@treeseed/sdk 0.13.0-rc.8 → 0.13.0-rc.80

package/dist/seeds/repositories/repository-history.js

@@ -1,343 +0,0 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, resolve } from "node:path";
-import { resolveMachineEnvironmentValues } from "../../operations/services/configuration/config-runtime.js";
-import { resolveGitHubCredentialForRepository } from "../../operations/services/configuration/github-credentials.js";
-import { classifyGitMode, runRepositoryGit } from "../../operations/services/operations/git-runner.js";
-function normalizeSeedGitOutput(output, preserveOutput = false) {
-  return preserveOutput ? output : output.trim();
-}
-async function git(cwd, args, options = {}) {
-  const result = runRepositoryGit(args, { cwd, ...options, mode: classifyGitMode(args) });
-  return {
-    stdout: normalizeSeedGitOutput(result.stdout, options.preserveOutput),
-    stderr: result.stderr.trim(),
-    code: result.status ?? 1
-  };
-}
-function credentialEnvironment(token) {
-  const basic = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
-  return {
-    ...process.env,
-    GIT_CONFIG_COUNT: "1",
-    GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader",
-    GIT_CONFIG_VALUE_0: `AUTHORIZATION: basic ${basic}`,
-    GIT_TERMINAL_PROMPT: "0"
-  };
-}
-function migrationCredential(projectRoot, repository, env) {
-  const values = resolveMachineEnvironmentValues(projectRoot, "staging");
-  return resolveGitHubCredentialForRepository(repository, { values, env: { ...values, ...env } });
-}
-async function resolveRef(sourcePath, branch) {
-  for (const candidate of [`refs/heads/${branch}`, `refs/remotes/origin/${branch}`]) {
-    const result = await git(sourcePath, ["rev-parse", "--verify", candidate], { allowFailure: true });
-    if (result.code === 0) return { ref: candidate, commit: result.stdout };
-  }
-  return null;
-}
-async function migrationBranches(sourcePath) {
-  const current = (await git(sourcePath, ["branch", "--show-current"], { allowFailure: true })).stdout;
-  return [.../* @__PURE__ */ new Set(["main", "staging", ...current && current !== "main" && current !== "staging" ? [current] : []])];
-}
-async function contentPathAtRef(sourcePath, ref) {
-  for (const path of ["docs/src/content", "src/content"]) {
-    const result = await git(sourcePath, ["cat-file", "-e", `${ref}:${path}`], { allowFailure: true });
-    if (result.code === 0) return path;
-  }
-  return null;
-}
-async function fetchSourceCommit(sourcePath, repository, commit, env) {
-  const present = await git(sourcePath, ["cat-file", "-e", `${commit}^{commit}`], { allowFailure: true });
-  if (present.code !== 0) await git(sourcePath, ["fetch", "--quiet", "--no-tags", `https://github.com/${repository}.git`, commit], { env });
-}
-async function contentTreeAtRef(sourcePath, ref, contentPath) {
-  if (!ref || !contentPath) return null;
-  const result = await git(sourcePath, ["rev-parse", `${ref}:${contentPath}`], { allowFailure: true });
-  return result.code === 0 ? result.stdout : null;
-}
-async function remoteHead(sourcePath, repository, branch, env) {
-  const result = await git(sourcePath, ["ls-remote", `https://github.com/${repository}.git`, `refs/heads/${branch}`], { env, allowFailure: true });
-  if (result.code !== 0) throw new Error(`Unable to observe ${repository}@${branch}: ${result.stderr || result.stdout}`);
-  return result.stdout.split(/\s+/u)[0] || null;
-}
-function mappings(manifest, projectRoot, selectedProject) {
-  const projects = new Map(manifest.resources.projects.map((project) => [project.key, project]));
-  return manifest.resources.hubRepositories.flatMap((target) => {
-    const project = projects.get(target.project);
-    if (!project || selectedProject && project.slug !== selectedProject) return [];
-    const forceSkeleton = project.metadata?.contentMigrationMode === "skeleton";
-    const migrationSourcePath = typeof project.metadata?.migrationSourcePath === "string" ? project.metadata.migrationSourcePath.trim() : "";
-    const checkoutPath = migrationSourcePath || project.repository.checkoutPath;
-    if (!checkoutPath && !forceSkeleton) throw new Error(`Project ${project.slug} must declare repository.checkoutPath before content history migration.`);
-    return [{ project, sourcePath: forceSkeleton ? projectRoot : resolve(projectRoot, checkoutPath), targetRepository: `${target.owner}/${target.name}`, visibility: target.repositoryPolicy?.visibility ?? "private", forceSkeleton }];
-  });
-}
