@treeseed/sdk 0.4.12 → 0.5.0

package/dist/workflow-state.js

@@ -1,6 +1,16 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { getTreeseedMachineConfigPaths, resolveTreeseedRemoteSession } from "./operations/services/config-runtime.js";
+import {
+  getTreeseedMachineConfigPaths,
+  inspectTreeseedKeyAgentStatus,
+  loadTreeseedMachineConfig,
+  resolveTreeseedMachineEnvironmentValues,
+  resolveTreeseedRemoteSession,
+  collectTreeseedEnvironmentContext,
+  withTreeseedKeyAgentAutopromptDisabled
+} from "./operations/services/config-runtime.js";
+import { validateTreeseedEnvironmentValues } from "./platform/environment.js";
+import { resolveTreeseedWebCachePolicy } from "./platform/deploy-config.js";
 import {
   createBranchPreviewDeployTarget,
   createPersistentDeployTarget,
@@ -8,39 +18,42 @@ import {
 } from "./operations/services/deploy.js";
 import { loadCliDeployConfig } from "./operations/services/runtime-tools.js";
 import { collectCliPreflight } from "./operations/services/workspace-preflight.js";
-import { gitStatusPorcelain } from "./operations/services/workspace-save.js";
-import { isWorkspaceRoot } from "./operations/services/workspace-tools.js";
+import { currentBranch, gitStatusPorcelain } from "./operations/services/workspace-save.js";
+import { hasCompleteTreeseedPackageCheckout, isWorkspaceRoot, run, workspacePackages } from "./operations/services/workspace-tools.js";
+import { inspectWorkflowLock, listInterruptedWorkflowRuns } from "./workflow/runs.js";
 import {
   resolveTreeseedWorkflowPaths,
   workflowEnvironmentForBranchRole
 } from "./workflow/policy.js";
 function emptyPersistentEnvironments() {
   return {
-    local: { initialized: false, lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
-    staging: { initialized: false, lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
-    prod: { initialized: false, lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null }
+    local: { initialized: false, phase: "pending", configured: false, provisioned: false, deployable: false, blockers: [], warnings: [], lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
+    staging: { initialized: false, phase: "pending", configured: false, provisioned: false, deployable: false, blockers: [], warnings: [], lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
+    prod: { initialized: false, phase: "pending", configured: false, provisioned: false, deployable: false, blockers: [], warnings: [], lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null }
   };
 }
 function readinessForEnvironment(state, scope) {
-  const blockers = [];
-  const warnings = [];
+  const blockers = [...state.persistentEnvironments[scope].blockers];
+  const warnings = [...state.persistentEnvironments[scope].warnings];
   if (!state.deployConfigPresent) {
     blockers.push("Missing treeseed.site.yaml.");
   }
   if (!state.files.machineConfig) {
     blockers.push("Missing Treeseed machine config.");
   }
-  if (scope === "local") {
-    if (!state.files.envLocal) {
-      blockers.push("Missing .env.local.");
-    }
-    if (!state.files.devVars) {
-      warnings.push("Missing .dev.vars.");
-    }
-  } else {
+  if (!state.secrets.wrappedKeyPresent) {
+    blockers.push("Missing wrapped Treeseed machine key.");
+  }
+  if (state.secrets.migrationRequired) {
+    blockers.push("Treeseed machine key migration is still required.");
+  }
+  if (scope !== "local") {
     if (!state.persistentEnvironments[scope].initialized) {
       blockers.push(`Environment ${scope} is not initialized.`);
     }
+    if (state.persistentEnvironments[scope].configured && !state.persistentEnvironments[scope].provisioned) {
