: process.execPath,
-      args: [npmExecPath, ...installArgs],
-      display: [process.execPath, npmExecPath, ...installArgs]
-    };
-  }
-  return {
-    command: "npm",
-    args: installArgs,
-    display: ["npm", ...installArgs]
-  };
-}
-function esbuildPlatformPackage() {
-  const platform = osPlatform();
-  const arch = osArch();
-  if (platform === "linux" && ["x64", "arm64", "arm", "ia32", "ppc64", "riscv64", "s390x"].includes(arch)) return `@esbuild/linux-${arch}`;
-  if (platform === "darwin" && ["x64", "arm64"].includes(arch)) return `@esbuild/darwin-${arch}`;
-  if (platform === "win32" && ["x64", "arm64", "ia32"].includes(arch)) return `@esbuild/win32-${arch}`;
-  return null;
-}
-function collectInstalledNativeDependencyIssues(tenantRoot) {
-  return collectNativeDependencyRepairs(tenantRoot).map((repair) => repair.issue);
-}
-function collectNativeDependencyRepairs(tenantRoot) {
-  const binaryPackage = esbuildPlatformPackage();
-  if (!binaryPackage) return [];
-  try {
-    const lock = JSON.parse(readFileSync(resolve(tenantRoot, "package-lock.json"), "utf8"));
-    const packages = lock.packages ?? {};
-    const repairs = [];
-    for (const [packagePath, entry] of Object.entries(packages)) {
-      if (packagePath !== "node_modules/esbuild" && !packagePath.endsWith("/node_modules/esbuild")) continue;
-      if (!existsSync(resolve(tenantRoot, packagePath, "package.json"))) continue;
-      const binaryPath = `${packagePath.slice(0, -"esbuild".length)}${binaryPackage}`;
-      const expectedBinary = packages[binaryPath];
-      if (!expectedBinary?.version) continue;
-      const installedBinaryPath = resolve(tenantRoot, binaryPath, "package.json");
-      if (!existsSync(installedBinaryPath)) {
-        repairs.push({
-          packagePath: binaryPath,
-          packageName: binaryPackage,
-          version: expectedBinary.version,
-          integrity: expectedBinary.integrity,
-          issue: `${binaryPath}: missing native binary ${expectedBinary.version} for ${packagePath}`
-        });
-        continue;
-      }
-      const installedBinary = JSON.parse(readFileSync(installedBinaryPath, "utf8"));
-      if (installedBinary.version !== expectedBinary.version || installedBinary.version !== entry.version) {
-        repairs.push({
-          packagePath: binaryPath,
-          packageName: binaryPackage,
-          version: expectedBinary.version,
-          integrity: expectedBinary.integrity,
-          issue: `${binaryPath}: native binary ${installedBinary.version ?? "(missing version)"} does not match host ${entry.version ?? "(missing version)"}`
-        });
-      }
-    }
-    return repairs;
-  } catch {
-    return [];
-  }
-}
-function resolveNpmPackCommand(env, spec, destination) {
-  const args = ["pack", spec, "--json", "--ignore-scripts", "--pack-destination", destination];
-  const npmExecPath = env.npm_execpath || env.NPM_EXEC_PATH;
-  return npmExecPath?.trim() ? { command: process.execPath, args: [npmExecPath, ...args] } : { command: "npm", args };
-}
-function repairInstalledNativeDependencies(tenantRoot, options) {
-  const repairs = collectNativeDependencyRepairs(tenantRoot);
-  if (repairs.length === 0) return null;
-  const tempParent = resolve(tenantRoot, ".treeseed", "tmp");
-  mkdirSync(tempParent, { recursive: true });
-  const tempRoot = mkdtempSync(resolve(tempParent, "native-dependency-"));
-  try {
-    for (const repair of repairs) {
-      options.write?.(`Hydrating ${repair.packageName}@${repair.version} for ${repair.packagePath}.`);
-      const pack = resolveNpmPackCommand(options.env, `${repair.packageName}@${repair.version}`, tempRoot);
-      const packed = options.spawn(pack.command, pack.args, {
-        cwd: tenantRoot,
-        env: { ...options.env, TREESEED_MANAGED_NPM_INSTALL: "1" },
-        stdio: "pipe",
-        encoding: "utf8"
-      });
-      if (packed.status !== 0 || packed.error) return null;
-      let metadata;
-      try {
-        metadata = JSON.parse(String(packed.stdout ?? ""));
-      } catch {
-        return null;
-      }
-      const artifact = metadata[0];
-      if (!artifact?.filename || repair.integrity && artifact.integrity !== repair.integrity) return null;
-      const target = resolve(tenantRoot, repair.packagePath);
-      rmSync(target, { recursive: true, force: true });
-      mkdirSync(target, { recursive: true });
-      const extracted = options.spawn("tar", ["-xzf", resolve(tempRoot, artifact.filename), "-C", target, "--strip-components=1"], {
