@treeseed/sdk 0.13.0-rc.6 → 0.13.0-rc.8

package/dist/seeds/workspaces/market-api-workspace.js

@@ -1,528 +0,0 @@
-import { createHash } from "node:crypto";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, resolve } from "node:path";
-import { credentialEnvironment, git, migrationCredential, remoteHead } from "../repositories/repository-history.js";
-import { assertMarketApiPackageLock, generateMarketApiPackageLock } from "./market-api-package-lock.js";
-import { managedWorkspaceMatches, managedWorkspacePaths, missingApplicationBootstrapFiles, staleManagedWorkspacePaths } from "./managed-workspace-overlay.js";
-function exactRef(value, label) {
-  if (!/^[a-f0-9]{40}$/u.test(value)) throw new Error(`${label} must be an exact 40-character commit SHA.`);
-  return value;
-}
-async function assertLocalGeneratedDescriptor(projectRoot, adminApiRef) {
-  const apiRoot = resolve(projectRoot, "packages", "api");
-  const head = (await git(apiRoot, ["rev-parse", "HEAD"])).stdout;
-  if (head !== adminApiRef) throw new Error(`Local Admin API checkout is ${head}, not requested ref ${adminApiRef}.`);
-  const dirty = (await git(apiRoot, ["status", "--porcelain"])).stdout;
-  if (dirty) throw new Error("Local Admin API checkout must be clean before its generated descriptor can seed Market API.");
-  const descriptor = resolve(apiRoot, "dist", "admin-api-descriptor.json");
-  try {
-    readFileSync(descriptor, "utf8");
-  } catch {
-    throw new Error(`Build Admin API ${adminApiRef} before reconciling Market API; ${descriptor} is missing.`);
-  }
-}
-function project(manifest, slug) {
-  const value = manifest.resources.projects.find((entry) => entry.slug === slug);
-  if (!value) throw new Error(`Seed ${manifest.name} does not declare ${slug}.`);
-  return value;
-}
-function journalPath(projectRoot, repository) {
-  return resolve(projectRoot, ".treeseed", "repository-migrations", `${repository.replace("/", "--")}--workspace.json`);
-}
-function journal(projectRoot, repository) {
-  try {
-    return JSON.parse(readFileSync(journalPath(projectRoot, repository), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeJournal(projectRoot, plan, receipts) {
-  const path = journalPath(projectRoot, plan.repository);
-  mkdirSync(dirname(path), { recursive: true });
-  const verified = new Set(receipts.filter((receipt) => receipt.verified).map((receipt) => receipt.branch));
-  const status = verified.has("main") && verified.has("staging") ? "verified" : "partial";
-  writeFileSync(path, `${JSON.stringify({ schemaVersion: 1, kind: "treeseed.market-api-workspace", repository: plan.repository, status, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), receipts }, null, 2)}
-`, "utf8");
-}
-function mergeReceipts(previous, current) {
-  const byBranch = new Map(previous.map((receipt) => [receipt.branch, receipt]));
-  for (const receipt of current) byBranch.set(receipt.branch, receipt);
-  return [...byBranch.values()].sort((left, right) => left.branch.localeCompare(right.branch));
-}
-function packageJson(sdkRef) {
-  return `${JSON.stringify({
-    name: "@treeseed/market-api",
-    version: "0.1.0",
-    private: true,
-    license: "UNLICENSED",
-    type: "module",
-    engines: { node: ">=22" },
-    workspaces: ["."],
-    scripts: { build: "tsc -p tsconfig.build.json", test: "vitest run tests", verify: "npm run build && npm test", start: "node dist/server.js" },
-    dependencies: { "@treeseed/sdk": `git+https://github.com/treeseed-ai/sdk.git#${sdkRef}` },
-    devDependencies: { "@types/node": "24.6.0", typescript: "5.9.3", vitest: "4.1.2" }
-  }, null, 2)}
-`;
-}
-function siteManifest() {
-  return `name: TreeSeed Market API
-slug: treeseed-market-api
-siteUrl: https://api.treeseed.dev
-contactEmail: hello@treeseed.email
-authority:
-  kind: market-singleton
-market:
-  profile: treeseed
-controlPlane:
-  mode: market-passthrough
-hosting:
-  kind: treeseed_control_plane
-  registration: none
-  teamId: treeseed
-  projectId: market-api
-runtime:
-  mode: treeseed_managed
-  registration: none
-providers:
-  deploy: railway
-  dns: cloudflare-dns
-`;
-}
-function packageManifest() {
-  return `schemaVersion: treeseed.package/v1
-id: "@treeseed/market-api"
-name: TreeSeed Market API
-kind: node-typescript
-type: singleton-hosted-service
-repository: treeseed-ai/market-api
-capabilities: { save: true, verify: true, publish: false, deploy: false, localOnly: false }
-workflowTemplateVersion: "1"
-githubEnvironments:
-  - staging
-  - production
-verify:
-  fast: npm run verify
-  local: npm run verify
-  release: npm run verify
-releaseGate:
-  workflow: verify.yml
-  timeoutSeconds: 1800
-projectArchitecture:
-  topology: split_site_content
-  rootPath: .
