@treeseed/sdk 0.10.28 → 0.12.4

package/dist/operations/services/repository-save-orchestrator.js

@@ -1,7 +1,8 @@
-import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, resolve, relative } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "./git-runner.js";
 import {
   ensureSshPushUrlForOrigin,
   remoteWriteUrl,
@@ -11,8 +12,8 @@ import {
   generateRepositoryCommitMessage
 } from "./commit-message-provider.js";
 import {
-  createDevTagMessage,
   createPackageDependencyReference,
+  normalizeGitRemoteForDependency,
   updateInternalDependencySpecs
 } from "./package-reference-policy.js";
 import {
@@ -33,15 +34,39 @@ import {
 } from "./workspace-save.js";
 import {
   hasCompleteTreeseedPackageCheckout,
-  run,
   sortWorkspacePackages,
   workspacePackages
 } from "./workspace-tools.js";
-import { collectDeploymentLockfileWorkspaceIssues } from "./workspace-dependency-mode.js";
+import { collectDeploymentLockfileWorkspaceIssues, ensureLocalWorkspaceLinks } from "./workspace-dependency-mode.js";
 import {
   createBuildWarningSummary,
   formatAllowedBuildWarnings
 } from "./build-warning-policy.js";
+import {
+  readTreeseedVerificationCache,
+  writeTreeseedVerificationCache
+} from "./verification-cache.js";
+import {
+  discoverTreeseedPackageAdapters
+} from "./package-adapters.js";
+import {
+  discoverTreeseedManagedRepositories,
+  parseGitmodulesPaths,
+  readTreeseedTemplateRepositoryManifest
+} from "./managed-repositories.js";
+function runGit(args, options) {
+  return runTreeseedGitText(args, {
+    cwd: options.cwd,
+    mode: classifyTreeseedGitMode(args),
+    timeoutMs: options.timeoutMs,
+    maxBuffer: options.maxBuffer
+  });
+}
+function sleepMs(durationMs) {
+  return new Promise((resolvePromise) => {
+    setTimeout(resolvePromise, durationMs);
+  });
+}
 class RepositorySaveError extends Error {
   exitCode;
   details;
@@ -71,11 +96,66 @@ function emitProgress(options, node, phase, message, stream = "stdout") {
 function prefixedOutput(node, phase, output) {
   return String(output ?? "").split(/\r?\n/u).map((line) => line.trimEnd()).filter(Boolean).map((line) => `${progressPrefix(node, phase)} ${line}`).join("\n");
 }
+function withShortProcessTempEnv(env = {}) {
+  const merged = { ...process.env, ...env };
+  if (process.platform === "win32") {
+    return merged;
+  }
+  const shortTemp = tmpdir();
+  const tempKeys = ["TMPDIR", "TMP", "TEMP"];
+  for (const key of tempKeys) {
+    const value = merged[key];
+    if (value && value.length > shortTemp.length) {
+      merged[key] = shortTemp;
+    }
+  }
+  return merged;
+}
+function npmCacheForCwd(cwd) {
+  const cacheDir = resolve(cwd, ".treeseed", "cache", "npm");
+  mkdirSync(cacheDir, { recursive: true });
+  return cacheDir;
+}
+function npmWorkflowEnv(env = {}, cwd = process.cwd()) {
+  const npmCache = env.npm_config_cache ?? env.NPM_CONFIG_CACHE ?? process.env.npm_config_cache ?? process.env.NPM_CONFIG_CACHE ?? npmCacheForCwd(cwd);
+  return withShortProcessTempEnv({
+    ...env,
+    NPM_CONFIG_CACHE: npmCache,
+    npm_config_audit: env.npm_config_audit ?? process.env.npm_config_audit ?? "false",
+    npm_config_cache: npmCache,
+    npm_config_fetch_retries: env.npm_config_fetch_retries ?? process.env.npm_config_fetch_retries ?? "2",
+    npm_config_fund: env.npm_config_fund ?? process.env.npm_config_fund ?? "false",
+    npm_config_foreground_scripts: env.npm_config_foreground_scripts ?? process.env.npm_config_foreground_scripts ?? "true",
+    npm_config_loglevel: env.npm_config_loglevel ?? process.env.npm_config_loglevel ?? "warn",
+    npm_config_maxsockets: env.npm_config_maxsockets ?? process.env.npm_config_maxsockets ?? "4",
+    npm_config_prefer_offline: env.npm_config_prefer_offline ?? process.env.npm_config_prefer_offline ?? "true",
+    npm_config_progress: env.npm_config_progress ?? process.env.npm_config_progress ?? "false"
+  });
+}
+function npmCommandForSpawn(args) {
+  if (process.platform === "win32") {
+    return { command: "npm", args };
+  }
+  return {
+    command: "bash",
+    args: [
+      "-lc",
+      'ulimit -n 65535 2>/dev/null || ulimit -n 32768 2>/dev/null || ulimit -n 16384 2>/dev/null || true; exec npm "$@"',
+      "npm-fd-guard",
+      ...args
+    ]
+  };
+}
+function displayCommand(command, args) {
+  return command === "npm" ? `npm ${args.join(" ")}` : `${command} ${args.join(" ")}`;
+}
 function runCapturedCommand(node, options, phase, command, args, commandOptions = {}) {
-  emitProgress(options, node, phase, `$ ${command} ${args.join(" ")}`);
-  const result = spawnSync(command, args, {
-    cwd: commandOptions.cwd ?? node.path,
-    env: { ...process.env, ...commandOptions.env ?? {} },
+  const cwd = commandOptions.cwd ?? node.path;
+  const spawnCommand = command === "npm" ? npmCommandForSpawn(args) : { command, args };
+  emitProgress(options, node, phase, `$ ${displayCommand(command, args)}`);
+  const result = spawnSync(spawnCommand.command, spawnCommand.args, {
+    cwd,
+    env: command === "npm" ? npmWorkflowEnv(commandOptions.env, cwd) : withShortProcessTempEnv(commandOptions.env),
     stdio: "pipe",
     encoding: "utf8",
     timeout: commandOptions.timeoutMs
@@ -88,12 +168,12 @@ function runCapturedCommand(node, options, phase, command, args, commandOptions
   }
   if (result.status !== 0) {
     const message = (result.error?.message ? `${result.error.message}
-` : "") + (prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${command} ${args.join(" ")} failed`);
+` : "") + (prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${displayCommand(command, args)} failed`);
     throw new RepositorySaveError(message, {
       details: {
         failingRepo: node.name,
         phase,
-        command: `${command} ${args.join(" ")}`
+        command: displayCommand(command, args)
       }
     });
   }
@@ -121,9 +201,11 @@ function isNoOpGitCommitError(error) {
   return /nothing to commit|no changes added to commit/u.test(error.message);
 }
 function runQuietCommand(node, phase, command, args, commandOptions = {}) {
-  const result = spawnSync(command, args, {
-    cwd: commandOptions.cwd ?? node.path,
-    env: { ...process.env, ...commandOptions.env ?? {} },
+  const cwd = commandOptions.cwd ?? node.path;
+  const spawnCommand = command === "npm" ? npmCommandForSpawn(args) : { command, args };
+  const result = spawnSync(spawnCommand.command, spawnCommand.args, {
+    cwd,
+    env: command === "npm" ? npmWorkflowEnv(commandOptions.env, cwd) : withShortProcessTempEnv(commandOptions.env),
     stdio: "pipe",
     encoding: "utf8",
     timeout: commandOptions.timeoutMs
@@ -133,14 +215,14 @@ function runQuietCommand(node, phase, command, args, commandOptions = {}) {
   if (result.status !== 0) {
     throw new RepositorySaveError(
       [
-        `${progressPrefix(node, phase)} ${command} ${args.join(" ")} failed`,
+        `${progressPrefix(node, phase)} ${displayCommand(command, args)} failed`,
         stderr || stdout
       ].filter(Boolean).join("\n"),
       {
         details: {
           failingRepo: node.name,
           phase,
-          command: `${command} ${args.join(" ")}`
+          command: displayCommand(command, args)
         }
       }
     );
@@ -148,11 +230,13 @@ function runQuietCommand(node, phase, command, args, commandOptions = {}) {
   return stdout;
 }
 async function runStreamingCommand(node, options, phase, command, args, commandOptions = {}) {
-  emitProgress(options, node, phase, `$ ${command} ${args.join(" ")}`);
+  const cwd = commandOptions.cwd ?? node.path;
+  const spawnCommand = command === "npm" ? npmCommandForSpawn(args) : { command, args };
+  emitProgress(options, node, phase, `$ ${displayCommand(command, args)}`);
   return await new Promise((resolvePromise, reject) => {
-    const child = spawn(command, args, {
-      cwd: commandOptions.cwd ?? node.path,
-      env: { ...process.env, ...commandOptions.env ?? {} },
