@treeseed/sdk 0.11.0 → 0.12.4

package/dist/operations/services/hosted-service-checks.js

@@ -1,7 +1,7 @@
 import { relative, resolve } from "node:path";
 import { collectTreeseedEnvironmentContext, resolveTreeseedMachineEnvironmentValues } from "./config-runtime.js";
 import { configuredRailwayServices } from "./railway-deploy.js";
-import { loadCliDeployConfig } from "./runtime-tools.js";
+import { loadTreeseedPlatformConfig } from "../../platform/config.js";
 import { discoverTreeseedApplications } from "../../hosting/apps.js";
 const RAILWAY_SECRET_KEYS_BY_SERVICE = {
   api: [
@@ -14,6 +14,12 @@ const RAILWAY_SECRET_KEYS_BY_SERVICE = {
     "TREESEED_DATABASE_URL",
     "TREESEED_PLATFORM_RUNNER_SECRET",
     "TREESEED_CREDENTIAL_SESSION_SECRET"
+  ],
+  capacityProviderManager: [
+    "TREESEED_CAPACITY_PROVIDER_API_KEY"
+  ],
+  capacityProviderRunner: [
+    "TREESEED_CAPACITY_PROVIDER_API_KEY"
   ]
 };
 const RAILWAY_VARIABLE_KEYS_BY_SERVICE = {
@@ -22,6 +28,18 @@ const RAILWAY_VARIABLE_KEYS_BY_SERVICE = {
     "TREESEED_PLATFORM_RUNNER_DATA_DIR",
     "TREESEED_PLATFORM_RUNNER_ENVIRONMENT",
     "TREESEED_MANAGER_ID"
+  ],
+  capacityProviderManager: [
+    "TREESEED_PROVIDER_ENVIRONMENT",
+    "TREESEED_PROVIDER_ROLE",
+    "TREESEED_MARKET_URL"
+  ],
+  capacityProviderRunner: [
+    "TREESEED_PROVIDER_ENVIRONMENT",
+    "TREESEED_PROVIDER_ROLE",
+    "TREESEED_MARKET_URL",
+    "TREESEED_PROVIDER_RUNNER_ID",
+    "TREESEED_PROVIDER_DATA_DIR"
   ]
 };
 function check(input) {
@@ -38,8 +56,15 @@ function rootDirectory(tenantRoot, rootDir) {
   return rel || ".";
 }
 function railwayServiceRootDirectory(tenantRoot, service) {
+  const sourceRootDirectory = String(service.sourceRootDirectory ?? "").trim();
+  if (sourceRootDirectory) {
+    return sourceRootDirectory;
+  }
   return rootDirectory(service.application?.root ?? tenantRoot, service.rootDir);
 }
+function railwayServiceUsesImageSource(service) {
+  return Boolean(service.imageRef || service.sourceMode === "image");
+}
 function hasConfiguredValue(values, key) {
   return typeof values[key] === "string" && Boolean(values[key]?.trim());
 }
@@ -65,6 +90,8 @@ function valuePresence(values, observed, key, serviceTarget) {
 function serviceTypeFor(key) {
   if (key === "api") return "api";
   if (key === "operationsRunner") return "operationsRunner";
+  if (key === "capacityProviderManager") return "capacityProviderManager";
+  if (key === "capacityProviderRunner") return "capacityProviderRunner";
   if (key === "treeseedDatabase") return "treeseedDatabase";
   return "unknown";
 }
@@ -118,7 +145,7 @@ function httpStatus(url, options) {
 function collectTreeseedHostedServiceChecks(options) {
   const target = options.target ?? "prod";
   const tenantRoot = options.tenantRoot;
-  const deployConfig = loadCliDeployConfig(tenantRoot);
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target, env: process.env }).deployConfig;
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
   let machineValues = {};
   try {
@@ -128,12 +155,17 @@ function collectTreeseedHostedServiceChecks(options) {
   }
   const values = { ...machineValues, ...options.valuesOverlay ?? {} };
   const checks = [];
+  const selectedServiceKeys = new Set((options.serviceKeys ?? []).map((key) => key.trim()).filter(Boolean));
   const selectedAppId = options.appId?.trim() || null;
-  const selectedApplication = selectedAppId ? discoverTreeseedApplications(tenantRoot).find((application) => application.id === selectedAppId || application.relativeRoot === selectedAppId) : null;
+  const applications = discoverTreeseedApplications(tenantRoot);
+  const selectedApplication = selectedAppId ? applications.find((application) => application.id === selectedAppId || application.relativeRoot === selectedAppId) : null;
+  const workspaceHasApiApplication = applications.some(
+    (application) => application.roles.includes("api") || application.config.surfaces?.api?.enabled === true || application.config.services?.api?.enabled !== false && Boolean(application.config.services?.api)
+  );
