@treeseed/sdk 0.11.0 → 0.12.5

package/dist/operations/services/repository-save-orchestrator.js

@@ -1,6 +1,8 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, resolve, relative } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "./git-runner.js";
 import {
   ensureSshPushUrlForOrigin,
   remoteWriteUrl,
@@ -10,8 +12,8 @@ import {
   generateRepositoryCommitMessage
 } from "./commit-message-provider.js";
 import {
-  createDevTagMessage,
   createPackageDependencyReference,
+  normalizeGitRemoteForDependency,
   updateInternalDependencySpecs
 } from "./package-reference-policy.js";
 import {
@@ -32,7 +34,6 @@ import {
 } from "./workspace-save.js";
 import {
   hasCompleteTreeseedPackageCheckout,
-  run,
   sortWorkspacePackages,
   workspacePackages
 } from "./workspace-tools.js";
@@ -48,6 +49,24 @@ import {
 import {
   discoverTreeseedPackageAdapters
 } from "./package-adapters.js";
+import {
+  discoverTreeseedManagedRepositories,
+  parseGitmodulesPaths,
+  readTreeseedTemplateRepositoryManifest
+} from "./managed-repositories.js";
+function runGit(args, options) {
+  return runTreeseedGitText(args, {
+    cwd: options.cwd,
+    mode: classifyTreeseedGitMode(args),
+    timeoutMs: options.timeoutMs,
+    maxBuffer: options.maxBuffer
+  });
+}
+function sleepMs(durationMs) {
+  return new Promise((resolvePromise) => {
+    setTimeout(resolvePromise, durationMs);
+  });
+}
 class RepositorySaveError extends Error {
   exitCode;
   details;
@@ -77,11 +96,66 @@ function emitProgress(options, node, phase, message, stream = "stdout") {
 function prefixedOutput(node, phase, output) {
   return String(output ?? "").split(/\r?\n/u).map((line) => line.trimEnd()).filter(Boolean).map((line) => `${progressPrefix(node, phase)} ${line}`).join("\n");
 }
+function withShortProcessTempEnv(env = {}) {
+  const merged = { ...process.env, ...env };
+  if (process.platform === "win32") {
+    return merged;
+  }
+  const shortTemp = tmpdir();
+  const tempKeys = ["TMPDIR", "TMP", "TEMP"];
+  for (const key of tempKeys) {
+    const value = merged[key];
+    if (value && value.length > shortTemp.length) {
+      merged[key] = shortTemp;
+    }
+  }
+  return merged;
+}
+function npmCacheForCwd(cwd) {
+  const cacheDir = resolve(cwd, ".treeseed", "cache", "npm");
+  mkdirSync(cacheDir, { recursive: true });
+  return cacheDir;
+}
+function npmWorkflowEnv(env = {}, cwd = process.cwd()) {
+  const npmCache = env.npm_config_cache ?? env.NPM_CONFIG_CACHE ?? process.env.npm_config_cache ?? process.env.NPM_CONFIG_CACHE ?? npmCacheForCwd(cwd);
+  return withShortProcessTempEnv({
+    ...env,
+    NPM_CONFIG_CACHE: npmCache,
+    npm_config_audit: env.npm_config_audit ?? process.env.npm_config_audit ?? "false",
+    npm_config_cache: npmCache,
+    npm_config_fetch_retries: env.npm_config_fetch_retries ?? process.env.npm_config_fetch_retries ?? "2",
+    npm_config_fund: env.npm_config_fund ?? process.env.npm_config_fund ?? "false",
+    npm_config_foreground_scripts: env.npm_config_foreground_scripts ?? process.env.npm_config_foreground_scripts ?? "true",
+    npm_config_loglevel: env.npm_config_loglevel ?? process.env.npm_config_loglevel ?? "warn",
+    npm_config_maxsockets: env.npm_config_maxsockets ?? process.env.npm_config_maxsockets ?? "4",
+    npm_config_prefer_offline: env.npm_config_prefer_offline ?? process.env.npm_config_prefer_offline ?? "true",
+    npm_config_progress: env.npm_config_progress ?? process.env.npm_config_progress ?? "false"
+  });
+}
+function npmCommandForSpawn(args) {
+  if (process.platform === "win32") {
+    return { command: "npm", args };
+  }
+  return {
+    command: "bash",
+    args: [
+      "-lc",
+      'ulimit -n 65535 2>/dev/null || ulimit -n 32768 2>/dev/null || ulimit -n 16384 2>/dev/null || true; exec npm "$@"',
+      "npm-fd-guard",
+      ...args
+    ]
+  };
+}
+function displayCommand(command, args) {
+  return command === "npm" ? `npm ${args.join(" ")}` : `${command} ${args.join(" ")}`;
+}
 function runCapturedCommand(node, options, phase, command, args, commandOptions = {}) {
-  emitProgress(options, node, phase, `$ ${command} ${args.join(" ")}`);
-  const result = spawnSync(command, args, {
-    cwd: commandOptions.cwd ?? node.path,
-    env: { ...process.env, ...commandOptions.env ?? {} },
+  const cwd = commandOptions.cwd ?? node.path;
+  const spawnCommand = command === "npm" ? npmCommandForSpawn(args) : { command, args };
+  emitProgress(options, node, phase, `$ ${displayCommand(command, args)}`);
+  const result = spawnSync(spawnCommand.command, spawnCommand.args, {
+    cwd,
+    env: command === "npm" ? npmWorkflowEnv(commandOptions.env, cwd) : withShortProcessTempEnv(commandOptions.env),
     stdio: "pipe",
     encoding: "utf8",
     timeout: commandOptions.timeoutMs
@@ -94,12 +168,12 @@ function runCapturedCommand(node, options, phase, command, args, commandOptions
   }
   if (result.status !== 0) {
     const message = (result.error?.message ? `${result.error.message}
-` : "") + (prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${command} ${args.join(" ")} failed`);
+` : "") + (prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${displayCommand(command, args)} failed`);
     throw new RepositorySaveError(message, {
       details: {
         failingRepo: node.name,
         phase,
-        command: `${command} ${args.join(" ")}`
+        command: displayCommand(command, args)
       }
     });
   }
@@ -127,9 +201,11 @@ function isNoOpGitCommitError(error) {
   return /nothing to commit|no changes added to commit/u.test(error.message);
 }
 function runQuietCommand(node, phase, command, args, commandOptions = {}) {
-  const result = spawnSync(command, args, {
-    cwd: commandOptions.cwd ?? node.path,
-    env: { ...process.env, ...commandOptions.env ?? {} },
+  const cwd = commandOptions.cwd ?? node.path;
+  const spawnCommand = command === "npm" ? npmCommandForSpawn(args) : { command, args };
+  const result = spawnSync(spawnCommand.command, spawnCommand.args, {
+    cwd,
+    env: command === "npm" ? npmWorkflowEnv(commandOptions.env, cwd) : withShortProcessTempEnv(commandOptions.env),
     stdio: "pipe",
     encoding: "utf8",
     timeout: commandOptions.timeoutMs
@@ -139,14 +215,14 @@ function runQuietCommand(node, phase, command, args, commandOptions = {}) {
   if (result.status !== 0) {
