@treeseed/sdk 0.4.13 → 0.5.0

package/dist/platform/env.yaml

@@ -6,7 +6,7 @@ entries:
     howToGet: "Create a GitHub fine-grained personal access token scoped to the TreeSeed repository. Required repository permissions: Contents read/write, Environments read/write, Secrets and variables read/write, Actions and workflows read/write, Pull requests read/write, Issues read/write. Then paste it here as GH_TOKEN."
     sensitivity: secret
     targets:
-      - local-file
+      - local-runtime
       - railway-secret
     scopes:
       - local
@@ -19,6 +19,7 @@ entries:
       - config
     validation:
       kind: nonempty
+      minLength: 8
     sourcePriority:
       - machine-config
       - process-env
@@ -29,7 +30,7 @@ entries:
     howToGet: "Create a Cloudflare account-level API token scoped to the target domain and account. Required permissions: Account Cloudflare Pages edit, Account Workers Scripts edit, Account Workers KV Storage edit, Account D1 edit, Account Queues edit, Zone DNS edit. Then paste it here as CLOUDFLARE_API_TOKEN."
     sensitivity: secret
     targets:
-      - local-file
+      - local-runtime
       - github-secret
     scopes:
       - local
@@ -44,6 +45,7 @@ entries:
       - config
     validation:
       kind: nonempty
+      minLength: 8
     sourcePriority:
       - machine-config
       - process-env
@@ -51,10 +53,10 @@ entries:
     label: Railway API token
     group: auth
     description: Primary Railway token for user or workspace scoped access, including project creation and most Treeseed-managed Railway flows.
-    howToGet: In Railway, create a user or workspace API token that can create and manage the target project, then paste it here as RAILWAY_API_TOKEN.
+    howToGet: In Railway, create a user or workspace API token that can create and manage the target project, then paste it here. Treeseed also accepts the legacy alias RAILWAY_API_KEY from process env.
     sensitivity: secret
     targets:
-      - local-file
+      - local-runtime
       - railway-secret
     scopes:
       - local
@@ -68,6 +70,7 @@ entries:
       - config
     validation:
       kind: nonempty
+      minLength: 8
     sourcePriority:
       - machine-config
       - process-env
@@ -80,7 +83,7 @@ entries:
     howToGet: In Railway, generate a project-scoped token only if you need project resource management separate from the primary API token, then paste it here as RAILWAY_TOKEN.
     sensitivity: secret
     targets:
-      - local-file
+      - local-runtime
       - railway-secret
     scopes:
       - local
@@ -94,6 +97,7 @@ entries:
       - config
     validation:
       kind: nonempty
+      minLength: 8
     sourcePriority:
       - machine-config
       - process-env
@@ -105,7 +109,7 @@ entries:
     howToGet: In the Cloudflare dashboard, open Workers & Pages or Account Home and copy the account ID.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - config-file
     scopes:
@@ -123,7 +127,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-      - treeseed.site.yaml
   TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME:
     label: Cloudflare Pages project name
     group: cloudflare
@@ -131,7 +134,7 @@ entries:
     howToGet: Treeseed can default this from the site slug. Override it if the Cloudflare Pages project should use a different name.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
     scopes:
       - staging
@@ -146,7 +149,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-      - treeseed.site.yaml
     defaultValueRef: pagesProjectNameDefault
   TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME:
     label: Cloudflare staging Pages project
@@ -155,7 +157,7 @@ entries:
     howToGet: Treeseed can default this from the production Pages project name with a -staging suffix.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
     scopes:
       - staging
@@ -170,7 +172,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-      - treeseed.site.yaml
     defaultValueRef: pagesPreviewProjectNameDefault
   TREESEED_CONTENT_BUCKET_NAME:
     label: Cloudflare R2 content bucket
@@ -179,7 +180,7 @@ entries:
     howToGet: Treeseed can default this from the site slug with a -content suffix. Override it if the shared bucket should use a different name.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
     scopes:
       - staging
@@ -194,7 +195,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-      - treeseed.site.yaml
     defaultValueRef: contentBucketNameDefault
   TREESEED_CONTENT_BUCKET_BINDING:
     label: Cloudflare R2 binding name
@@ -203,7 +203,7 @@ entries:
     howToGet: Treeseed defaults this to TREESEED_CONTENT_BUCKET unless you need a different binding name.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
     scopes:
       - staging
@@ -218,7 +218,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-      - treeseed.site.yaml
     defaultValueRef: contentBucketBindingDefault
   TREESEED_EDITORIAL_PREVIEW_SECRET:
     label: Editorial preview signing secret
@@ -227,7 +226,7 @@ entries:
     howToGet: Treeseed can generate a strong random secret for you. Reuse the same value across hosted environments so preview links remain valid during staging-to-production promotion.