   const includeWeb = !selectedAppId || selectedAppId === "web" || selectedApplication?.roles.includes("web") === true;
   const includeApi = !selectedAppId || selectedAppId === "api" || selectedApplication?.roles.includes("api") === true;
   const selectedAppHasApi = Boolean(
-    selectedApplication?.roles.includes("api") || selectedApplication?.config.surfaces?.api?.enabled === true || selectedApplication?.config.services?.api?.enabled !== false && selectedApplication?.config.services?.api
+    selectedApplication?.roles.includes("api") || selectedApplication?.config.surfaces?.api?.enabled === true || selectedApplication?.config.services?.api?.enabled !== false && selectedApplication?.config.services?.api || selectedAppId === "web" && workspaceHasApiApplication || selectedAppId === "web" && (deployConfig.surfaces?.api?.enabled === true || deployConfig.services?.api?.enabled !== false && deployConfig.services?.api)
   );
   const selectedWeb = webCheckConfig(deployConfig, selectedApplication);
   const web = selectedWeb.web;
@@ -179,7 +211,7 @@ function collectTreeseedHostedServiceChecks(options) {
       }));
     }
   }
-  const configuredServices = configuredRailwayServices(tenantRoot, target).filter((service) => !selectedAppId || service.application?.id === selectedAppId);
+  const configuredServices = configuredRailwayServices(tenantRoot, target).filter((service) => !selectedAppId || service.application?.id === selectedAppId).filter((service) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(service.key));
   for (const service of configuredServices) {
     const serviceType = serviceTypeFor(service.key);
     const observed = observedFor(options, service.serviceName);
@@ -197,8 +229,9 @@ function collectTreeseedHostedServiceChecks(options) {
       issues: observed ? [] : ["No live Railway observation was provided."]
     }));
     for (const [key, expected] of Object.entries({
-      rootDirectory: expectedRootDirectory,
+      rootDirectory: railwayServiceUsesImageSource(service) ? null : expectedRootDirectory,
       buildCommand: service.buildCommand,
+      dockerfilePath: service.dockerfilePath,
       startCommand: service.startCommand,
       healthcheckPath: service.healthcheckPath,
       healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
@@ -219,7 +252,81 @@ function collectTreeseedHostedServiceChecks(options) {
         issues: !observed || actual === expected ? [] : [`Expected ${key}=${expected}, observed ${actual ?? "(unset)"}.`]
       }));
     }
-    if (service.key === "operationsRunner" && service.volumeMountPath) {
+    if (!railwayServiceUsesImageSource(service) && service.sourceRepo) {
+      const actualRepo = observed?.deploymentRepo ?? null;
+      const actualBranch = observed?.deploymentBranch ?? null;
+      const actualRootDirectory = observed?.deploymentRootDirectory ?? null;
+      const sourceUploadDeployment = target === "staging" && actualRepo === null && actualBranch === null && observed?.deploymentHealthy === true;
+      checks.push(check({
+        id: `railway:${service.instanceKey}:deployment-repo`,
+        provider: "railway",
+        serviceKey: service.key,
+        serviceType,
+        target,
+        description: `Railway ${service.serviceName} latest deployment uses the desired Git repo.`,
+        expected: { repo: service.sourceRepo },
+        observed: observed ? { repo: actualRepo, sourceUpload: sourceUploadDeployment } : { skipped: true },
+        status: observed ? sourceUploadDeployment ? "passed" : statusForMatch(actualRepo, service.sourceRepo) : "skipped",
+        issues: !observed || sourceUploadDeployment || actualRepo === service.sourceRepo ? [] : [`Expected deployment repo=${service.sourceRepo}, observed ${actualRepo ?? "(unset)"}.`]
+      }));
+      if (service.sourceBranch) {
+        checks.push(check({
+          id: `railway:${service.instanceKey}:deployment-branch`,
+          provider: "railway",
+          serviceKey: service.key,
+          serviceType,
+          target,
