@treeseed/sdk 0.11.0 → 0.12.4

package/drizzle/market/0014_governance_pipeline.sql

@@ -0,0 +1,189 @@
+CREATE TABLE IF NOT EXISTS "team_governance_policies" (
+	"id" text PRIMARY KEY NOT NULL,
+	"team_id" text NOT NULL,
+	"scope" text DEFAULT 'team' NOT NULL,
+	"provider_id" text NOT NULL,
+	"provider_version" text DEFAULT '1' NOT NULL,
+	"config_json" text DEFAULT '{}' NOT NULL,
+	"active" integer DEFAULT 1 NOT NULL,
+	"created_by" text,
+	"created_at" text NOT NULL,
+	"updated_at" text NOT NULL,
+	"superseded_at" text
+);
+CREATE INDEX IF NOT EXISTS "idx_team_governance_policies_team_scope" ON "team_governance_policies" ("team_id","scope","active");
+
+CREATE TABLE IF NOT EXISTS "project_governance_policies" (
+	"id" text PRIMARY KEY NOT NULL,
+	"team_id" text NOT NULL,
+	"project_id" text NOT NULL,
+	"provider_id" text NOT NULL,
+	"provider_version" text DEFAULT '1' NOT NULL,
+	"config_json" text DEFAULT '{}' NOT NULL,
+	"active" integer DEFAULT 1 NOT NULL,
+	"created_by" text,
+	"created_at" text NOT NULL,
+	"updated_at" text NOT NULL,
+	"superseded_at" text
+);
+CREATE INDEX IF NOT EXISTS "idx_project_governance_policies_project" ON "project_governance_policies" ("project_id","active");
+
+CREATE TABLE IF NOT EXISTS "governance_proposals" (
+	"id" text PRIMARY KEY NOT NULL,
+	"team_id" text NOT NULL,
+	"project_id" text,
+	"scope" text DEFAULT 'project' NOT NULL,
+	"status" text DEFAULT 'draft' NOT NULL,
+	"title" text NOT NULL,
+	"summary" text NOT NULL,
+	"body" text NOT NULL,
+	"proposal_type" text DEFAULT 'implementation' NOT NULL,
+	"content_proposal_slug" text,
+	"content_decision_slug" text,
+	"active_version" integer DEFAULT 1 NOT NULL,
+	"active_content_hash" text NOT NULL,
+	"governance_provider_id" text NOT NULL,
+	"governance_provider_version" text DEFAULT '1' NOT NULL,
+	"governance_policy_id" text,
+	"decision_id" text,
+	"voting_starts_at" text,
+	"voting_ends_at" text,
+	"closed_at" text,
+	"closed_reason" text,
+	"created_by_type" text DEFAULT 'user' NOT NULL,
+	"created_by_id" text,
+	"metadata_json" text DEFAULT '{}' NOT NULL,
+	"created_at" text NOT NULL,
+	"updated_at" text NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "idx_governance_proposals_team_status" ON "governance_proposals" ("team_id","status","updated_at");
+CREATE INDEX IF NOT EXISTS "idx_governance_proposals_project_status" ON "governance_proposals" ("project_id","status","updated_at");
+CREATE INDEX IF NOT EXISTS "idx_governance_proposals_scope_status" ON "governance_proposals" ("scope","status","updated_at");
+CREATE INDEX IF NOT EXISTS "idx_governance_proposals_content_slug" ON "governance_proposals" ("content_proposal_slug");
+
+CREATE TABLE IF NOT EXISTS "governance_proposal_versions" (
+	"id" text PRIMARY KEY NOT NULL,
+	"proposal_id" text NOT NULL,
+	"version" integer NOT NULL,
+	"title" text NOT NULL,
+	"summary" text NOT NULL,
+	"body" text NOT NULL,
+	"content_hash" text NOT NULL,
+	"change_reason" text,
+	"created_by_type" text DEFAULT 'user' NOT NULL,
+	"created_by_id" text,
+	"created_at" text NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "idx_governance_proposal_versions_unique" ON "governance_proposal_versions" ("proposal_id","version");
+CREATE INDEX IF NOT EXISTS "idx_governance_proposal_versions_proposal" ON "governance_proposal_versions" ("proposal_id","created_at");
+
+CREATE TABLE IF NOT EXISTS "governance_electorate_snapshots" (