-  contentPath: src/content
-  contentRuntimeSource: r2_preview_overlay
-  localContentMaterialization: none
-`;
-}
-function gatewaySource(descriptorDigest) {
-  return `import { createAdminPassthroughHandler, createGatewayHealthHandlers } from '@treeseed/sdk/market-gateway';
-import descriptor from '../artifacts/admin-api-descriptor.json' with { type: 'json' };
-
-export type MarketHandler = (request: Request) => Promise<Response> | Response;
-export type DependencyChecks = Parameters<typeof createGatewayHealthHandlers>[0]['checks'];
-
-export function createMarketGateway(options: { adminBaseUrl: string; checks: DependencyChecks; marketHandler?: MarketHandler; serviceAssertion?: (request: Request) => Promise<string | null> | string | null; fetchImpl?: typeof fetch }) {
-	const health = createGatewayHealthHandlers({ checks: options.checks });
-	const admin = createAdminPassthroughHandler({ adminBaseUrl: options.adminBaseUrl, adminRoutes: descriptor.routes, fetchImpl: options.fetchImpl, serviceAssertion: options.serviceAssertion });
-	return async (request: Request) => {
-		const path = new URL(request.url).pathname;
-		if (path === '/healthz') return health.process();
-		if (path === '/healthz/deep') return health.deep();
-		if (path === '/readyz') return health.ready();
-		if (path === '/v1/market/status') return Response.json({ ok: true, service: 'market-api', adminDescriptor: '${descriptorDigest}' });
-		if (path === '/v1/market/profile') return request.method === 'GET'
-			? Response.json({ ok: true, payload: { id: 'central', label: 'TreeSeed Central Market', baseUrl: 'https://api.treeseed.dev', kind: 'central', alwaysAvailable: true } })
-			: Response.json({ error: 'method-not-allowed' }, { status: 405, headers: { allow: 'GET' } });
-		if (path.startsWith('/v1/market/')) return options.marketHandler ? options.marketHandler(request) : Response.json({ error: 'market-route-not-found' }, { status: 404 });
-		if (path.startsWith('/v1/')) return admin(request);
-		return Response.json({ error: 'not-found' }, { status: 404 });
-	};
-}
-`;
-}
-function assertionSource() {
-  return `import { createHmac, randomUUID } from 'node:crypto';
-
-const encode = (value: unknown) => Buffer.from(JSON.stringify(value)).toString('base64url');
-
-export function createAudienceBoundAssertion(secret: string, audience: string, now = () => Date.now()) {
-	if (!secret) throw new Error('Market service assertion secret is required.');
-	return (request: Request) => {
-		const issuedAt = Math.floor(now() / 1000);
-		const requestId = request.headers.get('x-request-id') ?? randomUUID();
-		const header = encode({ alg: 'HS256', typ: 'JWT' });
-		const payload = encode({ aud: audience, iss: 'market-api', iat: issuedAt, exp: issuedAt + 30, method: request.method, path: new URL(request.url).pathname, requestId });
-		const signature = createHmac('sha256', secret).update(\`\${header}.\${payload}\`).digest('base64url');
-		return \`\${header}.\${payload}.\${signature}\`;
-	};
-}
-`;
-}
-function serverSource() {
-  return `import { createServer } from 'node:http';
-import { Readable } from 'node:stream';
-import { proxyNodeWebSocketUpgrade } from '@treeseed/sdk/market-gateway';
-import descriptor from '../artifacts/admin-api-descriptor.json' with { type: 'json' };
-import { createMarketGateway, type MarketHandler } from './gateway.js';
-import { createAudienceBoundAssertion } from './service-assertion.js';
-
-const adminBaseUrl = process.env.TREESEED_ADMIN_API_INTERNAL_URL ?? '';
-if (!adminBaseUrl) throw new Error('TREESEED_ADMIN_API_INTERNAL_URL is required.');
-const assertionSecret = process.env.TREESEED_MARKET_SERVICE_ASSERTION_SECRET ?? '';
