@treeseed/sdk 0.4.13 → 0.5.1

package/dist/operations/services/runtime-tools.js

@@ -37,12 +37,12 @@ const TREESEED_DEFAULT_PLUGIN_REFERENCES = [
 const TREESEED_DEFAULT_PROVIDER_SELECTIONS = {
   forms: "store_only",
   agents: {
-    execution: "stub",
+    execution: "copilot",
     mutation: "local_branch",
-    repository: "stub",
-    verification: "stub",
-    notification: "stub",
-    research: "stub"
+    repository: "git",
+    verification: "local",
+    notification: "sdk_message",
+    research: "project_graph"
   },
   deploy: "cloudflare",
   content: {
@@ -52,9 +52,57 @@ const TREESEED_DEFAULT_PROVIDER_SELECTIONS = {
   },
   site: "default"
 };
-const TRESEED_MANAGED_SERVICE_KEYS = ["api", "agents", "manager", "worker", "runner", "workdayStart", "workdayReport"];
+const TRESEED_MANAGED_SERVICE_KEYS = ["api", "manager", "worker", "workdayStart", "workdayReport"];
 const TRESEED_WORKSPACE_PACKAGE_DIRS = ["sdk", "core", "cli"];
 const CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER = "replace-with-cloudflare-account-id";
+function normalizePlanesFromLegacyHosting(hosting) {
+  if (!hosting || Object.keys(hosting).length === 0) {
+    return {
+      hub: { mode: "treeseed_hosted" },
+      runtime: { mode: "none", registration: "none" }
+    };
+  }
+  if (hosting.kind === "market_control_plane" || hosting.kind === "hosted_project") {
+    return {
+      hub: { mode: "treeseed_hosted" },
+      runtime: {
+        mode: "treeseed_managed",
+        registration: hosting.kind === "market_control_plane" ? "none" : hosting.registration ?? "none",
+        marketBaseUrl: hosting.marketBaseUrl,
+        teamId: hosting.teamId,
+        projectId: hosting.projectId
+      }
+    };
+  }
+  return {
+    hub: { mode: "customer_hosted" },
+    runtime: {
+      mode: "byo_attached",
+      registration: hosting.registration ?? "none",
+      marketBaseUrl: hosting.marketBaseUrl,
+      teamId: hosting.teamId,
+      projectId: hosting.projectId
+    }
+  };
+}
+function normalizeLegacyHostingFromPlanes(hub, runtime) {
+  if (runtime.mode === "treeseed_managed" && hub.mode === "treeseed_hosted") {
+    return {
+      kind: "hosted_project",
+      registration: runtime.registration === "required" ? "optional" : runtime.registration ?? "none",
+      marketBaseUrl: runtime.marketBaseUrl,
+      teamId: runtime.teamId,
+      projectId: runtime.projectId
+    };
+  }
+  return {
+    kind: "self_hosted_project",
+    registration: runtime.registration === "required" ? "optional" : runtime.registration ?? "none",
+    marketBaseUrl: runtime.marketBaseUrl,
+    teamId: runtime.teamId,
+    projectId: runtime.projectId
+  };
+}
 function parseServiceEnvironmentConfig(value) {
   const record = optionalRecord(value, "service environment") ?? {};
   return {
@@ -108,6 +156,81 @@ function parseManagedServicesConfig(value) {
     ])
   );
 }
+function parseWebSurfaceCacheConfig(value, label) {
+  const record = optionalRecord(value, label) ?? {};
+  if (Object.keys(record).length === 0) {
+    return void 0;
+  }
+  return {
+    sourcePages: parseWebCachePolicyRecord(record.sourcePages ?? record.source_pages, `${label}.sourcePages`, {
+      paths: ["/", "/contact", "/404"]
+    }),
+    contentPages: parseWebCachePolicyRecord(record.contentPages ?? record.content_pages, `${label}.contentPages`),
+    r2PublishedObjects: parseWebCachePolicyRecord(
+      record.r2PublishedObjects ?? record.r2_published_objects,
+      `${label}.r2PublishedObjects`
+    )
+  };
+}
+function parseWebCachePolicyRecord(value, label, options = {}) {
+  const record = optionalRecord(value, label) ?? {};
+  if (Object.keys(record).length === 0) {
+    return options.paths ? { paths: [...options.paths] } : void 0;
+  }
+  const parsed = {
+    browserTtlSeconds: optionalNonNegativeNumber(
+      record.browserTtlSeconds ?? record.browser_ttl_seconds,
+      `${label}.browserTtlSeconds`
+    ),
+    edgeTtlSeconds: optionalNonNegativeNumber(
+      record.edgeTtlSeconds ?? record.edge_ttl_seconds,