+	"id" text PRIMARY KEY NOT NULL,
+	"proposal_id" text NOT NULL,
+	"proposal_version" integer NOT NULL,
+	"provider_id" text NOT NULL,
+	"provider_version" text DEFAULT '1' NOT NULL,
+	"rule_snapshot_json" text DEFAULT '{}' NOT NULL,
+	"chambers_json" text DEFAULT '[]' NOT NULL,
+	"eligible_voters_json" text DEFAULT '[]' NOT NULL,
+	"delegations_json" text DEFAULT '[]' NOT NULL,
+	"eligible_weight_total" real DEFAULT 0 NOT NULL,
+	"active_weight_total" real DEFAULT 0 NOT NULL,
+	"created_at" text NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "idx_governance_electorate_snapshots_proposal" ON "governance_electorate_snapshots" ("proposal_id","proposal_version");
+
+CREATE TABLE IF NOT EXISTS "governance_proposal_votes" (
+	"id" text PRIMARY KEY NOT NULL,
+	"proposal_id" text NOT NULL,
+	"proposal_version" integer NOT NULL,
+	"user_id" text NOT NULL,
+	"vote" text NOT NULL,
+	"reason" text,
+	"chamber_votes_json" text DEFAULT '{}' NOT NULL,
+	"effective_weights_json" text DEFAULT '{}' NOT NULL,
+	"delegated_from_json" text DEFAULT '[]' NOT NULL,
+	"created_at" text NOT NULL,
+	"updated_at" text NOT NULL
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "idx_governance_proposal_votes_once" ON "governance_proposal_votes" ("proposal_id","proposal_version","user_id");
+CREATE INDEX IF NOT EXISTS "idx_governance_proposal_votes_proposal" ON "governance_proposal_votes" ("proposal_id","proposal_version","vote");
+
+CREATE TABLE IF NOT EXISTS "governance_vote_events" (
+	"id" text PRIMARY KEY NOT NULL,
+	"proposal_id" text NOT NULL,
+	"proposal_version" integer NOT NULL,
+	"user_id" text NOT NULL,
+	"prior_vote" text,
+	"next_vote" text NOT NULL,
+	"reason" text,
+	"effective_weights_json" text DEFAULT '{}' NOT NULL,
+	"created_at" text NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "idx_governance_vote_events_proposal" ON "governance_vote_events" ("proposal_id","proposal_version","created_at");
+
+CREATE TABLE IF NOT EXISTS "governance_delegations" (
+	"id" text PRIMARY KEY NOT NULL,
+	"team_id" text NOT NULL,
+	"scope" text DEFAULT 'team' NOT NULL,
+	"from_user_id" text NOT NULL,
+	"to_user_id" text NOT NULL,
+	"chambers_json" text DEFAULT '[]' NOT NULL,
+	"status" text DEFAULT 'active' NOT NULL,
+	"reason" text,
+	"created_at" text NOT NULL,
+	"revoked_at" text,
+	"expires_at" text,
+	"metadata_json" text DEFAULT '{}' NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "idx_governance_delegations_team_status" ON "governance_delegations" ("team_id","status");
+CREATE INDEX IF NOT EXISTS "idx_governance_delegations_from" ON "governance_delegations" ("from_user_id","status");
+CREATE INDEX IF NOT EXISTS "idx_governance_delegations_to" ON "governance_delegations" ("to_user_id","status");
+
+CREATE TABLE IF NOT EXISTS "governance_decisions" (
+	"id" text PRIMARY KEY NOT NULL,
+	"team_id" text NOT NULL,
+	"project_id" text,
+	"proposal_id" text NOT NULL,
+	"proposal_version" integer NOT NULL,
+	"proposal_content_hash" text NOT NULL,
+	"status" text DEFAULT 'creating' NOT NULL,
+	"title" text NOT NULL,
+	"summary" text NOT NULL,
+	"content_decision_slug" text,
+	"governance_provider_id" text NOT NULL,
+	"governance_rule_json" text DEFAULT '{}' NOT NULL,
+	"electorate_snapshot_id" text,
+	"vote_result_json" text DEFAULT '{}' NOT NULL,
+	"voter_reasons_json" text DEFAULT '[]' NOT NULL,
