@treeseed/sdk 0.8.12 → 0.8.14

package/dist/seeds/schema.js

@@ -0,0 +1,544 @@
+import { errorDiagnostic, warningDiagnostic } from "./errors.js";
+import {
+  SEED_ENVIRONMENTS
+} from "./types.js";
+const RESOURCE_BUCKETS = [
+  "teams",
+  "repositoryHosts",
+  "projects",
+  "hubRepositories",
+  "products",
+  "catalogArtifacts",
+  "capacityProviders",
+  "capacityGrants",
+  "workPolicies",
+  "agentPools"
+];
+const SUPPORTED_BUCKETS = /* @__PURE__ */ new Set(["teams", "repositoryHosts", "projects", "hubRepositories", "products", "catalogArtifacts", "capacityProviders", "capacityGrants", "workPolicies"]);
+const ALLOWED_ENVIRONMENTS = new Set(SEED_ENVIRONMENTS);
+const CREDENTIAL_REF_PATTERN = /^(?:env|secret|provider-session):[A-Za-z0-9_./:-]+$/u;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asString(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function parseEnvironments(value, path, diagnostics) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_environments", "Expected an array of environments.", path));
+    return void 0;
+  }
+  const result = [];
+  for (let index = 0; index < value.length; index += 1) {
+    const environment = asString(value[index]);
+    if (!ALLOWED_ENVIRONMENTS.has(environment)) {
+      diagnostics.push(errorDiagnostic("seed.unknown_environment", `Unknown environment: ${environment || String(value[index])}.`, `${path}[${index}]`));
+      continue;
+    }
+    if (!result.includes(environment)) {
+      result.push(environment);
+    }
+  }
+  return result;
+}
+function requireString(record, field, path, diagnostics) {
+  const value = asString(record[field]);
+  if (!value) {
+    diagnostics.push(errorDiagnostic("seed.missing_field", `Missing required field: ${field}.`, `${path}.${field}`));
+  }
+  return value;
+}
+function numberField(record, field, path, diagnostics) {
+  const value = record[field];
+  if (value === void 0) return void 0;
+  if (typeof value !== "number" || !Number.isFinite(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_number", `Expected ${field} to be a finite number.`, `${path}.${field}`));
+    return void 0;
+  }
+  return value;
+}
+function objectField(record, field, path, diagnostics) {
+  const value = record[field];
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_object", `Expected ${field} to be an object.`, `${path}.${field}`));
+    return void 0;
+  }
+  return value;
+}
+function stringArrayField(record, field, path, diagnostics) {
+  const value = record[field];
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_array", `Expected ${field} to be an array.`, `${path}.${field}`));
+    return void 0;
+  }
+  return value.map((entry) => asString(entry)).filter(Boolean);
+}
+function keyBase(record, path, diagnostics) {
+  const key = requireString(record, "key", path, diagnostics);
+  const environments = parseEnvironments(record.environments, `${path}.environments`, diagnostics);
+  return { key, ...environments ? { environments } : {} };
+}
+function parseTeam(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected team resource to be an object.", path));
+    return null;
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    slug: requireString(value, "slug", path, diagnostics),
+    name: asString(value.name) || void 0,
+    displayName: asString(value.displayName) || void 0,
+    logoUrl: asString(value.logoUrl) || void 0,
+    profileSummary: asString(value.profileSummary) || void 0,
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function parseRepository(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_repository", "Expected repository to be an object.", path));
+    return { role: "", provider: "", owner: "", name: "", gitUrl: "" };
+  }
+  const repository = {
+    role: requireString(value, "role", path, diagnostics),
+    provider: requireString(value, "provider", path, diagnostics),
+    owner: requireString(value, "owner", path, diagnostics),
+    name: requireString(value, "name", path, diagnostics),
+    gitUrl: requireString(value, "gitUrl", path, diagnostics),
+    defaultBranch: asString(value.defaultBranch) || void 0,