-function journalPath(projectRoot, repository) {
-  return resolve(projectRoot, ".treeseed", "repository-migrations", `${repository.replace("/", "--")}.json`);
-}
-function migrationJournal(projectRoot, repository) {
-  try {
-    return JSON.parse(readFileSync(journalPath(projectRoot, repository), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function cutoverJournal(projectRoot, repository, branch) {
-  try {
-    return JSON.parse(readFileSync(resolve(projectRoot, ".treeseed", "content-cutovers", `${repository.replace("/", "--")}--${branch}.json`), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function isVerifiedSoftwareContentRemoval(input) {
-  const evidence = input.cutover?.evidence;
-  return Boolean(
-    input.contentPath && input.targetTree && input.cutover?.contract === "treeseed.content-cutover/v1" && input.cutover.verified === true && input.cutover.softwarePathRemoved === true && evidence?.status === "ready" && evidence.project === input.project && evidence.sourceRepository === input.sourceRepository && evidence.targetRepository === input.targetRepository && evidence.contentPath === input.contentPath && evidence.sourceTree === input.targetTree && evidence.targetTree === input.targetTree && (input.previousTree === null || input.previousTree === input.targetTree) && evidence.historyVerified === true && evidence.publicationVerified === true && evidence.treeDxVerified === true
-  );
-}
-function classifyContentHistoryBranch(input) {
-  if (!input.sourceCommit) return { action: "blocked", reason: "Source branch is missing." };
-  const verifiedReplay = Boolean(input.targetCommit && input.receipt?.verified === true && input.receipt.sourceCommit === input.sourceCommit && input.receipt.contentPath === input.contentPath && input.receipt.targetCommit === input.targetCommit);
-  if (verifiedReplay) return { action: "noop", reason: "Live source and target commits match the verified migration receipt." };
-  const ownedTarget = Boolean(input.targetCommit && input.receipt?.verified === true && input.receipt.contentPath === input.contentPath && input.receipt.targetCommit === input.targetCommit);
-  if (ownedTarget) return { action: "update", reason: "Fast-forward the reconciler-owned content branch to the current live source content." };
-  if (input.targetCommit) return { action: "blocked", reason: "Target branch differs from the verified migration journal or has no receipt." };
-  return { action: "create", reason: input.contentPath ? `Extract ${input.contentPath} with history into src/content.` : "Create the required content repository skeleton because this source ref has no content path." };
-}
-function isRecognizedOrganizationMigrationMetadata(metadata) {
-  return metadata[0] === "Migrate organization references to treeseed-ai" && metadata[1] === "TreeSeed migration" && metadata[2] === "operations@treeseed.dev";
-}
-function isRecognizedContentMigrationMetadata(metadata, project) {
-  return [`Migrate ${project} content history`, `Reconcile ${project} content history`].includes(metadata[0] ?? "") && metadata[1] === "TreeSeed migration" && metadata[2] === "operations@treeseed.dev";
-}
-function contentTreesUnchanged(previousTree, currentTree, forceSkeleton = false) {
-  return forceSkeleton || previousTree === currentTree;
-}
-async function recognizedOrganizationMigrationAdvance(sourcePath, previousTarget, targetCommit) {
-  if (!previousTarget || !targetCommit || previousTarget === targetCommit) return false;
-  const ancestor = await git(sourcePath, ["merge-base", "--is-ancestor", previousTarget, targetCommit], { allowFailure: true });
-  if (ancestor.code !== 0) return false;
-  const commits = (await git(sourcePath, ["rev-list", `${previousTarget}..${targetCommit}`])).stdout.split("\n").filter(Boolean);
-  if (!commits.length) return false;
-  for (const commit of commits) {
-    const metadata = (await git(sourcePath, ["show", "-s", "--format=%s%x00%an%x00%ae", commit])).stdout.split("\0");
-    if (!isRecognizedOrganizationMigrationMetadata(metadata)) return false;
-  }
-  return true;
-}
-async function recognizedContentMigrationTarget(sourcePath, targetCommit, project) {
-  if (!targetCommit) return false;
-  const metadata = (await git(sourcePath, ["show", "-s", "--format=%s%x00%an%x00%ae", targetCommit], { allowFailure: true })).stdout.split("\0");
-  return isRecognizedContentMigrationMetadata(metadata, project);
-}
-function writeMigrationJournal(projectRoot, plan, receipts, status) {
