@treeseed/sdk 0.10.22 → 0.10.23

package/dist/db/market-schema.js

@@ -297,13 +297,14 @@ const webSessions = pgTable("web_sessions", {
 const projects = pgTable("projects", {
   id: text("id").primaryKey(),
   teamId: text("team_id").notNull(),
-  slug: text("slug").notNull().unique(),
+  slug: text("slug").notNull(),
   name: text("name").notNull(),
   description: text("description"),
   metadataJson: text("metadata_json"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (table) => [
+  uniqueIndex("idx_projects_team_slug").on(table.teamId, table.slug),
   index("idx_projects_team_id").on(table.teamId)
 ]);
 const projectConnections = pgTable("project_connections", {
@@ -445,7 +446,7 @@ const catalogItems = pgTable("catalog_items", {
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 }, (table) => [
-  uniqueIndex("idx_catalog_items_kind_slug").on(table.kind, table.slug),
+  uniqueIndex("idx_catalog_items_team_kind_slug").on(table.teamId, table.kind, table.slug),
   index("idx_catalog_items_team_kind").on(table.teamId, table.kind, table.updatedAt),
   index("idx_catalog_items_visibility_listing").on(table.visibility, table.listingEnabled, table.updatedAt)
 ]);

package/dist/market-client.d.ts

@@ -374,6 +374,10 @@ export declare class MarketClient {
         ok: true;
         payload: ProjectDeployment;
     }>;
+    projectDeploymentById(deploymentId: string): Promise<{
+        ok: true;
+        payload: ProjectDeployment;
+    }>;
     projectDeploymentEvents(projectId: string, deploymentId: string, options?: {
         limit?: number | string | null;
     }): Promise<{

package/dist/market-client.js

@@ -485,6 +485,12 @@ class MarketClient {
       { requireAuth: true }
     );
   }
+  projectDeploymentById(deploymentId) {
+    return this.request(
+      `/v1/project-deployments/${encodeURIComponent(deploymentId)}`,
+      { requireAuth: true }
+    );
+  }
   projectDeploymentEvents(projectId, deploymentId, options = {}) {
     const query = options.limit ? `?limit=${encodeURIComponent(String(options.limit))}` : "";
     return this.request(

package/dist/operations/providers/default.js

@@ -91,6 +91,28 @@ function failureResult(metadata, message, options = {}) {
 function contextEnv(context) {
   return { ...process.env, ...context.env ?? {} };
 }
+async function withTemporaryProcessEnv(env, action) {
+  const previous = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(env)) {
+    previous.set(key, process.env[key]);
+    if (value === void 0) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+  try {
+    return await action();
+  } finally {
+    for (const [key, value] of previous) {
+      if (value === void 0) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  }
+}
 function operationEnv(context) {
   const tenantConfigPath = resolve(context.cwd, "treeseed.site.yaml");
   return existsSync(tenantConfigPath) ? resolveTreeseedLaunchEnvironment({ tenantRoot: context.cwd, scope: "local", baseEnv: contextEnv(context) }) : contextEnv(context);
@@ -399,21 +421,21 @@ class HubValidateLaunchOperation extends BaseOperation {
 class HubExecuteLaunchOperation extends BaseOperation {
   async execute(input, context) {
     const intent = input.intent && typeof input.intent === "object" ? input.intent : input;
-    const result = await executeKnowledgeHubLaunch(intent, {
+    const result = await withTemporaryProcessEnv(contextEnv(context), () => executeKnowledgeHubLaunch(intent, {
       onPhase: async (phase) => {
         await context.onProgress?.({
           kind: "hub_launch_phase",
           ...phase
         });
       }
-    });
+    }));
     return operationResult(this.metadata, result);
   }
 }
 class HubResumeLaunchOperation extends BaseOperation {
   async execute(input, context) {
     const intent = input.intent && typeof input.intent === "object" ? input.intent : input;
-    const result = await executeKnowledgeHubLaunch(intent, {
+    const result = await withTemporaryProcessEnv(contextEnv(context), () => executeKnowledgeHubLaunch(intent, {
       onPhase: async (phase) => {
         await context.onProgress?.({
           kind: "hub_launch_phase",
@@ -421,7 +443,7 @@ class HubResumeLaunchOperation extends BaseOperation {
           ...phase
         });
       }
-    });
+    }));
     return operationResult(this.metadata, {
       resumed: true,
       ...result