     throw new RepositorySaveError(
       [
-        `${progressPrefix(node, phase)} ${command} ${args.join(" ")} failed`,
+        `${progressPrefix(node, phase)} ${displayCommand(command, args)} failed`,
         stderr || stdout
       ].filter(Boolean).join("\n"),
       {
         details: {
           failingRepo: node.name,
           phase,
-          command: `${command} ${args.join(" ")}`
+          command: displayCommand(command, args)
         }
       }
     );
@@ -154,11 +230,13 @@ function runQuietCommand(node, phase, command, args, commandOptions = {}) {
   return stdout;
 }
 async function runStreamingCommand(node, options, phase, command, args, commandOptions = {}) {
-  emitProgress(options, node, phase, `$ ${command} ${args.join(" ")}`);
+  const cwd = commandOptions.cwd ?? node.path;
+  const spawnCommand = command === "npm" ? npmCommandForSpawn(args) : { command, args };
+  emitProgress(options, node, phase, `$ ${displayCommand(command, args)}`);
   return await new Promise((resolvePromise, reject) => {
-    const child = spawn(command, args, {
-      cwd: commandOptions.cwd ?? node.path,
-      env: { ...process.env, ...commandOptions.env ?? {} },
+    const child = spawn(spawnCommand.command, spawnCommand.args, {
+      cwd,
+      env: command === "npm" ? npmWorkflowEnv(commandOptions.env, cwd) : withShortProcessTempEnv(commandOptions.env),
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = "";
@@ -185,7 +263,7 @@ async function runStreamingCommand(node, options, phase, command, args, commandO
       if (settled) return;
       settled = true;
       child.kill("SIGTERM");
-      reject(new Error(`${progressPrefix(node, phase)} ${command} ${args.join(" ")} timed out after ${commandOptions.timeoutMs}ms`));
+      reject(new Error(`${progressPrefix(node, phase)} ${displayCommand(command, args)} timed out after ${commandOptions.timeoutMs}ms`));
     }, commandOptions.timeoutMs) : null;
     child.stdout?.on("data", (chunk) => {
       const text = chunk.toString();
@@ -225,12 +303,12 @@ async function runStreamingCommand(node, options, phase, command, args, commandO
         return;
       }
       reject(new RepositorySaveError(
-        prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${command} ${args.join(" ")} failed with exit code ${code ?? "unknown"}`,
+        prefixedOutput(node, phase, stderr) || prefixedOutput(node, phase, stdout) || `${progressPrefix(node, phase)} ${displayCommand(command, args)} failed with exit code ${code ?? "unknown"}`,
         {
           details: {
             failingRepo: node.name,
             phase,
-            command: `${command} ${args.join(" ")}`
+            command: displayCommand(command, args)
           }
         }
       ));
@@ -241,7 +319,9 @@ function packageScripts(packageJson) {
   const scripts = packageJson?.scripts;
   return scripts && typeof scripts === "object" && !Array.isArray(scripts) ? Object.fromEntries(Object.entries(scripts).map(([key, value]) => [key, String(value)])) : {};
 }
-function classifyRepoKind(packageJson) {
+function classifyRepoKind(packageJson, managedKind) {
+  if (managedKind === "template") return "template";
+  if (managedKind === "fixture") return "fixture";
   if (typeof packageJson?.name !== "string" || typeof packageJson?.version !== "string") {
     return "project";
   }
@@ -261,7 +341,7 @@ function repoIdForPath(root, repoDir) {
 }
 function isGitRepo(repoDir) {
   try {
-    run("git", ["rev-parse", "--is-inside-work-tree"], { cwd: repoDir, capture: true });
+    runGit(["rev-parse", "--is-inside-work-tree"], { cwd: repoDir, capture: true });
     return true;
   } catch {
     return false;
@@ -294,17 +374,20 @@ function repoDisplayName(repoDir, packageJson) {
 function emptyManifestVerifyCommands() {
   return { fast: null, local: null, release: null };
 }
+function verifyCommandFromString(repoDir, label, command) {
+  return command ? { label, command: "bash", args: ["-lc", command], cwd: repoDir } : null;
+}
+function templateVerifyCommands(repoDir) {
+  const manifest = readTreeseedTemplateRepositoryManifest(repoDir);
+  if (!manifest) return null;
+  return {
+    fast: verifyCommandFromString(repoDir, "fast", manifest.verify.fast),
+    local: verifyCommandFromString(repoDir, "local", manifest.verify.local),
+    release: verifyCommandFromString(repoDir, "release", manifest.verify.release)
+  };
+}
 function parseGitmodules(root) {
-  const gitmodulesPath = resolve(root, ".gitmodules");
-  if (!existsSync(gitmodulesPath)) {
-    return [];
-  }
-  const source = readFileSync(gitmodulesPath, "utf8");
-  const paths = [];
-  for (const match of source.matchAll(/^\s*path\s*=\s*(.+?)\s*$/gmu)) {
-    paths.push(match[1].replaceAll("\\", "/"));
-  }
-  return paths;
+  return parseGitmodulesPaths(root);
 }
 function slugBranch(branch) {
   return branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "dev";
@@ -328,13 +411,29 @@ function isDevVersionForBranch(version, branch) {
 function packageVersionAtHead(node) {
   if (!node.packageJsonPath) return null;
   try {
-    const source = run("git", ["show", "HEAD:package.json"], { cwd: node.path, capture: true });
+    const source = runGit(["show", "HEAD:package.json"], { cwd: node.path, capture: true });
     const packageJson = JSON.parse(source);
     return typeof packageJson.version === "string" ? packageJson.version : null;
   } catch {
     return null;
   }
 }
+function headCommitOrPlanPlaceholder(cwd) {
+  try {
+    return headCommit(cwd);
+  } catch {
+    return "HEAD";
+  }
+}
+function remoteBranchCommitSafe(cwd, branch) {
+  try {
+    const output = runGit(["ls-remote", "origin", `refs/heads/${branch}`], { cwd, capture: true });
+    const [sha] = output.trim().split(/\s+/u);
+    return /^[a-f0-9]{40}$/u.test(sha ?? "") ? sha : null;
+  } catch {
+    return null;
+  }
+}
 function canManagePackageJsonVersion(node) {
   return node.kind === "package" && Boolean(node.packageJsonPath) && typeof node.packageJson?.version === "string";
 }
@@ -343,6 +442,7 @@ function packageVersionEligibleForBranch(node, version, options) {
 }
 function packageVersionTagConflictsWithHead(node, options) {
   if (node.kind !== "package") return false;
+  if (node.branchMode === "package-dev-save" && (options.devDependencyReferenceMode ?? "git-commit") === "git-commit") return false;
