@treeseed/sdk 0.13.0-rc.6 → 0.13.0-rc.8

package/dist/seeds/runtime/local-capacity.d.ts

@@ -1,65 +0,0 @@
-import { type CapacityProviderManifestV2 } from '../../capacity/providers/capacity-provider.js';
-import { MarketClient } from '../../entrypoints/clients/market-client.js';
-import type { SeedCapacityProviderPrerequisite, SeedPlan } from '../types.js';
-type Json = Record<string, unknown>;
-export type LocalSeedRuntimeResult = {
-    providers: Array<{
-        key: string;
-        teamId: string;
-        providerId: string;
-        membershipId: string;
-        projectIds: string[];
-        grantIds: string[];
-        allocationId: string;
-        runtimeManifestPath: string;
-    }>;
-    servicePrincipals: Array<{
-        key: string;
-        teamId: string;
-        serviceId: string;
-        membershipId: string | null;
-        credentialPath: string;
-    }>;
-};
-export declare function seedAllocationActivationKey(allocationId: string, expectedActiveAllocationSetId: string | null): string;
-export declare function seedAllocationRevisionId(providerKey: string, expectedActiveAllocationSetId: string): string;
-export declare function seedAllocationDesiredId(teamId: string, projectIds: string[]): string;
-export declare function seedAllocationMatchesProjects(allocation: Json, projectIds: string[]): boolean;
-export declare function selectSeedExecutionProviders(provider: SeedCapacityProviderPrerequisite, manifest: CapacityProviderManifestV2): {
-    id: string;
-    adapter: string;
-    profile?: string;
-    module?: string;
-    protocol?: "responses" | "chat-completions";
-    model?: {
-        endpointRef?: string;
-        baseUrl?: string;
-        model?: string;
-    };
-    credentialBindings?: string[];
-    healthProbe?: string;
-    versionConstraint?: string;
-    configurationDigest?: string;
-    minimumAssignmentDuration?: import("../../index.js").MinimumAssignmentDuration;
-    nativeLimits: Record<string, unknown>;
-    researchSourcePolicy?: import("../../index.js").ResearchSourcePolicy;
-    capabilities?: string[];
-    lanes?: Array<{
-        id: string;
-        purpose: import("../../index.js").ProviderLanePurpose;
-        maxConcurrentRunners: number;
-        minimumAssignmentDuration?: import("../../index.js").MinimumAssignmentDuration;
-        capabilities?: string[];
-        nativeLimits?: Record<string, unknown>;
-    }>;
-}[];
-export declare function listSeedCapacityGrants(client: MarketClient, teamId: string): Promise<Json[]>;
-export declare function listSeedCapacityAllocationSets(client: MarketClient, teamId: string): Promise<Json[]>;
-export declare function reconcileLocalSeedRuntime(input: {
-    projectRoot: string;
-    plan: SeedPlan;
-    accessToken: string;
-    apiUrl?: string;
-    env?: NodeJS.ProcessEnv;
-}): Promise<LocalSeedRuntimeResult>;
-export {};

package/dist/seeds/runtime/local-capacity.js

@@ -1,402 +0,0 @@
-import { createHash } from "node:crypto";
-import { existsSync } from "node:fs";
-import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
-import { parse, stringify } from "yaml";
-import {
-  capacityProviderPublicIdentity,
-  generateCapacityProviderIdentity,
-  ProviderProtocolClient,
-  signCapacityProviderProof,
-  validateAndDigestCapacityProviderManifest
-} from "../../capacity/providers/capacity-provider.js";
-import { MarketClient } from "../../entrypoints/clients/market-client.js";
-import { MarketClientError } from "../../entrypoints/clients/market-client.js";
-import { createInternalCapacityAllocationSet, supersedeInternalCapacityAllocationSet } from "../../market-client/internal-capacity-allocation.js";
-function object(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function string(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-function stableId(prefix, key) {
-  return `${prefix}-${createHash("sha256").update(key).digest("hex").slice(0, 24)}`;
-}
-function seedAllocationActivationKey(allocationId, expectedActiveAllocationSetId) {
-  return `seed-runtime:${allocationId}:activate:${expectedActiveAllocationSetId ?? "none"}`;
-}
-function seedAllocationRevisionId(providerKey, expectedActiveAllocationSetId) {