package/dist/operations/repository-operations.js

@@ -310,15 +310,19 @@ async function writeContentRecord(repoPath, collection, input, normalizedInput)
   const existingTarget = input.overwrite === true ? [`${normalized.slug}.mdx`, `${normalized.slug}.md`].map((file) => resolve(root, file)).find((candidate) => existsSync(candidate)) : null;
   const target = existingTarget ?? safeContentPath(repoPath, collection, normalized.slug, normalized.extension);
   if (existsSync(target) && input.overwrite !== true) throw new Error("A content record with that slug already exists.");
+  const frontmatter = existingTarget && input.preserveFrontmatter === true ? {
+    ...normalized.frontmatter,
+    ...(await readContentRecord(repoPath, collection, normalized.slug)).frontmatter
+  } : normalized.frontmatter;
   const relativePath = await writeParsedRecord(repoPath, {
     path: target,
-    frontmatter: normalized.frontmatter,
+    frontmatter,
     body: normalized.body
   });
   return {
     collection,
     slug: normalized.slug,
-    id: normalized.frontmatter.id,
+    id: frontmatter.id,
     path: relativePath,
     href: collection === "agents" ? `/app/projects/${encodeURIComponent(String(input.projectId ?? ""))}/agents/${encodeURIComponent(normalized.slug)}` : `/app/work/${collection}/${encodeURIComponent(normalized.slug)}`
   };

package/dist/operations/services/config-runtime.d.ts

@@ -55,7 +55,7 @@ export type TreeseedConfigEntrySnapshot = {
     group: string;
     cluster: string;
     startupProfile: 'core' | 'optional' | 'advanced';
-    requirement: 'required' | 'conditional' | 'optional';
+    requirement: 'required' | 'conditional' | 'optional' | 'generated';
     description: string;
     howToGet: string;
     sensitivity: 'secret' | 'plain' | 'derived';