+    checkoutPath: asString(value.checkoutPath) || void 0,
+    submodulePath: asString(value.submodulePath) || void 0,
+    webUrl: asString(value.webUrl) || void 0
+  };
+  validateRepository(repository, path, diagnostics);
+  return repository;
+}
+function parseProject(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected project resource to be an object.", path));
+    return null;
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    team: requireString(value, "team", path, diagnostics),
+    slug: requireString(value, "slug", path, diagnostics),
+    name: requireString(value, "name", path, diagnostics),
+    description: asString(value.description) || void 0,
+    kind: asString(value.kind) || void 0,
+    repository: parseRepository(value.repository, `${path}.repository`, diagnostics),
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function parseRepositoryHost(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected repository host resource to be an object.", path));
+    return null;
+  }
+  const credentialRef = asString(value.credentialRef) || void 0;
+  if (credentialRef && !CREDENTIAL_REF_PATTERN.test(credentialRef)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_credential_ref", "Repository host credentialRef must be env:, secret:, or provider-session:.", `${path}.credentialRef`));
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    team: requireString(value, "team", path, diagnostics),
+    provider: requireString(value, "provider", path, diagnostics),
+    name: requireString(value, "name", path, diagnostics),
+    ownership: asString(value.ownership) || void 0,
+    accountLabel: asString(value.accountLabel) || void 0,
+    organizationOrOwner: requireString(value, "organizationOrOwner", path, diagnostics),
+    defaultVisibility: asString(value.defaultVisibility) || void 0,
+    softwareRepositoryNameTemplate: asString(value.softwareRepositoryNameTemplate) || void 0,
+    contentRepositoryNameTemplate: asString(value.contentRepositoryNameTemplate) || void 0,
+    branchPolicy: objectField(value, "branchPolicy", path, diagnostics),
+    workflowPolicy: objectField(value, "workflowPolicy", path, diagnostics),
+    allowedProjectKinds: stringArrayField(value, "allowedProjectKinds", path, diagnostics),
+    status: asString(value.status) || void 0,
+    credentialRef,
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function parseHubRepository(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected hub repository resource to be an object.", path));
+    return null;
+  }
+  const repository = {
+    ...keyBase(value, path, diagnostics),
+    project: requireString(value, "project", path, diagnostics),
+    role: requireString(value, "role", path, diagnostics),
+    repositoryHost: asString(value.repositoryHost) || void 0,
+    provider: requireString(value, "provider", path, diagnostics),
+    owner: requireString(value, "owner", path, diagnostics),
+    name: requireString(value, "name", path, diagnostics),
+    gitUrl: requireString(value, "gitUrl", path, diagnostics),
+    defaultBranch: asString(value.defaultBranch) || void 0,
+    currentBranch: asString(value.currentBranch) || void 0,
+    submodulePath: asString(value.submodulePath) || void 0,
+    status: asString(value.status) || void 0,
+    accessPolicy: objectField(value, "accessPolicy", path, diagnostics),
+    releasePolicy: objectField(value, "releasePolicy", path, diagnostics),
+    publishPolicy: objectField(value, "publishPolicy", path, diagnostics),
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+  validateRepository({
+    role: repository.role,
+    provider: repository.provider,
+    owner: repository.owner,
+    name: repository.name,
+    gitUrl: repository.gitUrl,
+    defaultBranch: repository.defaultBranch,
+    submodulePath: repository.submodulePath
+  }, path, diagnostics);
+  return repository;
+}
+function parseProduct(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected product resource to be an object.", path));
+    return null;
