@treeseed/cli 0.4.11 → 0.5.1

package/dist/cli/handlers/config.js

@@ -1,10 +1,14 @@
 import {
+  applyTreeseedConfigValues,
   applyTreeseedSafeRepairs,
   collectTreeseedConfigContext,
+  ensureTreeseedActVerificationTooling,
+  ensureTreeseedSecretSessionForConfig,
   findNearestTreeseedRoot
 } from "@treeseed/sdk/workflow-support";
 import { fail, guidedResult } from "./utils.js";
 import { buildCliConfigPages, runCliConfigEditor } from "./config-ui.js";
+import { promptForNewPassphrase, promptHidden } from "./secret-prompts.js";
 import { createWorkflowSdk, renderWorkflowNextSteps, workflowErrorResult } from "./workflow.js";
 function normalizeConfigScopes(value) {
   const requested = Array.isArray(value) ? value.map(String) : typeof value === "string" ? [value] : ["all"];
@@ -31,11 +35,85 @@ function formatPrintEnvReports(payload) {
   }
   return lines.filter((line, index, all) => !(line === "" && all[index - 1] === ""));
 }
+function resolveMouseEnabled(value, env) {
+  if (value === true) {
+    return true;
+  }
+  const envValue = env.TREESEED_UI_MOUSE;
+  return envValue === "1" || envValue === "true";
+}
+function configReadinessLabel(readiness) {
+  if (!readiness) {
+    return "pending";
+  }
+  if (typeof readiness.phase === "string" && readiness.phase.length > 0) {
+    return readiness.phase;
+  }
+  if (readiness.deployable) {
+    return "deployable";
+  }
+  if (readiness.provisioned) {
+    return "provisioned";
+  }
+  if (readiness.configured) {
+    return "config_complete";
+  }
+  return "pending";
+}
+function describeSecretBootstrap(secretSession) {
+  if (!secretSession?.status) {
+    return "(unknown)";
+  }
+  if (secretSession.createdWrappedKey) {
+    return secretSession.unlockSource === "env" ? "created via env passphrase" : "created via interactive passphrase";
+  }
+  if (secretSession.migratedWrappedKey) {
+    return secretSession.unlockSource === "env" ? "migrated via env passphrase" : "migrated via interactive passphrase";
+  }
+  if (secretSession.unlockSource === "existing-session") {
+    return secretSession.status.unlocked ? "already unlocked" : "locked";
+  }
+  return secretSession.unlockSource === "env" ? "unlocked via env passphrase" : "unlocked interactively";
+}
+function describeInteractiveSecretBootstrap(secretSession) {
+  if (!secretSession?.status) {
+    return void 0;
+  }
+  if (secretSession.createdWrappedKey) {
+    return "Wrapped machine key created and unlocked.";
+  }
+  if (secretSession.migratedWrappedKey) {
+    return "Legacy machine key wrapped and unlocked.";
+  }
+  if (secretSession.unlockSource === "interactive") {
+    return "Wrapped machine key unlocked.";
+  }
+  if (secretSession.unlockSource === "env") {
+    return "Wrapped machine key unlocked from TREESEED_KEY_PASSPHRASE.";
+  }
+  return void 0;
+}
+function describeSharedStorageMigrations(migrations) {
+  if (!Array.isArray(migrations) || migrations.length === 0) {
+    return void 0;
+  }
+  return migrations.map((migration) => {
+    const label = typeof migration.label === "string" && migration.label.length > 0 ? migration.label : migration.entryId;
+    const promotedFrom = typeof migration.promotedFrom === "string" ? migration.promotedFrom : "staging";
+    const scopes = Array.isArray(migration.consolidatedScopes) && migration.consolidatedScopes.length > 0 ? migration.consolidatedScopes.join("/") : promotedFrom;
+    return migration.hadConflicts ? `${label} consolidated from ${scopes} using ${promotedFrom}` : `${label} promoted from ${promotedFrom}`;
+  }).join("; ");
+}
 function renderConfigResult(commandName, result) {
   const payload = result.payload;
   const toolHealth = payload.toolHealth;
+  const configContext = payload.context;
+  const configReadiness = configContext?.configReadinessByScope?.local ?? {};
   const readinessByScope = payload.result?.readinessByScope ?? {};
-  const summary = payload.mode === "print-env-only" ? "Treeseed config environment report completed." : payload.mode === "rotate-machine-key" ? "Treeseed machine key rotated successfully." : "Treeseed config completed successfully.";
+  const secretSession = payload.secretSession;
+  const sharedStorageMigrations = payload.result?.sharedStorageMigrations;
+  const summary = payload.mode === "print-env-only" ? "Treeseed config environment report completed." : payload.mode === "rotate-machine-key" ? "Treeseed machine key rotated successfully." : payload.mode === "connect-market" ? "Knowledge Coop pairing completed successfully." : "Treeseed config completed successfully.";