-const serviceAssertion = createAudienceBoundAssertion(assertionSecret, adminBaseUrl);
-const checkUrl = async (url: string) => { try { return (await fetch(url, { signal: AbortSignal.timeout(3000) })).ok; } catch { return false; } };
-const applicationModulePath = './market/app.js';
-const application = await import(applicationModulePath) as { createMarketHandler: () => MarketHandler };
-const gateway = createMarketGateway({
-	adminBaseUrl,
-	marketHandler: application.createMarketHandler(),
-	serviceAssertion,
-	checks: {
-		'market-database': async () => Boolean(process.env.TREESEED_MARKET_DATABASE_URL),
-		'admin-api': async () => checkUrl(\`\${adminBaseUrl.replace(/\\/$/u, '')}/healthz\`),
-		'internal-auth': async () => Boolean(assertionSecret),
-		'provider-bindings': async () => process.env.TREESEED_PROVIDER_BINDINGS_READY === 'true',
-	},
-});
-
-const server = createServer(async (incoming, outgoing) => {
-	const origin = \`http://\${incoming.headers.host ?? '127.0.0.1'}\`;
-	const body = incoming.method === 'GET' || incoming.method === 'HEAD' ? undefined : Readable.toWeb(incoming) as ReadableStream<Uint8Array>;
-	const response = await gateway(new Request(new URL(incoming.url ?? '/', origin), { method: incoming.method, headers: incoming.headers as HeadersInit, body, duplex: body ? 'half' : undefined } as RequestInit & { duplex?: 'half' }));
-	outgoing.statusCode = response.status;
-	for (const [name, value] of response.headers) if (name.toLowerCase() !== 'set-cookie') outgoing.setHeader(name, value);
-	const cookies = (response.headers as Headers & { getSetCookie?: () => string[] }).getSetCookie?.() ?? [];
-	if (cookies.length > 0) outgoing.setHeader('set-cookie', cookies);
-	if (!response.body) return outgoing.end();
-	Readable.fromWeb(response.body as never).pipe(outgoing);
-});
-server.on('upgrade', (incoming, socket, head) => {
-	void proxyNodeWebSocketUpgrade({ adminBaseUrl, adminRoutes: descriptor.routes, incoming, socket, head, serviceAssertion }).catch(() => socket.destroy());
-});
-server.listen(Number(process.env.PORT ?? 3000));
-`;
-}
-function marketApplicationBootstrap() {
-  return `import type { MarketHandler } from '../gateway.js';
-
-export function createMarketHandler(): MarketHandler {
-	return async () => Response.json({ error: 'market-route-not-implemented' }, { status: 501 });
-}
-`;
-}
-function gatewayTest() {
-  const sourceRoot = "../src";
-  return `import { describe, expect, it, vi } from 'vitest';
-import descriptor from '../artifacts/admin-api-descriptor.json' with { type: 'json' };
-import { createMarketGateway } from '${sourceRoot}/gateway.js';
-import { createAudienceBoundAssertion } from '${sourceRoot}/service-assertion.js';
-
-const checks = { 'market-database': async () => true, 'admin-api': async () => true, 'internal-auth': async () => true, 'provider-bindings': async () => true };
-const concretePath = (path: string) => path.replace(/:[^/]+/gu, 'fixture');
-
-describe('singleton Market gateway', () => {
-	it('owns Market routes and passes every declared Admin method and path through exactly', async () => {
-		const fetchImpl = vi.fn(async () => Response.json({ admin: true }, { status: 202 }));
-		const gateway = createMarketGateway({ adminBaseUrl: 'http://admin.internal', checks, fetchImpl });
-		expect((await gateway(new Request('https://api.treeseed.dev/v1/market/status'))).status).toBe(200);
-		for (const route of descriptor.routes) {
-			const response = await gateway(new Request(\`https://api.treeseed.dev\${concretePath(route.path)}?inventory=true\`, { method: route.method }));