-  const path = journalPath(projectRoot, plan.targetRepository);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify({ schemaVersion: 1, kind: "treeseed.repository-content-history-migration", project: plan.project, sourceRepository: plan.sourceRepository, targetRepository: plan.targetRepository, status, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), receipts }, null, 2)}
-`, "utf8");
-}
-function workflow(project) {
-  return `name: Publish content
-
-on:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: content-\${{ github.repository }}-\${{ github.ref }}
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    environment: \${{ github.ref_name == 'main' && 'production' || (github.ref_name == 'staging' && 'staging' || 'preview') }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: actions/checkout@v4
-        with:
-          repository: treeseed-ai/sdk
-          ref: \${{ github.ref_name == 'main' && 'main' || 'staging' }}
-          path: .treeseed/content-publisher
-          persist-credentials: false
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-          cache: npm
-          cache-dependency-path: .treeseed/content-publisher/package-lock.json
-      - name: Build publisher
-        working-directory: .treeseed/content-publisher
-        run: npm ci --ignore-scripts && npm run build:dist
-      - name: Publish exact content commit
-        env:
-          TREESEED_TEAM_ID: treeseed
-          TREESEED_PROJECT_ID: ${project.slug}
-          TREESEED_CONTENT_CHANNEL: \${{ github.ref_name == 'main' && 'production' || (github.ref_name == 'staging' && 'staging' || 'preview') }}
-          TREESEED_CLOUDFLARE_ACCOUNT_ID: \${{ vars.TREESEED_CLOUDFLARE_ACCOUNT_ID }}
-          TREESEED_CONTENT_BUCKET_NAME: \${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
-          TREESEED_CLOUDFLARE_API_TOKEN: \${{ secrets.TREESEED_CLOUDFLARE_API_TOKEN }}
-        run: node ./.treeseed/content-publisher/dist/scripts/content/publish-content.js --root . --content-path src/content --source-commit "\${GITHUB_SHA}" --ref "\${GITHUB_REF_NAME}" --channel "\${TREESEED_CONTENT_CHANNEL}" > content-publication-receipt.json
-      - uses: actions/upload-artifact@v4
-        with:
-          name: content-publication-\${{ github.sha }}
-          path: content-publication-receipt.json
-`;
-}
-function readme(project) {
-  return `# ${project.name} content
-
-Authoritative content history for \`${project.repository.owner}/${project.repository.name}\`. Operate content through TreeDX and publish immutable runtime content through the protected workflow.
-`;
-}
-function license(project, visibility, projectRoot) {
-  if (visibility === "private") return "UNLICENSED\n\nCopyright (c) TreeSeed. All rights reserved. No license is granted.\n";
-  return readFileSync(resolve(projectRoot, "LICENSE"), "utf8");
-}
-async function addBlob(sourcePath, indexPath, path, content) {
-  const blob = await git(sourcePath, ["hash-object", "-w", "--stdin"], { input: content });
-  await git(sourcePath, ["update-index", "--add", "--cacheinfo", "100644", blob.stdout, path], { env: { ...process.env, GIT_INDEX_FILE: indexPath } });
-}
-async function targetFile(sourcePath, targetCommit, path) {
-  if (!targetCommit) return null;
-  const result = await git(sourcePath, ["show", `${targetCommit}:${path}`], { allowFailure: true });
-  return result.code === 0 ? `${result.stdout}
-` : null;
-}
-async function generatedWrapperMatches(input) {
-  const expected = {
-    "README.md": readme(input.project),
-    "LICENSE": license(input.project, input.visibility, input.projectRoot),
-    ".github/workflows/publish-content.yml": workflow(input.project)
-  };
-  for (const [path, content] of Object.entries(expected)) {
-    if (await targetFile(input.sourcePath, input.targetCommit, path) !== content) return false;
-  }
-  return true;
-}
-async function buildContentCommit(input) {
-  const temporary = mkdtempSync(resolve(tmpdir(), "trsd-content-migration-"));
-  const indexPath = resolve(temporary, "index");
-  try {
-    let parent = null;
-    await git(input.sourcePath, ["read-tree", "--empty"], { env: { ...process.env, GIT_INDEX_FILE: indexPath } });
-    if (input.contentPath) {
-      parent = (await git(input.sourcePath, ["subtree", "split", "--prefix", input.contentPath, input.sourceRef])).stdout.split("\n").at(-1) ?? null;
-      if (!parent) throw new Error(`Content history extraction produced no commit for ${input.project.slug}@${input.branch}.`);
