@uipath/vertical-solutions-tool 1.204.0 → 1.205.0-preview.258

package/dist/seed-service-2d1f7zaz.js

@@ -0,0 +1,2014 @@
+import {
+  listDeploymentsOfSolution,
+  resolveInstalledFolder,
+  solutionNameFromManifest
+} from "./tool-tjhwq0ez.js";
+import {
+  BatchResponseSchema,
+  FailureRecordSchema,
+  WrittenRecordSchema,
+  buildEntityPlan,
+  fieldMap,
+  findFolderPath,
+  getManifest,
+  journalEntity,
+  listAllFolders,
+  listFolderDtos,
+  loadChoiceSetValues,
+  loadLiveEntities,
+  loadLiveRecords,
+  needsExpandedRecords,
+  orchestratorApi,
+  putOwn,
+  readAllPages,
+  readSeedContext,
+  readSeedFile,
+  readStrategy,
+  removeSeedContext,
+  withOptionalClears,
+  writeSeedContext
+} from "./tool-e4qgwf9h.js";
+import {
+  downloadSeedTemplates
+} from "./tool-maw0g02p.js";
+import {
+  isDotSegment,
+  isUnsafeSegment,
+  refreshSeedTemplates,
+  segmentNameProblem,
+  withoutControlBytes
+} from "./tool-yx29vb63.js";
+import"./tool-67587985.js";
+import {
+  acquireSeedWorkspaceLock,
+  entityNameProblem,
+  insideSeedRoot,
+  namesSeedRoot,
+  packageDir,
+  packageNameProblem,
+  readJournal,
+  resolveSeedDir,
+  writeJournal
+} from "./tool-s9qbxa2g.js";
+import {
+  readServiceUrl,
+  rejectBlankOptions
+} from "./tool-p589v2r5.js";
+import {
+  collapseRowProblems,
+  writeProgress,
+  writeWarning
+} from "./tool-v15vxc4x.js";
+import {
+  createVssConfig,
+  isLoopbackHost
+} from "./tool-xd2ejt3h.js";
+import {
+  toDeployFailure
+} from "./tool-r2epw08s.js";
+import"./tool-4z1dy1rn.js";
+import"./tool-87e2ps7f.js";
+import"./tool-38ad77wd.js";
+import {
+  routingFlags,
+  shellQuote
+} from "./tool-cag2z2d6.js";
+import {
+  failure,
+  invalidOption
+} from "./tool-h4f967yd.js";
+import"./tool-rr9fensp.js";
+import"./tool-s04z9t80.js";
+import"./tool-vf2mgth0.js";
+import {
+  RESULTS,
+  canPrompt,
+  catchError,
+  extractErrorDetails,
+  extractErrorMessage
+} from "./tool-pz9qm3dv.js";
+import {
+  getFileSystem
+} from "./tool-hdxtgckw.js";
+import {
+  __require
+} from "./tool-1yh8g550.js";
+
+// src/services/seed-run/context-checks.ts
+function contextForPackage(context, packageName) {
+  const wrote = context?.packageName.trim().toLowerCase();
+  if (!context || !wrote || wrote === packageName.trim().toLowerCase()) {
+    return context;
+  }
+  writeWarning(`This workspace's seed context was recorded for ${context.packageName}, not ` + `${packageName} — its version, folder, deployment name and service URL are ignored. ` + `Nothing then vouches for the files in it as ${packageName}'s, so the run stops ` + "unless --refresh replaces them; the scope is resolved for " + `${packageName} on its own.`);
+  return;
+}
+function checkContextTenant(context, config, options) {
+  if (!context || options.folderKey !== undefined || options.folderPath !== undefined) {
+    return;
+  }
+  const sameOrg = sameId(context.organizationId, config.organizationId);
+  const sameOrgName = sameName(context.organizationName, config.organizationName);
+  const sameTenant = sameId(context.tenantId, config.tenantId);
+  const sameTenantName = sameName(context.tenantName, config.tenantName);
+  if (sameOrg && sameOrgName && sameTenant && sameTenantName) {
+    if (!comparable(context.organizationId, config.organizationId) && !comparable(context.organizationName, config.organizationName) && !comparable(context.tenantId, config.tenantId) && !comparable(context.tenantName, config.tenantName)) {
+      writeWarning("This seed workspace's context records no organization or tenant to check " + `against the one you are logged in to (${config.organizationName ?? "?"} / ` + `${config.tenantName ?? "?"}), so nothing here can tell whether it was ` + "written for this tenant. Pass --folder-key <guid> or --folder-path <path> " + "if you mean to seed a workspace from somewhere else.");
+    }
+    return;
+  }
+  return failure("invalid-option", "This seed workspace was written by a deploy into a different organization or tenant " + `than the one you are logged in to (${config.organizationName ?? "?"} / ${config.tenantName ?? "?"}).`, "Log in to the tenant the deploy landed in (uip login, or uip login tenant set), or pass " + "--folder-key <guid> or --folder-path <path> to seed this tenant deliberately.", { result: RESULTS.ValidationError });
+}
+function sameId(recorded, live) {
+  return !recorded || !live || recorded === live;
+}
+function sameName(recorded, live) {
+  return !recorded || !live || recorded.trim().toLowerCase() === live.trim().toLowerCase();
+}
+function comparable(recorded, live) {
+  return Boolean(recorded) && Boolean(live);
+}
+
+// src/services/seed-run/folder-scope.ts
+async function resolveFolderKey(config, manifest, context, options, explicitFolder) {
+  if (explicitFolder !== undefined) {
+    return { ok: true, folderKey: explicitFolder };
+  }
+  if (manifest.dataFabric?.schemaFilename) {
+    return { ok: true, folderKey: undefined };
+  }
+  const deployed = context?.packageVersion === options.packageVersion ? context : undefined;
+  if (deployed?.folderKey) {
+    writeProgress("Scoping Data Fabric calls to the solution folder recorded at deploy time (from the seed context).");
+    return { ok: true, folderKey: deployed.folderKey };
+  }
+  return resolveInstalledFolderKey(config, manifest, deployed, options);
+}
+async function resolveInstalledFolderKey(config, manifest, context, options) {
+  const solutionName = solutionNameFromManifest(manifest);
+  if (!solutionName) {
+    return needsFolderKey("The seed context records no folder and the manifest names no solution to look one up by.");
+  }
+  const [error, deployments] = await catchError(listDeploymentsOfSolution(config, solutionName, options.signal, context?.deploymentName));
+  if (error || !deployments) {
+    return failure("service-error", `Could not list deployments to resolve the folder scope: ${error?.message ?? "unknown error"}.`, "Fix the lookup problem and re-run, or pass --folder-key <guid> to scope the run yourself.");
+  }
+  const resolved = resolveInstalledFolder({
+    deployments,
+    deploymentName: context?.deploymentName,
+    solutionName,
+    packageVersion: options.packageVersion
+  });
+  if (resolved.kind === "resolved") {
+    const path = await findFolderPath(config, resolved.folderKey, options.signal);
+    writeProgress(`Scoping Data Fabric calls to folder ${path ?? resolved.folderKey} ` + `(installed deployment "${resolved.deployment.name}").`);
+    return { ok: true, folderKey: resolved.folderKey };
+  }
+  if (resolved.kind === "ambiguous") {
+    const installs = resolved.candidates.map((candidate) => {
+      const target = candidate.folderPath ? `, deployed into ${candidate.folderPath}` : "";
+      return `${candidate.installedRootFolderKey} (v${candidate.packageVersion}${target})`;
+    }).sort((a, b) => a.localeCompare(b)).join(", ");
+    return needsFolderKey(`Solution "${solutionName}" is installed in several folders (${installs}).`);
+  }
+  return needsFolderKey(`No installed deployment was found for solution "${solutionName}".`);
+}
+function rejectFolderPathForTenantLevel(manifest, options, packageName) {
+  if (options.folderPath === undefined || !manifest.dataFabric?.schemaFilename) {
+    return;
+  }
+  return invalidSeedOption(`--folder-path cannot be used with ${packageName}: its ` + "Data Fabric entities are tenant-level (the manifest declares dataFabric.schemaFilename), " + "not inside a solution folder.", "Drop --folder-path to seed the tenant-level entities. To scope the run into a folder " + "on purpose, pass that folder's key with --folder-key <guid>.");
+}
+async function explicitFolderKey(config, options) {
+  if (options.folderPath !== undefined) {
+    return folderKeyForPath(config, options);
+  }
+  return { ok: true, folderKey: options.folderKey };
+}
+async function folderKeyForPath(config, options) {
+  const wanted = (options.folderPath ?? "").trim();
+  const [error, folders] = await catchError(listAllFolders(config, options.signal));
+  if (error || !folders) {
+    return failure("service-error", `Could not read the Orchestrator folders to resolve --folder-path ${wanted}: ` + `${error?.message ?? "unknown error"}`, "Pass the folder's key with --folder-key <guid> instead, or give this login the " + "right to read Orchestrator folders.", { errorCode: "server_error", retry: "RetryLater" });
+  }
+  const lower = wanted.toLowerCase();
+  const byPath = folders.filter((folder) => folder.path.toLowerCase() === lower);
+  const matches = byPath.length > 0 ? byPath : folders.filter((folder) => folder.displayName.toLowerCase() === lower);
+  const [match, ...others] = matches;
+  if (match === undefined) {
+    return invalidSeedOption(`--folder-path ${wanted} matches no Orchestrator folder in this tenant.`, "Pass the full path as Orchestrator shows it (for example " + "Shared/Lending/LoanSetup), or the folder's key with --folder-key <guid>.");
+  }
+  if (others.length > 0) {
+    return invalidSeedOption(`--folder-path ${wanted} matches ${matches.length} folders: ` + `${matches.map((folder) => folder.path).join(", ")}.`, "Pass the full path of the one you mean, or --folder-key <guid>.");
+  }
+  if (options.folderKey && match.key.toLowerCase() !== options.folderKey.toLowerCase()) {
+    return invalidSeedOption(`--folder-path ${wanted} (${match.key}) and --folder-key ` + `${options.folderKey} name different folders.`, "Drop one of the two, or correct it so both point at the same folder.");
+  }
+  writeProgress(`Scoping Data Fabric calls to folder ${match.path} (--folder-path).`);
+  return { ok: true, folderKey: match.key };
+}
+function invalidSeedOption(message, instructions) {
+  return failure("invalid-option", message, instructions);
+}
+function needsFolderKey(why) {
+  return failure("missing-option", `The folder to seed into could not be determined. ${why}`, "Pass --folder-key <guid> with the key of the folder the solution installed into (the " + "Solution folder under the deploy target in Orchestrator), or re-deploy the package — a " + "deploy records the folder in the seed context.", { result: RESULTS.ValidationError, errorCode: "invalid_argument" });
+}
+
+// src/services/seed-run/retry-command.ts
+function seedRetryCommand(options) {
+  const flag = (name, value) => value === undefined ? "" : ` ${name} ${shellQuote(value)}`;
+  return "uip vss deploy seed" + flag("--dir", options.dir) + flag("--package-name", options.packageName) + flag("--package-version", options.packageVersion) + flag("--folder-key", options.folderKey) + flag("--folder-path", options.folderPath) + routingFlags(options) + (options.yes === true ? " --yes" : "");
+}
+
+// src/services/seed-run/refresh.ts
+async function refreshAndScope(input) {
+  const { config, context, packageName, packageVersion, options } = input;
+  const tenantLevel = rejectFolderPathForTenantLevel(input.manifest, options, packageName);
+  if (tenantLevel)
+    return tenantLevel;
+  const explicit = await explicitFolderKey(config, {
+    ...options,
+    packageVersion
+  });
+  if (!explicit.ok)
+    return explicit;
+  const explicitFolder = explicit.folderKey;