+          description: `Railway ${service.serviceName} latest deployment uses the desired Git branch.`,
+          expected: { branch: service.sourceBranch },
+          observed: observed ? { branch: actualBranch, commitHash: observed.deploymentCommitHash ?? null, sourceUpload: sourceUploadDeployment } : { skipped: true },
+          status: observed ? sourceUploadDeployment ? "passed" : statusForMatch(actualBranch, service.sourceBranch) : "skipped",
+          issues: !observed || sourceUploadDeployment || actualBranch === service.sourceBranch ? [] : [`Expected deployment branch=${service.sourceBranch}, observed ${actualBranch ?? "(unset)"}.`]
+        }));
+      }
+      if (expectedRootDirectory) {
+        checks.push(check({
+          id: `railway:${service.instanceKey}:deployment-root-directory`,
+          provider: "railway",
+          serviceKey: service.key,
+          serviceType,
+          target,
+          description: `Railway ${service.serviceName} latest deployment uses the desired Git root directory.`,
+          expected: { rootDirectory: expectedRootDirectory },
+          observed: observed ? { rootDirectory: actualRootDirectory } : { skipped: true },
+          status: observed ? statusForMatch(actualRootDirectory, expectedRootDirectory) : "skipped",
+          issues: !observed || actualRootDirectory === expectedRootDirectory ? [] : [`Expected deployment rootDirectory=${expectedRootDirectory}, observed ${actualRootDirectory ?? "(unset)"}.`]
+        }));
+      }
+    }
+    if (observed && observed.deploymentHealthy === false) {
+      checks.push(check({
+        id: `railway:${service.instanceKey}:deployment`,
+        provider: "railway",
+        serviceKey: service.key,
+        serviceType,
+        target,
+        description: `Railway ${service.serviceName} latest deployment is healthy.`,
+        expected: { healthy: true },
+        observed: { healthy: false, status: observed.deploymentStatus ?? null },
+        status: "failed",
+        issues: [`Latest Railway deployment status is ${observed.deploymentStatus ?? "unknown"}.`]
+      }));
+    } else if (observed) {
+      checks.push(check({
+        id: `railway:${service.instanceKey}:deployment`,
+        provider: "railway",
+        serviceKey: service.key,
+        serviceType,
+        target,
+        description: `Railway ${service.serviceName} latest deployment is healthy.`,
+        expected: { healthy: true },
+        observed: { healthy: observed.deploymentHealthy ?? null, status: observed.deploymentStatus ?? null },
+        status: observed.deploymentHealthy === true ? "passed" : "skipped",
+        issues: observed.deploymentHealthy === true ? [] : ["No live Railway deployment health observation was provided."]
+      }));
+    }
+    if (service.volumeMountPath) {
+      const volumeAttached = Boolean(observed?.volumeId) && observed?.volumeMountPath === service.volumeMountPath && (!observed?.serviceName || !observed?.volumeServiceId || observed.volumeServiceId === observed.serviceId) && observed?.volumePendingDeletion !== true && !(typeof observed?.volumeDeletedAt === "string" && observed.volumeDeletedAt.trim()) && !["DELETING", "DELETED"].includes(String(observed?.volumeState ?? "").toUpperCase());
       checks.push(check({
         id: `railway:${service.instanceKey}:volume`,
         provider: "railway",
@@ -228,9 +335,53 @@ function collectTreeseedHostedServiceChecks(options) {
         target,
         description: `Railway ${service.serviceName} volume mount matches config.`,
         expected: { volumeMountPath: service.volumeMountPath },
-        observed: observed ? { volumeMountPath: observed.volumeMountPath ?? null } : { skipped: true },
-        status: observed ? statusForMatch(observed.volumeMountPath ?? null, service.volumeMountPath) : "skipped",
-        issues: !observed || observed.volumeMountPath === service.volumeMountPath ? [] : [`Expected volumeMountPath=${service.volumeMountPath}, observed ${observed.volumeMountPath ?? "(unset)"}.`]
+        observed: observed ? {
+          volumeName: observed.volumeName ?? null,
