@treeseed/sdk 0.10.28 → 0.12.4

package/dist/operations/services/runtime-tools.js

@@ -3,7 +3,7 @@ import { dirname, extname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
-import { parse as parseYaml } from "yaml";
+import { loadTreeseedDeployConfigFromPath } from "../../platform/deploy-config.js";
 const require2 = createRequire(import.meta.url);
 const scriptRoot = dirname(fileURLToPath(import.meta.url));
 function resolveSdkPackageRoot(startDir) {
@@ -28,246 +28,7 @@ function resolveSdkPackageRoot(startDir) {
 }
 const packageRootFromSource = resolveSdkPackageRoot(scriptRoot);
 const treeseedRuntimeRoot = resolve(packageRootFromSource, "src", "treeseed");
-const TREESEED_DEFAULT_PLUGIN_REFERENCES = [
-  {
-    package: "@treeseed/sdk/plugin-default",
-    enabled: true
-  }
-];
-const TREESEED_DEFAULT_PROVIDER_SELECTIONS = {
-  forms: "store_only",
-  agents: {
-    execution: "codex",
-    mutation: "local_branch",
-    repository: "git",
-    verification: "local",
-    notification: "sdk_message",
-    research: "project_graph"
-  },
-  deploy: "cloudflare",
-  dns: "cloudflare-dns",
-  content: {
-    runtime: "team_scoped_r2_overlay",
-    publish: "team_scoped_r2_overlay",
-    docs: "default"
-  },
-  site: "default"
-};
-const TRESEED_MANAGED_SERVICE_KEYS = ["marketDatabase", "api", "marketOperationsRunner"];
 const TRESEED_WORKSPACE_PACKAGE_DIRS = ["sdk", "core", "cli"];
-const CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER = "replace-with-cloudflare-account-id";
-function normalizePlanesFromLegacyHosting(hosting) {
-  if (!hosting || Object.keys(hosting).length === 0) {
-    return {
-      hub: { mode: "treeseed_hosted" },
-      runtime: { mode: "none", registration: "none" }
-    };
-  }
-  if (hosting.kind === "market_control_plane" || hosting.kind === "hosted_project") {
-    return {
-      hub: { mode: "treeseed_hosted" },
-      runtime: {
-        mode: "treeseed_managed",
-        registration: hosting.kind === "market_control_plane" ? "none" : hosting.registration ?? "none",
-        marketBaseUrl: hosting.marketBaseUrl,
-        teamId: hosting.teamId,
-        projectId: hosting.projectId
-      }
-    };
-  }
-  return {
-    hub: { mode: "customer_hosted" },
-    runtime: {
-      mode: "byo_attached",
-      registration: hosting.registration ?? "none",
-      marketBaseUrl: hosting.marketBaseUrl,
-      teamId: hosting.teamId,
-      projectId: hosting.projectId
-    }
-  };
-}
-function normalizeLegacyHostingFromPlanes(hub, runtime) {
-  if (runtime.mode === "treeseed_managed" && hub.mode === "treeseed_hosted") {
-    return {
-      kind: "hosted_project",
-      registration: runtime.registration === "required" ? "optional" : runtime.registration ?? "none",
-      marketBaseUrl: runtime.marketBaseUrl,
-      teamId: runtime.teamId,
-      projectId: runtime.projectId
-    };
-  }
-  return {
-    kind: "self_hosted_project",
-    registration: runtime.registration === "required" ? "optional" : runtime.registration ?? "none",
-    marketBaseUrl: runtime.marketBaseUrl,
-    teamId: runtime.teamId,
-    projectId: runtime.projectId
-  };
-}
-function parseServiceEnvironmentConfig(value) {
-  const record = optionalRecord(value, "service environment") ?? {};
-  return {
-    baseUrl: optionalString(record.baseUrl),
-    domain: optionalString(record.domain),
-    railwayEnvironment: optionalString(record.railwayEnvironment)
-  };
-}
-function parseLocalRuntimeConfig(value, label) {
-  const record = optionalRecord(value, label);
-  if (!record) {
-    return void 0;
-  }
-  return {
-    runtime: optionalEnum(record.runtime ?? record.runtime_mode ?? record.runtimeMode, `${label}.runtime`, ["auto", "provider", "local"])
-  };
-}
-function parseManagedServiceConfig(value, label) {
-  const record = optionalRecord(value, label);
-  if (!record) {
-    return void 0;
-  }
-  const railway = optionalRecord(record.railway, `${label}.railway`) ?? {};