-      const tree2 = (await git(input.sourcePath, ["rev-parse", `${parent}^{tree}`])).stdout;
-      await git(input.sourcePath, ["read-tree", `--prefix=src/content/`, tree2], { env: { ...process.env, GIT_INDEX_FILE: indexPath } });
-    }
-    await addBlob(input.sourcePath, indexPath, "README.md", readme(input.project));
-    await addBlob(input.sourcePath, indexPath, "LICENSE", license(input.project, input.visibility, input.projectRoot));
-    await addBlob(input.sourcePath, indexPath, ".github/workflows/publish-content.yml", workflow(input.project));
-    const tree = (await git(input.sourcePath, ["write-tree"], { env: { ...process.env, GIT_INDEX_FILE: indexPath } })).stdout;
-    const historyParent = input.targetParent ?? parent;
-    const args = ["commit-tree", tree, ...historyParent ? ["-p", historyParent] : [], "-m", `${input.targetParent ? "Reconcile" : "Migrate"} ${input.project.slug} content history`];
-    return (await git(input.sourcePath, args, { env: { ...process.env, GIT_AUTHOR_NAME: "TreeSeed migration", GIT_AUTHOR_EMAIL: "operations@treeseed.dev", GIT_COMMITTER_NAME: "TreeSeed migration", GIT_COMMITTER_EMAIL: "operations@treeseed.dev" } })).stdout;
-  } finally {
-    rmSync(temporary, { recursive: true, force: true });
-  }
-}
-async function planSeedContentRepositoryHistory(input) {
-  const plans = [];
-  for (const mapping of mappings(input.manifest, input.projectRoot, input.project)) {
-    const credential = migrationCredential(input.projectRoot, mapping.targetRepository, input.env);
-    if (!credential.token) throw new Error(`Central GitHub credential ${credential.envName} is required for ${mapping.targetRepository}.`);
-    const gitEnv = credentialEnvironment(credential.token);
-    const sourceRepository = `${mapping.project.repository.owner}/${mapping.project.repository.name}`;
-    const journal = migrationJournal(input.projectRoot, mapping.targetRepository);
-    const branches = [];
-    for (const branch of await migrationBranches(mapping.sourcePath)) {
-      const liveSourceCommit = await remoteHead(mapping.sourcePath, sourceRepository, branch, gitEnv);
-      if (!liveSourceCommit && branch !== "main" && branch !== "staging") continue;
-      if (liveSourceCommit) await fetchSourceCommit(mapping.sourcePath, sourceRepository, liveSourceCommit, gitEnv);
-      const source = liveSourceCommit ? { ref: liveSourceCommit, commit: liveSourceCommit } : null;
-      const targetCommit = await remoteHead(mapping.sourcePath, mapping.targetRepository, branch, gitEnv);
-      const contentPath = source && !mapping.forceSkeleton ? await contentPathAtRef(mapping.sourcePath, source.ref) : null;
-      const receipt = journal?.receipts?.find((entry) => entry.branch === branch);
-      if (receipt?.sourceCommit) await fetchSourceCommit(mapping.sourcePath, sourceRepository, receipt.sourceCommit, gitEnv);
-      if (receipt?.targetCommit) await fetchSourceCommit(mapping.sourcePath, mapping.targetRepository, receipt.targetCommit, gitEnv);
-      if (targetCommit) await fetchSourceCommit(mapping.sourcePath, mapping.targetRepository, targetCommit, gitEnv);
-      const previousTree = await contentTreeAtRef(mapping.sourcePath, receipt?.sourceCommit, receipt?.contentPath);
-      const currentTree = await contentTreeAtRef(mapping.sourcePath, source?.commit, contentPath);
-      const targetTree = await contentTreeAtRef(mapping.sourcePath, targetCommit ?? void 0, "src/content");
-      const verifiedRemoval = !contentPath && receipt?.verified === true && receipt.targetCommit === targetCommit && ["main", "staging"].some((cutoverBranch) => isVerifiedSoftwareContentRemoval({
-        cutover: cutoverJournal(input.projectRoot, mapping.targetRepository, cutoverBranch),
-        project: mapping.project.slug,
-        sourceRepository,
-        targetRepository: mapping.targetRepository,
-        contentPath: receipt.contentPath,
-        previousTree,
-        targetTree
-      }));
-      const recognizedTargetAdvance = receipt?.verified === true && receipt.contentPath === contentPath && await recognizedOrganizationMigrationAdvance(mapping.sourcePath, receipt.targetCommit, targetCommit);
-      const recognizedGeneratedTarget = await recognizedContentMigrationTarget(mapping.sourcePath, targetCommit, mapping.project.slug);
-      const targetMatchesCurrentContent = targetTree === currentTree;
-      const wrappersMatch = await generatedWrapperMatches({ projectRoot: input.projectRoot, project: mapping.project, sourcePath: mapping.sourcePath, targetCommit, visibility: mapping.visibility });
