@treeseed/sdk 0.13.0-rc.5 → 0.13.0-rc.8

package/dist/api/auth/rbac.js

@@ -1,171 +0,0 @@
-const CONTENT_RESOURCES = [
-  "pages",
-  "notes",
-  "questions",
-  "objectives",
-  "proposals",
-  "decisions",
-  "people",
-  "agents",
-  "books",
-  "templates",
-  "workdays"
-];
-const PLATFORM_RESOURCES = [
-  "users",
-  "roles",
-  "api_tokens",
-  "services",
-  "jobs",
-  "audit",
-  "auth",
-  "sdk",
-  "agent",
-  "operations",
-  "feedback"
-];
-const ALL_PERMISSION_RESOURCES = [...CONTENT_RESOURCES, ...PLATFORM_RESOURCES];
-function principalHasPlatformPermission(principal, permission) {
-  return Boolean(
-    principal && (principal.roles?.includes("platform_admin") || principal.permissions?.includes("*:*:*") || principal.permissions?.includes(permission))
-  );
-}
-function permissionKey(resource, action, scope) {
-  return `${resource}:${action}:${scope}`;
-}
-function contentPermission(resource, action, scope, description) {
-  return {
-    key: permissionKey(resource, action, scope),
-    resource,
-    action,
-    scope,
-    description
-  };
-}
-const permissionDefinitions = [
-  {
-    key: permissionKey("*", "*", "*"),
-    resource: "*",
-    action: "*",
-    scope: "*",
-    description: "Full platform access."
-  },
-  contentPermission("auth", "read", "self", "Read the authenticated principal."),
-  contentPermission("api_tokens", "read", "self", "List personal API tokens."),
-  contentPermission("api_tokens", "create", "self", "Create personal API tokens."),
-  contentPermission("api_tokens", "delete", "self", "Revoke personal API tokens."),
-  contentPermission("services", "impersonate", "global", "Allow trusted web and service impersonation flows."),
-  contentPermission("services", "manage", "global", "Manage service credentials and internal service auth."),
-  contentPermission("users", "read", "global", "Read user records."),
-  contentPermission("users", "manage", "global", "Manage user records."),
-  contentPermission("roles", "manage", "global", "Manage role assignments."),
-  contentPermission("audit", "read", "global", "Read audit events."),
-  contentPermission("jobs", "manage", "global", "Manage internal job and worker control surfaces."),
-  contentPermission("sdk", "execute", "global", "Execute SDK routes."),
-  contentPermission("agent", "execute", "global", "Execute agent routes."),
-  contentPermission("operations", "execute", "global", "Execute workflow operation routes."),
-  contentPermission("feedback", "read", "global", "Read private platform feedback."),
-  contentPermission("feedback", "manage", "global", "Triage and resolve private platform feedback."),
-  contentPermission("feedback", "export", "global", "Export privacy-safe platform feedback bundles.")
-];
-for (const resource of CONTENT_RESOURCES) {
-  permissionDefinitions.push(
-    contentPermission(resource, "read", "global", `Read ${resource}.`),
-    contentPermission(resource, "create", "global", `Create ${resource}.`),
-    contentPermission(resource, "update", "global", `Update ${resource}.`),
-    contentPermission(resource, "delete", "global", `Delete ${resource}.`)
-  );
-}
-const DEFAULT_PERMISSIONS = permissionDefinitions;
-const DEFAULT_ROLES = [
-  {
-    key: "platform_admin",
-    description: "Full platform administration.",
-    permissions: [permissionKey("*", "*", "*")]
-  },
-  {
-    key: "market_admin",
-    description: "Manage market content and core operational surfaces.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self"),
-      permissionKey("sdk", "execute", "global"),
-      permissionKey("agent", "execute", "global"),
-      permissionKey("operations", "execute", "global"),
-      permissionKey("users", "read", "global"),
-      permissionKey("audit", "read", "global"),
-      permissionKey("jobs", "manage", "global")
-    ]
-  },
-  {
-    key: "content_admin",
-    description: "Manage all content resources.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self")
-    ]
-  },
-  {
-    key: "content_editor",
-    description: "Edit marketplace content.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self")
-    ]
-  },
-  {
-    key: "member",
-    description: "Authenticated member with personal API tokens.",
-    permissions: [
-      permissionKey("auth", "read", "self"),
-      permissionKey("api_tokens", "read", "self"),
-      permissionKey("api_tokens", "create", "self"),
-      permissionKey("api_tokens", "delete", "self")
-    ]
-  },
-  {
-    key: "viewer",
-    description: "Read-only marketplace viewer.",
-    permissions: [permissionKey("auth", "read", "self")]
-  }
-];
-for (const role of DEFAULT_ROLES) {
-  if (role.key === "content_admin") {
-    for (const resource of CONTENT_RESOURCES) {
-      role.permissions.push(
-        permissionKey(resource, "read", "global"),
-        permissionKey(resource, "create", "global"),
-        permissionKey(resource, "update", "global"),
-        permissionKey(resource, "delete", "global")
-      );
-    }
-  }
-  if (role.key === "content_editor") {
-    for (const resource of CONTENT_RESOURCES) {
-      role.permissions.push(
-        permissionKey(resource, "read", "global"),
-        permissionKey(resource, "create", "global"),
-        permissionKey(resource, "update", "global")
-      );
-    }
-  }
-}
-function permissionGranted(granted, required) {
-  return granted.includes(permissionKey("*", "*", "*")) || granted.includes(required);
-}
-export {
-  ALL_PERMISSION_RESOURCES,
-  CONTENT_RESOURCES,
-  DEFAULT_PERMISSIONS,
-  DEFAULT_ROLES,
-  PLATFORM_RESOURCES,
-  permissionGranted,
-  permissionKey,
-  principalHasPlatformPermission
-};