-  const cloudflare = optionalRecord(record.cloudflare, `${label}.cloudflare`) ?? {};
-  const environments = optionalRecord(record.environments, `${label}.environments`) ?? {};
-  return {
-    enabled: record.enabled === void 0 ? void 0 : optionalBoolean(record.enabled, `${label}.enabled`),
-    provider: optionalString(record.provider),
-    rootDir: optionalString(record.rootDir),
-    publicBaseUrl: optionalString(record.publicBaseUrl),
-    local: parseLocalRuntimeConfig(record.local, `${label}.local`),
-    cloudflare: {
-      workerName: optionalString(cloudflare.workerName)
-    },
-    railway: {
-      projectId: optionalString(railway.projectId),
-      projectName: optionalString(railway.projectName),
-      serviceId: optionalString(railway.serviceId),
-      serviceName: optionalString(railway.serviceName),
-      resourceType: optionalString(railway.resourceType),
-      environmentVariable: optionalString(railway.environmentVariable),
-      serviceTargets: Array.isArray(railway.serviceTargets) ? railway.serviceTargets.map((entry) => optionalString(entry)).filter(Boolean) : void 0,
-      rootDir: optionalString(railway.rootDir),
-      buildCommand: optionalString(railway.buildCommand),
-      startCommand: optionalString(railway.startCommand),
-      healthcheckPath: optionalString(railway.healthcheckPath),
-      healthcheckTimeoutSeconds: optionalNonNegativeNumber(railway.healthcheckTimeoutSeconds, `${label}.railway.healthcheckTimeoutSeconds`),
-      healthcheckIntervalSeconds: optionalNonNegativeNumber(railway.healthcheckIntervalSeconds, `${label}.railway.healthcheckIntervalSeconds`),
-      restartPolicy: optionalString(railway.restartPolicy),
-      runtimeMode: optionalString(railway.runtimeMode),
-      volumeMountPath: optionalString(railway.volumeMountPath),
-      runnerPool: optionalRecord(railway.runnerPool, `${label}.railway.runnerPool`) ? {
-        bootstrapCount: optionalNonNegativeNumber(railway.runnerPool.bootstrapCount, `${label}.railway.runnerPool.bootstrapCount`),
-        maxRunners: optionalNonNegativeNumber(railway.runnerPool.maxRunners, `${label}.railway.runnerPool.maxRunners`),
-        volumeMountPath: optionalString(railway.runnerPool.volumeMountPath)
-      } : void 0,
-      schedule: Array.isArray(railway.schedule) ? railway.schedule.map((entry) => optionalString(entry)).filter(Boolean) : optionalString(railway.schedule)
-    },
-    environments: {
-      local: parseServiceEnvironmentConfig(environments.local),
-      staging: parseServiceEnvironmentConfig(environments.staging),
-      prod: parseServiceEnvironmentConfig(environments.prod)
-    }
-  };
-}
-function parseManagedServicesConfig(value) {
-  const record = optionalRecord(value, "services");
-  if (!record) {
-    return void 0;
-  }
-  return Object.fromEntries(
-    TRESEED_MANAGED_SERVICE_KEYS.map((serviceKey) => [
-      serviceKey,
-      parseManagedServiceConfig(record[serviceKey], `services.${serviceKey}`)
-    ])
-  );
-}
-function parseWebSurfaceCacheConfig(value, label) {
-  const record = optionalRecord(value, label) ?? {};
-  if (Object.keys(record).length === 0) {
-    return void 0;
-  }
-  return {
-    sourcePages: parseWebCachePolicyRecord(record.sourcePages ?? record.source_pages, `${label}.sourcePages`, {
-      paths: ["/", "/contact", "/404"]
-    }),
-    contentPages: parseWebCachePolicyRecord(record.contentPages ?? record.content_pages, `${label}.contentPages`),
-    r2PublishedObjects: parseWebCachePolicyRecord(
-      record.r2PublishedObjects ?? record.r2_published_objects,
-      `${label}.r2PublishedObjects`
-    )
-  };
-}
-function parseWebCachePolicyRecord(value, label, options = {}) {
-  const record = optionalRecord(value, label) ?? {};
-  if (Object.keys(record).length === 0) {
-    return options.paths ? { paths: [...options.paths] } : void 0;
-  }
-  const parsed = {
-    browserTtlSeconds: optionalNonNegativeNumber(
-      record.browserTtlSeconds ?? record.browser_ttl_seconds,