package/dist/operations/services/deploy.d.ts

@@ -85,7 +85,7 @@ export declare function buildPublicVars(deployConfig: any, options?: {}): {
 export declare function buildSecretMap(deployConfig: any, state: any): {
     TREESEED_FORM_TOKEN_SECRET: any;
     TREESEED_EDITORIAL_PREVIEW_SECRET: any;
-    TREESEED_TURNSTILE_SECRET_KEY: string | null;
+    TREESEED_TURNSTILE_SECRET_KEY: any;
     TREESEED_SMTP_PASSWORD: string | null;
 };
 export declare function loadDeployState(tenantRoot: any, deployConfig: any, options?: {}): any;
@@ -307,6 +307,10 @@ export declare function listD1Databases(tenantRoot: any, env: any): any;
 export declare function listQueues(tenantRoot: any, env: any): any;
 export declare function listR2Buckets(tenantRoot: any, env: any): any;
 export declare function listPagesProjects(tenantRoot: any, env: any): any;
+export declare function listTurnstileWidgets(tenantRoot: any, env: any): any;
+export declare function getTurnstileWidget(env: any, sitekey: any): any;
+export declare function createTurnstileWidget(env: any, input: any): any;
+export declare function updateTurnstileWidget(env: any, sitekey: any, input: any): any;
 export declare function buildCloudflarePagesFunctionBindings(state: any): {
     r2_buckets?: {
         [x: number]: {
@@ -330,6 +334,7 @@ export declare function buildProvisioningSummary(deployConfig: any, state: any,
     siteUrl: any;
     accountId: any;
     pages: any;
+    turnstileWidget: any;
     formGuardKv: any;
     sessionKv: any;
     siteDataDb: any;
@@ -341,6 +346,7 @@ export declare function buildProvisioningSummary(deployConfig: any, state: any,
         queue: any;
         dlq: any;
         database: any;
+        turnstileWidget: any;
         formGuardKv: any;
         railwayProject: any;
         webDomain: any;
@@ -891,6 +897,7 @@ export declare function destroyTreeseedEnvironmentResources(tenantRoot: any, opt
         siteUrl: any;
         accountId: any;
         pages: any;
+        turnstileWidget: any;
         formGuardKv: any;
         sessionKv: any;
         siteDataDb: any;
@@ -902,6 +909,7 @@ export declare function destroyTreeseedEnvironmentResources(tenantRoot: any, opt
             queue: any;
             dlq: any;
             database: any;
+            turnstileWidget: any;
             formGuardKv: any;
             railwayProject: any;
             webDomain: any;
@@ -963,6 +971,7 @@ export declare function destroyCloudflareResources(tenantRoot: any, options?: {}
         siteUrl: any;
         accountId: any;
         pages: any;
+        turnstileWidget: any;
         formGuardKv: any;
         sessionKv: any;
         siteDataDb: any;
@@ -974,6 +983,7 @@ export declare function destroyCloudflareResources(tenantRoot: any, options?: {}
             queue: any;
             dlq: any;
             database: any;
+            turnstileWidget: any;
             formGuardKv: any;
             railwayProject: any;
             webDomain: any;
@@ -1008,6 +1018,11 @@ export declare function destroyCloudflareResources(tenantRoot: any, options?: {}
             status: any;
             name: any;
         };
+        turnstileWidget: {
+            status: any;
+            sitekey: any;
+            name: null;
+        };
         formGuard: {
             status: string;
             id: any;
@@ -1064,6 +1079,7 @@ export declare function provisionCloudflareResources(tenantRoot: any, options?:
     siteUrl: any;
     accountId: any;
     pages: any;
+    turnstileWidget: any;
     formGuardKv: any;
     sessionKv: any;
     siteDataDb: any;
@@ -1075,6 +1091,7 @@ export declare function provisionCloudflareResources(tenantRoot: any, options?:
         queue: any;
         dlq: any;
         database: any;
+        turnstileWidget: any;
         formGuardKv: any;
         railwayProject: any;
         webDomain: any;