+  const market = payload.market;
   return guidedResult({
     command: commandName,
     summary,
@@ -46,13 +124,28 @@ function renderConfigResult(commandName, result) {
       { label: "Safe repairs", value: Array.isArray(payload.repairs) ? payload.repairs.length : 0 },
       { label: "Machine config", value: payload.configPath },
       { label: "Machine key", value: payload.keyPath },
-      { label: "Local readiness", value: readinessByScope.local?.deployable ? "deployable" : readinessByScope.local?.configured ? "configured" : "pending" },
-      { label: "Staging readiness", value: readinessByScope.staging?.deployable ? "deployable" : readinessByScope.staging?.provisioned ? "provisioned" : readinessByScope.staging?.configured ? "configured" : "pending" },
-      { label: "Prod readiness", value: readinessByScope.prod?.deployable ? "deployable" : readinessByScope.prod?.provisioned ? "provisioned" : readinessByScope.prod?.configured ? "configured" : "pending" },
+      { label: "Secrets session", value: describeSecretBootstrap(secretSession) },
+      { label: "Shared consolidations", value: describeSharedStorageMigrations(sharedStorageMigrations) },
+      { label: "Local readiness", value: configReadinessLabel(readinessByScope.local) },
+      { label: "Staging readiness", value: configReadinessLabel(readinessByScope.staging) },
+      { label: "Prod readiness", value: configReadinessLabel(readinessByScope.prod) },
+      { label: "GitHub token/config", value: configReadiness.github?.configured ? "configured" : "missing" },
+      { label: "Cloudflare token/config", value: configReadiness.cloudflare?.configured ? "configured" : "missing" },
+      { label: "Railway token/config", value: configReadiness.railway?.configured ? "configured" : "missing" },
       { label: "GitHub CLI", value: toolHealth?.githubCli?.available ? "ready" : "missing" },
+      { label: "Wrangler CLI", value: toolHealth?.wranglerCli?.available ? "ready" : "missing" },
+      { label: "Railway CLI", value: toolHealth?.railwayCli?.available ? "ready" : "missing" },
       { label: "gh act", value: toolHealth?.ghActExtension?.available ? "ready" : "missing" },
       { label: "Docker", value: toolHealth?.dockerDaemon?.available ? "ready" : "missing" },
-      { label: "ACT verify", value: toolHealth?.actVerificationReady ? "ready" : "not ready" }
+      { label: "ACT verify", value: toolHealth?.actVerificationReady ? "ready" : "not ready" },
+      ...market ? [
+        { label: "Market base URL", value: market.baseUrl ?? "(none)" },
+        { label: "Market team", value: market.teamSlug ?? market.teamId ?? "(none)" },
+        { label: "Market project", value: market.projectSlug ?? market.projectId ?? "(none)" },
+        { label: "Hub mode", value: market.hubMode ?? "(unknown)" },
+        { label: "Runtime mode", value: market.runtimeMode ?? "(unknown)" },
+        { label: "Runtime ready", value: market.runtimeReady ? "yes" : "no" }
+      ] : []
     ],
     nextSteps: renderWorkflowNextSteps(result),
     report: payload
@@ -66,35 +159,86 @@ const handleConfig = async (invocation, context) => {
     });
     const scopes = normalizeConfigScopes(invocation.args.environment);
     const sync = invocation.args.sync;
-    const interactive = context.outputFormat !== "json" && process.stdin.isTTY && process.stdout.isTTY;
-    if (interactive && invocation.args.printEnvOnly !== true && invocation.args.rotateMachineKey !== true) {
+    const interactive = context.outputFormat !== "json" && context.interactiveUi !== false && process.stdin.isTTY && process.stdout.isTTY;
+    const nonInteractive = invocation.args.nonInteractive === true || context.outputFormat === "json";
+    const operationalMode = invocation.args.printEnvOnly === true || invocation.args.rotateMachineKey === true || invocation.args.connectMarket === true;
+    if (!interactive && !nonInteractive && !operationalMode) {
+      return fail("Treeseed config requires a TTY for the interactive editor. Re-run in a terminal, or use --non-interactive, --json, --print-env-only, --rotate-machine-key, or --connect-market.");
+    }
+    if (interactive && !nonInteractive && !operationalMode) {
       const tenantRoot = findNearestTreeseedRoot(context.cwd) ?? context.cwd;
       if (!tenantRoot) {
         return fail("Treeseed config requires a Treeseed project. Run the command from inside a tenant or initialize one first.");
       }