+      warnings.push(`Environment ${scope} is configured but foundational infrastructure has not been provisioned yet.`);
+    }
   }
   return {
     ready: blockers.length === 0,
@@ -48,6 +61,28 @@ function readinessForEnvironment(state, scope) {
     warnings
   };
 }
+function safeResolveRemoteSession(cwd, hostId) {
+  try {
+    return withTreeseedKeyAgentAutopromptDisabled(() => resolveTreeseedRemoteSession(cwd, hostId ?? void 0));
+  } catch {
+    return null;
+  }
+}
+function safeResolveMachineEnvironmentValues(cwd, scope) {
+  try {
+    return withTreeseedKeyAgentAutopromptDisabled(() => resolveTreeseedMachineEnvironmentValues(cwd, scope));
+  } catch {
+    return {};
+  }
+}
+function knownRemoteTrackingBranchExists(repoDir, branchName) {
+  try {
+    run("git", ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branchName}`], { cwd: repoDir, capture: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
 function resolveTreeseedWorkflowState(cwd) {
   const resolved = resolveTreeseedWorkflowPaths(cwd);
   const effectiveCwd = resolved.cwd;
@@ -58,8 +93,72 @@ function resolveTreeseedWorkflowState(cwd) {
   const branchName = resolved.branchName;
   const branchRole = resolved.branchRole;
   const dirtyWorktree = root ? gitStatusPorcelain(root).length > 0 : false;
+  const completePackageCheckout = hasCompleteTreeseedPackageCheckout(effectiveCwd);
+  const packageSyncRepos = completePackageCheckout ? workspacePackages(effectiveCwd).filter((pkg) => pkg.name?.startsWith("@treeseed/")).map((pkg) => {
+    const repoBranch = currentBranch(pkg.dir) || null;
+    const dirty = gitStatusPorcelain(pkg.dir).length > 0;
+    const expectedBranch = branchName;
+    let localBranch = false;
+    if (expectedBranch) {
+      if (repoBranch === expectedBranch) {
+        localBranch = true;
+      } else {
+        try {
+          run("git", ["show-ref", "--verify", "--quiet", `refs/heads/${expectedBranch}`], { cwd: pkg.dir, capture: true });
+          localBranch = true;
+        } catch {
+          localBranch = false;
+        }
+      }
+    }
+    const remoteBranch = Boolean(expectedBranch) ? knownRemoteTrackingBranchExists(pkg.dir, expectedBranch) : false;
+    return {
+      name: pkg.name,
+      path: pkg.relativeDir,
+      branchName: repoBranch,
+      dirty,
+      aligned: expectedBranch ? repoBranch === expectedBranch : true,
+      localBranch,
+      remoteBranch
+    };
+  }) : [];
+  const packageSyncBlockers = [];
+  for (const repo of packageSyncRepos) {
+    if (repo.dirty) {
+      packageSyncBlockers.push(`${repo.name} has uncommitted changes.`);
+    }
+    if (branchName && !repo.localBranch && !repo.remoteBranch) {
+      packageSyncBlockers.push(`${repo.name} is missing branch ${branchName}.`);
+      continue;
+    }
+    if (branchName && !repo.aligned) {
+      packageSyncBlockers.push(`${repo.name} is on ${repo.branchName ?? "(detached)"} instead of ${branchName}.`);
+    }
+  }
   const preflight = collectCliPreflight({ cwd: effectiveCwd, requireAuth: false });
   const { configPath, keyPath } = getTreeseedMachineConfigPaths(effectiveCwd);
+  const machineConfig = existsSync(configPath) ? loadTreeseedMachineConfig(effectiveCwd) : null;
+  const keyStatus = inspectTreeseedKeyAgentStatus(effectiveCwd);
+  const marketSettings = machineConfig?.settings?.market && typeof machineConfig.settings.market === "object" ? machineConfig.settings.market : null;
+  const runnerHostId = typeof marketSettings?.runnerHostId === "string" && marketSettings.runnerHostId.trim() ? marketSettings.runnerHostId.trim() : typeof marketSettings?.projectId === "string" && marketSettings.projectId.trim() ? `market-runner:${marketSettings.projectId.trim()}` : null;