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    team: requireString(value, "team", path, diagnostics),
+    kind: requireString(value, "kind", path, diagnostics),
+    slug: requireString(value, "slug", path, diagnostics),
+    title: requireString(value, "title", path, diagnostics),
+    summary: asString(value.summary) || void 0,
+    visibility: asString(value.visibility) || void 0,
+    listingEnabled: typeof value.listingEnabled === "boolean" ? value.listingEnabled : void 0,
+    offerMode: asString(value.offerMode) || void 0,
+    manifestKey: asString(value.manifestKey) || void 0,
+    artifactKey: asString(value.artifactKey) || void 0,
+    searchText: asString(value.searchText) || void 0,
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function parseCatalogArtifact(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected catalog artifact resource to be an object.", path));
+    return null;
+  }
+  if (value.content !== void 0 || value.bytes !== void 0 || value.data !== void 0) {
+    diagnostics.push(errorDiagnostic("seed.inline_artifact_content", "Catalog artifact resources must reference content keys, not inline bytes/content.", path));
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    product: requireString(value, "product", path, diagnostics),
+    version: requireString(value, "version", path, diagnostics),
+    kind: requireString(value, "kind", path, diagnostics),
+    contentKey: requireString(value, "contentKey", path, diagnostics),
+    manifestKey: asString(value.manifestKey) || void 0,
+    publishedAt: asString(value.publishedAt) || void 0,
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function parseLane(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected lane resource to be an object.", path));
+    return null;
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    name: requireString(value, "name", path, diagnostics),
+    businessModel: asString(value.businessModel) || void 0,
+    modelFamily: asString(value.modelFamily) || void 0,
+    modelClass: asString(value.modelClass) || void 0,
+    regionPolicy: asString(value.regionPolicy) || void 0,
+    unit: asString(value.unit) || void 0,
+    scarcityLevel: asString(value.scarcityLevel) || void 0,
+    hardLimits: objectField(value, "hardLimits", path, diagnostics),
+    routingPolicy: objectField(value, "routingPolicy", path, diagnostics),
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function parseProviderRegistration(value, path, diagnostics) {
+  if (value === void 0) return void 0;
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_object", "Expected registration to be an object.", path));
+    return void 0;
+  }
+  const apiKeyValue = value.apiKey;
+  if (apiKeyValue === void 0) return {};
+  if (!isRecord(apiKeyValue)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_object", "Expected registration.apiKey to be an object.", `${path}.apiKey`));
+    return {};
+  }
+  if (apiKeyValue.createIfMissing !== void 0 && typeof apiKeyValue.createIfMissing !== "boolean") {
+    diagnostics.push(errorDiagnostic("seed.invalid_boolean", "Expected registration.apiKey.createIfMissing to be a boolean.", `${path}.apiKey.createIfMissing`));
+  }
+  return {
+    apiKey: {
+      createIfMissing: typeof apiKeyValue.createIfMissing === "boolean" ? apiKeyValue.createIfMissing : void 0,
+      name: asString(apiKeyValue.name) || void 0,
+      scopes: stringArrayField(apiKeyValue, "scopes", `${path}.apiKey`, diagnostics),
+      expiresAt: asString(apiKeyValue.expiresAt) || void 0
+    }
+  };
+}
+function parseProvider(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected capacity provider resource to be an object.", path));
+    return null;
+  }
+  const lanesValue = value.lanes;
+  const lanes = lanesValue === void 0 ? [] : Array.isArray(lanesValue) ? lanesValue.map((lane, index) => parseLane(lane, `${path}.lanes[${index}]`, diagnostics)).filter((lane) => Boolean(lane)) : (diagnostics.push(errorDiagnostic("seed.invalid_lanes", "Expected lanes to be an array.", `${path}.lanes`)), []);
+  return {
+    ...keyBase(value, path, diagnostics),