       applyTreeseedSafeRepairs(tenantRoot);
+      const toolAvailability = ensureTreeseedActVerificationTooling({
+        tenantRoot,
+        installIfMissing: invocation.args.installMissingTooling === true,
+        env: context.env,
+        write: context.write
+      });
+      const secretSession = await ensureTreeseedSecretSessionForConfig({
+        tenantRoot,
+        interactive: true,
+        env: context.env,
+        promptForPassphrase: () => promptHidden("Treeseed passphrase: "),
+        promptForNewPassphrase
+      });
       const configContext = collectTreeseedConfigContext({
         tenantRoot,
         scopes,
         env: context.env
       });
+      const initialViewMode = (() => {
+        if (invocation.args.full === true) {
+          return "full";
+        }
+        return buildCliConfigPages(configContext, "local", {}, "startup").length > 0 ? "startup" : "full";
+      })();
       const editorResult = await runCliConfigEditor(configContext, {
-        initialViewMode: invocation.args.full === true ? "full" : "startup"
+        initialViewMode,
+        mouseEnabled: resolveMouseEnabled(invocation.args.mouse, context.env),
+        initialStatusMessage: describeInteractiveSecretBootstrap(secretSession),
+        toolAvailability,
+        secretSession,
+        onCommit: async (update) => {
+          applyTreeseedConfigValues({
+            tenantRoot,
+            updates: [{
+              scope: update.scope,
+              entryId: update.entryId,
+              value: update.value,
+              reused: false
+            }]
+          });
+          return collectTreeseedConfigContext({
+            tenantRoot,
+            scopes,
+            env: context.env
+          });
+        }
       });
       if (editorResult === null) {
         return fail("Treeseed config canceled.");
       }
-      const updates = buildCliConfigPages(configContext, "all", editorResult.overrides, "full").map((page) => ({
+      const refreshedContext = collectTreeseedConfigContext({
+        tenantRoot,
+        scopes,
+        env: context.env
+      });
+      const updates = refreshedContext.scopes.flatMap((scope) => buildCliConfigPages(refreshedContext, scope, editorResult.overrides, "full")).filter((page, index, allPages) => allPages.findIndex((candidate) => candidate.key === page.key) === index).map((page) => ({
         scope: page.scope,
         entryId: page.entry.id,
         value: page.finalValue,
         reused: !(page.key in editorResult.overrides)
       }));
+      context.write("Applying config updates, validating environments, and syncing managed providers...", "stdout");
       const result2 = await workflow.config({
         environment: scopes,
         sync,
         printEnv: invocation.args.printEnv === true,
         showSecrets: invocation.args.showSecrets === true,
+        installMissingTooling: invocation.args.installMissingTooling === true,
         nonInteractive: true,
         updates
       });
@@ -107,7 +251,17 @@ const handleConfig = async (invocation, context) => {
       printEnvOnly: invocation.args.printEnvOnly === true,
       showSecrets: invocation.args.showSecrets === true,
       rotateMachineKey: invocation.args.rotateMachineKey === true,
-      nonInteractive: context.outputFormat === "json"
+      connectMarket: invocation.args.connectMarket === true,
+      marketBaseUrl: typeof invocation.args.marketBaseUrl === "string" ? invocation.args.marketBaseUrl : void 0,
+      marketTeamId: typeof invocation.args.marketTeamId === "string" ? invocation.args.marketTeamId : void 0,
+      marketTeamSlug: typeof invocation.args.marketTeamSlug === "string" ? invocation.args.marketTeamSlug : void 0,
+      marketProjectId: typeof invocation.args.marketProjectId === "string" ? invocation.args.marketProjectId : void 0,
+      marketProjectSlug: typeof invocation.args.marketProjectSlug === "string" ? invocation.args.marketProjectSlug : void 0,
+      marketProjectApiBaseUrl: typeof invocation.args.marketProjectApiBaseUrl === "string" ? invocation.args.marketProjectApiBaseUrl : void 0,
+      marketAccessToken: typeof invocation.args.marketAccessToken === "string" ? invocation.args.marketAccessToken : void 0,
+      rotateRunnerToken: invocation.args.rotateRunnerToken === true,
+      installMissingTooling: invocation.args.installMissingTooling === true,
+      nonInteractive
     });
     if (context.outputFormat !== "json" && result.payload.mode === "print-env-only") {
       return {

