@treeseed/sdk 0.5.3 → 0.6.0

package/dist/workflow/operations.js

@@ -12,6 +12,7 @@ import {
   ensureTreeseedSecretSessionForConfig,
   ensureTreeseedActVerificationTooling,
   ensureTreeseedGitignoreEntries,
+  inspectTreeseedPassphraseEnvDiagnostic,
   finalizeTreeseedConfig,
   getTreeseedMachineConfigPaths,
   inspectTreeseedKeyAgentStatus,
@@ -26,6 +27,7 @@ import { ControlPlaneClient } from "../control-plane-client.js";
 import { exportTreeseedCodebase } from "../operations/services/export-runtime.js";
 import {
   assertDeploymentInitialized,
+  buildProvisioningSummary,
   cleanupDestroyedState,
   createBranchPreviewDeployTarget,
   createPersistentDeployTarget,
@@ -33,9 +35,7 @@ import {
   ensureGeneratedWranglerConfig,
   finalizeDeploymentState,
   loadDeployState,
-  provisionCloudflareResources,
   runRemoteD1Migrations,
-  syncCloudflareSecrets,
   validateDeployPrerequisites,
   validateDestroyPrerequisites
 } from "../operations/services/deploy.js";
@@ -89,6 +89,7 @@ import {
   workspaceRoot
 } from "../operations/services/workspace-tools.js";
 import { resolveTreeseedWorkflowState } from "../workflow-state.js";
+import { createTreeseedReconcileRegistry, deriveTreeseedDesiredUnits, planTreeseedReconciliation, reconcileTreeseedTarget } from "../reconcile/index.js";
 import {
   acquireWorkflowLock,
   createWorkflowRunJournal,
@@ -749,15 +750,19 @@ function previewStateFor(tenantRoot, branchName) {
     target: createBranchPreviewDeployTarget(branchName)
   });
 }
-function deployBranchPreview(tenantRoot, branchName, context, { initialize }) {
+async function deployBranchPreview(tenantRoot, branchName, context, { initialize }) {
   applyTreeseedEnvironmentToProcess({ tenantRoot, scope: "staging", override: true });
   assertTreeseedCommandEnvironment({ tenantRoot, scope: "staging", purpose: "deploy" });
   const target = createBranchPreviewDeployTarget(branchName);
   const existingState = previewStateFor(tenantRoot, branchName);
   if (initialize && !existingState.readiness?.initialized) {
     validateDeployPrerequisites(tenantRoot, { requireRemote: true });
-    provisionCloudflareResources(tenantRoot, { target });
-    syncCloudflareSecrets(tenantRoot, { target });
+    await reconcileTreeseedTarget({
+      tenantRoot,
+      target,
+      env: { ...process.env, ...context.env ?? {} },
+      write: (line) => context.write?.(line)
+    });
     runRemoteD1Migrations(tenantRoot, { target });
   } else {
     assertDeploymentInitialized(tenantRoot, { target });
@@ -1023,6 +1028,8 @@ async function workflowConfig(helpers, input = {}) {
       const printEnvOnly = input.printEnvOnly === true;
       const rotateMachineKeyFlag = input.rotateMachineKey === true;
       const connectMarketFlag = input.connectMarket === true;
+      const bootstrapOnly = input.bootstrap === true;
+      const bootstrapPreflight = bootstrapOnly && input.preflight === true;
       const nonInteractive = input.nonInteractive === true;
       const repairs = input.repair === false ? [] : resolveTreeseedWorkflowState(tenantRoot).deployConfigPresent ? applyTreeseedSafeRepairs(tenantRoot) : [];
       const toolHealth = ensureTreeseedActVerificationTooling({
@@ -1031,7 +1038,8 @@ async function workflowConfig(helpers, input = {}) {
         env: helpers.context.env,
         write: (line) => maybePrint(helpers.write, line)
       });
-      const secretSession = printEnvOnly && !revealSecrets ? {
+      const passphraseEnv = inspectTreeseedPassphraseEnvDiagnostic(helpers.context.env ?? process.env);
+      const secretSession = printEnvOnly && !revealSecrets || bootstrapPreflight ? {
         status: inspectTreeseedKeyAgentStatus(tenantRoot),
         createdWrappedKey: false,
         migratedWrappedKey: false,