+      `${label}.edgeTtlSeconds`
+    ),
+    staleWhileRevalidateSeconds: optionalNonNegativeNumber(
+      record.staleWhileRevalidateSeconds ?? record.stale_while_revalidate_seconds,
+      `${label}.staleWhileRevalidateSeconds`
+    ),
+    staleIfErrorSeconds: optionalNonNegativeNumber(
+      record.staleIfErrorSeconds ?? record.stale_if_error_seconds,
+      `${label}.staleIfErrorSeconds`
+    )
+  };
+  if (options.paths) {
+    parsed.paths = [...new Set(Array.isArray(record.paths) ? record.paths.map((entry) => optionalString(entry)).filter(Boolean) : options.paths)];
+  }
+  return parsed;
+}
+function parseSurfaceConfig(value, label) {
+  const record = optionalRecord(value, label);
+  if (!record) {
+    return void 0;
+  }
+  return {
+    enabled: record.enabled === void 0 ? void 0 : optionalBoolean(record.enabled, `${label}.enabled`),
+    provider: optionalString(record.provider),
+    rootDir: optionalString(record.rootDir),
+    publicBaseUrl: optionalString(record.publicBaseUrl),
+    localBaseUrl: optionalString(record.localBaseUrl),
+    cache: parseWebSurfaceCacheConfig(record.cache, `${label}.cache`)
+  };
+}
+function parsePlatformSurfacesConfig(value) {
+  const record = optionalRecord(value, "surfaces");
+  if (!record) {
+    return void 0;
+  }
+  return Object.fromEntries(
+    Object.entries(record).map(([surfaceKey, surfaceValue]) => [
+      surfaceKey,
+      parseSurfaceConfig(surfaceValue, `surfaces.${surfaceKey}`)
+    ])
+  );
+}
+function inferManagedRuntimeFromServices(services) {
+  return Object.values(services ?? {}).some(
+    (service) => service && service.enabled !== false && (service.provider ?? "railway") === "railway"
+  );
+}
 const packageRoot = packageRootFromSource;
 const packageScriptRoot = resolve(packageRoot, "scripts");
 const packageDistScriptRoot = resolve(packageRoot, "dist", "scripts");
@@ -272,6 +395,15 @@ function optionalPositiveNumber(value, label) {
   }
   return value;
 }
+function optionalNonNegativeNumber(value, label) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+    throw new Error(`Invalid deploy config: expected ${label} to be a non-negative number when provided.`);
+  }
+  return value;
+}
 function optionalEnum(value, label, allowed) {
   const normalized = optionalString(value);
   if (!normalized) {
@@ -314,6 +446,35 @@ function parseFallbackDeployConfig(configPath) {
   const cloudflarePages = optionalRecord(cloudflare.pages, "cloudflare.pages") ?? {};
   const cloudflareR2 = optionalRecord(cloudflare.r2, "cloudflare.r2") ?? {};
   const hosting = optionalRecord(record.hosting, "hosting") ?? {};
+  const parsedHosting = Object.keys(hosting).length === 0 ? void 0 : {
+    kind: optionalEnum(hosting.kind, "hosting.kind", [
+      "market_control_plane",
+      "hosted_project",
+      "self_hosted_project"
+    ]) ?? "self_hosted_project",
+    registration: optionalEnum(hosting.registration, "hosting.registration", ["optional", "none"]) ?? "none",
+    marketBaseUrl: optionalString(process.env.TREESEED_MARKET_API_BASE_URL),
+    teamId: optionalString(process.env.TREESEED_HOSTING_TEAM_ID),
+    projectId: optionalString(process.env.TREESEED_PROJECT_ID)
+  };
+  const services = parseManagedServicesConfig(record.services);
+  const normalizedPlanes = normalizePlanesFromLegacyHosting(parsedHosting);
+  const inferredPlanes = !parsedHosting && record.hub === void 0 && record.runtime === void 0 && inferManagedRuntimeFromServices(services) ? {
+    hub: { mode: "customer_hosted" },
+    runtime: { mode: "treeseed_managed", registration: "none" }
+  } : normalizedPlanes;
+  const hubRecord = optionalRecord(record.hub, "hub") ?? {};
+  const runtimeRecord = optionalRecord(record.runtime, "runtime") ?? {};
+  const hub = {
+    mode: optionalEnum(hubRecord.mode, "hub.mode", ["treeseed_hosted", "customer_hosted"]) ?? inferredPlanes.hub.mode
+  };
+  const runtime = {
+    mode: optionalEnum(runtimeRecord.mode, "runtime.mode", ["none", "byo_attached", "treeseed_managed"]) ?? inferredPlanes.runtime.mode,