+    team: requireString(value, "team", path, diagnostics),
+    name: requireString(value, "name", path, diagnostics),
+    kind: asString(value.kind) || void 0,
+    provider: requireString(value, "provider", path, diagnostics),
+    billingScope: asString(value.billingScope) || void 0,
+    monthlyCreditBudget: numberField(value, "monthlyCreditBudget", path, diagnostics),
+    dailyCreditBudget: numberField(value, "dailyCreditBudget", path, diagnostics),
+    maxConcurrentWorkdays: numberField(value, "maxConcurrentWorkdays", path, diagnostics),
+    maxConcurrentWorkers: numberField(value, "maxConcurrentWorkers", path, diagnostics),
+    capacityModel: objectField(value, "capacityModel", path, diagnostics),
+    registration: parseProviderRegistration(value.registration, `${path}.registration`, diagnostics),
+    metadata: objectField(value, "metadata", path, diagnostics),
+    lanes
+  };
+}
+function parseGrant(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected capacity grant resource to be an object.", path));
+    return null;
+  }
+  const environment = asString(value.environment);
+  if (environment && !ALLOWED_ENVIRONMENTS.has(environment)) {
+    diagnostics.push(errorDiagnostic("seed.unknown_environment", `Unknown grant environment: ${environment}.`, `${path}.environment`));
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    provider: requireString(value, "provider", path, diagnostics),
+    lane: asString(value.lane) || void 0,
+    team: requireString(value, "team", path, diagnostics),
+    project: asString(value.project) || void 0,
+    environment: environment && ALLOWED_ENVIRONMENTS.has(environment) ? environment : void 0,
+    grantScope: asString(value.grantScope) || void 0,
+    dailyCreditLimit: numberField(value, "dailyCreditLimit", path, diagnostics),
+    weeklyCreditLimit: numberField(value, "weeklyCreditLimit", path, diagnostics),
+    monthlyCreditLimit: numberField(value, "monthlyCreditLimit", path, diagnostics),
+    dailyUsdLimit: numberField(value, "dailyUsdLimit", path, diagnostics),
+    weeklyQuotaMinutes: numberField(value, "weeklyQuotaMinutes", path, diagnostics),
+    monthlyProviderUnits: numberField(value, "monthlyProviderUnits", path, diagnostics),
+    priorityWeight: numberField(value, "priorityWeight", path, diagnostics),
+    overflowPolicy: asString(value.overflowPolicy) || void 0,
+    state: asString(value.state) || void 0,
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function parseWorkPolicy(value, path, diagnostics) {
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource", "Expected work policy resource to be an object.", path));
+    return null;
+  }
+  const environment = requireString(value, "environment", path, diagnostics);
+  if (environment && !ALLOWED_ENVIRONMENTS.has(environment)) {
+    diagnostics.push(errorDiagnostic("seed.unknown_environment", `Unknown work policy environment: ${environment}.`, `${path}.environment`));
+  }
+  return {
+    ...keyBase(value, path, diagnostics),
+    project: requireString(value, "project", path, diagnostics),
+    environment: ALLOWED_ENVIRONMENTS.has(environment) ? environment : "local",
+    enabled: typeof value.enabled === "boolean" ? value.enabled : void 0,
+    startCron: asString(value.startCron) || void 0,
+    durationMinutes: numberField(value, "durationMinutes", path, diagnostics),
+    maxRunners: numberField(value, "maxRunners", path, diagnostics),
+    maxWorkersPerRunner: numberField(value, "maxWorkersPerRunner", path, diagnostics),
+    dailyCreditBudget: numberField(value, "dailyCreditBudget", path, diagnostics),
+    maxQueuedTasks: numberField(value, "maxQueuedTasks", path, diagnostics),
+    maxQueuedCredits: numberField(value, "maxQueuedCredits", path, diagnostics),
+    autoscale: objectField(value, "autoscale", path, diagnostics),
+    creditWeights: Array.isArray(value.creditWeights) ? value.creditWeights : void 0,
+    metadata: objectField(value, "metadata", path, diagnostics)
+  };
+}
+function validateRepository(repository, path, diagnostics) {
+  if (!repository.gitUrl) return;