package/dist/operations/services/deploy.js

@@ -41,6 +41,13 @@ function ensureParent(filePath) {
 function stableHash(value) {
   return createHash("sha256").update(value).digest("hex");
 }
+function compactDeploymentKey(input) {
+  const rawKey = sanitizeResourceKey(input.rawKey ?? "");
+  if (rawKey && rawKey.length <= 40) return rawKey;
+  const base = sanitizeSegment(input.slug ?? input.projectSegment ?? "project").slice(0, 27) || "project";
+  const hash = stableHash(`${input.teamId ?? ""}:${input.projectId ?? ""}:${input.slug ?? ""}`).slice(0, 8);
+  return `${base}-${hash}`;
+}
 function readJson(filePath, fallback) {
   if (!existsSync(filePath)) {
     return fallback;
@@ -69,6 +76,9 @@ function loadTenantDeployConfig(tenantRoot) {
 function sanitizeSegment(value) {
   return String(value).trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 36) || "default";
 }
+function sanitizeResourceKey(value) {
+  return String(value).trim().toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "");
+}
 function requireConfiguredIdentityValue(value, label) {
   const normalized = typeof value === "string" && value.trim() ? value.trim() : "";
   if (!normalized) {
@@ -87,7 +97,13 @@ function resolveTreeseedResourceIdentity(deployConfig, target) {
   );
   const teamSegment = sanitizeSegment(teamId);
   const projectSegment = sanitizeSegment(projectId);
-  const deploymentKey = `${teamSegment}-${projectSegment}`;
+  const deploymentKey = compactDeploymentKey({
+    rawKey: `${teamSegment}-${projectSegment}`,
+    teamId,
+    projectId,
+    projectSegment,
+    slug: deployConfig.slug
+  });
   const environment = target.kind === "persistent" ? target.scope : target.branchName;
   const environmentSegment = target.kind === "persistent" ? target.scope : sanitizeSegment(target.branchName);
   return {
@@ -168,6 +184,13 @@ function resolveConfiguredSurfaceBaseUrl(deployConfig, target, surface) {
   }
   return null;
 }
+function configuredSurfaceHosts(deployConfig, target, surface) {
+  const hosts = [
+    resolveConfiguredSurfaceDomain(deployConfig, target, surface),
+    surface === "web" && target.kind === "persistent" && target.scope === "prod" ? primaryHost(deployConfig.surfaces?.web?.publicBaseUrl ?? deployConfig.siteUrl) : null
+  ].filter(Boolean);
+  return [...new Set(hosts)];
+}
 function sharedDeploymentName(identity, role = "") {
   const roleSegment = role === "workdayManager" ? "workday-manager" : role === "workerRunner" ? "worker-runner-01" : role;
   return role ? `${identity.deploymentKey}-${sanitizeSegment(roleSegment)}` : identity.deploymentKey;
@@ -419,7 +442,7 @@ function buildSecretMap(deployConfig, state) {
   return {
     TREESEED_FORM_TOKEN_SECRET: envOrNull("TREESEED_FORM_TOKEN_SECRET") ?? generatedSecret,
     TREESEED_EDITORIAL_PREVIEW_SECRET: envOrNull("TREESEED_EDITORIAL_PREVIEW_SECRET") ?? previewSecret,
-    TREESEED_TURNSTILE_SECRET_KEY: envOrNull("TREESEED_TURNSTILE_SECRET_KEY"),
+    TREESEED_TURNSTILE_SECRET_KEY: state.turnstileWidgets?.formGuard?.secret ?? envOrNull("TREESEED_TURNSTILE_SECRET_KEY"),
     TREESEED_SMTP_PASSWORD: envOrNull("TREESEED_SMTP_PASSWORD")
   };
 }
@@ -431,6 +454,8 @@ function defaultStateFromConfig(deployConfig, target) {
   const contentPreviewRootTemplate = deployConfig.cloudflare.r2?.previewRootTemplate ?? "teams/{teamId}/previews";
   const contentDefaultTeamId = identity.teamId;
   const contentManifestKey = contentManifestKeyTemplate.replaceAll("{teamId}", contentDefaultTeamId);
+  const turnstileName = environmentScopedIdentityName(identity, "turnstile", target);
+  const turnstileDomains = configuredSurfaceHosts(deployConfig, target, "web");
   return {
     version: 2,
     target,
@@ -469,6 +494,17 @@ function defaultStateFromConfig(deployConfig, target) {
       buildOutputDir: deployConfig.cloudflare.pages?.buildOutputDir ?? "dist",
       url: resolveConfiguredSurfaceBaseUrl(deployConfig, target, "web")
     },
+    turnstileWidgets: {
+      formGuard: {
+        name: turnstileName,
+        sitekey: null,
+        secret: null,
+        mode: "managed",
+        domains: turnstileDomains,
+        managed: true,
+        lastSyncedAt: null
+      }
+    },
     content: {
       runtimeProvider: deployConfig.providers?.content?.runtime ?? "team_scoped_r2_overlay",
       publishProvider: deployConfig.providers?.content?.publish ?? deployConfig.providers?.content?.runtime ?? "team_scoped_r2_overlay",
@@ -636,6 +672,23 @@ function loadDeployState(tenantRoot, deployConfig, options = {}) {
       ...defaults.generatedSecrets ?? {},
       ...persisted.generatedSecrets ?? {}
     },
+    turnstileWidgets: {