+    registration: optionalEnum(runtimeRecord.registration, "runtime.registration", ["optional", "required", "none"]) ?? inferredPlanes.runtime.registration ?? "none",
+    marketBaseUrl: optionalString(process.env.TREESEED_MARKET_API_BASE_URL) ?? inferredPlanes.runtime.marketBaseUrl,
+    teamId: optionalString(process.env.TREESEED_HOSTING_TEAM_ID) ?? inferredPlanes.runtime.teamId,
+    projectId: optionalString(process.env.TREESEED_PROJECT_ID) ?? inferredPlanes.runtime.projectId
+  };
   const smtp = optionalRecord(record.smtp, "smtp") ?? {};
   const turnstile = optionalRecord(record.turnstile, "turnstile") ?? {};
   const agentProviders = optionalRecord(optionalRecord(record.providers, "providers")?.agents, "providers.agents") ?? {};
@@ -323,35 +484,28 @@ function parseFallbackDeployConfig(configPath) {
     slug: expectString(record.slug, "slug"),
     siteUrl: expectString(record.siteUrl, "siteUrl"),
     contactEmail: expectString(record.contactEmail, "contactEmail"),
-    hosting: Object.keys(hosting).length === 0 ? void 0 : {
-      kind: optionalEnum(hosting.kind, "hosting.kind", [
-        "market_control_plane",
-        "hosted_project",
-        "self_hosted_project"
-      ]) ?? "self_hosted_project",
-      registration: optionalEnum(hosting.registration, "hosting.registration", ["optional", "none"]) ?? "none",
-      marketBaseUrl: optionalString(hosting.marketBaseUrl),
-      teamId: optionalString(hosting.teamId),
-      projectId: optionalString(hosting.projectId)
-    },
+    hosting: parsedHosting && record.hub === void 0 && record.runtime === void 0 ? parsedHosting : normalizeLegacyHostingFromPlanes(hub, runtime),
+    hub,
+    runtime,
     cloudflare: {
-      accountId: optionalCloudflareAccountId(cloudflare.accountId) ?? optionalCloudflareAccountId(process.env.CLOUDFLARE_ACCOUNT_ID) ?? CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER,
+      accountId: optionalCloudflareAccountId(process.env.CLOUDFLARE_ACCOUNT_ID) ?? CLOUDFLARE_ACCOUNT_ID_PLACEHOLDER,
+      zoneId: optionalString(cloudflare.zoneId ?? cloudflare.zone_id),
       workerName: optionalString(cloudflare.workerName),
       queueName: optionalString(cloudflare.queueName),
       dlqName: optionalString(cloudflare.dlqName),
       d1Binding: optionalString(cloudflare.d1Binding),
       queueBinding: optionalString(cloudflare.queueBinding),
       pages: cloudflare.pages === void 0 ? void 0 : {
-        projectName: optionalString(cloudflarePages.projectName) ?? optionalString(process.env.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME),
-        previewProjectName: optionalString(cloudflarePages.previewProjectName) ?? optionalString(process.env.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME),
+        projectName: optionalString(process.env.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME) ?? optionalString(cloudflarePages.projectName),
+        previewProjectName: optionalString(process.env.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME) ?? optionalString(cloudflarePages.previewProjectName),
         productionBranch: optionalString(cloudflarePages.productionBranch) ?? "main",
         stagingBranch: optionalString(cloudflarePages.stagingBranch) ?? "staging",
         buildOutputDir: optionalString(cloudflarePages.buildOutputDir)
       },
       r2: cloudflare.r2 === void 0 ? void 0 : {
-        binding: optionalString(cloudflareR2.binding) ?? optionalString(process.env.TREESEED_CONTENT_BUCKET_BINDING),
-        bucketName: optionalString(cloudflareR2.bucketName) ?? optionalString(process.env.TREESEED_CONTENT_BUCKET_NAME),
-        publicBaseUrl: optionalString(cloudflareR2.publicBaseUrl) ?? optionalString(process.env.TREESEED_CONTENT_PUBLIC_BASE_URL),
+        binding: optionalString(process.env.TREESEED_CONTENT_BUCKET_BINDING),
+        bucketName: optionalString(process.env.TREESEED_CONTENT_BUCKET_NAME),
+        publicBaseUrl: optionalString(process.env.TREESEED_CONTENT_PUBLIC_BASE_URL),