package/dist/api/auth/tokens.d.ts

@@ -1,18 +0,0 @@
-import type { ApiPrincipal } from '../types.js';
-export interface AccessTokenPayload {
-    sub: string;
-    displayName?: string;
-    scopes: string[];
-    roles: string[];
-    permissions: string[];
-    iat: number;
-    exp: number;
-    iss: string;
-    jti: string;
-    tokenType: 'access' | 'service';
-    metadata?: Record<string, unknown>;
-}
-export declare function nextOpaqueToken(prefix: string): string;
-export declare function createAccessToken(payload: AccessTokenPayload, secret: string): string;
-export declare function verifyAccessToken(token: string, secret: string): AccessTokenPayload | null;
-export declare function principalFromAccessTokenPayload(payload: AccessTokenPayload): ApiPrincipal;

package/dist/api/auth/tokens.js

@@ -1,56 +0,0 @@
-import { createHmac, randomBytes } from "node:crypto";
-function encodeBase64Url(value) {
-  return Buffer.from(value).toString("base64url");
-}
-function decodeBase64Url(value) {
-  return Buffer.from(value, "base64url").toString("utf8");
-}
-function sign(input, secret) {
-  return createHmac("sha256", secret).update(input).digest("base64url");
-}
-function nextOpaqueToken(prefix) {
-  return `${prefix}_${randomBytes(24).toString("base64url")}`;
-}
-function createAccessToken(payload, secret) {
-  const encodedPayload = encodeBase64Url(JSON.stringify(payload));
-  const encodedSignature = sign(encodedPayload, secret);
-  return `${encodedPayload}.${encodedSignature}`;
-}
-function verifyAccessToken(token, secret) {
-  const [encodedPayload, encodedSignature] = token.split(".");
-  if (!encodedPayload || !encodedSignature) {
-    return null;
-  }
-  const expected = sign(encodedPayload, secret);
-  if (expected !== encodedSignature) {
-    return null;
-  }
-  try {
-    const payload = JSON.parse(decodeBase64Url(encodedPayload));
-    if (!payload.sub || !Array.isArray(payload.scopes) || !payload.exp) {
-      return null;
-    }
-    if (payload.exp <= Math.floor(Date.now() / 1e3)) {
-      return null;
-    }
-    return payload;
-  } catch {
-    return null;
-  }
-}
-function principalFromAccessTokenPayload(payload) {
-  return {
-    id: payload.sub,
-    displayName: payload.displayName,
-    scopes: [...payload.scopes],
-    roles: [...payload.roles],
-    permissions: [...payload.permissions],
-    metadata: payload.metadata
-  };
-}
-export {
-  createAccessToken,
-  nextOpaqueToken,
-  principalFromAccessTokenPayload,
-  verifyAccessToken
-};