+  if (/^(?:\.{1,2}\/?|packages\/|\/)/u.test(repository.gitUrl) || !/(?:^[a-z][a-z0-9+.-]*:\/\/|^git@)/iu.test(repository.gitUrl)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_git_url", "Project repository gitUrl must be a remote Git URL, not a local path.", `${path}.gitUrl`));
+    return;
+  }
+  if (repository.provider !== "github") return;
+  const parsed = parseGitHubRepository(repository.gitUrl);
+  if (!parsed) {
+    diagnostics.push(errorDiagnostic("seed.invalid_git_url", "GitHub repository gitUrl must identify an owner and repository.", `${path}.gitUrl`));
+    return;
+  }
+  if (parsed.owner !== repository.owner || parsed.name !== repository.name) {
+    diagnostics.push(errorDiagnostic(
+      "seed.repository_metadata_mismatch",
+      `gitUrl points to ${parsed.owner}/${parsed.name}, but owner/name are ${repository.owner}/${repository.name}.`,
+      path
+    ));
+  }
+}
+function parseGitHubRepository(gitUrl) {
+  const ssh = /^git@github\.com:([^/]+)\/(.+?)(?:\.git)?$/u.exec(gitUrl);
+  if (ssh) return { owner: ssh[1], name: ssh[2] };
+  try {
+    const url = new URL(gitUrl);
+    if (url.hostname !== "github.com") return null;
+    const [owner, rawName] = url.pathname.replace(/^\/+/u, "").split("/");
+    if (!owner || !rawName) return null;
+    return { owner, name: rawName.replace(/\.git$/u, "") };
+  } catch {
+    return null;
+  }
+}
+function walkForSecrets(value, path, diagnostics) {
+  if (typeof value === "string") {
+    if (/(?:ghp_|github_pat_|sk-[A-Za-z0-9]|xox[baprs]-|-----BEGIN [A-Z ]*PRIVATE KEY-----)/u.test(value)) {
+      diagnostics.push(errorDiagnostic("seed.secret_value", "Manifest appears to contain a raw secret value.", path));
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => walkForSecrets(entry, `${path}[${index}]`, diagnostics));
+    return;
+  }
+  if (!isRecord(value)) return;
+  for (const [key, entry] of Object.entries(value)) {
+    const nextPath = path ? `${path}.${key}` : key;
+    if (typeof entry === "string" && /(?:api[_-]?key|token|private[_-]?key|password|secret|credential)/iu.test(key)) {
+      if (!CREDENTIAL_REF_PATTERN.test(entry)) {
+        diagnostics.push(errorDiagnostic("seed.secret_field", `Field ${key} must use a credential reference, not an inline value.`, nextPath));
+      }
+    }
+    walkForSecrets(entry, nextPath, diagnostics);
+  }
+}
+function arrayBucket(resources, bucket, diagnostics) {
+  const value = resources[bucket];
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resource_bucket", `resources.${bucket} must be an array.`, `resources.${bucket}`));
+    return [];
+  }
+  if (!SUPPORTED_BUCKETS.has(bucket) && value.length > 0) {
+    diagnostics.push(errorDiagnostic("seed.unsupported_resource_kind", `resources.${bucket} is recognized but is not backed by seed reconciliation yet.`, `resources.${bucket}`));
+  }
+  return value;
+}
+function validateResourceKeys(manifest, diagnostics) {
+  const seen = /* @__PURE__ */ new Map();
+  const visit = (key, path) => {
+    if (!key) return;
+    const existingPath = seen.get(key);
+    if (existingPath) {
+      diagnostics.push(errorDiagnostic("seed.duplicate_key", `Duplicate resource key ${key}; first seen at ${existingPath}.`, path));
+      return;
+    }
+    seen.set(key, path);
+  };
+  manifest.resources.teams.forEach((team, index) => visit(team.key, `resources.teams[${index}].key`));
+  manifest.resources.repositoryHosts.forEach((host, index) => visit(host.key, `resources.repositoryHosts[${index}].key`));
+  manifest.resources.projects.forEach((project, index) => visit(project.key, `resources.projects[${index}].key`));
+  manifest.resources.hubRepositories.forEach((repository, index) => visit(repository.key, `resources.hubRepositories[${index}].key`));
+  manifest.resources.products.forEach((product, index) => visit(product.key, `resources.products[${index}].key`));
+  manifest.resources.catalogArtifacts.forEach((artifact, index) => visit(artifact.key, `resources.catalogArtifacts[${index}].key`));
+  manifest.resources.capacityProviders.forEach((provider, providerIndex) => {
