@treeseed/sdk 0.12.44 → 0.12.46

package/dist/hosting/graph.js

@@ -6,6 +6,7 @@ import { parse as parseYaml } from "yaml";
 import { createPersistentDeployTarget } from "../operations/services/deploy.js";
 import { collectTreeseedConfigSeedValues, resolveTreeseedMachineEnvironmentValues } from "../operations/services/config-runtime.js";
 import { classifyTreeseedGitMode, runTreeseedGitText } from "../operations/services/git-runner.js";
+import { apiRailwayDefaultDockerfilePath, apiRailwayDefaultSourceRepo, assertApiRailwaySourcePolicy, isApiRailwaySourcePolicyService } from "../operations/services/railway-source-policy.js";
 import { createTreeseedCanonicalReconcileReport } from "../reconcile/index.js";
 import { reconcileTreeseedTarget } from "../reconcile/index.js";
 import { discoverTreeseedApplications, findTreeseedApplication } from "./apps.js";
@@ -64,12 +65,15 @@ function publicTreeDxSourcePolicy(input, config, launchEnv) {
   const railway = config.publicTreeDxFederation?.railway ?? {};
   const configuredSource = railway.source && typeof railway.source === "object" && !Array.isArray(railway.source) ? railway.source : {};
   const configuredMode = typeof railway.sourceMode === "string" ? railway.sourceMode : null;
+  if (input.environment === "staging" && configuredMode === "image") {
+    throw new Error("public-treedx-node-01: API Railway staging services must use GitHub Dockerfile source builds (configured sourceMode image is not allowed).");
+  }
   const treeDxRoot = resolvePublicTreeDxRoot(input);
   const repository = typeof railway.sourceRepo === "string" ? railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readPackageRepository(treeDxRoot) ?? "treeseed-ai/treedx";
   const sourceMode = configuredMode === "git" || configuredMode === "image" ? configuredMode : input.environment === "staging" ? "git" : "image";
   if (sourceMode !== "git") {
     const imageRef = typeof launchEnv.TREESEED_PUBLIC_TREEDX_IMAGE_REF === "string" && launchEnv.TREESEED_PUBLIC_TREEDX_IMAGE_REF.trim() ? launchEnv.TREESEED_PUBLIC_TREEDX_IMAGE_REF.trim() : null;
-    return {
+    const policy2 = {
       sourceMode: "image",
       sourceRepo: null,
       sourceBranch: null,
@@ -79,8 +83,10 @@ function publicTreeDxSourcePolicy(input, config, launchEnv) {
       imageRef,
       imageTagRef: "TREESEED_PUBLIC_TREEDX_IMAGE_REF"
     };
+    assertApiRailwaySourcePolicy(input.environment, { key: "public-treedx-node-01", serviceName: "public-treedx-node-01", ...policy2 });
+    return policy2;
   }
-  return {
+  const policy = {
     sourceMode: "git",
     sourceRepo: repository,
     sourceBranch: typeof railway.sourceBranch === "string" ? railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : "staging",
@@ -89,6 +95,13 @@ function publicTreeDxSourcePolicy(input, config, launchEnv) {
     image: null,
     imageTagRef: null
   };
+  assertApiRailwaySourcePolicy(input.environment, {
+    key: "public-treedx-node-01",
+    serviceName: "public-treedx-node-01",
+    dockerfilePath: railway.dockerfilePath ?? "/Dockerfile",
+    ...policy
+  });
+  return policy;
 }
 function serviceKeyPlacement(serviceKey) {
   if (serviceKey === "api") return "api";
@@ -161,11 +174,16 @@ function resolveRailwayServiceSourceRoot(input, serviceKey, service) {
 function railwaySourcePolicy(input, serviceKey, service, imageRef) {
   const configuredSource = service.railway?.source && typeof service.railway.source === "object" && !Array.isArray(service.railway.source) ? service.railway.source : {};
   const configuredMode = typeof service.railway?.sourceMode === "string" ? service.railway.sourceMode : null;