     sensitivity: secret
     targets:
-      - local-file
+      - local-runtime
       - github-secret
       - cloudflare-secret
     scopes:
@@ -251,7 +250,7 @@ entries:
     howToGet: Treeseed can derive this from the hosting block in treeseed.site.yaml. Override it only when the runtime environment must force a different deployment profile.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
       - config-file
@@ -282,7 +281,7 @@ entries:
     howToGet: Treeseed can derive this from the hosting block in treeseed.site.yaml.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
       - config-file
@@ -312,7 +311,7 @@ entries:
     howToGet: Use the hosted market API URL if Treeseed manages the project for you. Self-hosted deployments should only set this when registration with the market control plane is enabled.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -338,10 +337,10 @@ entries:
     label: Hosted team ID
     group: hosting
     description: Team identifier used by hosted or registered project platforms when they publish infra metadata, register agent pools, or resolve team-scoped content.
-    howToGet: Treeseed can default this from the hosting.teamId value in treeseed.site.yaml or fall back to the site slug.
+    howToGet: Treeseed defaults this to the site slug unless you need a different hosted team identifier.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -359,7 +358,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-      - treeseed.site.yaml
     relevanceRef: projectRegistrationEnabled
     requiredWhenRef: projectRegistrationEnabled
     defaultValueRef: hostingTeamIdDefault
@@ -367,10 +365,10 @@ entries:
     label: Hosted project ID
     group: hosting
     description: Stable project identifier used by hosted or registered self-hosted project platforms for dispatch, deploy reporting, and agent-pool registration.
-    howToGet: Treeseed can default this from hosting.projectId in treeseed.site.yaml or fall back to the site slug.
+    howToGet: Treeseed defaults this to the site slug unless you need a different hosted project identifier.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -388,7 +386,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
-      - treeseed.site.yaml
     relevanceRef: projectRegistrationEnabled
     requiredWhenRef: projectRegistrationEnabled
     defaultValueRef: hostingProjectIdDefault
@@ -399,7 +396,7 @@ entries:
     howToGet: Generate or rotate this token from the market control plane after connecting a project environment.
     sensitivity: secret
     targets:
-      - local-file
+      - local-runtime
       - github-secret
       - railway-secret
     scopes:
@@ -425,7 +422,7 @@ entries:
     howToGet: Set this to 0 for scale-to-zero by default unless the project requires warm workers.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -444,6 +441,7 @@ entries:
       - machine-config
       - process-env
     relevanceRef: railwayManagedEnabled
+    defaultValueRef: agentPoolMinWorkersDefault
   TREESEED_AGENT_POOL_MAX_WORKERS:
     label: Agent pool maximum workers
     group: hosting
@@ -451,7 +449,7 @@ entries:
     howToGet: Choose a value that reflects your budget and expected concurrency ceiling.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -470,6 +468,7 @@ entries:
       - machine-config
       - process-env
     relevanceRef: railwayManagedEnabled
+    defaultValueRef: agentPoolMaxWorkersDefault
   TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH:
     label: Agent pool target queue depth
     group: hosting
@@ -477,7 +476,7 @@ entries:
     howToGet: Start with 1 for conservative scaling, then raise it only after observing stable worker latency.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -496,6 +495,7 @@ entries:
       - machine-config
       - process-env
     relevanceRef: railwayManagedEnabled
+    defaultValueRef: agentPoolTargetQueueDepthDefault
   TREESEED_AGENT_POOL_COOLDOWN_SECONDS:
     label: Agent pool cooldown seconds
     group: hosting
@@ -503,7 +503,7 @@ entries:
     howToGet: Start with 60 seconds to prevent worker thrash in lightly bursty environments.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -522,6 +522,7 @@ entries:
       - machine-config
       - process-env
     relevanceRef: railwayManagedEnabled
+    defaultValueRef: agentPoolCooldownSecondsDefault
   TREESEED_WORKDAY_TIMEZONE:
     label: Workday timezone
     group: hosting
@@ -529,7 +530,7 @@ entries:
     howToGet: Use the project team's operating timezone, such as America/New_York.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -547,6 +548,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: workdayTimezoneDefault
   TREESEED_WORKDAY_WINDOWS_JSON:
     label: Workday schedule JSON
     group: hosting
@@ -554,7 +556,7 @@ entries:
     howToGet: Provide a JSON value like [{"days":[1,2,3,4,5],"startTime":"09:00","endTime":"17:00"}].