-			expect(response.status, \`\${route.method} \${route.path}\`).toBe(202);
-		}
-		expect(fetchImpl).toHaveBeenCalledTimes(descriptor.routeCount);
-	});
-
-	it('rejects undeclared paths, method mismatches, and Admin shadowing of Market', async () => {
-		const fetchImpl = vi.fn(async () => Response.json({ admin: true }));
-		const gateway = createMarketGateway({ adminBaseUrl: 'http://admin.internal', checks, fetchImpl });
-		const route = descriptor.routes[0]!;
-		const methods = new Set(descriptor.routes.filter((candidate) => candidate.path === route.path).map((candidate) => candidate.method));
-		const mismatched = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].find((method) => !methods.has(method))!;
-		expect((await gateway(new Request('https://api.treeseed.dev/v1/not-declared'))).status).toBe(404);
-		expect((await gateway(new Request(\`https://api.treeseed.dev\${concretePath(route.path)}\`, { method: mismatched }))).status).toBe(404);
-		expect((await gateway(new Request('https://api.treeseed.dev/v1/market/not-declared'))).status).toBe(404);
-		expect(fetchImpl).not.toHaveBeenCalled();
-	});
-
-	it('fails readiness when hosted Admin is unavailable while process health remains available', async () => {
-		const gateway = createMarketGateway({ adminBaseUrl: 'http://admin.internal', checks: { ...checks, 'admin-api': async () => false } });
-		expect((await gateway(new Request('https://api.treeseed.dev/healthz'))).status).toBe(200);
-		expect((await gateway(new Request('https://api.treeseed.dev/healthz/deep'))).status).toBe(503);
-		expect((await gateway(new Request('https://api.treeseed.dev/readyz'))).status).toBe(503);
-	});
-
-	it('creates short-lived audience-bound service assertions', () => {
-		const assertion = createAudienceBoundAssertion('secret', 'http://admin.internal', () => 1000)(new Request('https://api.treeseed.dev/v1/projects', { headers: { 'x-request-id': 'request-1' } }));
-		const payload = JSON.parse(Buffer.from(assertion.split('.')[1]!, 'base64url').toString());
-		expect(payload).toMatchObject({ aud: 'http://admin.internal', method: 'GET', path: '/v1/projects', requestId: 'request-1', exp: 31 });
-	});
-});
-`;
-}
-function profileTest() {
-  const sourceRoot = "../src";
-  return `import { describe, expect, it, vi } from 'vitest';
-import { createMarketGateway } from '${sourceRoot}/gateway.js';
-
-const checks = { 'market-database': async () => true, 'admin-api': async () => true, 'internal-auth': async () => true, 'provider-bindings': async () => true };
-
-describe('singleton Market profile', () => {
-	it('owns the canonical profile route without contacting Admin', async () => {
-		const fetchImpl = vi.fn(async () => Response.json({ admin: true }));
-		const gateway = createMarketGateway({ adminBaseUrl: 'http://admin.internal', checks, fetchImpl });
-		const response = await gateway(new Request('https://api.treeseed.dev/v1/market/profile'));
-		expect(response.status).toBe(200);
-		expect(await response.json()).toEqual({ ok: true, payload: { id: 'central', label: 'TreeSeed Central Market', baseUrl: 'https://api.treeseed.dev', kind: 'central', alwaysAvailable: true } });
-		expect(fetchImpl).not.toHaveBeenCalled();
-		expect((await gateway(new Request('https://api.treeseed.dev/v1/market/profile', { method: 'POST' }))).status).toBe(405);
-	});
-});
-`;
-}
-function descriptorTest() {
-  return `import { createHash } from 'node:crypto';
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { describe, expect, it } from 'vitest';
-
-const descriptor = JSON.parse(readFileSync(resolve(import.meta.dirname, '../artifacts/admin-api-descriptor.json'), 'utf8'));