+	"proposal_snapshot_json" text DEFAULT '{}' NOT NULL,
+	"decision_record_json" text DEFAULT '{}' NOT NULL,
+	"created_by_type" text DEFAULT 'system' NOT NULL,
+	"created_by_id" text,
+	"created_at" text NOT NULL,
+	"updated_at" text NOT NULL,
+	"superseded_at" text
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "idx_governance_decisions_proposal" ON "governance_decisions" ("proposal_id");
+CREATE INDEX IF NOT EXISTS "idx_governance_decisions_project_status" ON "governance_decisions" ("project_id","status","updated_at");
+
+CREATE TABLE IF NOT EXISTS "governance_events" (
+	"id" text PRIMARY KEY NOT NULL,
+	"event_type" text NOT NULL,
+	"actor_type" text DEFAULT 'system' NOT NULL,
+	"actor_id" text,
+	"team_id" text NOT NULL,
+	"project_id" text,
+	"proposal_id" text,
+	"decision_id" text,
+	"proposal_version" integer,
+	"prior_state" text,
+	"next_state" text,
+	"message" text,
+	"evidence_json" text DEFAULT '{}' NOT NULL,
+	"created_at" text NOT NULL
+);
+CREATE INDEX IF NOT EXISTS "idx_governance_events_proposal" ON "governance_events" ("proposal_id","created_at");
+CREATE INDEX IF NOT EXISTS "idx_governance_events_decision" ON "governance_events" ("decision_id","created_at");
+CREATE INDEX IF NOT EXISTS "idx_governance_events_team" ON "governance_events" ("team_id","created_at");
+CREATE INDEX IF NOT EXISTS "idx_governance_events_project" ON "governance_events" ("project_id","created_at");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.11.0",
+  "version": "0.12.4",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -21,50 +21,52 @@
     "README.md",
     "dist",
     "drizzle",
-    "scripts/verify-driver.mjs",
+    "scripts/verify-driver.ts",
     "templates"
   ],
   "publishConfig": {
     "access": "public"
   },
   "bin": {
-    "treeseed-sdk-verify": "./scripts/verify-driver.mjs"
+    "treeseed-sdk-verify": "./dist/verification.js"
   },
   "scripts": {
     "setup": "npm install",
     "setup:ci": "npm ci",
     "build": "npm run build:dist",
-    "build:dist": "node ./scripts/run-ts.mjs ./scripts/build-dist.ts",
+    "build:dist": "node --import tsx ./scripts/build-dist.ts",
     "db:generate:d1": "drizzle-kit export --config drizzle.config.ts > drizzle/d1/0000_treeseed_d1.sql",
     "db:generate:market": "drizzle-kit export --config drizzle.market.config.ts > drizzle/market/0000_market_control_plane.sql",
-    "prepare": "node ./scripts/prepare.mjs",
+    "prepare": "node --import tsx ./scripts/prepare.ts",
     "prepack": "npm run build:dist",
     "test": "npm run test:unit",
     "test:unit": "vitest run --config ./vitest.config.ts",
     "test:unit:fast": "vitest run --config ./vitest.fast.config.ts",
     "test:workflow:lifecycle": "vitest run --config ./vitest.config.ts test/utils/workflow-lifecycle.test.ts",
     "test:release": "npm run test:unit:fast",
-    "test:smoke": "node ./scripts/run-ts.mjs ./scripts/test-smoke.ts",
-    "treedx:generate-types": "node ./scripts/run-ts.mjs ./scripts/generate-treedx-openapi-types.ts",
-    "treedx:check-types": "node ./scripts/run-ts.mjs ./scripts/generate-treedx-openapi-types.ts --check",
+    "test:smoke": "node --import tsx ./scripts/test-smoke.ts",
+    "treedx:generate-types": "node --import tsx ./scripts/generate-treedx-openapi-types.ts",
+    "treedx:check-types": "node --import tsx ./scripts/generate-treedx-openapi-types.ts --check",