-  return stableId("seed-allocation-revision", `${providerKey}:${expectedActiveAllocationSetId}`);
-}
-function seedAllocationDesiredId(teamId, projectIds) {
-  return stableId("seed-allocation", `${teamId}:${[...new Set(projectIds)].sort().join(",")}`);
-}
-function seedAllocationMatchesProjects(allocation, projectIds) {
-  const expected = [...new Set(projectIds)].sort();
-  const slices = (Array.isArray(allocation.slices) ? allocation.slices : []).map(object);
-  const observed = slices.map((slice) => string(slice.targetId)).filter((value) => Boolean(value)).sort();
-  const target = 100 / expected.length;
-  const policiesMatch = slices.every((slice) => {
-    const policy = object(slice.policy);
-    return Number(policy.minPercent) === 0 && Number(policy.targetPercent) === target && Number(policy.maxPercent) === 100 && Number(policy.hardCapPercent) === 100;
-  });
-  const reserve = object(allocation.reservePolicy);
-  return expected.length > 0 && expected.length === observed.length && expected.every((projectId, index) => projectId === observed[index]) && policiesMatch && Number(reserve.percent) === 0 && reserve.overflow === "deny";
-}
-function selectSeedExecutionProviders(provider, manifest) {
-  const selected = manifest.executionProviders.filter((entry) => provider.executionProviderIds.includes(entry.id)).map((entry) => structuredClone(entry));
-  const selectedIds = new Set(selected.map((entry) => entry.id));
-  const missing = provider.executionProviderIds.filter((id) => !selectedIds.has(id));
-  if (missing.length) {
-    throw new Error(`Seed capacity prerequisite ${provider.key} references execution providers absent from ${provider.manifest}: ${missing.join(", ")}.`);
-  }
-  return selected;
-}
-async function atomicWrite(path, value, mode = 384) {
-  await mkdir(dirname(path), { recursive: true });
-  const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile(temporary, value, { encoding: "utf8", mode });
-  await rename(temporary, path);
-  await chmod(path, mode);
-}
-async function readJson(path) {
-  if (!existsSync(path)) return null;
-  return object(JSON.parse(await readFile(path, "utf8")));
-}
-function selectedProviders(plan) {
-  return plan.runtime.capacityProviders.filter((provider) => {
-    const environments = provider.environments ?? plan.environments;
-    return environments.some((environment) => plan.environments.includes(environment));
-  });
-}
-function selectedServicePrincipals(plan) {
-  return plan.runtime.agentLabServicePrincipals.filter((principal) => (principal.environments ?? plan.environments).some((environment) => plan.environments.includes(environment)));
-}
-async function listSeedCapacityGrants(client, teamId) {
-  const items = [];
-  let cursor;
-  do {
-    const response = await client.capacityGrants(teamId, { limit: 200, cursor });
-    items.push(...response.payload.items.map(object));
-    cursor = response.payload.page.hasMore ? response.payload.page.nextCursor ?? void 0 : void 0;
-  } while (cursor);
-  return items;
-}
-async function listSeedCapacityAllocationSets(client, teamId) {
-  const items = [];
-  let cursor;
-  do {
-    const response = await client.capacityAllocationSets(teamId, { limit: 200, cursor });
-    items.push(...response.payload.items.map(object));
-    cursor = response.payload.page.hasMore ? response.payload.page.nextCursor ?? void 0 : void 0;
-  } while (cursor);
-  return items;
-}
-function providerDataDir(projectRoot, provider) {
-  const identity = provider.key.replace(/[^a-zA-Z0-9._-]+/gu, "-").replace(/^-+|-+$/gu, "").toLowerCase();
-  return resolve(projectRoot, ".treeseed/local-capacity-providers", `${provider.providerClass}-${identity}`);
-}
-async function resolveTeam(client, plan, prerequisite) {
-  const action = plan.actions.find((candidate) => candidate.kind === "team" && candidate.key === prerequisite.team);
-  const actionId = string(action?.existing?.id);
-  if (actionId) return actionId;
-  const resource = (await client.resolveSeedResources([prerequisite.team])).payload[0];
-  const teamId = string(resource?.id);
-  if (!teamId) throw new Error(`Agent Lab service principal ${prerequisite.key} could not resolve team ${prerequisite.team}.`);
-  return teamId;
-}
-async function reconcileServicePrincipal(input) {