package/dist/api/auth/trusted-assertion.d.ts

@@ -1,10 +0,0 @@
-export declare function createSignedUserAssertion(input: {
-    secret: string;
-    userId: string;
-    sessionId: string;
-    identityId?: string | null;
-    authTime: string;
-    now?: Date;
-    ttlSeconds?: number;
-    nonce?: string;
-}): string;

package/dist/api/auth/trusted-assertion.js

@@ -1,19 +0,0 @@
-import { createHmac, randomUUID } from "node:crypto";
-function createSignedUserAssertion(input) {
-  if (!input.secret.trim()) throw new Error("A web assertion secret is required.");
-  const now = input.now ?? /* @__PURE__ */ new Date();
-  const claims = {
-    userId: input.userId,
-    sessionId: input.sessionId,
-    identityId: input.identityId ?? null,
-    authTime: input.authTime,
-    expiresAt: new Date(now.getTime() + (input.ttlSeconds ?? 300) * 1e3).toISOString(),
-    nonce: input.nonce ?? randomUUID()
-  };
-  const payload = Buffer.from(JSON.stringify(claims)).toString("base64url");
-  const signature = createHmac("sha256", input.secret).update(payload).digest("base64url");
-  return `${payload}.${signature}`;
-}
-export {
-  createSignedUserAssertion
-};

package/dist/api/capacity/providers/providers.d.ts

@@ -1,2 +0,0 @@
-import type { ApiConfig, ApiRuntimeProviders, ResolvedApiRuntimeProviders } from '../../types.js';
-export declare function resolveApiRuntimeProviders(config: ApiConfig, overrides?: ApiRuntimeProviders): ResolvedApiRuntimeProviders;