-const deployment = JSON.parse(readFileSync(resolve(import.meta.dirname, '../singleton.manifest.json'), 'utf8'));
-
-describe('Admin route descriptor pin', () => {
-	it('pins the exact Admin image ref and exposes a unique disjoint route union', () => {
-		expect(descriptor.sourceRef).toBe(deployment.adminApiRef);
-		expect(descriptor.routeCount).toBe(descriptor.routes.length);
-		expect(descriptor.routes.every((route: { path: string }) => !route.path.startsWith('/v1/market/'))).toBe(true);
-		expect(new Set(descriptor.routes.map((route: { method: string; path: string }) => \`\${route.method} \${route.path}\`)).size).toBe(descriptor.routeCount);
-		const digest = createHash('sha256').update(JSON.stringify(descriptor.routes)).digest('hex');
-		expect(\`sha256:\${digest}\`).toBe(descriptor.digest);
-		expect(descriptor.digest).toBe(deployment.adminDescriptorDigest);
-	});
-});
-`;
-}
-function workflow() {
-  return `name: Verify
-
-on:
-  pull_request:
-  push:
-    branches: [main, staging]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: verify-\${{ github.repository }}-\${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-      - run: npm ci
-      - run: npm run verify
-`;
-}
-const managedPaths = [
-  ".github/workflows/verify.yml",
-  "LICENSE",
-  "README.md",
-  "artifacts/admin-api-descriptor.json",
-  "package.json",
-  "package-lock.json",
-  "singleton.manifest.json",
-  "src/gateway.ts",
-  "src/server.ts",
-  "src/service-assertion.ts",
-  "tests/descriptor.test.ts",
-  "tests/gateway.test.ts",
-  "tests/profile.test.ts",
-  "treeseed.package.yaml",
-  "treeseed.site.yaml",
-  "tsconfig.build.json",
-  "tsconfig.json"
-].sort();
-function marketApiWorkspaceFiles(projectRoot, sdkRef, adminApiRef, packageLock) {
-  const descriptor = JSON.parse(readFileSync(resolve(projectRoot, "packages/api/dist/admin-api-descriptor.json"), "utf8"));
-  descriptor.sourceRef = adminApiRef;
-  const descriptorContent = `${JSON.stringify(descriptor, null, 2)}
-`;
-  return {
-    descriptorDigest: descriptor.digest,
-    bootstrapFiles: [["src/market/app.ts", marketApplicationBootstrap()]],
-    files: [
-      ["package.json", packageJson(sdkRef)],
-      ["treeseed.package.yaml", packageManifest()],
-      ["treeseed.site.yaml", siteManifest()],
-      ...packageLock ? [["package-lock.json", packageLock]] : [],
-      ["tsconfig.json", `${JSON.stringify({ compilerOptions: { target: "ES2023", module: "NodeNext", moduleResolution: "NodeNext", resolveJsonModule: true, noEmit: true, strict: true, skipLibCheck: true, lib: ["ES2023", "DOM", "DOM.Iterable"] }, include: ["src/**/*.ts", "tests/**/*.ts"] }, null, 2)}
-`],
-      ["tsconfig.build.json", `${JSON.stringify({ extends: "./tsconfig.json", compilerOptions: { noEmit: false, outDir: "dist", rootDir: "src" }, include: ["src/**/*.ts"], exclude: ["tests/**/*.ts"] }, null, 2)}
-`],
-      ["LICENSE", "UNLICENSED\n\nCopyright (c) TreeSeed. All rights reserved. No license is granted.\n"],
-      ["README.md", "# TreeSeed Market API\n\nPrivate singleton Market implementation and hosted Admin API gateway for `api.treeseed.dev`. This repository is never provisioned by Platform. Hosted deployment remains suspended.\n"],
-      ["src/gateway.ts", gatewaySource(descriptor.digest)],
-      ["src/service-assertion.ts", assertionSource()],
-      ["src/server.ts", serverSource()],
-      ["tests/gateway.test.ts", gatewayTest()],
-      ["tests/profile.test.ts", profileTest()],
-      ["tests/descriptor.test.ts", descriptorTest()],
-      ["artifacts/admin-api-descriptor.json", descriptorContent],