package/dist/cli/handlers/destroy.js

@@ -24,6 +24,7 @@ const handleDestroy = async (invocation, context) => {
       }
     }).destroy({
       environment: String(invocation.args.environment),
+      plan: invocation.args.plan === true || invocation.args.dryRun === true,
       dryRun: invocation.args.dryRun === true,
       force: invocation.args.force === true,
       removeBuildArtifacts: invocation.args.removeBuildArtifacts === true
@@ -31,14 +32,14 @@ const handleDestroy = async (invocation, context) => {
     const payload = result.payload;
     return guidedResult({
       command: invocation.commandName || "destroy",
-      summary: payload.dryRun ? "Treeseed destroy dry run completed." : "Treeseed destroy completed successfully.",
+      summary: result.executionMode === "plan" ? "Treeseed destroy plan ready." : "Treeseed destroy completed successfully.",
       facts: [
         { label: "Environment", value: payload.scope },
         { label: "Dry run", value: payload.dryRun ? "yes" : "no" },
         { label: "Removed build artifacts", value: payload.removeBuildArtifacts ? "yes" : "no" }
       ],
       nextSteps: renderWorkflowNextSteps(result),
-      report: payload
+      report: result
     });
   } catch (error) {
     return workflowErrorResult(error);

package/dist/cli/handlers/dev.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, resolve } from "node:path";
+import { resolveTreeseedLaunchEnvironment } from "@treeseed/sdk/workflow-support";
 import { workflowErrorResult } from "./workflow.js";
 const require2 = createRequire(import.meta.url);
 function resolveCoreDevEntrypoint(cwd) {
@@ -46,7 +47,11 @@ const handleDev = async (invocation, context) => {
     const args = watch ? [...resolved.args, "--watch"] : resolved.args;
     const result = context.spawn(resolved.command, args, {
       cwd: context.cwd,
-      env: context.env,
+      env: resolveTreeseedLaunchEnvironment({
+        tenantRoot: context.cwd,
+        scope: "local",
+        baseEnv: { ...process.env, ...context.env ?? {} }
+      }),
       stdio: "inherit"
     });
     return {