-  const teamId = await resolveTeam(input.client, input.plan, input.principal);
-  const result = await input.client.request(`/v1/teams/${encodeURIComponent(teamId)}/agent-lab/service-principal/reconcile`, { method: "POST", requireAuth: true, body: { resourceKey: input.principal.key, name: input.principal.name } });
-  const credentialPath = resolve(input.projectRoot, ".treeseed/agent-lab/runtime", `${result.payload.serviceId}.credential`);
-  await atomicWrite(credentialPath, `${result.payload.credential.trim()}
-`);
-  await atomicWrite(resolve(input.projectRoot, ".treeseed/agent-lab/runtime", "service-principal.json"), `${JSON.stringify({ schemaVersion: 1, teamId, serviceId: result.payload.serviceId, membershipId: result.payload.membershipId, credentialPath, resourceKey: input.principal.key, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
-`);
-  return { key: input.principal.key, teamId, serviceId: result.payload.serviceId, membershipId: result.payload.membershipId, credentialPath };
-}
-async function resolveResources(client, plan, provider, fallbackTeamId) {
-  const teamAction = plan.actions.find((action) => action.kind === "team" && action.key === provider.team);
-  let teamId = string(teamAction?.existing?.id) ?? fallbackTeamId ?? null;
-  const unresolvedKeys = [
-    ...!teamId ? [provider.team] : [],
-    ...provider.projects.filter((key) => !string(plan.actions.find((candidate) => candidate.kind === "project" && candidate.key === key)?.existing?.id))
-  ];
-  const resolved = unresolvedKeys.length > 0 ? new Map((await client.resolveSeedResources(unresolvedKeys)).payload.map((resource) => [resource.key, resource])) : /* @__PURE__ */ new Map();
-  teamId = teamId ?? string(resolved.get(provider.team)?.id);
-  if (!teamId) throw new Error(`Seed capacity prerequisite ${provider.key} could not resolve team ${provider.team}.`);
-  const projectIds = provider.projects.map((key) => {
-    const action = plan.actions.find((candidate) => candidate.kind === "project" && candidate.key === key);
-    const actionId = string(action?.existing?.id);
-    if (actionId) return actionId;
-    const id = string(resolved.get(key)?.id);
-    if (!id) throw new Error(`Seed capacity prerequisite ${provider.key} could not resolve project ${key}.`);
-    return id;
-  });
-  return { teamId, projectIds };
-}
-async function resolveProjectCapabilities(client, projectIds) {
-  const capabilities = /* @__PURE__ */ new Set();
-  for (const projectId of projectIds) {
-    const classes = (await client.projectAgentClasses(projectId, { limit: 200 })).payload.items.map(object);
-    for (const agentClass of classes) {
-      for (const capability of Array.isArray(agentClass.requiredCapabilities) ? agentClass.requiredCapabilities : []) {
-        if (string(capability)) capabilities.add(String(capability));
-      }
-    }
-  }
-  return [...capabilities].sort();
-}
-async function loadIdentity(path) {
-  const existing = await readJson(path);
-  if (existing?.d) return existing;
-  const identity = generateCapacityProviderIdentity();
-  await atomicWrite(path, `${JSON.stringify(identity)}
-`);
-  return identity;
-}
-async function verifyOrRepairCredential(input) {
-  const credentialId = string(input.state.credentialId);
-  const membershipId = string(input.state.membershipId);
-  const requestId = string(input.state.registrationRequestId);
-  const credentialRef = string(input.state.generatedCredentialRef);
-  if (!credentialId || !membershipId || !requestId || !credentialRef) return { state: input.state, accessToken: null };
-  const credentialPath = resolve(input.dataDir, credentialRef.replace(/^data:\/\//u, ""));
-  const credential = (await readFile(credentialPath, "utf8")).trim();
-  const verifyKey = `seed-runtime:${input.providerKey}:credential-verify:${Date.now()}`;
-  const verifyBody = { credentialId, idempotencyKey: verifyKey };
-  const verifyProof = await signCapacityProviderProof({ privateJwk: input.privateJwk, publicJwk: input.publicJwk, method: "POST", path: "/v1/provider/access-tokens", audience: input.apiUrl, body: verifyBody });
-  try {
-    const issued2 = await input.protocol.issueAccessToken(credential, credentialId, verifyProof, verifyKey);