         manifestKeyTemplate: optionalString(cloudflareR2.manifestKeyTemplate ?? cloudflareR2.manifestKey) ?? "teams/{teamId}/published/common.json",
         previewRootTemplate: optionalString(cloudflareR2.previewRootTemplate ?? cloudflareR2.previewRoot) ?? "teams/{teamId}/previews",
         previewTtlHours: optionalPositiveNumber(cloudflareR2.previewTtlHours, "cloudflare.r2.previewTtlHours") ?? 168
@@ -381,16 +535,22 @@ function parseFallbackDeployConfig(configPath) {
         docs: expectString(
           contentProviders.docs ?? contentProviders.runtime ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.docs ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.runtime,
           "providers.content.docs"
-        )
+        ),
+        serving: optionalEnum(
+          contentProviders.serving,
+          "providers.content.serving",
+          ["local_collections", "published_runtime"]
+        ) ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.content.serving
       },
       site: expectString(record.providers?.site ?? TREESEED_DEFAULT_PROVIDER_SELECTIONS.site, "providers.site")
     },
-    services: parseManagedServicesConfig(record.services),
+    surfaces: parsePlatformSurfacesConfig(record.surfaces),
+    services,
     smtp: {
       enabled: optionalBoolean(smtp.enabled, "smtp.enabled")
     },
     turnstile: {
-      enabled: optionalBoolean(turnstile.enabled, "turnstile.enabled") ?? true
+      enabled: optionalBoolean(turnstile.enabled, "turnstile.enabled") ?? false
     }
   };
   Object.defineProperty(deployConfig, "__tenantRoot", {

package/dist/operations/services/watch-dev.js

@@ -40,7 +40,7 @@ function shouldIgnoreWatchPath(filePath, rootPath) {
     return false;
   }
   const normalized = rel.split(sep).join("/");
-  return normalized === ".git" || normalized.startsWith(".git/") || normalized === "node_modules" || normalized.startsWith("node_modules/") || normalized === ".astro" || normalized.startsWith(".astro/") || normalized === ".wrangler" || normalized.startsWith(".wrangler/") || normalized === ".local" || normalized.startsWith(".local/") || normalized === ".treeseed" || normalized.startsWith(".treeseed/") || normalized === "dist" || normalized.startsWith("dist/") || normalized === "coverage" || normalized.startsWith("coverage/") || normalized === ".dev.vars" || normalized === "books" || normalized.startsWith("books/") || normalized === "__treeseed" || normalized.startsWith("__treeseed/") || normalized.startsWith("public/books/") || normalized.startsWith("public/__treeseed/");
+  return normalized === ".git" || normalized.startsWith(".git/") || normalized === "node_modules" || normalized.startsWith("node_modules/") || normalized === ".astro" || normalized.startsWith(".astro/") || normalized === ".wrangler" || normalized.startsWith(".wrangler/") || normalized === ".local" || normalized.startsWith(".local/") || normalized === ".treeseed" || normalized.startsWith(".treeseed/") || normalized === "dist" || normalized.startsWith("dist/") || normalized === "coverage" || normalized.startsWith("coverage/") || normalized === "books" || normalized.startsWith("books/") || normalized === "__treeseed" || normalized.startsWith("__treeseed/") || normalized.startsWith("public/books/") || normalized.startsWith("public/__treeseed/");
 }
 function collectRootSnapshot(rootPath, snapshot) {
   if (!existsSync(rootPath)) {
@@ -135,9 +135,7 @@ function createTenantWatchEntries(tenantRoot) {
     { kind: "tenant", root: resolve(tenantRoot, "src") },
     { kind: "tenant", root: resolve(tenantRoot, "public") },
     { kind: "tenant", root: resolve(tenantRoot, "astro.config.ts") },
-    { kind: "tenant", root: resolve(tenantRoot, "treeseed.site.yaml") },
-    { kind: "tenant", root: resolve(tenantRoot, ".env.local") },
-    { kind: "tenant", root: resolve(tenantRoot, ".env.local.example") }
+    { kind: "tenant", root: resolve(tenantRoot, "treeseed.site.yaml") }
   ];
   if (isEditablePackageWorkspace()) {
     const sdkRoot = workspaceSdkRoot();