-  const repository = typeof service.railway?.sourceRepo === "string" ? service.railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readPackageRepository(resolveRailwayServiceSourceRoot(input, serviceKey, service)) ?? readPackageRepository(input.tenantRoot);
+  const serviceName = service.railway?.serviceName ?? null;
+  const repository = typeof service.railway?.sourceRepo === "string" ? service.railway.sourceRepo : typeof configuredSource.repository === "string" ? configuredSource.repository : typeof configuredSource.repo === "string" ? configuredSource.repo : readPackageRepository(resolveRailwayServiceSourceRoot(input, serviceKey, service)) ?? readPackageRepository(input.tenantRoot) ?? apiRailwayDefaultSourceRepo({ key: serviceKey, serviceName });
+  const dockerfilePath = service.railway?.dockerfilePath ?? apiRailwayDefaultDockerfilePath({ key: serviceKey, serviceName });
   const apiPackageSourceEligible = ["api", "operationsRunner"].includes(serviceKey);
+  if (input.environment === "staging" && isApiRailwaySourcePolicyService({ key: serviceKey, serviceName }) && (configuredMode === "image" || service.railway?.imageRef)) {
+    throw new Error(`${serviceName ?? serviceKey}: API Railway staging services must use GitHub Dockerfile source builds (configured image source is not allowed).`);
+  }
   const mode = input.environment === "prod" ? "image" : input.environment === "staging" && apiPackageSourceEligible ? "git" : configuredMode === "git" || configuredMode === "image" ? configuredMode : imageRef ? "image" : "git";
   if (mode !== "git") {
-    return {
+    const policy2 = {
       sourceMode: "image",
       sourceRepo: null,
       sourceBranch: null,
@@ -173,8 +191,17 @@ function railwaySourcePolicy(input, serviceKey, service, imageRef) {
       sourceRootDirectory: null,
       imageRef
     };
+    assertApiRailwaySourcePolicy(input.environment, {
+      key: serviceKey,
+      serviceName,
+      dockerfilePath: null,
+      buildCommand: null,
+      startCommand: null,
+      ...policy2
+    });
+    return policy2;
   }
-  return {
+  const policy = {
     sourceMode: "git",
     sourceRepo: repository,
     sourceBranch: typeof service.railway?.sourceBranch === "string" ? service.railway.sourceBranch : typeof configuredSource.branch === "string" ? configuredSource.branch : input.environment === "staging" ? "staging" : null,
@@ -182,6 +209,13 @@ function railwaySourcePolicy(input, serviceKey, service, imageRef) {
     sourceRootDirectory: typeof service.railway?.sourceRootDirectory === "string" ? service.railway.sourceRootDirectory : typeof configuredSource.rootDirectory === "string" ? configuredSource.rootDirectory : ".",
     imageRef: null
   };
+  assertApiRailwaySourcePolicy(input.environment, {
+    key: serviceKey,
+    serviceName,
+    dockerfilePath,
+    ...policy
+  });
+  return policy;
 }
 function collectPluginHostingContributions(input) {
   const plugins = loadTreeseedPlugins(input.deployConfig);
@@ -358,7 +392,7 @@ function buildProfileFromDeployConfig(input) {
         sourceBranch: sourcePolicy.sourceBranch,
         sourceCommit: sourcePolicy.sourceCommit,
         sourceRootDirectory: sourcePolicy.sourceRootDirectory,
-        dockerfilePath: sourcePolicy.sourceMode === "git" ? service.railway?.dockerfilePath ?? null : null,
+        dockerfilePath: sourcePolicy.sourceMode === "git" ? service.railway?.dockerfilePath ?? apiRailwayDefaultDockerfilePath({ key: serviceKey, serviceName: service.railway?.serviceName ?? null }) : null,
         buildCommand: sourcePolicy.imageRef || sourcePolicy.sourceMode === "git" && service.railway?.dockerfilePath ? null : service.railway?.buildCommand ?? null,
         startCommand: sourcePolicy.imageRef ? null : service.railway?.startCommand ?? null,
         healthcheckPath: service.railway?.healthcheckPath ?? null,