+  const runnerSession = runnerHostId ? safeResolveRemoteSession(effectiveCwd, runnerHostId) : null;
+  const workflowLock = inspectWorkflowLock(effectiveCwd);
+  const interruptedRuns = listInterruptedWorkflowRuns(effectiveCwd).map((journal) => ({
+    runId: journal.runId,
+    command: journal.command,
+    updatedAt: journal.updatedAt,
+    nextStep: journal.steps.find((step) => step.status === "pending")?.description ?? null
+  }));
+  const workflowBlockers = [];
+  if (workflowLock.active && workflowLock.lock) {
+    workflowBlockers.push(`Workflow lock active for ${workflowLock.lock.command} (${workflowLock.lock.runId}).`);
+  }
+  if (workflowLock.stale && workflowLock.lock) {
+    workflowBlockers.push(`Workflow lock is stale: ${workflowLock.staleReason}.`);
+  }
+  if (interruptedRuns.length > 0) {
+    workflowBlockers.push(`Interrupted workflow runs detected: ${interruptedRuns.map((run2) => run2.runId).join(", ")}.`);
+  }
   const state = {
     cwd: effectiveCwd,
     workspaceRoot,
@@ -70,34 +169,101 @@ function resolveTreeseedWorkflowState(cwd) {
     branchRole,
     environment: workflowEnvironmentForBranchRole(branchRole),
     dirtyWorktree,
+    workflowControl: {
+      lock: {
+        active: workflowLock.active,
+        stale: workflowLock.stale,
+        runId: workflowLock.lock?.runId ?? null,
+        command: workflowLock.lock?.command ?? null,
+        updatedAt: workflowLock.lock?.updatedAt ?? null,
+        staleReason: workflowLock.staleReason
+      },
+      interruptedRuns,
+      blockers: workflowBlockers
+    },
+    packageSync: {
+      mode: completePackageCheckout ? "recursive-workspace" : "root-only",
+      completeCheckout: completePackageCheckout,
+      expectedBranch: branchName,
+      aligned: packageSyncRepos.every((repo) => repo.aligned),
+      dirty: packageSyncRepos.some((repo) => repo.dirty),
+      repos: packageSyncRepos,
+      blockers: packageSyncBlockers
+    },
     preview: {
       enabled: false,
       url: null,
       lastDeploymentTimestamp: null
     },
+    webCache: {
+      webHost: null,
+      contentHost: null,
+      sourcePagePolicy: null,
+      contentPagePolicy: null,
+      r2ObjectPolicy: null,
+      cloudflareRulesManaged: false,
+      lastDeployPurgeAt: null,
+      lastDeployPurgeCount: null,
+      lastContentPurgeAt: null,
+      lastContentPurgeCount: null
+    },
     persistentEnvironments: emptyPersistentEnvironments(),
     auth: {
       gh: preflight.checks.auth.gh?.authenticated === true,
       wrangler: preflight.checks.auth.wrangler?.authenticated === true,
       railway: preflight.checks.auth.railway?.authenticated === true,
       copilot: preflight.checks.auth.copilot?.configured === true,
-      remoteApi: Boolean(resolveTreeseedRemoteSession(cwd))
+      remoteApi: Boolean(safeResolveRemoteSession(cwd))
+    },
+    marketConnection: {
+      configured: Boolean(marketSettings?.baseUrl && marketSettings?.projectId),
+      baseUrl: typeof marketSettings?.baseUrl === "string" ? marketSettings.baseUrl : null,
+      hostId: typeof marketSettings?.hostId === "string" ? marketSettings.hostId : null,
+      teamId: typeof marketSettings?.teamId === "string" ? marketSettings.teamId : null,
+      teamSlug: typeof marketSettings?.teamSlug === "string" ? marketSettings.teamSlug : null,
+      projectId: typeof marketSettings?.projectId === "string" ? marketSettings.projectId : null,
+      projectSlug: typeof marketSettings?.projectSlug === "string" ? marketSettings.projectSlug : null,
+      connectionMode: typeof marketSettings?.connectionMode === "string" ? marketSettings.connectionMode : null,
+      projectApiBaseUrl: typeof marketSettings?.projectApiBaseUrl === "string" ? marketSettings.projectApiBaseUrl : null,