-      ["singleton.manifest.json", `${JSON.stringify({ schemaVersion: 3, authority: "market-singleton", sdkRef, adminApiRef, adminDescriptorDigest: descriptor.digest, deployment: "suspended", managedPaths }, null, 2)}
-`],
-      [".github/workflows/verify.yml", workflow()]
-    ]
-  };
-}
-function workspaceFilesDigest(entries) {
-  const hash = createHash("sha256");
-  for (const [path, content] of entries) hash.update(path).update("\0").update(content).update("\0");
-  return `sha256:${hash.digest("hex")}`;
-}
-function workspaceDigest(projectRoot, sdkRef, adminApiRef) {
-  return workspaceFilesDigest(marketApiWorkspaceFiles(projectRoot, sdkRef, adminApiRef).files);
-}
-async function recoverGeneratedReceipt(projectRoot, repository, branch, commit, gitEnv) {
-  const temporary = mkdtempSync(resolve(tmpdir(), "trsd-market-api-observe-"));
-  try {
-    await git(temporary, ["init", "--quiet"]);
-    await git(temporary, ["fetch", "--quiet", "--no-tags", `https://github.com/${repository}.git`, commit], { env: gitEnv });
-    const manifestResult = await git(temporary, ["show", `${commit}:singleton.manifest.json`], { allowFailure: true });
-    if (manifestResult.code !== 0) return null;
-    const manifest = JSON.parse(manifestResult.stdout);
-    if (manifest.authority !== "market-singleton" || manifest.deployment !== "suspended") return null;
-    if (typeof manifest.sdkRef !== "string" || !/^[a-f0-9]{40}$/u.test(manifest.sdkRef)) return null;
-    if (typeof manifest.adminApiRef !== "string" || !/^[a-f0-9]{40}$/u.test(manifest.adminApiRef)) return null;
-    const packageResult = await git(temporary, ["show", `${commit}:package.json`], { allowFailure: true });
-    const lockResult = await git(temporary, ["show", `${commit}:package-lock.json`], { allowFailure: true });
-    if (packageResult.code !== 0 || lockResult.code !== 0) return null;
-    try {
-      assertMarketApiPackageLock(lockResult.stdout, packageResult.stdout, manifest.sdkRef);
-    } catch {
-      return null;
-    }
-    const expected = marketApiWorkspaceFiles(projectRoot, manifest.sdkRef, manifest.adminApiRef, `${lockResult.stdout}
-`).files;
-    const legacySourceRoot = ["..", "src"].join("/");
-    const historicalSourceExtension = [".", "ts"].join("");
-    const legacyExpected = expected.map(([path, content]) => [path, path === "tests/gateway.test.ts" ? content.replace(`${legacySourceRoot}/gateway.js`, `${legacySourceRoot}/gateway${historicalSourceExtension}`).replace(`${legacySourceRoot}/service-assertion.js`, `${legacySourceRoot}/service-assertion${historicalSourceExtension}`) : content]);
-    const observedPaths = (await git(temporary, ["ls-tree", "-r", "--name-only", commit])).stdout.split("\n").filter(Boolean).sort();
-    const observedFiles = /* @__PURE__ */ new Map();
-    for (const path of managedWorkspacePaths(expected)) {
-      const observed = await git(temporary, ["show", `${commit}:${path}`], { allowFailure: true });
-      if (observed.code !== 0) return null;
-      observedFiles.set(path, observed.stdout);
-    }
-    const declaredManagedPaths = Array.isArray(manifest.managedPaths) && manifest.managedPaths.every((path) => typeof path === "string") ? manifest.managedPaths : null;
-    const matched = [expected, legacyExpected].find((candidate) => managedWorkspaceMatches({
-      expected: candidate,
-      observed: observedFiles,
-      declaredManagedPaths,
-      legacyObservedPaths: observedPaths
-    }));
-    if (!matched) return null;
-    return { branch, targetCommit: commit, sdkRef: manifest.sdkRef, adminApiRef: manifest.adminApiRef, workspaceDigest: workspaceDigest(projectRoot, manifest.sdkRef, manifest.adminApiRef), verified: true };
-  } finally {