+  const refreshed = await refreshIfAsked({ ...input, explicitFolder });
+  if (!refreshed.ok)
+    return refreshed;
+  const scope = await resolveFolderKey(config, input.manifest, context, { ...options, packageVersion }, explicitFolder);
+  const folderKey = scope.ok ? scope.folderKey : undefined;
+  if (!refreshed.refreshed && folderKey !== undefined) {
+    warnIfFilledForAnotherFolder(context?.folderKey, folderKey);
+  }
+  const scopedElsewhere = folderKey !== undefined && context?.folderKey?.toLowerCase() !== folderKey.toLowerCase();
+  const servedElsewhere = input.serviceUrl !== undefined && context?.serviceUrl !== input.serviceUrl;
+  const sameInstall = context?.packageVersion === packageVersion && !scopedElsewhere;
+  if (refreshed.refreshed && (!sameInstall || servedElsewhere)) {
+    await recordRefreshedContext(input.workspaceDir, options, {
+      packageName,
+      packageVersion,
+      serviceUrl: input.serviceUrl,
+      organizationId: config.organizationId,
+      organizationName: config.organizationName,
+      tenantId: config.tenantId,
+      tenantName: config.tenantName,
+      folderKey: sameInstall ? folderKey ?? context?.folderKey : folderKey,
+      ...sameInstall && context?.deploymentName !== undefined ? { deploymentName: context.deploymentName } : {}
+    }, Boolean(input.manifest.dataFabric?.schemaFilename));
+  }
+  return scope;
+}
+function warnIfFilledForAnotherFolder(recordedFolder, folderKey) {
+  if (recordedFolder === undefined) {
+    writeWarning("The seed workspace records no folder, so nothing says the files in it " + `were filled in for ${folderKey}. Those rows are about to be written ` + "there. Pass --refresh to replace them with this version's templates " + "first if they belong somewhere else.");
+  } else if (recordedFolder.toLowerCase() !== folderKey.toLowerCase()) {
+    writeWarning(`The seed workspace holds the files filled in for folder ${recordedFolder}, ` + `and this run is scoped to ${folderKey}. Those rows are about to be written ` + "there. Pass --refresh to replace them with this version's templates first, " + "or drop the folder option to seed the folder they belong to.");
+  }
+}
+async function refreshIfAsked(input) {
+  const { context, packageName, packageVersion, options } = input;
+  const recorded = context?.packageVersion;
+  const recordedOther = recorded !== undefined && recorded !== packageVersion;
+  const unknownVersion = recorded === undefined && !input.creating && options.templatesAreCurrent !== true;
+  const scopedElsewhere = context?.folderKey !== undefined && input.explicitFolder !== undefined && input.explicitFolder.toLowerCase() !== context.folderKey.toLowerCase();
+  if (options.refresh !== true && !input.creating) {
+    if (recordedOther) {
+      return oldTemplatesKept(packageName, packageVersion, context);
+    }
+    return unknownVersion ? unknownTemplatesKept(options, packageName, packageVersion, false) : { ok: true, refreshed: false };
+  }
+  const fallsBack = !input.creating && !recordedOther && !unknownVersion && !scopedElsewhere;
+  const refreshed = await refreshTemplates(input, fallsBack ? " Seeding the files already in the workspace." : "");
+  if (refreshed || fallsBack)
+    return { ok: true, refreshed };
+  if (input.creating)
+    return noWorkspaceCreated(packageName, packageVersion);
+  if (recordedOther) {
+    return oldTemplatesKept(packageName, packageVersion, context);
+  }
+  if (scopedElsewhere) {
+    return otherFolderTemplatesKept(packageName, packageVersion, context);
+  }
+  return unknownTemplatesKept(options, packageName, packageVersion, true);
+}
+function otherFolderTemplatesKept(packageName, packageVersion, context) {
+  return failure("service-error", `Could not refresh the seed templates of ${packageName} ${packageVersion}: the ` + `workspace still holds the files filled in for folder ${String(context?.folderKey)}, ` + "and this run is scoped to another one, so nothing was seeded.", "Fix the problem reported above and run the same command again. To seed the folder " + "the files were filled in for, drop the folder option instead.", { errorCode: "server_error", retry: "RetryLater" });
+}
+function unknownTemplatesKept(options, packageName, packageVersion, refreshAttempted) {
+  const message = `The seed workspace of ${packageName} records no version, so the files in ` + `it cannot be shown to be ${packageVersion}'s; nothing was seeded.`;
+  return failure("service-error", message, refreshAttempted ? RETRY_AFTER_FIXING : `Refresh them with: ${seedRetryCommand(options)} --refresh`, { errorCode: "server_error", retry: "RetryLater" });
+}
+var RETRY_AFTER_FIXING = "Fix the problem reported above and run the same command again.";
+function oldTemplatesKept(packageName, packageVersion, context) {
+  return failure("service-error", `Could not refresh the seed templates of ${packageName} to ${packageVersion}: ` + `the workspace still holds the ${String(context?.packageVersion)} templates, ` + "so nothing was seeded.", RETRY_AFTER_FIXING, { errorCode: "server_error", retry: "RetryLater" });
+}
+function noWorkspaceCreated(packageName, packageVersion) {
+  return failure("service-error", `Could not create the seed workspace for ${packageName} ${packageVersion}: ` + "the seed templates could not be downloaded or written.", RETRY_AFTER_FIXING, { errorCode: "server_error", retry: "RetryLater" });
+}
+async function recordRefreshedContext(workspaceDir, options, context, tenantLevel) {
+  const [error] = await catchError(writeSeedContext(context, workspaceDir));
+  if (!error) {
+    writeProgress(`Recorded ${context.packageName} ${context.packageVersion} in .seed-context.json.`);
+    return;
+  }
+  const [removeError] = await catchError(removeSeedContext(workspaceDir));
+  const stale = removeError ? ` The previous .seed-context.json could not be removed either (${removeError.message}), ` + "so do not run 'uip vss deploy seed' without arguments." : "";
+  const again = `uip vss deploy seed --package-name ${shellQuote(context.packageName)}` + ` --package-version ${shellQuote(context.packageVersion)}` + (isDefaultWorkspace(workspaceDir, context.packageName) ? "" : ` --dir ${shellQuote(workspaceDir)}`) + folderAdvice(context.folderKey, tenantLevel) + routingFlags(options) + (options.yes === true ? " --yes" : "") + " --refresh";
+  writeWarning(`Could not update .seed-context.json: ${error.message}.${stale} The workspace holds ` + `${context.packageName} ${context.packageVersion}'s templates, not yet filled in. ` + `Fix that, then run: ${again} — before you fill the CSVs in, since --refresh ` + "replaces them. A run without it refuses these files as an unknown version.");
+}
+function isDefaultWorkspace(workspaceDir, packageName) {
+  const fs = getFileSystem();
+  if (packageNameProblem(packageName))
+    return false;
+  return fs.path.resolve(workspaceDir) === fs.path.resolve(packageDir(packageName));
+}
+function folderAdvice(folderKey, tenantLevel) {
+  if (folderKey)
+    return ` --folder-key ${shellQuote(folderKey)}`;
+  return tenantLevel ? "" : " --folder-key <key>";
+}
+async function refreshTemplates(input, fallback) {
+  const [error, download] = await catchError(downloadSeedTemplates(input.config, input.packageName, input.packageVersion, input.options.signal));
+  if (error || !download) {
+    input.options.signal?.throwIfAborted();
+    writeWarning(`Could not refresh the seed templates: ${error?.message ?? "unknown error"}.${fallback}`);
+    return false;
+  }
+  const [extractError, result] = await catchError(refreshSeedTemplates({
+    dir: input.workspaceDir,
+    zip: download.zip,
+    lockHeld: input.lockHeld ?? false
+  }));
+  if (extractError || !result) {
+    writeWarning(`Could not extract the seed templates: ${extractError?.message ?? "unknown error"}.${fallback}`);
+    return false;
+  }
+  for (const warning of result.warnings)
+    writeWarning(warning);
+  writeProgress(`Refreshed ${result.written.length} seed ${result.written.length === 1 ? "file" : "files"} in ${result.dir}`);
+  return true;
+}
+
+// src/api/solution-resources.ts
+var SOLUTION_COLLECTIONS = [
+  "Processes",
+  "Assets",
+  "StorageBuckets",
+  "Connections"
+];
+async function readSolutionResources(config, folderKey, wanted, signal) {
+  const resources = {
+    processes: [],
+    assets: [],
+    buckets: [],
+    connections: [],
+    warnings: []
+  };
+  const [folderError, folder] = await catchError(readFolder(config, folderKey, signal));
+  if (folderError || !folder) {
+    const why = folderError ? await extractErrorMessage(folderError) : "no such folder";
+    resources.warnings.push(`Could not read the solution folder: ${why}`);
+    return resources;
+  }
+  const collect = async (what, into, read) => {
+    const [error, rows] = await catchError(read());
+    if (error) {
+      resources.warnings.push(`Could not read the solution's ${what}: ${await extractErrorMessage(error)}`);
+      return;
+    }
+    into.push(...rows);
+  };
+  if (wanted.has("Processes")) {
+    await collect("processes", resources.processes, () => readProcesses(config, folderKey, signal));
+  }
+  if (wanted.has("Assets")) {
+    await collect("assets", resources.assets, () => readAssets(config, folderKey, signal));
+  }
+  if (wanted.has("StorageBuckets")) {
+    await collect("storage buckets", resources.buckets, () => readBucketsWithChildren(config, folderKey, resources.warnings, signal));
+  }
+  if (wanted.has("Connections")) {
+    await collect("connections", resources.connections, () => readConnections(config, folderKey, signal));
+  }
+  return { ...resources, folder };
+}
+async function readFolder(config, folderKey, signal) {
+  const api = await orchestratorApi(config, (sdk) => sdk.FoldersApi);
+  const folder = await api.foldersGetByKeyByIdentifier({ identifier: folderKey }, { signal });
+  return {
+    id: folder.id,
+    key: folder.key ?? folderKey,
+    path: folder.fullyQualifiedName ?? undefined,
+    parentId: folder.parentId ?? undefined,
+    parentKey: folder.parentKey ?? undefined
+  };
+}
+async function readProcesses(config, folderKey, signal) {
+  const api = await orchestratorApi(config, (sdk) => sdk.ReleasesApi, folderKey);
+  const releases = await readAllPages("processes", (page) => api.releasesGet(page, { signal }));
+  return releases.map((release) => ({
+    id: release.id,
+    key: release.key,
+    name: release.name,
+    processKey: release.processKey,
+    processVersion: release.processVersion,
+    processType: release.processType
+  }));
+}
+async function readAssets(config, folderKey, signal) {
+  const api = await orchestratorApi(config, (sdk) => sdk.AssetsApi, folderKey);
+  const assets = await readAllPages("assets", (page) => api.assetsGetFiltered(page, { signal }));
+  return assets.map((asset) => ({
+    id: asset.id,
+    name: asset.name,
+    value: asset.value ?? undefined,
+    valueType: asset.valueType
+  }));
+}
+async function readBuckets(config, folderKey, signal) {
+  const api = await orchestratorApi(config, (sdk) => sdk.BucketsApi, folderKey);
+  const buckets = await readAllPages("storage buckets", (page) => api.bucketsGet(page, { signal }));