   const version = typeof node.packageJson?.version === "string" ? node.packageJson.version : null;
   if (!version || !packageVersionEligibleForBranch(node, version, options)) return false;
   const head = headCommit(node.path);
@@ -351,7 +451,7 @@ function packageVersionTagConflictsWithHead(node, options) {
 }
 function selectPackageVersion(node, options) {
   const current = String(node.packageJson?.version ?? "0.0.0");
-  if (node.branchMode === "package-dev-save" && isDevVersionForBranch(current, node.branch || options.branch) && !tagExists(node.path, current)) {
+  if (node.branchMode === "package-dev-save" && isDevVersionForBranch(current, node.branch || options.branch) && ((options.devDependencyReferenceMode ?? "git-commit") === "git-commit" || !tagExists(node.path, current))) {
     return { version: current, reused: true };
   }
   if (node.branchMode === "package-release-main") {
@@ -382,8 +482,6 @@ function createReport(node) {
     publishWait: null,
     version: typeof node.packageJson?.version === "string" ? node.packageJson.version : null,
     dependencySpec: node.plannedDependencySpec,
-    devTagMetadata: null,
-    replacedDevTags: [],
     branchMode: node.branchMode,
     verification: null,
     install: null,
@@ -396,8 +494,14 @@ function createReport(node) {
 }
 function discoverRepositorySaveNodes(root, gitRoot = repoRoot(root), branch = currentBranch(gitRoot), options = {}) {
   const repoDirs = /* @__PURE__ */ new Map();
-  repoDirs.set(".", gitRoot);
   const packageAdaptersByDir = new Map(discoverTreeseedPackageAdapters(root).map((adapter) => [resolve(adapter.dir), adapter]));
+  const managedRepositoriesByDir = new Map(discoverTreeseedManagedRepositories(root).map((repo) => [resolve(repo.dir), repo]));
+  for (const repo of managedRepositoriesByDir.values()) {
+    repoDirs.set(repo.relativeDir, repo.dir);
+  }
+  if (!repoDirs.has(".")) {
+    repoDirs.set(".", gitRoot);
+  }
   if (hasCompleteTreeseedPackageCheckout(root)) {
     for (const pkg of workspacePackages(root)) {
       if (isIndependentGitRepo(pkg.dir)) {
@@ -420,12 +524,13 @@ function discoverRepositorySaveNodes(root, gitRoot = repoRoot(root), branch = cu
     const packageJsonPath = resolve(repoDir, "package.json");
     const packageJson = existsSync(packageJsonPath) ? readJson(packageJsonPath) : null;
     const adapter = packageAdaptersByDir.get(resolve(repoDir)) ?? null;
-    const kind = adapter && !packageJson ? "package" : classifyRepoKind(packageJson);
+    const managed = managedRepositoriesByDir.get(resolve(repoDir)) ?? null;
+    const kind = adapter && !packageJson ? "package" : classifyRepoKind(packageJson, managed?.kind);
     const repoBranch = relativePath === "." ? currentBranch(repoDir) || branch || null : branch || currentBranch(repoDir) || null;
     const branchMode = kind === "project" ? "project-save" : options.stablePackageRelease === true && repoBranch === PRODUCTION_BRANCH ? "package-release-main" : "package-dev-save";
     return {
       id: relativePath,
-      name: adapter?.id ?? repoDisplayName(repoDir, packageJson),
+      name: managed?.kind === "template" || managed?.kind === "fixture" ? managed.name : adapter?.id ?? repoDisplayName(repoDir, packageJson),
       path: repoDir,
       relativePath,
       kind,
@@ -434,7 +539,7 @@ function discoverRepositorySaveNodes(root, gitRoot = repoRoot(root), branch = cu
       packageJsonPath: packageJson ? packageJsonPath : null,
       packageJson,
       scripts: packageScripts(packageJson),
-      manifestVerifyCommands: adapter?.verifyCommands ?? emptyManifestVerifyCommands(),
+      manifestVerifyCommands: adapter?.verifyCommands ?? templateVerifyCommands(repoDir) ?? emptyManifestVerifyCommands(),
       remoteUrl: originRemoteUrlSafe(repoDir),
       dependencies: [],
       dependents: [],
@@ -529,9 +634,16 @@ function runLimited(items, limit, action) {
   });
   return Promise.all(workers);
 }
+function repositorySaveConcurrency(options) {
+  if (options.verifyMode && options.verifyMode !== "skip") {
+    return 1;
+  }
+  const configured = Number.parseInt(process.env.TREESEED_SAVE_REPOSITORY_CONCURRENCY ?? "", 10);
+  return Number.isFinite(configured) && configured > 0 ? configured : 3;
+}
 function remoteBranchExistsSafe(repoDir, branch) {
   try {
-    run("git", ["rev-parse", "--verify", `refs/remotes/origin/${branch}`], { cwd: repoDir, capture: true });
+    runGit(["rev-parse", "--verify", `refs/remotes/origin/${branch}`], { cwd: repoDir, capture: true });
     return true;
   } catch {
   }
@@ -580,8 +692,8 @@ function commitSubject(message) {
   return String(message ?? "").split(/\r?\n/u)[0]?.trim() || null;
 }
 function gitDiffSummary(repoDir) {
-  const changedFiles = run("git", ["status", "--porcelain"], { cwd: repoDir, capture: true });
-  const rawDiff = run("git", ["diff", "--cached"], { cwd: repoDir, capture: true, maxBuffer: 1024 * 1024 * 32 });
+  const changedFiles = runGit(["status", "--porcelain"], { cwd: repoDir, capture: true });
+  const rawDiff = runGit(["diff", "--cached"], { cwd: repoDir, capture: true, maxBuffer: 1024 * 1024 * 32 });
   const maxDiffChars = 12e4;
   const diff = rawDiff.length > maxDiffChars ? `${rawDiff.slice(0, maxDiffChars)}
 
@@ -591,7 +703,7 @@ function gitDiffSummary(repoDir) {
 }
 function hasStagedChanges(repoDir) {
   try {
-    return run("git", ["diff", "--cached", "--name-only"], { cwd: repoDir, capture: true }).trim().length > 0;
+    return runGit(["diff", "--cached", "--name-only"], { cwd: repoDir, capture: true }).trim().length > 0;
   } catch {
     return false;
   }
@@ -604,6 +716,54 @@ function updateDependencyReferences(node, finalizedReferences) {
   }
   return changed;
 }
+function isRootWorkspaceRepository(node, options) {
+  const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
+  return node.path === options.root && Array.isArray(packageJson?.workspaces);
+}
+function syncDirectGitDependencyLockfileEntries(node, options, references) {
+  if (references.length === 0) return false;
+  const lockfilePath = resolve(node.path, "package-lock.json");
+  if (!existsSync(lockfilePath)) return false;
+  const lockfile = readJson(lockfilePath);
+  const rootPackage = lockfile.packages && typeof lockfile.packages === "object" && !Array.isArray(lockfile.packages) ? lockfile.packages[""] : null;