-    rmSync(temporary, { recursive: true, force: true });
-  }
-}
-async function planMarketApiWorkspace(input) {
-  const marketApi = project(input.manifest, "market-api");
-  const repository = `${marketApi.repository.owner}/${marketApi.repository.name}`;
-  const credential = migrationCredential(input.projectRoot, repository, input.env);
-  if (!credential.token) throw new Error(`Central GitHub credential ${credential.envName} is required for ${repository}.`);
-  const gitEnv = credentialEnvironment(credential.token);
-  const sdkRef = exactRef(input.sdkRef, "SDK ref");
-  const adminApiRef = exactRef(input.adminApiRef, "Admin API ref");
-  const observedSdk = await remoteHead(input.projectRoot, "treeseed-ai/sdk", input.targetBranch, gitEnv);
-  const observedAdminApi = await remoteHead(input.projectRoot, "treeseed-ai/api", input.targetBranch, gitEnv);
-  if (observedSdk !== sdkRef || observedAdminApi !== adminApiRef) throw new Error(`Requested dependency refs do not match live ${input.targetBranch}: SDK ${observedSdk ?? "missing"}, Admin API ${observedAdminApi ?? "missing"}.`);
-  await assertLocalGeneratedDescriptor(input.projectRoot, adminApiRef);
-  const descriptorDigest = marketApiWorkspaceFiles(input.projectRoot, sdkRef, adminApiRef).descriptorDigest;
-  const desiredWorkspaceDigest = workspaceDigest(input.projectRoot, sdkRef, adminApiRef);
-  const recorded = journal(input.projectRoot, repository);
-  const branches = [];
-  for (const branch of [input.targetBranch]) {
-    const targetCommit = await remoteHead(input.projectRoot, repository, branch, gitEnv);
-    const receipt = recorded?.receipts?.find((entry) => entry.branch === branch) ?? (targetCommit ? await recoverGeneratedReceipt(input.projectRoot, repository, branch, targetCommit, gitEnv) : null);
-    const owned = Boolean(targetCommit && receipt?.verified && receipt.targetCommit === targetCommit);
-    const verified = Boolean(owned && receipt?.sdkRef === sdkRef && receipt?.adminApiRef === adminApiRef && receipt?.workspaceDigest === desiredWorkspaceDigest);
-    branches.push({ branch, targetCommit, action: verified ? "noop" : owned ? "update" : targetCommit ? "blocked" : "create", reason: verified ? "Live branch matches the verified singleton workspace receipt." : owned ? "Fast-forward the reconciler-owned singleton workspace." : targetCommit ? "Target branch has unrecognized history." : "Create the private singleton gateway workspace." });
-  }
-  return { repository, sdkRef, adminApiRef, descriptorDigest, branches };
-}
-async function buildCommit(projectRoot, branch, plan, parent, gitEnv, packageLock) {
-  const temporary = mkdtempSync(resolve(tmpdir(), "trsd-market-api-"));
-  const indexPath = resolve(temporary, "index");
-  const indexEnv = { ...process.env, GIT_INDEX_FILE: indexPath };
-  try {
-    await git(temporary, ["init", "--quiet"]);
-    if (parent) await git(temporary, ["fetch", "--quiet", "--no-tags", `https://github.com/${plan.repository}.git`, parent], { env: gitEnv });
-    await git(temporary, ["read-tree", ...parent ? [parent] : ["--empty"]], { env: indexEnv });
-    const desiredWorkspace = marketApiWorkspaceFiles(projectRoot, plan.sdkRef, plan.adminApiRef, packageLock);
-    const desiredFiles = desiredWorkspace.files;
-    const existingPaths = parent ? (await git(temporary, ["ls-tree", "-r", "--name-only", parent])).stdout.split("\n").filter(Boolean) : [];
-    let previousManagedPaths = [];
-    if (parent) {
-      const previousManifest = await git(temporary, ["show", `${parent}:singleton.manifest.json`], { allowFailure: true });
-      if (previousManifest.code === 0) {
-        try {