-      `${label}.browserTtlSeconds`
-    ),
-    edgeTtlSeconds: optionalNonNegativeNumber(
-      record.edgeTtlSeconds ?? record.edge_ttl_seconds,
-      `${label}.edgeTtlSeconds`
-    ),
-    staleWhileRevalidateSeconds: optionalNonNegativeNumber(
-      record.staleWhileRevalidateSeconds ?? record.stale_while_revalidate_seconds,
-      `${label}.staleWhileRevalidateSeconds`
-    ),
-    staleIfErrorSeconds: optionalNonNegativeNumber(
-      record.staleIfErrorSeconds ?? record.stale_if_error_seconds,
-      `${label}.staleIfErrorSeconds`
-    )
-  };
-  if (options.paths) {
-    parsed.paths = [...new Set(Array.isArray(record.paths) ? record.paths.map((entry) => optionalString(entry)).filter(Boolean) : options.paths)];
-  }
-  return parsed;
-}
-function parseSurfaceConfig(value, label) {
-  const record = optionalRecord(value, label);
-  if (!record) {
-    return void 0;
-  }
-  return {
-    enabled: record.enabled === void 0 ? void 0 : optionalBoolean(record.enabled, `${label}.enabled`),
-    provider: optionalString(record.provider),
-    rootDir: optionalString(record.rootDir),
-    publicBaseUrl: optionalString(record.publicBaseUrl),
-    localBaseUrl: optionalString(record.localBaseUrl),
-    local: parseLocalRuntimeConfig(record.local, `${label}.local`),
-    environments: (() => {
-      const environments = optionalRecord(record.environments, `${label}.environments`);
-      if (!environments) {
-        return void 0;
-      }
-      return {
-        local: parseServiceEnvironmentConfig(environments.local),
-        staging: parseServiceEnvironmentConfig(environments.staging),
-        prod: parseServiceEnvironmentConfig(environments.prod)
-      };
-    })(),
-    cache: parseWebSurfaceCacheConfig(record.cache, `${label}.cache`)
-  };
-}
-function parsePlatformSurfacesConfig(value) {
-  const record = optionalRecord(value, "surfaces");
-  if (!record) {
-    return void 0;
-  }
-  return Object.fromEntries(
-    Object.entries(record).map(([surfaceKey, surfaceValue]) => [
-      surfaceKey,
-      parseSurfaceConfig(surfaceValue, `surfaces.${surfaceKey}`)
-    ])
-  );
-}
-function inferManagedRuntimeFromServices(services) {
-  return Object.values(services ?? {}).some(
-    (service) => service && service.enabled !== false && (service.provider ?? "railway") === "railway"
-  );
-}
 const packageRoot = packageRootFromSource;
 const packageScriptRoot = resolve(packageRoot, "scripts");
 const packageDistScriptRoot = resolve(packageRoot, "dist", "scripts");
@@ -374,13 +135,13 @@ function packageScriptPath(scriptName) {
     }
     return directScriptPath;
   }
-  for (const extension of [".js", ".ts", ".mjs"]) {
+  for (const extension of [".ts", ".js"]) {
     const candidate = resolve(packageScriptRoot, `${scriptName}${extension}`);
     if (existsSync(candidate)) {
       return candidate;
     }
   }
-  for (const extension of [".js", ".mjs"]) {
+  for (const extension of [".js"]) {
     const candidate = resolve(packageDistScriptRoot, `${scriptName}${extension}`);
     if (existsSync(candidate)) {
       return candidate;
@@ -400,212 +161,12 @@ function withProcessCwd(cwd, action) {
     process.chdir(previous);
   }
 }
-function expectString(value, label) {
-  if (typeof value !== "string" || value.trim().length === 0) {
-    throw new Error(`Invalid deploy config: expected ${label} to be a non-empty string.`);
-  }
-  return value.trim();
-}
-function optionalString(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
-function optionalCloudflareAccountId(value) {
-  const accountId = optionalString(value);
-  return accountId === CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER ? void 0 : accountId;
-}
-function optionalBoolean(value, label) {
-  if (value === void 0) {
-    return void 0;
-  }
-  if (typeof value !== "boolean") {
-    throw new Error(`Invalid deploy config: expected ${label} to be a boolean when provided.`);
-  }
-  return value;