+  const packageEntries = lockfile.packages && typeof lockfile.packages === "object" && !Array.isArray(lockfile.packages) ? lockfile.packages : null;
+  if (!rootPackage || !packageEntries) return false;
+  let changed = false;
+  for (const reference of references) {
+    const manifestSpec = reference.manifestSpec ?? reference.spec;
+    for (const field of dependencyFields(rootPackage)) {
+      const values = rootPackage[field];
+      if (!values || typeof values !== "object" || Array.isArray(values)) continue;
+      const dependencies = values;
+      if (reference.packageName in dependencies && dependencies[reference.packageName] !== manifestSpec) {
+        dependencies[reference.packageName] = manifestSpec;
+        changed = true;
+      }
+    }
+    const entryKey = `node_modules/${reference.packageName}`;
+    const entry = packageEntries[entryKey];
+    if (entry) {
+      const nextResolved = normalizeGitRemoteForDependency(reference.remoteUrl ?? "", "ssh");
+      const resolved = nextResolved ? `${nextResolved}#${manifestSpec.slice(manifestSpec.lastIndexOf("#") + 1)}` : manifestSpec;
+      if (entry.resolved !== resolved) {
+        entry.resolved = resolved;
+        changed = true;
+      }
+      if (typeof reference.version === "string" && reference.version && entry.version !== reference.version) {
+        entry.version = reference.version;
+        changed = true;
+      }
+      if ("integrity" in entry) {
+        delete entry.integrity;
+        changed = true;
+      }
+    }
+  }
+  if (!changed) return false;
+  writeJson(lockfilePath, lockfile);
+  emitProgress(options, node, "lockfile", "Synchronized direct internal Git dependency lockfile entries without npm git preparation.");
+  return true;
+}
 function planPackageVersion(node, options) {
   if (!node.packageJson || !node.packageJsonPath) return null;
   const current = String(node.packageJson.version ?? "0.0.0");
@@ -635,6 +795,25 @@ function syncRootWorkspaceLockfileMetadata(node, options) {
   let changed = false;
   const packageEntries = packages;
   const rootEntry = packageEntries[""] ?? {};
+  const workspacePackageList = workspacePackages(node.path);
+  const workspaceVersionByName = new Map(workspacePackageList.map((workspacePackage) => [String(workspacePackage.packageJson.name ?? ""), String(workspacePackage.packageJson.version ?? "")]).filter(([name, version]) => name.length > 0 && version.length > 0));
+  const rootDependencySpecs = /* @__PURE__ */ new Map();
+  for (const field of dependencyFields(node.packageJson)) {
+    const rootDeps = node.packageJson[field];
+    if (!rootDeps || typeof rootDeps !== "object" || Array.isArray(rootDeps)) continue;
+    for (const [dependencyName, dependencySpec] of Object.entries(rootDeps)) {
+      if (typeof dependencySpec === "string") {
+        rootDependencySpecs.set(dependencyName, dependencySpec);
+      }
+    }
+  }
+  const stableWorkspaceDependencySpec = (dependencyName) => rootDependencySpecs.get(dependencyName) ?? workspaceVersionByName.get(dependencyName) ?? null;
+  const normalizeWorkspaceDependencySpecs = (value) => Object.fromEntries(
+    Object.entries(value).map(([dependencyName, dependencySpec]) => [
+      dependencyName,
+      workspaceVersionByName.has(dependencyName) ? stableWorkspaceDependencySpec(dependencyName) : dependencySpec
+    ])
+  );
   if (JSON.stringify(rootEntry.workspaces ?? []) !== JSON.stringify(node.packageJson.workspaces)) {
     rootEntry.workspaces = node.packageJson.workspaces;
     packageEntries[""] = rootEntry;
@@ -659,7 +838,7 @@ function syncRootWorkspaceLockfileMetadata(node, options) {
       }
     }
   }
-  for (const workspacePackage of workspacePackages(node.path)) {
+  for (const workspacePackage of workspacePackageList) {
     const relativeDir = workspacePackage.relativeDir.replace(/\\/gu, "/");
     const packageJson = workspacePackage.packageJson;
     const packageName = String(packageJson.name ?? "");
@@ -676,8 +855,9 @@ function syncRootWorkspaceLockfileMetadata(node, options) {
     for (const field of dependencyFields(packageJson)) {
       const nextValue = packageJson[field];
       if (nextValue && typeof nextValue === "object" && !Array.isArray(nextValue)) {
-        if (JSON.stringify(packageEntry[field] ?? {}) !== JSON.stringify(nextValue)) {
-          packageEntry[field] = nextValue;
+        const normalizedValue = normalizeWorkspaceDependencySpecs(nextValue);
+        if (JSON.stringify(packageEntry[field] ?? {}) !== JSON.stringify(normalizedValue)) {
+          packageEntry[field] = normalizedValue;
           changed = true;
         }
       }
@@ -702,24 +882,9 @@ function syncRootWorkspaceLockfileMetadata(node, options) {
   return true;
 }
 async function runGitDependencySmoke(node, options, reference) {
-  if (reference.mode !== "dev-git-tag" || shouldSkipGitDependencySmoke(options)) return;
-  const tagName = reference.tagName ?? reference.version;
-  if (!reference.remoteUrl || !tagName) {
-    throw new RepositorySaveError(`Git dependency smoke cannot verify ${reference.packageName}; remote URL or tag is missing.`);
-  }
-  const tagRef = `refs/tags/${tagName}`;
-  emitProgress(options, node, "smoke", `Verifying ${reference.packageName} tag ${tagName} exists on ${reference.remoteUrl}.`);
-  try {
-    await runStreamingCommand(node, options, "smoke", "git", ["ls-remote", "--exit-code", "--tags", reference.remoteUrl, tagRef]);
-  } catch (error) {
-    const detail = error instanceof Error ? error.message : String(error);
-    throw new RepositorySaveError([
-      `Git dependency smoke failed for ${reference.packageName}; tag is not reachable on the remote.`,
-      `Remote: ${reference.remoteUrl}`,
-      `Tag: ${tagName}`,
-      detail
-    ].join("\n"));
-  }
+  void node;
+  void options;
+  void reference;
 }
 async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs = []) {
   if (shouldSkipNetworkInstall()) {
@@ -741,14 +906,14 @@ async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs =
     }
     if (attempt < 5) {
       emitProgress(options, node, "install", "npm install failed; retrying in 60 seconds.", "stderr");
-      spawnSync("sleep", ["60"], { stdio: "ignore" });
+      await sleepMs(6e4);
     }
   }
   throw new RepositorySaveError(`npm install failed after 5 attempts.