-      const ownedTarget = receipt?.verified === true && (receipt.targetCommit === targetCommit || recognizedTargetAdvance) || recognizedGeneratedTarget && targetMatchesCurrentContent;
-      const contentUnchanged = Boolean(
-        receipt?.verified && receipt.targetCommit === targetCommit && receipt.contentPath === contentPath && receipt.sourceCommit !== source?.commit && contentTreesUnchanged(previousTree, currentTree, mapping.forceSkeleton)
-      );
-      const classification = ownedTarget && targetMatchesCurrentContent && !wrappersMatch ? { action: "update", reason: "Reconcile generated content-repository wrapper files to exact seed policy." } : recognizedTargetAdvance && targetMatchesCurrentContent ? { action: "noop", reason: "The verified organization migration advanced the target to the current authoritative content tree." } : contentUnchanged ? { action: "noop", reason: "Live source advanced without changing the authoritative content tree." } : verifiedRemoval ? { action: "noop", reason: "The legacy software content path was removed after a verified Git, R2, and TreeDX cutover." } : classifyContentHistoryBranch({
-        sourceCommit: source?.commit ?? null,
-        contentPath,
-        targetCommit,
-        receipt: recognizedTargetAdvance ? { ...receipt, targetCommit } : receipt
-      });
-      branches.push({ branch, sourceRef: source?.ref ?? branch, contentPath, journalContentPath: verifiedRemoval ? receipt?.contentPath ?? null : contentPath, sourceCommit: source?.commit ?? null, targetCommit, action: classification.action, reason: !source ? `Source branch ${branch} is missing.` : classification.reason });
-    }
-    plans.push({ project: mapping.project.slug, sourcePath: mapping.sourcePath, sourceRepository, targetRepository: mapping.targetRepository, visibility: mapping.visibility, branches });
-  }
-  return plans;
-}
-async function applySeedContentRepositoryHistory(input) {
-  const plans = await planSeedContentRepositoryHistory(input);
-  if (plans.length !== 1) throw new Error(`Expected exactly one content migration for project ${input.project}.`);
-  const plan = plans[0];
-  if (plan.branches.some((branch) => branch.action === "blocked")) throw new Error(plan.branches.filter((branch) => branch.action === "blocked").map((branch) => branch.reason).join(" "));
-  const project = input.manifest.resources.projects.find((entry) => entry.slug === plan.project);
-  const credential = migrationCredential(input.projectRoot, plan.targetRepository, input.env);
-  const gitEnv = credentialEnvironment(credential.token);
-  const receipts = [...migrationJournal(input.projectRoot, plan.targetRepository)?.receipts ?? []].filter((receipt) => plan.branches.some((branch) => branch.branch === receipt.branch));
-  const processed = /* @__PURE__ */ new Set();
-  const record = (receipt) => {
-    const index = receipts.findIndex((entry) => entry.branch === receipt.branch);
-    if (index >= 0) receipts[index] = receipt;
-    else receipts.push(receipt);
-    processed.add(receipt.branch);
-    writeMigrationJournal(input.projectRoot, plan, receipts, processed.size === plan.branches.length ? "history_verified" : "partial");
-  };
-  for (const branch of plan.branches) {
-    if (branch.action === "noop") {
-      record({ branch: branch.branch, sourceRef: branch.sourceRef, sourceCommit: branch.sourceCommit, contentPath: branch.journalContentPath, targetCommit: branch.targetCommit, verified: true });
-      continue;
-    }
-    if (branch.action === "update" && branch.targetCommit) await fetchSourceCommit(plan.sourcePath, plan.targetRepository, branch.targetCommit, gitEnv);
-    const commit = await buildContentCommit({ projectRoot: input.projectRoot, project, sourcePath: plan.sourcePath, sourceRef: branch.sourceRef, contentPath: branch.contentPath, branch: branch.branch, visibility: plan.visibility, targetParent: branch.action === "update" ? branch.targetCommit : null });
-    await git(plan.sourcePath, ["push", `https://github.com/${plan.targetRepository}.git`, `${commit}:refs/heads/${branch.branch}`], { env: gitEnv });
-    const observed = await remoteHead(plan.sourcePath, plan.targetRepository, branch.branch, gitEnv);
-    if (observed !== commit) throw new Error(`Fresh GitHub read-back for ${plan.targetRepository}@${branch.branch} returned ${observed ?? "missing"}, expected ${commit}.`);