package/dist/operations/services/workspace-preflight.d.ts

@@ -2,19 +2,19 @@ export declare function createWranglerCommandEnv(overrides?: {}): {
     XDG_CONFIG_HOME: string;
     WRANGLER_SEND_METRICS: string;
 };
-export declare function parseGitHubAuthStatus(): {
+export declare function parseGitHubAuthStatus(values?: NodeJS.ProcessEnv): {
     authenticated: boolean;
     detail: string;
 };
-export declare function parseWranglerWhoAmI(): {
+export declare function parseWranglerWhoAmI(values?: NodeJS.ProcessEnv): {
     authenticated: boolean;
     detail: string;
 };
-export declare function parseRailwayWhoAmI(): {
+export declare function parseRailwayWhoAmI(values?: NodeJS.ProcessEnv): {
     authenticated: boolean;
     detail: string;
 };
-export declare function parseCopilotSessionStatus(): {
+export declare function parseCopilotSessionStatus(values?: NodeJS.ProcessEnv): {
     configured: boolean;
     detail: string;
 };

package/dist/operations/services/workspace-preflight.js

@@ -1,6 +1,7 @@
 import { mkdirSync, writeFileSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
+import { collectTreeseedConfigSeedValues } from "./config-runtime.js";
 import { createTempDir } from "./workspace-tools.js";
 function runCapture(command, args, options = {}) {
   const result = spawnSync(command, args, {
@@ -32,43 +33,44 @@ function createWranglerCommandEnv(overrides = {}) {
     ...overrides
   };
 }
-function envTokenStatus(keys, label) {
+function envTokenStatus(keys, label, values = process.env) {
   const foundKey = keys.find((key) => {
-    const value = process.env[key];
+    const value = values[key];
     return typeof value === "string" && value.trim().length > 0;
   }) ?? null;
   return {
     ready: Boolean(foundKey),
-    detail: foundKey ? `${label} token detected from ${foundKey}.` : `${label} token is not configured. Set ${keys.join(" or ")}.`,
-    source: foundKey ? "env" : "missing"
+    detail: foundKey ? `${label} token detected from configured Treeseed environment (${foundKey}).` : `${label} token is not configured. Set ${keys.join(" or ")}.`,
+    source: foundKey ? "config" : "missing"
   };
 }
-function parseGitHubAuthStatus() {
+function parseGitHubAuthStatus(values = process.env) {
   return {
-    authenticated: envTokenStatus(["GH_TOKEN"], "GitHub").ready,
-    detail: envTokenStatus(["GH_TOKEN"], "GitHub").detail
+    authenticated: envTokenStatus(["GH_TOKEN"], "GitHub", values).ready,
+    detail: envTokenStatus(["GH_TOKEN"], "GitHub", values).detail
   };
 }
-function parseWranglerWhoAmI() {
+function parseWranglerWhoAmI(values = process.env) {
   return {
-    authenticated: envTokenStatus(["CLOUDFLARE_API_TOKEN"], "Cloudflare").ready,
-    detail: envTokenStatus(["CLOUDFLARE_API_TOKEN"], "Cloudflare").detail
+    authenticated: envTokenStatus(["CLOUDFLARE_API_TOKEN"], "Cloudflare", values).ready,
+    detail: envTokenStatus(["CLOUDFLARE_API_TOKEN"], "Cloudflare", values).detail
   };
 }
-function parseRailwayWhoAmI() {
+function parseRailwayWhoAmI(values = process.env) {
   return {
-    authenticated: envTokenStatus(["RAILWAY_API_TOKEN"], "Railway").ready,
-    detail: envTokenStatus(["RAILWAY_API_TOKEN"], "Railway").detail
+    authenticated: envTokenStatus(["RAILWAY_API_TOKEN", "RAILWAY_TOKEN"], "Railway", values).ready,
+    detail: envTokenStatus(["RAILWAY_API_TOKEN", "RAILWAY_TOKEN"], "Railway", values).detail
   };
 }
-function parseCopilotSessionStatus() {
-  const status = envTokenStatus(["GH_TOKEN"], "GitHub");
+function parseCopilotSessionStatus(values = process.env) {
+  const status = envTokenStatus(["GH_TOKEN"], "GitHub", values);
   return {
     configured: status.ready,
-    detail: status.ready ? "GitHub token detected from GH_TOKEN for Copilot-backed workflows." : "GitHub token is not configured. Set GH_TOKEN for Copilot-backed workflows."
+    detail: status.ready ? "GitHub token detected from configured Treeseed environment for Copilot-backed workflows." : "GitHub token is not configured. Set GH_TOKEN for Copilot-backed workflows."