+          volumeId: observed.volumeId ?? null,
+          volumeMountPath: observed.volumeMountPath ?? null,
+          volumeServiceId: observed.volumeServiceId ?? null,
+          volumeEnvironmentId: observed.volumeEnvironmentId ?? null,
+          volumeState: observed.volumeState ?? null,
+          volumePendingDeletion: observed.volumePendingDeletion ?? null,
+          volumeDeletedAt: observed.volumeDeletedAt ?? null
+        } : { skipped: true },
+        status: observed ? volumeAttached ? "passed" : "failed" : "skipped",
+        issues: !observed || volumeAttached ? [] : [`Expected an attached persistent volume mounted at ${service.volumeMountPath}, observed ${observed.volumeMountPath ?? "(unset)"} on volume ${observed.volumeName ?? "(none)"}.`]
+      }));
+      const volumeNotPendingDeletion = observed?.volumePendingDeletion === false && !["DELETING", "DELETED"].includes(String(observed?.volumeState ?? "").toUpperCase());
+      checks.push(check({
+        id: `railway:${service.instanceKey}:volume-retained`,
+        provider: "railway",
+        serviceKey: service.key,
+        serviceType,
+        target,
+        description: `Railway ${service.serviceName} volume is retained and active.`,
+        expected: { pendingDeletion: false },
+        observed: observed ? {
+          volumeName: observed.volumeName ?? null,
+          volumeId: observed.volumeId ?? null,
+          state: observed.volumeState ?? null,
+          pendingDeletion: observed.volumePendingDeletion ?? null,
+          deletedAt: observed.volumeDeletedAt ?? null
+        } : { skipped: true },
+        status: observed ? volumeNotPendingDeletion ? "passed" : "failed" : "skipped",
+        issues: !observed || volumeNotPendingDeletion ? [] : [`Expected an active retained volume, observed state=${observed.volumeState ?? "(unset)"} pendingDeletion=${String(observed.volumePendingDeletion ?? null)} deletedAt=${observed.volumeDeletedAt ?? "(unset)"}.`]
+      }));
+      const deploymentHasVolumeMount = observed?.deploymentRequiredMountPath === service.volumeMountPath || (observed?.deploymentVolumeMounts ?? []).includes(service.volumeMountPath);
+      checks.push(check({
+        id: `railway:${service.instanceKey}:deployment-required-mount`,
+        provider: "railway",
+        serviceKey: service.key,
+        serviceType,
+        target,
+        description: `Railway ${service.serviceName} deployment metadata includes the volume mount.`,
+        expected: { volumeMountPath: service.volumeMountPath },
+        observed: observed ? {
+          requiredMountPath: observed.deploymentRequiredMountPath ?? null,
+          volumeMounts: observed.deploymentVolumeMounts ?? []
+        } : { skipped: true },
+        status: observed ? deploymentHasVolumeMount ? "passed" : "failed" : "skipped",
+        issues: !observed || deploymentHasVolumeMount ? [] : [`Expected deployment metadata to include volume mount ${service.volumeMountPath}.`]
       }));
     }
     for (const key of [...RAILWAY_SECRET_KEYS_BY_SERVICE[service.key] ?? [], ...RAILWAY_VARIABLE_KEYS_BY_SERVICE[service.key] ?? []]) {
@@ -262,7 +413,7 @@ function collectTreeseedHostedServiceChecks(options) {
     ...discoverTreeseedApplications(tenantRoot).filter((application) => application.root !== resolve(tenantRoot)).filter((application) => !selectedAppId || application.id === selectedAppId).map((application) => application.config)
   ];
   const treeseedDatabaseService = applicationConfigs.map((config) => config.services?.treeseedDatabase).find((service) => service?.enabled !== false);
-  if (includeApi && treeseedDatabaseService?.enabled !== false && treeseedDatabaseService?.provider === "railway") {
+  if (includeApi && (selectedServiceKeys.size === 0 || selectedServiceKeys.has("treeseedDatabase")) && treeseedDatabaseService?.enabled !== false && treeseedDatabaseService?.provider === "railway") {
     const targets = treeseedDatabaseService.railway?.serviceTargets ?? [];
     checks.push(check({
       id: "railway:treeseedDatabase:targets",