package/dist/api/capacity/providers/providers.js

@@ -1,69 +0,0 @@
-import { BUILT_IN_AGENT_EXECUTION_PROVIDER_IDS } from "../../../types/agents.js";
-import { resolveApiD1Database } from "../../auth/d1-database.js";
-import { D1AuthProvider } from "../../auth/d1-provider.js";
-import { MemoryDeviceCodeAuthProvider } from "../../auth/memory-provider.js";
-function addProviders(target, incoming, label) {
-  for (const [id, value] of Object.entries(incoming ?? {})) {
-    if (target.has(id)) {
-      throw new Error(`Treeseed API runtime found duplicate ${label} provider "${id}".`);
-    }
-    target.set(id, value);
-  }
-}
-function resolveSelectedProvider(registry, selectedId, label) {
-  const selected = registry.get(selectedId);
-  if (!selected) {
-    throw new Error(`Treeseed API runtime could not resolve ${label} provider "${selectedId}".`);
-  }
-  return selected;
-}
-function resolveApiRuntimeProviders(config, overrides = {}) {
-  const authRegistry = /* @__PURE__ */ new Map();
-  const agentExecution = /* @__PURE__ */ new Map();
-  const agentQueue = /* @__PURE__ */ new Map();
-  const agentNotification = /* @__PURE__ */ new Map();
-  const agentRepository = /* @__PURE__ */ new Map();
-  const agentVerification = /* @__PURE__ */ new Map();
-  addProviders(authRegistry, {
-    memory: ({ config: runtimeConfig }) => new MemoryDeviceCodeAuthProvider({
-      ...runtimeConfig,
-      baseUrl: runtimeConfig.authApprovalBaseUrl ?? runtimeConfig.baseUrl
-    }),
-    d1: ({ config: runtimeConfig }) => new D1AuthProvider({
-      ...runtimeConfig,
-      baseUrl: runtimeConfig.authApprovalBaseUrl ?? runtimeConfig.baseUrl
-    }, { db: resolveApiD1Database(runtimeConfig) })
-  }, "auth");
-  addProviders(authRegistry, overrides.auth, "auth");
-  addProviders(agentExecution, Object.fromEntries(BUILT_IN_AGENT_EXECUTION_PROVIDER_IDS.map((id) => [id, { id }])), "agent execution");
-  addProviders(agentQueue, { memory: { id: "memory" } }, "agent queue");
-  addProviders(agentNotification, { sdk_message: { id: "sdk_message" } }, "agent notification");
-  addProviders(agentRepository, { git: { id: "git" } }, "agent repository");
-  addProviders(agentVerification, { local: { id: "local" } }, "agent verification");
-  addProviders(agentExecution, overrides.agentExecution, "agent execution");
-  addProviders(agentQueue, overrides.agentQueue, "agent queue");
-  addProviders(agentNotification, overrides.agentNotification, "agent notification");
-  addProviders(agentRepository, overrides.agentRepository, "agent repository");
-  addProviders(agentVerification, overrides.agentVerification, "agent verification");
-  const authFactory = resolveSelectedProvider(authRegistry, config.providers.auth, "auth");
-  resolveSelectedProvider(agentExecution, config.providers.agents.execution, "agent execution");
-  resolveSelectedProvider(agentQueue, config.providers.agents.queue, "agent queue");
-  resolveSelectedProvider(agentNotification, config.providers.agents.notification, "agent notification");
-  resolveSelectedProvider(agentRepository, config.providers.agents.repository, "agent repository");
-  resolveSelectedProvider(agentVerification, config.providers.agents.verification, "agent verification");
-  return {
-    auth: authFactory({ config }),
-    registries: {
-      auth: authRegistry,
-      agentExecution,
-      agentQueue,
-      agentNotification,
-      agentRepository,
-      agentVerification
-    },
-    selections: config.providers
-  };
-}
-export {
-  resolveApiRuntimeProviders
-};

package/dist/api/configuration/config.d.ts

@@ -1,4 +0,0 @@
-import type { ApiConfig } from '../types.js';
-export declare function resolveLocalApiDatabaseUrl(env?: NodeJS.ProcessEnv): string;
-export declare function resolveApiDatabaseUrl(env?: NodeJS.ProcessEnv, baseUrl?: string): string | undefined;
-export declare function resolveApiConfig(env?: NodeJS.ProcessEnv): ApiConfig;