-}
-function optionalPositiveNumber(value, label) {
-  if (value === void 0) {
-    return void 0;
-  }
-  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
-    throw new Error(`Invalid deploy config: expected ${label} to be a positive number when provided.`);
-  }
-  return value;
-}
-function optionalNonNegativeNumber(value, label) {
-  if (value === void 0) {
-    return void 0;
-  }
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
-    throw new Error(`Invalid deploy config: expected ${label} to be a non-negative number when provided.`);
-  }
-  return value;
-}
-function optionalEnum(value, label, allowed) {
-  const normalized = optionalString(value);
-  if (!normalized) {
-    return void 0;
-  }
-  if (!allowed.includes(normalized)) {
-    throw new Error(`Invalid deploy config: expected ${label} to be one of ${allowed.join(", ")}.`);
-  }
-  return normalized;
-}
-function optionalRecord(value, label) {
-  if (value === void 0 || value === null) {
-    return void 0;
-  }
-  if (typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`Invalid deploy config: expected ${label} to be an object when provided.`);
-  }
-  return value;
-}
-function parsePluginReferences(value) {
-  if (value === void 0) {
-    return [...TREESEED_DEFAULT_PLUGIN_REFERENCES];
-  }
-  if (!Array.isArray(value)) {
-    throw new Error("Invalid deploy config: expected plugins to be an array.");
-  }
-  return value.map((entry, index) => {
-    const record = optionalRecord(entry, `plugins[${index}]`) ?? {};
-    return {
-      package: expectString(record.package, `plugins[${index}].package`),
-      enabled: record.enabled === void 0 ? true : optionalBoolean(record.enabled, `plugins[${index}].enabled`),
-      config: record.config === void 0 ? {} : optionalRecord(record.config, `plugins[${index}].config`)
-    };
-  });
-}
-function parseFallbackDeployConfig(configPath) {
-  const parsed = parseYaml(readFileSync(configPath, "utf8")) ?? {};
-  const record = optionalRecord(parsed, "root") ?? {};
-  const cloudflare = optionalRecord(record.cloudflare, "cloudflare") ?? {};
-  const cloudflarePages = optionalRecord(cloudflare.pages, "cloudflare.pages") ?? {};
-  const cloudflareR2 = optionalRecord(cloudflare.r2, "cloudflare.r2") ?? {};
-  const hosting = optionalRecord(record.hosting, "hosting") ?? {};
-  const parsedHosting = Object.keys(hosting).length === 0 ? void 0 : {
-    kind: optionalEnum(hosting.kind, "hosting.kind", [
-      "market_control_plane",
-      "hosted_project",
-      "self_hosted_project"
-    ]) ?? "self_hosted_project",
-    registration: optionalEnum(hosting.registration, "hosting.registration", ["optional", "none"]) ?? "none",
-    marketBaseUrl: optionalString(process.env.TREESEED_MARKET_API_BASE_URL) ?? optionalString(hosting.marketBaseUrl),
-    teamId: optionalString(process.env.TREESEED_HOSTING_TEAM_ID) ?? optionalString(hosting.teamId),
-    projectId: optionalString(process.env.TREESEED_PROJECT_ID) ?? optionalString(hosting.projectId)
-  };
-  const services = parseManagedServicesConfig(record.services);
-  const normalizedPlanes = normalizePlanesFromLegacyHosting(parsedHosting);
-  const inferredPlanes = !parsedHosting && record.hub === void 0 && record.runtime === void 0 && inferManagedRuntimeFromServices(services) ? {
-    hub: { mode: "customer_hosted" },
-    runtime: { mode: "treeseed_managed", registration: "none" }
-  } : normalizedPlanes;
-  const hubRecord = optionalRecord(record.hub, "hub") ?? {};
-  const runtimeRecord = optionalRecord(record.runtime, "runtime") ?? {};
-  const hub = {
-    mode: optionalEnum(hubRecord.mode, "hub.mode", ["treeseed_hosted", "customer_hosted"]) ?? inferredPlanes.hub.mode
-  };
-  const runtime = {
-    mode: optionalEnum(runtimeRecord.mode, "runtime.mode", ["none", "byo_attached", "treeseed_managed"]) ?? inferredPlanes.runtime.mode,
-    registration: optionalEnum(runtimeRecord.registration, "runtime.registration", ["optional", "required", "none"]) ?? inferredPlanes.runtime.registration ?? "none",