package/dist/operations/services/hosting-audit.d.ts

@@ -1,5 +1,5 @@
-import { type TreeseedEnvironmentScope } from '../../platform/environment.ts';
-import type { TreeseedReconcileTarget } from '../../reconcile/contracts.ts';
+import { type TreeseedEnvironmentScope } from '../../platform/environment.js';
+import type { TreeseedReconcileTarget } from '../../reconcile/contracts.js';
 export type TreeseedHostingAuditEnvironment = 'current' | 'local' | 'staging' | 'prod';
 export type TreeseedHostingAuditResolvedEnvironment = 'local' | 'staging' | 'prod' | 'preview';
 export type TreeseedHostingAuditHostKind = 'repository' | 'web' | 'email';

package/dist/operations/services/hosting-audit.js

@@ -20,7 +20,7 @@ import {
   PRODUCTION_BRANCH,
   STAGING_BRANCH
 } from "./git-workflow.js";
-import { loadCliDeployConfig } from "./runtime-tools.js";
+import { loadTreeseedPlatformConfig } from "../../platform/config.js";
 import {
   collectTreeseedReconcileStatus,
   reconcileTreeseedTarget
@@ -110,7 +110,7 @@ function resolveTreeseedHostingAuditTarget({
   }
   if (branchName) {
     try {
-      const deployConfig = loadCliDeployConfig(tenantRoot);
+      const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: "staging", env: process.env }).deployConfig;
       const previewTarget = createBranchPreviewDeployTarget(branchName);
       const previewState = loadDeployState(tenantRoot, deployConfig, { target: previewTarget });
       if (previewState?.previewEnabled === true || previewState?.readiness?.initialized === true || hasValue(previewState?.lastDeployedUrl) || hasValue(previewState?.workerName)) {
@@ -222,17 +222,17 @@ function appendManualConfigChecks(checks, values, hostKinds) {
       id: "web.cloudflare.token",
       hostType: "web",
       provider: "cloudflare",
-      keys: ["CLOUDFLARE_API_TOKEN"],
+      keys: ["TREESEED_CLOUDFLARE_API_TOKEN"],
       label: "Web provider token",
-      remediation: "Set CLOUDFLARE_API_TOKEN for TreeSeed-managed Web hosting."
+      remediation: "Set TREESEED_CLOUDFLARE_API_TOKEN for TreeSeed-managed Web hosting."
     });
     requiredKeyCheck(checks, values, {
       id: "web.cloudflare.account",
       hostType: "web",
       provider: "cloudflare",
-      keys: ["CLOUDFLARE_ACCOUNT_ID"],
+      keys: ["TREESEED_CLOUDFLARE_ACCOUNT_ID"],
       label: "Web provider account",
-      remediation: "Set CLOUDFLARE_ACCOUNT_ID for TreeSeed-managed Web hosting."
+      remediation: "Set TREESEED_CLOUDFLARE_ACCOUNT_ID for TreeSeed-managed Web hosting."
     });
   }
   if (hostKinds.includes("email")) {
@@ -468,7 +468,7 @@ async function runTreeseedHostingAudit({
 }) {
   const resolved = resolveTreeseedHostingAuditTarget({ tenantRoot, environment });
   const hostKinds = normalizeHostKinds(requestedHostKinds);
-  const deployConfig = loadCliDeployConfig(tenantRoot);
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: resolved.scope, env }).deployConfig;
   const seedValues = collectTreeseedConfigSeedValues(tenantRoot, resolved.scope, env, valuesOverlay);
   const suggestedValues = getTreeseedEnvironmentSuggestedValues({
     scope: resolved.scope,

package/dist/operations/services/hub-launch.d.ts

@@ -1,4 +1,4 @@
-import { type KnowledgeHubProviderLaunchInput, type KnowledgeHubProviderLaunchResult } from './hub-provider-launch.ts';
+import { type KnowledgeHubProviderLaunchInput, type KnowledgeHubProviderLaunchResult } from './hub-provider-launch.js';
 export type KnowledgeHubSourceKind = 'blank_hub' | 'template' | 'knowledge_pack' | 'market_listing';
 export type KnowledgeHubRepositoryTopology = 'split_software_content' | 'combined_compatibility';
 export type KnowledgeHubRepositoryRole = 'software' | 'content' | 'parent_workspace';