package/dist/operations/services/git-workflow.d.ts

@@ -123,6 +123,16 @@ export declare function checkoutTaskBranchFromStaging(cwd: any, branchName: any,
     resumed: boolean;
     remoteBranch: boolean;
 };
+export declare function checkoutNewTaskBranchWithChanges(cwd: string, branchName: string, { pushIfCreated }?: {
+    pushIfCreated?: boolean | undefined;
+}): {
+    repoDir: string;
+    branchName: string;
+    baseBranch: string;
+    created: boolean;
+    resumed: boolean;
+    remoteBranch: boolean;
+};
 export declare function syncBranchWithOrigin(repoDir: any, branchName: any): void;
 export declare function checkoutDetachedOriginBranch(repoDir: any, branchName: any): void;
 export declare function pushHeadToBranch(repoDir: any, branchName: any): void;
@@ -201,13 +211,18 @@ export declare function listTaskBranches(repoDir: any): {
     remote: boolean;
     current: boolean;
 }[];
-export declare function waitForStagingAutomation(repoDir: any): {
+export declare function shouldRetryFailedStagingAutomation(status: string | null, conclusion: string | null): boolean;
+export declare function waitForStagingAutomation(repoDir: any, env?: NodeJS.ProcessEnv): {
     status: string;
     reason: string;
     branch?: undefined;
+    headSha?: undefined;
+    runId?: undefined;
 } | {
     status: string;
     branch: string;
+    headSha: string;
+    runId: number;
     reason?: undefined;
 };
 export declare function prepareReleaseBranches(cwd?: any): string;

package/dist/operations/services/git-workflow.js

@@ -437,6 +437,25 @@ function checkoutTaskBranchFromStaging(cwd, branchName, { createIfMissing = true
     remoteBranch: pushIfCreated
   };
 }
+function checkoutNewTaskBranchWithChanges(cwd, branchName, { pushIfCreated = false } = {}) {
+  const repoDir = repoRoot(cwd);
+  if (currentBranch(repoDir) !== STAGING_BRANCH) {
+    throw new Error(`Dirty change adoption requires ${repoDir} to be on ${STAGING_BRANCH}.`);
+  }
+  if (branchExists(repoDir, branchName) || remoteBranchExists(repoDir, branchName)) {
+    throw new Error(`Dirty change adoption requires a new branch; ${branchName} already exists.`);
+  }
+  runGit(["checkout", "-b", branchName], { cwd: repoDir });
+  if (pushIfCreated) pushBranch(repoDir, branchName, { setUpstream: true });
+  return {
+    repoDir,
+    branchName,
+    baseBranch: STAGING_BRANCH,
+    created: true,
+    resumed: false,
+    remoteBranch: pushIfCreated
+  };
+}
 function syncBranchWithOrigin(repoDir, branchName) {
   fetchOrigin(repoDir);
   if (!branchExists(repoDir, branchName) && remoteBranchExists(repoDir, branchName)) {
@@ -637,20 +656,59 @@ function listTaskBranches(repoDir) {
     };
   });
 }
-function waitForStagingAutomation(repoDir) {
+function shouldRetryFailedStagingAutomation(status, conclusion) {
+  return status === "completed" && Boolean(conclusion) && conclusion !== "success";
+}
+function waitForStagingAutomation(repoDir, env = process.env) {
   if (process.env.TREESEED_STAGE_WAIT_MODE === "skip") {
     return { status: "skipped", reason: "disabled" };
   }
   try {
-    const gh = resolveTreeseedToolBinary("gh");
+    const gh = resolveTreeseedToolBinary("gh", { env });
     if (!gh) {
       throw new Error("GitHub CLI `gh` is unavailable.");
     }
-    run(gh, ["run", "watch", "--branch", STAGING_BRANCH, "--exit-status"], {
+    const headSha = remoteHeadCommit(repoDir, STAGING_BRANCH);
+    let runId = null;
+    let runStatus = null;
+    let runConclusion = null;
+    for (let attempt = 0; attempt < 120 && runId == null; attempt += 1) {
+      const output = run(gh, [
+        "run",
+        "list",
+        "--workflow",
+        "deploy.yml",
+        "--branch",
+        STAGING_BRANCH,
+        "--commit",
+        headSha,
+        "--limit",
+        "1",
+        "--json",
+        "databaseId,status,conclusion"
+      ], {
+        cwd: repoDir,
+        env: createTreeseedManagedToolEnv(env),
+        capture: true
+      });
+      const rows = JSON.parse(output || "[]");
+      runId = typeof rows[0]?.databaseId === "number" ? rows[0].databaseId : null;
+      runStatus = typeof rows[0]?.status === "string" ? rows[0].status : null;
+      runConclusion = typeof rows[0]?.conclusion === "string" ? rows[0].conclusion : null;
+      if (runId == null) Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 5e3);
+    }
+    if (runId == null) throw new Error(`No deploy.yml run appeared for ${headSha}.`);
+    if (shouldRetryFailedStagingAutomation(runStatus, runConclusion)) {
+      run(gh, ["run", "rerun", String(runId), "--failed"], {
+        cwd: repoDir,
+        env: createTreeseedManagedToolEnv(env)
+      });
+    }
+    run(gh, ["run", "watch", String(runId), "--exit-status"], {
       cwd: repoDir,
-      env: createTreeseedManagedToolEnv(process.env)
+      env: createTreeseedManagedToolEnv(env)
     });
-    return { status: "completed", branch: STAGING_BRANCH };
+    return { status: "completed", branch: STAGING_BRANCH, headSha, runId };
   } catch (error) {
     throw new Error([
       "Treeseed stage could not confirm the staging deploy/checks completed.",
@@ -710,6 +768,7 @@ export {
   branchExists,
   checkoutBranch,
   checkoutDetachedOriginBranch,
+  checkoutNewTaskBranchWithChanges,
   checkoutTaskBranchFromStaging,
   createDeprecatedTaskTag,
   createFeatureBranchFromStaging,
@@ -736,6 +795,7 @@ export {
   reattachDetachedHeadIfSafe,
   remoteBranchExists,
   remoteHeadCommit,
+  shouldRetryFailedStagingAutomation,
   squashMergeBranchIntoStaging,
   syncBranchWithOrigin,
   taskTagSlug,