 ${lastError ?? ""}`);
 }
 async function runProjectVerificationInstallWithRetry(node, options) {
-  if (node.branchMode !== "project-save" || !hasNpmLockfile(node.path)) return;
+  if (!hasNpmLockfile(node.path)) return;
   if (shouldSkipNetworkInstall()) {
     emitProgress(options, node, "install", "Skipped project verification dependency install because network install mode is disabled.");
     return;
@@ -770,8 +935,8 @@ async function runProjectVerificationInstallWithRetry(node, options) {
       lastError = error instanceof Error ? error.message : String(error);
     }
     if (attempt < 5) {
-      emitProgress(options, node, "install", "npm ci for project verification failed; retrying in 60 seconds.", "stderr");
-      spawnSync("sleep", ["60"], { stdio: "ignore" });
+      emitProgress(options, node, "install", "npm ci for verification failed; retrying in 60 seconds.", "stderr");
+      await sleepMs(6e4);
     }
   }
   throw new RepositorySaveError(`Project verification dependency install failed after 5 attempts.
@@ -993,9 +1158,57 @@ function pushCurrentBranch(node, options, branch, tagName) {
     combinedBranchAndTagPush: pushedTag
   };
 }
+async function finishRepositorySavePublish(node, options, state, report, input) {
+  const reference = input.reference ?? null;
+  const tagName = input.tagName ?? reference?.tagName ?? null;
+  const shouldDeferPush = options.deferPushUntilVerified === true && node.id === ".";
+  if (shouldDeferPush) {
+    state.deferredPushes.push({
+      node,
+      report,
+      branch: input.branch,
+      tagName,
+      rebase: input.rebase,
+      reference
+    });
+    report.pushed = false;
+    report.publishWait = {
+      ...input.rebase,
+      deferredPush: true
+    };
+    return;
+  }
+  const push = pushCurrentBranch(node, options, input.branch, tagName);
+  if (reference) {
+    await runGitDependencySmoke(node, options, reference);
+    report.dependencySpec = reference.spec;
+  }
+  report.pushed = push.pushed;
+  report.publishWait = {
+    ...input.rebase,
+    ...push
+  };
+}
+async function publishDeferredRepositoryPushes(options, state) {
+  if (state.deferredPushes.length === 0) return;
+  for (const deferred of state.deferredPushes) {
+    const push = pushCurrentBranch(deferred.node, options, deferred.branch, deferred.tagName);
+    if (deferred.reference) {
+      await runGitDependencySmoke(deferred.node, options, deferred.reference);
+      deferred.report.dependencySpec = deferred.reference.spec;
+    }
+    deferred.report.pushed = push.pushed;
+    deferred.report.publishWait = {
+      ...deferred.rebase,
+      ...push,
+      deferredPush: true
+    };
+  }
+  state.deferredPushes = [];
+}
 function tagExists(repoDir, tagName) {
   try {
-    run("git", ["rev-parse", "--verify", `refs/tags/${tagName}`], { cwd: repoDir, capture: true });
+    runGit(["rev-parse", "--verify", `refs/tags/${tagName}`], { cwd: repoDir, capture: true });
     return true;
   } catch {
     return false;
@@ -1003,14 +1216,14 @@ function tagExists(repoDir, tagName) {
 }
 function localTagCommit(repoDir, tagName) {
   try {
-    return run("git", ["rev-list", "-n", "1", tagName], { cwd: repoDir, capture: true }).trim();
+    return runGit(["rev-list", "-n", "1", tagName], { cwd: repoDir, capture: true }).trim();
   } catch {
     return null;
   }
 }
 function remoteTagCommit(repoDir, tagName) {
   try {
-    const output = run("git", ["ls-remote", "--tags", "origin", `refs/tags/${tagName}*`], { cwd: repoDir, capture: true });
+    const output = runGit(["ls-remote", "--tags", "origin", `refs/tags/${tagName}*`], { cwd: repoDir, capture: true });
     const lines = output.split(/\r?\n/u).map((line) => line.trim()).filter(Boolean);
     const dereferenced = lines.find((line) => line.endsWith(`refs/tags/${tagName}^{}`));
     const exact = lines.find((line) => line.endsWith(`refs/tags/${tagName}`));
@@ -1022,7 +1235,7 @@ function remoteTagCommit(repoDir, tagName) {
 }
 function localTagMessage(repoDir, tagName) {
   try {
-    return run("git", ["tag", "-l", tagName, "--format=%(contents)"], { cwd: repoDir, capture: true }).trim();
+    return runGit(["tag", "-l", tagName, "--format=%(contents)"], { cwd: repoDir, capture: true }).trim();
   } catch {
     return null;
   }
@@ -1063,13 +1276,9 @@ function assertTagStateMatchesHead(node, tagName, state, head) {
   }
 }
 function createPackageTagMessage(node, tagName, branch, workflowRunId) {
-  return tagName.includes("-dev.") ? createDevTagMessage({
-    packageName: node.name,
-    version: tagName,
-    branch,
-    commitSha: headCommit(node.path),
-    workflowRunId
-  }) : `release: ${tagName}`;
+  void branch;
+  void workflowRunId;
+  return `release: ${tagName}`;
 }
 function ensureRemoteAccessBeforeVerification(node, options, state) {
   if (shouldSkipRemoteAccessPreflight()) return;
@@ -1099,12 +1308,6 @@ function ensureRemoteAccessBeforeVerification(node, options, state) {
 function shouldSkipRemoteAccessPreflight() {
   return process.env.TREESEED_SAVE_REMOTE_PREFLIGHT === "skip";
 }
-function localTreeseedTagWasCreatedByThisRun(node, tagName, workflowRunId) {
-  const message = localTagMessage(node.path, tagName);
-  if (!message?.includes("treeseed-dev-tag: true")) return false;
-  if (!workflowRunId) return true;
-  return message.includes(`workflowRunId: ${workflowRunId}`);
-}
 function ensurePackageTagReady(node, options, tagName, branch, workflowRunId) {
   let message = null;
   ensureWritableRemote(node, options);
@@ -1129,7 +1332,7 @@ function ensurePackageTagReady(node, options, tagName, branch, workflowRunId) {
 }
 function treeCommitForPath(repoDir, ref, path) {
   try {
-    const output = run("git", ["ls-tree", ref, "--", path], { cwd: repoDir, capture: true }).trim();
+    const output = runGit(["ls-tree", ref, "--", path], { cwd: repoDir, capture: true }).trim();
     const match = output.match(/^\d+\s+commit\s+([0-9a-f]{40})\t/u);