   };
 }
 function collectCliPreflight({ cwd = process.cwd(), requireAuth = false } = {}) {
+  const configuredValues = collectTreeseedConfigSeedValues(cwd, "local");
   const binaries = {
     git: locateBinary("git"),
     npm: locateBinary("npm"),
@@ -87,22 +89,22 @@ function collectCliPreflight({ cwd = process.cwd(), requireAuth = false } = {})
     auth: {}
   };
   if (binaries.gh) {
-    checks.auth.gh = parseGitHubAuthStatus();
+    checks.auth.gh = parseGitHubAuthStatus(configuredValues);
   } else {
     checks.auth.gh = { authenticated: false, detail: "GitHub CLI is not installed." };
   }
   if (binaries.wrangler) {
-    checks.auth.wrangler = parseWranglerWhoAmI();
+    checks.auth.wrangler = parseWranglerWhoAmI(configuredValues);
   } else {
     checks.auth.wrangler = { authenticated: false, detail: "Wrangler CLI is not installed." };
   }
   if (binaries.railway) {
-    checks.auth.railway = parseRailwayWhoAmI();
+    checks.auth.railway = parseRailwayWhoAmI(configuredValues);
   } else {
     checks.auth.railway = { authenticated: false, detail: "Railway CLI is not installed." };
   }
   if (binaries.copilot) {
-    checks.auth.copilot = parseCopilotSessionStatus();
+    checks.auth.copilot = parseCopilotSessionStatus(configuredValues);
   } else {
     checks.auth.copilot = { configured: false, detail: "Copilot CLI is not installed." };
   }

package/dist/operations-registry.js

@@ -15,10 +15,16 @@ const TRESEED_OPERATION_SPECS = [
   operation({ id: "auth.login", name: "auth:login", aliases: [], group: "Validation", summary: "Authenticate against the configured Treeseed API.", description: "Start the device login flow against the active Treeseed API host and persist the returned session locally.", provider: "default", related: ["auth:check", "auth:whoami", "auth:logout"] }),
   operation({ id: "auth.logout", name: "auth:logout", aliases: [], group: "Validation", summary: "Clear locally stored Treeseed API credentials.", description: "Remove the persisted local device-flow session for the active Treeseed API host.", provider: "default", related: ["auth:login", "auth:whoami"] }),
   operation({ id: "auth.whoami", name: "auth:whoami", aliases: [], group: "Validation", summary: "Inspect the active Treeseed API identity.", description: "Use the persisted local remote session to query the active Treeseed API principal.", provider: "default", related: ["auth:login", "status"] }),
+  operation({ id: "secrets.status", name: "secrets:status", aliases: [], group: "Validation", summary: "Inspect the local wrapped machine-key session.", description: "Report whether the local key agent is running, whether the wrapped machine key exists, and whether the secret session is unlocked.", provider: "default", related: ["secrets:unlock", "secrets:lock"] }),
+  operation({ id: "secrets.unlock", name: "secrets:unlock", aliases: [], group: "Validation", summary: "Unlock the local Treeseed secret session.", description: "Unlock the host-local Treeseed key agent from an interactive passphrase prompt or an explicit startup passphrase env var.", provider: "default", related: ["secrets:status", "secrets:lock", "secrets:migrate-key"] }),
+  operation({ id: "secrets.lock", name: "secrets:lock", aliases: [], group: "Validation", summary: "Lock the local Treeseed secret session.", description: "Clear the in-memory machine key from the host-local Treeseed key agent.", provider: "default", related: ["secrets:status", "secrets:unlock"] }),
+  operation({ id: "secrets.migrateKey", name: "secrets:migrate-key", aliases: [], group: "Validation", summary: "Wrap a legacy plaintext machine key.", description: "Replace the legacy plaintext machine-key file with the wrapped passphrase-protected format used by the Treeseed key agent.", provider: "default", related: ["secrets:unlock", "secrets:rotate-passphrase"] }),
+  operation({ id: "secrets.rotatePassphrase", name: "secrets:rotate-passphrase", aliases: [], group: "Validation", summary: "Rotate the wrapped machine-key passphrase.", description: "Re-wrap the existing machine key with a newly entered passphrase without changing the underlying machine key.", provider: "default", related: ["secrets:unlock", "secrets:rotate-machine-key"] }),
+  operation({ id: "secrets.rotateMachineKey", name: "secrets:rotate-machine-key", aliases: [], group: "Validation", summary: "Rotate the encrypted machine key itself.", description: "Generate a new machine key, re-encrypt stored local secrets and remote auth sessions, and re-wrap the result with the configured passphrase.", provider: "default", related: ["config", "secrets:rotate-passphrase"] }),
   operation({ id: "template.list", name: "template", aliases: [], group: "Utilities", summary: "List, inspect, and validate templates from the Treeseed catalog.", description: "Use remote template metadata to list templates, show one template, or validate local template artifacts.", provider: "default", related: ["init", "sync"] }),