package/dist/operations/services/github-api.js

@@ -792,25 +792,6 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
       monitorErrorStartedAt = null;
       lastMonitorError = null;
       const matchingRuns = listed.data.workflow_runs.map((run) => normalizeWorkflowRun(run)).filter((run) => (!headSha || run.headSha === headSha) && (!branch || run.headBranch === branch));
-      const failedMatch = matchingRuns.find((run) => run.status === "completed" && run.conclusion !== "success");
-      if (failedMatch?.id) {
-        const failedJobs = await listWorkflowJobsForProgress(client, owner, name, failedMatch.id);
-        emitProgress("completed", failedMatch, failedJobs);
-        return {
-          status: "completed",
-          repository: `${owner}/${name}`,
-          workflow,
-          runId: failedMatch.id,
-          headSha: failedMatch.headSha,
-          branch: failedMatch.headBranch,
-          createdAt: failedMatch.createdAt,
-          updatedAt: failedMatch.updatedAt,
-          conclusion: failedMatch.conclusion,
-          url: failedMatch.url,
-          jobs: failedJobs,
-          failedJobs: failedJobs.filter((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped")
-        };
-      }
       const match = matchingRuns[0];
       if (!match?.id) {
         emitProgress("waiting");

package/dist/operations/services/hosted-service-checks.js

@@ -1,6 +1,7 @@
 import { relative, resolve } from "node:path";
 import { collectTreeseedEnvironmentContext, resolveTreeseedMachineEnvironmentValues } from "./config-runtime.js";
 import { configuredRailwayServices } from "./railway-deploy.js";
+import { isApiRailwaySourcePolicyService, isImmutableRailwayImageRef } from "./railway-source-policy.js";
 import { loadTreeseedPlatformConfig } from "../../platform/config.js";
 import { discoverTreeseedApplications } from "../../hosting/apps.js";
 const RAILWAY_SECRET_KEYS_BY_SERVICE = {
@@ -221,6 +222,21 @@ function collectTreeseedHostedServiceChecks(options) {
     const serviceType = serviceTypeFor(service.key);
     const observed = observedFor(options, service.serviceName);
     const expectedRootDirectory = railwayServiceRootDirectory(tenantRoot, service);
+    const apiSourcePolicyService = isApiRailwaySourcePolicyService(service);
+    if (target === "prod" && apiSourcePolicyService && railwayServiceUsesImageSource(service)) {
+      checks.push(check({
+        id: `railway:${service.instanceKey}:image-ref-policy`,
+        provider: "railway",
+        serviceKey: service.key,
+        serviceType,
+        target,
+        description: `Railway ${service.serviceName} uses an immutable production image reference.`,
+        expected: { imageRef: "<released-image>:<immutable-tag>" },
+        observed: { imageRef: service.imageRef ?? null },
+        status: isImmutableRailwayImageRef(service.imageRef) ? "passed" : "failed",
+        issues: isImmutableRailwayImageRef(service.imageRef) ? [] : [`Production API Railway service ${service.serviceName} is missing an immutable image ref.`]
+      }));
+    }
     checks.push(check({
       id: `railway:${service.instanceKey}:service`,
       provider: "railway",
@@ -261,7 +277,7 @@ function collectTreeseedHostedServiceChecks(options) {
       const actualRepo = observed?.deploymentRepo ?? null;
       const actualBranch = observed?.deploymentBranch ?? null;
       const actualRootDirectory = observed?.deploymentRootDirectory ?? null;
-      const sourceUploadDeployment = target === "staging" && actualRepo === null && actualBranch === null && observed?.deploymentHealthy === true;
+      const sourceUploadDeployment = target === "staging" && !apiSourcePolicyService && actualRepo === null && actualBranch === null && observed?.deploymentHealthy === true;
       checks.push(check({
         id: `railway:${service.instanceKey}:deployment-repo`,
         provider: "railway",