-    record({ branch: branch.branch, sourceRef: branch.sourceRef, sourceCommit: branch.sourceCommit, contentPath: branch.contentPath, targetCommit: commit, verified: true });
-  }
-  writeMigrationJournal(input.projectRoot, plan, receipts, "history_verified");
-  return { ...plan, status: "history_verified", receipts, journalPath: journalPath(input.projectRoot, plan.targetRepository) };
-}
-export {
-  applySeedContentRepositoryHistory,
-  classifyContentHistoryBranch,
-  contentTreesUnchanged,
-  credentialEnvironment,
-  git,
-  isRecognizedContentMigrationMetadata,
-  isRecognizedOrganizationMigrationMetadata,
-  isVerifiedSoftwareContentRemoval,
-  migrationBranches,
-  migrationCredential,
-  normalizeSeedGitOutput,
-  planSeedContentRepositoryHistory,
-  remoteHead,
-  resolveRef
-};

package/dist/seeds/repositories/source-repository-history.d.ts

@@ -1,85 +0,0 @@
-import type { SeedManifest } from '../types.js';
-type SourceHistoryReceipt = {
-    branch: string;
-    sourceCommit: string;
-    targetCommit: string;
-    workflow: string | null;
-    verified: boolean;
-};
-export type SourceRepositoryHistoryPlan = {
-    project: string;
-    sourcePath: string;
-    targetRepository: string;
-    workflow: string | null;
-    branches: Array<{
-        branch: string;
-        sourceRef: string;
-        sourceCommit: string | null;
-        targetCommit: string | null;
-        workflowPresent: boolean;
-        action: 'create' | 'update' | 'noop' | 'blocked';
-        reason: string;
-    }>;
-};
-export declare function classifySourceHistoryBranch(input: {
-    sourceCommit: string | null;
-    targetCommit: string | null;
-    workflow?: string | null;
-    receipt?: Partial<SourceHistoryReceipt> | null;
-}): {
-    action: "blocked";
-    reason: string;
-} | {
-    action: "noop";
-    reason: string;
-} | {
-    action: "update";
-    reason: string;
-} | {
-    action: "create";
-    reason: string;
-};
-export declare function planSeedSourceRepositoryHistory(input: {
-    projectRoot: string;
-    manifest: SeedManifest;
-    project: string;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-}): Promise<{
-    project: string;
-    sourcePath: string;
-    targetRepository: string;
-    workflow: string;
-    branches: {
-        branch: string;
-        sourceRef: string;
-        sourceCommit: string | null;
-        targetCommit: string | null;
-        workflowPresent: boolean;
-        action: "create" | "update" | "noop" | "blocked";
-        reason: string;
-    }[];
-}>;
-export declare function applySeedSourceRepositoryHistory(input: {
-    projectRoot: string;
-    manifest: SeedManifest;
-    project: string;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-}): Promise<{
-    status: "history_verified";
-    receipts: SourceHistoryReceipt[];
-    journalPath: string;
-    project: string;
-    sourcePath: string;
-    targetRepository: string;
-    workflow: string;
-    branches: {
-        branch: string;
-        sourceRef: string;
-        sourceCommit: string | null;
-        targetCommit: string | null;
-        workflowPresent: boolean;
-        action: "create" | "update" | "noop" | "blocked";
-        reason: string;
-    }[];
-}>;
-export {};

package/dist/seeds/repositories/source-repository-history.js

@@ -1,123 +0,0 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, resolve } from "node:path";
-import { credentialEnvironment, git, migrationBranches, migrationCredential, remoteHead, resolveRef } from "./repository-history.js";
-function journalPath(projectRoot, repository) {
-  return resolve(projectRoot, ".treeseed", "repository-migrations", `${repository.replace("/", "--")}--source.json`);
-}
-function journal(projectRoot, repository) {
-  try {
-    return JSON.parse(readFileSync(journalPath(projectRoot, repository), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeJournal(projectRoot, plan, receipts, status) {
-  const path = journalPath(projectRoot, plan.targetRepository);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify({ schemaVersion: 1, kind: "treeseed.repository-source-history-migration", project: plan.project, targetRepository: plan.targetRepository, status, updatedAt: (/* @__PURE__ */ new Date()).toISOString(), receipts }, null, 2)}
-`, "utf8");
-}
-function classifySourceHistoryBranch(input) {
-  if (!input.sourceCommit) return { action: "blocked", reason: "Source branch is missing." };