@@ -1050,8 +1058,21 @@ async function workflowConfig(helpers, input = {}) {
         scopes,
         env: helpers.context.env
       });
+      if (bootstrapPreflight && !secretSession.status.unlocked && !passphraseEnv.configured) {
+        workflowError(
+          "config",
+          "validation_failed",
+          `${passphraseEnv.envVar} is not visible to this Codex process. ${passphraseEnv.recommendedLaunch}`,
+          {
+            details: {
+              passphraseEnv,
+              secretSession: secretSession.status
+            }
+          }
+        );
+      }
       if (printEnvOnly) {
-        const reports2 = scopes.map((scope) => ({
+        const reports2 = await Promise.all(scopes.map(async (scope) => ({
           scope,
           environment: collectTreeseedPrintEnvReport({
             tenantRoot,
@@ -1059,8 +1080,8 @@ async function workflowConfig(helpers, input = {}) {
             env: helpers.context.env,
             revealSecrets
           }),
-          provider: checkTreeseedProviderConnections({ tenantRoot, scope, env: helpers.context.env })
-        }));
+          provider: await checkTreeseedProviderConnections({ tenantRoot, scope, env: helpers.context.env })
+        })));
         return buildWorkflowResult(
           "config",
           tenantRoot,
@@ -1115,13 +1136,90 @@ async function workflowConfig(helpers, input = {}) {
           toolHealth
         });
       }
+      if (bootstrapPreflight) {
+        maybePrint(helpers.write, "Preparing bootstrap preflight...");
+        const { configPath: configPath2, keyPath: keyPath2 } = getTreeseedMachineConfigPaths(tenantRoot);
+        const plansByScope = await Promise.all(scopes.filter((scope) => scope !== "local").map(async (scope) => {
+          maybePrint(helpers.write, `Deriving desired units for ${scope}...`);
+          const target = createPersistentDeployTarget(scope);
+          const derived = deriveTreeseedDesiredUnits({ tenantRoot, target });
+          const registry = createTreeseedReconcileRegistry(derived.deployConfig);
+          const capabilityMatrix = derived.units.map((unit) => {
+            const adapter = registry.get(unit.unitType, unit.provider);
+            return {
+              unitId: unit.unitId,
+              unitType: unit.unitType,
+              provider: unit.provider,
+              logicalName: unit.logicalName,
+              requiredPostconditions: adapter.requiredPostconditions?.({
+                context: {
+                  tenantRoot,
+                  target,
+                  deployConfig: derived.deployConfig,
+                  launchEnv: helpers.context.env ?? process.env,
+                  session: /* @__PURE__ */ new Map(),
+                  write: (line) => maybePrint(helpers.write, line)
+                },
+                unit,
+                persistedState: null
+              }) ?? [],
+              verificationSupported: typeof adapter.verify === "function"
+            };
+          });
+          const planned = await planTreeseedReconciliation({
+            tenantRoot,
+            target,
+            env: helpers.context.env,
+            write: (line) => maybePrint(helpers.write, line)
+          });
+          return {
+            scope,
+            resourceInventory: buildProvisioningSummary(derived.deployConfig, loadDeployState(tenantRoot, derived.deployConfig, { target }), target),
+            capabilityMatrix: await Promise.all(capabilityMatrix.map(async (entry) => ({
+              ...entry,
+              requiredPostconditions: await Promise.resolve(entry.requiredPostconditions)
+            }))),
+            plans: planned.plans.map((plan) => ({
+              unitId: plan.unit.unitId,
+              unitType: plan.unit.unitType,