package/dist/operations/services/hub-provider-launch.d.ts

@@ -1,8 +1,8 @@
-import { checkTreeseedProviderConnections, syncTreeseedGitHubEnvironment } from './config-runtime.ts';
-import { configuredRailwayServices, deployRailwayService, ensureRailwayScheduledJobs, verifyRailwayScheduledJobs } from './railway-deploy.ts';
-import { type ProjectLaunchSecretSyncResult } from './template-secret-sync.ts';
-import { buildKnowledgePackMarketPackage, buildTemplateMarketPackage } from './market-packaging.ts';
-import type { ProjectLaunchConfigWritePlanItem, ProjectLaunchResolvedHostBinding, ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.ts';
+import { checkTreeseedProviderConnections, syncTreeseedGitHubEnvironment } from './config-runtime.js';
+import { configuredRailwayServices, deployRailwayService, ensureRailwayScheduledJobs, verifyRailwayScheduledJobs } from './railway-deploy.js';
+import { type ProjectLaunchSecretSyncResult } from './template-secret-sync.js';
+import { buildKnowledgePackMarketPackage, buildTemplateMarketPackage } from './market-packaging.js';
+import type { ProjectLaunchConfigWritePlanItem, ProjectLaunchResolvedHostBinding, ProjectLaunchSecretDeploymentPlanItem } from '../../template-launch-requirements.js';
 export type KnowledgeHubProviderLaunchFailurePhase = 'repo_provision_failed' | 'content_bootstrap_failed' | 'workflow_bootstrap_failed' | 'hosting_registration_failed' | 'host_binding_secret_sync_failed' | 'runtime_connection_failed';
 export interface KnowledgeHubProviderLaunchInput {
     projectId: string;

package/dist/operations/services/hub-provider-launch.js

@@ -1,6 +1,5 @@
 import { cpSync, mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync, existsSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { collectTreeseedReconcileStatus, reconcileTreeseedTarget } from "../../reconcile/index.js";
@@ -18,6 +17,7 @@ import { loadCliDeployConfig } from "./runtime-tools.js";
 import { templateCatalogRoot } from "./runtime-paths.js";
 import { scaffoldTemplateProject } from "./template-registry.js";
 import { applyProjectLaunchHostBindingConfig } from "./template-host-bindings.js";
+import { runTreeseedGit } from "./git-runner.js";
 import {
   ProjectLaunchSecretSyncError,
   syncProjectLaunchHostBindingSecrets
@@ -70,19 +70,24 @@ function ensureDir(path) {
   mkdirSync(path, { recursive: true });
 }
 function runGit(cwd, args, capture = true) {
-  const result = spawnSync("git", args, {
+  const mutating = /^(add|commit|checkout|switch|merge|tag|push|fetch|worktree|submodule|reset|clean|restore|branch)$/u.test(args[0] ?? "");
+  const result = runTreeseedGit(args, {
     cwd,
-    stdio: capture ? "pipe" : "inherit",
-    encoding: "utf8"
+    mode: mutating ? "mutate" : "read",
+    allowFailure: true
   });
+  if (!capture && result.stdout.trim()) process.stdout.write(result.stdout);
+  if (!capture && result.stderr.trim()) process.stderr.write(result.stderr);
   if (result.status !== 0) {
     if (args[0] === "push" && !args.includes("--force")) {
       const retryArgs = ["push", "--force", ...args.slice(1)];
-      const retry = spawnSync("git", retryArgs, {
+      const retry = runTreeseedGit(retryArgs, {
         cwd,
-        stdio: capture ? "pipe" : "inherit",
-        encoding: "utf8"
+        mode: "mutate",
+        allowFailure: true
       });
+      if (!capture && retry.stdout.trim()) process.stdout.write(retry.stdout);
+      if (!capture && retry.stderr.trim()) process.stderr.write(retry.stderr);
       if (retry.status === 0) return retry;
       const retryDetail = retry.stderr?.trim() || retry.stdout?.trim();
       throw new Error(`git ${retryArgs.join(" ")} failed${retryDetail ? `: ${retryDetail}` : ""}`);
@@ -292,7 +297,7 @@ This hub is live and ready for the first team release cycle.
 }
 function ensureHostedProjectFiles(projectRoot) {
   const sdkApiPackage = ["@treeseed", "sdk/api"].join("/");
-  writeText(resolve(projectRoot, "src/api/server.js"), `import { createRailwayTreeseedApiServer } from '${sdkApiPackage}';
+  writeText(resolve(projectRoot, "src/api/server.ts"), `import { createRailwayTreeseedApiServer } from '${sdkApiPackage}';
 