-    marketBaseUrl: optionalString(process.env.TREESEED_MARKET_API_BASE_URL) ?? optionalString(runtimeRecord.marketBaseUrl) ?? inferredPlanes.runtime.marketBaseUrl,
-    teamId: optionalString(process.env.TREESEED_HOSTING_TEAM_ID) ?? optionalString(runtimeRecord.teamId) ?? inferredPlanes.runtime.teamId,
-    projectId: optionalString(process.env.TREESEED_PROJECT_ID) ?? optionalString(runtimeRecord.projectId) ?? inferredPlanes.runtime.projectId
-  };
-  const smtp = optionalRecord(record.smtp, "smtp") ?? {};
-  const turnstile = optionalRecord(record.turnstile, "turnstile") ?? {};
-  const agentProviders = optionalRecord(optionalRecord(record.providers, "providers")?.agents, "providers.agents") ?? {};
-  const contentProviders = optionalRecord(optionalRecord(record.providers, "providers")?.content, "providers.content") ?? {};
-  const deployConfig = {
-    name: expectString(record.name, "name"),
-    slug: expectString(record.slug, "slug"),
-    siteUrl: expectString(record.siteUrl, "siteUrl"),
-    contactEmail: expectString(record.contactEmail, "contactEmail"),
-    hosting: parsedHosting?.kind === "market_control_plane" ? { ...parsedHosting, registration: "none" } : parsedHosting && record.hub === void 0 && record.runtime === void 0 ? parsedHosting : normalizeLegacyHostingFromPlanes(hub, runtime),
-    hub,
-    runtime,
-    cloudflare: {
-      accountId: optionalCloudflareAccountId(process.env.CLOUDFLARE_ACCOUNT_ID) ?? CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER,
-      zoneId: optionalString(cloudflare.zoneId ?? cloudflare.zone_id),
-      workerName: optionalString(cloudflare.workerName),
-      queueName: optionalString(cloudflare.queueName),
-      dlqName: optionalString(cloudflare.dlqName),
-      d1Binding: optionalString(cloudflare.d1Binding),
-      queueBinding: optionalString(cloudflare.queueBinding),
-      pages: cloudflare.pages === void 0 ? void 0 : {
-        projectName: optionalString(process.env.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME) ?? optionalString(cloudflarePages.projectName),
-        previewProjectName: optionalString(process.env.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME) ?? optionalString(cloudflarePages.previewProjectName),
-        productionBranch: optionalString(cloudflarePages.productionBranch) ?? "main",
-        stagingBranch: optionalString(cloudflarePages.stagingBranch) ?? "staging",
-        buildOutputDir: optionalString(cloudflarePages.buildOutputDir)
-      },
-      r2: cloudflare.r2 === void 0 ? void 0 : {
-        binding: optionalString(process.env.TREESEED_CONTENT_BUCKET_BINDING),
-        bucketName: optionalString(process.env.TREESEED_CONTENT_BUCKET_NAME),
-        publicBaseUrl: optionalString(process.env.TREESEED_CONTENT_PUBLIC_BASE_URL),
-        manifestKeyTemplate: optionalString(cloudflareR2.manifestKeyTemplate ?? cloudflareR2.manifestKey) ?? "teams/{teamId}/published/common.json",
-        previewRootTemplate: optionalString(cloudflareR2.previewRootTemplate ?? cloudflareR2.previewRoot) ?? "teams/{teamId}/previews",
-        previewTtlHours: optionalPositiveNumber(cloudflareR2.previewTtlHours, "cloudflare.r2.previewTtlHours") ?? 168
-      }
-    },
-    plugins: parsePluginReferences(record.plugins),
-    providers: {
-      forms: expectString(record.providers?.forms ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.forms, "providers.forms"),
-      agents: {
-        execution: expectString(agentProviders.execution ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.agents.execution, "providers.agents.execution"),
-        mutation: expectString(agentProviders.mutation ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.agents.mutation, "providers.agents.mutation"),
-        repository: expectString(agentProviders.repository ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.agents.repository, "providers.agents.repository"),