-    return { state: input.state, accessToken: issued2.accessToken };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (!/credential (?:is invalid|identifier does not match|is not active)/iu.test(message)) throw error;
-  }
-  const rotationKey = `seed-runtime:${input.providerKey}:credential-repair:${credentialId}`;
-  const authorization = await input.client.authorizeCapacityProviderCredentialRotation(String(input.state.teamId), membershipId, rotationKey);
-  const exchangeKey = `seed-runtime:${input.providerKey}:credential:${authorization.payload.generation}`;
-  const exchangePath = `/v1/provider-registrations/${encodeURIComponent(requestId)}/credential`;
-  const exchangeBody = { requestId, idempotencyKey: exchangeKey };
-  const exchangeProof = await signCapacityProviderProof({ privateJwk: input.privateJwk, publicJwk: input.publicJwk, method: "POST", path: exchangePath, audience: input.apiUrl, body: exchangeBody });
-  const issued = await input.protocol.exchangeCredential(requestId, exchangeProof, exchangeKey);
-  await atomicWrite(credentialPath, `${issued.credential.trim()}
-`);
-  const repairedState = { ...input.state, credentialId: issued.id, credentialRepair: { priorCredentialId: credentialId, repairedAt: (/* @__PURE__ */ new Date()).toISOString() } };
-  const accessKey = `seed-runtime:${input.providerKey}:credential-verify:${issued.id}`;
-  const accessBody = { credentialId: issued.id, idempotencyKey: accessKey };
-  const accessProof = await signCapacityProviderProof({ privateJwk: input.privateJwk, publicJwk: input.publicJwk, method: "POST", path: "/v1/provider/access-tokens", audience: input.apiUrl, body: accessBody });
-  const access = await input.protocol.issueAccessToken(issued.credential, issued.id, accessProof, accessKey);
-  return { state: repairedState, accessToken: access.accessToken };
-}
-async function publishExecutionProviderInventory(input) {
-  const protocol = new ProviderProtocolClient({ marketUrl: input.apiUrl, accessToken: input.accessToken, userAgent: "treeseed-seed-runtime/1" });
-  const session = await protocol.createAvailabilitySession({
-    ttlSeconds: 90,
-    environment: "local",
-    status: "open",
-    availableFrom: (/* @__PURE__ */ new Date()).toISOString(),
-    availableUntil: null,
-    executionProviders: input.executionProviders.map((provider) => ({ ...provider, status: "active" })),
-    capabilities: input.capabilities,
-    nativeLimits: { maxConcurrentRunners: input.maxConcurrentRunners },
-    runnerPressure: { activeRunners: 0, maxConcurrentRunners: input.maxConcurrentRunners },
-    constraints: { outboundOnly: true },
-    metadata: { source: "treeseed-seed-runtime", seedResourceKey: input.provider.key, inventoryOnly: true }
-  });
-  await protocol.closeAvailabilitySession(session.payload.id);
-}
-async function provisionConnection(input) {
-  const connectionStatePath = resolve(input.dataDir, "connections", `${input.provider.connectionId}.json`);
-  const existingState = await readJson(connectionStatePath);
-  const sourceConnection = input.baseManifest.connections.find((entry) => entry.id === input.provider.connectionId);
-  let state = existingState ?? (sourceConnection ? {
-    teamId: sourceConnection.teamId,
-    providerId: sourceConnection.providerId,
-    membershipId: sourceConnection.membershipId,
-    credentialId: sourceConnection.membershipCredentialId,
-    generatedCredentialRef: sourceConnection.membershipCredentialRef
-  } : null);
-  const identityPath = resolve(input.dataDir, "identity.json");
-  const privateJwk = await loadIdentity(identityPath);
-  const publicJwk = capacityProviderPublicIdentity(privateJwk);
-  const protocol = new ProviderProtocolClient({ marketUrl: input.apiUrl, userAgent: "treeseed-seed-runtime/1" });
-  const executionProviders = selectSeedExecutionProviders(input.provider, input.baseManifest);
-  const maxConcurrentRunners = Math.max(1, ...executionProviders.map((entry) => Number(entry.nativeLimits.maxConcurrentRunners ?? 1)).filter(Number.isFinite));
-  const capabilities = [.../* @__PURE__ */ new Set([...executionProviders.flatMap((entry) => entry.capabilities), ...input.projectCapabilities])].sort();