+    const child = spawn(spawnCommand.command, spawnCommand.args, {
+      cwd,
+      env: command === "npm" ? npmWorkflowEnv(commandOptions.env, cwd) : withShortProcessTempEnv(commandOptions.env),
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = "";
@@ -179,7 +263,7 @@ async function runStreamingCommand(node, options, phase, command, args, commandO
       if (settled) return;
       settled = true;
       child.kill("SIGTERM");
-      reject(new Error(`${progressPrefix(node, phase)} ${command} ${args.join(" ")} timed out after ${commandOptions.timeoutMs}ms`));
+      reject(new Error(`${progressPrefix(node, phase)} ${displayCommand(command, args)} timed out after ${commandOptions.timeoutMs}ms`));
     }, commandOptions.timeoutMs) : null;
     child.stdout?.on("data", (chunk) => {
       const text = chunk.toString();
@@ -219,12 +303,12 @@ async function runStreamingCommand(node, options, phase, command, args, commandO
         return;
       }
       reject(new RepositorySaveError(
-        prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${command} ${args.join(" ")} failed with exit code ${code ?? "unknown"}`,
+        prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${displayCommand(command, args)} failed with exit code ${code ?? "unknown"}`,
         {
           details: {
             failingRepo: node.name,
             phase,
-            command: `${command} ${args.join(" ")}`
+            command: displayCommand(command, args)
           }
         }
       ));
@@ -235,7 +319,9 @@ function packageScripts(packageJson) {
   const scripts = packageJson?.scripts;
   return scripts && typeof scripts === "object" && !Array.isArray(scripts) ? Object.fromEntries(Object.entries(scripts).map(([key, value]) => [key, String(value)])) : {};
 }
-function classifyRepoKind(packageJson) {
+function classifyRepoKind(packageJson, managedKind) {
+  if (managedKind === "template") return "template";
+  if (managedKind === "fixture") return "fixture";
   if (typeof packageJson?.name !== "string" || typeof packageJson?.version !== "string") {
     return "project";
   }
@@ -255,12 +341,19 @@ function repoIdForPath(root, repoDir) {
 }
 function isGitRepo(repoDir) {
   try {
-    run("git", ["rev-parse", "--is-inside-work-tree"], { cwd: repoDir, capture: true });
+    runGit(["rev-parse", "--is-inside-work-tree"], { cwd: repoDir, capture: true });
     return true;
   } catch {
     return false;
   }
 }
+function isIndependentGitRepo(repoDir) {
+  try {
+    return resolve(repoRoot(repoDir)) === resolve(repoDir);
+  } catch {
+    return false;
+  }
+}
 function originRemoteUrlSafe(repoDir) {
   try {
     return originRemoteUrl(repoDir);
@@ -278,17 +371,23 @@ function ensureWritableRemote(node, options) {
 function repoDisplayName(repoDir, packageJson) {
   return typeof packageJson?.name === "string" && packageJson.name.length > 0 ? packageJson.name : basename(repoDir);
 }
+function emptyManifestVerifyCommands() {
+  return { fast: null, local: null, release: null };
+}
+function verifyCommandFromString(repoDir, label, command) {
+  return command ? { label, command: "bash", args: ["-lc", command], cwd: repoDir } : null;
+}
+function templateVerifyCommands(repoDir) {
+  const manifest = readTreeseedTemplateRepositoryManifest(repoDir);
+  if (!manifest) return null;
+  return {
+    fast: verifyCommandFromString(repoDir, "fast", manifest.verify.fast),
+    local: verifyCommandFromString(repoDir, "local", manifest.verify.local),
+    release: verifyCommandFromString(repoDir, "release", manifest.verify.release)
+  };
+}
 function parseGitmodules(root) {
-  const gitmodulesPath = resolve(root, ".gitmodules");
-  if (!existsSync(gitmodulesPath)) {
-    return [];
-  }
-  const source = readFileSync(gitmodulesPath, "utf8");
-  const paths = [];
-  for (const match of source.matchAll(/^\s*path\s*=\s*(.+?)\s*$/gmu)) {
-    paths.push(match[1].replaceAll("\\", "/"));
-  }
-  return paths;
+  return parseGitmodulesPaths(root);
 }
 function slugBranch(branch) {
   return branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "dev";
@@ -312,18 +411,38 @@ function isDevVersionForBranch(version, branch) {
 function packageVersionAtHead(node) {
   if (!node.packageJsonPath) return null;
   try {
-    const source = run("git", ["show", "HEAD:package.json"], { cwd: node.path, capture: true });
+    const source = runGit(["show", "HEAD:package.json"], { cwd: node.path, capture: true });
     const packageJson = JSON.parse(source);
     return typeof packageJson.version === "string" ? packageJson.version : null;
   } catch {
     return null;
   }
 }
+function headCommitOrPlanPlaceholder(cwd) {
+  try {
+    return headCommit(cwd);
+  } catch {
+    return "HEAD";
+  }
+}
+function remoteBranchCommitSafe(cwd, branch) {
+  try {
+    const output = runGit(["ls-remote", "origin", `refs/heads/${branch}`], { cwd, capture: true });
+    const [sha] = output.trim().split(/\s+/u);
+    return /^[a-f0-9]{40}$/u.test(sha ?? "") ? sha : null;
+  } catch {
+    return null;
+  }
+}
+function canManagePackageJsonVersion(node) {
+  return node.kind === "package" && Boolean(node.packageJsonPath) && typeof node.packageJson?.version === "string";
+}
 function packageVersionEligibleForBranch(node, version, options) {
   return node.branchMode === "package-release-main" ? isStableSemverVersion(version) : isDevVersionForBranch(version, node.branch || options.branch);
 }
 function packageVersionTagConflictsWithHead(node, options) {
   if (node.kind !== "package") return false;
+  if (node.branchMode === "package-dev-save" && (options.devDependencyReferenceMode ?? "git-commit") === "git-commit") return false;
   const version = typeof node.packageJson?.version === "string" ? node.packageJson.version : null;
   if (!version || !packageVersionEligibleForBranch(node, version, options)) return false;
   const head = headCommit(node.path);
@@ -332,7 +451,7 @@ function packageVersionTagConflictsWithHead(node, options) {
 }
 function selectPackageVersion(node, options) {
   const current = String(node.packageJson?.version ?? "0.0.0");
-  if (node.branchMode === "package-dev-save" && isDevVersionForBranch(current, node.branch || options.branch) && !tagExists(node.path, current)) {
+  if (node.branchMode === "package-dev-save" && isDevVersionForBranch(current, node.branch || options.branch) && ((options.devDependencyReferenceMode ?? "git-commit") === "git-commit" || !tagExists(node.path, current))) {
     return { version: current, reused: true };
   }
   if (node.branchMode === "package-release-main") {
@@ -363,8 +482,6 @@ function createReport(node) {
     publishWait: null,
     version: typeof node.packageJson?.version === "string" ? node.packageJson.version : null,
     dependencySpec: node.plannedDependencySpec,
-    devTagMetadata: null,
-    replacedDevTags: [],
     branchMode: node.branchMode,
     verification: null,
     install: null,
@@ -377,29 +494,43 @@ function createReport(node) {
 }
 function discoverRepositorySaveNodes(root, gitRoot = repoRoot(root), branch = currentBranch(gitRoot), options = {}) {
   const repoDirs = /* @__PURE__ */ new Map();
-  repoDirs.set(".", gitRoot);
+  const packageAdaptersByDir = new Map(discoverTreeseedPackageAdapters(root).map((adapter) => [resolve(adapter.dir), adapter]));
+  const managedRepositoriesByDir = new Map(discoverTreeseedManagedRepositories(root).map((repo) => [resolve(repo.dir), repo]));
+  for (const repo of managedRepositoriesByDir.values()) {
+    repoDirs.set(repo.relativeDir, repo.dir);
+  }
+  if (!repoDirs.has(".")) {
+    repoDirs.set(".", gitRoot);
+  }
   if (hasCompleteTreeseedPackageCheckout(root)) {
     for (const pkg of workspacePackages(root)) {
-      if (isGitRepo(pkg.dir)) {
+      if (isIndependentGitRepo(pkg.dir)) {
         repoDirs.set(pkg.relativeDir, pkg.dir);
       }
     }
   }
+  for (const adapter of packageAdaptersByDir.values()) {
+    if (isIndependentGitRepo(adapter.dir)) {
+      repoDirs.set(adapter.relativeDir, adapter.dir);