-        cwd: tenantRoot,
-        env: options.env,
-        stdio: "pipe",
-        encoding: "utf8"
-      });
-      if (extracted.status !== 0 || extracted.error) return null;
-    }
-    return collectNativeDependencyRepairs(tenantRoot).length === 0 ? repairs.length : null;
-  } finally {
-    rmSync(tempRoot, { recursive: true, force: true });
-  }
-}
-function resolveNpmRebuildCommand(env = process.env, packageNames) {
-  const npmExecPath = env.npm_execpath || env.NPM_EXEC_PATH;
-  if (npmExecPath?.trim()) {
-    return {
-      command: process.execPath,
-      args: [npmExecPath, "rebuild", ...packageNames],
-      display: [process.execPath, npmExecPath, "rebuild", ...packageNames]
-    };
-  }
-  return {
-    command: "npm",
-    args: ["rebuild", ...packageNames],
-    display: ["npm", "rebuild", ...packageNames]
-  };
-}
-function staleNpmGitClonePath(detail) {
-  const match = /destination path '([^']+\/_cacache\/tmp\/git-clone[^/]+\/\.git)' already exists/u.exec(detail);
-  if (!match?.[1]) return null;
-  const gitPath = resolve(match[1]);
-  const cloneRoot = dirname(gitPath);
-  if (basename(gitPath) !== ".git" || !basename(cloneRoot).startsWith("git-clone")) return null;
-  if (basename(dirname(cloneRoot)) !== "tmp" || basename(dirname(dirname(cloneRoot))) !== "_cacache") return null;
-  return cloneRoot;
-}
-function runNpmBootstrap(options) {
-  const tenantRoot = options.tenantRoot ? resolve(options.tenantRoot) : null;
-  const npmCommand = resolveNpmInstallCommand(options.env);
-  if (!tenantRoot || !existsSync(resolve(tenantRoot, "package.json"))) {
-    return [{
-      root: tenantRoot,
-      command: npmCommand.display,
-      status: "skipped",
-      exitCode: null,
-      detail: tenantRoot ? `No package.json found in ${tenantRoot}; npm install skipped.` : "No tenant root was provided; npm install skipped."
-    }];
-  }
-  if (options.env.TREESEED_MANAGED_NPM_INSTALL === "1") {
-    return [{
-      root: tenantRoot,
-      command: npmCommand.display,
-      status: "skipped",
-      exitCode: null,
-      detail: "npm install skipped because TREESEED_MANAGED_NPM_INSTALL=1 is set."
-    }];
-  }
-  const nodeModulesMissing = !existsSync(resolve(tenantRoot, "node_modules"));
-  const npmDepsMissing = !npmBackedDependenciesAvailable();
-  const missingRuntimeTools = npmToolsMissingRuntime();
-  const nativeDependencyIssues = nodeModulesMissing ? [] : collectInstalledNativeDependencyIssues(tenantRoot);
-  if (nativeDependencyIssues.length > 0) {
-    const repaired = repairInstalledNativeDependencies(tenantRoot, options);
-    if (repaired !== null) {
-      return [{
-        root: tenantRoot,
-        command: ["npm", "pack", "<lockfile-pinned-native-dependencies>"],
-        status: "installed",
-        exitCode: 0,
-        detail: `Hydrated ${repaired} lockfile-pinned native package artifact${repaired === 1 ? "" : "s"} without resolving the workspace dependency graph.`
-      }];
-    }
-  }
-  if (!nodeModulesMissing && npmDepsMissing && missingRuntimeTools.length > 0) {
-    return [{
-      root: tenantRoot,
-      command: npmCommand.display,
-      status: "already-present",
-      exitCode: 0,
-      detail: `npm dependencies are installed; rebuilding missing runtime tools: ${missingRuntimeTools.map((tool) => tool.packageName).join(", ")}.`
-    }];
-  }
-  if (!nodeModulesMissing && !npmDepsMissing && nativeDependencyIssues.length === 0) {
-    return [{
-      root: tenantRoot,
-      command: npmCommand.display,
-      status: "already-present",
-      exitCode: 0,
-      detail: options.force ? "npm dependencies are already installed; force is limited to Treeseed-managed tool repair." : "npm dependencies are already installed."
-    }];
-  }
-  options.write?.(nativeDependencyIssues.length > 0 ? `Repairing npm dependency integrity in ${tenantRoot}: ${nativeDependencyIssues.join("; ")}` : `Installing npm dependencies in ${tenantRoot}...`);
-  const testNpmInstallStatus = options.env.NODE_ENV === "test" ? options.env.TREESEED_TEST_NPM_INSTALL_STATUS : void 0;
-  if (testNpmInstallStatus === "installed" || testNpmInstallStatus === "failed") {
-    const ok2 = testNpmInstallStatus === "installed";
-    return [{
-      root: tenantRoot,
-      command: npmCommand.display,
-      status: ok2 ? "installed" : "failed",
-      exitCode: ok2 ? 0 : 1,
-      detail: ok2 ? "npm install completed successfully." : "npm install failed."