package/dist/api/configuration/config.js

@@ -1,149 +0,0 @@
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-const LOCAL_DEV_AUTH_TTL_SECONDS = 365 * 24 * 60 * 60;
-const DEFAULT_AUTH_TTL_SECONDS = 15 * 60;
-const DEFAULT_REFRESH_TTL_SECONDS = 7 * 24 * 60 * 60;
-const DEFAULT_LOCAL_API_DATABASE_PORT = "54329";
-const DEFAULT_LOCAL_API_DATABASE_NAME = "treeseed_api";
-const DEFAULT_LOCAL_API_DATABASE_USER = "treeseed";
-const DEFAULT_LOCAL_API_DATABASE_PASSWORD = "treeseed-local-dev";
-function parseInteger(value, fallback) {
-  if (!value) return fallback;
-  const parsed = Number.parseInt(value, 10);
-  return Number.isFinite(parsed) ? parsed : fallback;
-}
-function resolveLocalWranglerConfigPath(repoRoot, env) {
-  const explicit = env.TREESEED_API_D1_WRANGLER_CONFIG?.trim() || env.TREESEED_LOCAL_WRANGLER_CONFIG?.trim();
-  if (explicit) return resolve(repoRoot, explicit);
-  const generated = resolve(repoRoot, ".treeseed", "generated", "environments", "local", "wrangler.toml");
-  return existsSync(generated) ? generated : void 0;
-}
-function normalizeUrl(value) {
-  return value.endsWith("/") ? value.slice(0, -1) : value;
-}
-function isLoopbackUrl(value) {
-  try {
-    const url = new URL(value);
-    return url.hostname === "127.0.0.1" || url.hostname === "localhost";
-  } catch {
-    return false;
-  }
-}
-function parseCsv(value) {
-  return (value ?? "").split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
-}
-function firstEnvValue(env, ...keys) {
-  for (const key of keys) {
-    const value = env[key]?.trim();
-    if (value) return value;
-  }
-  return void 0;
-}
-function encodeDatabaseUrlPart(value) {
-  return encodeURIComponent(value);
-}
-function resolveLocalApiDatabaseUrl(env = process.env) {
-  const port = firstEnvValue(env, "TREESEED_MARKET_LOCAL_POSTGRES_PORT", "TREESEED_API_LOCAL_POSTGRES_PORT") || DEFAULT_LOCAL_API_DATABASE_PORT;
-  const database = firstEnvValue(env, "TREESEED_MARKET_LOCAL_POSTGRES_DATABASE", "TREESEED_API_LOCAL_POSTGRES_DATABASE") || DEFAULT_LOCAL_API_DATABASE_NAME;
-  const user = firstEnvValue(env, "TREESEED_MARKET_LOCAL_POSTGRES_USER", "TREESEED_API_LOCAL_POSTGRES_USER") || DEFAULT_LOCAL_API_DATABASE_USER;
-  const password = firstEnvValue(env, "TREESEED_MARKET_LOCAL_POSTGRES_PASSWORD", "TREESEED_API_LOCAL_POSTGRES_PASSWORD") || DEFAULT_LOCAL_API_DATABASE_PASSWORD;
-  return `postgres://${encodeDatabaseUrlPart(user)}:${encodeDatabaseUrlPart(password)}@127.0.0.1:${port}/${encodeDatabaseUrlPart(database)}`;
-}
-function resolveApiDatabaseUrl(env = process.env, baseUrl) {
-  const explicit = firstEnvValue(env, "TREESEED_DATABASE_URL");
-  if (explicit) return explicit;
-  const environment = firstEnvValue(env, "TREESEED_API_ENVIRONMENT", "TREESEED_ENVIRONMENT");
-  const localMode = env.LOCAL_DEV_MODE !== void 0 || environment === "local" || (baseUrl ? isLoopbackUrl(baseUrl) : false);
-  return localMode ? resolveLocalApiDatabaseUrl(env) : void 0;
-}
-function resolveBaseUrl(env, host, port) {
-  if (env.TREESEED_API_BASE_URL?.trim()) {
-    return normalizeUrl(env.TREESEED_API_BASE_URL.trim());
-  }
-  if (env.RAILWAY_PUBLIC_DOMAIN?.trim()) {
-    return normalizeUrl(`https://${env.RAILWAY_PUBLIC_DOMAIN.trim()}`);
-  }
-  return normalizeUrl(`http://${host}:${port}`);
-}
-function resolveAuthApprovalBaseUrl(env, baseUrl) {
-  const explicit = env.TREESEED_API_AUTH_APPROVAL_BASE_URL?.trim() || env.TREESEED_SITE_URL?.trim() || env.TREESEED_BETTER_AUTH_URL?.trim();
-  const explicitIsLoopback = explicit ? isLoopbackUrl(explicit) : false;
-  try {
-    const url = new URL(baseUrl);
-    const isLocalApi = url.hostname === "127.0.0.1" || url.hostname === "localhost";
-    if (!isLocalApi && explicit && explicitIsLoopback) {
-      throw new Error(`Refusing loopback device approval URL "${explicit}" for remote API "${baseUrl}".`);
-    }
-    if (explicit) {
-      return normalizeUrl(explicit);
-    }
-    if (isLocalApi && url.port === "3000") {
-      url.port = "4321";
-      return normalizeUrl(url.toString());