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -572,6 +574,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: workdayWindowsDefault
   TREESEED_WORKDAY_TASK_CREDIT_BUDGET:
     label: Daily task-credit budget
     group: hosting
@@ -579,7 +582,7 @@ entries:
     howToGet: Choose the daily throughput ceiling that matches the team's Copilot and infrastructure budget.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -597,6 +600,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: workdayTaskCreditBudgetDefault
   TREESEED_MANAGER_MAX_QUEUED_TASKS:
     label: Manager max queued tasks
     group: hosting
@@ -604,7 +608,7 @@ entries:
     howToGet: Start small so queue top-ups stay budget-aware and incremental.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -622,6 +626,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: managerMaxQueuedTasksDefault
   TREESEED_MANAGER_MAX_QUEUED_CREDITS:
     label: Manager max queued credits
     group: hosting
@@ -629,7 +634,7 @@ entries:
     howToGet: Set this lower than or equal to the daily task-credit budget.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -647,6 +652,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: managerMaxQueuedCreditsDefault
   TREESEED_MANAGER_PRIORITY_MODELS:
     label: Manager priority models
     group: hosting
@@ -654,7 +660,7 @@ entries:
     howToGet: Leave unset to use the default objective/question/note/page/book/knowledge set.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -672,6 +678,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: managerPriorityModelsDefault
   TREESEED_TASK_CREDIT_WEIGHTS_JSON:
     label: Task credit weights JSON
     group: hosting
@@ -679,7 +686,7 @@ entries:
     howToGet: Provide a JSON value such as [{"type":"question","credits":3}].
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -697,6 +704,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: taskCreditWeightsDefault
   TREESEED_WORKER_POOL_SCALER:
     label: Worker pool scaler kind
     group: hosting
@@ -704,7 +712,7 @@ entries:
     howToGet: Set this to railway for hosted projects or noop/manual for self-hosted environments without automatic scale control.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -726,6 +734,7 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    defaultValueRef: workerPoolScalerDefault
   TREESEED_RAILWAY_PROJECT_ID:
     label: Railway project ID
     group: hosting
@@ -733,7 +742,7 @@ entries:
     howToGet: Copy the project ID from Railway when automatic worker scaling is enabled.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -758,7 +767,7 @@ entries:
     howToGet: Copy the environment ID from Railway for the matching staging or production environment.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -783,7 +792,7 @@ entries:
     howToGet: Copy the worker service ID from Railway after the hosted project environment is provisioned.
     sensitivity: plain
     targets:
-      - local-file
+      - local-runtime
       - github-variable
       - railway-var
     scopes:
@@ -804,18 +813,21 @@ entries:
   TREESEED_FORM_TOKEN_SECRET:
     label: Forms token secret
     group: forms
+    cluster: forms-core
+    startupProfile: core
     description: Signs form-related tokens and protects Treeseed forms workflows in local and hosted runtimes.
     howToGet: Treeseed can generate a strong random secret for you. Reuse it across environments only if that matches your security model.