+  return buckets.map((bucket) => ({
+    id: bucket.id,
+    name: bucket.name,
+    identifier: bucket.identifier
+  }));
+}
+async function readBucketsWithChildren(config, folderKey, warnings, signal) {
+  const buckets = await readBuckets(config, folderKey, signal);
+  const [listError, folders] = await catchError(listFolderDtos(config, signal));
+  if (listError || !folders) {
+    warnings.push("Could not list the Solution folders under the installed folder, so their storage " + `buckets were not read: ${await extractErrorMessage(listError)}`);
+    return buckets;
+  }
+  const wanted = folderKey.toLowerCase();
+  const children = folders.filter((folder) => folder.key && folder.folderType === "Solution" && folder.parentKey?.toLowerCase() === wanted);
+  for (const child of children) {
+    if (!child.key)
+      continue;
+    if (signal?.aborted)
+      break;
+    const [readError, childBuckets] = await catchError(readBuckets(config, child.key, signal));
+    if (readError || !childBuckets) {
+      warnings.push(`Could not read the storage buckets of the Solution folder ${child.displayName || child.key}: ` + await extractErrorMessage(readError));
+      continue;
+    }
+    buckets.push(...childBuckets);
+  }
+  return buckets;
+}
+var CONNECTION_PAGE_SIZE = 200;
+var MAX_CONNECTION_PAGES = 50;
+async function readConnections(config, folderKey, signal) {
+  const {
+    ConnectionsApi,
+    createConnectionsConfig,
+    folderOverride,
+    normalizeConnectionStatus
+  } = await import("./index-h43sj8at.js");
+  const api = new ConnectionsApi(await createConnectionsConfig({ tenant: config.tenantName }));
+  const scoped = folderOverride(folderKey);
+  const connections = [];
+  let previousFirst;
+  for (let pageIndex = 0;pageIndex < MAX_CONNECTION_PAGES; pageIndex += 1) {
+    const page = await api.apiV1ConnectionsGet({ pageIndex, pageSize: CONNECTION_PAGE_SIZE }, async (context) => ({
+      ...scoped ? await scoped(context) : context.init,
+      signal
+    }));
+    const first = page[0]?.id;
+    if (page.length === 0 || first !== undefined && first === previousFirst) {
+      break;
+    }
+    previousFirst = first;
+    for (const connection of page) {
+      connections.push({
+        id: connection.id,
+        name: connection.name ?? undefined,
+        state: connection.state === undefined ? undefined : normalizeConnectionStatus(connection.state)
+      });
+    }
+    if (page.length < CONNECTION_PAGE_SIZE)
+      break;
+  }
+  return connections;
+}
+
+// src/services/seed/order.ts
+class SeedCycleError extends Error {
+  entities;
+  result = RESULTS.ValidationError;
+  errorCode = "invalid_argument";
+  retry = "RetryWillNotFix";
+  instructions;
+  constructor(entities) {
+    super(`These entities reference each other in a cycle, so none of them can be ` + `seeded before the others: ${entities.join(", ")}.`);
+    this.entities = entities;
+    this.name = "SeedCycleError";
+    this.instructions = "Seed them in separate runs: move one entity's CSV out of the seeding " + "folder, seed, then put it back and seed again so its relationship " + "columns can resolve. A relationship cell holding a record id instead " + "of a local Id does not need the other entity seeded first.";
+  }
+}
+function orderEntities(names, lookup) {
+  const dependsOn = dependencies(names, lookup);
+  const ordered = [];
+  const remaining = [...names];
+  while (remaining.length > 0) {
+    const index = remaining.findIndex((name) => (dependsOn.get(name)?.size ?? 0) === 0);
+    if (index === -1) {
+      throw new SeedCycleError(inCycle(remaining, dependsOn));
+    }
+    const [next] = remaining.splice(index, 1);
+    ordered.push(next);
+    for (const deps of dependsOn.values())
+      deps.delete(next.toLowerCase());
+  }
+  return ordered;
+}
+function dependencies(names, lookup) {
+  const wanted = new Set(names.map((name) => name.toLowerCase()));
+  const dependsOn = new Map;
+  for (const name of names) {
+    const deps = new Set;
+    const entity = lookup.byName.get(name.toLowerCase());
+    for (const field of entity?.fields.values() ?? []) {
+      const target = field.referenceEntityName?.toLowerCase();
+      if (field.isForeignKey && target && target !== name.toLowerCase() && wanted.has(target)) {
+        deps.add(target);
+      }
+    }
+    dependsOn.set(name, deps);
+  }
+  return dependsOn;
+}
+function inCycle(remaining, dependsOn) {
+  let members = [...remaining];
+  for (;; ) {
+    const pointedAt = new Set(members.flatMap((name) => [...dependsOn.get(name) ?? []]));
+    const kept = members.filter((name) => pointedAt.has(name.toLowerCase()));
+    if (kept.length === members.length)
+      return members;
+    members = kept;
+  }
+}
+
+// src/services/seed-run/report.ts
+function describePlans(plans) {
+  let inserts = 0;
+  let updates = 0;
+  let unchanged = 0;
+  for (const plan of plans) {
+    inserts += plan.toInsert.length;
+    updates += plan.toUpdate.length;
+    unchanged += plan.unchanged;
+    const parts = [];
+    if (plan.toInsert.length > 0)
+      parts.push(`+${plan.toInsert.length} insert`);
+    if (plan.toUpdate.length > 0)
+      parts.push(`~${plan.toUpdate.length} update`);
+    if (plan.toRepairAttachments.length > 0)
+      parts.push(`${plan.toRepairAttachments.length} attachment retry`);
+    if (plan.ignored > 0)
+      parts.push(`${plan.ignored} changed (ignored, insert strategy)`);
+    if (plan.unchanged > 0)
+      parts.push(`${plan.unchanged} unchanged`);
+    writeProgress(`  ${plan.entityName}: ${parts.length > 0 ? parts.join(", ") : "nothing to do"}`);
+  }
+  if (plans.length > 0) {
+    writeProgress(`Total: +${inserts} insert, ~${updates} update, ${unchanged} unchanged`);
+  }
+}
+function nothingToSeed(plans) {
+  const ignored = plans.reduce((total, plan) => total + plan.ignored, 0);
+  if (ignored === 0)
+    return "All records are up to date. Nothing to seed.";
+  return `Nothing to seed: ${ignored} ${ignored === 1 ? "row differs" : "rows differ"} from the seed ` + "files but the entity's strategy is insert, so existing records are left alone. " + "Every other record is up to date.";
+}
+function hasEntityWork(plan) {
+  return plan.toInsert.length > 0 || plan.toUpdate.length > 0 || plan.toRepairAttachments.length > 0;
+}
+function hasWork(plans) {
+  return plans.some(hasEntityWork);
+}
+function describeResult(result) {
+  const parts = [];
+  if (result.inserted > 0)
+    parts.push(`+${result.inserted} inserted`);
+  if (result.updated > 0)
+    parts.push(`~${result.updated} updated`);
+  if (result.attachmentsUploaded > 0)
+    parts.push(`${result.attachmentsUploaded} attachment(s) uploaded`);
+  if (result.attachmentsCleared > 0)
+    parts.push(`${result.attachmentsCleared} attachment(s) removed`);
+  if (result.failed > 0)
+    parts.push(`!${result.failed} failed`);
+  const attachmentFailures = result.errors.filter((error) => /attachment|uploading/.test(error)).length;
+  if (attachmentFailures > 0)
+    parts.push(`!${attachmentFailures} attachment problem(s)`);
+  return parts.length > 0 ? parts.join(", ") : "nothing written";
+}
+function finish(workspaceDir, summaries, errors, retry) {
+  const executed = summaries.filter((summary) => summary.inserted > 0 || summary.updated > 0);
+  const unexplained = summaries.reduce((total, summary) => total + summary.failed, 0);
+  if (errors.length === 0 && unexplained > 0) {
+    errors.push(`${unexplained} ${unexplained === 1 ? "row was" : "rows were"} not written and the ` + "service gave no reason.");
+  }
+  if (errors.length === 0) {
+    if (executed.length > 0) {
+      writeProgress("Seeding completed successfully.");
+    }
+    return { ok: true, workspaceDir, summaries };
+  }
+  const problems = collapseRowProblems(errors);
+  const noun = problems.length === 1 ? "problem" : "problems";
+  const list = problems.map((problem) => `  - ${problem}`).join(`
+`);
+  writeWarning(`Seeding finished with ${problems.length} ${noun}:
+${list}`);
+  const message = `Seeding finished with ${problems.length} ${noun}: ${problems.map((problem) => problem.replace(/\s*\n\s*/g, " ")).join("; ")}`;
+  return {
+    ...failure("service-error", message, `Fix the seed files or the scope, then retry with: ${retry} — rows already seeded are ` + "recorded in the seed journal and will not be inserted twice."),
+    workspaceDir,
+    summaries
+  };
+}
+function finishIdle(run, plans) {
+  return finish(run.input.workspaceDir, [...run.summaries, ...plans.map(nothingDone)], run.errors, run.retry);
+}
+function nothingDone(plan) {
+  return {
+    entityName: plan.entityName,
+    inserted: 0,
+    updated: 0,
+    unchanged: plan.unchanged,
+    ignored: plan.ignored,
+    failed: 0,
+    attachmentsUploaded: 0,
+    skipped: false
+  };
+}
+function emptySummary(entityName, skipReason) {
+  return {
+    entityName,
+    inserted: 0,
+    updated: 0,
+    unchanged: 0,
+    ignored: 0,
+    failed: 0,
+    attachmentsUploaded: 0,
+    skipped: skipReason !== undefined,
+    ...skipReason ? { skipReason } : {}
+  };
+}
+
+// src/services/seed-run/solution-namespace.ts
+function solutionCollections(manifest, resources) {
+  const declared = manifest.solution;
+  const collections = new Map;
+  const processes = new Map;
+  for (const name of declared?.processes ?? []) {
+    const release = findByName(resources.processes, name);
+    if (!release)
+      continue;
+    processes.set(name, properties({
+      Id: release.id,
+      Key: release.key,
+      Name: release.name,
+      ProcessKey: release.processKey,
+      Version: release.processVersion,
+      Type: release.processType
+    }));
+  }
+  collections.set("Processes", processes);
+  const assets = new Map;
+  for (const name of declared?.assets ?? []) {
+    const asset = findByName(resources.assets, name);
+    if (!asset)
+      continue;
+    assets.set(name, properties({
+      Id: asset.id,
+      Name: asset.name,
+      Value: asset.value,
+      Type: asset.valueType
+    }));
+  }
+  collections.set("Assets", assets);
+  const buckets = new Map;
+  for (const bucket of resources.buckets) {
+    buckets.set(bucket.name, properties({
+      Id: bucket.id,
+      Name: bucket.name,
+      Identifier: bucket.identifier
+    }));
+  }
+  collections.set("StorageBuckets", buckets);
+  const connections = new Map;
+  for (const [name, connectorKey] of declared?.connections ?? []) {
+    const connection = resources.connections.find((candidate) => candidate.name?.toLowerCase() === name.toLowerCase());
+    if (!connection)
+      continue;
+    connections.set(name, properties({
+      Id: connection.id,
+      Name: name,
+      ConnectorKey: connectorKey,
+      State: connection.state
+    }));
+  }
+  collections.set("Connections", connections);
+  return collections;
+}
+function findByName(resources, name) {
+  const wanted = name.toLowerCase();
+  return resources.find((resource) => resource.name.toLowerCase() === wanted);
+}
+function properties(values) {
+  const out = new Map;
+  for (const [key, value] of Object.entries(values)) {