-          const parsed = JSON.parse(previousManifest.stdout);
-          if (Array.isArray(parsed.managedPaths) && parsed.managedPaths.every((path) => typeof path === "string")) previousManagedPaths = parsed.managedPaths;
-        } catch {
-        }
-      }
-    }
-    for (const path of staleManagedWorkspacePaths(previousManagedPaths, managedWorkspacePaths(desiredFiles))) {
-      await git(temporary, ["update-index", "--force-remove", path], { env: indexEnv });
-    }
-    for (const [path, content] of desiredFiles) {
-      const blob = (await git(temporary, ["hash-object", "-w", "--stdin"], { input: content })).stdout;
-      await git(temporary, ["update-index", "--add", "--cacheinfo", "100644", blob, path], { env: indexEnv });
-    }
-    for (const [path, content] of missingApplicationBootstrapFiles(existingPaths, desiredWorkspace.bootstrapFiles)) {
-      const blob = (await git(temporary, ["hash-object", "-w", "--stdin"], { input: content })).stdout;
-      await git(temporary, ["update-index", "--add", "--cacheinfo", "100644", blob, path], { env: indexEnv });
-    }
-    const tree = (await git(temporary, ["write-tree"], { env: indexEnv })).stdout;
-    const commit = (await git(temporary, ["commit-tree", tree, ...parent ? ["-p", parent] : [], "-m", `${parent ? "Reconcile" : "Create"} Market API ${branch} gateway workspace`], { env: { ...process.env, GIT_AUTHOR_NAME: "TreeSeed migration", GIT_AUTHOR_EMAIL: "operations@treeseed.dev", GIT_COMMITTER_NAME: "TreeSeed migration", GIT_COMMITTER_EMAIL: "operations@treeseed.dev" } })).stdout;
-    await git(temporary, ["push", `https://github.com/${plan.repository}.git`, `${commit}:refs/heads/${branch}`], { env: gitEnv });
-    return commit;
-  } finally {
-    rmSync(temporary, { recursive: true, force: true });
-  }
-}
-async function applyMarketApiWorkspace(input) {
-  const plan = await planMarketApiWorkspace(input);
-  if (plan.branches.some((branch) => branch.action === "blocked")) throw new Error("Market API target contains unrecognized history.");
-  const credential = migrationCredential(input.projectRoot, plan.repository, input.env);
-  const gitEnv = credentialEnvironment(credential.token);
-  const previousReceipts = journal(input.projectRoot, plan.repository)?.receipts ?? [];
-  const receipts = [];
-  const packageLock = plan.branches.some((branch) => branch.action === "create" || branch.action === "update") ? generateMarketApiPackageLock(packageJson(plan.sdkRef), plan.sdkRef) : null;
-  for (const branch of plan.branches) {
-    let targetCommit = branch.targetCommit;
-    if (branch.action === "create" || branch.action === "update") {
-      if (!packageLock) throw new Error("Market API package lock generation was not completed.");
-      targetCommit = await buildCommit(input.projectRoot, branch.branch, plan, branch.targetCommit, gitEnv, packageLock);
-    }
-    const observed = await remoteHead(input.projectRoot, plan.repository, branch.branch, gitEnv);
-    if (!targetCommit || observed !== targetCommit) throw new Error(`Fresh GitHub read-back returned ${observed ?? "missing"}, expected ${targetCommit ?? "missing"}.`);
-    receipts.push({ branch: branch.branch, targetCommit, sdkRef: plan.sdkRef, adminApiRef: plan.adminApiRef, workspaceDigest: workspaceDigest(input.projectRoot, plan.sdkRef, plan.adminApiRef), verified: true });
-    writeJournal(input.projectRoot, plan, mergeReceipts(previousReceipts, receipts));
-  }
-  return { ...plan, status: "verified", receipts, journalPath: journalPath(input.projectRoot, plan.repository) };
-}
-export {
-  applyMarketApiWorkspace,
-  marketApiWorkspaceFiles,
-  planMarketApiWorkspace
-};