+              provider: plan.unit.provider,
+              action: plan.diff.action,
+              reasons: plan.diff.reasons
+            }))
+          };
+        }));
+        return buildWorkflowResult(
+          "config",
+          tenantRoot,
+          {
+            mode: "bootstrap-preflight",
+            scopes,
+            sync,
+            configPath: configPath2,
+            keyPath: keyPath2,
+            repairs,
+            preflight,
+            toolHealth,
+            passphraseEnv,
+            secretSession,
+            context: contextSnapshot,
+            resourceInventoryByScope: Object.fromEntries(plansByScope.map((entry) => [entry.scope, entry.resourceInventory])),
+            verificationPreflight: plansByScope
+          },
+          {
+            nextSteps: createNextSteps([
+              { operation: "config", reason: "Run bootstrap once the verification preflight is clean.", input: { environment: scopes, bootstrap: true } }
+            ])
+          }
+        );
+      }
       const explicitUpdates = Array.isArray(input.updates) ? input.updates.map((update) => ({
         scope: update.scope,
         entryId: String(update.entryId ?? ""),
         value: typeof update.value === "string" ? update.value : "",
         reused: update.reused === true
       })) : null;
-      if (!explicitUpdates && !nonInteractive) {
+      if (!bootstrapOnly && !explicitUpdates && !nonInteractive) {
         workflowError(
           "config",
           "validation_failed",
@@ -1136,16 +1234,22 @@ async function workflowConfig(helpers, input = {}) {
           reused: entry.currentValue.length > 0 || entry.suggestedValue.length > 0
         }))
       );
-      maybePrint(helpers.write, "Saving resolved configuration values to machine config...");
-      const applyResult = applyTreeseedConfigValues({
-        tenantRoot,
-        updates: explicitUpdates ?? autoUpdates
-      });
-      const finalizeResult = finalizeTreeseedConfig({
+      const applyResult = bootstrapOnly ? { updated: [], sharedStorageMigrations: [] } : (() => {
+        maybePrint(helpers.write, "Saving resolved configuration values to machine config...");
+        return applyTreeseedConfigValues({
+          tenantRoot,
+          updates: explicitUpdates ?? autoUpdates
+        });
+      })();
+      if (bootstrapOnly) {
+        maybePrint(helpers.write, "Bootstrapping platform reconciliation from existing configuration...");
+      }
+      const finalizeResult = await finalizeTreeseedConfig({
         tenantRoot,
         scopes,
         sync,
         env: helpers.context.env,
+        checkConnections: bootstrapOnly || sync !== "none" || scopes.some((scope) => scope !== "local"),
         onProgress: (line) => maybePrint(helpers.write, line)
       });
       const refreshedContext = collectTreeseedConfigContext({
@@ -1153,7 +1257,7 @@ async function workflowConfig(helpers, input = {}) {
         scopes,
         env: helpers.context.env
       });
-      const reports = printEnv ? scopes.map((scope) => ({
+      const reports = printEnv ? await Promise.all(scopes.map(async (scope) => ({
         scope,
         environment: collectTreeseedPrintEnvReport({
           tenantRoot,
@@ -1161,15 +1265,15 @@ async function workflowConfig(helpers, input = {}) {
           env: helpers.context.env,
           revealSecrets
         }),
-        provider: finalizeResult.connectionChecks.find((report) => report.scope === scope) ?? checkTreeseedProviderConnections({ tenantRoot, scope, env: helpers.context.env })
-      })) : [];
+        provider: finalizeResult.connectionChecks.find((report) => report.scope === scope) ?? await checkTreeseedProviderConnections({ tenantRoot, scope, env: helpers.context.env })