package/dist/cli/handlers/doctor.js

@@ -1,54 +1,89 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
 import { collectCliPreflight } from "@treeseed/sdk/workflow-support";
 import { guidedResult } from "./utils.js";
-import { resolveTreeseedWorkflowState } from "../workflow-state.js";
 import { applyTreeseedSafeRepairs } from "../repair.js";
-const handleDoctor = (invocation, context) => {
-  const performedFixes = invocation.args.fix === true && resolveTreeseedWorkflowState(context.cwd).deployConfigPresent ? applyTreeseedSafeRepairs(context.cwd) : [];
-  const state = resolveTreeseedWorkflowState(context.cwd);
-  const preflight = collectCliPreflight({ cwd: context.cwd, requireAuth: false });
-  const railwayManagedServicesEnabled = Object.values(state.managedServices).some((service) => service.enabled);
-  const mustFixNow = [];
-  const optional = [];
-  if (!state.workspaceRoot) mustFixNow.push("Run Treeseed inside a Treeseed workspace so package commands and workflow state can resolve correctly.");
-  if (!state.repoRoot) mustFixNow.push("Initialize or clone the git repository before using save, close, stage, or release flows.");
-  if (!state.deployConfigPresent) mustFixNow.push("Create or restore treeseed.site.yaml so the tenant contract can be loaded.");
-  if (preflight.missingCommands.includes("git")) mustFixNow.push("Install Git.");
-  if (preflight.missingCommands.includes("npm")) mustFixNow.push("Install npm 10 or newer.");
-  if (!state.files.machineConfig) mustFixNow.push("Run `treeseed config --environment local` to create the local machine config.");
-  if (!state.files.envLocal) optional.push("Create `.env.local` or run `treeseed config --environment local` to generate it.");
-  if (!state.files.devVars) optional.push("Generate `.dev.vars` by running `treeseed config --environment local`.");
-  if (!state.auth.gh) optional.push("Configure `GH_TOKEN` for GitHub CLI automation and Copilot-backed workflows.");
-  if (!state.auth.wrangler) optional.push("Configure `CLOUDFLARE_API_TOKEN` before staging, preview, or production deployment work.");
-  if (!state.auth.railway && railwayManagedServicesEnabled) {
-    optional.push("Configure `RAILWAY_API_TOKEN` before deploying the managed Railway services.");
+import { createWorkflowSdk, workflowErrorResult } from "./workflow.js";
+const handleDoctor = async (invocation, context) => {
+  try {
+    const status = await createWorkflowSdk(context).status();
+    const state = status.payload;
+    const performedFixes = invocation.args.fix === true && state.deployConfigPresent ? applyTreeseedSafeRepairs(state.cwd) : [];
+    const preflight = collectCliPreflight({ cwd: context.cwd, requireAuth: false });
+    const railwayManagedServicesEnabled = Object.values(state.managedServices).some((service) => service.enabled);
+    const mustFixNow = [];
+    const optional = [];
+    if (!state.workspaceRoot) mustFixNow.push("Run Treeseed inside a Treeseed workspace so package commands and workflow state can resolve correctly.");
+    if (!state.repoRoot) mustFixNow.push("Initialize or clone the git repository before using save, close, stage, or release flows.");
+    if (!state.deployConfigPresent) mustFixNow.push("Create or restore treeseed.site.yaml so the tenant contract can be loaded.");
+    if (preflight.missingCommands.includes("git")) mustFixNow.push("Install Git.");
+    if (preflight.missingCommands.includes("npm")) mustFixNow.push("Install npm 10 or newer.");
+    if (!state.files.machineConfig) mustFixNow.push("Run `treeseed config --environment local` to create the local machine config.");
+    if (!state.secrets.wrappedKeyPresent) mustFixNow.push("Run `treeseed secrets:unlock` to create the wrapped machine key used for local secret storage.");
+    if (state.secrets.migrationRequired) mustFixNow.push("Run `treeseed secrets:migrate-key` to replace the legacy plaintext machine key with the wrapped format.");
+    if (state.packageSync.blockers.length > 0) mustFixNow.push(...state.packageSync.blockers);
+    if (state.workflowControl.lock.active && state.workflowControl.lock.runId) {
+      mustFixNow.push(`Active workflow lock detected for run ${state.workflowControl.lock.runId}. Use \`treeseed recover\` before starting another mutating command.`);
+    }