+    }
+  }
   for (const submodulePath of parseGitmodules(root)) {
     const dir = resolve(root, submodulePath);
-    if (existsSync(dir) && isGitRepo(dir)) {
+    if (existsSync(dir) && isIndependentGitRepo(dir)) {
       repoDirs.set(submodulePath, dir);
     }
   }
   const nodes = [...repoDirs.entries()].map(([relativePath, repoDir]) => {
     const packageJsonPath = resolve(repoDir, "package.json");
     const packageJson = existsSync(packageJsonPath) ? readJson(packageJsonPath) : null;
-    const kind = classifyRepoKind(packageJson);
+    const adapter = packageAdaptersByDir.get(resolve(repoDir)) ?? null;
+    const managed = managedRepositoriesByDir.get(resolve(repoDir)) ?? null;
+    const kind = adapter && !packageJson ? "package" : classifyRepoKind(packageJson, managed?.kind);
     const repoBranch = relativePath === "." ? currentBranch(repoDir) || branch || null : branch || currentBranch(repoDir) || null;
     const branchMode = kind === "project" ? "project-save" : options.stablePackageRelease === true && repoBranch === PRODUCTION_BRANCH ? "package-release-main" : "package-dev-save";
     return {
       id: relativePath,
-      name: repoDisplayName(repoDir, packageJson),
+      name: managed?.kind === "template" || managed?.kind === "fixture" ? managed.name : adapter?.id ?? repoDisplayName(repoDir, packageJson),
       path: repoDir,
       relativePath,
       kind,
@@ -408,6 +539,7 @@ function discoverRepositorySaveNodes(root, gitRoot = repoRoot(root), branch = cu
       packageJsonPath: packageJson ? packageJsonPath : null,
       packageJson,
       scripts: packageScripts(packageJson),
+      manifestVerifyCommands: adapter?.verifyCommands ?? templateVerifyCommands(repoDir) ?? emptyManifestVerifyCommands(),
       remoteUrl: originRemoteUrlSafe(repoDir),
       dependencies: [],
       dependents: [],
@@ -502,9 +634,16 @@ function runLimited(items, limit, action) {
   });
   return Promise.all(workers);
 }
+function repositorySaveConcurrency(options) {
+  if (options.verifyMode && options.verifyMode !== "skip") {
+    return 1;
+  }
+  const configured = Number.parseInt(process.env.TREESEED_SAVE_REPOSITORY_CONCURRENCY ?? "", 10);
+  return Number.isFinite(configured) && configured > 0 ? configured : 3;
+}
 function remoteBranchExistsSafe(repoDir, branch) {
   try {
-    run("git", ["rev-parse", "--verify", `refs/remotes/origin/${branch}`], { cwd: repoDir, capture: true });
+    runGit(["rev-parse", "--verify", `refs/remotes/origin/${branch}`], { cwd: repoDir, capture: true });
     return true;
   } catch {
   }
@@ -553,13 +692,18 @@ function commitSubject(message) {
   return String(message ?? "").split(/\r?\n/u)[0]?.trim() || null;
 }
 function gitDiffSummary(repoDir) {
-  const changedFiles = run("git", ["status", "--porcelain"], { cwd: repoDir, capture: true });
-  const diff = run("git", ["diff", "--cached"], { cwd: repoDir, capture: true });
+  const changedFiles = runGit(["status", "--porcelain"], { cwd: repoDir, capture: true });
+  const rawDiff = runGit(["diff", "--cached"], { cwd: repoDir, capture: true, maxBuffer: 1024 * 1024 * 32 });
+  const maxDiffChars = 12e4;
+  const diff = rawDiff.length > maxDiffChars ? `${rawDiff.slice(0, maxDiffChars)}
+
+[treeseed-save: diff truncated from ${rawDiff.length} characters for commit-message generation]
+` : rawDiff;
   return { changedFiles, diff };
 }
 function hasStagedChanges(repoDir) {
   try {
-    return run("git", ["diff", "--cached", "--name-only"], { cwd: repoDir, capture: true }).trim().length > 0;
+    return runGit(["diff", "--cached", "--name-only"], { cwd: repoDir, capture: true }).trim().length > 0;
   } catch {
     return false;
   }
@@ -572,6 +716,54 @@ function updateDependencyReferences(node, finalizedReferences) {
   }
   return changed;
 }
+function isRootWorkspaceRepository(node, options) {
+  const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
+  return node.path === options.root && Array.isArray(packageJson?.workspaces);
+}
+function syncDirectGitDependencyLockfileEntries(node, options, references) {
+  if (references.length === 0) return false;
+  const lockfilePath = resolve(node.path, "package-lock.json");
+  if (!existsSync(lockfilePath)) return false;
+  const lockfile = readJson(lockfilePath);
+  const rootPackage = lockfile.packages && typeof lockfile.packages === "object" && !Array.isArray(lockfile.packages) ? lockfile.packages[""] : null;
+  const packageEntries = lockfile.packages && typeof lockfile.packages === "object" && !Array.isArray(lockfile.packages) ? lockfile.packages : null;
+  if (!rootPackage || !packageEntries) return false;
+  let changed = false;
+  for (const reference of references) {
+    const manifestSpec = reference.manifestSpec ?? reference.spec;
+    for (const field of dependencyFields(rootPackage)) {
+      const values = rootPackage[field];
+      if (!values || typeof values !== "object" || Array.isArray(values)) continue;
+      const dependencies = values;
+      if (reference.packageName in dependencies && dependencies[reference.packageName] !== manifestSpec) {
+        dependencies[reference.packageName] = manifestSpec;
+        changed = true;
+      }
+    }
+    const entryKey = `node_modules/${reference.packageName}`;
+    const entry = packageEntries[entryKey];
+    if (entry) {
+      const nextResolved = normalizeGitRemoteForDependency(reference.remoteUrl ?? "", "ssh");
+      const resolved = nextResolved ? `${nextResolved}#${manifestSpec.slice(manifestSpec.lastIndexOf("#") + 1)}` : manifestSpec;
+      if (entry.resolved !== resolved) {
+        entry.resolved = resolved;
+        changed = true;
+      }
+      if (typeof reference.version === "string" && reference.version && entry.version !== reference.version) {
+        entry.version = reference.version;
+        changed = true;
+      }
+      if ("integrity" in entry) {
+        delete entry.integrity;
+        changed = true;
+      }
+    }
+  }
+  if (!changed) return false;
+  writeJson(lockfilePath, lockfile);
+  emitProgress(options, node, "lockfile", "Synchronized direct internal Git dependency lockfile entries without npm git preparation.");
+  return true;
+}
 function planPackageVersion(node, options) {
   if (!node.packageJson || !node.packageJsonPath) return null;
   const current = String(node.packageJson.version ?? "0.0.0");
@@ -593,44 +785,106 @@ function shouldSkipGitDependencySmoke(options) {
 function hasNpmLockfile(repoDir) {
   return existsSync(resolve(repoDir, "package-lock.json")) || existsSync(resolve(repoDir, "npm-shrinkwrap.json"));
 }
-async function runGitDependencySmoke(node, options, reference) {
-  if (reference.mode !== "dev-git-tag" || shouldSkipGitDependencySmoke(options)) return;
-  const installSpec = reference.installSpec ?? reference.spec;
-  const tempRoot = mkdtempSync(resolve(tmpdir(), "treeseed-git-dep-smoke-"));
-  const npmCacheRoot = resolve(tempRoot, ".npm-cache");
-  try {
-    emitProgress(options, node, "smoke", `Installing ${installSpec} in a temporary project.`);
-    writeFileSync(resolve(tempRoot, "package.json"), JSON.stringify({
-      name: "treeseed-git-dependency-smoke",
-      version: "0.0.0",
-      private: true,
-      type: "module",
-      dependencies: {
-        [reference.packageName]: installSpec
+function syncRootWorkspaceLockfileMetadata(node, options) {
+  if (node.path !== options.root || !Array.isArray(node.packageJson?.workspaces)) return false;
+  const lockfilePath = resolve(node.path, "package-lock.json");
+  if (!existsSync(lockfilePath)) return false;
+  const lockfile = readJson(lockfilePath);
+  const packages = lockfile.packages;
+  if (!packages || typeof packages !== "object" || Array.isArray(packages)) return false;
+  let changed = false;
+  const packageEntries = packages;
+  const rootEntry = packageEntries[""] ?? {};
+  const workspacePackageList = workspacePackages(node.path);