     return match?.[1] ?? null;
   } catch {
@@ -1143,7 +1346,7 @@ function collectSubmodulePointerChanges(node, finalizedCommits) {
     if (!childRelativePath) continue;
     const childPath = resolve(node.path, childRelativePath);
     if (!existsSync(childPath) || !isGitRepo(childPath)) continue;
-    const status = run("git", ["status", "--porcelain", "--", childRelativePath], { cwd: node.path, capture: true });
+    const status = runGit(["status", "--porcelain", "--", childRelativePath], { cwd: node.path, capture: true });
     const oldSha = treeCommitForPath(node.path, "HEAD", childRelativePath);
     const newSha = finalizedCommit || headCommit(childPath);
     if (status.trim().length > 0 || oldSha && newSha && oldSha !== newSha) {
@@ -1210,7 +1413,8 @@ function finalizePackageReference(node, version, options) {
     version,
     branchMode: node.branchMode === "package-release-main" ? "package-release-main" : "package-dev-save",
     remoteUrl: node.remoteUrl,
-    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-tag",
+    commitSha: headCommit(node.path),
+    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-commit",
     gitDependencyProtocol: options.gitDependencyProtocol ?? "preserve-origin"
   });
   node.plannedDependencySpec = reference.spec;
@@ -1222,21 +1426,25 @@ async function finalizeCleanPackageVersion(node, options, state, report, branch)
     return false;
   }
   const head = headCommit(node.path);
-  const currentTagState = tagState(node.path, version);
-  assertTagStateMatchesHead(node, version, currentTagState, head);
+  const reference = finalizePackageReference(node, version, options);
+  const currentTagState = reference.tagName ? tagState(node.path, reference.tagName) : null;
+  if (reference.tagName && currentTagState) {
+    assertTagStateMatchesHead(node, reference.tagName, currentTagState, head);
+  }
   const remoteBranchExists2 = remoteBranchExistsSafe(node.path, branch);
-  const finalizedRemotely = currentTagState.localCommit === head && currentTagState.remoteCommit === head && remoteBranchExists2;
+  const remoteBranchCommit = remoteBranchCommitSafe(node.path, branch);
+  const finalizedRemotely = remoteBranchExists2 && remoteBranchCommit === head && (!reference.tagName || currentTagState?.localCommit === head && currentTagState?.remoteCommit === head);
   report.version = version;
-  report.tagName = version;
+  report.tagName = reference.tagName;
   report.commitSha = head;
-  report.dependencySpec = finalizePackageReference(node, version, options).spec;
+  report.dependencySpec = reference.spec;
   state.finalizedVersions.set(node.name, version);
-  state.finalizedReferences.set(node.name, finalizePackageReference(node, version, options));
+  state.finalizedReferences.set(node.name, reference);
   state.finalizedCommits.set(node.relativePath, head);
   if (finalizedRemotely) {
     report.pushed = true;
     report.skippedReason = "already-finalized";
-    report.publishWait = { recoveredPartialSave: true, remoteBranchExisted: true, tagAlreadyPushed: true };
+    report.publishWait = { recoveredPartialSave: true, remoteBranchExisted: true, tagAlreadyPushed: Boolean(reference.tagName) };
     emitProgress(options, node, "finalize", `Using existing finalized package version ${version}.`);
     return true;
   }
@@ -1246,36 +1454,24 @@ async function finalizeCleanPackageVersion(node, options, state, report, branch)
     report.lockfileValidation = await validateRepositoryLockfile(node, options);
   }
   const rebase = pullRebaseFromOrigin(node, options, branch);
-  if (currentTagState.localCommit === head && localTreeseedTagWasCreatedByThisRun(node, version, options.workflowRunId)) {
-    emitProgress(options, node, "verify", `Reusing verification from interrupted tag ${version}.`);
-    report.verification = {
-      mode: options.verifyMode ?? "action-first",
-      status: "skipped",
-      primary: null,
-      fallbackUsed: false,
-      error: "verified-before-interruption"
-    };
-    report.verified = true;
-  } else {
-    ensureRemoteAccessBeforeVerification(node, options, state);
-    report.verification = await runRepoVerification(node, options, options.verifyMode ?? "action-first");
-    report.verified = report.verification.status === "passed";
-  }
-  const tagMessage = ensurePackageTagReady(node, options, version, branch, options.workflowRunId);
-  report.devTagMetadata = tagMessage?.includes("treeseed-dev-tag: true") ? tagMessage : null;
-  const reference = finalizePackageReference(node, version, options);
-  const push = pushCurrentBranch(node, options, branch, version);
-  await runGitDependencySmoke(node, options, reference);
+  ensureRemoteAccessBeforeVerification(node, options, state);
+  report.verification = await runRepoVerification(node, options, options.verifyMode ?? "action-first");
+  report.verified = report.verification.status === "passed";
+  const tagMessage = reference.tagName ? ensurePackageTagReady(node, options, reference.tagName, branch, options.workflowRunId) : null;
+  void tagMessage;
   report.dependencySpec = reference.spec;
-  report.pushed = push.pushed;
   report.skippedReason = "finalized-partial-save";
   report.commitSha = headCommit(node.path);
   state.finalizedCommits.set(node.relativePath, report.commitSha);
-  report.publishWait = {
-    ...rebase,
-    ...push,
-    recoveredPartialSave: true
-  };
+  await finishRepositorySavePublish(node, options, state, report, {
+    branch,
+    rebase: {
+      ...rebase,
+      recoveredPartialSave: true
+    },
+    reference,
+    tagName: reference.tagName
+  });
   return true;
 }
 function branchModeLabel(branchMode) {
@@ -1308,8 +1504,8 @@ function repoPlanCommands(node, options, plannedVersion, plannedDependencySpec,
   const rootWorkspaceInstall = node.path === options.root && Array.isArray(packageJson?.workspaces);
   if (node.kind === "package" && plannedVersion) {