+    if (state.workflowControl.interruptedRuns.length > 0) {
+      mustFixNow.push(`Interrupted workflow runs detected. Resume the latest run with \`treeseed resume ${state.workflowControl.interruptedRuns[0].runId}\` or inspect \`treeseed recover\`.`);
+    }
+    if (state.packageSync.completeCheckout) {
+      for (const repo of state.packageSync.repos) {
+        const publishWorkflowPath = resolve(state.cwd, repo.path, ".github", "workflows", "publish.yml");
+        if (!existsSync(publishWorkflowPath)) {
+          mustFixNow.push(`${repo.name} is missing .github/workflows/publish.yml required for recursive release.`);
+        }
+      }
+    }
+    for (const workflowName of ["verify.yml", "deploy.yml"]) {
+      const workflowPath = resolve(state.cwd, ".github", "workflows", workflowName);
+      if (!existsSync(workflowPath)) {
+        mustFixNow.push(`Missing root workflow contract .github/workflows/${workflowName}.`);
+      }
+    }
+    if (!state.auth.gh) optional.push("Configure GitHub token/config (`GH_TOKEN`) for GitHub CLI automation and Copilot-backed workflows.");
+    if (!state.auth.wrangler) optional.push("Configure Cloudflare token/config (`CLOUDFLARE_API_TOKEN`) before staging, preview, or production deployment work.");
+    if (!state.auth.railway && railwayManagedServicesEnabled) {
+      optional.push("Configure Railway token/config (`RAILWAY_API_TOKEN`) before deploying the managed Railway services.");
+    }
+    if (!state.auth.remoteApi && state.managedServices.api.enabled) {
+      optional.push("Run `treeseed auth:login` so the CLI can use the configured remote API.");
+    }
+    if (state.secrets.wrappedKeyPresent && !state.secrets.keyAgentUnlocked) {
+      optional.push("Run `treeseed secrets:unlock` before starting secret-backed dev, deploy, or runner commands.");
+    }
+    if (!state.secrets.keyAgentRunning) {
+      optional.push("The Treeseed key-agent is not running yet. It will start automatically when you unlock the secret session.");
+    }
+    if (!state.auth.copilot) optional.push("Configure `GH_TOKEN` if you rely on local Copilot-assisted workflows.");
+    return guidedResult({
+      command: "doctor",
+      summary: mustFixNow.length === 0 ? "Treeseed doctor found no blocking issues." : "Treeseed doctor found issues that need attention.",
+      facts: [
+        { label: "Must fix now", value: mustFixNow.length },
+        { label: "Optional follow-up", value: optional.length },
+        { label: "Safe fixes applied", value: performedFixes.length },
+        { label: "Branch", value: state.branchName ?? "(none)" },
+        { label: "Workspace root", value: state.workspaceRoot ? "yes" : "no" }
+      ],
+      nextSteps: [
+        ...mustFixNow.map((item) => item),
+        ...mustFixNow.length === 0 ? optional : optional.map((item) => `Optional: ${item}`)
+      ],
+      report: {
+        ...status,
+        state,
+        preflight,
+        performedFixes,
+        mustFixNow,
+        optional
+      },
+      exitCode: mustFixNow.length === 0 ? 0 : 1
+    });
+  } catch (error) {
+    return workflowErrorResult(error);
   }
-  if (!state.auth.remoteApi && state.managedServices.api.enabled) {
-    optional.push("Run `treeseed auth:login` so the CLI can use the configured remote API.");
-  }
-  if (!state.auth.copilot) optional.push("Configure `GH_TOKEN` if you rely on local Copilot-assisted workflows.");
-  return guidedResult({
-    command: "doctor",
-    summary: mustFixNow.length === 0 ? "Treeseed doctor found no blocking issues." : "Treeseed doctor found issues that need attention.",
-    facts: [
-      { label: "Must fix now", value: mustFixNow.length },
-      { label: "Optional follow-up", value: optional.length },
-      { label: "Safe fixes applied", value: performedFixes.length },
-      { label: "Branch", value: state.branchName ?? "(none)" },
-      { label: "Workspace root", value: state.workspaceRoot ? "yes" : "no" }
-    ],
-    nextSteps: [
-      ...mustFixNow.map((item) => item),
-      ...mustFixNow.length === 0 ? optional : optional.map((item) => `Optional: ${item}`)
-    ],
-    report: {
-      state,
-      preflight,
-      performedFixes,
-      mustFixNow,
-      optional
-    },
-    exitCode: mustFixNow.length === 0 ? 0 : 1
-  });
 };
 export {
   handleDoctor