-        verification: expectString(agentProviders.verification ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.agents.verification, "providers.agents.verification"),
-        notification: expectString(agentProviders.notification ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.agents.notification, "providers.agents.notification"),
-        research: expectString(agentProviders.research ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.agents.research, "providers.agents.research")
-      },
-      deploy: expectString(record.providers?.deploy ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.deploy, "providers.deploy"),
-      dns: expectString(record.providers?.dns ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.dns, "providers.dns"),
-      content: {
-        runtime: expectString(
-          contentProviders.runtime ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.runtime,
-          "providers.content.runtime"
-        ),
-        publish: expectString(
-          contentProviders.publish ?? contentProviders.runtime ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.publish,
-          "providers.content.publish"
-        ),
-        docs: expectString(
-          contentProviders.docs ?? contentProviders.runtime ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.docs ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.runtime,
-          "providers.content.docs"
-        ),
-        serving: optionalEnum(
-          contentProviders.serving,
-          "providers.content.serving",
-          ["local_collections", "published_runtime"]
-        ) ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.serving
-      },
-      site: expectString(record.providers?.site ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.site, "providers.site")
-    },
-    surfaces: parsePlatformSurfacesConfig(record.surfaces),
-    services,
-    smtp: {
-      enabled: optionalBoolean(smtp.enabled, "smtp.enabled")
-    },
-    turnstile: {
-      enabled: optionalBoolean(turnstile.enabled, "turnstile.enabled") ?? false
-    }
-  };
-  Object.defineProperty(deployConfig, "__tenantRoot", {
-    value: dirname(configPath),
-    enumerable: false
-  });
-  Object.defineProperty(deployConfig, "__configPath", {
-    value: configPath,
-    enumerable: false
-  });
-  return deployConfig;
-}
 function loadCliDeployConfig(tenantRoot) {
   const configPath = resolve(tenantRoot, "treeseed.site.yaml");
   if (!existsSync(configPath)) {
     throw new Error(`Unable to resolve Treeseed deploy config at "${configPath}".`);
   }
-  return parseFallbackDeployConfig(configPath);
+  return loadTreeseedDeployConfigFromPath(configPath);
 }
 function runNodeBinary(binPath, args, options = {}) {
   const result = spawnSync(process.execPath, [binPath, ...args], {

package/dist/operations/services/save-deploy-preflight.js

@@ -4,17 +4,25 @@ import { applyTreeseedEnvironmentToProcess, assertTreeseedCommandEnvironment } f
 import { collectCliPreflight } from "./workspace-preflight.js";
 import { requiredGitHubEnvironment } from "./github-automation.js";
 function runStep(label, scriptName, { cwd, env } = {}) {
+  const startedAt = Date.now();
+  process.stderr.write(`[preflight] ${label} start (${scriptName})
+`);
   const result = spawnSync(process.execPath, [packageScriptPath(scriptName)], {
     cwd,
     env: { ...process.env, ...env ?? {} },
     stdio: "inherit"
   });
+  const elapsedSeconds = ((Date.now() - startedAt) / 1e3).toFixed(1);
   if (result.status !== 0) {
+    process.stderr.write(`[preflight] ${label} failed after ${elapsedSeconds}s (${scriptName})
+`);
     const error = new Error(`${label} failed.`);
     error.kind = `${label}_failed`;
     error.exitCode = result.status ?? 1;
     throw error;
   }
+  process.stderr.write(`[preflight] ${label} complete after ${elapsedSeconds}s (${scriptName})
+`);
 }
 function missingRequiredEnv(requiredKeys) {