-    }];
-  }
-  const spawnInstall = () => options.spawn(npmCommand.command, npmCommand.args, {
-    cwd: tenantRoot,
-    env: {
-      ...options.env,
-      TREESEED_MANAGED_NPM_INSTALL: "1"
-    },
-    stdio: "pipe",
-    encoding: "utf8"
-  });
-  let result = spawnInstall();
-  let detail = `${result.stderr ?? ""}
-${result.stdout ?? ""}`.trim() || result.error?.message || "";
-  const staleClone = result.status !== 0 ? staleNpmGitClonePath(detail) : null;
-  if (staleClone) {
-    options.write?.(`Removing interrupted npm Git clone ${staleClone} and retrying dependency repair once.`);
-    rmSync(staleClone, { recursive: true, force: true });
-    result = spawnInstall();
-    detail = `${result.stderr ?? ""}
-${result.stdout ?? ""}`.trim() || result.error?.message || "";
-  }
-  const ok = result.status === 0 && !result.error;
-  return [{
-    root: tenantRoot,
-    command: npmCommand.display,
-    status: ok ? "installed" : "failed",
-    exitCode: result.status ?? 1,
-    detail: ok ? detail || "npm install completed successfully." : detail || "npm install failed."
-  }];
-}
-function npmToolsMissingRuntime() {
-  return NPM_TOOLS.filter((tool) => !resolveNpmToolRuntimeBinary(tool));
-}
-function runNpmToolRebuilds(options) {
-  const missingRuntimeTools = npmToolsMissingRuntime();
-  if (missingRuntimeTools.length === 0) {
-    return [];
-  }
-  const tenantRoot = options.tenantRoot ? resolve(options.tenantRoot) : null;
-  const npmCommand = resolveNpmRebuildCommand(options.env, missingRuntimeTools.map((tool) => tool.packageName));
-  if (!tenantRoot || !existsSync(resolve(tenantRoot, "package.json"))) {
-    return [{
-      root: tenantRoot,
-      command: npmCommand.display,
-      status: "skipped",
-      exitCode: null,
-      detail: tenantRoot ? `No package.json found in ${tenantRoot}; npm rebuild skipped.` : "No tenant root was provided; npm rebuild skipped."
-    }];
-  }
-  if (options.env.TREESEED_MANAGED_NPM_INSTALL === "1") {
-    return [{
-      root: tenantRoot,
-      command: npmCommand.display,
-      status: "skipped",
-      exitCode: null,
-      detail: "npm rebuild skipped because TREESEED_MANAGED_NPM_INSTALL=1 is set."
-    }];
-  }
-  options.write?.(`Rebuilding npm-backed Treeseed tools in ${tenantRoot}...`);
-  const result = options.spawn(npmCommand.command, npmCommand.args, {
-    cwd: tenantRoot,
-    env: {
-      ...options.env,
-      TREESEED_MANAGED_NPM_INSTALL: "1"
-    },
-    stdio: "pipe",
-    encoding: "utf8"
-  });
-  const detail = `${result.stderr ?? ""}
-${result.stdout ?? ""}`.trim() || result.error?.message || "";
-  const stillMissing = npmToolsMissingRuntime().map((tool) => tool.packageName);
-  const ok = result.status === 0 && !result.error && stillMissing.length === 0;
-  return [{
-    root: tenantRoot,
-    command: npmCommand.display,
-    status: ok ? "installed" : "failed",
-    exitCode: result.status ?? (ok ? 0 : 1),
-    detail: ok ? detail || "npm-backed Treeseed tools rebuilt successfully." : [
-      detail || "npm-backed Treeseed tool rebuild failed.",
-      stillMissing.length > 0 ? `Missing runtime tools after rebuild: ${stillMissing.join(", ")}` : ""
-    ].filter(Boolean).join("\n")
-  }];
-}
-function formatTreeseedDependencyFailureDetails(result) {
-  const npmFailures = result.npmInstalls.filter((entry) => entry.status === "failed").map((entry) => {
-    const root = entry.root ?? "no tenant root";
-    const exit = entry.exitCode === null ? "unknown exit code" : `exit code ${entry.exitCode}`;
-    const operation = entry.command.includes("rebuild") ? "npm rebuild" : "npm install";
-    return `${operation} in ${root}: ${entry.command.join(" ")} failed with ${exit}${entry.detail ? `: ${entry.detail}` : ""}`;
-  });
-  const toolFailures = result.reports.filter((entry) => entry.required && ["failed", "missing", "unsupported"].includes(entry.status)).map((entry) => `${entry.name}: ${entry.detail}`);
-  return [...npmFailures, ...toolFailures].join("\n- ") || "No dependency failure details were reported.";
-}
-function resolveTreeseedToolBinary(toolName, options = {}) {
-  if (toolName === "gh") {
-    const managed = managedGhBin(options.env);
-    if (existsSync(managed)) {
-      return managed;
-    }
-    return locateSystemBinary("gh", spawnSync, options.env ?? process.env);
-  }
-  if (toolName === "railway") {
-    const managed = managedRailwayBin(options.env);
-    return existsSync(managed) ? managed : null;
-  }
-  const npmTool = findNpmTool(toolName);
-  if (npmTool) {
-    return resolveNpmToolRuntimeBinary(npmTool);
-  }