+      ...defaults.turnstileWidgets ?? {},
+      ...persisted.turnstileWidgets ?? {},
+      formGuard: {
+        ...defaults.turnstileWidgets?.formGuard ?? {},
+        ...persisted.turnstileWidgets?.formGuard ?? {},
+        name: defaults.turnstileWidgets?.formGuard?.name ?? persisted.turnstileWidgets?.formGuard?.name ?? null,
+        mode: "managed",
+        managed: true,
+        domains: [
+          ...new Set([
+            ...Array.isArray(defaults.turnstileWidgets?.formGuard?.domains) ? defaults.turnstileWidgets.formGuard.domains : [],
+            ...Array.isArray(persisted.turnstileWidgets?.formGuard?.domains) ? persisted.turnstileWidgets.formGuard.domains : []
+          ].filter(Boolean))
+        ]
+      }
+    },
     content: {
       ...defaults.content ?? {},
       ...persisted.content ?? {},
@@ -926,6 +979,68 @@ function listPagesProjects(tenantRoot, env) {
   });
   return Array.isArray(payload?.result) ? payload.result : [];
 }
+function listTurnstileWidgets(tenantRoot, env) {
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  if (!accountId) {
+    return [];
+  }
+  const payload = cloudflareApiRequest(`/accounts/${encodeURIComponent(accountId)}/challenges/widgets?per_page=100`, {
+    env,
+    allowFailure: true
+  });
+  return Array.isArray(payload?.result) ? payload.result : [];
+}
+function getTurnstileWidget(env, sitekey) {
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  if (!accountId || !sitekey) {
+    return null;
+  }
+  const payload = cloudflareApiRequest(
+    `/accounts/${encodeURIComponent(accountId)}/challenges/widgets/${encodeURIComponent(sitekey)}`,
+    { env, allowFailure: true }
+  );
+  return payload?.result ?? null;
+}
+function createTurnstileWidget(env, input) {
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  if (!accountId) {
+    throw new Error("Configure CLOUDFLARE_ACCOUNT_ID before creating Turnstile widgets.");
+  }
+  try {
+    return cloudflareApiRequest(`/accounts/${encodeURIComponent(accountId)}/challenges/widgets`, {
+      method: "POST",
+      env,
+      body: {
+        name: input.name,
+        domains: input.domains ?? [],
+        mode: input.mode ?? "managed"
+      }
+    })?.result ?? null;
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Cloudflare Turnstile widget creation failed. Ensure the API token has Turnstile Sites Write permission: ${detail}`);
+  }
+}
+function updateTurnstileWidget(env, sitekey, input) {
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  if (!accountId || !sitekey) {
+    throw new Error("Configure CLOUDFLARE_ACCOUNT_ID and sitekey before updating Turnstile widgets.");
+  }
+  try {
+    return cloudflareApiRequest(`/accounts/${encodeURIComponent(accountId)}/challenges/widgets/${encodeURIComponent(sitekey)}`, {
+      method: "PUT",
+      env,
+      body: {
+        name: input.name,
+        domains: input.domains ?? [],
+        mode: input.mode ?? "managed"
+      }
+    })?.result ?? null;
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Cloudflare Turnstile widget update failed. Ensure the API token has Turnstile Sites Write permission: ${detail}`);
+  }
+}
 function buildCloudflarePagesFunctionBindings(state) {
   const kvNamespaces = Object.fromEntries(
     Object.entries(state.kvNamespaces ?? {}).map(([key, namespace]) => {
@@ -1006,6 +1121,7 @@ function buildProvisioningSummary(deployConfig, state, target) {
     siteUrl: target.kind === "branch" ? targetWorkersDevUrl(state.workerName) : deployConfig.siteUrl,
     accountId: resolveConfiguredCloudflareAccountId(deployConfig),
     pages: state.pages ?? null,
+    turnstileWidget: state.turnstileWidgets?.formGuard ?? null,
     formGuardKv: state.kvNamespaces.FORM_GUARD_KV,
     sessionKv: state.kvNamespaces.SESSION ?? null,
     siteDataDb: state.d1Databases.SITE_DATA_DB,
@@ -1017,6 +1133,7 @@ function buildProvisioningSummary(deployConfig, state, target) {
       queue: state.queues?.agentWork?.name ?? null,
       dlq: state.queues?.agentWork?.dlqName ?? null,
       database: state.d1Databases?.SITE_DATA_DB?.databaseName ?? null,
+      turnstileWidget: state.turnstileWidgets?.formGuard?.name ?? null,
       formGuardKv: state.kvNamespaces?.FORM_GUARD_KV?.name ?? null,
       railwayProject: state.services?.worker?.projectName ?? state.services?.api?.projectName ?? null,
       webDomain: configuredWebDomain,
@@ -1533,14 +1650,7 @@ function resolveConfiguredContentPublicBaseUrl(deployConfig) {
   return envOrNull("TREESEED_CONTENT_PUBLIC_BASE_URL") ?? deployConfig.cloudflare.r2?.publicBaseUrl ?? "";
 }
 function missingTurnstileRequirements() {