+    visit(provider.key, `resources.capacityProviders[${providerIndex}].key`);
+    (provider.lanes ?? []).forEach((lane, laneIndex) => visit(lane.key, `resources.capacityProviders[${providerIndex}].lanes[${laneIndex}].key`));
+  });
+  manifest.resources.capacityGrants.forEach((grant, index) => visit(grant.key, `resources.capacityGrants[${index}].key`));
+  manifest.resources.workPolicies.forEach((policy, index) => visit(policy.key, `resources.workPolicies[${index}].key`));
+}
+function validateReferences(manifest, diagnostics) {
+  const teamKeys = new Set(manifest.resources.teams.map((team) => team.key));
+  const projectKeys = new Set(manifest.resources.projects.map((project) => project.key));
+  const repositoryHostKeys = new Set(manifest.resources.repositoryHosts.map((host) => host.key));
+  const productKeys = new Set(manifest.resources.products.map((product) => product.key));
+  const providerKeys = new Set(manifest.resources.capacityProviders.map((provider) => provider.key));
+  const laneKeys = new Set(manifest.resources.capacityProviders.flatMap((provider) => (provider.lanes ?? []).map((lane) => lane.key)));
+  manifest.resources.repositoryHosts.forEach((host, index) => {
+    if (!teamKeys.has(host.team)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown team reference: ${host.team}.`, `resources.repositoryHosts[${index}].team`));
+  });
+  manifest.resources.projects.forEach((project, index) => {
+    if (!teamKeys.has(project.team)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown team reference: ${project.team}.`, `resources.projects[${index}].team`));
+  });
+  manifest.resources.hubRepositories.forEach((repository, index) => {
+    if (!projectKeys.has(repository.project)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown project reference: ${repository.project}.`, `resources.hubRepositories[${index}].project`));
+    if (repository.repositoryHost && !repositoryHostKeys.has(repository.repositoryHost)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown repository host reference: ${repository.repositoryHost}.`, `resources.hubRepositories[${index}].repositoryHost`));
+  });
+  manifest.resources.products.forEach((product, index) => {
+    if (!teamKeys.has(product.team)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown team reference: ${product.team}.`, `resources.products[${index}].team`));
+  });
+  manifest.resources.catalogArtifacts.forEach((artifact, index) => {
+    if (!productKeys.has(artifact.product)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown product reference: ${artifact.product}.`, `resources.catalogArtifacts[${index}].product`));
+  });
+  manifest.resources.capacityProviders.forEach((provider, index) => {
+    if (!teamKeys.has(provider.team)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown team reference: ${provider.team}.`, `resources.capacityProviders[${index}].team`));
+  });
+  manifest.resources.capacityGrants.forEach((grant, index) => {
+    if (!teamKeys.has(grant.team)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown team reference: ${grant.team}.`, `resources.capacityGrants[${index}].team`));
+    if (!providerKeys.has(grant.provider)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown capacity provider reference: ${grant.provider}.`, `resources.capacityGrants[${index}].provider`));
+    if (grant.lane && !laneKeys.has(grant.lane)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown capacity lane reference: ${grant.lane}.`, `resources.capacityGrants[${index}].lane`));
+    if (grant.project && !projectKeys.has(grant.project)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown project reference: ${grant.project}.`, `resources.capacityGrants[${index}].project`));
+  });
+  manifest.resources.workPolicies.forEach((policy, index) => {
+    if (!projectKeys.has(policy.project)) diagnostics.push(errorDiagnostic("seed.invalid_reference", `Unknown project reference: ${policy.project}.`, `resources.workPolicies[${index}].project`));
+  });
+}
+function parseSeedManifest(value, diagnostics) {
+  walkForSecrets(value, "", diagnostics);