-    }
-  } catch (error) {
-    if (error instanceof Error && error.message.includes("Refusing loopback device approval URL")) {
-      throw error;
-    }
-    if (explicit && /^https?:\/\//u.test(explicit)) {
-      throw new Error(`Invalid device approval URL configuration for API "${baseUrl}".`);
-    }
-  }
-  return baseUrl;
-}
-function resolveApiConfig(env = process.env) {
-  const host = env.HOST?.trim() || "0.0.0.0";
-  const port = parseInteger(env.PORT, 3e3);
-  const baseUrl = resolveBaseUrl(env, host === "0.0.0.0" ? "127.0.0.1" : host, port);
-  const issuer = normalizeUrl(env.TREESEED_API_ISSUER?.trim() || baseUrl);
-  const repoRoot = resolve(env.TREESEED_API_REPO_ROOT?.trim() || process.cwd());
-  const localDevAuth = env.LOCAL_DEV_MODE === "cloudflare" || isLoopbackUrl(baseUrl);
-  const defaultAccessTokenTtl = localDevAuth ? LOCAL_DEV_AUTH_TTL_SECONDS : DEFAULT_AUTH_TTL_SECONDS;
-  const defaultRefreshTokenTtl = localDevAuth ? LOCAL_DEV_AUTH_TTL_SECONDS : DEFAULT_REFRESH_TTL_SECONDS;
-  return {
-    name: env.TREESEED_API_NAME?.trim() || "@treeseed/sdk/api",
-    host,
-    port,
-    baseUrl,
-    authApprovalBaseUrl: resolveAuthApprovalBaseUrl(env, baseUrl),
-    issuer,
-    repoRoot,
-    projectId: env.TREESEED_PROJECT_ID?.trim() || "treeseed-project",
-    authSecret: env.TREESEED_API_AUTH_SECRET?.trim() || "treeseed-api-dev-secret",
-    projectApiKey: env.TREESEED_API_PROJECT_KEY?.trim() || void 0,
-    projectApiLabel: env.TREESEED_API_PROJECT_LABEL?.trim() || "Project API Key",
-    projectApiPermissions: parseCsv(env.TREESEED_API_PROJECT_KEY_PERMISSIONS).length > 0 ? parseCsv(env.TREESEED_API_PROJECT_KEY_PERMISSIONS) : ["sdk:execute:global", "agent:execute:global", "operations:execute:global"],
-    cloudflareAccountId: env.TREESEED_CLOUDFLARE_ACCOUNT_ID?.trim() || void 0,
-    cloudflareApiToken: env.TREESEED_CLOUDFLARE_API_TOKEN?.trim() || void 0,
-    apiDatabaseUrl: resolveApiDatabaseUrl(env, baseUrl),
-    d1DatabaseId: env.TREESEED_API_D1_DATABASE_ID?.trim() || void 0,
-    d1DatabaseName: env.TREESEED_API_D1_DATABASE_NAME?.trim() || env.SITE_DATA_DB?.trim() || void 0,
-    d1LocalPersistTo: env.TREESEED_API_D1_LOCAL_PERSIST_TO?.trim() || resolve(repoRoot, ".wrangler/state/v3/d1"),
-    d1WranglerConfigPath: resolveLocalWranglerConfigPath(repoRoot, env),
-    webServiceId: firstEnvValue(env, "TREESEED_WEB_SERVICE_ID", "TREESEED_API_WEB_SERVICE_ID") || "web",
-    webServiceSecret: firstEnvValue(env, "TREESEED_WEB_SERVICE_SECRET", "TREESEED_API_WEB_SERVICE_SECRET") || "treeseed-web-service-dev-secret",
-    webAssertionSecret: firstEnvValue(env, "TREESEED_API_WEB_ASSERTION_SECRET", "TREESEED_WEB_ASSERTION_SECRET", "TREESEED_API_AUTH_SECRET") || "treeseed-web-assertion-dev-secret",
-    webExchangeTtlSeconds: parseInteger(env.TREESEED_API_WEB_EXCHANGE_TTL, 300),
-    bootstrapAdminAllowlist: parseCsv(env.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST),
-    accessTokenTtlSeconds: parseInteger(env.TREESEED_API_ACCESS_TOKEN_TTL, defaultAccessTokenTtl),
-    refreshTokenTtlSeconds: parseInteger(env.TREESEED_API_REFRESH_TOKEN_TTL, defaultRefreshTokenTtl),
-    deviceCodeTtlSeconds: parseInteger(env.TREESEED_API_DEVICE_CODE_TTL, 10 * 60),
-    deviceCodePollIntervalSeconds: parseInteger(env.TREESEED_API_DEVICE_CODE_POLL_INTERVAL, 5),
-    templateCatalogPath: env.TREESEED_API_TEMPLATE_CATALOG_PATH?.trim() || void 0,
-    providers: {
-      auth: env.TREESEED_API_PROVIDER_AUTH?.trim() || "d1",
-      agents: {
-        execution: env.TREESEED_API_PROVIDER_AGENT_EXECUTION?.trim() || "codex",
-        queue: env.TREESEED_API_PROVIDER_AGENT_QUEUE?.trim() || "memory",
-        notification: env.TREESEED_API_PROVIDER_AGENT_NOTIFICATION?.trim() || "sdk_message",
-        repository: env.TREESEED_API_PROVIDER_AGENT_REPOSITORY?.trim() || "git",
-        verification: env.TREESEED_API_PROVIDER_AGENT_VERIFICATION?.trim() || "local"
-      }
-    }
-  };
-}
-export {
-  resolveApiConfig,
-  resolveApiDatabaseUrl,
-  resolveLocalApiDatabaseUrl
-};