-  const issues = [];
-  if (!envOrNull("TREESEED_PUBLIC_TURNSTILE_SITE_KEY")) {
-    issues.push("Set TREESEED_PUBLIC_TURNSTILE_SITE_KEY before deploying.");
-  }
-  if (!envOrNull("TREESEED_TURNSTILE_SECRET_KEY")) {
-    issues.push("Set TREESEED_TURNSTILE_SECRET_KEY before deploying.");
-  }
-  return issues;
+  return [];
 }
 function missingContentRuntimeRequirements(deployConfig) {
   const issues = [];
@@ -1564,20 +1674,6 @@ function collectMissingDeployInputs(tenantRoot) {
       message: "Cloudflare account ID is missing. Set CLOUDFLARE_ACCOUNT_ID with treeseed config or provide it now."
     });
   }
-  if (!envOrNull("TREESEED_PUBLIC_TURNSTILE_SITE_KEY")) {
-    missing.push({
-      key: "TREESEED_PUBLIC_TURNSTILE_SITE_KEY",
-      label: "Turnstile public site key",
-      message: "Turnstile public site key is missing for deploy."
-    });
-  }
-  if (!envOrNull("TREESEED_TURNSTILE_SECRET_KEY")) {
-    missing.push({
-      key: "TREESEED_TURNSTILE_SECRET_KEY",
-      label: "Turnstile secret key",
-      message: "Turnstile secret key is missing for deploy."
-    });
-  }
   if (deployConfig.providers?.content?.runtime === "team_scoped_r2_overlay" && !envOrNull("TREESEED_EDITORIAL_PREVIEW_SECRET")) {
     missing.push({
       key: "TREESEED_EDITORIAL_PREVIEW_SECRET",
@@ -1674,6 +1770,24 @@ function resolveExistingKvIdByName(kvNamespaces, expectedName, fallbackId) {
   }
   return kvNamespaces.find((entry) => entry?.title === expectedName)?.id ?? null;
 }
+function resolveExistingTurnstileWidget(widgets, current) {
+  if (!current?.name && !current?.sitekey) {
+    return current;
+  }
+  const existing = widgets.find(
+    (entry) => current.sitekey && entry?.sitekey === current.sitekey || current.name && entry?.name === current.name
+  );
+  if (!existing?.sitekey) {
+    return current;
+  }
+  return {
+    ...current,
+    sitekey: existing.sitekey,
+    secret: existing.secret ?? current.secret ?? null,
+    domains: Array.isArray(existing.domains) ? existing.domains : current.domains ?? [],
+    mode: existing.mode ?? current.mode ?? "managed"
+  };
+}
 function resolveExistingD1ByName(d1Databases, expectedName, current) {
   if (current?.databaseId && !isPlaceholderResourceId(current.databaseId)) {
     return current;
@@ -1703,6 +1817,24 @@ function deleteKvNamespace(tenantRoot, namespaceId, { env, dryRun, preview = fal
   const deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: namespaceId, type: "kv-namespace" });
   return { status: deleted.status, id: namespaceId, preview };
 }
+function deleteTurnstileWidget(sitekey, { env, dryRun, name = null }) {
+  if (!sitekey || isPlaceholderResourceId(sitekey)) {
+    return { status: "missing", sitekey, name };
+  }
+  if (dryRun) {
+    return { status: "planned", sitekey, name };
+  }
+  const accountId = env?.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? "";
+  const path = accountId ? `/accounts/${encodeURIComponent(accountId)}/challenges/widgets/${encodeURIComponent(sitekey)}` : null;
+  let deleted;
+  try {
+    deleted = deleteCloudflareApiResource(path, { env, dryRun: false, name: name ?? sitekey, type: "turnstile-widget" });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Cloudflare Turnstile widget deletion failed. Ensure the API token has Turnstile Sites Write permission: ${detail}`);
+  }
+  return { status: deleted.status, sitekey, name };
+}
 function deleteD1Database(tenantRoot, databaseName, { env, dryRun }) {
   if (!databaseName) {
     return { status: "missing", name: databaseName };
@@ -2385,6 +2517,7 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
   const queues = dryRun ? [] : listQueues(tenantRoot, env);
   const buckets = dryRun ? [] : listR2Buckets(tenantRoot, env);
   const pagesProjects = dryRun ? [] : listPagesProjects(tenantRoot, env);
+  const turnstileWidgets = dryRun ? [] : listTurnstileWidgets(tenantRoot, env);
   state.kvNamespaces.FORM_GUARD_KV.id = resolveExistingKvIdByName(
     kvNamespaces,
     state.kvNamespaces.FORM_GUARD_KV.name,
@@ -2402,11 +2535,17 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
     state.d1Databases.SITE_DATA_DB.databaseName,
     state.d1Databases.SITE_DATA_DB
   );
+  state.turnstileWidgets.formGuard = resolveExistingTurnstileWidget(turnstileWidgets, state.turnstileWidgets?.formGuard);
   const pagesProject = pagesProjects.find((entry) => entry?.name === state.pages?.projectName);
   const bucket = buckets.find((entry) => entry?.name === state.content?.bucketName);
   const queue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
   const dlq = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.dlqName);