-  if (toolName === "git" || toolName === "docker") {
-    return locateSystemBinary(toolName, spawnSync, options.env ?? process.env);
-  }
-  return null;
-}
-function resolveTreeseedToolCommand(toolName, options = {}) {
-  const binaryPath = resolveTreeseedToolBinary(toolName, options);
-  if (!binaryPath) {
-    return null;
-  }
-  if (findNpmTool(toolName) && /\.(?:cjs|mjs|js)$/u.test(binaryPath)) {
-    return { command: process.execPath, argsPrefix: [binaryPath], binaryPath };
-  }
-  return { command: binaryPath, argsPrefix: [], binaryPath };
-}
-function invocationForTool(toolName, env = process.env) {
-  const command = resolveTreeseedToolCommand(toolName, { env });
-  if (!command) {
-    return {
-      mode: "unavailable",
-      command: null,
-      argsPrefix: [],
-      binaryPath: null
-    };
-  }
-  return {
-    mode: findNpmTool(toolName) && /\.(?:cjs|mjs|js)$/u.test(command.binaryPath) ? "node" : "direct",
-    command: command.command,
-    argsPrefix: command.argsPrefix,
-    binaryPath: command.binaryPath
-  };
-}
-function checkGitHubAuth(options) {
-  const env = tokenEnv(options.env ?? process.env);
-  const gh = resolveTreeseedToolCommand("gh", { env });
-  const command = gh ? [gh.command, ...gh.argsPrefix, "auth", "status", "--hostname", "github.com"] : [];
-  const remediation = [
-    "Run `npx trsd install --json` to install or inspect managed tools.",
-    "Run `npx trsd secrets:unlock` or provide TREESEED_KEY_PASSPHRASE so machine secrets can be decrypted.",
-    "Verify TREESEED_GITHUB_TOKEN is configured in machine.yaml or the environment."
-  ];
-  if (!gh) {
-    return {
-      checked: true,
-      authenticated: false,
-      binaryPath: null,
-      command,
-      detail: "GitHub CLI `gh` is unavailable.",
-      remediation
-    };
-  }
-  const result = (options.spawn ?? spawnSync)(gh.command, [...gh.argsPrefix, "auth", "status", "--hostname", "github.com"], {
-    cwd: options.tenantRoot,
-    env: createTreeseedManagedToolEnv(env),
-    stdio: "pipe",
-    encoding: "utf8",
-    timeout: 15e3
-  });
-  const detail = redactSensitiveOutput(`${result.stderr ?? ""}
-${result.stdout ?? ""}`.trim()) || (result.status === 0 ? "GitHub CLI authentication succeeded." : "GitHub CLI authentication failed.");
-  return {
-    checked: true,
-    authenticated: result.status === 0,
-    binaryPath: gh.binaryPath,
-    command,
-    detail,
-    remediation
-  };
-}
-async function defaultDownloadFile(url, targetPath) {
-  const request = url.startsWith("https:") ? httpsRequest : httpRequest;
-  await new Promise((resolvePromise, rejectPromise) => {
-    const req = request(url, (response) => {
-      const status = response.statusCode ?? 0;
-      const location = response.headers.location;
-      if (status >= 300 && status < 400 && location) {
-        response.resume();
-        defaultDownloadFile(new URL(location, url).toString(), targetPath).then(resolvePromise, rejectPromise);
-        return;
-      }
-      if (status < 200 || status >= 300) {
-        response.resume();
-        rejectPromise(new Error(`Download failed (${status}) for ${url}`));
-        return;
-      }
-      mkdirSync(dirname(targetPath), { recursive: true });
-      const output = createWriteStream(targetPath);
-      response.pipe(output);
-      output.on("finish", () => {
-        output.close();
-        resolvePromise();
-      });
-      output.on("error", rejectPromise);
-    });
-    req.on("error", rejectPromise);
-    req.end();
-  });
-}
-function parseChecksums(contents, assetName) {
-  for (const line of contents.split(/\r?\n/u)) {
-    const [hash, name] = line.trim().split(/\s+/u);
-    if (name === assetName && /^[a-f0-9]{64}$/iu.test(hash ?? "")) {
-      return hash.toLowerCase();
-    }
-  }
-  return null;
-}
-function findExtractedGhBinary(root) {
-  for (const entry of readdirSync(root, { withFileTypes: true })) {
-    const fullPath = resolve(root, entry.name);
-    if (entry.isDirectory()) {
-      const found = findExtractedGhBinary(fullPath);
-      if (found) return found;
-      continue;
-    }
-    if (entry.isFile() && basename(fullPath) === "gh" && basename(dirname(fullPath)) === "bin") {
-      return fullPath;
-    }
-  }
-  return null;
-}
-async function installGh(options) {
-  const asset = currentPlatformAsset();
-  if (!asset) {
-    return report({
-      name: "gh",
-      kind: "download",
-      version: GH_VERSION,
-      source: "not-applicable",
-      status: "unsupported",
-      required: true,
-      detail: "Managed GitHub CLI installation supports Linux and macOS on x64 or arm64."