+      hubMode: null,
+      runtimeMode: null,
+      runtimeRegistration: null,
+      runtimeAttached: false,
+      runtimeReady: true,
+      runnerHostId,
+      runnerReady: Boolean(
+        marketSettings?.runnerReady === true || typeof runnerSession?.accessToken === "string" && runnerSession.accessToken.length > 0
+      ),
+      runnerRegisteredAt: typeof marketSettings?.runnerRegisteredAt === "string" ? marketSettings.runnerRegisteredAt : null,
+      runnerLastSeenAt: typeof marketSettings?.runnerLastSeenAt === "string" ? marketSettings.runnerLastSeenAt : null,
+      launchPhase: typeof marketSettings?.launchPhase === "string" ? marketSettings.launchPhase : null,
+      lastSuccessfulPhase: typeof marketSettings?.lastSuccessfulPhase === "string" ? marketSettings.lastSuccessfulPhase : null,
+      githubRepository: typeof marketSettings?.githubRepository === "string" ? marketSettings.githubRepository : null,
+      workflowBootstrapReady: marketSettings?.workflowBootstrapReady === true,
+      currentWorkstreamId: branchRole === "feature" ? branchName : null,
+      verificationPosture: typeof marketSettings?.launchPhase === "string" && marketSettings.launchPhase === "failed" ? "blocked" : "pending",
+      approvalBlockers: Array.isArray(marketSettings?.approvalBlockers) ? marketSettings.approvalBlockers.map(String) : []
     },
     managedServices: {
       api: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
-      agents: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       manager: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       worker: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
-      runner: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       workdayStart: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       workdayReport: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null }
     },
     files: {
       treeseedConfig: tenantRoot,
       machineConfig: existsSync(configPath),
-      machineKey: existsSync(keyPath),
-      envLocal: existsSync(resolve(cwd, ".env.local")),
-      devVars: existsSync(resolve(cwd, ".dev.vars"))
+      machineKey: existsSync(keyPath)
+    },
+    secrets: {
+      keyAgentRunning: keyStatus.running,
+      keyAgentUnlocked: keyStatus.unlocked,
+      wrappedKeyPresent: keyStatus.wrappedKeyPresent,
+      migrationRequired: keyStatus.migrationRequired,
+      idleTimeoutMs: keyStatus.idleTimeoutMs,
+      idleRemainingMs: keyStatus.idleRemainingMs,
+      startupPassphraseConfigured: Boolean(process.env.TREESEED_KEY_PASSPHRASE?.trim())
     },
     releaseReady: branchRole === "staging" && !dirtyWorktree,
     readiness: {
@@ -111,10 +277,59 @@ function resolveTreeseedWorkflowState(cwd) {
   if (tenantRoot) {
     try {
       const deployConfig = loadCliDeployConfig(effectiveCwd);
+      const environmentContext = collectTreeseedEnvironmentContext(effectiveCwd);
+      const sharedConfigValues = safeResolveMachineEnvironmentValues(effectiveCwd, "prod");
+      const runtimeMode = deployConfig.runtime?.mode ?? "none";
+      const runtimeRegistration = deployConfig.runtime?.registration ?? "none";
+      const webCachePolicy = resolveTreeseedWebCachePolicy(deployConfig);
+      const registrationRequired2 = runtimeRegistration === "required";
+      const registrationEnabled = runtimeRegistration === "required" || runtimeRegistration === "optional";
+      const runtimeSessionReady = Boolean(
+        marketSettings?.runnerReady === true || typeof runnerSession?.accessToken === "string" && runnerSession.accessToken.length > 0
+      );
+      state.marketConnection.baseUrl = state.marketConnection.baseUrl ?? sharedConfigValues.TREESEED_MARKET_API_BASE_URL ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? null;