+    if (value !== undefined)
+      out.set(key, String(value));
+  }
+  return out;
+}
+
+// src/services/seed-run/plan-all.ts
+async function planAll(run, lookup, present, expressionContext) {
+  const { input } = run;
+  writeProgress(`
+Comparing with live data...`);
+  const bundledFiles = await listBundledFiles(input.workspaceDir, present);
+  const ordered = orderEntities(present.map((file) => file.entityName), lookup);
+  const plans = [];
+  let journalChanged = false;
+  for (const entityName of ordered) {
+    const file = present.find((f) => f.entityName === entityName);
+    if (file === undefined)
+      continue;
+    const planned = await planEntity({
+      input,
+      sdk: run.sdk,
+      file,
+      journal: run.journal,
+      expressionContext,
+      bundledFiles,
+      idMaps: run.idMaps
+    });
+    if (planned.ok)
+      journalChanged ||= planned.plan.journalChanged;
+    const plan = acceptPlan(run, entityName, planned);
+    if (plan !== undefined)
+      plans.push(plan);
+  }
+  holdBackDependents(plans, run.summaries, run.errors, run.idMaps);
+  if (journalChanged) {
+    await saveJournal(input.workspaceDir, run.journalScope, run.journal);
+  }
+  return plans;
+}
+function acceptPlan(run, entityName, planned) {
+  if (!planned.ok) {
+    run.errors.push(...planned.errors);
+    run.summaries.push(emptySummary(entityName, "invalid"));
+    return;
+  }
+  const plan = planned.plan;
+  for (const warning of plan.warnings)
+    writeWarning(warning);
+  if (plan.errors.length > 0) {
+    run.errors.push(...plan.errors);
+    run.summaries.push(emptySummary(entityName, "invalid"));
+    return;
+  }
+  run.idMaps.set(entityName.toLowerCase(), new Map(plan.idMap));
+  return plan;
+}
+function reportPlanning(run, plans, missing) {
+  if (run.errors.length === 0 && missing.length === 0) {
+    writeProgress("Validation passed.");
+  }
+  describePlans(plans);
+  if (missing.length > 0 || run.errors.length > 0) {
+    const named = [
+      ...missing,
+      ...run.summaries.filter((s) => s.skipped).map((s) => s.entityName)
+    ];
+    writeWarning(`Planning failed for: ${[...new Set(named)].join(", ")} — those entities will not be seeded.`);
+  }
+}
+async function planEntity(args) {
+  const { input, sdk, file } = args;
+  const { entity } = file;
+  const [recordsError, liveRecords] = await catchError(loadLiveRecords(sdk, entity.id, input.folderKey, needsExpandedRecords(entity)));
+  if (recordsError) {
+    return {
+      ok: false,
+      errors: [
+        `${file.entityName}: could not read the existing records: ${recordsError.message}`
+      ]
+    };
+  }
+  const dropped = await dropStaleJournalEntries(sdk, entity, file.entityName, args.journal, liveRecords ?? [], input.folderKey);
+  const plan = buildEntityPlan({
+    entityName: file.entityName,
+    entity,
+    csv: file.csv,
+    strategy: file.strategy,
+    liveRecords: liveRecords ?? [],
+    journal: args.journal,
+    expressionContext: args.expressionContext,
+    choiceValues: await loadChoiceValues(sdk, entity, input.folderKey),
+    bundledFiles: args.bundledFiles,
+    idMaps: args.idMaps
+  });
+  return {
+    ok: true,
+    plan: dropped ? { ...plan, journalChanged: true } : plan
+  };
+}
+async function dropStaleJournalEntries(sdk, entity, entityName, journal, liveRecords, folderKey) {
+  const entries = journal[entityName];
+  if (!entries)
+    return false;
+  const liveIds = new Set(liveRecords.flatMap((record) => typeof record.Id === "string" ? [record.Id.toLowerCase()] : []));
+  let changed = false;
+  for (const [key, entry] of Object.entries(entries)) {
+    if (liveIds.has(entry.recordId.toLowerCase()))
+      continue;
+    const [error] = await catchError(sdk.entities.getRecordById(entity.id, entry.recordId, folderKey === undefined ? undefined : { folderKey }));
+    if (!error)
+      continue;
+    const { errorCode } = await extractErrorDetails(error);
+    if (errorCode === "not_found") {
+      delete entries[key];
+      changed = true;
+    }
+  }
+  return changed;
+}
+async function listBundledFiles(workspaceDir, files) {
+  const fs = getFileSystem();
+  const bundled = new Map;
+  for (const file of files) {
+    const dir = fs.path.join(workspaceDir, file.entityName);
+    const [listError, entries] = await catchError(fs.readdir(dir));
+    if (listError || !entries)
+      continue;
+    for (const entry of entries) {
+      const [, stats] = await catchError(fs.stat(fs.path.join(dir, entry)));
+      if (stats?.isFile()) {
+        bundled.set(`${file.entityName}/${entry}`, stats.size);
+      }
+    }
+  }
+  return bundled;
+}
+function holdBackDependents(plans, summaries, errors, idMaps) {
+  let held = true;
+  while (held) {
+    held = false;
+    const unavailable = skippedEntities(summaries);
+    for (const plan of plans.slice()) {
+      const dependency = dependsOn(plan, unavailable);
+      if (dependency === undefined)
+        continue;
+      errors.push(`${plan.entityName}: rows reference ${dependency} by local Id, and ${dependency} ` + `could not be planned — nothing written for ${plan.entityName}.`);
+      summaries.push(emptySummary(plan.entityName, "depends-on-skipped"));
+      plans.splice(plans.indexOf(plan), 1);
+      idMaps.delete(plan.entityName.toLowerCase());
+      held = true;
+    }
+  }
+}
+function skippedEntities(summaries) {
+  return new Map(summaries.filter((summary) => summary.skipped).map((summary) => [
+    summary.entityName.toLowerCase(),
+    summary.entityName
+  ]));
+}
+function dependsOn(plan, unavailable) {
+  for (const row of [...plan.toInsert, ...plan.toUpdate]) {
+    for (const reference of Object.values(row.foreignKeys)) {
+      const name = unavailable.get(reference.entity);
+      if (name !== undefined)
+        return name;
+    }
+  }
+  return;
+}
+async function saveJournal(workspaceDir, scope, journal) {
+  const [error] = await catchError(writeJournal(workspaceDir, scope, journal, true));
+  if (error) {
+    writeWarning(`Could not write the seed journal (.seed-ids.json): ${error.message}. ` + "Seeding continues, but retry protection degrades to live matching.");
+  }
+}
+function buildExpressionContext(input, lookup, solution) {
+  const entityIds = new Map;
+  const entityNames = new Map;
+  for (const [name, entity] of lookup.byName) {
+    entityIds.set(name, entity.id);
+    entityNames.set(name, entity.name);
+  }
+  const folder = solution.resources?.folder;
+  return {
+    baseUrl: input.config.baseUrl,
+    organizationId: input.config.organizationId,
+    organizationName: input.config.organizationName,
+    tenantId: input.config.tenantId,
+    tenantName: input.config.tenantName,
+    folderKey: input.folderKey,
+    solutionFolderKey: input.folderKey,
+    solutionFolderPath: solution.folderPath,
+    solutionFolderId: textOf(folder?.id),
+    solutionParentFolderId: textOf(folder?.parentId),
+    solutionParentFolderKey: folder?.parentKey,
+    solutionResources: solution.resources ? solutionCollections(input.manifest, solution.resources) : undefined,
+    entityIds,
+    entityNames
+  };
+}
+function textOf(value) {
+  return value === undefined ? undefined : String(value);
+}
+async function loadChoiceValues(sdk, entity, folderKey) {
+  const byField = new Map;
+  for (const field of entity.fields.values()) {
+    if (!field.choiceSetId)
+      continue;
+    const values = await loadChoiceSetValues(sdk, field.choiceSetId, folderKey);
+    if (values)
+      byField.set(field.name.toLowerCase(), values);
+  }
+  return byField;
+}
+
+// src/services/seed/execute-context.ts
+var BATCH_SIZE = 1000;
+function plannedLocalIds(plan) {
+  return new Set([...plan.toInsert, ...plan.toUpdate].map((row) => row.localId).filter((localId) => Boolean(localId)));
+}
+function recordJournal(journal, entityName, written) {
+  if (written.length === 0)
+    return;
+  const entity = journalEntity(journal, entityName);
+  for (const [row, id] of written) {
+    const pendingFiles = Object.keys(row.attachments);
+    const entry = pendingFiles.length > 0 ? { recordId: id, pendingFiles } : { recordId: id };
+    putOwn(entity, row.key, entry);
+  }
+  putOwn(journal, entityName, entity);
+}
+async function saveJournal2(options, warnings) {
+  const [error] = await catchError(options.journalLockHeld ? writeJournal(options.workspaceDir, options.journalScope, options.journal, true) : writeJournal(options.workspaceDir, options.journalScope, options.journal));
+  if (error && !warnings.some((warning) => warning.includes(".seed-ids.json"))) {
+    warnings.push(`Could not write the seed journal (.seed-ids.json): ${error.message}. ` + "Seeding continues, but retry protection for this run's rows is lost.");
+  }
+}
+function readBatchOutcome(response) {
+  const parsed = BatchResponseSchema.safeParse(response);
+  if (!parsed.success)
+    return { ids: [], failures: [] };
+  const container = parsed.data;
+  const successes = [
+    container.successRecords,
+    container.records,
+    container.items,
+    container.value
+  ].find((candidate) => candidate !== undefined);
+  const ids = (successes ?? []).flatMap((item) => {
+    const record = WrittenRecordSchema.safeParse(item);
+    if (!record.success)
+      return [];
+    const id = record.data.Id ?? record.data.id;
+    return typeof id === "string" ? [id] : [];
+  });
+  const failures = (container.failureRecords ?? []).map((failure2) => {
+    const record = FailureRecordSchema.safeParse(failure2);
+    return record.success && record.data.error ? record.data.error : "the service rejected the record without a reason";
+  });
+  return { ids, failures };
+}
+function chunk(items, size) {
+  const batches = [];
+  for (let index = 0;index < items.length; index += size) {
+    batches.push(items.slice(index, index + size));
+  }
+  return batches;
+}
+function rowRange(batch) {
+  return `rows ${batch[0].line}-${batch[batch.length - 1].line}`;
+}
+
+// src/services/seed/execute-attachments.ts
+async function syncAttachments(options, scope, rows, errors) {
+  let uploaded = 0;
+  let cleared = 0;
+  for (const [row, recordId] of rows) {
+    if (options.signal?.aborted) {
+      await saveJournal2(options, []);
+      options.signal.throwIfAborted();
+    }
+    const failed = [];
+    for (const [fieldName, relativePath] of attachmentsToSync(row)) {
+      const ok = await uploadAttachmentField(options, scope, row, recordId, fieldName, relativePath, errors);
+      if (ok) {
+        uploaded += 1;
+      } else {
+        failed.push(fieldName);
+      }
+    }
+    for (const fieldName of row.attachmentClears ?? []) {
+      const [clearError] = await catchError(options.sdk.entities.deleteAttachment({ id: options.plan.entityId }, recordId, fieldName, scope));
+      if (clearError) {
+        errors.push(`${options.plan.entityName} row ${row.line}: removing the file from ` + `${fieldName} failed: ${clearError.message}`);
+        continue;
+      }
+      cleared += 1;
+    }
+    setPendingFiles(options.journal, options.plan.entityName, row.key, recordId, failed);
+  }
+  return { uploaded, cleared };
+}
