@treeseed/sdk 0.4.13 → 0.5.1

package/dist/platform/environment.d.ts

@@ -2,18 +2,23 @@ import type { TreeseedDeployConfig, TreeseedTenantConfig } from './contracts.ts'
 import { type LoadedTreeseedPluginEntry } from './plugins.ts';
 export declare const TREESEED_ENVIRONMENT_SCOPES: readonly ["local", "staging", "prod"];
 export declare const TREESEED_ENVIRONMENT_REQUIREMENTS: readonly ["required", "conditional", "optional"];
-export declare const TREESEED_ENVIRONMENT_TARGETS: readonly ["local-file", "wrangler-dev-vars", "github-secret", "github-variable", "cloudflare-secret", "cloudflare-var", "railway-secret", "railway-var", "config-file"];
+export declare const TREESEED_ENVIRONMENT_TARGETS: readonly ["local-runtime", "local-cloudflare", "github-secret", "github-variable", "cloudflare-secret", "cloudflare-var", "railway-secret", "railway-var", "config-file"];
 export declare const TREESEED_ENVIRONMENT_PURPOSES: readonly ["dev", "save", "deploy", "destroy", "config"];
 export declare const TREESEED_ENVIRONMENT_SENSITIVITY: readonly ["secret", "plain", "derived"];
 export declare const TREESEED_ENVIRONMENT_STORAGE: readonly ["scoped", "shared"];
+export declare const TREESEED_CONFIG_STARTUP_PROFILES: readonly ["core", "optional", "advanced"];
 export type TreeseedEnvironmentScope = (typeof TREESEED_ENVIRONMENT_SCOPES)[number];
 export type TreeseedEnvironmentRequirement = (typeof TREESEED_ENVIRONMENT_REQUIREMENTS)[number];
 export type TreeseedEnvironmentTarget = (typeof TREESEED_ENVIRONMENT_TARGETS)[number];
 export type TreeseedEnvironmentPurpose = (typeof TREESEED_ENVIRONMENT_PURPOSES)[number];
 export type TreeseedEnvironmentSensitivity = (typeof TREESEED_ENVIRONMENT_SENSITIVITY)[number];
 export type TreeseedEnvironmentStorage = (typeof TREESEED_ENVIRONMENT_STORAGE)[number];
+export type TreeseedConfigStartupProfile = (typeof TREESEED_CONFIG_STARTUP_PROFILES)[number];
 export type TreeseedEnvironmentValidation = {
-    kind: 'string' | 'nonempty' | 'boolean' | 'number' | 'url' | 'email';
+    kind: 'string' | 'nonempty' | 'url' | 'email';
+    minLength?: number;
+} | {
+    kind: 'boolean' | 'number';
 } | {
     kind: 'enum';
     values: string[];
@@ -60,6 +65,9 @@ export type TreeseedEnvironmentEntry = {
     id: string;
     label: string;
     group: string;
+    cluster?: string;
+    onboardingFeature?: string;
+    startupProfile?: TreeseedConfigStartupProfile;
     description: string;
     howToGet: string;
     sensitivity: TreeseedEnvironmentSensitivity;
@@ -76,6 +84,9 @@ export type TreeseedEnvironmentEntry = {
     requiredWhen?: (context: TreeseedEnvironmentContext, scope: TreeseedEnvironmentScope, purpose?: TreeseedEnvironmentPurpose) => boolean;
 };
 export type TreeseedEnvironmentEntryYaml = Omit<TreeseedEnvironmentEntry, 'id' | 'defaultValue' | 'localDefaultValue' | 'isRelevant' | 'requiredWhen'> & {
+    cluster?: string;
+    onboardingFeature?: string;
+    startupProfile?: TreeseedConfigStartupProfile;
     defaultValueRef?: string;
     localDefaultValueRef?: string;
     relevanceRef?: string;