package/dist/operations/services/live-hosted-service-checks.d.ts

@@ -12,6 +12,10 @@ export interface TreeseedLiveHostedServiceCheckOptions {
         attempts: number;
         intervalMs: number;
     };
+    httpRetry?: {
+        attempts: number;
+        intervalMs: number;
+    };
     env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
     fetchImpl?: typeof fetch;
 }

package/dist/operations/services/live-hosted-service-checks.js

@@ -19,7 +19,7 @@ import {
 } from "./hosted-service-checks.js";
 const DEFAULT_RETRY_ATTEMPTS = 3;
 const DEFAULT_RETRY_INTERVAL_MS = 1500;
-const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_ATTEMPTS = 60;
+const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_ATTEMPTS = 120;
 const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_INTERVAL_MS = 5e3;
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
@@ -46,10 +46,11 @@ function pagesBranchName(config, target) {
   return typeof pages[key] === "string" && pages[key].trim() ? pages[key].trim() : fallback;
 }
 async function observeHttp(url, options) {
-  const attempts = Math.max(1, Math.floor(options.retry?.attempts ?? DEFAULT_RETRY_ATTEMPTS));
-  const intervalMs = Math.max(0, Math.floor(options.retry?.intervalMs ?? DEFAULT_RETRY_INTERVAL_MS));
+  const attempts = Math.max(1, Math.floor(options.httpRetry?.attempts ?? options.retry?.attempts ?? DEFAULT_RETRY_ATTEMPTS));
+  const intervalMs = Math.max(0, Math.floor(options.httpRetry?.intervalMs ?? options.retry?.intervalMs ?? DEFAULT_RETRY_INTERVAL_MS));
   const timeoutMs = Math.max(1e3, Math.floor(options.timeoutMs ?? 1e4));
   let lastError = "";
+  let lastResponse = null;
   for (let attempt = 0; attempt < attempts; attempt += 1) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
@@ -60,14 +61,16 @@ async function observeHttp(url, options) {
         signal: controller.signal
       });
       clearTimeout(timeout);
-      return { status: response.status, ok: response.ok };
+      lastResponse = { status: response.status, ok: response.ok };
+      if (response.ok) return lastResponse;
     } catch (error) {
       clearTimeout(timeout);
       lastError = error instanceof Error ? error.message : String(error);
       if (attempt + 1 < attempts) await sleep(intervalMs);
     }
+    if (attempt + 1 < attempts) await sleep(intervalMs);
   }
-  return { ok: false, error: lastError || "HTTP request failed." };
+  return lastResponse ?? { ok: false, error: lastError || "HTTP request failed." };
 }
 async function inspectRailwayServiceDeploymentHealthWithRetry(input) {
   const attempts = Math.max(1, Math.floor(input.options.retry?.attempts ?? DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_ATTEMPTS));