   operation({ id: "template.sync", name: "sync", aliases: [], group: "Validation", summary: "Validate or reconcile the managed template surface for the current site.", description: "Use remote template metadata plus the local scaffold artifact to check or apply updates to the managed scaffold surface.", provider: "default", related: ["template", "init", "status"] }),
   operation({ id: "project.init", name: "init", aliases: [], group: "Workflow", summary: "Scaffold a new Treeseed tenant project.", description: "Create a new Treeseed tenant directory from a remote-catalog template backed by the packaged scaffold artifact.", provider: "default", related: ["config", "switch", "dev"] }),
-  operation({ id: "project.config", name: "config", aliases: [], group: "Workflow", summary: "Configure and test the runtime foundation.", description: "Apply safe repairs, collect environment values, write local machine config, generate local env files, initialize environments, sync providers, and run doctor-style checks.", provider: "default", related: ["status", "switch", "dev"] }),
+  operation({ id: "project.config", name: "config", aliases: [], group: "Workflow", summary: "Configure and test the runtime foundation.", description: "Apply safe repairs, collect environment values, write local machine config, initialize environments, sync providers, and run doctor-style checks.", provider: "default", related: ["status", "switch", "dev"] }),
   operation({ id: "project.export", name: "export", aliases: [], group: "Utilities", summary: "Export a Markdown snapshot of the current codebase.", description: "Generate a Markdown codebase snapshot for the selected directory using the SDK-owned repomix integration and store it under .treeseed/exports.", provider: "default", related: ["status", "config"] }),
   operation({ id: "deploy.release", name: "release", aliases: [], group: "Workflow", summary: "Release changed packages and market from staging to production.", description: "Select changed packages plus dependents, validate publish workflows, release packages first, then promote market from staging to main with aligned package pointers.", provider: "default", related: ["stage", "status", "rollback"] }),
   operation({ id: "deploy.destroy", name: "destroy", aliases: [], group: "Workflow", summary: "Destroy a persistent environment and its local state.", description: "Delete the selected persistent environment resources and remove the local deploy state after confirmation.", provider: "default", related: ["config", "status"] }),
@@ -40,7 +46,6 @@ const TRESEED_OPERATION_SPECS = [
   operation({ id: "release.verify", name: "test:release:full", aliases: ["release:verify"], group: "Release Utilities", summary: "Run the full release verification path.", description: "Run the full release verification path.", provider: "default" }),
   operation({ id: "release.publishChanged", name: "release:publish:changed", aliases: [], group: "Release Utilities", summary: "Publish changed Treeseed workspace packages.", description: "Publish changed Treeseed workspace packages.", provider: "default" }),
   operation({ id: "tools.astro", name: "astro", aliases: [], group: "Passthrough", summary: "Pass through to the packaged Astro CLI wrapper.", description: "Pass through to the packaged Astro CLI wrapper.", provider: "default" }),
-  operation({ id: "tools.syncDevvars", name: "sync:devvars", aliases: [], group: "Utilities", summary: "Regenerate .dev.vars from local configuration.", description: "Regenerate .dev.vars from local configuration.", provider: "default" }),
   operation({ id: "services.mailpitUp", name: "mailpit:up", aliases: [], group: "Utilities", summary: "Start the package-managed Mailpit service.", description: "Start the package-managed Mailpit service.", provider: "default" }),
   operation({ id: "services.mailpitDown", name: "mailpit:down", aliases: [], group: "Utilities", summary: "Stop the package-managed Mailpit service.", description: "Stop the package-managed Mailpit service.", provider: "default" }),
   operation({ id: "services.mailpitLogs", name: "mailpit:logs", aliases: [], group: "Utilities", summary: "Show Mailpit logs.", description: "Show Mailpit logs.", provider: "default" }),

package/dist/platform/contracts.d.ts

@@ -1,11 +1,13 @@
-export type TreeseedFeatureName = 'docs' | 'books' | 'notes' | 'questions' | 'objectives' | 'agents' | 'forms';
-export type TreeseedContentCollection = 'pages' | 'notes' | 'questions' | 'objectives' | 'people' | 'agents' | 'books' | 'docs' | 'templates' | 'knowledge_packs' | 'workdays';
+export type TreeseedFeatureName = 'docs' | 'books' | 'notes' | 'questions' | 'objectives' | 'proposals' | 'decisions' | 'agents' | 'forms';