-  if (input.targetCommit && input.receipt?.verified === true && input.receipt.sourceCommit === input.sourceCommit && input.receipt.targetCommit === input.targetCommit && (input.receipt.workflow ?? null) === (input.workflow ?? null)) {
-    return { action: "noop", reason: "Live source and target commits match the verified migration receipt." };
-  }
-  if (input.targetCommit === input.sourceCommit && input.receipt?.verified === true && input.receipt.targetCommit === input.sourceCommit && !input.receipt.workflow && input.workflow) {
-    return { action: "update", reason: `Add required workflow .github/workflows/${input.workflow} as a fast-forward migration commit.` };
-  }
-  if (input.targetCommit) return { action: "blocked", reason: "Target branch differs from the verified migration journal or has no receipt." };
-  return { action: "create", reason: "Push the exact source history ref into the empty target branch." };
-}
-function mappings(manifest, projectRoot, selectedProject) {
-  const project = manifest.resources.projects.find((entry) => entry.slug === selectedProject);
-  if (!project) throw new Error(`Seed ${manifest.name} does not declare project ${selectedProject}.`);
-  const migrationSourcePath = typeof project.metadata?.migrationSourcePath === "string" ? project.metadata.migrationSourcePath.trim() : "";
-  if (!migrationSourcePath) throw new Error(`Project ${selectedProject} does not declare metadata.migrationSourcePath; source history migration is not authorized.`);
-  const workflows = project.repository.repositoryPolicy?.workflows ?? [];
-  if (workflows.length > 1) throw new Error(`Project ${selectedProject} source migration currently requires at most one workflow.`);
-  return { project, sourcePath: resolve(projectRoot, migrationSourcePath), targetRepository: `${project.repository.owner}/${project.repository.name}`, workflow: workflows[0] ?? null };
-}
-function verificationWorkflow() {
-  return `name: Verify
-
-on:
-  pull_request:
-  push:
-    branches: [main, staging]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  verify:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 24
-      - name: Verify generated project
-        working-directory: template
-        run: npm install --ignore-scripts && npm run verify
-`;
-}
-async function sourceTargetCommit(sourcePath, sourceCommit, workflow, workflowPresent, project, branch) {
-  if (!workflow || workflowPresent) return sourceCommit;
-  if (workflow !== "verify.yml") throw new Error(`Source migration does not have a generator for ${workflow}.`);
-  const temporary = mkdtempSync(resolve(tmpdir(), "trsd-source-migration-"));
-  const indexPath = resolve(temporary, "index");
-  const env = { ...process.env, GIT_INDEX_FILE: indexPath };
-  try {
-    await git(sourcePath, ["read-tree", sourceCommit], { env });
-    const blob = (await git(sourcePath, ["hash-object", "-w", "--stdin"], { input: verificationWorkflow() })).stdout;
-    await git(sourcePath, ["update-index", "--add", "--cacheinfo", "100644", blob, `.github/workflows/${workflow}`], { env });
-    const tree = (await git(sourcePath, ["write-tree"], { env })).stdout;
-    return (await git(sourcePath, ["commit-tree", tree, "-p", sourceCommit, "-m", `Prepare ${project} ${branch} repository workflow`], { env: { ...process.env, GIT_AUTHOR_NAME: "TreeSeed migration", GIT_AUTHOR_EMAIL: "operations@treeseed.dev", GIT_COMMITTER_NAME: "TreeSeed migration", GIT_COMMITTER_EMAIL: "operations@treeseed.dev" } })).stdout;
-  } finally {
-    rmSync(temporary, { recursive: true, force: true });
-  }
-}
-async function planSeedSourceRepositoryHistory(input) {
-  const mapping = mappings(input.manifest, input.projectRoot, input.project);
-  const credential = migrationCredential(input.projectRoot, mapping.targetRepository, input.env);
-  if (!credential.token) throw new Error(`Central GitHub credential ${credential.envName} is required for ${mapping.targetRepository}.`);
-  const gitEnv = credentialEnvironment(credential.token);
-  const recorded = journal(input.projectRoot, mapping.targetRepository);
-  const branches = [];
-  for (const branch of await migrationBranches(mapping.sourcePath)) {
-    const source = await resolveRef(mapping.sourcePath, branch);
-    const targetCommit = await remoteHead(mapping.sourcePath, mapping.targetRepository, branch, gitEnv);
-    const workflowPresent = Boolean(source && mapping.workflow && (await git(mapping.sourcePath, ["cat-file", "-e", `${source.ref}:.github/workflows/${mapping.workflow}`], { allowFailure: true })).code === 0);