package/dist/operations/services/local-cleanup.js

@@ -44,15 +44,11 @@ function runTreeseedLocalCleanup(input) {
     ".treeseed/cache",
     ".treeseed/scenes/runs",
     ".treeseed/scenes/matrix",
-    ".treeseed/scenes/render",
-    ".treeseed/guarantees/runs",
-    ".treeseed/guarantees/release",
-    ".treeseed/generated/release-evidence",
-    ".treeseed/release/evidence"
+    ".treeseed/scenes/render"
   ] : [".treeseed/tmp", ".treeseed/cache", ".treeseed/scenes/render"];
   for (const target of directoryTargets) actions.push(removeDirectory(root, target));
-  if (input.docker !== false && mode === "aggressive") actions.push(runCleanupCommand("docker-system-prune", "docker", ["docker", "system", "prune", "--all", "--volumes", "--force"], root));
-  if (input.npmCache !== false) actions.push(runCleanupCommand("npm-cache-clean", "npm-cache", ["npm", "cache", "clean", "--force"], root));
+  if (input.docker === true && mode === "aggressive") actions.push(runCleanupCommand("docker-system-prune", "docker", ["docker", "system", "prune", "--all", "--volumes", "--force"], root));
+  if (input.npmCache === true) actions.push(runCleanupCommand("npm-cache-clean", "npm-cache", ["npm", "cache", "clean", "--force"], root));
   const afterBytes = directoryBytes(join(root, ".treeseed"));
   const completedAt = (/* @__PURE__ */ new Date()).toISOString();
   return { ok: actions.every((entry) => entry.status !== "failed"), mode, root, startedAt, completedAt, beforeBytes, afterBytes, reclaimedBytes: Math.max(0, beforeBytes - afterBytes), actions };

package/dist/operations/services/package-adapters.d.ts

@@ -31,6 +31,13 @@ export type TreeseedPackageAdapter = {
         role?: string | null;
         architectures?: string[];
     }>;
+    capabilities: {
+        save: boolean;
+        verify: boolean;
+        publish: boolean;
+        deploy: boolean;
+        localOnly: boolean;
+    };
     releaseChecks: Array<{
         kind: 'npm-pack-plan' | 'github-workflow' | 'docker-manifest';
         name: string;
@@ -139,6 +146,13 @@ export declare function packageAdapterPlanSummary(root?: any): {
         role?: string | null;
         architectures?: string[];
     }[];
+    capabilities: {
+        save: boolean;
+        verify: boolean;
+        publish: boolean;
+        deploy: boolean;
+        localOnly: boolean;
+    };
     releaseChecks: {
         kind: "npm-pack-plan" | "github-workflow" | "docker-manifest";
         name: string;