   return requiredKeys.filter((key) => {
@@ -51,7 +59,7 @@ function validateSaveAutomationPrerequisites({ cwd }) {
 }
 function runWorkspaceSavePreflight({ cwd }) {
   runStep("lint", "workspace-lint", { cwd });
-  runStep("test", "workspace-test", { cwd });
+  runStep("test", "workspace-release-test", { cwd });
   runStep("build", "tenant-build", { cwd });
 }
 function runWorkspaceReleasePreflight({ cwd }) {

package/dist/operations/services/template-host-bindings.d.ts

@@ -1,5 +1,5 @@
-import { type ProjectEnvironmentName, type TemplateConfigMergeStrategy, type TemplateConfigWriteTarget, type TemplateSecretSensitivity } from '../../sdk-types.ts';
-import type { ProjectLaunchConfigWritePlanItem, ProjectLaunchResolvedHostBinding, ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.ts';
+import { type ProjectEnvironmentName, type TemplateConfigMergeStrategy, type TemplateConfigWriteTarget, type TemplateSecretSensitivity } from '../../sdk-types.js';
+import type { ProjectLaunchConfigWritePlanItem, ProjectLaunchResolvedHostBinding, ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.js';
 export interface ApplyProjectLaunchHostBindingConfigOptions {
     projectRoot: string;
     hostBindings?: Record<string, ProjectLaunchResolvedHostBinding> | null;

package/dist/operations/services/template-host-bindings.js

@@ -1,5 +1,4 @@
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import {
@@ -297,7 +296,9 @@ function auditProjectLaunchHostBindingConfig(options) {
     plannedTargets.add("src/env.yaml");
   }
   const checkedTargets = [...plannedTargets];
-  const tempRoot = mkdtempSync(join(tmpdir(), "treeseed-host-binding-audit-"));
+  const tempBase = resolve(options.projectRoot, ".treeseed", "tmp", "host-binding-audit");
+  mkdirSync(tempBase, { recursive: true });
+  const tempRoot = mkdtempSync(join(tempBase, "treeseed-host-binding-audit-"));
   const before = /* @__PURE__ */ new Map();
   try {
     for (const target of checkedTargets) {

package/dist/operations/services/template-registry.d.ts

@@ -1,5 +1,5 @@
-import { type SdkTemplateCatalogEntry, type TemplateLaunchRequirements } from '../../sdk-types.ts';
-import { type ProjectLaunchConfigWritePlanItem, type ProjectLaunchLocalHostBindingSummary, type ProjectLaunchResolvedHostBinding, type ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.ts';
+import { type SdkTemplateCatalogEntry, type TemplateLaunchRequirements } from '../../sdk-types.js';
+import { type ProjectLaunchConfigWritePlanItem, type ProjectLaunchLocalHostBindingSummary, type ProjectLaunchResolvedHostBinding, type ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.js';
 export declare const TEMPLATE_CATEGORIES: readonly ["starter", "example", "fixture", "reference-app"];
 export type TemplateCategory = (typeof TEMPLATE_CATEGORIES)[number];
 export interface TemplateVariableDefinition {
@@ -93,17 +93,17 @@ export declare function serializeTemplateRegistryEntry(product: Pick<TemplatePro
     displayName: string;
     description: string;
     summary: string;
-    status: import("../../sdk-types.ts").SdkTemplateCatalogStatus;
+    status: import("../../sdk-types.js").SdkTemplateCatalogStatus;
     featured: boolean;
-    category: import("../../sdk-types.ts").SdkTemplateCategory;
+    category: import("../../sdk-types.js").SdkTemplateCategory;
     tags: string[];
-    publisher: import("../../sdk-types.ts").SdkTemplateCatalogPublisher;
+    publisher: import("../../sdk-types.js").SdkTemplateCatalogPublisher;
     templateVersion: string;
     templateApiVersion: number;
     minCliVersion: string;
     minCoreVersion: string | undefined;
     fulfillmentMode: "r2" | "git" | "packaged";
-    source: import("../../sdk-types.ts").SdkTemplateCatalogSource;
+    source: import("../../sdk-types.js").SdkTemplateCatalogSource;
     launchRequirements: TemplateLaunchRequirements | undefined;
 };
 export declare function exportTemplateCatalogYaml(options?: TemplateCatalogOptions): Promise<string>;