     "treedx:contract": "vitest run --config ./vitest.config.ts test/utils/treedx-openapi-contract.test.ts test/utils/treedx-sdk-request-contract.test.ts test/utils/treedx-generated-types.test.ts",
-    "fixtures:resolve": "node ./scripts/run-ts.mjs ./scripts/fixture-tools.ts resolve",
-    "fixtures:check": "node ./scripts/run-ts.mjs ./scripts/fixture-tools.ts check",
+    "fixtures:resolve": "node --import tsx ./scripts/fixture-tools.ts resolve",
+    "fixtures:check": "node --import tsx ./scripts/fixture-tools.ts check",
     "lint": "npm run fixtures:check && npm run build:dist",
     "verify:direct": "npm run release:verify",
-    "verify:local": "node --input-type=module -e \"process.env.TREESEED_VERIFY_DRIVER='direct'; await import('./scripts/verify-driver.mjs')\"",
-    "verify:action": "node --input-type=module -e \"process.env.TREESEED_VERIFY_DRIVER='act'; await import('./scripts/verify-driver.mjs')\"",
-    "verify": "node ./scripts/verify-driver.mjs",
+    "verify:local": "TREESEED_VERIFY_DRIVER=direct TMPDIR=/tmp node --import tsx ./scripts/verify-driver.ts",
+    "verify:action": "TREESEED_VERIFY_DRIVER=act TMPDIR=/tmp node --import tsx ./scripts/verify-driver.ts",
+    "verify": "TMPDIR=/tmp node --import tsx ./scripts/verify-driver.ts",
     "release:setup": "npm run setup:ci",
-    "release:check-tag": "node ./scripts/run-ts.mjs ./scripts/assert-release-tag-version.ts",
-    "release:verify": "node ./scripts/run-ts.mjs ./scripts/release-verify.ts",
-    "release:publish": "node ./scripts/run-ts.mjs ./scripts/publish-package.ts"
+    "release:check-tag": "node --import tsx ./scripts/assert-release-tag-version.ts",
+    "release:verify": "node --import tsx ./scripts/release-verify.ts",
+    "release:publish": "node --import tsx ./scripts/publish-package.ts"
   },
   "dependencies": {
     "@github/copilot": "1.0.39",
     "@github/copilot-language-server": "1.480.0",
     "@github/copilot-sdk": "0.3.0",
-    "@railway/cli": "4.44.0",
+    "@railway/cli": "5.23.2",
+    "@remotion/bundler": "4.0.477",
+    "@remotion/renderer": "4.0.477",
     "drizzle-orm": "^0.45.2",
     "esbuild": "^0.28.0",
     "extract-zip": "2.0.1",
@@ -76,9 +78,12 @@
     "minisearch": "^7.2.0",
     "octokit": "^5.0.3",
     "pg": "^8.21.0",
+    "playwright": "^1.60.0",
+    "railway": "3.4.1",
     "react": "^19.2.5",
     "remark-mdx": "^3.1.1",
     "remark-parse": "^11.0.0",
+    "remotion": "4.0.477",
     "repomix": "^1.13.1",
     "tar": "7.5.13",
     "typescript": "^5.9.3",
@@ -89,6 +94,7 @@
   "devDependencies": {
     "@types/node": "^24.6.0",
     "drizzle-kit": "^0.31.10",
+    "tsx": "^4.21.0",
     "vitest": "^4.1.2"
   },
   "exports": {
@@ -108,6 +114,14 @@
       "types": "./dist/operations/agent-tools.d.ts",
       "default": "./dist/operations/agent-tools.js"
     },
+    "./agent-tools": {
+      "types": "./dist/agent-tools.d.ts",
+      "default": "./dist/agent-tools.js"
+    },
+    "./content-operations": {
+      "types": "./dist/content-operations.d.ts",
+      "default": "./dist/content-operations.js"
+    },
     "./api": {
       "types": "./dist/api/index.d.ts",
       "default": "./dist/api/index.js"
@@ -132,7 +146,18 @@
       "types": "./dist/seeds/index.d.ts",
       "default": "./dist/seeds/index.js"
     },
-    "./scripts/verify-driver": "./scripts/verify-driver.mjs",
+    "./scenes": {
+      "types": "./dist/scenes/index.d.ts",