+      state.marketConnection.teamId = state.marketConnection.teamId ?? sharedConfigValues.TREESEED_HOSTING_TEAM_ID ?? deployConfig.runtime?.teamId ?? deployConfig.hosting?.teamId ?? null;
+      state.marketConnection.projectId = state.marketConnection.projectId ?? sharedConfigValues.TREESEED_PROJECT_ID ?? deployConfig.runtime?.projectId ?? deployConfig.hosting?.projectId ?? null;
+      state.marketConnection.hubMode = deployConfig.hub?.mode ?? null;
+      state.marketConnection.runtimeMode = runtimeMode;
+      state.marketConnection.runtimeRegistration = runtimeRegistration;
+      state.marketConnection.runtimeAttached = runtimeMode !== "none" && (!registrationEnabled || state.marketConnection.configured);
+      state.marketConnection.runtimeReady = runtimeMode === "none" || !registrationEnabled || runtimeSessionReady;
+      state.marketConnection.runnerReady = runtimeSessionReady;
+      state.webCache.webHost = deployConfig.surfaces?.web?.publicBaseUrl ?? deployConfig.siteUrl ?? null;
+      state.webCache.contentHost = sharedConfigValues.TREESEED_CONTENT_PUBLIC_BASE_URL ?? deployConfig.cloudflare.r2?.publicBaseUrl ?? null;
+      state.webCache.sourcePagePolicy = `browser=${webCachePolicy.sourcePages.browserTtlSeconds}s edge=${webCachePolicy.sourcePages.edgeTtlSeconds}s swr=${webCachePolicy.sourcePages.staleWhileRevalidateSeconds}s sie=${webCachePolicy.sourcePages.staleIfErrorSeconds}s`;
+      state.webCache.contentPagePolicy = `browser=${webCachePolicy.contentPages.browserTtlSeconds}s edge=${webCachePolicy.contentPages.edgeTtlSeconds}s swr=${webCachePolicy.contentPages.staleWhileRevalidateSeconds}s sie=${webCachePolicy.contentPages.staleIfErrorSeconds}s`;
+      state.webCache.r2ObjectPolicy = `browser=${webCachePolicy.r2PublishedObjects.browserTtlSeconds}s edge=${webCachePolicy.r2PublishedObjects.edgeTtlSeconds}s swr=${webCachePolicy.r2PublishedObjects.staleWhileRevalidateSeconds}s sie=${webCachePolicy.r2PublishedObjects.staleIfErrorSeconds}s`;
+      state.marketConnection.configured = registrationRequired2 ? Boolean(state.marketConnection.baseUrl && state.marketConnection.projectId) : state.marketConnection.configured;
       for (const scope of ["local", "staging", "prod"]) {
         const deployState = loadDeployState(effectiveCwd, deployConfig, { target: createPersistentDeployTarget(scope) });
+        const validation = validateTreeseedEnvironmentValues({
+          values: safeResolveMachineEnvironmentValues(effectiveCwd, scope),
+          scope,
+          purpose: "config",
+          deployConfig: environmentContext.context.deployConfig,
+          tenantConfig: environmentContext.context.tenantConfig,
+          plugins: environmentContext.context.plugins
+        });
+        const validationProblems = [...validation.missing, ...validation.invalid].map((problem) => problem.message);
+        const persistentBlockers = Array.isArray(deployState.readiness?.blockers) ? deployState.readiness.blockers.map(String) : [];
+        const persistentWarnings = Array.isArray(deployState.readiness?.warnings) ? deployState.readiness.warnings.map(String) : [];
+        const configured = scope === "local" ? validation.ok : deployState.readiness?.configured === true && validation.ok;
+        const provisioned = scope === "local" ? true : configured && deployState.readiness?.provisioned === true;
+        const deployable = scope === "local" ? validation.ok : configured && deployState.readiness?.deployable === true;
+        const initialized = deployState.readiness?.initialized === true || scope === "local";
         state.persistentEnvironments[scope] = {