package/dist/operations/services/template-registry.js

@@ -1,6 +1,6 @@
 import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { spawnSync } from "node:child_process";
 import { basename, dirname, relative, resolve } from "node:path";
+import { runTreeseedGit } from "./git-runner.js";
 import {
   normalizeTreeseedTemplateId
 } from "../../sdk-types.js";
@@ -29,15 +29,34 @@ function loadJsonFile(filePath) {
 function ensureDir(filePath) {
   mkdirSync(dirname(filePath), { recursive: true });
 }
-function listFiles(root) {
-  if (!existsSync(root)) {
+const templatePayloadIgnoredDirectoryNames = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  ".astro"
+]);
+const templatePayloadIgnoredRelativePaths = /* @__PURE__ */ new Set([
+  ".treeseed/generated",
+  ".treeseed/test-reports",
+  "public/books"
+]);
+function normalizeTemplateRelativePath(path) {
+  return path.split(/[\\/]+/u).join("/");
+}
+function isIgnoredTemplatePayloadDirectory(root, directoryPath) {
+  const relativePath = normalizeTemplateRelativePath(relative(root, directoryPath));
+  return templatePayloadIgnoredDirectoryNames.has(basename(directoryPath)) || templatePayloadIgnoredRelativePaths.has(relativePath);
+}
+function listFiles(root, currentRoot = root) {
+  if (!existsSync(currentRoot)) {
     return [];
   }
   const files = [];
-  for (const entry of readdirSync(root, { withFileTypes: true })) {
-    const fullPath = resolve(root, entry.name);
+  for (const entry of readdirSync(currentRoot, { withFileTypes: true })) {
+    const fullPath = resolve(currentRoot, entry.name);
     if (entry.isDirectory()) {
-      files.push(...listFiles(fullPath));
+      if (!isIgnoredTemplatePayloadDirectory(root, fullPath)) {
+        files.push(...listFiles(root, fullPath));
+      }
       continue;
     }
     files.push(fullPath);
@@ -149,20 +168,20 @@ function resolveTemplateSourceCacheRoot(product, options) {
   return resolve(dirname(cachePath), "templates", sanitizeCacheSegment(product.id), sanitizeCacheSegment(sourceVersion));
 }
 function runGit(commandArgs, cwd) {
-  const result = spawnSync("git", commandArgs, {
-    cwd,
-    stdio: "pipe",
-    encoding: "utf8"
+  const mutating = /^(add|commit|checkout|switch|merge|tag|push|fetch|worktree|submodule|reset|clean|restore|branch|clone)$/u.test(commandArgs[0] ?? "");
+  const result = runTreeseedGit(commandArgs, {
+    cwd: cwd ?? process.cwd(),
+    mode: mutating ? "mutate" : "read"
   });
   if (result.status !== 0) {
     throw new Error(result.stderr?.trim() || result.stdout?.trim() || `git ${commandArgs.join(" ")} failed`);
   }
 }
 function readGitOutput(commandArgs, cwd) {
-  const result = spawnSync("git", commandArgs, {
-    cwd,
-    stdio: "pipe",
-    encoding: "utf8"
+  const result = runTreeseedGit(commandArgs, {
+    cwd: cwd ?? process.cwd(),
+    mode: "read",
+    allowFailure: true
   });
   return result.status === 0 ? result.stdout.trim() : null;
 }

package/dist/operations/services/template-secret-sync.d.ts

@@ -1,6 +1,6 @@
-import { syncTreeseedCloudflareEnvironment, syncTreeseedGitHubEnvironment, syncTreeseedRailwayEnvironment, type TreeseedConfigScope } from './config-runtime.ts';
-import type { ProjectLaunchResolvedHostBinding, ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.ts';
-import type { ProjectLaunchRequirementKind } from '../../sdk-types.ts';
+import { syncTreeseedCloudflareEnvironment, syncTreeseedGitHubEnvironment, syncTreeseedRailwayEnvironment, type TreeseedConfigScope } from './config-runtime.js';
+import type { ProjectLaunchResolvedHostBinding, ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.js';
+import type { ProjectLaunchRequirementKind } from '../../sdk-types.js';
 export type ProjectLaunchSecretSyncProvider = 'github' | 'cloudflare' | 'railway';
 export type ProjectLaunchSecretSyncStatus = 'synced' | 'skipped' | 'failed';
 export type ProjectLaunchSecretSyncProviderStatus = 'running' | 'completed' | 'failed';