   const workerResult = deleteWorker(tenantRoot, state.workerName, { env, dryRun, force });
+  const turnstileWidget = deleteTurnstileWidget(state.turnstileWidgets?.formGuard?.sitekey, {
+    env,
+    dryRun,
+    name: state.turnstileWidgets?.formGuard?.name
+  });
   const formGuard = deleteKvNamespace(tenantRoot, state.kvNamespaces.FORM_GUARD_KV.id, { env, dryRun });
   const formGuardPreview = state.kvNamespaces.FORM_GUARD_KV.previewId && state.kvNamespaces.FORM_GUARD_KV.previewId !== state.kvNamespaces.FORM_GUARD_KV.id ? deleteKvNamespace(tenantRoot, state.kvNamespaces.FORM_GUARD_KV.previewId, { env, dryRun, preview: true }) : null;
   const session = state.kvNamespaces.SESSION?.id ? deleteKvNamespace(tenantRoot, state.kvNamespaces.SESSION.id, { env, dryRun }) : null;
@@ -2454,6 +2593,7 @@ async function destroyTreeseedEnvironmentResources(tenantRoot, options = {}) {
   const operations = {
     cloudflare: [
       resourceOperation("cloudflare", "worker", state.workerName, workerResult.status, workerResult),
+      resourceOperation("cloudflare", "turnstile-widget", state.turnstileWidgets?.formGuard?.name, turnstileWidget.status, turnstileWidget),
       resourceOperation("cloudflare", "kv-namespace", state.kvNamespaces.FORM_GUARD_KV.name, formGuard.status, formGuard),
       ...formGuardPreview ? [resourceOperation("cloudflare", "kv-namespace-preview", state.kvNamespaces.FORM_GUARD_KV.name, formGuardPreview.status, formGuardPreview)] : [],
       ...session ? [resourceOperation("cloudflare", "kv-namespace", state.kvNamespaces.SESSION.name, session.status, session)] : [],
@@ -2496,6 +2636,7 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
   const queues = listQueues(tenantRoot, env);
   const buckets = dryRun ? [] : listR2Buckets(tenantRoot, env);
   const pagesProjects = dryRun ? [] : listPagesProjects(tenantRoot, env);
+  const turnstileWidgets = dryRun ? [] : listTurnstileWidgets(tenantRoot, env);
   state.kvNamespaces.FORM_GUARD_KV.id = resolveExistingKvIdByName(
     kvNamespaces,
     state.kvNamespaces.FORM_GUARD_KV.name,
@@ -2506,11 +2647,17 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
     state.d1Databases.SITE_DATA_DB.databaseName,
     state.d1Databases.SITE_DATA_DB
   );
+  state.turnstileWidgets.formGuard = resolveExistingTurnstileWidget(turnstileWidgets, state.turnstileWidgets?.formGuard);
   const queue = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.name);
   const dlq = queues.find((entry) => queueName(entry) === state.queues?.agentWork?.dlqName);
   const bucket = buckets.find((entry) => entry?.name === state.content?.bucketName);
   const pagesProject = pagesProjects.find((entry) => entry?.name === state.pages?.projectName);
   const worker = deleteWorker(tenantRoot, state.workerName, { env, dryRun, force });
+  const turnstileWidget = deleteTurnstileWidget(state.turnstileWidgets?.formGuard?.sitekey, {
+    env,
+    dryRun,
+    name: state.turnstileWidgets?.formGuard?.name
+  });
   const formGuard = deleteKvNamespace(tenantRoot, state.kvNamespaces.FORM_GUARD_KV.id, { env, dryRun });
   const database = deleteD1DatabaseForDestroy(tenantRoot, state.d1Databases.SITE_DATA_DB.databaseName, { env, dryRun, deleteData });
   const deletedQueue = deleteQueueByName(tenantRoot, queue ?? { name: state.queues?.agentWork?.name }, { env, dryRun });
@@ -2524,6 +2671,7 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
   const pages = pagesProject || dryRun ? deletePagesProject(state.pages?.projectName, { env, dryRun }) : resourceOperation("cloudflare", "pages-project", state.pages?.projectName, "missing");
   const operations = {
     worker,
+    turnstileWidget,
     formGuard,
     database,
     queue: deletedQueue,
@@ -3093,12 +3241,14 @@ export {
   collectMissingDeployInputs,
   createBranchPreviewDeployTarget,
   createPersistentDeployTarget,
+  createTurnstileWidget,
   deployTargetLabel,
   deriveTreeseedStagingSurfaceDomain,
   destroyCloudflareResources,
   destroyTreeseedEnvironmentResources,
   ensureGeneratedWranglerConfig,
   finalizeDeploymentState,
+  getTurnstileWidget,
   hasProvisionedCloudflareResources,
   isWranglerAlreadyExistsError,
   listD1Databases,
@@ -3106,6 +3256,7 @@ export {
   listPagesProjects,
   listQueues,
   listR2Buckets,
+  listTurnstileWidgets,
   loadDeployState,
   markDeploymentInitialized,
   markManagedServicesInitialized,
@@ -3132,6 +3283,7 @@ export {
   scopeFromTarget,
   shouldDeleteRailwayProjectAfterEnvironmentDestroy,
   syncCloudflareSecrets,
+  updateTurnstileWidget,
   validateDeployPrerequisites,
   validateDestroyPrerequisites,
   verifyProvisionedCloudflareResources,