     commands.push(`update package.json version to ${plannedVersion}`);
-    commands.push("npm install --workspaces=false # explicitly refresh changed git-tag dependencies with --force; retry up to 5 times with 60s delay");
-  } else if (node.kind === "project" && dependencyUpdates.length > 0 && hasNpmLockfile(node.path)) {
+    commands.push("npm install --workspaces=false # explicitly refresh changed git commit dependencies with --force; retry up to 5 times with 60s delay");
+  } else if (node.kind === "project" && (dependencyUpdates.length > 0 || rootWorkspaceInstall && node.submoduleDependencies.length > 0) && hasNpmLockfile(node.path)) {
     commands.push(rootWorkspaceInstall ? "npm install --package-lock-only --ignore-scripts # refresh root workspace lockfile without installing git dependencies" : "npm install --workspaces=false # refresh project lockfile after internal dependency updates");
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || plannedVersion || dependencyUpdates.length > 0 || node.submoduleDependencies.length > 0)) {
@@ -1341,11 +1537,14 @@ function repoPlanCommands(node, options, plannedVersion, plannedDependencySpec,
     commands.push("skip verification # project repository has no Treeseed verify script");
   }
   if (node.kind === "package") {
-    if (plannedVersion) {
-      commands.push(`git tag -a ${plannedVersion} -m <${plannedVersion.includes("-dev.") ? "dev metadata" : "release"}>`);
+    const plansTag = plannedVersion && node.branchMode === "package-release-main";
+    if (plannedVersion && plansTag) {
+      commands.push(`git tag -a ${plannedVersion} -m <release>`);
       commands.push(remoteExists ? `git push origin ${branch} ${plannedVersion}` : `git push -u origin ${branch} ${plannedVersion}`);
+    } else if (plannedVersion) {
+      commands.push(remoteExists ? `git push origin ${branch}` : `git push -u origin ${branch}`);
       if (plannedDependencySpec && node.branchMode === "package-dev-save") {
-        commands.push(`git ls-remote --exit-code --tags origin refs/tags/${plannedVersion} # validate dependency tag reachability`);
+        commands.push(`npm install ${node.name}@${plannedDependencySpec} --package-lock-only --ignore-scripts --force # validate dependency commit reachability`);
       }
     } else {
       commands.push(remoteExists ? `git push origin ${branch}` : `git push -u origin ${branch}`);
@@ -1388,7 +1587,8 @@ function planRepositorySave(options) {
           version: plannedVersion,
           branchMode: node.branchMode === "package-release-main" ? "package-release-main" : "package-dev-save",
           remoteUrl: node.remoteUrl,
-          devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-tag",
+          commitSha: headCommitOrPlanPlaceholder(node.path),
+          devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-commit",
           gitDependencyProtocol: options.gitDependencyProtocol ?? "preserve-origin"
         });
         plannedDependencySpec = reference.spec;
@@ -1400,7 +1600,7 @@ function planRepositorySave(options) {
       const notes = [
         `${branchModeLabel(node.branchMode)} on top-level ${options.branch}`,
         ...current && current !== branch ? [`current branch ${current} will be switched to ${branch}`] : [],
-        ...node.kind === "package" && plannedVersion?.includes("-dev.") ? ["dev Git tag only; publish workflows reject prerelease/dev tags"] : []
+        ...node.kind === "package" && plannedVersion?.includes("-dev.") ? ["development and staging dependency refs use the package commit SHA; no Git tag is created"] : []
       ];
       const repoPlan = {
         id: node.id,
@@ -1417,7 +1617,7 @@ function planRepositorySave(options) {
         submoduleDependencies: node.submoduleDependencies,
         currentVersion,
         plannedVersion,
-        plannedTag: plannedVersion,
+        plannedTag: plannedReferences.get(node.name)?.tagName ?? null,
         plannedDependencySpec,
         remoteUrl: node.remoteUrl,
         commands: repoPlanCommands(node, options, plannedVersion, plannedDependencySpec, dependencyUpdates),
@@ -1445,7 +1645,7 @@ function planRepositorySave(options) {
     mode,
     branch: options.branch,
     scope,
-    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-tag",
+    devDependencyReferenceMode: options.devDependencyReferenceMode ?? "git-commit",
     gitDependencyProtocol: options.gitDependencyProtocol ?? "preserve-origin",
     verifyMode: options.verifyMode ?? "action-first",
     commitMessageMode: options.commitMessageMode ?? "auto",
@@ -1503,9 +1703,11 @@ async function saveOneRepository(node, options, state) {
   report.branch = node.branch;
   refreshRepositoryNodePackageMetadata(node);
   ensureWritableRemote(node, options);
-  const dependencyUpdates = updateDependencyReferences(node, state.finalizedReferences);
+  const dependencyUpdates = isRootWorkspaceRepository(node, options) ? [] : updateDependencyReferences(node, state.finalizedReferences);
   const dependencyChanged = dependencyUpdates.length > 0;
-  const gitDependencyRefreshSpecs = dependencyUpdates.map((update) => state.finalizedReferences.get(update.packageName)).filter((reference) => Boolean(reference) && reference.mode === "dev-git-tag").map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
+  const gitDependencyRefreshReferences = dependencyUpdates.map((update) => state.finalizedReferences.get(update.packageName)).filter((reference) => Boolean(reference) && reference.mode === "dev-git-commit");
+  const lockfileGitDependenciesSynced = syncDirectGitDependencyLockfileEntries(node, options, gitDependencyRefreshReferences);
+  const gitDependencyRefreshSpecs = lockfileGitDependenciesSynced ? [] : gitDependencyRefreshReferences.map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
   const submodulePointers = collectSubmodulePointerChanges(node, state.finalizedCommits);
   const submodulesChanged = submodulePointers.length > 0;