+  const workspaceVersionByName = new Map(workspacePackageList.map((workspacePackage) => [String(workspacePackage.packageJson.name ?? ""), String(workspacePackage.packageJson.version ?? "")]).filter(([name, version]) => name.length > 0 && version.length > 0));
+  const rootDependencySpecs = /* @__PURE__ */ new Map();
+  for (const field of dependencyFields(node.packageJson)) {
+    const rootDeps = node.packageJson[field];
+    if (!rootDeps || typeof rootDeps !== "object" || Array.isArray(rootDeps)) continue;
+    for (const [dependencyName, dependencySpec] of Object.entries(rootDeps)) {
+      if (typeof dependencySpec === "string") {
+        rootDependencySpecs.set(dependencyName, dependencySpec);
       }
-    }, null, 2), "utf8");
-    let lastError = null;
-    for (let attempt = 1; attempt <= 5; attempt += 1) {
-      emitProgress(options, node, "smoke", `npm install --cache ${npmCacheRoot} attempt ${attempt}/5.`);
-      try {
-        await runStreamingCommand(node, options, "smoke", "npm", ["install", "--cache", npmCacheRoot], { cwd: tempRoot });
-        return;
-      } catch (error) {
-        lastError = error instanceof Error ? error.message : String(error);
+    }
+  }
+  const stableWorkspaceDependencySpec = (dependencyName) => rootDependencySpecs.get(dependencyName) ?? workspaceVersionByName.get(dependencyName) ?? null;
+  const normalizeWorkspaceDependencySpecs = (value) => Object.fromEntries(
+    Object.entries(value).map(([dependencyName, dependencySpec]) => [
+      dependencyName,
+      workspaceVersionByName.has(dependencyName) ? stableWorkspaceDependencySpec(dependencyName) : dependencySpec
+    ])
+  );
+  if (JSON.stringify(rootEntry.workspaces ?? []) !== JSON.stringify(node.packageJson.workspaces)) {
+    rootEntry.workspaces = node.packageJson.workspaces;
+    packageEntries[""] = rootEntry;
+    changed = true;
+  }
+  for (const field of dependencyFields(node.packageJson)) {
+    const nextValue = node.packageJson[field];
+    if (nextValue && typeof nextValue === "object" && !Array.isArray(nextValue)) {
+      const currentValue = rootEntry[field];
+      const currentDeps = currentValue && typeof currentValue === "object" && !Array.isArray(currentValue) ? currentValue : {};
+      const mergedDeps = { ...currentDeps };
+      let fieldChanged = false;
+      for (const [dependencyName, dependencySpec] of Object.entries(nextValue)) {
+        if (mergedDeps[dependencyName] != null) continue;
+        mergedDeps[dependencyName] = dependencySpec;
+        fieldChanged = true;
       }
-      if (attempt < 5) {
-        emitProgress(options, node, "smoke", "npm install failed; retrying in 60 seconds.", "stderr");
-        spawnSync("sleep", ["60"], { stdio: "ignore" });
+      if (fieldChanged) {
+        rootEntry[field] = mergedDeps;
+        packageEntries[""] = rootEntry;
+        changed = true;
       }
     }
-    throw new RepositorySaveError([
-      `Git dependency smoke install failed for ${reference.packageName} after 5 attempts.`,
-      `Spec: ${installSpec}`,
-      lastError ?? ""
-    ].join("\n"));
-  } finally {
-    rmSync(tempRoot, { recursive: true, force: true });
   }
+  for (const workspacePackage of workspacePackageList) {
+    const relativeDir = workspacePackage.relativeDir.replace(/\\/gu, "/");
+    const packageJson = workspacePackage.packageJson;
+    const packageName = String(packageJson.name ?? "");
+    if (!packageName) continue;
+    const packageEntry = packageEntries[relativeDir] ?? {};
+    if (packageEntry.name !== packageName) {
+      packageEntry.name = packageName;
+      changed = true;
+    }
+    if (typeof packageJson.version === "string" && packageEntry.version !== packageJson.version) {
+      packageEntry.version = packageJson.version;
+      changed = true;
+    }
+    for (const field of dependencyFields(packageJson)) {
+      const nextValue = packageJson[field];
+      if (nextValue && typeof nextValue === "object" && !Array.isArray(nextValue)) {
+        const normalizedValue = normalizeWorkspaceDependencySpecs(nextValue);
+        if (JSON.stringify(packageEntry[field] ?? {}) !== JSON.stringify(normalizedValue)) {
+          packageEntry[field] = normalizedValue;
+          changed = true;
+        }
+      }
+    }
+    packageEntries[relativeDir] = packageEntry;
+    const linkKey = `node_modules/${packageName}`;
+    const linkEntry = packageEntries[linkKey] ?? {};
+    if (linkEntry.resolved !== relativeDir) {
+      linkEntry.resolved = relativeDir;
+      changed = true;
+    }
+    if (linkEntry.link !== true) {
+      linkEntry.link = true;
+      changed = true;
+    }
+    packageEntries[linkKey] = linkEntry;
+  }
+  if (!changed) return false;
+  lockfile.packages = packageEntries;
+  writeJson(lockfilePath, lockfile);
+  emitProgress(options, node, "lockfile", "Synchronized root workspace lockfile metadata before validation.");
+  return true;
+}
+async function runGitDependencySmoke(node, options, reference) {
+  void node;
+  void options;
+  void reference;
 }
 async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs = []) {
   if (shouldSkipNetworkInstall()) {
@@ -640,7 +894,7 @@ async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs =
   let lastError = null;
   const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
   const rootWorkspaceInstall = node.path === options.root && Array.isArray(packageJson?.workspaces);
-  const installFlags = ["--package-lock-only", "--ignore-scripts"];
+  const installFlags = rootWorkspaceInstall ? ["--package-lock-only", "--ignore-scripts"] : node.branchMode === "project-save" ? ["--ignore-scripts"] : ["--package-lock-only", "--ignore-scripts"];
   const args = rootWorkspaceInstall ? gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, ...installFlags, "--force"] : ["install", ...installFlags] : gitDependencyRefreshSpecs.length > 0 ? ["install", ...gitDependencyRefreshSpecs, ...installFlags, "--force", "--workspaces=false"] : ["install", ...installFlags, "--workspaces=false"];
   for (let attempt = 1; attempt <= 5; attempt += 1) {
     emitProgress(options, node, "install", `npm ${args.join(" ")} attempt ${attempt}/5.`);
@@ -652,12 +906,42 @@ async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs =
     }
     if (attempt < 5) {
       emitProgress(options, node, "install", "npm install failed; retrying in 60 seconds.", "stderr");
-      spawnSync("sleep", ["60"], { stdio: "ignore" });
+      await sleepMs(6e4);
     }
   }
   throw new RepositorySaveError(`npm install failed after 5 attempts.
 ${lastError ?? ""}`);
 }
+async function runProjectVerificationInstallWithRetry(node, options) {
+  if (!hasNpmLockfile(node.path)) return;
+  if (shouldSkipNetworkInstall()) {
+    emitProgress(options, node, "install", "Skipped project verification dependency install because network install mode is disabled.");
+    return;
+  }
+  let lastError = null;
+  const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
+  const rootWorkspaceInstall = node.path === options.root && Array.isArray(packageJson?.workspaces);
+  if (rootWorkspaceInstall) {
+    emitProgress(options, node, "install", "Skipped root npm ci project verification install; lockfile dry-run and restored workspace links provide save-time dependency proof.");
+    return;
+  }
+  const args = rootWorkspaceInstall ? ["ci"] : ["ci", "--workspaces=false"];
+  for (let attempt = 1; attempt <= 5; attempt += 1) {
+    emitProgress(options, node, "install", `npm ${args.join(" ")} for project verification attempt ${attempt}/5.`);
+    try {
+      await runStreamingCommand(node, options, "install", "npm", args);
+      return;
+    } catch (error) {
+      lastError = error instanceof Error ? error.message : String(error);
+    }
+    if (attempt < 5) {
+      emitProgress(options, node, "install", "npm ci for verification failed; retrying in 60 seconds.", "stderr");
+      await sleepMs(6e4);
+    }
+  }
+  throw new RepositorySaveError(`Project verification dependency install failed after 5 attempts.