+function attachmentsToSync(row) {
+  return row.pendingFiles ? Object.entries(row.attachments).filter(([field]) => row.pendingFiles?.includes(field)) : Object.entries(row.attachments);
+}
+async function uploadAttachmentField(options, scope, row, recordId, fieldName, relativePath, errors) {
+  const lexical = resolveWorkspacePath(options.workspaceDir, relativePath);
+  const resolved = lexical !== undefined && await staysInWorkspace(options.workspaceDir, lexical) ? lexical : undefined;
+  if (resolved === undefined) {
+    const nameProblem = attachmentNameProblem(relativePath);
+    const named = withoutControlBytes(relativePath);
+    errors.push(`${options.plan.entityName} row ${row.line}: attachment path ` + (nameProblem === undefined ? `"${named}" points outside the seed workspace.` : `"${named}" is not a usable file name (${nameProblem}).`));
+    return false;
+  }
+  const [readError, bytes] = await catchError(getFileSystem().readFile(resolved));
+  if (readError || bytes === null) {
+    errors.push(`${options.plan.entityName} row ${row.line}: attachment ` + `"${relativePath}" could not be read: ${readError?.message ?? "the file is empty"}`);
+    return false;
+  }
+  const filename = relativePath.slice(relativePath.lastIndexOf("/") + 1);
+  const [uploadError] = await catchError(options.sdk.entities.uploadAttachment({ id: options.plan.entityId }, recordId, fieldName, new File([new Uint8Array(bytes)], filename, {
+    type: mimeTypeFor(filename)
+  }), scope));
+  if (uploadError) {
+    errors.push(`${options.plan.entityName} row ${row.line}: uploading ` + `"${relativePath}" to ${fieldName} failed: ${uploadError.message}`);
+    return false;
+  }
+  return true;
+}
+var MIME_TYPES = {
+  csv: "text/csv",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  gif: "image/gif",
+  htm: "text/html",
+  html: "text/html",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  json: "application/json",
+  md: "text/markdown",
+  pdf: "application/pdf",
+  png: "image/png",
+  svg: "image/svg+xml",
+  txt: "text/plain",
+  webp: "image/webp",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  xml: "application/xml",
+  yaml: "application/yaml",
+  yml: "application/yaml",
+  zip: "application/zip"
+};
+function mimeTypeFor(filename) {
+  const dot = filename.lastIndexOf(".");
+  const extension = dot === -1 ? "" : filename.slice(dot + 1).toLowerCase();
+  return MIME_TYPES[extension] ?? "application/octet-stream";
+}
+function setPendingFiles(journal, entityName, rowKey, recordId, failed) {
+  const entity = journalEntity(journal, entityName);
+  if (!Object.hasOwn(entity, rowKey))
+    return;
+  putOwn(entity, rowKey, failed.length > 0 ? { recordId, pendingFiles: failed } : { recordId });
+  putOwn(journal, entityName, entity);
+}
+function resolveWorkspacePath(workspaceDir, relativePath) {
+  const segments = relativeSegments(relativePath);
+  if (segments === undefined || segments.length === 0)
+    return;
+  if (segments.some(isUnsafeSegment))
+    return;
+  return getFileSystem().path.join(workspaceDir, ...segments);
+}
+function relativeSegments(relativePath) {
+  const normalized = relativePath.replaceAll("\\", "/");
+  if (normalized.startsWith("/") || /^[a-zA-Z]:/.test(normalized)) {
+    return;
+  }
+  return normalized.split("/").filter((part) => part !== "");
+}
+function attachmentNameProblem(relativePath) {
+  const segments = relativeSegments(relativePath);
+  if (segments === undefined || segments.some(isDotSegment))
+    return;
+  for (const segment of segments) {
+    const problem = segmentNameProblem(segment);
+    if (problem !== undefined)
+      return problem;
+  }
+  return;
+}
+async function staysInWorkspace(workspaceDir, path) {
+  const fs = getFileSystem();
+  const [error, canonical] = await catchError(Promise.all([fs.realpath(workspaceDir), fs.realpath(path)]));
+  if (error)
+    return false;
+  const [realRoot, realPath] = canonical;
+  return isUnder(fs.path, realRoot, realPath) || isUnder(fs.path, workspaceDir, realPath);
+}
+function climbsOut(relative) {
+  return relative.split(/[\\/]/)[0] === "..";
+}
+function isUnder(paths, root, path) {
+  const relative = paths.relative(root, path);
+  return relative === "" || !climbsOut(relative) && !paths.isAbsolute(relative);
+}
+
+// src/services/seed/execute-insert.ts
+async function insertRows(rows, options, scope, errors, warnings) {
+  const written = [];
+  const claimed = new Set(options.plan.matched.map((row) => row.recordId.toLowerCase()));
+  const recovery = { blocked: false };
+  for (const batch of chunk(rows, BATCH_SIZE)) {
+    options.signal?.throwIfAborted();
+    const batchWritten = await insertBatch(batch, options, scope, errors, warnings, claimed, recovery);
+    if (batchWritten.length > 0) {
+      recordJournal(options.journal, options.plan.entityName, batchWritten);
+      await saveJournal2(options, warnings);
+    }
+    written.push(...batchWritten);
+  }
+  return written;
+}
+async function insertBatch(batch, options, scope, errors, warnings, claimed, recovery) {
+  const { plan, sdk } = options;
+  options.onProgress?.(`  ${plan.entityName}: inserting ${batch.length} ${batch.length === 1 ? "record" : "records"}`);
+  const [error, response] = await catchError(sdk.entities.insertRecordsById(plan.entityId, batch.map((row) => row.values), scope));
+  if (error) {
+    return recoverRejectedBatch(batch, options, scope, {
+      errors,
+      warnings,
+      claimed,
+      recovery,
+      cause: error.message
+    });
+  }
+  const outcome = readBatchOutcome(response);
+  for (const failure2 of outcome.failures) {
+    errors.push(`${plan.entityName}: ${failure2}`);
+  }
+  if (outcome.ids.length === 0 && outcome.failures.length < batch.length) {
+    return recoverWrittenRows(batch, options, scope, errors, warnings, claimed, recovery);
+  }
+  if (outcome.ids.length === batch.length) {
+    const written = [];
+    for (const [index, row] of batch.entries()) {
+      written.push([row, outcome.ids[index]]);
+      claimed.add(outcome.ids[index].toLowerCase());
+    }
+    return written;
+  }
+  if (outcome.ids.length > 0) {
+    for (const id of outcome.ids)
+      claimed.add(id.toLowerCase());
+    errors.push(`${plan.entityName}: the service accepted ${outcome.ids.length} of ${batch.length} rows ` + "but did not say which, so none were journaled. Re-running would insert those rows " + "again — fix the rejected rows and delete the accepted ones first, or seed this " + "entity into a clean folder.");
+    if (outcome.ids.length + outcome.failures.length < batch.length) {
+      recovery.blocked = true;
+      errors.push(`${plan.entityName}: the answer accounted for ${outcome.ids.length + outcome.failures.length} of ${batch.length} rows, so records of this batch may be in the entity ` + "unrecorded. Later batches were not matched against Data Fabric either.");
+    }
+  }
+  return [];
+}
+async function recoverWrittenRows(batch, options, scope, errors, warnings, claimed, recovery) {
+  const { plan } = options;
+  const range = rowRange(batch);
+  if (recovery.blocked) {
+    errors.push(unreconciledEarlier(plan.entityName, range));
+    return [];
+  }
+  const [error, live] = await catchError(readBack(options, scope));
+  if (error) {
+    recovery.blocked = true;
+    errors.push(`${plan.entityName}: the service returned no result for ${range}, and reading ` + `the entity back failed: ${error.message}. Check the entity in Data Fabric ` + "before re-running — the rows may have been written.");
+    return [];
+  }
+  const { written, missing } = pairWithLive(batch, live, plan, claimed);
+  if (written.length > 0) {
+    warnings.push(`${plan.entityName}: the service returned no record ids for ${range}; ` + `${written.length} of ${batch.length} rows were found in Data Fabric and recorded.`);
+  }
+  reportMissingRows(plan.entityName, range, batch.length, missing, errors);
+  if (missing.length > 0)
+    recovery.blocked = true;
+  return written;
+}
+async function recoverRejectedBatch(batch, options, scope, report) {
+  const { plan } = options;
+  const range = rowRange(batch);
+  const failure2 = `${plan.entityName}: inserting ${range} failed: ${report.cause}`;
+  if (report.recovery.blocked) {
+    report.errors.push(failure2);
+    report.errors.push(unreconciledEarlier(plan.entityName, range));
+    return [];
+  }
+  const [error, live] = await catchError(readBack(options, scope));
+  if (error) {
+    report.recovery.blocked = true;
+    report.errors.push(`${failure2}. Reading the entity back to see what was written failed as well: ` + `${error.message}. Check the entity in Data Fabric before re-running — ` + "some of these rows may already be there.");
+    return [];
+  }
+  const { written, missing } = pairWithLive(batch, live, plan, report.claimed);
+  if (written.length > 0) {
+    report.warnings.push(`${plan.entityName}: inserting ${range} reported an error (${report.cause}), ` + `but ${written.length} of ${batch.length} rows were found in Data Fabric ` + "afterwards and recorded.");
+  }
+  if (missing.length === batch.length) {
+    report.errors.push(failure2);
+  } else if (missing.length > 0) {
+    report.errors.push(`${failure2} (${missing.length} of ${batch.length} rows not found afterwards: ` + `${nameRows(missing)})`);
+  }
+  if (missing.length > 0)
+    report.recovery.blocked = true;
+  return written;
+}
+function unreconciledEarlier(entityName, range) {
+  return `${entityName}: not matching ${range} against Data Fabric, because an ` + "earlier batch of this entity could not be reconciled and its rows may " + "be there unrecorded. Check the entity, then re-run to pick up what is " + "missing.";
+}
+function readBack(options, scope) {
+  const { plan, sdk } = options;
+  return loadLiveRecords(sdk, plan.entityId, scope?.folderKey, plan.expandRecords);
+}
+function pairWithLive(batch, live, plan, claimed) {
+  const unclaimed = live.filter((record) => typeof record.Id !== "string" || !claimed.has(record.Id.toLowerCase()));
+  const ids = plan.locate(batch, unclaimed);
+  const written = [];
+  const missing = [];
+  for (const [index, row] of batch.entries()) {
+    const id = ids[index];
+    if (id === undefined) {
+      missing.push(row);
+    } else {
+      written.push([row, id]);
+    }
+  }
+  for (const record of live) {
+    if (typeof record.Id === "string")
+      claimed.add(record.Id.toLowerCase());
+  }
+  return { written, missing };
+}
+function reportMissingRows(entityName, range, batchSize, missing, errors) {
+  const blank = missing.filter((row) => Object.keys(row.values).length === 0);
+  const other = missing.filter((row) => !blank.includes(row));
+  if (other.length > 0) {
+    errors.push(`${entityName}: the service returned no result for ${range} and ` + `${other.length} of ${batchSize} rows could not be found afterwards ` + `(${nameRows(other)}). Check the entity in Data Fabric ` + "before re-running — a row that was written would be inserted again.");
+  }
+  if (blank.length > 0) {