-    });
-  }
-  const binaryPath = managedGhBin(options.env);
-  if (existsSync(binaryPath)) {
-    const check = checkCommand(binaryPath, ["--version"], {
-      cwd: options.tenantRoot,
-      env: createTreeseedManagedToolEnv(options.env),
-      spawn: options.spawn
-    });
-    if (check.ok && check.stdout.includes(GH_VERSION)) {
-      return report({
-        name: "gh",
-        kind: "download",
-        version: GH_VERSION,
-        source: "managed-cache",
-        binaryPath,
-        status: options.force ? "repaired" : "already-present",
-        required: true,
-        detail: check.stdout.split("\n")[0] ?? `GitHub CLI ${GH_VERSION} is installed.`
-      });
-    }
-  }
-  const toolsHome = resolveToolsHome(options.env);
-  const tmpRoot = resolve(toolsHome, ".tmp", `gh-${process.pid}-${Date.now()}`);
-  const archivePath = resolve(tmpRoot, asset.assetName);
-  const checksumsPath = resolve(tmpRoot, `gh_${GH_VERSION}_checksums.txt`);
-  const extractRoot = resolve(tmpRoot, "extract");
-  const installRoot = dirname(dirname(binaryPath));
-  const stagingRoot = `${installRoot}.staging-${process.pid}-${Date.now()}`;
-  try {
-    options.write?.(`Installing GitHub CLI ${GH_VERSION}...`);
-    rmSync(tmpRoot, { recursive: true, force: true });
-    mkdirSync(extractRoot, { recursive: true });
-    await options.downloadFile(`${GH_RELEASE_BASE_URL}/gh_${GH_VERSION}_checksums.txt`, checksumsPath);
-    const checksumsHash = sha256File(checksumsPath);
-    if (checksumsHash !== GH_CHECKSUMS_SHA256) {
-      throw new Error(`GitHub CLI checksums file hash mismatch: expected ${GH_CHECKSUMS_SHA256}, got ${checksumsHash}.`);
-    }
-    const expectedAssetHash = parseChecksums(readFileSync(checksumsPath, "utf8"), asset.assetName);
-    if (!expectedAssetHash) {
-      throw new Error(`GitHub CLI checksums file does not contain ${asset.assetName}.`);
-    }
-    await options.downloadFile(`${GH_RELEASE_BASE_URL}/${asset.assetName}`, archivePath);
-    const assetHash = sha256File(archivePath);
-    if (assetHash !== expectedAssetHash) {
-      throw new Error(`GitHub CLI archive hash mismatch for ${asset.assetName}: expected ${expectedAssetHash}, got ${assetHash}.`);
-    }
-    if (asset.archiveKind === "zip") {
-      const { default: extractZip } = await import("extract-zip");
-      await extractZip(archivePath, { dir: extractRoot });
-    } else {
-      const tar = await import("tar");
-      await tar.x({ file: archivePath, cwd: extractRoot });
-    }
-    const extractedBinary = findExtractedGhBinary(extractRoot);
-    if (!extractedBinary) {
-      throw new Error(`Unable to find gh binary in ${asset.assetName}.`);
-    }
-    rmSync(stagingRoot, { recursive: true, force: true });
-    mkdirSync(resolve(stagingRoot, "bin"), { recursive: true });
-    copyFileSync(extractedBinary, resolve(stagingRoot, "bin", "gh"));
-    chmodSync(resolve(stagingRoot, "bin", "gh"), 493);
-    rmSync(installRoot, { recursive: true, force: true });
-    mkdirSync(dirname(installRoot), { recursive: true });
-    renameSync(stagingRoot, installRoot);
-    const check = checkCommand(binaryPath, ["--version"], {
-      cwd: options.tenantRoot,
-      env: createTreeseedManagedToolEnv(options.env),
-      spawn: options.spawn
-    });
-    if (!check.ok) {
-      throw new Error(check.detail || "GitHub CLI failed after installation.");
-    }
-    return report({
-      name: "gh",
-      kind: "download",
-      version: GH_VERSION,
-      source: "managed-cache",
-      binaryPath,
-      status: existsSync(binaryPath) && options.force ? "repaired" : "installed",
-      required: true,
-      detail: check.stdout.split("\n")[0] ?? `GitHub CLI ${GH_VERSION} installed.`
-    });
-  } catch (error) {
-    return report({
-      name: "gh",
-      kind: "download",
-      version: GH_VERSION,
-      source: "managed-cache",
-      binaryPath,
-      status: "failed",
-      required: true,
-      detail: error instanceof Error ? error.message : String(error)
-    });
-  } finally {
-    rmSync(tmpRoot, { recursive: true, force: true });
-    rmSync(stagingRoot, { recursive: true, force: true });
-  }
-}
-async function installRailway(options) {
-  const asset = currentRailwayPlatformAsset();
-  if (!asset) {
-    return report({
-      name: "railway",
-      kind: "download",
-      version: RAILWAY_VERSION,
-      source: "not-applicable",
-      status: "unsupported",
-      required: true,
-      detail: "Managed Railway CLI installation supports Linux and macOS on x64 or arm64."