package/dist/api/hosting/railway.d.ts

@@ -1,53 +0,0 @@
-import type { Hono } from 'hono';
-import { type Server } from 'node:http';
-import type { ApiServerOptions } from '../types.js';
-export declare function createNodeServer(options?: ApiServerOptions): Promise<{
-    app: Hono<{
-        Variables: import("../types.js").AppVariables;
-    }, import("hono/types").BlankSchema, "/">;
-    config: {
-        providers: {
-            agents: {
-                execution: string;
-                queue: string;
-                notification: string;
-                repository: string;
-                verification: string;
-            };
-            auth: string;
-        };
-        name: string;
-        host: string;
-        port: number;
-        baseUrl: string;
-        authApprovalBaseUrl?: string;
-        issuer: string;
-        repoRoot: string;
-        projectId: string;
-        authSecret: string;
-        projectApiKey?: string;
-        projectApiLabel: string;
-        projectApiPermissions: string[];
-        cloudflareAccountId?: string;
-        cloudflareApiToken?: string;
-        apiDatabaseUrl?: string;
-        d1DatabaseId?: string;
-        d1DatabaseName?: string;
-        d1LocalPersistTo?: string;
-        d1WranglerConfigPath?: string;
-        webServiceId: string;
-        webServiceSecret: string;
-        webAssertionSecret: string;
-        webExchangeTtlSeconds: number;
-        bootstrapAdminAllowlist: string[];
-        accessTokenTtlSeconds: number;
-        refreshTokenTtlSeconds: number;
-        deviceCodeTtlSeconds: number;
-        deviceCodePollIntervalSeconds: number;
-        templateCatalogPath?: string;
-    };
-    server: Server<typeof import("http").IncomingMessage, typeof import("http").ServerResponse>;
-    url: string;
-    close(): Promise<void>;
-}>;
-export declare const createRailwayApiServer: typeof createNodeServer;