   const packageHasMeaningfulChanges = hasMeaningfulChanges(node.path);
@@ -1523,18 +1725,18 @@ async function saveOneRepository(node, options, state) {
       applyPackageVersion(node, plannedVersion);
     }
     node.plannedVersion = plannedVersion;
-    node.plannedTag = plannedVersion;
     report.version = plannedVersion;
-    report.tagName = plannedVersion;
     if (!selection.reused) {
       emitProgress(options, node, "version", `Planned ${plannedVersion}.`);
     }
     const reference = finalizePackageReference(node, plannedVersion, options);
+    node.plannedTag = reference.tagName;
+    report.tagName = reference.tagName;
     report.dependencySpec = reference.spec;
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   } else if (node.kind === "package") {
     report.version = String(node.packageJson?.version ?? report.version ?? "");
-  } else if (node.kind === "project" && dependencyChanged && hasNpmLockfile(node.path)) {
+  } else if (node.kind === "project" && (dependencyChanged || node.path === options.root && submodulesChanged) && hasNpmLockfile(node.path)) {
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || packageNeedsVersion || dependencyChanged || submodulesChanged)) {
@@ -1559,12 +1761,7 @@ async function saveOneRepository(node, options, state) {
     }
     if (node.kind === "project" || node.kind === "package" && !canManagePackageJsonVersion(node)) {
       const rebase2 = pullRebaseFromOrigin(node, options, branch);
-      const push = pushCurrentBranch(node, options, branch);
-      report.pushed = push.pushed;
-      report.publishWait = {
-        ...rebase2,
-        ...push
-      };
+      await finishRepositorySavePublish(node, options, state, report, { branch, rebase: rebase2 });
       report.commitSha = headCommit(node.path);
     }
     state.finalizedCommits.set(node.relativePath, report.commitSha);
@@ -1584,12 +1781,7 @@ async function saveOneRepository(node, options, state) {
     }
     if (node.kind === "project" || node.kind === "package" && !canManagePackageJsonVersion(node)) {
       const rebase2 = pullRebaseFromOrigin(node, options, branch);
-      const push = pushCurrentBranch(node, options, branch);
-      report.pushed = push.pushed;
-      report.publishWait = {
-        ...rebase2,
-        ...push
-      };
+      await finishRepositorySavePublish(node, options, state, report, { branch, rebase: rebase2 });
       report.commitSha = headCommit(node.path);
     }
     state.finalizedCommits.set(node.relativePath, report.commitSha);
@@ -1629,12 +1821,7 @@ async function saveOneRepository(node, options, state) {
     }
     if (node.kind === "project" || node.kind === "package" && !canManagePackageJsonVersion(node)) {
       const rebase2 = pullRebaseFromOrigin(node, options, branch);
-      const push = pushCurrentBranch(node, options, branch);
-      report.pushed = push.pushed;
-      report.publishWait = {
-        ...rebase2,
-        ...push
-      };
+      await finishRepositorySavePublish(node, options, state, report, { branch, rebase: rebase2 });
       report.commitSha = headCommit(node.path);
     }
     state.finalizedCommits.set(node.relativePath, report.commitSha);
@@ -1657,28 +1844,17 @@ async function saveOneRepository(node, options, state) {
   report.verified = report.verification.status === "passed";
   if (canManagePackageJsonVersion(node)) {
     const version = plannedVersion ?? String(readJson(resolve(node.path, "package.json")).version ?? report.version ?? "");
-    const tagMessage = ensurePackageTagReady(node, options, version, branch, options.workflowRunId);
-    report.tagName = version;
-    report.version = version;
-    report.devTagMetadata = tagMessage?.includes("treeseed-dev-tag: true") ? tagMessage : null;
     const reference = finalizePackageReference(node, version, options);
-    const push = pushCurrentBranch(node, options, branch, version);
-    await runGitDependencySmoke(node, options, reference);
+    const tagMessage = reference.tagName ? ensurePackageTagReady(node, options, reference.tagName, branch, options.workflowRunId) : null;
+    void tagMessage;
+    report.tagName = reference.tagName;
+    report.version = version;
     report.dependencySpec = reference.spec;
     state.finalizedVersions.set(node.name, version);
     state.finalizedReferences.set(node.name, reference);
-    report.pushed = push.pushed;
-    report.publishWait = {
-      ...rebase,
-      ...push
-    };
+    await finishRepositorySavePublish(node, options, state, report, { branch, rebase, reference, tagName: reference.tagName });
   } else {
-    const push = pushCurrentBranch(node, options, branch);
-    report.pushed = push.pushed;
-    report.publishWait = {
-      ...rebase,
-      ...push
-    };
+    await finishRepositorySavePublish(node, options, state, report, { branch, rebase });
   }
   report.commitSha = headCommit(node.path);
   report.skippedReason = null;
@@ -1703,10 +1879,12 @@ async function runRepositorySaveOrchestrator(options) {
     finalizedCommits: /* @__PURE__ */ new Map(),
     reports: new Map(nodes.map((node) => [node.id, createReport(node)])),
     remoteAccessChecked: /* @__PURE__ */ new Set(),
-    workflowGates: []
+    workflowGates: [],
+    deferredPushes: []
   };
+  const concurrency = repositorySaveConcurrency(options);
   for (const [index, wave] of waves.entries()) {
-    await runLimited(wave, 3, async (node) => {
+    await runLimited(wave, concurrency, async (node) => {
       try {
         await saveOneRepository(node, options, state);
       } catch (error) {
@@ -1767,6 +1945,7 @@ async function runRepositorySaveOrchestrator(options) {
       state.workflowGates.push(...waveGates);
     }
   }
+  await publishDeferredRepositoryPushes(options, state);
   const rootNode = nodes.find((node) => node.id === ".") ?? allNodes.find((node) => node.id === ".");
   const rootReport = rootNode ? state.reports.get(rootNode.id) ?? createReport(rootNode) : createReport({
     id: ".",