-    });
-  }
-  const binaryPath = managedRailwayBin(options.env);
-  if (existsSync(binaryPath)) {
-    const check = checkCommand(binaryPath, ["--version"], {
-      cwd: options.tenantRoot,
-      env: options.env,
-      spawn: options.spawn
-    });
-    if (check.ok && check.stdout.includes(RAILWAY_VERSION)) {
-      return report({
-        name: "railway",
-        kind: "download",
-        version: RAILWAY_VERSION,
-        source: "managed-cache",
-        binaryPath,
-        status: options.force ? "repaired" : "already-present",
-        required: true,
-        detail: check.stdout.split("\n")[0] ?? `Railway CLI ${RAILWAY_VERSION} is installed.`
-      });
-    }
-  }
-  const toolsHome = resolveToolsHome(options.env);
-  const tmpRoot = resolve(toolsHome, ".tmp", `railway-${process.pid}-${Date.now()}`);
-  const archivePath = resolve(tmpRoot, asset.assetName);
-  const extractRoot = resolve(tmpRoot, "extract");
-  const installRoot = dirname(dirname(binaryPath));
-  const stagingRoot = `${installRoot}.staging-${process.pid}-${Date.now()}`;
-  try {
-    options.write?.(`Installing Railway CLI ${RAILWAY_VERSION}...`);
-    rmSync(tmpRoot, { recursive: true, force: true });
-    mkdirSync(extractRoot, { recursive: true });
-    await options.downloadFile(`${RAILWAY_RELEASE_BASE_URL}/${asset.assetName}`, archivePath);
-    const assetHash = sha256File(archivePath);
-    if (assetHash !== asset.sha256) {
-      throw new Error(`Railway CLI archive hash mismatch for ${asset.assetName}: expected ${asset.sha256}, got ${assetHash}.`);
-    }
-    const tar = await import("tar");
-    await tar.x({ file: archivePath, cwd: extractRoot });
-    const extractedBinary = resolve(extractRoot, "railway");
-    if (!existsSync(extractedBinary)) throw new Error(`Unable to find railway binary in ${asset.assetName}.`);
-    rmSync(stagingRoot, { recursive: true, force: true });
-    mkdirSync(resolve(stagingRoot, "bin"), { recursive: true });
-    copyFileSync(extractedBinary, resolve(stagingRoot, "bin", "railway"));
-    chmodSync(resolve(stagingRoot, "bin", "railway"), 493);
-    rmSync(installRoot, { recursive: true, force: true });
-    mkdirSync(dirname(installRoot), { recursive: true });
-    renameSync(stagingRoot, installRoot);
-    const check = checkCommand(binaryPath, ["--version"], { cwd: options.tenantRoot, env: options.env, spawn: options.spawn });
-    if (!check.ok || !check.stdout.includes(RAILWAY_VERSION)) {
-      throw new Error(check.detail || `Railway CLI ${RAILWAY_VERSION} failed after installation.`);
-    }
-    return report({
-      name: "railway",
-      kind: "download",
-      version: RAILWAY_VERSION,
-      source: "managed-cache",
-      binaryPath,
-      status: options.force ? "repaired" : "installed",
-      required: true,
-      detail: check.stdout.split("\n")[0] ?? `Railway CLI ${RAILWAY_VERSION} installed.`
-    });
-  } catch (error) {
-    return report({
-      name: "railway",
-      kind: "download",
-      version: RAILWAY_VERSION,
-      source: "managed-cache",
-      binaryPath,
-      status: "failed",
-      required: true,
-      detail: error instanceof Error ? error.message : String(error)
-    });
-  } finally {
-    rmSync(tmpRoot, { recursive: true, force: true });
-    rmSync(stagingRoot, { recursive: true, force: true });
-  }
-}
-function statusForNpmTool(tool, options) {
-  try {
-    const binaryPath = resolveNpmToolRuntimeBinary(tool);
-    return report({
-      name: tool.name,
-      kind: "npm",
-      version: tool.version,
-      source: "package",
-      binaryPath,
-      status: binaryPath && existsSync(binaryPath) ? "already-present" : "missing",
-      required: true,
-      detail: binaryPath && existsSync(binaryPath) ? `${tool.packageName} is available from the Treeseed SDK dependency graph.` : npmToolMissingDetail(tool)