package/dist/cli/handlers/recover.d.ts

@@ -0,0 +1,2 @@
+import type { TreeseedCommandHandler } from '../types.js';
+export declare const handleRecover: TreeseedCommandHandler;

package/dist/cli/handlers/recover.js

@@ -0,0 +1,25 @@
+import { guidedResult } from "./utils.js";
+import { createWorkflowSdk, renderWorkflowNextSteps, workflowErrorResult } from "./workflow.js";
+const handleRecover = async (_invocation, context) => {
+  try {
+    const result = await createWorkflowSdk(context).recover({});
+    const payload = result.payload;
+    return guidedResult({
+      command: "recover",
+      summary: payload.interruptedRuns.length > 0 || payload.lock.active ? "Treeseed recover found workflow state that may need attention." : "Treeseed recover found no active locks or interrupted runs.",
+      facts: [
+        { label: "Active lock", value: payload.lock.active ? "yes" : "no" },
+        { label: "Stale lock", value: payload.lock.stale ? "yes" : "no" },
+        { label: "Interrupted runs", value: payload.interruptedRuns.length },
+        { label: "Recorded runs", value: payload.runCount }
+      ],
+      nextSteps: renderWorkflowNextSteps(result),
+      report: result
+    });
+  } catch (error) {
+    return workflowErrorResult(error);
+  }
+};
+export {
+  handleRecover
+};

package/dist/cli/handlers/release.js

@@ -3,23 +3,33 @@ import { createWorkflowSdk, renderWorkflowNextSteps, workflowErrorResult } from
 const handleRelease = async (invocation, context) => {
   try {
     const bump = ["major", "minor", "patch"].find((candidate) => invocation.args[candidate] === true) ?? "patch";
-    const result = await createWorkflowSdk(context).release({ bump });
+    const result = await createWorkflowSdk(context).release({
+      bump,
+      plan: invocation.args.plan === true || invocation.args.dryRun === true,
+      dryRun: invocation.args.dryRun === true
+    });
     const payload = result.payload;
+    const completedPublishes = payload.publishWait.filter((entry) => entry.status === "completed").length;
     return guidedResult({
       command: invocation.commandName || "release",
-      summary: "Treeseed release completed successfully.",
+      summary: result.executionMode === "plan" ? "Treeseed release plan ready." : "Treeseed release completed successfully.",
       facts: [
+        { label: "Mode", value: payload.mode },
         { label: "Staging branch", value: payload.stagingBranch },
         { label: "Production branch", value: payload.productionBranch },
+        { label: "Merge strategy", value: payload.mergeStrategy },
         { label: "Release level", value: payload.level },
         { label: "Root version", value: payload.rootVersion },
         { label: "Release tag", value: payload.releaseTag },
         { label: "Released commit", value: payload.releasedCommit.slice(0, 12) },
-        { label: "Updated packages", value: payload.touchedPackages.length },
+        { label: "Changed packages", value: String(payload.packageSelection.changed.length) },
+        { label: "Dependent packages", value: String(payload.packageSelection.dependents.length) },
+        { label: "Released packages", value: String(payload.touchedPackages.length) },
+        { label: "Publish waits", value: String(completedPublishes) },
         { label: "Final branch", value: payload.finalBranch }
       ],
       nextSteps: renderWorkflowNextSteps(result),
-      report: payload
+      report: result
     });
   } catch (error) {
     return workflowErrorResult(error);

package/dist/cli/handlers/resume.d.ts

@@ -0,0 +1,2 @@
+import type { TreeseedCommandHandler } from '../types.js';
+export declare const handleResume: TreeseedCommandHandler;

package/dist/cli/handlers/resume.js

@@ -0,0 +1,23 @@
+import { guidedResult } from "./utils.js";
+import { createWorkflowSdk, renderWorkflowNextSteps, workflowErrorResult } from "./workflow.js";
+const handleResume = async (invocation, context) => {
+  try {
+    const runId = invocation.positionals[0] ?? "";
+    const result = await createWorkflowSdk(context).resume({ runId });
+    return guidedResult({
+      command: invocation.commandName || "resume",
+      summary: `Resumed workflow run ${runId}.`,
+      facts: [
+        { label: "Run", value: result.runId ?? runId },
+        { label: "Command", value: result.command }
+      ],
+      nextSteps: renderWorkflowNextSteps(result),
+      report: result
+    });
+  } catch (error) {
+    return workflowErrorResult(error);
+  }
+};
+export {
+  handleResume
+};