+export type TreeseedContentCollection = 'pages' | 'notes' | 'questions' | 'objectives' | 'proposals' | 'decisions' | 'people' | 'agents' | 'books' | 'docs' | 'templates' | 'knowledge_packs' | 'workdays';
 export interface TreeseedFeatureModules {
     docs?: boolean;
     books?: boolean;
     notes?: boolean;
     questions?: boolean;
     objectives?: boolean;
+    proposals?: boolean;
+    decisions?: boolean;
     agents?: boolean;
     forms?: boolean;
     [key: string]: boolean | undefined;
@@ -15,6 +17,8 @@ export interface TreeseedContentMap {
     notes: string;
     questions: string;
     objectives: string;
+    proposals: string;
+    decisions: string;
     people: string;
     agents: string;
     books: string;
@@ -118,7 +122,23 @@ export interface TreeseedPlatformSurfaceConfig {
     rootDir?: string;
     publicBaseUrl?: string;
     localBaseUrl?: string;
+    cache?: TreeseedWebSurfaceCacheConfig;
 }
+export interface TreeseedWebCachePolicyConfig {
+    browserTtlSeconds?: number;
+    edgeTtlSeconds?: number;
+    staleWhileRevalidateSeconds?: number;
+    staleIfErrorSeconds?: number;
+}
+export interface TreeseedWebSourcePageCacheConfig extends TreeseedWebCachePolicyConfig {
+    paths?: string[];
+}
+export interface TreeseedWebSurfaceCacheConfig {
+    sourcePages?: TreeseedWebSourcePageCacheConfig;
+    contentPages?: TreeseedWebCachePolicyConfig;
+    r2PublishedObjects?: TreeseedWebCachePolicyConfig;
+}
+export type TreeseedContentServingMode = 'local_collections' | 'published_runtime';
 export interface TreeseedCloudflareR2Config {
     binding?: string;
     bucketName?: string;
@@ -136,6 +156,9 @@ export interface TreeseedCloudflarePagesConfig {
 }
 export type TreeseedHostingKind = 'market_control_plane' | 'hosted_project' | 'self_hosted_project';
 export type TreeseedHostingRegistration = 'optional' | 'none';
+export type TreeseedHubMode = 'treeseed_hosted' | 'customer_hosted';
+export type TreeseedRuntimeMode = 'none' | 'byo_attached' | 'treeseed_managed';
+export type TreeseedRuntimeRegistration = 'optional' | 'required' | 'none';
 export interface TreeseedHostingConfig {
     kind: TreeseedHostingKind;
     registration?: TreeseedHostingRegistration;
@@ -143,6 +166,16 @@ export interface TreeseedHostingConfig {
     teamId?: string;
     projectId?: string;
 }
+export interface TreeseedHubConfig {
+    mode: TreeseedHubMode;
+}
+export interface TreeseedRuntimeConfig {
+    mode: TreeseedRuntimeMode;
+    registration?: TreeseedRuntimeRegistration;
+    marketBaseUrl?: string;
+    teamId?: string;
+    projectId?: string;
+}
 export interface TreeseedManagedServiceEnvironmentConfig {
     baseUrl?: string;
     domain?: string;
@@ -172,7 +205,6 @@ export interface TreeseedManagedServiceConfig {
 }
 export interface TreeseedManagedServicesConfig {
     api?: TreeseedManagedServiceConfig;
-    agents?: TreeseedManagedServiceConfig;
     [key: string]: TreeseedManagedServiceConfig | undefined;
 }
 export interface TreeseedPlatformSurfacesConfig {
@@ -196,6 +228,7 @@ export interface TreeseedProviderSelections {
         runtime: string;
         publish: string;
         docs?: string;
+        serving?: TreeseedContentServingMode;
     };
     site?: string;
 }
@@ -209,8 +242,11 @@ export interface TreeseedDeployConfig {
     siteUrl: string;
     contactEmail: string;
     hosting?: TreeseedHostingConfig;
+    hub: TreeseedHubConfig;
+    runtime: TreeseedRuntimeConfig;
     cloudflare: {
         accountId: string;
+        zoneId?: string;
         workerName?: string;
         queueName?: string;
         dlqName?: string;

package/dist/platform/deploy-config.d.ts

@@ -1,6 +1,17 @@
-import type { TreeseedDeployConfig } from './contracts.ts';
+import type { TreeseedDeployConfig, TreeseedWebCachePolicyConfig } from './contracts.ts';
 export declare function resolveTreeseedDeployConfigPath(configPath?: string): string;
 export declare function resolveTreeseedDeployConfigPathFromRoot(tenantRoot: string, configPath?: string): string;
 export declare function deriveCloudflareWorkerName(config: TreeseedDeployConfig): string;
+export declare function resolveTreeseedWebCachePolicy(config: TreeseedDeployConfig): {
+    sourcePages: {
+        paths: string[];
+        browserTtlSeconds: number;
+        edgeTtlSeconds: number;
+        staleWhileRevalidateSeconds: number;
+        staleIfErrorSeconds: number;
+    };
+    contentPages: Required<TreeseedWebCachePolicyConfig>;
+    r2PublishedObjects: Required<TreeseedWebCachePolicyConfig>;
+};
 export declare function loadTreeseedDeployConfig(configPath?: string): TreeseedDeployConfig;
 export declare function loadTreeseedDeployConfigFromPath(resolvedConfigPath: string): TreeseedDeployConfig;