-  const capabilityDigest = createHash("sha256").update(`${capabilities.join("\0")}\0${maxConcurrentRunners}`).digest("hex");
-  if (!state?.membershipId || !state.providerId || !state.credentialId || !state.generatedCredentialRef || state.teamId !== input.teamId) {
-    let key;
-    try {
-      key = await input.client.revealTeamCapacityRegistrationKey(input.teamId);
-    } catch (error) {
-      const payload = error instanceof MarketClientError ? object(error.payload) : {};
-      if (string(payload.code) !== "registration_key_reveal_invalid") throw error;
-      const current = await input.client.teamCapacityRegistrationKey(input.teamId);
-      key = await input.client.rotateTeamCapacityRegistrationKey(
-        input.teamId,
-        `seed-runtime:${input.provider.key}:repair-registration-key:${current.payload.generation}`
-      );
-    }
-    const body = {
-      schemaVersion: 1,
-      displayName: input.baseManifest.identity.displayName,
-      publicJwk,
-      capabilitySummary: capabilities,
-      supplyOffer: { weight: 1, maxConcurrentRunners, capabilities },
-      metadata: { seedRuntime: true, seedResourceKey: input.provider.key }
-    };
-    const proof = await signCapacityProviderProof({ privateJwk, publicJwk, method: "POST", path: "/v1/provider-registrations", audience: input.apiUrl, body });
-    const request = await protocol.register(key.payload.registrationKey, { ...body, proof }, `seed-runtime:${input.provider.key}:register:${capabilityDigest}`);
-    const approved = await input.client.reviewCapacityProviderRegistration(input.teamId, request.id, "approve", `seed-runtime:${input.provider.key}:approve:${capabilityDigest}`, { teamAlias: input.provider.connectionId });
-    if (approved.payload.status !== "approved" || !approved.payload.membershipId) throw new Error(`Seed provider ${input.provider.key} was not approved.`);
-    const credentialKey = `seed-runtime:${input.provider.key}:credential:${capabilityDigest}`;
-    const credentialPath = `/v1/provider-registrations/${encodeURIComponent(request.id)}/credential`;
-    const credentialProof = await signCapacityProviderProof({ privateJwk, publicJwk, method: "POST", path: credentialPath, audience: input.apiUrl, body: { requestId: request.id, idempotencyKey: credentialKey } });
-    const credential2 = await protocol.exchangeCredential(request.id, credentialProof, credentialKey);
-    const credentialRef = `data://secrets/${input.provider.connectionId}.credential`;
-    await atomicWrite(resolve(input.dataDir, "secrets", `${input.provider.connectionId}.credential`), `${credential2.credential.trim()}
-`);
-    state = { teamId: input.teamId, providerId: request.providerId, membershipId: approved.payload.membershipId, credentialId: credential2.id, generatedCredentialRef: credentialRef, registrationRequestId: request.id, registrationStatus: "approved", capabilityDigest };
-    await atomicWrite(connectionStatePath, `${JSON.stringify({ schemaVersion: 1, connectionId: input.provider.connectionId, marketUrl: input.apiUrl, marketProfile: "local", marketAudience: input.apiUrl, ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
-`);
-  }
-  const credential = await verifyOrRepairCredential({ client: input.client, protocol, apiUrl: input.apiUrl, providerKey: input.provider.key, dataDir: input.dataDir, privateJwk, publicJwk, state: state ?? {} });
-  state = credential.state;
-  if (state?.capabilityDigest !== capabilityDigest) {
-    state = { ...state, capabilityDigest };
-  }
-  await atomicWrite(connectionStatePath, `${JSON.stringify({ schemaVersion: 1, connectionId: input.provider.connectionId, marketUrl: input.apiUrl, marketProfile: "local", marketAudience: input.apiUrl, ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2)}
-`);
-  for (const executionProvider of executionProviders) executionProvider.capabilities = capabilities;
-  const connection = {
-    id: input.provider.connectionId,
-    marketProfile: "local",
-    marketAudience: input.apiUrl,
-    teamId: String(state.teamId),
-    providerId: String(state.providerId),
-    membershipId: String(state.membershipId),
-    membershipCredentialRef: String(state.generatedCredentialRef),
-    membershipCredentialId: String(state.credentialId),
-    offer: { weight: 1, maxConcurrentRunners, capabilities }