package/dist/cli/handlers/save.js

@@ -5,22 +5,28 @@ const handleSave = async (invocation, context) => {
     const result = await createWorkflowSdk(context).save({
       message: invocation.positionals.join(" ").trim(),
       hotfix: invocation.args.hotfix === true,
-      preview: invocation.args.preview === true
+      preview: invocation.args.preview === true,
+      plan: invocation.args.plan === true || invocation.args.dryRun === true,
+      dryRun: invocation.args.dryRun === true
     });
     const payload = result.payload;
+    const savedRepos = (payload.repos ?? []).filter((repo) => repo.committed || repo.pushed).map((repo) => `${repo.name}@${String(repo.commitSha ?? "").slice(0, 12)}`).join(", ");
     return guidedResult({
       command: invocation.commandName || "save",
-      summary: payload.noChanges ? "Treeseed save found no new changes and confirmed branch sync." : "Treeseed save completed successfully.",
+      summary: result.executionMode === "plan" ? "Treeseed save plan ready." : payload.noChanges ? "Treeseed save found no new changes and confirmed branch sync." : "Treeseed save completed successfully.",
       facts: [
+        { label: "Mode", value: payload.mode },
         { label: "Branch", value: payload.branch },
         { label: "Environment scope", value: payload.scope },
         { label: "Hotfix", value: payload.hotfix ? "yes" : "no" },
         { label: "Commit", value: payload.commitSha.slice(0, 12) },
         { label: "Commit created", value: payload.commitCreated ? "yes" : "no" },
+        { label: "Workspace repos", value: savedRepos || ((payload.repos ?? []).length > 0 ? "none saved" : "not applicable") },
+        { label: "Market pushed", value: payload.rootRepo?.pushed ? "yes" : "no" },
         { label: "Preview action", value: payload.previewAction?.status ?? "skipped" }
       ],
       nextSteps: renderWorkflowNextSteps(result),
-      report: payload
+      report: result
     });
   } catch (error) {
     return workflowErrorResult(error);

package/dist/cli/handlers/secret-prompts.d.ts

@@ -0,0 +1,2 @@
+export declare function promptHidden(question: string): Promise<string>;
+export declare function promptForNewPassphrase(): Promise<string>;

package/dist/cli/handlers/secret-prompts.js

@@ -0,0 +1,54 @@
+function promptHidden(question) {
+  return new Promise((resolvePromise) => {
+    const stdin = process.stdin;
+    const stdout = process.stdout;
+    let value = "";
+    function cleanup() {
+      stdin.removeListener("data", onData);
+      if (stdin.isTTY) {
+        stdin.setRawMode(false);
+      }
+      stdout.write("\n");
+    }
+    function onData(chunk) {
+      const text = Buffer.isBuffer(chunk) ? chunk.toString("utf8") : chunk;
+      for (const char of text) {
+        if (char === "\n" || char === "\r") {
+          cleanup();
+          resolvePromise(value);
+          return;
+        }
+        if (char === "") {
+          cleanup();
+          process.exit(1);
+        }
+        if (char === "\x7F") {
+          value = value.slice(0, -1);
+          continue;
+        }
+        value += char;
+      }
+    }
+    stdout.write(question);
+    if (stdin.isTTY) {
+      stdin.setRawMode(true);
+    }
+    stdin.resume();
+    stdin.on("data", onData);
+  });
+}
+async function promptForNewPassphrase() {
+  const passphrase = (await promptHidden("New Treeseed passphrase: ")).trim();
+  if (!passphrase) {
+    throw new Error("A non-empty passphrase is required.");
+  }
+  const confirmation = (await promptHidden("Confirm passphrase: ")).trim();
+  if (passphrase !== confirmation) {
+    throw new Error("The passphrase confirmation did not match.");
+  }
+  return passphrase;
+}
+export {
+  promptForNewPassphrase,
+  promptHidden
+};

package/dist/cli/handlers/secrets.d.ts

@@ -0,0 +1,7 @@
+import type { TreeseedCommandHandler } from '../types.js';
+export declare const handleSecretsStatus: TreeseedCommandHandler;
+export declare const handleSecretsUnlock: TreeseedCommandHandler;
+export declare const handleSecretsLock: TreeseedCommandHandler;
+export declare const handleSecretsMigrateKey: TreeseedCommandHandler;
+export declare const handleSecretsRotatePassphrase: TreeseedCommandHandler;
+export declare const handleSecretsRotateMachineKey: TreeseedCommandHandler;