-          initialized: deployState.readiness?.initialized === true || scope === "local",
+          initialized,
+          phase: validation.ok ? scope === "local" ? "code_ready" : provisioned ? "provisioned" : configured ? "config_complete" : initialized ? "config_complete" : "pending" : "config_incomplete",
+          configured,
+          provisioned,
+          deployable,
+          blockers: [
+            ...validationProblems,
+            ...persistentBlockers
+          ],
+          warnings: persistentWarnings,
           lastValidatedAt: deployState.readiness?.lastValidatedAt ?? deployState.readiness?.initializedAt ?? null,
           lastDeploymentTimestamp: deployState.lastDeploymentTimestamp ?? null,
           lastDeployedUrl: deployState.lastDeployedUrl ?? null
@@ -129,7 +344,14 @@ function resolveTreeseedWorkflowState(cwd) {
             url: typeof latestHistory?.url === "string" ? latestHistory.url : deployState.lastDeployedUrl ?? null
           });
         }
-        for (const serviceKey of ["api", "agents", "manager", "worker", "runner", "workdayStart", "workdayReport"]) {
+        if (scope === "prod") {
+          state.webCache.cloudflareRulesManaged = deployState.webCache?.rulesManaged === true;
+          state.webCache.lastDeployPurgeAt = deployState.webCache?.deployPurge?.lastPurgedAt ?? null;
+          state.webCache.lastDeployPurgeCount = deployState.webCache?.deployPurge?.purgeCount ?? null;
+          state.webCache.lastContentPurgeAt = deployState.webCache?.contentPurge?.lastPurgedAt ?? null;
+          state.webCache.lastContentPurgeCount = deployState.webCache?.contentPurge?.purgeCount ?? null;
+        }
+        for (const serviceKey of ["api", "manager", "worker", "workdayStart", "workdayReport"]) {
           const service = deployState.services?.[serviceKey];
           if (!service) continue;
           state.managedServices[serviceKey] = {
@@ -155,6 +377,12 @@ function resolveTreeseedWorkflowState(cwd) {
   state.readiness.local = readinessForEnvironment(state, "local");
   state.readiness.staging = readinessForEnvironment(state, "staging");
   state.readiness.prod = readinessForEnvironment(state, "prod");
+  state.marketConnection.verificationPosture = state.readiness.local.ready ? "ready" : state.files.machineConfig ? "blocked" : "pending";
+  const registrationRequired = state.marketConnection.runtimeRegistration === "required";
+  state.marketConnection.approvalBlockers = [
+    ...registrationRequired && !state.marketConnection.configured ? ["Knowledge Coop runtime attachment is not configured."] : [],
+    ...registrationRequired && !state.marketConnection.runtimeReady ? ["Knowledge Coop runtime credential is missing or not ready."] : []
+  ];
   state.recommendations = recommendTreeseedNextSteps(state);
   return state;
 }
@@ -168,10 +396,37 @@ function recommendTreeseedNextSteps(state) {
   }
   if (!state.files.machineConfig) {
     recommendations.push({ operation: "status", reason: "Validate tooling, auth, and repository readiness first." });
-    recommendations.push({ operation: "config", reason: "Bootstrap the local machine config and local environment files." });
+    recommendations.push({ operation: "config", reason: "Bootstrap the local machine config and injected runtime environment." });
+    return recommendations;
+  }
+  if (!state.secrets.wrappedKeyPresent || state.secrets.migrationRequired) {
+    recommendations.push({
+      operation: state.secrets.migrationRequired ? "secrets:migrate-key" : "secrets:unlock",
+      reason: state.secrets.migrationRequired ? "Wrap the local machine key before running secret-backed commands." : "Create and unlock the local wrapped machine key before running secret-backed commands."