+      }))) : [];
       const { configPath, keyPath } = getTreeseedMachineConfigPaths(tenantRoot);
       const state = resolveTreeseedWorkflowState(tenantRoot);
       return buildWorkflowResult(
         "config",
         tenantRoot,
         {
-          mode: "configure",
+          mode: bootstrapOnly ? "bootstrap" : "configure",
           scopes,
           sync,
           configPath,
@@ -1177,6 +1281,7 @@ async function workflowConfig(helpers, input = {}) {
           repairs,
           preflight,
           toolHealth,
+          passphraseEnv,
           secretSession,
           context: refreshedContext,
           result: {
@@ -2268,7 +2373,7 @@ async function workflowRelease(helpers, input) {
             }
             continue;
           }
-          const releasedPackage = await executeJournalStep(root, workflowRun.runId, `release-${report.name}`, () => {
+          const releasedPackage = await executeJournalStep(root, workflowRun.runId, `release-${report.name}`, async () => {
             checkoutBranch(pkg.dir, STAGING_BRANCH);
             if (hasMeaningfulChanges(pkg.dir)) {
               run("git", ["add", "-A"], { cwd: pkg.dir });
@@ -2284,7 +2389,7 @@ async function workflowRelease(helpers, input) {
             const tagName = String(versionPlan.versions.get(pkg.name));
             run("git", ["tag", "-a", tagName, "-m", `release: ${tagName}`], { cwd: pkg.dir });
             run("git", ["push", "origin", tagName], { cwd: pkg.dir });
-            const publish = waitForGitHubWorkflowCompletion(pkg.dir, {
+            const publish = await waitForGitHubWorkflowCompletion(pkg.dir, {
               workflow: "publish.yml",
               headSha: mergeResult.commitSha,
               branch: PRODUCTION_BRANCH

package/dist/workflow-support.d.ts

@@ -1,10 +1,12 @@
-export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedActVerificationTooling, ensureTreeseedSecretSessionForConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, listDeprecatedTreeseedLocalEnvFiles, inspectTreeseedKeyAgentStatus, lockTreeseedSecretSession, migrateTreeseedMachineKeyToWrapped, resolveTreeseedMachineEnvironmentValues, resolveTreeseedLaunchEnvironment, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, rotateTreeseedMachineKeyPassphrase, setTreeseedRemoteSession, TREESEED_MACHINE_KEY_PASSPHRASE_ENV, TreeseedKeyAgentError, updateTreeseedDeployConfigFeatureToggles, unlockTreeseedSecretSessionFromEnv, unlockTreeseedSecretSessionInteractive, unlockTreeseedSecretSessionWithPassphrase, withTreeseedKeyAgentAutopromptDisabled, warnDeprecatedTreeseedLocalEnvFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.ts';
+export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedActVerificationTooling, ensureTreeseedSecretSessionForConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, inspectTreeseedKeyAgentTransportDiagnostic, inspectTreeseedPassphraseEnvDiagnostic, listDeprecatedTreeseedLocalEnvFiles, inspectTreeseedKeyAgentStatus, lockTreeseedSecretSession, migrateTreeseedMachineKeyToWrapped, resolveTreeseedMachineEnvironmentValues, resolveTreeseedLaunchEnvironment, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, rotateTreeseedMachineKeyPassphrase, setTreeseedRemoteSession, TREESEED_MACHINE_KEY_PASSPHRASE_ENV, TreeseedKeyAgentError, updateTreeseedDeployConfigFeatureToggles, unlockTreeseedSecretSessionFromEnv, unlockTreeseedSecretSessionInteractive, unlockTreeseedSecretSessionWithPassphrase, withTreeseedKeyAgentAutopromptDisabled, warnDeprecatedTreeseedLocalEnvFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.ts';
 export { exportTreeseedCodebase } from './operations/services/export-runtime.ts';