package/dist/operations/services/package-adapters.js

@@ -110,12 +110,17 @@ function nodeTypeScriptAdapter(pkg) {
   const dockerImages = stringRecord(manifest?.dockerImages);
   const dockerImageReleaseWorkflow = stringValue(dockerImages.releaseWorkflow);
   const dockerImageArchitectures = stringArray(dockerImages.architectures);
+  const releaseGateRecord = stringRecord(manifest?.releaseGate);
+  const hostedVerifyTimeoutSeconds = positiveIntegerValue(releaseGateRecord.timeoutSeconds) ?? positiveIntegerValue(manifest?.hostedVerifyTimeoutSeconds);
   const publishTargetRaw = stringValue(manifest?.publishTarget);
   const publishTarget = dockerArtifacts.length > 0 && publishTargetRaw === "docker" ? dockerArtifacts[0].name : publishTargetRaw ?? "npm";
-  const hostedVerifyWorkflow = stringValue(manifest?.hostedVerifyWorkflow) ?? stringValue(stringRecord(manifest?.releaseGate).workflow) ?? (existsSync(resolve(pkg.dir, ".github/workflows/deploy.yml")) ? "deploy.yml" : null);
+  const hostedVerifyWorkflow = stringValue(manifest?.hostedVerifyWorkflow) ?? stringValue(releaseGateRecord.workflow) ?? (existsSync(resolve(pkg.dir, ".github/workflows/deploy.yml")) ? "deploy.yml" : null);
   const projectArchitecture = normalizeTreeseedPackageProjectArchitecture(manifest?.projectArchitecture, id);
   const docsReadiness = docsSiteReadiness(pkg.dir, projectArchitecture);
   const verifyLocal = typeof scripts["verify:local"] === "string" ? "verify:local" : typeof scripts.verify === "string" ? "verify" : typeof scripts["verify:action"] === "string" ? "verify:action" : null;
+  const capabilityRecord = stringRecord(manifest?.capabilities);
+  const localOnly = capabilityRecord.localOnly === true;
+  const packageType = stringValue(manifest?.type);
   return {
     id,
     name,
@@ -140,6 +145,13 @@ function nodeTypeScriptAdapter(pkg) {
       role: artifact.role,
       architectures: artifact.architectures
     })) : [{ provider: "npm", name: String(pkg.name) }],
+    capabilities: {
+      save: capabilityRecord.save !== false,
+      verify: capabilityRecord.verify !== false,
+      publish: capabilityRecord.publish !== false,
+      deploy: !localOnly && (capabilityRecord.deploy === true || packageType === "hosted-service" || packageType === "hosted-app"),
+      localOnly
+    },
     releaseChecks: [
       { kind: "github-workflow", name: "publish workflow", detail: dockerImageReleaseWorkflow ? `.github/workflows/${dockerImageReleaseWorkflow}` : ".github/workflows/publish.yml" },
       ...dockerArtifacts.length > 0 ? dockerArtifacts.map((artifact) => ({ kind: "docker-manifest", name: `${artifact.name} Docker image manifest`, detail: `${artifact.name}:<version>` })) : [{ kind: "npm-pack-plan", name: "npm pack", detail: "npm pack --plan" }]
@@ -153,7 +165,7 @@ function nodeTypeScriptAdapter(pkg) {
         dockerImageArchitectures,
         imageHosting: stringRecord(dockerImages.hosting)
       } : {},
-      type: stringValue(manifest?.type) ?? null,
+      type: packageType ?? null,
       githubEnvironments: stringArray(manifest?.githubEnvironments),
       requiredSecrets: stringArray(manifest?.requiredSecrets),
       requiredVariables: stringArray(manifest?.requiredVariables),
@@ -168,6 +180,7 @@ function nodeTypeScriptAdapter(pkg) {
       ...hostedVerifyWorkflow ? {
         hostedVerifyWorkflow: hostedVerifyWorkflow.startsWith(".github/workflows/") ? hostedVerifyWorkflow : `.github/workflows/${hostedVerifyWorkflow}`
       } : {},
+      ...hostedVerifyTimeoutSeconds ? { hostedVerifyTimeoutSeconds } : {},
       scripts
     }
   };
@@ -189,6 +202,10 @@ function stringRecord(value) {
 function stringValue(value) {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
+function positiveIntegerValue(value) {
+  const parsed = typeof value === "number" ? value : typeof value === "string" && value.trim() ? Number(value.trim()) : NaN;
+  return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : null;
+}
 function stringArray(value) {
   return Array.isArray(value) ? value.map((entry) => stringValue(entry)).filter((entry) => Boolean(entry)) : [];
 }
@@ -225,10 +242,14 @@ function beamPackageAdapter(root, dir) {
   const dockerImages = stringRecord(manifest?.dockerImages);
   const dockerImageReleaseWorkflow = stringValue(dockerImages.releaseWorkflow);
   const dockerImageArchitectures = stringArray(dockerImages.architectures);
+  const releaseGateRecord = stringRecord(manifest?.releaseGate);
+  const hostedVerifyTimeoutSeconds = positiveIntegerValue(releaseGateRecord.timeoutSeconds) ?? positiveIntegerValue(manifest?.hostedVerifyTimeoutSeconds);