+    });
     return recommendations;
   }
+  if (state.workflowControl.interruptedRuns.length > 0) {
+    recommendations.push({
+      operation: "resume",
+      reason: "Resume the most recent interrupted workflow run before making new branch changes.",
+      input: { runId: state.workflowControl.interruptedRuns[0].runId }
+    });
+    recommendations.push({ operation: "recover", reason: "Inspect active workflow locks and interrupted runs." });
+    return recommendations.slice(0, 3);
+  }
+  if (state.workflowControl.lock.active && state.workflowControl.lock.runId) {
+    recommendations.push({ operation: "recover", reason: "Inspect the active workflow lock before starting another mutating command." });
+    return recommendations.slice(0, 3);
+  }
   if (state.branchRole === "feature") {
+    if (state.packageSync.mode === "recursive-workspace" && state.packageSync.blockers.length > 0 && state.branchName) {
+      recommendations.push({
+        operation: "switch",
+        reason: "Realign the checked-out package repos to the current task branch before continuing.",
+        input: { branch: state.branchName }
+      });
+    }
     recommendations.push({ operation: "stage", reason: "Merge this task branch into staging and clean up branch artifacts.", input: { message: "describe the resolution" } });
     recommendations.push({ operation: "save", reason: "Persist, verify, and push the current task branch before or independently of staging it.", input: { message: "describe your change" } });
     if (state.preview.enabled && state.branchName) {
@@ -183,11 +438,18 @@ function recommendTreeseedNextSteps(state) {
     return recommendations.slice(0, 3);
   }
   if (state.branchRole === "staging") {
+    if (state.packageSync.mode === "recursive-workspace" && state.packageSync.blockers.length > 0 && state.branchName) {
+      recommendations.push({
+        operation: "switch",
+        reason: "Realign the checked-out package repos to staging before releasing.",
+        input: { branch: state.branchName }
+      });
+    }
     if (!state.persistentEnvironments.staging.initialized) {
       recommendations.push({ operation: "config", reason: "Initialize the staging environment before releasing.", input: { environment: ["staging"] } });
     } else {
       recommendations.push({ operation: "release", reason: "Promote staging into main when the integration branch is ready for production.", input: { bump: "patch" } });
-      if (state.managedServices.api.enabled || state.managedServices.agents.enabled) {
+      if (state.managedServices.api.enabled) {
         recommendations.push({ operation: "auth:login", reason: "Keep the local runtime authenticated to the remote API used by managed services." });
       }
     }

package/dist/workflow-support.d.ts

@@ -1,4 +1,4 @@
-export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, resolveTreeseedMachineEnvironmentValues, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, setTreeseedRemoteSession, writeTreeseedLocalEnvironmentFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.ts';
+export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedActVerificationTooling, ensureTreeseedSecretSessionForConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, listDeprecatedTreeseedLocalEnvFiles, inspectTreeseedKeyAgentStatus, lockTreeseedSecretSession, migrateTreeseedMachineKeyToWrapped, resolveTreeseedMachineEnvironmentValues, resolveTreeseedLaunchEnvironment, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, rotateTreeseedMachineKeyPassphrase, setTreeseedRemoteSession, TREESEED_MACHINE_KEY_PASSPHRASE_ENV, TreeseedKeyAgentError, updateTreeseedDeployConfigFeatureToggles, unlockTreeseedSecretSessionFromEnv, unlockTreeseedSecretSessionInteractive, unlockTreeseedSecretSessionWithPassphrase, withTreeseedKeyAgentAutopromptDisabled, warnDeprecatedTreeseedLocalEnvFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.ts';
 export { exportTreeseedCodebase } from './operations/services/export-runtime.ts';