-    const receipt = recorded?.receipts?.find((entry) => entry.branch === branch);
-    const classification = classifySourceHistoryBranch({ sourceCommit: source?.commit ?? null, targetCommit, workflow: mapping.workflow, receipt });
-    branches.push({ branch, sourceRef: source?.ref ?? branch, sourceCommit: source?.commit ?? null, targetCommit, workflowPresent, ...classification });
-  }
-  return { project: mapping.project.slug, sourcePath: mapping.sourcePath, targetRepository: mapping.targetRepository, workflow: mapping.workflow, branches };
-}
-async function applySeedSourceRepositoryHistory(input) {
-  const plan = await planSeedSourceRepositoryHistory(input);
-  if (plan.branches.some((branch) => branch.action === "blocked")) throw new Error(plan.branches.filter((branch) => branch.action === "blocked").map((branch) => branch.reason).join(" "));
-  const credential = migrationCredential(input.projectRoot, plan.targetRepository, input.env);
-  const gitEnv = credentialEnvironment(credential.token);
-  const receipts = [];
-  for (const branch of plan.branches) {
-    if (!branch.sourceCommit) throw new Error(`Source commit is missing for ${plan.project}@${branch.branch}.`);
-    let expectedTarget = branch.targetCommit;
-    if (branch.action === "create" || branch.action === "update") {
-      expectedTarget = await sourceTargetCommit(plan.sourcePath, branch.sourceCommit, plan.workflow, branch.workflowPresent, plan.project, branch.branch);
-      await git(plan.sourcePath, ["push", `https://github.com/${plan.targetRepository}.git`, `${expectedTarget}:refs/heads/${branch.branch}`], { env: gitEnv });
-    }
-    const observed = await remoteHead(plan.sourcePath, plan.targetRepository, branch.branch, gitEnv);
-    if (!expectedTarget || observed !== expectedTarget) throw new Error(`Fresh GitHub read-back for ${plan.targetRepository}@${branch.branch} returned ${observed ?? "missing"}, expected ${expectedTarget ?? "missing"}.`);
-    receipts.push({ branch: branch.branch, sourceCommit: branch.sourceCommit, targetCommit: observed, workflow: plan.workflow, verified: true });
-    writeJournal(input.projectRoot, plan, receipts, receipts.length === plan.branches.length ? "history_verified" : "partial");
-  }
-  return { ...plan, status: "history_verified", receipts, journalPath: journalPath(input.projectRoot, plan.targetRepository) };
-}
-export {
-  applySeedSourceRepositoryHistory,
-  classifySourceHistoryBranch,
-  planSeedSourceRepositoryHistory
-};

package/dist/seeds/repositories/support-repository-workflow.d.ts

@@ -1,73 +0,0 @@
-import type { SeedManifest } from '../types.js';
-type Receipt = {
-    branch: string;
-    sourceCommit: string;
-    targetCommit: string;
-    workflowDigest: string;
-    verified: boolean;
-};
-export type SupportWorkflowPlan = {
-    repository: string;
-    workflow: string;
-    workflowDigest: string;
-    branches: Array<{
-        branch: 'main' | 'staging';
-        sourceCommit: string;
-        workflowPresent: boolean;
-        action: 'update' | 'noop' | 'blocked';
-        reason: string;
-    }>;
-};
-export declare function classifySupportWorkflow(input: {
-    workflowPresent: boolean;
-    sourceCommit: string;
-    workflowDigest: string;
-    receipt?: Partial<Receipt> | null;
-}): {
-    action: "noop";
-    reason: string;
-} | {
-    action: "blocked";
-    reason: string;
-} | {
-    action: "update";
-    reason: string;
-};
-export declare function planSupportRepositoryWorkflow(input: {
-    projectRoot: string;
-    manifest: SeedManifest;
-    repository: string;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-}): Promise<{
-    repository: string;
-    workflow: string;
-    workflowDigest: string;
-    branches: {
-        branch: "main" | "staging";
-        sourceCommit: string;
-        workflowPresent: boolean;
-        action: "update" | "noop" | "blocked";
-        reason: string;
-    }[];
-}>;
-export declare function applySupportRepositoryWorkflow(input: {
-    projectRoot: string;
-    manifest: SeedManifest;
-    repository: string;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-}): Promise<{
-    status: "verified";
-    receipts: Receipt[];
-    journalPath: string;
-    repository: string;
-    workflow: string;
-    workflowDigest: string;
-    branches: {
-        branch: "main" | "staging";
-        sourceCommit: string;
-        workflowPresent: boolean;
-        action: "update" | "noop" | "blocked";
-        reason: string;
-    }[];
-}>;
-export {};