package/dist/api/hosting/railway.js

@@ -1,71 +0,0 @@
-import { createServer } from "node:http";
-import { Readable } from "node:stream";
-import { resolveApiConfig } from "../configuration/config.js";
-import { createApiApp } from "../support/app.js";
-function hasRequestBody(method) {
-  return method !== "GET" && method !== "HEAD";
-}
-async function honoNodeHandler(app, request, response) {
-  const req = request;
-  const res = response;
-  const origin = req.headers.host ? `http://${req.headers.host}` : "http://127.0.0.1";
-  const url = new URL(req.url ?? "/", origin);
-  const webRequest = new Request(url, {
-    method: req.method,
-    headers: req.headers,
-    body: hasRequestBody(req.method) ? req : void 0,
-    duplex: "half"
-  });
-  const webResponse = await app.fetch(webRequest);
-  res.statusCode = webResponse.status;
-  webResponse.headers.forEach((value, key) => {
-    res.setHeader(key, value);
-  });
-  if (!webResponse.body) {
-    res.end();
-    return;
-  }
-  Readable.fromWeb(webResponse.body).pipe(res);
-}
-async function createNodeServer(options = {}) {
-  const config = {
-    ...resolveApiConfig(),
-    ...options.config ?? {},
-    providers: {
-      ...resolveApiConfig().providers,
-      ...options.config?.providers ?? {},
-      agents: {
-        ...resolveApiConfig().providers.agents,
-        ...options.config?.providers?.agents ?? {}
-      }
-    }
-  };
-  const app = createApiApp({
-    ...options,
-    config
-  });
-  const server = createServer((req, res) => {
-    void honoNodeHandler(app, req, res);
-  });
-  await new Promise((resolvePromise) => {
-    server.listen(config.port, config.host, () => resolvePromise());
-  });
-  const address = server.address();
-  const resolvedUrl = address ? `${config.baseUrl.startsWith("http") ? config.baseUrl : `http://${address.address}:${address.port}`}` : config.baseUrl;
-  return {
-    app,
-    config,
-    server,
-    url: resolvedUrl,
-    async close() {
-      await new Promise((resolvePromise, rejectPromise) => {
-        server.close((error) => error ? rejectPromise(error) : resolvePromise());
-      });
-    }
-  };
-}
-const createRailwayApiServer = createNodeServer;
-export {
-  createNodeServer,
-  createRailwayApiServer
-};

package/dist/api/index.d.ts

@@ -1,13 +0,0 @@
-export { resolveApiD1Database } from './auth/d1-database.js';
-export { D1AuthProvider } from './auth/d1-provider.js';
-export { MemoryDeviceCodeAuthProvider } from './auth/memory-provider.js';
-export { createSignedUserAssertion } from './auth/trusted-assertion.js';
-export { principalHasPlatformPermission } from './auth/rbac.js';
-export type { PermissionPrincipal } from './auth/rbac.js';
-export { resolveApiRuntimeProviders } from './capacity/providers/providers.js';
-export { resolveApiConfig, resolveApiDatabaseUrl, resolveLocalApiDatabaseUrl } from './configuration/config.js';
-export { createNodeServer, createRailwayApiServer } from './hosting/railway.js';
-export { createApiApp, createApiRouter } from './support/app.js';
-export { bearerTokenFromRequest, jsonError, requireActorType, requireAuthentication, requirePermission, requireScope } from './support/http.js';
-export { loadTemplateCatalog } from './support/templates.js';
-export type * from './types.js';