 export { assertDeploymentInitialized, cleanupDestroyedState, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, destroyCloudflareResources, ensureGeneratedWranglerConfig, finalizeDeploymentState, loadDeployState, printDeploySummary, printDestroySummary, provisionCloudflareResources, runRemoteD1Migrations, syncCloudflareSecrets, validateDeployPrerequisites, validateDestroyPrerequisites, } from './operations/services/deploy.ts';
 export { assertCleanWorktree, assertFeatureBranch, branchExists, checkoutBranch, createDeprecatedTaskTag, createFeatureBranchFromStaging, currentManagedBranch, deleteLocalBranch, deleteRemoteBranch, ensureLocalBranchTracking, gitWorkflowRoot, listTaskBranches, mergeCurrentBranchIntoStaging, mergeStagingIntoMain, prepareReleaseBranches, PRODUCTION_BRANCH, pushBranch, remoteBranchExists, STAGING_BRANCH, syncBranchWithOrigin, waitForStagingAutomation, } from './operations/services/git-workflow.ts';
 export { loadCliDeployConfig, packageScriptPath, resolveWranglerBin, } from './operations/services/runtime-tools.ts';
 export { configuredRailwayServices, deployRailwayService, validateRailwayDeployPrerequisites, } from './operations/services/railway-deploy.ts';
+export { ensureRailwayEnvironment, ensureRailwayProject, ensureRailwayService, getRailwayAuthProfile, listRailwayEnvironments, listRailwayProjects, listRailwayServices, listRailwayVariables, railwayGraphqlRequest, resolveRailwayApiToken, resolveRailwayApiUrl, resolveRailwayWorkspace, resolveRailwayWorkspaceContext, upsertRailwayVariables, } from './operations/services/railway-api.ts';
 export { runTenantDeployPreflight, runWorkspaceSavePreflight, } from './operations/services/save-deploy-preflight.ts';
 export { collectCliPreflight } from './operations/services/workspace-preflight.ts';
 export { applyWorkspaceVersionChanges, collectMergeConflictReport, currentBranch, formatMergeConflictReport, gitStatusPorcelain, hasMeaningfulChanges, incrementVersion, originRemoteUrl, planWorkspaceReleaseBump, repoRoot, } from './operations/services/workspace-save.ts';
 export { findNearestTreeseedRoot, findNearestTreeseedWorkspaceRoot, isWorkspaceRoot, run, workspaceRoot, } from './operations/services/workspace-tools.ts';
+export { collectTreeseedReconcileStatus, createTreeseedReconcileRegistry, deriveTreeseedDesiredUnits, destroyTreeseedTargetUnits, observeTreeseedUnits, planTreeseedReconciliation, reconcileTreeseedTarget, } from './reconcile/index.ts';

package/dist/workflow-support.js

@@ -15,6 +15,8 @@ import {
   loadTreeseedMachineConfig,
   listRelevantTreeseedConfigEntries,
   finalizeTreeseedConfig,
+  inspectTreeseedKeyAgentTransportDiagnostic,
+  inspectTreeseedPassphraseEnvDiagnostic,
   listDeprecatedTreeseedLocalEnvFiles,
   inspectTreeseedKeyAgentStatus,
   lockTreeseedSecretSession,
@@ -88,6 +90,22 @@ import {
   deployRailwayService,
   validateRailwayDeployPrerequisites
 } from "./operations/services/railway-deploy.js";
+import {
+  ensureRailwayEnvironment,
+  ensureRailwayProject,
+  ensureRailwayService,
+  getRailwayAuthProfile,
+  listRailwayEnvironments,
+  listRailwayProjects,
+  listRailwayServices,
+  listRailwayVariables,
+  railwayGraphqlRequest,
+  resolveRailwayApiToken,
+  resolveRailwayApiUrl,
+  resolveRailwayWorkspace,
+  resolveRailwayWorkspaceContext,
+  upsertRailwayVariables
+} from "./operations/services/railway-api.js";
 import {
   runTenantDeployPreflight,
   runWorkspaceSavePreflight
@@ -112,6 +130,15 @@ import {
   run,
   workspaceRoot
 } from "./operations/services/workspace-tools.js";
+import {
+  collectTreeseedReconcileStatus,
+  createTreeseedReconcileRegistry,
+  deriveTreeseedDesiredUnits,
+  destroyTreeseedTargetUnits,
+  observeTreeseedUnits,
+  planTreeseedReconciliation,
+  reconcileTreeseedTarget
+} from "./reconcile/index.js";
 export {
   PRODUCTION_BRANCH,
   STAGING_BRANCH,