+    errors.push(`${entityName}: the service returned no result for ${range}, and ` + `${blank.length} of ${batchSize} rows (${nameRows(blank)}) hold only files or ` + `links to other ${entityName} rows, which are set after the insert, so there ` + "is nothing to find them by. They were not journaled and their files were not " + "uploaded. Check the entity in Data Fabric before re-running — a row that was " + "written would be inserted again.");
+  }
+}
+function nameRows(rows) {
+  const named = rows.slice(0, 5).map((row) => row.label).join(", ");
+  return `${named}${rows.length > 5 ? ", …" : ""}`;
+}
+
+// src/services/seed/execute-update.ts
+async function updateRows(rows, options, scope, errors) {
+  const written = [];
+  for (const batch of chunk(rows, BATCH_SIZE)) {
+    options.signal?.throwIfAborted();
+    written.push(...await updateBatch(batch, options, scope, errors));
+  }
+  return written;
+}
+async function updateBatch(batch, options, scope, errors) {
+  const { plan, sdk } = options;
+  const withRecordId = (row) => [
+    row,
+    row.recordId
+  ];
+  const withFields = batch.filter((row) => Object.keys(row.values).length > 0);
+  const attachmentOnly = batch.filter((row) => Object.keys(row.values).length === 0).map(withRecordId);
+  if (withFields.length === 0)
+    return attachmentOnly;
+  options.onProgress?.(`  ${plan.entityName}: updating ${withFields.length} ${withFields.length === 1 ? "record" : "records"}`);
+  const [error, response] = await catchError(sdk.entities.updateRecordsById(plan.entityId, withFields.map((row) => ({
+    Id: row.recordId,
+    ...row.values
+  })), scope));
+  if (error) {
+    errors.push(`${plan.entityName}: updating ${rowRange(batch)} failed: ${error.message}`);
+    return attachmentOnly;
+  }
+  const outcome = readBatchOutcome(response);
+  for (const failure2 of outcome.failures) {
+    errors.push(`${plan.entityName}: ${failure2}`);
+  }
+  if (outcome.failures.length === 0)
+    return batch.map(withRecordId);
+  if (outcome.failures.length < withFields.length) {
+    errors.push(`${plan.entityName}: the service accepted ${withFields.length - outcome.failures.length} of ${withFields.length} updates but did not say which, so none were ` + "counted or followed up. Fix the rejected rows and re-run; rows already " + "updated compare as unchanged.");
+  }
+  return attachmentOnly;
+}
+async function resolveSelfReferences(rows, options, scope, ownIds, errors, warnings) {
+  const followUps = [];
+  let rejected = 0;
+  const planned = plannedLocalIds(options.plan);
+  for (const [row, recordId] of rows) {
+    const fields = selfReferenceFields(row, options, ownIds, planned, {
+      errors,
+      warnings
+    });
+    if (Object.keys(fields).length > 0) {
+      followUps.push({ Id: recordId, ...fields });
+    }
+  }
+  for (const batch of chunk(followUps, BATCH_SIZE)) {
+    options.signal?.throwIfAborted();
+    const [error, response] = await catchError(options.sdk.entities.updateRecordsById(options.plan.entityId, batch, scope));
+    if (error) {
+      errors.push(`${options.plan.entityName}: linking ${batch.length} self-referencing ${batch.length === 1 ? "row" : "rows"} failed: ${error.message}`);
+      rejected += batch.length;
+      continue;
+    }
+    const { failures } = readBatchOutcome(response);
+    for (const failure2 of failures) {
+      errors.push(`${options.plan.entityName}: ${failure2}`);
+    }
+    rejected += failures.length;
+  }
+  return rejected;
+}
+function selfReferenceFields(row, options, ownIds, planned, report) {
+  const fields = fieldMap();
+  for (const [field, ref] of Object.entries(row.foreignKeys)) {
+    const id = ownIds.get(ref.localId);
+    if (id === undefined && planned.has(ref.localId)) {
+      report.errors.push(`${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `was not linked because that ${options.plan.entityName} row failed — ` + "this row was written without it. Fix the failed row and re-run to link it.");
+      continue;
+    }
+    if (id === undefined) {
+      const unresolved = `${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `does not match the Id of any row in ${options.plan.entityName}.csv`;
+      if (options.plan.requiredRelationships.has(field)) {
+        report.errors.push(`${unresolved}, and ${field} is required — the row was ` + "written without it. Add the missing row and re-run to link it.");
+        continue;
+      }
+      report.warnings.push(`${unresolved} — the relationship was left empty.`);
+      continue;
+    }
+    fields[field] = { Id: id };
+  }
+  return fields;
+}
+
+// src/services/seed/execute.ts
+async function executeEntityPlan(options) {
+  const { plan } = options;
+  const errors = [];
+  const warnings = [];
+  const idMaps = options.idMaps ?? new Map;
+  const scope = options.folderKey === undefined ? undefined : { folderKey: options.folderKey };
+  const selfName = plan.entityName.toLowerCase();
+  const ownIds = idMaps.get(selfName) ?? new Map;
+  idMaps.set(selfName, ownIds);
+  for (const [localId, recordId] of plan.idMap)
+    ownIds.set(localId, recordId);
+  const insertable = resolveReferences(plan.toInsert, options, idMaps, {
+    warnings,
+    errors
+  });
+  const updatable = resolveReferences(plan.toUpdate, options, idMaps, {
+    warnings,
+    errors
+  });
+  const inserts = insertable.rows;
+  const insertedIds = await insertRows(inserts, options, scope, errors, warnings);
+  let failed = inserts.length - insertedIds.length + insertable.heldBack + updatable.heldBack;
+  for (const [row, id] of insertedIds) {
+    if (row.localId)
+      ownIds.set(row.localId, id);
+  }
+  const settled = settleSelfReferenceUpdates(updatable.rows.filter(hasUpdateWork), options, ownIds, { errors, warnings });
+  const updates = settled.rows;
+  failed += settled.heldBack;
+  const updatedIds = await updateRows(updates, options, scope, errors);
+  failed += updates.length - updatedIds.length;
+  failed += await resolveSelfReferences([...insertedIds, ...updatedIds], options, scope, ownIds, errors, warnings);
+  const withIds = [
+    ...insertedIds,
+    ...updatedIds,
+    ...plan.toRepairAttachments.map((row) => [
+      row,
+      row.recordId
+    ])
+  ];
+  const attachments = await syncAttachments(options, scope, withIds, errors);
+  await saveJournal2(options, warnings);
+  return {
+    inserted: insertedIds.length,
+    updated: updatedIds.length,
+    failed,
+    attachmentsUploaded: attachments.uploaded,
+    attachmentsCleared: attachments.cleared,
+    errors,
+    warnings
+  };
+}
+function resolveReferences(rows, options, idMaps, report) {
+  const selfName = options.plan.entityName.toLowerCase();
+  const resolved = [];
+  let heldBack = 0;
+  for (const row of rows) {
+    const next = resolveRowReferences(row, options, idMaps, selfName, report);
+    if (next === undefined) {
+      heldBack += 1;
+      continue;
+    }
+    resolved.push(next);
+  }
+  return { rows: resolved, heldBack };
+}
+function hasUpdateWork(row) {
+  return hasFieldOrFileWork(row) || Object.keys(row.foreignKeys).length > 0;
+}
+function hasFieldOrFileWork(row) {
+  return Object.keys(row.values).length > 0 || Object.keys(row.attachments).length > 0 || (row.attachmentClears?.length ?? 0) > 0;
+}
+function settleSelfReferenceUpdates(rows, options, ownIds, report) {
+  const planned = plannedLocalIds(options.plan);
+  const kept = [];
+  let heldBack = 0;
+  for (const row of rows) {
+    const refs = Object.entries(row.foreignKeys);
+    if (hasFieldOrFileWork(row) || refs.some(([, ref]) => ownIds.has(ref.localId))) {
+      kept.push(row);
+      continue;
+    }
+    const failedRef = refs.find(([, ref]) => planned.has(ref.localId));
+    if (failedRef) {
+      const [field, ref] = failedRef;
+      report.errors.push(`${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `was not written because that ${options.plan.entityName} row failed — ` + "this row was held back rather than written without it.");
+      heldBack += 1;
+      continue;
+    }
+    const requiredRef = refs.find(([field]) => options.plan.requiredRelationships.has(field));
+    if (requiredRef) {
+      const [field, ref] = requiredRef;
+      report.errors.push(`${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `matches no row in ${options.plan.entityName}.csv and no record id, and ` + `${field} is required — this row was held back rather than updated ` + "without it.");
+      heldBack += 1;
+      continue;
+    }
+    for (const [field, ref] of refs) {
+      report.warnings.push(`${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `does not match the Id of any row in ${options.plan.entityName}.csv — ` + "the relationship was left empty.");
+    }
+  }
+  return { rows: kept, heldBack };
+}
+function resolveRowReferences(row, options, idMaps, selfName, report) {
+  const values = fieldMap(row.values);
+  const pending = fieldMap();
+  if (!resolveUuidReferences(row, values, options, idMaps, report)) {
+    return;
+  }
+  for (const [field, ref] of Object.entries(row.foreignKeys)) {
+    if (ref.entity === selfName) {
+      pending[field] = ref;
+      continue;
+    }
+    const id = idMaps.get(ref.entity)?.get(ref.localId);
+    if (id !== undefined) {
+      values[field] = { Id: id };
+      continue;
+    }
+    if (options.intendedIds?.get(ref.entity)?.has(ref.localId)) {
+      report.errors.push(heldBackMessage(options, row, field, ref));
+      return;
+    }
+    const where = ref.entity ? `${ref.entity}.csv` : "the referenced entity";
+    if (options.plan.requiredRelationships.has(field)) {
+      report.errors.push(`${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `matches no row in ${where} and no record id, and ${field} is ` + "required — the row was not written.");
+      return;
+    }
+    report.warnings.push(`${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `does not match the Id of any row in ${where}, nor a record id — ` + "the relationship was left empty.");
+  }
+  return { ...row, values, foreignKeys: pending };
+}
+function resolveUuidReferences(row, values, options, idMaps, report) {
+  for (const [field, ref] of Object.entries(row.uuidReferences ?? {})) {
+    const id = idMaps.get(ref.entity)?.get(ref.localId);
+    if (id !== undefined) {
+      if (Object.hasOwn(values, field))
+        values[field] = { Id: id };
+      continue;
+    }
+    if (options.intendedIds?.get(ref.entity)?.has(ref.localId)) {
+      report.errors.push(heldBackMessage(options, row, field, ref));
+      return false;
+    }
+  }
+  return true;
+}
+function heldBackMessage(options, row, field, ref) {
+  return `${options.plan.entityName} row ${row.line}: "${ref.localId}" in ${field} ` + `was not written because that ${ref.entity} row failed — ` + "this row was held back rather than written without it.";
+}
+
+// src/services/seed-run/write.ts
+async function confirmOptionalClears(run, plans) {
+  const { input } = run;
+  const optionalDiffs = plans.flatMap((plan) => plan.optionalDiffs);
+  if (optionalDiffs.length === 0 || input.options.yes === true || !canPrompt()) {
+    return { kind: "plans", plans };
+  }
+  if (!await input.deps.confirmClearOptional(optionalDiffs)) {
+    return { kind: "plans", plans };
+  }