package/dist/operations/services/github-automation.d.ts

@@ -24,6 +24,14 @@ export interface TreeseedGitHubRepositoryTarget {
 }
 export declare function getGitHubAutomationMode(): string;
 export declare function parseGitHubRepositoryFromRemote(remoteUrl: any): string | null;
+export declare function resolveGitHubRemoteUrls(owner: any, name: any): {
+    slug: string;
+    owner: string;
+    name: string;
+    sshUrl: string;
+    httpsUrl: string;
+    url: string;
+};
 export declare function resolveGitHubRepositorySlug(tenantRoot: any): string;
 export declare function maybeResolveGitHubRepositorySlug(tenantRoot: any): string | null;
 export declare function resolveDefaultGitHubOwner(): string;
@@ -54,12 +62,13 @@ export declare function ensureGitHubBootstrapRepository(tenantRoot: string, { va
 export declare function createGitHubRepository(input: any, { env }?: {
     env?: NodeJS.ProcessEnv | undefined;
 }): Promise<import("./github-api.ts").GitHubRepositorySummary>;
-export declare function initializeGitHubRepositoryWorkingTree(cwd: any, repository: any, { defaultBranch, createStaging, commitMessage, remoteName, push, }?: {
+export declare function initializeGitHubRepositoryWorkingTree(cwd: any, repository: any, { defaultBranch, createStaging, commitMessage, remoteName, push, forcePush, }?: {
     defaultBranch?: string | undefined;
     createStaging?: boolean | undefined;
     commitMessage?: string | undefined;
     remoteName?: string | undefined;
     push?: boolean | undefined;
+    forcePush?: boolean | undefined;
 }): {
     repository: any;
     remoteName: string;