   const repository = stringValue(manifest?.repository) ?? (id === "treedx" ? "treeseed-ai/treedx" : null);
-  const hostedVerifyWorkflow = stringValue(manifest?.hostedVerifyWorkflow) ?? stringValue(stringRecord(manifest?.releaseGate).workflow) ?? (existsSync(resolve(dir, ".github/workflows/release-gate.yml")) ? "release-gate.yml" : null);
+  const hostedVerifyWorkflow = stringValue(manifest?.hostedVerifyWorkflow) ?? stringValue(releaseGateRecord.workflow) ?? (existsSync(resolve(dir, ".github/workflows/release-gate.yml")) ? "release-gate.yml" : null);
   const projectArchitecture = normalizeTreeseedPackageProjectArchitecture(manifest?.projectArchitecture, id);
   const docsReadiness = docsSiteReadiness(dir, projectArchitecture);
+  const capabilityRecord = stringRecord(manifest?.capabilities);
+  const localOnly = capabilityRecord.localOnly === true;
   const verify = manifest?.verify && typeof manifest.verify === "object" && !Array.isArray(manifest.verify) ? manifest.verify : {};
   const fast = verify.fast ?? (existsSync(resolve(dir, "scripts/test-treedx-fast.sh")) ? "scripts/test-treedx-fast.sh" : null);
   const local = verify.local ?? (existsSync(resolve(dir, "scripts/test-all.sh")) ? "scripts/test-all.sh" : null);
@@ -269,6 +290,13 @@ function beamPackageAdapter(root, dir) {
       role: id,
       architectures: dockerImageArchitectures
     }] : [],
+    capabilities: {
+      save: capabilityRecord.save !== false,
+      verify: capabilityRecord.verify !== false,
+      publish: capabilityRecord.publish !== false,
+      deploy: !localOnly && capabilityRecord.deploy !== false,
+      localOnly
+    },
     releaseChecks: dockerArtifacts.length > 0 ? dockerArtifacts.map((artifact) => ({ kind: "docker-manifest", name: `${artifact.name} Docker image manifest`, detail: `${artifact.name}:${version ?? "<version>"}` })) : image ? [{ kind: "docker-manifest", name: "Docker image manifest", detail: `${image}:${version ?? "<version>"}` }] : [],
     metadata: {
       hasCargo: existsSync(resolve(dir, "Cargo.toml")),
@@ -282,6 +310,7 @@ function beamPackageAdapter(root, dir) {
       ...hostedVerifyWorkflow ? {
         hostedVerifyWorkflow: hostedVerifyWorkflow.startsWith(".github/workflows/") ? hostedVerifyWorkflow : `.github/workflows/${hostedVerifyWorkflow}`
       } : {},
+      ...hostedVerifyTimeoutSeconds ? { hostedVerifyTimeoutSeconds } : {},
       type: stringValue(manifest?.type) ?? null,
       githubEnvironments: stringArray(manifest?.githubEnvironments),
       requiredSecrets: stringArray(manifest?.requiredSecrets),
@@ -456,6 +485,7 @@ function packageAdapterPlanSummary(root = workspaceRoot()) {
       command ? `${command.command} ${command.args.join(" ")}` : null
     ])),
     artifacts: adapter.artifacts,
+    capabilities: adapter.capabilities,
     releaseChecks: adapter.releaseChecks,
     metadata: adapter.metadata
   }));
@@ -561,6 +591,9 @@ function validateTreeseedPackageManifests(root = workspaceRoot()) {
       if (stringValue(deploymentSource.staging) !== "git") {
         errors.push("docker package must declare deploymentSource.staging: git");
       }
+      if (adapter.capabilities.localOnly && adapter.capabilities.deploy) {
+        errors.push("local-only package cannot declare hosted deployment capability");
+      }
       if (stringValue(deploymentSource.prod) !== "image") {
         errors.push("docker package must declare deploymentSource.prod: image");
       }

package/dist/operations/services/package-artifacts.d.ts

@@ -0,0 +1,37 @@
+export type TreeseedPackageArtifactManifest = {
+    schemaVersion: 1;
+    kind: 'treeseed.package-artifact';
+    packageName: string;
+    packageVersion: string;
+    sourceSha: string;
+    createdAt: string;
+    file: string;
+    sha256: string;
+    size: number;
+};
+export declare function buildTreeseedPackageArtifact(input: {
+    packageRoot: string;
+    outputDir: string;
+}): {
+    artifactPath: string;
+    manifestPath: string;
+    manifest: TreeseedPackageArtifactManifest;
+};
+export declare function verifyTreeseedPackageArtifact(input: {
+    manifestPath: string;
+    artifactPath?: string;
+}): {
+    ok: true;
+    artifactPath: string;
+    manifestPath: string;
+    manifest: TreeseedPackageArtifactManifest;
+};
+export declare function hydrateTreeseedPackageArtifacts(input: {
+    artifactsRoot: string;
+    projectRoot: string;
+}): {
+    ok: true;
+    projectRoot: string;
+    artifactsRoot: string;
+    packages: TreeseedPackageArtifactManifest[];
+};