-  };
-  const sourceManifestDigest = validateAndDigestCapacityProviderManifest(input.baseManifest).digest;
-  const runtimeManifest = { ...input.baseManifest, configuration: { ...input.baseManifest.configuration, sourceManifestDigest }, executionProviders, connections: [connection] };
-  await atomicWrite(input.runtimeManifestPath, stringify(runtimeManifest));
-  if (!credential.accessToken) throw new Error(`Seed provider ${input.provider.key} could not issue a provider access token.`);
-  await publishExecutionProviderInventory({ apiUrl: input.apiUrl, accessToken: credential.accessToken, provider: input.provider, executionProviders, capabilities, maxConcurrentRunners });
-  return { providerId: connection.providerId, membershipId: connection.membershipId, capabilities, maxConcurrentRunners };
-}
-async function reconcilePolicy(input) {
-  const allocationProjectIds = (await input.client.projects(input.teamId)).payload.filter((project) => object(object(project.metadata).inventory).status !== "archived").map((project) => String(project.id)).sort();
-  if (!allocationProjectIds.length) throw new Error(`Team ${input.teamId} has no active projects for capacity allocation.`);
-  const existingGrants = await listSeedCapacityGrants(input.client, input.teamId);
-  const grantIds = [];
-  for (const projectId of input.projectIds) {
-    const id = stableId("seed-grant", `${input.provider.key}:${projectId}:${input.capabilities.join(",")}:time-v2:${input.maxConcurrentRunners}`);
-    grantIds.push(id);
-    const overlaps = existingGrants.filter(
-      (grant) => string(grant.id) !== id && string(grant.membershipId) === input.membershipId && string(grant.providerId) === input.providerId && string(grant.projectId) === projectId && string(grant.status) === "active"
-    );
-    for (const overlap of overlaps) {
-      const overlapId = string(overlap.id);
-      if (overlapId) await input.client.transitionCapacityGrant(
-        input.teamId,
-        overlapId,
-        "revoke",
-        `seed-runtime:${id}:retire-overlap:${overlapId}`
-      );
-    }
-    const existing = existingGrants.find((grant) => string(grant.id) === id);
-    if (!existing) {
-      await input.client.createCapacityGrant(input.teamId, {
-        schemaVersion: 2,
-        id,
-        membershipId: input.membershipId,
-        providerId: input.providerId,
-        projectId,
-        environment: "local",
-        status: "planned",
-        executionProviderIds: input.provider.executionProviderIds,
-        laneIds: [],
-        capabilities: input.capabilities,
-        allowedModes: input.provider.allowedModes,
-        dailyAgentSecondsLimit: 28800,
-        monthlyAgentSecondsLimit: 864e3,
-        maxConcurrentAssignments: input.maxConcurrentRunners,
-        metadata: { seedRuntime: true, seedResourceKey: input.provider.key }
-      }, `seed-runtime:${id}:create`);
-      await input.client.transitionCapacityGrant(input.teamId, id, "activate", `seed-runtime:${id}:activate`);
-    } else if (string(existing.status) !== "active") {
-      await input.client.transitionCapacityGrant(input.teamId, id, "activate", `seed-runtime:${id}:activate`);
-    }
-  }
-  const allocations = await listSeedCapacityAllocationSets(input.client, input.teamId);
-  const activeAllocation = allocations.find((entry) => string(entry.status) === "active");
-  if (activeAllocation && seedAllocationMatchesProjects(activeAllocation, allocationProjectIds)) {
-    return { grantIds, allocationId: String(activeAllocation.id) };
-  }
-  const desiredAllocationId = seedAllocationDesiredId(input.teamId, allocationProjectIds);
-  let allocationId = desiredAllocationId;
-  let allocation = allocations.find((entry) => string(entry.id) === allocationId);
-  if (allocation && ["superseded", "archived"].includes(string(allocation.status) ?? "")) {
-    const expectedActiveAllocationSetId = string(activeAllocation?.id);
-    if (!expectedActiveAllocationSetId) throw new Error("A superseded seed allocation requires an active replacement before a new revision can be reconciled.");
-    allocationId = seedAllocationRevisionId(desiredAllocationId, expectedActiveAllocationSetId);