-    });
-  } catch (error) {
-    return report({
-      name: tool.name,
-      kind: "npm",
-      version: tool.version,
-      source: "package",
-      status: "failed",
-      required: true,
-      detail: error instanceof Error ? error.message : String(error)
-    });
-  }
-}
-function statusForNpmPackage(pkg) {
-  try {
-    const packageRoot = resolvePackageRoot(pkg.packageName);
-    return report({
-      name: pkg.name,
-      kind: "npm",
-      version: pkg.version,
-      source: "package",
-      binaryPath: null,
-      status: existsSync(packageRoot) ? "already-present" : "missing",
-      required: true,
-      detail: existsSync(packageRoot) ? `${pkg.packageName} is available from the Treeseed SDK dependency graph at ${packageRoot}.` : `${pkg.packageName} is missing from the installed package graph.`
-    });
-  } catch (error) {
-    return report({
-      name: pkg.name,
-      kind: "npm",
-      version: pkg.version,
-      source: "package",
-      status: "failed",
-      required: true,
-      detail: error instanceof Error ? error.message : String(error)
-    });
-  }
-}
-function systemStatus(name, required, options) {
-  const binaryPath = locateSystemBinary(name, options.spawn ?? spawnSync, options.env ?? process.env);
-  return report({
-    name,
-    kind: "system",
-    source: binaryPath ? "system" : "not-applicable",
-    binaryPath,
-    status: binaryPath ? "already-present" : required ? "missing" : "skipped",
-    required,
-    detail: binaryPath ? `${name} detected at ${binaryPath}.` : required ? `${name} is required and was not found on PATH.` : `${name} was not found on PATH.`
-  });
-}
-function installGhAct(options) {
-  const env = createTreeseedManagedToolEnv(options.env ?? process.env);
-  const gh = resolveTreeseedToolBinary("gh", { env });
-  const docker = locateSystemBinary("docker", options.spawn ?? spawnSync, options.env ?? process.env);
-  if (!docker) {
-    return report({
-      name: "gh-act",
-      kind: "extension",
-      version: "nektos/gh-act",
-      source: "managed-gh-config",
-      status: "skipped",
-      required: false,
-      detail: "Docker is not on PATH, so gh-act installation was skipped."
-    });
-  }
-  if (!gh) {
-    return report({
-      name: "gh-act",
-      kind: "extension",
-      version: "nektos/gh-act",
-      source: "managed-gh-config",
-      status: "failed",
-      required: false,
-      detail: "GitHub CLI is unavailable, so gh-act cannot be installed."
-    });
-  }
-  const existing = checkCommand(gh, ["act", "--version"], {
-    cwd: options.tenantRoot,
-    env,
-    spawn: options.spawn
-  });
-  if (existing.ok && !options.force) {
-    return report({
-      name: "gh-act",
-      kind: "extension",
-      version: "nektos/gh-act",
-      source: "managed-gh-config",
-      binaryPath: gh,
-      status: "already-present",
-      required: false,
-      detail: existing.stdout.split("\n")[0] ?? "gh-act is installed."
-    });
-  }
-  options.write?.("Installing GitHub CLI extension gh-act...");
-  const install = checkCommand(gh, ["extension", "install", "https://github.com/nektos/gh-act", ...options.force ? ["--force"] : []], {
-    cwd: options.tenantRoot,
-    env,
-    spawn: options.spawn
-  });
-  const postInstall = checkCommand(gh, ["act", "--version"], {
-    cwd: options.tenantRoot,
-    env,
-    spawn: options.spawn
-  });
-  return report({
-    name: "gh-act",
-    kind: "extension",
-    version: "nektos/gh-act",
-    source: "managed-gh-config",
-    binaryPath: gh,
-    status: postInstall.ok ? existing.ok ? "repaired" : "installed" : "failed",
-    required: false,
-    detail: postInstall.ok ? postInstall.stdout.split("\n")[0] ?? "gh-act is installed." : install.detail || postInstall.detail || "Unable to install gh-act."