 export { assertDeploymentInitialized, cleanupDestroyedState, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, destroyCloudflareResources, ensureGeneratedWranglerConfig, finalizeDeploymentState, loadDeployState, printDeploySummary, printDestroySummary, provisionCloudflareResources, runRemoteD1Migrations, syncCloudflareSecrets, validateDeployPrerequisites, validateDestroyPrerequisites, } from './operations/services/deploy.ts';
 export { assertCleanWorktree, assertFeatureBranch, branchExists, checkoutBranch, createDeprecatedTaskTag, createFeatureBranchFromStaging, currentManagedBranch, deleteLocalBranch, deleteRemoteBranch, ensureLocalBranchTracking, gitWorkflowRoot, listTaskBranches, mergeCurrentBranchIntoStaging, mergeStagingIntoMain, prepareReleaseBranches, PRODUCTION_BRANCH, pushBranch, remoteBranchExists, STAGING_BRANCH, syncBranchWithOrigin, waitForStagingAutomation, } from './operations/services/git-workflow.ts';

package/dist/workflow-support.js

@@ -8,17 +8,32 @@ import {
   collectTreeseedConfigContext,
   collectTreeseedPrintEnvReport,
   createDefaultTreeseedMachineConfig,
+  ensureTreeseedActVerificationTooling,
+  ensureTreeseedSecretSessionForConfig,
   ensureTreeseedGitignoreEntries,
   getTreeseedMachineConfigPaths,
   loadTreeseedMachineConfig,
   listRelevantTreeseedConfigEntries,
   finalizeTreeseedConfig,
+  listDeprecatedTreeseedLocalEnvFiles,
+  inspectTreeseedKeyAgentStatus,
+  lockTreeseedSecretSession,
+  migrateTreeseedMachineKeyToWrapped,
   resolveTreeseedMachineEnvironmentValues,
+  resolveTreeseedLaunchEnvironment,
   resolveTreeseedRemoteConfig,
   resolveTreeseedRemoteSession,
   rotateTreeseedMachineKey,
+  rotateTreeseedMachineKeyPassphrase,
   setTreeseedRemoteSession,
-  writeTreeseedLocalEnvironmentFiles,
+  TREESEED_MACHINE_KEY_PASSPHRASE_ENV,
+  TreeseedKeyAgentError,
+  updateTreeseedDeployConfigFeatureToggles,
+  unlockTreeseedSecretSessionFromEnv,
+  unlockTreeseedSecretSessionInteractive,
+  unlockTreeseedSecretSessionWithPassphrase,
+  withTreeseedKeyAgentAutopromptDisabled,
+  warnDeprecatedTreeseedLocalEnvFiles,
   writeTreeseedMachineConfig
 } from "./operations/services/config-runtime.js";
 import { exportTreeseedCodebase } from "./operations/services/export-runtime.js";
@@ -100,6 +115,8 @@ import {
 export {
   PRODUCTION_BRANCH,
   STAGING_BRANCH,
+  TREESEED_MACHINE_KEY_PASSPHRASE_ENV,
+  TreeseedKeyAgentError,
   applyTreeseedConfigValues,
   applyTreeseedEnvironmentToProcess,
   applyTreeseedSafeRepairs,
@@ -132,7 +149,9 @@ export {
   destroyCloudflareResources,
   ensureGeneratedWranglerConfig,
   ensureLocalBranchTracking,
+  ensureTreeseedActVerificationTooling,
   ensureTreeseedGitignoreEntries,
+  ensureTreeseedSecretSessionForConfig,
   exportTreeseedCodebase,
   finalizeDeploymentState,
   finalizeTreeseedConfig,
@@ -144,14 +163,18 @@ export {
   gitWorkflowRoot,
   hasMeaningfulChanges,
   incrementVersion,
+  inspectTreeseedKeyAgentStatus,
   isWorkspaceRoot,
+  listDeprecatedTreeseedLocalEnvFiles,
   listRelevantTreeseedConfigEntries,
   listTaskBranches,
   loadCliDeployConfig,
   loadDeployState,
   loadTreeseedMachineConfig,
+  lockTreeseedSecretSession,
   mergeCurrentBranchIntoStaging,
   mergeStagingIntoMain,
+  migrateTreeseedMachineKeyToWrapped,
   originRemoteUrl,
   packageScriptPath,
   planWorkspaceReleaseBump,
@@ -162,11 +185,13 @@ export {
   pushBranch,
   remoteBranchExists,
   repoRoot,
+  resolveTreeseedLaunchEnvironment,
   resolveTreeseedMachineEnvironmentValues,
   resolveTreeseedRemoteConfig,
   resolveTreeseedRemoteSession,
   resolveWranglerBin,
   rotateTreeseedMachineKey,
+  rotateTreeseedMachineKeyPassphrase,
   run,
   runRemoteD1Migrations,
   runTenantDeployPreflight,
@@ -174,11 +199,16 @@ export {
   setTreeseedRemoteSession,
   syncBranchWithOrigin,
   syncCloudflareSecrets,
+  unlockTreeseedSecretSessionFromEnv,
+  unlockTreeseedSecretSessionInteractive,
+  unlockTreeseedSecretSessionWithPassphrase,
+  updateTreeseedDeployConfigFeatureToggles,
   validateDeployPrerequisites,
   validateDestroyPrerequisites,
   validateRailwayDeployPrerequisites,
   waitForStagingAutomation,
+  warnDeprecatedTreeseedLocalEnvFiles,
+  withTreeseedKeyAgentAutopromptDisabled,
   workspaceRoot,
-  writeTreeseedLocalEnvironmentFiles,
   writeTreeseedMachineConfig
 };