+  const cleared = plans.map(withOptionalClears);
+  describePlans(cleared);
+  if (!hasWork(cleared)) {
+    writeProgress(nothingToSeed(cleared));
+    return { kind: "done", result: finishIdle(run, cleared) };
+  }
+  return { kind: "plans", plans: cleared };
+}
+function refuseWithoutTerminal(input, plans) {
+  if (input.options.yes === true || canPrompt())
+    return;
+  const pending = plans.filter(hasEntityWork).map((plan) => plan.entityName).join(", ");
+  return failure("missing-option", `Seeding ${pending} needs confirmation, and there is no terminal to ask.`, "Re-run with --yes to seed without confirmation, or run from an interactive terminal " + "to review each entity's changes first.", { result: RESULTS.ValidationError, errorCode: "invalid_argument" });
+}
+async function writeApproved(run, plans) {
+  const unavailable = skippedEntities(run.summaries);
+  for (const plan of plans) {
+    run.input.options.signal?.throwIfAborted();
+    await seedOne(run, plan, unavailable);
+  }
+}
+async function seedOne(run, plan, unavailable) {
+  if (!hasEntityWork(plan)) {
+    run.summaries.push(nothingDone(plan));
+    return;
+  }
+  const dependency = dependsOn(plan, unavailable);
+  if (dependency !== undefined) {
+    run.errors.push(`${plan.entityName}: rows reference ${dependency} by local Id, and ${dependency} ` + `was not seeded — nothing written for ${plan.entityName}.`);
+    writeWarning(`  ${plan.entityName}: skipped — it references ${dependency}, which was not seeded.`);
+    run.summaries.push(emptySummary(plan.entityName, "depends-on-skipped"));
+    unavailable.set(plan.entityName.toLowerCase(), plan.entityName);
+    run.idMaps.delete(plan.entityName.toLowerCase());
+    return;
+  }
+  const approved = run.input.options.yes === true || await run.input.deps.confirmEntity(plan);
+  if (!approved) {
+    writeProgress(`  ${plan.entityName}: skipped by user.`);
+    run.summaries.push(emptySummary(plan.entityName, "declined"));
+    unavailable.set(plan.entityName.toLowerCase(), plan.entityName);
+    return;
+  }
+  run.input.options.signal?.throwIfAborted();
+  await writeEntity(run, plan, unavailable);
+}
+async function writeEntity(run, plan, unavailable) {
+  const { input, idMaps, intendedIds } = run;
+  intendedIds.set(plan.entityName.toLowerCase(), plannedLocalIds(plan));
+  const result = await executeEntityPlan({
+    sdk: run.sdk,
+    plan,
+    folderKey: input.folderKey,
+    workspaceDir: input.workspaceDir,
+    journal: run.journal,
+    signal: input.options.signal,
+    journalScope: run.journalScope,
+    journalLockHeld: true,
+    idMaps,
+    intendedIds,
+    onProgress: writeProgress
+  });
+  for (const warning of result.warnings)
+    writeWarning(warning);
+  run.errors.push(...result.errors);
+  writeProgress(`  ${plan.entityName}: ${describeResult(result)}`);
+  if (plan.toInsert.length > 0 && (idMaps.get(plan.entityName.toLowerCase())?.size ?? 0) === 0) {
+    unavailable.set(plan.entityName.toLowerCase(), plan.entityName);
+  }
+  run.summaries.push({
+    entityName: plan.entityName,
+    inserted: result.inserted,
+    updated: result.updated,
+    unchanged: plan.unchanged,
+    ignored: plan.ignored,
+    failed: result.failed,
+    attachmentsUploaded: result.attachmentsUploaded,
+    skipped: false
+  });
+}
+
+// src/services/seed-run/seed-entities.ts
+async function seedEntities(input) {
+  const retry = seedRetryCommand(input.pickedWorkspace ? { ...input.options, dir: input.workspaceDir } : input.options);
+  const read = await readSeedFiles(input);
+  const unusable = workspaceGate(input, read, retry);
+  if (unusable)
+    return unusable;
+  const connected = await connectSeedSdk(input);
+  if (!connected.ok)
+    return connected;
+  const { sdk } = connected;
+  const solution = await readSolution(input, read);
+  printSeedTarget(input, read, solution.folderPath);
+  const schema = await resolveLiveSchema(input, sdk, read.files);
+  if (!schema.ok)
+    return schema;
+  const { lookup, present, missing } = schema;
+  const run = await startRun(input, sdk, retry, {
+    noSeedFile: read.absent,
+    notInScope: missing
+  });
+  const [planError, plans] = await catchError(() => planAll(run, lookup, present, buildExpressionContext(input, lookup, solution)));
+  if (planError) {
+    if (planError instanceof SeedCycleError) {
+      return invalidOption(planError.message, planError.instructions);
+    }
+    throw planError;
+  }
+  input.options.signal?.throwIfAborted();
+  reportPlanning(run, plans, missing);
+  const cleared = await confirmOptionalClears(run, plans);
+  if (cleared.kind === "done")
+    return cleared.result;
+  const finalPlans = cleared.plans;
+  if (!hasWork(finalPlans)) {
+    if (run.errors.length === 0) {
+      writeProgress(nothingToSeed(finalPlans));
+    }
+    return finishIdle(run, finalPlans);
+  }
+  const refused = refuseWithoutTerminal(input, finalPlans);
+  if (refused)
+    return refused;
+  await writeApproved(run, finalPlans);
+  return finish(input.workspaceDir, run.summaries, run.errors, retry);
+}
+async function startRun(input, sdk, retry, notSeeded) {
+  const journalScope = {
+    organizationId: input.config.organizationId,
+    tenantId: input.config.tenantId,
+    organizationName: input.config.organizationName,
+    tenantName: input.config.tenantName,
+    folderKey: input.folderKey
+  };
+  const { journal, warning } = await readJournal(input.workspaceDir, journalScope);
+  if (warning)
+    writeWarning(warning);
+  return {
+    input,
+    sdk,
+    retry,
+    journal,
+    journalScope,
+    idMaps: new Map,
+    intendedIds: new Map,
+    summaries: [
+      ...notSeeded.noSeedFile.map((name) => emptySummary(name, "no-seed-file")),
+      ...notSeeded.notInScope.map((name) => emptySummary(name, "not-in-scope"))
+    ],
+    errors: []
+  };
+}
+async function readSeedFiles(input) {
+  const fs = getFileSystem();
+  const read = {
+    files: [],
+    empty: [],
+    invalid: [],
+    absent: []
+  };
+  for (const entityName of input.entityNames) {
+    const file = await readSeedFile(fs, input.workspaceDir, entityName);
+    if (file.kind === "absent") {
+      writeWarning(`Skipping "${entityName}": no seed file at ${file.path}.`);
+      read.absent.push(entityName);
+      continue;
+    }
+    const { strategy, warning } = readStrategy(input.manifest.dataFabric?.seeding?.[entityName]?.strategy);
+    if (warning)
+      writeWarning(warning);
+    if (file.kind === "invalid") {
+      read.invalid.push(`${entityName}.csv could not be read — ${file.why}`);
+      continue;
+    }
+    if (file.table.rows.length === 0) {
+      read.empty.push(entityName);
+      continue;
+    }
+    read.files.push({
+      entityName,
+      csv: file.csv,
+      rows: file.table.rows.length,
+      strategy
+    });
+  }
+  return read;
+}
+function workspaceGate(input, read, retry) {
+  const { files, empty, invalid, absent } = read;
+  if (invalid.length > 0) {
+    return failure("invalid-option", `Seed files could not be read: ${invalid.join("; ")}.`, `Fix the CSV (every opening quote needs a closing one), then retry with: ${retry}`, { result: RESULTS.ValidationError, errorCode: "invalid_argument" });
+  }
+  if (files.length === 0 && empty.length === 0 && absent.length > 0) {
+    return failure("invalid-option", `No seed files found in ${input.workspaceDir} for: ${absent.join(", ")}.`, `Write the templates with: ${retry} --refresh — or pass --dir <path> if the files live elsewhere.`, { result: RESULTS.ValidationError, errorCode: "invalid_argument" });
+  }
+  if (files.length > 0)
+    return;
+  for (const entityName of empty) {
+    writeProgress(`  ${entityName}: no rows in ${entityName}.csv — fill it in to seed this entity`);
+  }
+  writeProgress("No seeding CSV files with data found.");
+  return {
+    ok: true,
+    workspaceDir: input.workspaceDir,
+    summaries: input.entityNames.map((name) => emptySummary(name, absent.includes(name) ? "no-seed-file" : undefined))
+  };
+}
+async function connectSeedSdk(input) {
+  const [sdkError, sdk] = await catchError(input.deps.createSdk({
+    tenant: input.options.tenant,
+    loginValidity: input.options.loginValidity
+  }));
+  if (sdkError || !sdk) {
+    return failure("service-error", `Could not connect to Data Fabric: ${sdkError?.message ?? "unknown error"}`, "Run 'uip login' and check that the tenant has Data Fabric enabled.");
+  }
+  return { ok: true, sdk };
+}
+var SOLUTION_RESOURCE = /%\{\s*(?:Solution\.(?!Folder(?:Path|Key)\s*\}%)|UIPATH_FOLDER_ID\s*\}%)/;
+var SOLUTION_COLLECTION = /%\{\s*Solution\.(Processes|Assets|StorageBuckets|Connections)\[/g;
+function namedCollections(files) {
+  const wanted = new Set;
+  for (const file of files) {
+    for (const [, name] of file.csv.matchAll(SOLUTION_COLLECTION)) {
+      const collection = SOLUTION_COLLECTIONS.find((known) => known === name);
+      if (collection)
+        wanted.add(collection);
+    }
+  }
+  return wanted;
+}
+async function readSolution(input, read) {
+  if (input.folderKey === undefined)
+    return {};
+  if (!read.files.some((file) => SOLUTION_RESOURCE.test(file.csv))) {
+    return { folderPath: await findSolutionFolderPath(input) };
+  }
+  const resources = await readSolutionResources(input.config, input.folderKey, namedCollections(read.files), input.options.signal);
+  for (const warning of resources.warnings)
+    writeWarning(warning);
+  return {
+    folderPath: resources.folder?.path ?? await findSolutionFolderPath(input),
+    resources
+  };
+}
+async function findSolutionFolderPath(input) {
+  if (input.folderKey === undefined)
+    return;
+  const [, path] = await catchError(findFolderPath(input.config, input.folderKey, input.options.signal));
+  return path;
+}
+function printSeedTarget(input, read, solutionFolderPath) {
+  const fs = getFileSystem();
+  const scope = input.folderKey ? `solution folder ${solutionFolderPath ?? input.folderKey}` : "tenant-level entities";
+  writeProgress(`
+Seeding workspace: ${fs.path.resolve(input.workspaceDir)}`);
+  writeProgress("  (edit the CSVs there to change what gets seeded)");
+  writeProgress(`Target: ${input.config.organizationName ?? "?"} / ${input.config.tenantName ?? "?"} — ${scope}`);
+  for (const file of read.files) {
+    writeProgress(`  ${file.entityName}: ${file.rows} row(s) — strategy: ${file.strategy}`);
+  }
+  for (const entityName of read.empty) {
+    writeProgress(`  ${entityName}: no rows in ${entityName}.csv — fill it in to seed this entity`);
+  }
+}
+async function resolveLiveSchema(input, sdk, files) {
+  const where = input.folderKey ? `folder scope ${input.folderKey}` : "the tenant-level schema";
+  const [lookupError, lookup] = await catchError(loadLiveEntities(sdk, input.folderKey));
+  if (lookupError || !lookup) {
+    return failure("service-error", `Could not read the Data Fabric schema: ${lookupError?.message ?? "unknown error"}`, input.folderKey === undefined ? "If the package provisions its entities inside the solution folder, pass --folder-key." : "Check that --folder-key names the folder the solution was installed into.");
+  }