+      "default": "./dist/scenes/index.js"
+    },
+    "./guarantees": {
+      "types": "./dist/guarantees/index.d.ts",
+      "default": "./dist/guarantees/index.js"
+    },
+    "./scripts/verify-driver": {
+      "types": "./dist/verification.d.ts",
+      "default": "./dist/verification.js"
+    },
     "./workflow-support": {
       "types": "./dist/workflow-support.d.ts",
       "default": "./dist/workflow-support.js"
@@ -141,6 +166,18 @@
       "types": "./dist/market-client.d.ts",
       "default": "./dist/market-client.js"
     },
+    "./agent-capacity": {
+      "types": "./dist/agent-capacity.d.ts",
+      "default": "./dist/agent-capacity.js"
+    },
+    "./secrets-capability": {
+      "types": "./dist/secrets-capability.d.ts",
+      "default": "./dist/secrets-capability.js"
+    },
+    "./project-import": {
+      "types": "./dist/project-import.d.ts",
+      "default": "./dist/project-import.js"
+    },
     "./reconcile": {
       "types": "./dist/reconcile/index.d.ts",
       "default": "./dist/reconcile/index.js"
@@ -165,6 +202,10 @@
       "types": "./dist/platform/deploy-runtime.d.ts",
       "default": "./dist/platform/deploy-runtime.js"
     },
+    "./platform/desired-state": {
+      "types": "./dist/platform/desired-state.d.ts",
+      "default": "./dist/platform/desired-state.js"
+    },
     "./platform/environment": {
       "types": "./dist/platform/environment.d.ts",
       "default": "./dist/platform/environment.js"
@@ -277,6 +318,10 @@
       "types": "./dist/managed-dependencies.d.ts",
       "default": "./dist/managed-dependencies.js"
     },
+    "./service-credentials": {
+      "types": "./dist/service-credentials.d.ts",
+      "default": "./dist/service-credentials.js"
+    },
     "./copilot": {
       "types": "./dist/copilot.d.ts",
       "default": "./dist/copilot.js"
@@ -301,6 +346,18 @@
       "types": "./dist/operations/repository-operations.d.ts",
       "default": "./dist/operations/repository-operations.js"
     },
+    "./operations/github-credentials": {
+      "types": "./dist/operations/services/github-credentials.d.ts",
+      "default": "./dist/operations/services/github-credentials.js"
+    },
+    "./operations/hub-provider-launch": {
+      "types": "./dist/operations/services/hub-provider-launch.d.ts",
+      "default": "./dist/operations/services/hub-provider-launch.js"
+    },
+    "./operations/project-host-operations": {
+      "types": "./dist/operations/services/project-host-operations.d.ts",
+      "default": "./dist/operations/services/project-host-operations.js"
+    },
     "./types": {
       "types": "./dist/sdk-types.d.ts",
       "default": "./dist/sdk-types.js"

package/scripts/{verify-driver.mjs → verify-driver.ts}

@@ -3,22 +3,37 @@
 import { existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { dirname, resolve } from 'node:path';
+import { tmpdir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 
 const scriptRoot = dirname(fileURLToPath(import.meta.url));
 const packageRoot = resolve(scriptRoot, '..');
-const sourceRunner = resolve(packageRoot, 'scripts', 'run-ts.mjs');
 const sourceEntry = resolve(packageRoot, 'src', 'verification.ts');
 const publishedEntry = resolve(packageRoot, 'dist', 'verification.js');
 const entrypointCheckOnly = process.env.TREESEED_VERIFY_ENTRYPOINT_CHECK === 'true';
 
-if (existsSync(sourceRunner) && existsSync(sourceEntry)) {