@@ -134,21 +161,28 @@ export {
   collectMergeConflictReport,
   collectTreeseedConfigContext,
   collectTreeseedPrintEnvReport,
+  collectTreeseedReconcileStatus,
   configuredRailwayServices,
   createBranchPreviewDeployTarget,
   createDefaultTreeseedMachineConfig,
   createDeprecatedTaskTag,
   createFeatureBranchFromStaging,
   createPersistentDeployTarget,
+  createTreeseedReconcileRegistry,
   currentBranch,
   currentManagedBranch,
   deleteLocalBranch,
   deleteRemoteBranch,
   deployRailwayService,
   deployTargetLabel,
+  deriveTreeseedDesiredUnits,
   destroyCloudflareResources,
+  destroyTreeseedTargetUnits,
   ensureGeneratedWranglerConfig,
   ensureLocalBranchTracking,
+  ensureRailwayEnvironment,
+  ensureRailwayProject,
+  ensureRailwayService,
   ensureTreeseedActVerificationTooling,
   ensureTreeseedGitignoreEntries,
   ensureTreeseedSecretSessionForConfig,
@@ -158,14 +192,21 @@ export {
   findNearestTreeseedRoot,
   findNearestTreeseedWorkspaceRoot,
   formatMergeConflictReport,
+  getRailwayAuthProfile,
   getTreeseedMachineConfigPaths,
   gitStatusPorcelain,
   gitWorkflowRoot,
   hasMeaningfulChanges,
   incrementVersion,
   inspectTreeseedKeyAgentStatus,
+  inspectTreeseedKeyAgentTransportDiagnostic,
+  inspectTreeseedPassphraseEnvDiagnostic,
   isWorkspaceRoot,
   listDeprecatedTreeseedLocalEnvFiles,
+  listRailwayEnvironments,
+  listRailwayProjects,
+  listRailwayServices,
+  listRailwayVariables,
   listRelevantTreeseedConfigEntries,
   listTaskBranches,
   loadCliDeployConfig,
@@ -175,16 +216,24 @@ export {
   mergeCurrentBranchIntoStaging,
   mergeStagingIntoMain,
   migrateTreeseedMachineKeyToWrapped,
+  observeTreeseedUnits,
   originRemoteUrl,
   packageScriptPath,
+  planTreeseedReconciliation,
   planWorkspaceReleaseBump,
   prepareReleaseBranches,
   printDeploySummary,
   printDestroySummary,
   provisionCloudflareResources,
   pushBranch,
+  railwayGraphqlRequest,
+  reconcileTreeseedTarget,
   remoteBranchExists,
   repoRoot,
+  resolveRailwayApiToken,
+  resolveRailwayApiUrl,
+  resolveRailwayWorkspace,
+  resolveRailwayWorkspaceContext,
   resolveTreeseedLaunchEnvironment,
   resolveTreeseedMachineEnvironmentValues,
   resolveTreeseedRemoteConfig,
@@ -203,6 +252,7 @@ export {
   unlockTreeseedSecretSessionInteractive,
   unlockTreeseedSecretSessionWithPassphrase,
   updateTreeseedDeployConfigFeatureToggles,
+  upsertRailwayVariables,
   validateDeployPrerequisites,
   validateDestroyPrerequisites,
   validateRailwayDeployPrerequisites,

package/dist/workflow.d.ts

@@ -131,6 +131,8 @@ export type TreeseedConfigInput = {
     environment?: TreeseedConfigScope[] | TreeseedConfigScope;
     syncProviders?: 'none' | 'github' | 'cloudflare' | 'railway' | 'all';
     sync?: 'none' | 'github' | 'cloudflare' | 'railway' | 'all';
+    bootstrap?: boolean;
+    preflight?: boolean;
     updates?: Array<{
         scope: Exclude<TreeseedConfigScope, 'all'>;
         entryId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.5.3",
+  "version": "0.6.0",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -54,8 +54,10 @@
     "esbuild": "^0.28.0",
     "github-slugger": "^2.0.0",
     "ink": "^7.0.0",
+    "libsodium-wrappers": "^0.7.15",
     "mdast-util-to-string": "^4.0.0",
     "minisearch": "^7.2.0",
+    "octokit": "^5.0.3",
     "react": "^19.2.5",
     "remark-mdx": "^3.1.1",
     "remark-parse": "^11.0.0",
@@ -98,6 +100,10 @@
       "types": "./dist/workflow-support.d.ts",
       "default": "./dist/workflow-support.js"
     },
+    "./reconcile": {
+      "types": "./dist/reconcile/index.d.ts",
+      "default": "./dist/reconcile/index.js"
+    },
     "./platform/contracts": {
       "types": "./dist/platform/contracts.d.ts",
       "default": "./dist/platform/contracts.js"