+${lastError ?? ""}`);
+}
 function lockfileValidationCommand(node, options) {
   const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
   const rootWorkspaceInstall = node.path === options.root && Array.isArray(packageJson?.workspaces);
@@ -668,6 +952,7 @@ async function validateRepositoryLockfile(node, options) {
   if (!hasNpmLockfile(node.path)) {
     return { status: "skipped", command: null, issues: [], error: "no npm lockfile" };
   }
+  syncRootWorkspaceLockfileMetadata(node, options);
   const issues = collectDeploymentLockfileWorkspaceIssues(node.path).map((issue) => `${issue.filePath}: ${issue.packageName} ${issue.reason}`);
   if (issues.length > 0) {
     throw new RepositorySaveError([
@@ -713,38 +998,99 @@ async function validateRepositoryLockfile(node, options) {
 function hasScript(node, scriptName) {
   return typeof node.scripts[scriptName] === "string" && node.scripts[scriptName].length > 0;
 }
+function manifestVerifyCommand(node, key) {
+  return node.manifestVerifyCommands[key] ?? null;
+}
+function hasAnyVerificationCommand(node) {
+  return hasScript(node, "verify:action") || hasScript(node, "verify:local") || hasScript(node, "verify") || Boolean(manifestVerifyCommand(node, "local")) || Boolean(manifestVerifyCommand(node, "fast"));
+}
 async function runScript(node, options, scriptName) {
   await runStreamingCommand(node, options, "verify", "npm", ["run", scriptName]);
 }
+async function runManifestVerifyCommand(node, options, verifyMode, key) {
+  const manifestCommand = manifestVerifyCommand(node, key);
+  if (!manifestCommand) {
+    throw new RepositorySaveError(`${node.name} is missing a ${key} verification command in treeseed.package.yaml.`);
+  }
+  const command = `${manifestCommand.command} ${manifestCommand.args.join(" ")}`;
+  const cacheInput = {
+    workspaceRoot: options.root,
+    repoName: node.name,
+    repoPath: node.path,
+    command,
+    verifyMode,
+    env: process.env
+  };
+  const cached = readTreeseedVerificationCache(cacheInput);
+  if (cached) {
+    emitProgress(options, node, "verify", `[verify][cache] Reused ${node.name} ${manifestCommand.label} for ${cached.headSha.slice(0, 12)}.`);
+    return { cached: true };
+  }
+  const started = Date.now();
+  await runStreamingCommand(node, options, "verify", manifestCommand.command, manifestCommand.args, { cwd: manifestCommand.cwd });
+  writeTreeseedVerificationCache(cacheInput, Date.now() - started);
+  return { cached: false };
+}
+async function runCachedScript(node, options, verifyMode, scriptName) {
+  const command = `npm run ${scriptName}`;
+  const cacheInput = {
+    workspaceRoot: options.root,
+    repoName: node.name,
+    repoPath: node.path,
+    command,
+    verifyMode,
+    env: process.env
+  };
+  const cached = readTreeseedVerificationCache(cacheInput);
+  if (cached) {
+    emitProgress(options, node, "verify", `[verify][cache] Reused ${node.name} ${scriptName} for ${cached.headSha.slice(0, 12)}.`);
+    return { cached: true };
+  }
+  const started = Date.now();
+  await runScript(node, options, scriptName);
+  writeTreeseedVerificationCache(cacheInput, Date.now() - started);
+  return { cached: false };
+}
 async function runRepoVerification(node, options, verifyMode) {
   if (verifyMode === "skip") {
     emitProgress(options, node, "verify", "Skipped verification by request.");
     return { mode: verifyMode, status: "skipped", primary: null, fallbackUsed: false, error: null };
   }
-  if (node.kind !== "package") {
-    emitProgress(options, node, "verify", "Skipped package verification for project repository.");
+  if (node.kind !== "package" && !hasAnyVerificationCommand(node)) {
+    emitProgress(options, node, "verify", "Skipped verification because project repository does not declare a Treeseed verify script.");
     return { mode: verifyMode, status: "skipped", primary: null, fallbackUsed: false, error: null };
   }
+  await runProjectVerificationInstallWithRetry(node, options);
   if (verifyMode === "local-only") {
+    if (hasScript(node, "verify:local")) {
+      await runCachedScript(node, options, verifyMode, "verify:local");
+      return { mode: verifyMode, status: "passed", primary: "verify:local", fallbackUsed: false, error: null };
+    }
+    if (manifestVerifyCommand(node, "local")) {
+      await runManifestVerifyCommand(node, options, verifyMode, "local");
+      return { mode: verifyMode, status: "passed", primary: "manifest:local", fallbackUsed: false, error: null };
+    }
+    if (manifestVerifyCommand(node, "fast")) {
+      await runManifestVerifyCommand(node, options, verifyMode, "fast");
+      return { mode: verifyMode, status: "passed", primary: "manifest:fast", fallbackUsed: false, error: null };
+    }
     if (!hasScript(node, "verify:local")) {
-      throw new RepositorySaveError(`Package ${node.name} is missing required verify:local script.`);
+      throw new RepositorySaveError(`${node.kind === "package" ? "Package" : "Project"} ${node.name} is missing required verify:local script.`);
     }
-    await runScript(node, options, "verify:local");
-    return { mode: verifyMode, status: "passed", primary: "verify:local", fallbackUsed: false, error: null };
   }
-  if (!hasScript(node, "verify:action") && !hasScript(node, "verify:local")) {
-    throw new RepositorySaveError(`Package ${node.name} is missing required verify:action or verify:local script.`);
+  if (!hasAnyVerificationCommand(node)) {
+    throw new RepositorySaveError(`${node.kind === "package" ? "Package" : "Project"} ${node.name} is missing required verify:action, verify:local, or verify script.`);
   }
   if (hasScript(node, "verify:action")) {
     try {
-      await runScript(node, options, "verify:action");
+      await runCachedScript(node, options, verifyMode, "verify:action");
       return { mode: verifyMode, status: "passed", primary: "verify:action", fallbackUsed: false, error: null };
     } catch (error) {
       if (!hasScript(node, "verify:local")) {
         throw error;
       }
       emitProgress(options, node, "verify", "verify:action failed; falling back to verify:local.", "stderr");
-      await runScript(node, options, "verify:local");
+      await runCachedScript(node, options, verifyMode, "verify:local");
       return {
         mode: verifyMode,
         status: "passed",
@@ -754,7 +1100,19 @@ async function runRepoVerification(node, options, verifyMode) {
       };
     }
   }
-  await runScript(node, options, "verify:local");
+  if (hasScript(node, "verify:local")) {
+    await runCachedScript(node, options, verifyMode, "verify:local");
+    return { mode: verifyMode, status: "passed", primary: "verify:local", fallbackUsed: true, error: null };
+  }
+  if (manifestVerifyCommand(node, "local")) {
+    await runManifestVerifyCommand(node, options, verifyMode, "local");
+    return { mode: verifyMode, status: "passed", primary: "manifest:local", fallbackUsed: true, error: null };
+  }
+  if (manifestVerifyCommand(node, "fast")) {
+    await runManifestVerifyCommand(node, options, verifyMode, "fast");
+    return { mode: verifyMode, status: "passed", primary: "manifest:fast", fallbackUsed: true, error: null };
+  }
+  await runCachedScript(node, options, verifyMode, "verify");
   return { mode: verifyMode, status: "passed", primary: "verify:local", fallbackUsed: true, error: null };
 }
 function pullRebaseFromOrigin(node, options, branch) {
@@ -800,9 +1158,57 @@ function pushCurrentBranch(node, options, branch, tagName) {
     combinedBranchAndTagPush: pushedTag
   };
 }
+async function finishRepositorySavePublish(node, options, state, report, input) {
+  const reference = input.reference ?? null;
+  const tagName = input.tagName ?? reference?.tagName ?? null;
+  const shouldDeferPush = options.deferPushUntilVerified === true && node.id === ".";
+  if (shouldDeferPush) {
+    state.deferredPushes.push({
+      node,
+      report,
+      branch: input.branch,
+      tagName,
+      rebase: input.rebase,
+      reference
+    });
+    report.pushed = false;
+    report.publishWait = {
+      ...input.rebase,
+      deferredPush: true
+    };
+    return;
+  }
+  const push = pushCurrentBranch(node, options, input.branch, tagName);
+  if (reference) {
+    await runGitDependencySmoke(node, options, reference);
+    report.dependencySpec = reference.spec;
+  }
+  report.pushed = push.pushed;
+  report.publishWait = {
+    ...input.rebase,
+    ...push
+  };
+}
+async function publishDeferredRepositoryPushes(options, state) {
+  if (state.deferredPushes.length === 0) return;
+  for (const deferred of state.deferredPushes) {
+    const push = pushCurrentBranch(deferred.node, options, deferred.branch, deferred.tagName);
+    if (deferred.reference) {
+      await runGitDependencySmoke(deferred.node, options, deferred.reference);