+  const entityFor = (file) => lookup.byName.get(file.entityName.toLowerCase());
+  const federated = files.filter((file) => entityFor(file)?.isFederated === true).map((file) => file.entityName);
+  if (federated.length > 0) {
+    return failure("invalid-option", `These entities read from an external source and cannot be seeded: ${federated.join(", ")}.`, "A federated entity mirrors data held elsewhere, so records are written at the " + "source, not here. Remove those CSVs from the seed workspace, or seed the " + "native entity the package means instead.", { result: RESULTS.ValidationError });
+  }
+  const present = files.flatMap((file) => {
+    const entity = entityFor(file);
+    return entity ? [{ ...file, entity }] : [];
+  });
+  const missing = files.filter((file) => entityFor(file) === undefined).map((file) => file.entityName);
+  if (present.length === 0) {
+    return failure("service-error", `None of the seeding entities exist in ${where}: ${missing.join(", ")}.`, input.folderKey === undefined ? "New-structure packages provision entities inside the installed solution folder. " + "Re-deploy the package (the deploy records the folder in .seed-context.json) " + "or pass --folder-key <guid>." : `Folder ${input.folderKey} shows none of these entities to this login. Either the ` + "solution installed elsewhere — it installs into its own child folder under the " + "target; check 'uip solution deploy list' for the installed folder — or this login " + "has no role in that folder: an external application needs a folder role with " + "Data Fabric permissions there (the built-in Automation User role is enough).");
+  }
+  if (missing.length > 0) {
+    writeWarning(`Skipping entities missing from ${where}: ${missing.join(", ")}`);
+  }
+  return { ok: true, lookup, present, missing };
+}
+
+// src/services/seed-run/service-url.ts
+function readSeedServiceUrl(raw, context, tenant) {
+  if (raw !== undefined)
+    return readServiceUrl(raw, tenant);
+  const recorded = context?.serviceUrl;
+  if (recorded === undefined || recorded === "") {
+    return { ok: true, value: undefined };
+  }
+  if (tenant !== undefined) {
+    writeWarning(`Ignoring the service URL recorded in .seed-context.json (${hostOf(recorded)}): ` + "--tenant was given, and a service URL carries the login's own tenant.");
+    return { ok: true, value: undefined };
+  }
+  const resolved = readServiceUrl(recorded);
+  if (resolved.ok && resolved.value !== undefined && isLoopbackUrl(resolved.value)) {
+    return { ok: true, value: resolved.value };
+  }
+  writeWarning(`Ignoring the service URL recorded in .seed-context.json (${hostOf(recorded)}): ` + "a service other than the platform's is only used with an explicit --service-url.");
+  return { ok: true, value: undefined };
+}
+function isLoopbackUrl(value) {
+  const [, url] = catchError(() => new URL(value));
+  return url !== undefined && url !== null && isLoopbackHost(url);
+}
+function hostOf(value) {
+  const [, url] = catchError(() => new URL(value));
+  return url?.hostname ?? "not a URL";
+}
+
+// src/services/seed-service.ts
+async function runSeed(options, deps) {
+  const blank = rejectBlankOptions(options);
+  if (blank)
+    return blank;
+  const [locateError, located] = await catchError(() => locateWorkspace(options, deps));
+  if (locateError || !located) {
+    return failure("service-error", `The seed workspace could not be read: ${locateError?.message ?? "unknown error"}.`, "Check that ./seeding and the package folder under it are readable and are real " + "folders, then run the same command again. Pass --dir <path> to seed a folder elsewhere.", await workspaceFault(locateError));
+  }
+  if (!located.ok)
+    return located;
+  if (located.creating) {
+    const created = await createWorkspace(located.workspaceDir);
+    if (created)
+      return created;
+  }
+  const [lockError, release] = await catchError(acquireSeedWorkspaceLock(located.workspaceDir));
+  if (lockError || !release) {
+    return failure("service-error", `Could not lock the seed workspace ${located.workspaceDir}: ${lockError?.message ?? "no lock"}.`, "Wait for another deploy or seed to finish, and check that the workspace folder is " + "writable, then run the same command again.", await workspaceFault(lockError));
+  }
+  try {
+    const creating = located.creating && await readSeedContext(located.workspaceDir) === undefined;
+    return await runSeedLocked(options, deps, { ...located, creating });
+  } finally {
+    await catchError(release());
+  }
+}
+async function workspaceFault(error) {
+  const details = error ? await extractErrorDetails(error) : undefined;
+  return details?.errorCode === "local_permission_denied" ? { errorCode: "local_permission_denied", retry: "RetryWillNotFix" } : { errorCode: "network_error", retry: "RetryLater" };
+}
+async function createWorkspace(workspaceDir) {
+  const fs = getFileSystem();
+  const [mkdirError] = typeof fs.mkdir === "function" ? await catchError(fs.mkdir(workspaceDir)) : [undefined];
+  if (mkdirError) {
+    return failure("service-error", `Could not create the seed workspace ${workspaceDir}: ${mkdirError.message}.`, "Check that the parent folder is writable, then run the same command again.", await workspaceFault(mkdirError));
+  }
+  const [checkError, checked] = await catchError(async () => await namesSeedRoot(workspaceDir) ? insideSeedRoot(workspaceDir) : { ok: true, dir: workspaceDir });
+  if (checkError || !checked) {
+    return failure("service-error", `The seed workspace ${workspaceDir} could not be checked: ` + `${checkError?.message ?? "unknown error"}.`, "Check that ./seeding and the package folder under it are readable and are " + "real folders, then run the same command again.", await workspaceFault(checkError));
+  }
+  if (!checked.ok) {
+    return failure("invalid-option", checked.message, checked.instructions, {
+      result: RESULTS.ValidationError
+    });
+  }
+  return;
+}
+async function runSeedLocked(options, deps, located) {
+  const { workspaceDir, creating } = located;
+  const recorded = await readSeedContext(workspaceDir);
+  const packageName = options.packageName ?? recorded?.packageName;
+  const context = packageName ? contextForPackage(recorded, packageName) : recorded;
+  const packageVersion = options.packageVersion ?? context?.packageVersion;
+  if (!packageName || !packageVersion) {
+    return failure("missing-option", "The package coordinates could not be determined for this seed workspace.", "Pass --package-name <name> and --package-version <version>. A successful deploy " + "normally records them in .seed-context.json.", { result: RESULTS.ValidationError });
+  }
+  const serviceUrl = readSeedServiceUrl(options.serviceUrl, context, options.tenant);
+  if (!serviceUrl.ok)
+    return serviceUrl;
+  const [authError, config] = await catchError(createVssConfig({
+    tenant: options.tenant,
+    loginValidity: options.loginValidity,
+    serviceUrl: serviceUrl.value
+  }));
+  if (authError || !config) {
+    return failure("service-error", authError?.message ?? "Could not resolve UiPath credentials.", "Run 'uip login' first. In CI, set UIPATH_CLI_ENABLE_ENV_AUTH=true with UIPATH_CLI_AUTH_TOKEN.", { result: RESULTS.AuthenticationError });
+  }
+  const sameTenant = checkContextTenant(recorded, config, options);
+  if (sameTenant !== undefined)
+    return sameTenant;
+  const [manifestError, manifest] = await catchError(getManifest(config, packageName, packageVersion, options.signal));
+  if (manifestError || !manifest) {
+    return toDeployFailure(manifestError, `Could not read the manifest of ${packageName} ${packageVersion}`);
+  }
+  const entityNames = Object.keys(manifest.dataFabric?.seeding ?? {});
+  if (entityNames.length === 0) {
+    return { ok: true, workspaceDir, summaries: [] };
+  }
+  const unusable = unusableEntityNames(entityNames);
+  if (unusable)
+    return unusable;
+  const colliding = caseCollisions(entityNames);
+  if (colliding)
+    return colliding;
+  const scope = await refreshAndScope({
+    config,
+    manifest,
+    context,
+    workspaceDir,
+    creating,
+    packageName,
+    packageVersion,
+    serviceUrl: serviceUrl.value,
+    options,
+    lockHeld: true
+  });
+  if (!scope.ok)
+    return scope;
+  return seedEntities({
+    config,
+    manifest,
+    entityNames,
+    workspaceDir,
+    folderKey: scope.folderKey,
+    options,
+    deps,
+    pickedWorkspace: located.picked === true
+  });
+}
+function unusableEntityNames(entityNames) {
+  const unusable = entityNames.filter((name) => entityNameProblem(name));
+  if (unusable.length === 0)
+    return;
+  return failure("invalid-option", `The package manifest names seeding entities that cannot be seed file names: ${unusable.map((name) => JSON.stringify(name)).join(", ")}.`, "Fix the entity names under dataFabric.seeding in the package manifest and republish the package.", { result: RESULTS.ValidationError, errorCode: "invalid_argument" });
+}
+function caseCollisions(entityNames) {
+  const byFolded = new Map;
+  for (const name of entityNames) {
+    const folded = name.toLowerCase();
+    byFolded.set(folded, [...byFolded.get(folded) ?? [], name]);
+  }
+  const clashes = [...byFolded.values()].filter((names) => names.length > 1);
+  if (clashes.length === 0)
+    return;
+  return failure("invalid-option", `The package manifest names the same seeding entity more than once, in different case: ${clashes.map((names) => names.map((name) => JSON.stringify(name)).join(" and ")).join("; ")}.`, "Keep one spelling of each entity under dataFabric.seeding in the package manifest and republish the package.", { result: RESULTS.ValidationError, errorCode: "invalid_argument" });
+}
+async function isEmptyDir(dir) {
+  const fs = getFileSystem();
+  if (typeof fs.readdir !== "function")
+    return false;
+  const [error, entries] = await catchError(fs.readdir(dir));
+  return error === undefined && entries !== undefined && entries.length === 0;
+}
+async function locateWorkspace(options, deps) {
+  const located = await resolveSeedDir({
+    dir: options.dir,
+    packageName: options.packageName,
+    pickOne: deps.pickOne
+  });
+  if (located.ok) {
+    const creating = options.packageName !== undefined && options.packageVersion !== undefined && await isEmptyDir(located.dir);
+    return {
+      ok: true,
+      workspaceDir: located.dir,
+      creating,
+      ...located.picked ? { picked: true } : {}
+    };
+  }
+  if (located.missing && options.packageName !== undefined && options.packageVersion !== undefined) {
+    writeProgress(`No seed workspace for ${options.packageName} yet; creating it from the ` + `${options.packageVersion} seed templates.`);
+    return {
+      ok: true,
+      workspaceDir: packageDir(options.packageName),
+      creating: true
+    };
+  }
+  return failure("invalid-option", located.message, located.instructions, {
+    result: RESULTS.ValidationError
+  });
+}
+async function recordSeedContext(context) {
+  return writeSeedContext(context);
+}
+export {
+  recordSeedContext,
+  runSeed
+};
+
+//# debugId=02A50C129DE0952164756E2164756E21