+  if (!isRecord(value)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_manifest", "Seed manifest must be an object.", "manifest"));
+    return null;
+  }
+  const name = requireString(value, "name", "manifest", diagnostics);
+  if (value.version !== 1) {
+    diagnostics.push(errorDiagnostic("seed.unsupported_version", `Unsupported seed manifest version: ${String(value.version)}.`, "version"));
+  }
+  const environments = parseEnvironments(value.environments, "environments", diagnostics) ?? [];
+  if (environments.length === 0) {
+    diagnostics.push(errorDiagnostic("seed.missing_environments", "Seed manifest must declare at least one environment.", "environments"));
+  }
+  const defaultEnvironments = parseEnvironments(value.defaultEnvironments, "defaultEnvironments", diagnostics);
+  for (const environment of defaultEnvironments ?? []) {
+    if (!environments.includes(environment)) {
+      diagnostics.push(errorDiagnostic("seed.default_environment_not_declared", `Default environment ${environment} is not declared in environments.`, "defaultEnvironments"));
+    }
+  }
+  const resourcesValue = value.resources;
+  if (!isRecord(resourcesValue)) {
+    diagnostics.push(errorDiagnostic("seed.invalid_resources", "Seed manifest resources must be an object.", "resources"));
+    return null;
+  }
+  for (const bucket of Object.keys(resourcesValue)) {
+    if (!RESOURCE_BUCKETS.includes(bucket)) {
+      diagnostics.push(errorDiagnostic("seed.unsupported_resource_kind", `Unsupported resource bucket: ${bucket}.`, `resources.${bucket}`));
+    }
+  }
+  const resources = {
+    teams: arrayBucket(resourcesValue, "teams", diagnostics).map((entry, index) => parseTeam(entry, `resources.teams[${index}]`, diagnostics)).filter((team) => Boolean(team)),
+    repositoryHosts: arrayBucket(resourcesValue, "repositoryHosts", diagnostics).map((entry, index) => parseRepositoryHost(entry, `resources.repositoryHosts[${index}]`, diagnostics)).filter((host) => Boolean(host)),
+    projects: arrayBucket(resourcesValue, "projects", diagnostics).map((entry, index) => parseProject(entry, `resources.projects[${index}]`, diagnostics)).filter((project) => Boolean(project)),
+    hubRepositories: arrayBucket(resourcesValue, "hubRepositories", diagnostics).map((entry, index) => parseHubRepository(entry, `resources.hubRepositories[${index}]`, diagnostics)).filter((repository) => Boolean(repository)),
+    products: arrayBucket(resourcesValue, "products", diagnostics).map((entry, index) => parseProduct(entry, `resources.products[${index}]`, diagnostics)).filter((product) => Boolean(product)),
+    catalogArtifacts: arrayBucket(resourcesValue, "catalogArtifacts", diagnostics).map((entry, index) => parseCatalogArtifact(entry, `resources.catalogArtifacts[${index}]`, diagnostics)).filter((artifact) => Boolean(artifact)),
+    capacityProviders: arrayBucket(resourcesValue, "capacityProviders", diagnostics).map((entry, index) => parseProvider(entry, `resources.capacityProviders[${index}]`, diagnostics)).filter((provider) => Boolean(provider)),
+    capacityGrants: arrayBucket(resourcesValue, "capacityGrants", diagnostics).map((entry, index) => parseGrant(entry, `resources.capacityGrants[${index}]`, diagnostics)).filter((grant) => Boolean(grant)),
+    workPolicies: arrayBucket(resourcesValue, "workPolicies", diagnostics).map((entry, index) => parseWorkPolicy(entry, `resources.workPolicies[${index}]`, diagnostics)).filter((policy) => Boolean(policy)),
+    agentPools: arrayBucket(resourcesValue, "agentPools", diagnostics)
+  };
+  const manifest = {
+    name,
+    version: 1,
+    description: asString(value.description) || void 0,
+    defaultEnvironments,
+    environments,
+    resources
+  };
+  validateResourceKeys(manifest, diagnostics);
+  validateReferences(manifest, diagnostics);
+  if (diagnostics.length === 0 && manifest.resources.projects.length === 0) {
+    diagnostics.push(warningDiagnostic("seed.empty_projects", "Seed manifest does not define projects.", "resources.projects"));
+  }
+  return manifest;
+}
+export {
+  parseSeedManifest
+};