     sensitivity: secret
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-secret
       - cloudflare-secret
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: required
     purposes:
       - dev
@@ -832,18 +844,20 @@ entries:
   TREESEED_PUBLIC_TURNSTILE_SITE_KEY:
     label: Turnstile site key
     group: forms
+    cluster: turnstile
     description: Public site key used by the browser to render the Turnstile challenge when forms protection is enabled.
     howToGet: Create a Turnstile widget in Cloudflare Turnstile and copy the site key.
     sensitivity: plain
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-variable
       - cloudflare-var
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -860,18 +874,20 @@ entries:
   TREESEED_TURNSTILE_SECRET_KEY:
     label: Turnstile secret key
     group: forms
+    cluster: turnstile
     description: Server-side Turnstile secret used to verify challenge responses.
     howToGet: Create a Turnstile widget in Cloudflare Turnstile and copy the secret key.
     sensitivity: secret
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-secret
       - cloudflare-secret
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -892,8 +908,8 @@ entries:
     howToGet: Treeseed defaults this to true for local development. You can switch it off if you want to test with real Turnstile keys locally.
     sensitivity: plain
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
     scopes:
       - local
     requirement: optional
@@ -909,18 +925,20 @@ entries:
   TREESEED_SMTP_HOST:
     label: SMTP host
     group: smtp
+    cluster: smtp
     description: SMTP host for Treeseed email delivery when SMTP-backed forms behavior is enabled.
     howToGet: Use the SMTP hostname from your email provider or local Mailpit instance.
     sensitivity: plain
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-variable
       - cloudflare-var
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -932,23 +950,26 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    localDefaultValueRef: localMailpitHostDefault
     relevanceRef: smtpEnabled
     requiredWhenRef: smtpNonLocal
   TREESEED_SMTP_PORT:
     label: SMTP port
     group: smtp
+    cluster: smtp
     description: Port used to connect to the SMTP server.
     howToGet: Use the port provided by your email service, commonly 587, 465, or the Mailpit local port.
     sensitivity: plain
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-variable
       - cloudflare-var
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -960,23 +981,26 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    localDefaultValueRef: localMailpitPortDefault
     relevanceRef: smtpEnabled
     requiredWhenRef: smtpNonLocal
   TREESEED_SMTP_USERNAME:
     label: SMTP username
     group: smtp
+    cluster: smtp
     description: SMTP identity used when authenticating to the mail provider.
     howToGet: Use the SMTP username or mailbox identity from your email provider.
     sensitivity: plain
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-variable
       - cloudflare-var
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -993,18 +1017,20 @@ entries:
   TREESEED_SMTP_PASSWORD:
     label: SMTP password
     group: smtp
+    cluster: smtp
     description: SMTP password or app password used for authenticated email sending.
     howToGet: Use the SMTP password or app-specific password from your email provider.
     sensitivity: secret
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-secret
       - cloudflare-secret
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -1021,18 +1047,20 @@ entries:
   TREESEED_SMTP_FROM:
     label: SMTP from address
     group: smtp
+    cluster: smtp
     description: Email address Treeseed uses as the sender for mail notifications.
     howToGet: Use a verified sender address from your SMTP provider.
     sensitivity: plain
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-variable
       - cloudflare-var
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -1044,23 +1072,26 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    localDefaultValueRef: contactEmailDefault
     relevanceRef: smtpEnabled
     requiredWhenRef: smtpNonLocal
   TREESEED_SMTP_REPLY_TO:
     label: SMTP reply-to address
     group: smtp
+    cluster: smtp
     description: Reply-to address attached to Treeseed-generated emails.
     howToGet: Use a monitored mailbox that should receive replies from end users.
     sensitivity: plain
     targets:
-      - local-file
-      - wrangler-dev-vars
+      - local-runtime
+      - local-cloudflare
       - github-variable
       - cloudflare-var
     scopes:
       - local
       - staging
       - prod
+    storage: shared
     requirement: conditional
     purposes:
       - dev
@@ -1072,5 +1103,6 @@ entries:
     sourcePriority:
       - machine-config
       - process-env
+    localDefaultValueRef: contactEmailDefault
     relevanceRef: smtpEnabled
     requiredWhenRef: smtpNonLocal