+function withShortTempEnv() {
+	if (process.platform === 'win32') {
+		return process.env;
+	}
+	const env = { ...process.env };
+	const shortTemp = tmpdir();
+	for (const key of ['TMPDIR', 'TMP', 'TEMP'] as const) {
+		const value = env[key];
+		if (value && value.length > shortTemp.length) {
+			env[key] = shortTemp;
+		}
+	}
+	return env;
+}
+
+if (existsSync(sourceEntry)) {
 	if (entrypointCheckOnly) {
 		process.exit(0);
 	}
-	const result = spawnSync(process.execPath, [sourceRunner, sourceEntry], {
+	const result = spawnSync('tsx', [sourceEntry], {
 		cwd: process.cwd(),
-		env: process.env,
+		env: withShortTempEnv(),
 		stdio: 'inherit',
 	});
 	process.exit(result.status ?? 1);

package/templates/github/deploy-web.workflow.yml

@@ -47,8 +47,8 @@ __WORKING_DIRECTORY_BLOCK__  web:
     environment: ${{ inputs.environment == 'prod' && 'production' || 'staging' }}
     env:
       TREESEED_BOOTSTRAP_MODE: auto
-      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      TREESEED_CLOUDFLARE_API_TOKEN: ${{ secrets.TREESEED_CLOUDFLARE_API_TOKEN }}
+      TREESEED_CLOUDFLARE_ACCOUNT_ID: ${{ vars.TREESEED_CLOUDFLARE_ACCOUNT_ID }}
       TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
       TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME }}
       TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
@@ -69,17 +69,21 @@ __WORKING_DIRECTORY_BLOCK__  web:
       TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
       TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
       TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
+      TREESEED_CREDENTIAL_SESSION_SECRET: ${{ secrets.TREESEED_CREDENTIAL_SESSION_SECRET }}
       TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID || vars.TREESEED_WEB_SERVICE_ID || 'web' }}
-      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET || secrets.TREESEED_WEB_SERVICE_SECRET }}
+      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET || secrets.TREESEED_API_WEB_SERVICE_SECRET }}
       TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET || secrets.TREESEED_WEB_ASSERTION_SECRET }}
       TREESEED_API_AUTH_SECRET: ${{ secrets.TREESEED_API_AUTH_SECRET || secrets.TREESEED_BETTER_AUTH_SECRET }}
       TREESEED_HOSTED_HUBS_GITHUB_OWNER: ${{ vars.TREESEED_HOSTED_HUBS_GITHUB_OWNER }}
       TREESEED_HOSTED_HUBS_GITHUB_TOKEN: ${{ secrets.TREESEED_HOSTED_HUBS_GITHUB_TOKEN }}
+      TREESEED_GITHUB_TOKEN: ${{ secrets.TREESEED_HOSTED_HUBS_GITHUB_TOKEN }}
+      GH_TOKEN: ${{ secrets.TREESEED_HOSTED_HUBS_GITHUB_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.TREESEED_HOSTED_HUBS_GITHUB_TOKEN }}
       TREESEED_SITE_URL: ${{ vars.TREESEED_SITE_URL }}
-      BETTER_AUTH_URL: ${{ vars.BETTER_AUTH_URL || vars.TREESEED_SITE_URL }}
-      TREESEED_CENTRAL_MARKET_API_BASE_URL: ${{ vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_CATALOG_MARKET_API_BASE_URLS: ${{ vars.TREESEED_CATALOG_MARKET_API_BASE_URLS || vars.TREESEED_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
+      TREESEED_BETTER_AUTH_URL: ${{ vars.TREESEED_BETTER_AUTH_URL || vars.TREESEED_SITE_URL }}
+      TREESEED_CENTRAL_MARKET_API_BASE_URL: ${{ vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.dev' }}
+      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.dev' }}
+      TREESEED_CATALOG_MARKET_API_BASE_URLS: ${{ vars.TREESEED_CATALOG_MARKET_API_BASE_URLS || vars.TREESEED_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.dev' }}
       TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
       TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
       TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
@@ -159,5 +163,5 @@ __WORKING_DIRECTORY_BLOCK__  web:
           EXTRA_ARGS=()
           if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi
           if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi
-          node ./packages/sdk/scripts/run-ts.mjs ./packages/sdk/scripts/tenant-workflow-action.ts --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"
+          tsx ./packages/sdk/scripts/tenant-workflow-action.ts --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"
           if [[ -n "${GITHUB_STEP_SUMMARY:-}" && -s "${TIMING_SUMMARY}" ]]; then cat "${TIMING_SUMMARY}" >> "${GITHUB_STEP_SUMMARY}"; fi

package/dist/operations/services/mailpit-runtime.d.ts

@@ -1,20 +0,0 @@
-export type TreeseedMailpitContainer = {
-    name: string;
-    image: string;
-    ports: string;
-};
-type RunDocker = typeof runDocker;
-declare function runDocker(args: string[], options?: {}): import("child_process").SpawnSyncReturns<string>;
-export declare function dockerIsAvailable(): boolean;
-export declare function findRunningMailpitContainer(options?: {
-    run?: RunDocker;
-}): {
-    name: string;
-    image: string;
-    ports: string;
-} | null;
-export declare function stopKnownMailpitContainers(options?: {
-    run?: RunDocker;
-}): boolean;
-export declare function streamKnownMailpitLogs(): void;
-export {};

package/dist/operations/services/mailpit-runtime.js

@@ -1,67 +0,0 @@
-import { spawnSync } from "node:child_process";
-const KNOWN_MAILPIT_NAMES = ["treeseed_mailpit", "docs_mailpit"];
-function runDocker(args, options = {}) {
-  return spawnSync("docker", args, {
-    encoding: "utf8",
-    ...options
-  });
-}
-function parseDockerPsOutput(stdout) {
-  return stdout.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).map((line) => {
-    const [name = "", image = "", ports = ""] = line.split("	");
-    return { name, image, ports };
-  });
-}
-function isCompatibleMailpitContainer(container) {
-  const expectedName = process.env.TREESEED_MAILPIT_CONTAINER_NAME?.trim();
-  const smtpPort = process.env.TREESEED_MAILPIT_SMTP_PORT?.trim() || "1025";
-  const uiPort = process.env.TREESEED_MAILPIT_UI_PORT?.trim() || "8025";
-  const expectedPorts = [`${smtpPort}->1025/tcp`, `${uiPort}->8025/tcp`];
-  const nameMatch = expectedName ? container.name === expectedName : KNOWN_MAILPIT_NAMES.includes(container.name);
-  const imageMatch = container.image.includes("mailpit");
-  const portsMatch = expectedPorts.every((port) => container.ports.includes(port));
-  return (nameMatch || imageMatch) && portsMatch;
-}
-function dockerIsAvailable() {
-  const result = runDocker(["ps", "--format", "{{.Names}}	{{.Image}}	{{.Ports}}"]);
-  return result.status === 0;
-}
-function findKnownMailpitContainers({ all = false, run = runDocker } = {}) {
-  const args = [
-    "ps",
-    ...all ? ["-a"] : [],
-    "--format",
-    "{{.Names}}	{{.Image}}	{{.Ports}}"
-  ];
-  const result = run(args);
-  if (result.status !== 0) {
-    return [];
-  }
-  return parseDockerPsOutput(result.stdout).filter(isCompatibleMailpitContainer);
-}
-function findRunningMailpitContainer(options = {}) {