-  });
-}
-async function installTreeseedDependencies(options = {}) {
-  const env = options.env ?? process.env;
-  const effectiveOptions = {
-    ...options,
-    env,
-    downloadFile: options.downloadFile ?? defaultDownloadFile,
-    spawn: options.spawn ?? spawnSync
-  };
-  mkdirSync(resolveToolsHome(env), { recursive: true });
-  mkdirSync(createTreeseedManagedToolEnv(env).GH_CONFIG_DIR, { recursive: true });
-  const npmInstalls = [
-    ...runNpmBootstrap(effectiveOptions),
-    ...runNpmToolRebuilds(effectiveOptions)
-  ];
-  const reports = [
-    systemStatus("git", true, effectiveOptions),
-    await installGh(effectiveOptions),
-    await installRailway(effectiveOptions),
-    ...NPM_TOOLS.map((tool) => statusForNpmTool(tool, effectiveOptions)),
-    ...NPM_PACKAGES.map((pkg) => statusForNpmPackage(pkg)),
-    systemStatus("docker", false, effectiveOptions),
-    installGhAct(effectiveOptions)
-  ];
-  const ok = npmInstalls.every((entry) => entry.status !== "failed") && reports.every((entry) => !entry.required || !["failed", "missing", "unsupported"].includes(entry.status));
-  return {
-    ok,
-    toolsHome: resolveToolsHome(env),
-    ghConfigDir: createTreeseedManagedToolEnv(env).GH_CONFIG_DIR,
-    npmInstalls,
-    reports
-  };
-}
-function collectTreeseedDependencyStatus(options = {}) {
-  const env = options.env ?? process.env;
-  const ghBinary = managedGhBin(env);
-  const ghStatus = existsSync(ghBinary) ? report({
-    name: "gh",
-    kind: "download",
-    version: GH_VERSION,
-    source: "managed-cache",
-    binaryPath: ghBinary,
-    status: "already-present",
-    required: true,
-    detail: `GitHub CLI ${GH_VERSION} is installed in the Treeseed tool cache.`
-  }) : report({
-    name: "gh",
-    kind: "download",
-    version: GH_VERSION,
-    source: "managed-cache",
-    binaryPath: ghBinary,
-    status: "missing",
-    required: true,
-    detail: `GitHub CLI ${GH_VERSION} is not installed in the Treeseed tool cache.`
-  });
-  const railwayBinary = managedRailwayBin(env);
-  const railwayStatus = report({
-    name: "railway",
-    kind: "download",
-    version: RAILWAY_VERSION,
-    source: "managed-cache",
-    binaryPath: railwayBinary,
-    status: existsSync(railwayBinary) ? "already-present" : "missing",
-    required: true,
-    detail: existsSync(railwayBinary) ? `Railway CLI ${RAILWAY_VERSION} is installed in the Treeseed tool cache.` : `Railway CLI ${RAILWAY_VERSION} is not installed in the Treeseed tool cache.`
-  });
-  const reports = [
-    systemStatus("git", true, options),
-    ghStatus,
-    railwayStatus,
-    ...NPM_TOOLS.map((tool) => statusForNpmTool(tool, options)),
-    ...NPM_PACKAGES.map((pkg) => statusForNpmPackage(pkg)),
-    systemStatus("docker", false, options),
-    report({
-      name: "gh-act",
-      kind: "extension",
-      version: "nektos/gh-act",
-      source: "managed-gh-config",
-      binaryPath: ghBinary,
-      status: existsSync(ghBinary) ? "already-present" : "skipped",
-      required: false,
-      detail: existsSync(ghBinary) ? "gh-act status is checked during installation because it requires executing gh." : "gh-act is skipped until GitHub CLI is installed."
-    })
-  ];
-  return {
-    ok: reports.every((entry) => !entry.required || !["failed", "missing", "unsupported"].includes(entry.status)),
-    toolsHome: resolveToolsHome(env),
-    ghConfigDir: createTreeseedManagedToolEnv(env).GH_CONFIG_DIR,
-    npmInstalls: [],
-    reports
-  };
-}
-function collectTreeseedToolStatus(options = {}) {
-  const env = options.env ?? process.env;
-  const status = collectTreeseedDependencyStatus(options);
-  const tools = status.reports.map((entry) => ({
-    ...entry,
-    invocation: invocationForTool(entry.name, env)
-  }));
-  return {
-    ...status,
-    tools,
-    auth: {
-      github: checkGitHubAuth(options)
-    }
-  };
-}
-function formatTreeseedDependencyReport(result) {
-  return [
-    "Treeseed dependency status",
-    `Tools home: ${result.toolsHome}`,
-    `GitHub CLI config: ${result.ghConfigDir}`,
-    ...result.npmInstalls.map((entry) => {
-      const root = entry.root ? ` in ${entry.root}` : "";
-      const command = entry.command.length > 0 ? ` (${entry.command.join(" ")})` : "";
-      return `- npm install${root}: ${entry.status} - ${entry.detail}${command}`;
-    }),
-    ...result.reports.map((entry) => {
-      const path = entry.binaryPath ? ` (${entry.binaryPath})` : "";
-      return `- ${entry.name}: ${entry.status} - ${entry.detail}${path}`;
-    })
-  ].join("\n");
-}
-export {
-  collectInstalledNativeDependencyIssues,
-  collectTreeseedDependencyStatus,
-  collectTreeseedToolStatus,
-  createTreeseedManagedToolEnv,
-  formatTreeseedDependencyFailureDetails,
-  formatTreeseedDependencyReport,
-  installTreeseedDependencies,
-  repairInstalledNativeDependencies,
-  resolveTreeseedToolBinary,
-  resolveTreeseedToolCommand,
-  staleNpmGitClonePath
-};