 const server = await createRailwayTreeseedApiServer();
 console.log(\`Treeseed project API listening on \${server.url}\`);
@@ -340,8 +345,6 @@ function applyManagedProjectDefaults(projectRoot, input) {
       accountId: cloudflareAccountId,
       ...input.domains?.zoneId ? { zoneId: input.domains.zoneId } : {},
       workerName: slug,
-      queueName: `${slug}-agent-work`,
-      dlqName: `${slug}-agent-work-dlq`,
       pages: {
         projectName: slug,
         previewProjectName: slug,
@@ -647,7 +650,7 @@ function scaffoldLaunchSource(projectRoot, input) {
   });
 }
 function repositoryHostGitHubEnvOverlay() {
-  const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN || process.env.TREESEED_HOSTED_HUBS_GITHUB_TOKEN || "";
+  const token = process.env.TREESEED_GITHUB_TOKEN || process.env.TREESEED_HOSTED_HUBS_GITHUB_TOKEN || "";
   return token ? { ...process.env, GH_TOKEN: token, GITHUB_TOKEN: token } : process.env;
 }
 function prepareKnowledgeHubContentRepositoryRoot(sourceRoot, contentRoot, input) {
@@ -747,7 +750,9 @@ async function executeKnowledgeHubProviderLaunch(input, options = {}) {
       []
     );
   }
-  const workingRoot = mkdtempSync(join(tmpdir(), `hub-provider-launch-${slugify(input.projectSlug, "project")}-`));
+  const launchTempBase = resolve(process.cwd(), ".treeseed", "tmp", "hub-provider-launch");
+  mkdirSync(launchTempBase, { recursive: true });
+  const workingRoot = mkdtempSync(join(launchTempBase, `hub-provider-launch-${slugify(input.projectSlug, "project")}-`));
   const repoOwner = slugify(input.repoOwner ?? resolveDefaultGitHubOwner(), "treeseed-ai");
   const repoName = slugify(input.repoName ?? input.projectSlug, "project");
   const githubEnv = repositoryHostGitHubEnvOverlay();
@@ -796,14 +801,14 @@ async function executeKnowledgeHubProviderLaunch(input, options = {}) {
       );
     }
     const seed = seedLaunchContent(workingRoot, input);
-    packageSourceRoot = mkdtempSync(join(tmpdir(), `market-package-${slugify(input.projectSlug, "project")}-`));
+    packageSourceRoot = mkdtempSync(join(launchTempBase, `market-package-${slugify(input.projectSlug, "project")}-`));
     cpSync(workingRoot, packageSourceRoot, { recursive: true });
     await appendPhase(phases, "content_bootstrap", "completed", "Scaffolded the repo and seeded Direct content.", reportPhase);
     let contentRepository = null;
     let contentRepositoryWorkingRoot = null;
     if (input.contentRepository?.name) {
       await appendPhase(phases, "content_repository", "running", "Creating content repository.", reportPhase);
-      contentRepositoryWorkingRoot = mkdtempSync(join(tmpdir(), `market-content-${slugify(input.projectSlug, "project")}-`));
+      contentRepositoryWorkingRoot = mkdtempSync(join(launchTempBase, `market-content-${slugify(input.projectSlug, "project")}-`));
       prepareKnowledgeHubContentRepositoryRoot(workingRoot, contentRepositoryWorkingRoot, input);
       const createdContentRepository = input.contentRepository.url ? {
         ...resolveGitHubRemoteUrls(input.contentRepository.owner ?? repoOwner, input.contentRepository.name),

package/dist/operations/services/live-hosted-service-checks.d.ts

@@ -1,8 +1,9 @@
-import { type TreeseedHostedServiceCheckReport, type TreeseedHostedServiceTarget } from './hosted-service-checks.ts';
+import { type TreeseedHostedServiceCheckReport, type TreeseedHostedServiceTarget } from './hosted-service-checks.js';
 export interface TreeseedLiveHostedServiceCheckOptions {
     tenantRoot: string;
     target: TreeseedHostedServiceTarget;
     appId?: string;
+    serviceKeys?: string[];
     strict?: boolean;
     requireLiveRailway?: boolean;
     requireLiveHttp?: boolean;