+      deferred.report.dependencySpec = deferred.reference.spec;
+    }
+    deferred.report.pushed = push.pushed;
+    deferred.report.publishWait = {
+      ...deferred.rebase,
+      ...push,
+      deferredPush: true
+    };
+  }
+  state.deferredPushes = [];
+}
 function tagExists(repoDir, tagName) {
   try {
-    run("git", ["rev-parse", "--verify", `refs/tags/${tagName}`], { cwd: repoDir, capture: true });
+    runGit(["rev-parse", "--verify", `refs/tags/${tagName}`], { cwd: repoDir, capture: true });
     return true;
   } catch {
     return false;
@@ -810,14 +1216,14 @@ function tagExists(repoDir, tagName) {
 }
 function localTagCommit(repoDir, tagName) {
   try {
-    return run("git", ["rev-list", "-n", "1", tagName], { cwd: repoDir, capture: true }).trim();
+    return runGit(["rev-list", "-n", "1", tagName], { cwd: repoDir, capture: true }).trim();
   } catch {
     return null;
   }
 }
 function remoteTagCommit(repoDir, tagName) {
   try {
-    const output = run("git", ["ls-remote", "--tags", "origin", `refs/tags/${tagName}*`], { cwd: repoDir, capture: true });
+    const output = runGit(["ls-remote", "--tags", "origin", `refs/tags/${tagName}*`], { cwd: repoDir, capture: true });
     const lines = output.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
     const dereferenced = lines.find((line) => line.endsWith(`refs/tags/${tagName}^{}`));
     const exact = lines.find((line) => line.endsWith(`refs/tags/${tagName}`));
@@ -829,7 +1235,7 @@ function remoteTagCommit(repoDir, tagName) {
 }
 function localTagMessage(repoDir, tagName) {
   try {
-    return run("git", ["tag", "-l", tagName, "--format=%(contents)"], { cwd: repoDir, capture: true }).trim();
+    return runGit(["tag", "-l", tagName, "--format=%(contents)"], { cwd: repoDir, capture: true }).trim();
   } catch {
     return null;
   }
@@ -870,13 +1276,9 @@ function assertTagStateMatchesHead(node, tagName, state, head) {
   }
 }
 function createPackageTagMessage(node, tagName, branch, workflowRunId) {
-  return tagName.includes("-dev.") ? createDevTagMessage({
-    packageName: node.name,
-    version: tagName,
-    branch,
-    commitSha: headCommit(node.path),
-    workflowRunId
-  }) : `release: ${tagName}`;
+  void branch;
+  void workflowRunId;
+  return `release: ${tagName}`;
 }
 function ensureRemoteAccessBeforeVerification(node, options, state) {
   if (shouldSkipRemoteAccessPreflight()) return;
@@ -906,12 +1308,6 @@ function ensureRemoteAccessBeforeVerification(node, options, state) {
 function shouldSkipRemoteAccessPreflight() {
   return process.env.TREESEED_SAVE_REMOTE_PREFLIGHT === "skip";
 }
-function localTreeseedTagWasCreatedByThisRun(node, tagName, workflowRunId) {
-  const message = localTagMessage(node.path, tagName);
-  if (!message?.includes("treeseed-dev-tag: true")) return false;
-  if (!workflowRunId) return true;
-  return message.includes(`workflowRunId: ${workflowRunId}`);
-}
 function ensurePackageTagReady(node, options, tagName, branch, workflowRunId) {
   let message = null;
   ensureWritableRemote(node, options);
@@ -936,7 +1332,7 @@ function ensurePackageTagReady(node, options, tagName, branch, workflowRunId) {
 }
 function treeCommitForPath(repoDir, ref, path) {
   try {
-    const output = run("git", ["ls-tree", ref, "--", path], { cwd: repoDir, capture: true }).trim();
+    const output = runGit(["ls-tree", ref, "--", path], { cwd: repoDir, capture: true }).trim();
     const match = output.match(/^\d+\s+commit\s+([0-9a-f]{40})\t/u);
     return match?.[1] ?? null;
   } catch {
@@ -950,7 +1346,7 @@ function collectSubmodulePointerChanges(node, finalizedCommits) {
     if (!childRelativePath) continue;
     const childPath = resolve(node.path, childRelativePath);
     if (!existsSync(childPath) || !isGitRepo(childPath)) continue;
-    const status = run("git", ["status", "--porcelain", "--", childRelativePath], { cwd: node.path, capture: true });
+    const status = runGit(["status", "--porcelain", "--", childRelativePath], { cwd: node.path, capture: true });
     const oldSha = treeCommitForPath(node.path, "HEAD", childRelativePath);
     const newSha = finalizedCommit || headCommit(childPath);
     if (status.trim().length > 0 || oldSha && newSha && oldSha !== newSha) {
@@ -1007,7 +1403,7 @@ function refreshRepositoryNodePackageMetadata(node) {
   node.packageJson = packageJson;
   node.scripts = packageScripts(packageJson);
   node.remoteUrl = originRemoteUrlSafe(node.path);
-  if (node.kind === "package") {
+  if (node.kind === "package" && packageJson) {
     node.name = repoDisplayName(node.path, packageJson);
   }
 }
@@ -1017,7 +1413,8 @@ function finalizePackageReference(node, version, options) {
     version,
     branchMode: node.branchMode === "package-release-main" ? "package-release-main" : "package-dev-save",
     remoteUrl: node.remoteUrl,
-    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-tag",
+    commitSha: headCommit(node.path),
+    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-commit",
     gitDependencyProtocol: options.gitDependencyProtocol ?? "preserve-origin"
   });
   node.plannedDependencySpec = reference.spec;
@@ -1029,21 +1426,25 @@ async function finalizeCleanPackageVersion(node, options, state, report, branch)
     return false;
   }
   const head = headCommit(node.path);
-  const currentTagState = tagState(node.path, version);
-  assertTagStateMatchesHead(node, version, currentTagState, head);
+  const reference = finalizePackageReference(node, version, options);
+  const currentTagState = reference.tagName ? tagState(node.path, reference.tagName) : null;
+  if (reference.tagName && currentTagState) {
+    assertTagStateMatchesHead(node, reference.tagName, currentTagState, head);
+  }
   const remoteBranchExists2 = remoteBranchExistsSafe(node.path, branch);
-  const finalizedRemotely = currentTagState.localCommit === head && currentTagState.remoteCommit === head && remoteBranchExists2;
+  const remoteBranchCommit = remoteBranchCommitSafe(node.path, branch);
+  const finalizedRemotely = remoteBranchExists2 && remoteBranchCommit === head && (!reference.tagName || currentTagState?.localCommit === head && currentTagState?.remoteCommit === head);
   report.version = version;
-  report.tagName = version;
+  report.tagName = reference.tagName;
   report.commitSha = head;
-  report.dependencySpec = finalizePackageReference(node, version, options).spec;
+  report.dependencySpec = reference.spec;
   state.finalizedVersions.set(node.name, version);
-  state.finalizedReferences.set(node.name, finalizePackageReference(node, version, options));
+  state.finalizedReferences.set(node.name, reference);
   state.finalizedCommits.set(node.relativePath, head);
   if (finalizedRemotely) {
     report.pushed = true;
     report.skippedReason = "already-finalized";
-    report.publishWait = { recoveredPartialSave: true, remoteBranchExisted: true, tagAlreadyPushed: true };
+    report.publishWait = { recoveredPartialSave: true, remoteBranchExisted: true, tagAlreadyPushed: Boolean(reference.tagName) };
     emitProgress(options, node, "finalize", `Using existing finalized package version ${version}.`);
     return true;
   }
@@ -1053,36 +1454,24 @@ async function finalizeCleanPackageVersion(node, options, state, report, branch)
     report.lockfileValidation = await validateRepositoryLockfile(node, options);
   }
   const rebase = pullRebaseFromOrigin(node, options, branch);
-  if (currentTagState.localCommit === head && localTreeseedTagWasCreatedByThisRun(node, version, options.workflowRunId)) {
-    emitProgress(options, node, "verify", `Reusing verification from interrupted tag ${version}.`);
-    report.verification = {
-      mode: options.verifyMode ?? "action-first",
-      status: "skipped",
-      primary: null,
-      fallbackUsed: false,
-      error: "verified-before-interruption"
-    };
-    report.verified = true;
-  } else {
-    ensureRemoteAccessBeforeVerification(node, options, state);
-    report.verification = await runRepoVerification(node, options, options.verifyMode ?? "action-first");
-    report.verified = report.verification.status === "passed";
-  }
-  const tagMessage = ensurePackageTagReady(node, options, version, branch, options.workflowRunId);
-  report.devTagMetadata = tagMessage?.includes("treeseed-dev-tag: true") ? tagMessage : null;
-  const reference = finalizePackageReference(node, version, options);
-  const push = pushCurrentBranch(node, options, branch, version);
-  await runGitDependencySmoke(node, options, reference);
+  ensureRemoteAccessBeforeVerification(node, options, state);
+  report.verification = await runRepoVerification(node, options, options.verifyMode ?? "action-first");
+  report.verified = report.verification.status === "passed";