-    allocation = allocations.find((entry) => string(entry.id) === allocationId);
-  }
-  if (!allocation) {
-    const target = 100 / allocationProjectIds.length;
-    const created = await createInternalCapacityAllocationSet(input.client, input.teamId, {
-      id: allocationId,
-      effectiveFrom: new Date(Date.now() - 1e3).toISOString(),
-      effectiveUntil: "2100-01-01T00:00:00.000Z",
-      reservePolicy: { percent: 0, overflow: "deny" },
-      slices: allocationProjectIds.map((projectId) => ({ id: `${allocationId}:${projectId}`, scope: "project", targetId: projectId, policy: { minPercent: 0, targetPercent: target, maxPercent: 100, hardCapPercent: 100 } })),
-      borrowingRules: [],
-      metadata: { seedRuntime: true, seedResourceKey: input.provider.key }
-    }, `seed-runtime:${allocationId}:create`);
-    allocation = created.payload;
-  }
-  if (string(allocation.status) !== "active") {
-    const expectedActiveAllocationSetId = string(activeAllocation?.id);
-    await supersedeInternalCapacityAllocationSet(
-      input.client,
-      input.teamId,
-      allocationId,
-      { expectedActiveAllocationSetId },
-      seedAllocationActivationKey(allocationId, expectedActiveAllocationSetId)
-    );
-  }
-  return { grantIds, allocationId };
-}
-async function reconcileLocalSeedRuntime(input) {
-  const apiUrl = input.apiUrl ?? input.env?.TREESEED_MARKET_PROFILE_LOCAL_URL?.trim() ?? "http://127.0.0.1:3000";
-  const client = new MarketClient({ profile: { id: "local", label: "Local", baseUrl: apiUrl, kind: "specialized" }, accessToken: input.accessToken, userAgent: "treeseed-seed-runtime/1" });
-  const servicePrincipals = [];
-  for (const principal of selectedServicePrincipals(input.plan)) servicePrincipals.push(await reconcileServicePrincipal({ client, plan: input.plan, principal, projectRoot: input.projectRoot }));
-  const providers = [];
-  for (const provider of selectedProviders(input.plan)) {
-    const dataDir = providerDataDir(input.projectRoot, provider);
-    const connectionState = await readJson(resolve(dataDir, "connections", `${provider.connectionId}.json`));
-    const { teamId, projectIds } = await resolveResources(client, input.plan, provider, string(connectionState?.teamId));
-    const baseManifestPath = resolve(input.projectRoot, provider.manifest);
-    const baseManifest = parse(await readFile(baseManifestPath, "utf8"));
-    const runtimeManifestPath = resolve(dataDir, "runtime", "provider-manifest.yaml");
-    const projectCapabilities = await resolveProjectCapabilities(client, projectIds);
-    const connection = await provisionConnection({ client, apiUrl, provider, baseManifest, dataDir, runtimeManifestPath, teamId, projectCapabilities });
-    const policy = await reconcilePolicy({ client, provider, teamId, projectIds, ...connection });
-    providers.push({ key: provider.key, teamId, projectIds, runtimeManifestPath, ...connection, ...policy });
-  }
-  return { providers, servicePrincipals };
-}
-export {
-  listSeedCapacityAllocationSets,
-  listSeedCapacityGrants,
-  reconcileLocalSeedRuntime,
-  seedAllocationActivationKey,
-  seedAllocationDesiredId,
-  seedAllocationMatchesProjects,
-  seedAllocationRevisionId,
-  selectSeedExecutionProviders
-};

package/dist/seeds/workspaces/gateway-contract-migration.d.ts

@@ -1,31 +0,0 @@
-import type { SeedManifest } from '../types.js';
-export declare const gatewayContractPaths: string[];
-export declare function planGatewayContractMigration(input: {
-    projectRoot: string;
-    manifest: SeedManifest;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-}): Promise<{
-    repository: string;
-    cliRepository: string;
-    branch: "staging";
-    sourceCommit: string;
-    cliSourceCommit: string;
-    action: "update" | "noop";
-    reason: string;
-}>;
-export declare function applyGatewayContractMigration(input: {
-    projectRoot: string;
-    manifest: SeedManifest;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-}): Promise<{
-    targetCommit: string;
-    cliTargetCommit: string;
-    status: "verified";
-    repository: string;
-    cliRepository: string;
-    branch: "staging";
-    sourceCommit: string;
-    cliSourceCommit: string;
-    action: "update" | "noop";
-    reason: string;
-}>;