-  return findKnownMailpitContainers(options).at(0) ?? null;
-}
-function stopKnownMailpitContainers(options = {}) {
-  const run = options.run ?? runDocker;
-  const containers = findKnownMailpitContainers({ all: true, run });
-  if (containers.length === 0) {
-    return true;
-  }
-  return containers.every((container) => run(["rm", "-f", container.name]).status === 0);
-}
-function streamKnownMailpitLogs() {
-  const container = findRunningMailpitContainer();
-  if (!container) {
-    console.error("No running Mailpit container was found for the configured local ports.");
-    process.exit(1);
-  }
-  const result = runDocker(["logs", "-f", container.name], { stdio: "inherit" });
-  process.exit(result.status ?? 1);
-}
-export {
-  dockerIsAvailable,
-  findRunningMailpitContainer,
-  stopKnownMailpitContainers,
-  streamKnownMailpitLogs
-};

package/dist/operations/services/release-candidate.d.ts

@@ -1,60 +0,0 @@
-export type ReleaseCandidateStatus = 'passed' | 'failed';
-export type ReleaseCandidateMode = 'hybrid' | 'strict' | 'skip';
-export type ReleaseCandidateFailure = {
-    code: string;
-    scope: string;
-    provider?: string | null;
-    message: string;
-    details?: Record<string, unknown> | null;
-};
-export type ReleaseCandidateFingerprint = {
-    key: string;
-    policyVersion: string;
-    rootSha: string | null;
-    packageShas: Record<string, string | null>;
-    plannedVersions: Record<string, string>;
-    lockfiles: Record<string, string | null>;
-    selectedPackages: string[];
-};
-export type ReleaseCandidateTopologyFingerprint = {
-    key: string;
-    policyVersion: string;
-    packageManifests: Record<string, string | null>;
-    lockfiles: Record<string, string | null>;
-    treeseedManifests: Record<string, string | null>;
-    selectedPackages: string[];
-};
-export type ReleaseCandidateCheck = {
-    name: string;
-    status: 'passed' | 'skipped' | 'failed';
-    detail: string;
-};
-export type ReleaseCandidateReport = {
-    status: ReleaseCandidateStatus;
-    fingerprint: ReleaseCandidateFingerprint;
-    mode: ReleaseCandidateMode;
-    reason: string;
-    topology: ReleaseCandidateTopologyFingerprint;
-    reused: boolean;
-    checkedAt: string;
-    failures: ReleaseCandidateFailure[];
-    checks: ReleaseCandidateCheck[];
-};
-export type ReleaseCandidateInput = {
-    root: string;
-    plannedVersions: Record<string, unknown>;
-    selectedPackageNames?: string[];
-    allowReuse?: boolean;
-    mode?: ReleaseCandidateMode;
-};
-export declare function buildReleaseCandidateFingerprint(input: ReleaseCandidateInput): ReleaseCandidateFingerprint;
-export declare function buildReleaseCandidateTopologyFingerprint(input: ReleaseCandidateInput): ReleaseCandidateTopologyFingerprint;
-export declare function readCachedReleaseCandidateReport(root: string, key: string): ReleaseCandidateReport | null;
-export declare function writeReleaseCandidateReport(root: string, report: ReleaseCandidateReport): ReleaseCandidateReport;
-export declare function collectReleaseCandidateOutputFailures(line: string): string[];
-export declare function isRootWebReleaseCandidateEntry(entry: {
-    id: string;
-    group?: string | null;
-    serviceTargets?: unknown;
-}): boolean;
-export declare function runReleaseCandidateGate(input: ReleaseCandidateInput): Promise<ReleaseCandidateReport>;