+  const tagMessage = reference.tagName ? ensurePackageTagReady(node, options, reference.tagName, branch, options.workflowRunId) : null;
+  void tagMessage;
   report.dependencySpec = reference.spec;
-  report.pushed = push.pushed;
   report.skippedReason = "finalized-partial-save";
   report.commitSha = headCommit(node.path);
   state.finalizedCommits.set(node.relativePath, report.commitSha);
-  report.publishWait = {
-    ...rebase,
-    ...push,
-    recoveredPartialSave: true
-  };
+  await finishRepositorySavePublish(node, options, state, report, {
+    branch,
+    rebase: {
+      ...rebase,
+      recoveredPartialSave: true
+    },
+    reference,
+    tagName: reference.tagName
+  });
   return true;
 }
 function branchModeLabel(branchMode) {
@@ -1115,9 +1504,9 @@ function repoPlanCommands(node, options, plannedVersion, plannedDependencySpec,
   const rootWorkspaceInstall = node.path === options.root && Array.isArray(packageJson?.workspaces);
   if (node.kind === "package" && plannedVersion) {
     commands.push(`update package.json version to ${plannedVersion}`);
-    commands.push("npm install --workspaces=false # explicitly refresh changed git-tag dependencies with --force; retry up to 5 times with 60s delay");
-  } else if (node.kind === "project" && dependencyUpdates.length > 0 && hasNpmLockfile(node.path)) {
-    commands.push(rootWorkspaceInstall ? "npm install # refresh root workspace lockfile against the real checked-in manifest" : "npm install --workspaces=false # refresh project lockfile after internal dependency updates");
+    commands.push("npm install --workspaces=false # explicitly refresh changed git commit dependencies with --force; retry up to 5 times with 60s delay");
+  } else if (node.kind === "project" && (dependencyUpdates.length > 0 || rootWorkspaceInstall && node.submoduleDependencies.length > 0) && hasNpmLockfile(node.path)) {
+    commands.push(rootWorkspaceInstall ? "npm install --package-lock-only --ignore-scripts # refresh root workspace lockfile without installing git dependencies" : "npm install --workspaces=false # refresh project lockfile after internal dependency updates");
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || plannedVersion || dependencyUpdates.length > 0 || node.submoduleDependencies.length > 0)) {
     commands.push(rootWorkspaceInstall ? "npm ci --ignore-scripts --dry-run # validate root manifest, workspaces, and lockfile before commit" : "npm ci --ignore-scripts --dry-run --workspaces=false # validate deployment lockfile before commit");
@@ -1128,24 +1517,39 @@ function repoPlanCommands(node, options, plannedVersion, plannedDependencySpec,
   commands.push(
     remoteExists ? `git pull --rebase --recurse-submodules=no origin ${branch}` : `skip pull --rebase # origin/${branch} does not exist yet`
   );
-  if (node.kind === "package") {
-    const verifyMode = options.verifyMode ?? "action-first";
-    if (verifyMode === "skip") {
-      commands.push("skip package verification");
-    } else if (verifyMode === "local-only") {
+  const verifyMode = options.verifyMode ?? "action-first";
+  if (verifyMode === "skip") {
+    commands.push(node.kind === "package" ? "skip package verification" : "skip project verification");
+  } else if (hasScript(node, "verify:action") || hasScript(node, "verify:local") || hasScript(node, "verify")) {
+    if (verifyMode === "local-only") {
       commands.push("npm run verify:local");
-    } else {
+    } else if (hasScript(node, "verify:action")) {
       commands.push("npm run verify:action # fallback to npm run verify:local on failure");
+    } else if (hasScript(node, "verify:local")) {
+      commands.push("npm run verify:local");
+    } else {
+      commands.push("npm run verify");
     }
-    if (plannedVersion) {
-      commands.push(`git tag -a ${plannedVersion} -m <${plannedVersion.includes("-dev.") ? "dev metadata" : "release"}>`);
+  } else if (manifestVerifyCommand(node, "local") || manifestVerifyCommand(node, "fast")) {
+    const command = verifyMode === "local-only" ? manifestVerifyCommand(node, "local") ?? manifestVerifyCommand(node, "fast") : manifestVerifyCommand(node, "local") ?? manifestVerifyCommand(node, "fast");
+    if (command) commands.push(`${command.command} ${command.args.join(" ")} # treeseed.package.yaml verification`);
+  } else if (node.kind !== "package") {
+    commands.push("skip verification # project repository has no Treeseed verify script");
+  }
+  if (node.kind === "package") {
+    const plansTag = plannedVersion && node.branchMode === "package-release-main";
+    if (plannedVersion && plansTag) {
+      commands.push(`git tag -a ${plannedVersion} -m <release>`);
       commands.push(remoteExists ? `git push origin ${branch} ${plannedVersion}` : `git push -u origin ${branch} ${plannedVersion}`);
+    } else if (plannedVersion) {
+      commands.push(remoteExists ? `git push origin ${branch}` : `git push -u origin ${branch}`);
       if (plannedDependencySpec && node.branchMode === "package-dev-save") {
-        commands.push(`smoke install ${plannedDependencySpec}`);
+        commands.push(`npm install ${node.name}@${plannedDependencySpec} --package-lock-only --ignore-scripts --force # validate dependency commit reachability`);
       }
+    } else {
+      commands.push(remoteExists ? `git push origin ${branch}` : `git push -u origin ${branch}`);
     }
   } else {
-    commands.push("skip package verification # project repository");
     commands.push(remoteExists ? `git push origin ${branch}` : `git push -u origin ${branch}`);
   }
   return commands;
@@ -1173,7 +1577,7 @@ function planRepositorySave(options) {
         return dependency?.dirty || Boolean(dependency?.plannedVersion);
       });
       const dirty = hasMeaningfulChanges(node.path);
-      const packageNeedsVersion = node.kind === "package" && (dirty || dependencyChanged || submoduleChanged);
+      const packageNeedsVersion = canManagePackageJsonVersion(node) && (dirty || dependencyChanged || submoduleChanged);
       const currentVersion = typeof node.packageJson?.version === "string" ? node.packageJson.version : null;
       const plannedVersion = packageNeedsVersion ? selectPackageVersion(node, options).version : null;
       let plannedDependencySpec = null;
@@ -1183,7 +1587,8 @@ function planRepositorySave(options) {
           version: plannedVersion,
           branchMode: node.branchMode === "package-release-main" ? "package-release-main" : "package-dev-save",
           remoteUrl: node.remoteUrl,
-          devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-tag",
+          commitSha: headCommitOrPlanPlaceholder(node.path),
+          devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-commit",
           gitDependencyProtocol: options.gitDependencyProtocol ?? "preserve-origin"
         });
         plannedDependencySpec = reference.spec;
@@ -1195,7 +1600,7 @@ function planRepositorySave(options) {
       const notes = [
         `${branchModeLabel(node.branchMode)} on top-level ${options.branch}`,
         ...current && current !== branch ? [`current branch ${current} will be switched to ${branch}`] : [],
-        ...node.kind === "package" && plannedVersion?.includes("-dev.") ? ["dev Git tag only; publish workflows reject prerelease/dev tags"] : []
+        ...node.kind === "package" && plannedVersion?.includes("-dev.") ? ["development and staging dependency refs use the package commit SHA; no Git tag is created"] : []
       ];
       const repoPlan = {
         id: node.id,
@@ -1212,7 +1617,7 @@ function planRepositorySave(options) {
         submoduleDependencies: node.submoduleDependencies,
         currentVersion,
         plannedVersion,
-        plannedTag: plannedVersion,
+        plannedTag: plannedReferences.get(node.name)?.tagName ?? null,
         plannedDependencySpec,
         remoteUrl: node.remoteUrl,
         commands: repoPlanCommands(node, options, plannedVersion, plannedDependencySpec, dependencyUpdates),
@@ -1240,7 +1645,7 @@ function planRepositorySave(options) {
     mode,
     branch: options.branch,
     scope,
-    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-tag",
+    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-commit",
     gitDependencyProtocol: options.gitDependencyProtocol ?? "preserve-origin",
     verifyMode: options.verifyMode ?? "action-first",
     commitMessageMode: options.commitMessageMode ?? "auto",
@@ -1269,6 +1674,7 @@ async function refreshAndValidateRootWorkspaceLockfileForSave(options) {
     packageJsonPath: packageJson ? packageJsonPath : null,
     packageJson,
     scripts: packageScripts(packageJson),
+    manifestVerifyCommands: emptyManifestVerifyCommands(),
     remoteUrl: originRemoteUrlSafe(repoDir),
     dependencies: [],
     dependents: [],
@@ -1297,13 +1703,15 @@ async function saveOneRepository(node, options, state) {
   report.branch = node.branch;
   refreshRepositoryNodePackageMetadata(node);
   ensureWritableRemote(node, options);
-  const dependencyUpdates = updateDependencyReferences(node, state.finalizedReferences);
+  const dependencyUpdates = isRootWorkspaceRepository(node, options) ? [] : updateDependencyReferences(node, state.finalizedReferences);
   const dependencyChanged = dependencyUpdates.length > 0;
-  const gitDependencyRefreshSpecs = dependencyUpdates.map((update) => state.finalizedReferences.get(update.packageName)).filter((reference) => Boolean(reference) && reference.mode === "dev-git-tag").map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
+  const gitDependencyRefreshReferences = dependencyUpdates.map((update) => state.finalizedReferences.get(update.packageName)).filter((reference) => Boolean(reference) && reference.mode === "dev-git-commit");
+  const lockfileGitDependenciesSynced = syncDirectGitDependencyLockfileEntries(node, options, gitDependencyRefreshReferences);
+  const gitDependencyRefreshSpecs = lockfileGitDependenciesSynced ? [] : gitDependencyRefreshReferences.map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
   const submodulePointers = collectSubmodulePointerChanges(node, state.finalizedCommits);
   const submodulesChanged = submodulePointers.length > 0;
   const packageHasMeaningfulChanges = hasMeaningfulChanges(node.path);
-  const packageNeedsVersion = node.kind === "package" && (packageHasMeaningfulChanges || dependencyChanged || submodulesChanged || packageVersionTagConflictsWithHead(node, options));
+  const packageNeedsVersion = canManagePackageJsonVersion(node) && (packageHasMeaningfulChanges || dependencyChanged || submodulesChanged || packageVersionTagConflictsWithHead(node, options));
   let plannedVersion = null;
   if (packageNeedsVersion) {
     const selection = selectPackageVersion(node, options);
@@ -1317,18 +1725,18 @@ async function saveOneRepository(node, options, state) {
       applyPackageVersion(node, plannedVersion);
     }
     node.plannedVersion = plannedVersion;
-    node.plannedTag = plannedVersion;
     report.version = plannedVersion;
-    report.tagName = plannedVersion;
     if (!selection.reused) {
       emitProgress(options, node, "version", `Planned ${plannedVersion}.`);
     }
     const reference = finalizePackageReference(node, plannedVersion, options);
+    node.plannedTag = reference.tagName;
+    report.tagName = reference.tagName;
     report.dependencySpec = reference.spec;
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   } else if (node.kind === "package") {
     report.version = String(node.packageJson?.version ?? report.version ?? "");
-  } else if (node.kind === "project" && dependencyChanged && hasNpmLockfile(node.path)) {
+  } else if (node.kind === "project" && (dependencyChanged || node.path === options.root && submodulesChanged) && hasNpmLockfile(node.path)) {
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || packageNeedsVersion || dependencyChanged || submodulesChanged)) {
@@ -1351,14 +1759,9 @@ async function saveOneRepository(node, options, state) {
         return report;
       }
     }
-    if (node.id === ".") {
+    if (node.kind === "project" || node.kind === "package" && !canManagePackageJsonVersion(node)) {
       const rebase2 = pullRebaseFromOrigin(node, options, branch);
-      const push = pushCurrentBranch(node, options, branch);
-      report.pushed = push.pushed;
-      report.publishWait = {
-        ...rebase2,
-        ...push
-      };
+      await finishRepositorySavePublish(node, options, state, report, { branch, rebase: rebase2 });
       report.commitSha = headCommit(node.path);
     }
     state.finalizedCommits.set(node.relativePath, report.commitSha);
@@ -1376,14 +1779,9 @@ async function saveOneRepository(node, options, state) {
         return report;
       }
     }
-    if (node.id === ".") {
+    if (node.kind === "project" || node.kind === "package" && !canManagePackageJsonVersion(node)) {
       const rebase2 = pullRebaseFromOrigin(node, options, branch);
-      const push = pushCurrentBranch(node, options, branch);
-      report.pushed = push.pushed;
-      report.publishWait = {
-        ...rebase2,
-        ...push
-      };
+      await finishRepositorySavePublish(node, options, state, report, { branch, rebase: rebase2 });
       report.commitSha = headCommit(node.path);
     }
     state.finalizedCommits.set(node.relativePath, report.commitSha);
@@ -1421,14 +1819,9 @@ async function saveOneRepository(node, options, state) {
         return report;
       }
     }
-    if (node.id === ".") {
+    if (node.kind === "project" || node.kind === "package" && !canManagePackageJsonVersion(node)) {
       const rebase2 = pullRebaseFromOrigin(node, options, branch);
-      const push = pushCurrentBranch(node, options, branch);
-      report.pushed = push.pushed;
-      report.publishWait = {
-        ...rebase2,
-        ...push
-      };
+      await finishRepositorySavePublish(node, options, state, report, { branch, rebase: rebase2 });
       report.commitSha = headCommit(node.path);
     }
     state.finalizedCommits.set(node.relativePath, report.commitSha);
@@ -1437,35 +1830,31 @@ async function saveOneRepository(node, options, state) {
   report.committed = true;
   const rebase = pullRebaseFromOrigin(node, options, branch);
   const verifyMode = options.verifyMode ?? "action-first";
+  if (node.kind === "project" && node.path === options.root && Array.isArray(node.packageJson?.workspaces)) {
+    const linkReport = ensureLocalWorkspaceLinks(options.root);
+    const restoredLinks = Array.isArray(linkReport.created) ? linkReport.created.length : 0;
+    if (restoredLinks > 0) {
+      emitProgress(options, node, "install", `Restored ${restoredLinks} local workspace package link${restoredLinks === 1 ? "" : "s"} before project verification.`);
+    }
+  }
   if (node.kind === "package") {
     ensureRemoteAccessBeforeVerification(node, options, state);
   }
   report.verification = await runRepoVerification(node, options, verifyMode);
   report.verified = report.verification.status === "passed";
-  if (node.kind === "package") {
+  if (canManagePackageJsonVersion(node)) {
     const version = plannedVersion ?? String(readJson(resolve(node.path, "package.json")).version ?? report.version ?? "");
-    const tagMessage = ensurePackageTagReady(node, options, version, branch, options.workflowRunId);
-    report.tagName = version;
-    report.version = version;
-    report.devTagMetadata = tagMessage?.includes("treeseed-dev-tag: true") ? tagMessage : null;
     const reference = finalizePackageReference(node, version, options);
-    const push = pushCurrentBranch(node, options, branch, version);
-    await runGitDependencySmoke(node, options, reference);
+    const tagMessage = reference.tagName ? ensurePackageTagReady(node, options, reference.tagName, branch, options.workflowRunId) : null;
+    void tagMessage;
+    report.tagName = reference.tagName;
+    report.version = version;
     report.dependencySpec = reference.spec;
     state.finalizedVersions.set(node.name, version);
     state.finalizedReferences.set(node.name, reference);
-    report.pushed = push.pushed;
-    report.publishWait = {
-      ...rebase,
-      ...push
-    };
+    await finishRepositorySavePublish(node, options, state, report, { branch, rebase, reference, tagName: reference.tagName });
   } else {
-    const push = pushCurrentBranch(node, options, branch);
-    report.pushed = push.pushed;
-    report.publishWait = {
-      ...rebase,
-      ...push
-    };
+    await finishRepositorySavePublish(node, options, state, report, { branch, rebase });
   }
   report.commitSha = headCommit(node.path);
   report.skippedReason = null;
@@ -1490,10 +1879,12 @@ async function runRepositorySaveOrchestrator(options) {
     finalizedCommits: /* @__PURE__ */ new Map(),
     reports: new Map(nodes.map((node) => [node.id, createReport(node)])),
     remoteAccessChecked: /* @__PURE__ */ new Set(),
-    workflowGates: []
+    workflowGates: [],
+    deferredPushes: []
   };
+  const concurrency = repositorySaveConcurrency(options);
   for (const [index, wave] of waves.entries()) {
-    await runLimited(wave, 3, async (node) => {
+    await runLimited(wave, concurrency, async (node) => {
       try {
         await saveOneRepository(node, options, state);
       } catch (error) {
@@ -1554,6 +1945,7 @@ async function runRepositorySaveOrchestrator(options) {
       state.workflowGates.push(...waveGates);
     }
   }
+  await publishDeferredRepositoryPushes(options, state);
   const rootNode = nodes.find((node) => node.id === ".") ?? allNodes.find((node) => node.id === ".");
   const rootReport = rootNode ? state.reports.get(rootNode.id) ?? createReport(rootNode) : createReport({
     id: ".",