package/dist/platform/environment.js

@@ -9,8 +9,8 @@ import { loadTreeseedManifest } from "./tenant-config.js";
 const TREESEED_ENVIRONMENT_SCOPES = ["local", "staging", "prod"];
 const TREESEED_ENVIRONMENT_REQUIREMENTS = ["required", "conditional", "optional"];
 const TREESEED_ENVIRONMENT_TARGETS = [
-  "local-file",
-  "wrangler-dev-vars",
+  "local-runtime",
+  "local-cloudflare",
   "github-secret",
   "github-variable",
   "cloudflare-secret",
@@ -22,8 +22,17 @@ const TREESEED_ENVIRONMENT_TARGETS = [
 const TREESEED_ENVIRONMENT_PURPOSES = ["dev", "save", "deploy", "destroy", "config"];
 const TREESEED_ENVIRONMENT_SENSITIVITY = ["secret", "plain", "derived"];
 const TREESEED_ENVIRONMENT_STORAGE = ["scoped", "shared"];
+const TREESEED_CONFIG_STARTUP_PROFILES = ["core", "optional", "advanced"];
 const moduleDir = dirname(fileURLToPath(import.meta.url));
-const CORE_ENVIRONMENT_PATH = resolve(moduleDir, "env.yaml");
+function resolveCoreEnvironmentPath() {
+  const candidates = [
+    resolve(moduleDir, "env.yaml"),
+    resolve(moduleDir, "../src/platform/env.yaml"),
+    resolve(moduleDir, "../dist/platform/env.yaml")
+  ];
+  return candidates.find((candidate) => existsSync(candidate)) ?? candidates[0];
+}
+const CORE_ENVIRONMENT_PATH = resolveCoreEnvironmentPath();
 const TENANT_ENVIRONMENT_OVERLAY_PATH = "src/env.yaml";
 function loadOptionalTenantConfig() {
   try {
@@ -33,16 +42,31 @@ function loadOptionalTenantConfig() {
   }
 }
 function turnstileEnabled(context) {
-  return context.deployConfig.turnstile?.enabled !== false;
+  return context.deployConfig.turnstile?.enabled === true;
 }
 function smtpEnabled(context) {
   return context.deployConfig.smtp?.enabled === true;
 }
 function railwayManagedEnabled(context) {
+  if (context.deployConfig.runtime?.mode === "treeseed_managed") {
+    return true;
+  }
+  if (context.deployConfig.runtime?.mode && context.deployConfig.runtime.mode !== "treeseed_managed") {
+    return false;
+  }
   return Object.values(context.deployConfig.services ?? {}).some(
     (service) => service && service.enabled !== false && (service.provider ?? "railway") === "railway"
   );
 }
+function resolveHubMode(context) {
+  return context.deployConfig.hub?.mode ?? "treeseed_hosted";
+}
+function resolveRuntimeMode(context) {
+  return context.deployConfig.runtime?.mode ?? "none";
+}
+function resolveRuntimeRegistration(context) {
+  return context.deployConfig.runtime?.registration ?? "none";
+}
 function resolveHostingKind(context) {
   return context.deployConfig.hosting?.kind ?? "self_hosted_project";
 }
@@ -59,14 +83,26 @@ function selfHostedProjectEnabled(context) {
   return resolveHostingKind(context) === "self_hosted_project";
 }
 function projectRegistrationEnabled(context) {
-  if (hostedProjectEnabled(context)) {
-    return true;
-  }
-  return selfHostedProjectEnabled(context) && resolveHostingRegistration(context) === "optional";
+  return resolveRuntimeRegistration(context) === "optional" || resolveRuntimeRegistration(context) === "required";
 }
 function generatedSecret(bytes = 24) {
   return randomBytes(bytes).toString("hex");
 }
+function localTimezoneDefault() {
+  return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+}
+function localMailpitHostDefault() {
+  return "127.0.0.1";
+}
+function localMailpitPortDefault() {
+  return "1025";
+}
+function contactEmailDefault(context) {
+  return context.deployConfig.contactEmail?.trim() || "contact@example.com";
+}
+function workdayWindowsDefault() {
+  return JSON.stringify([{ days: [1, 2, 3, 4, 5], startTime: "09:00", endTime: "17:00" }]);
+}
 function normalizeUrl(value) {
   return value.trim().replace(/\/$/u, "");
 }
@@ -124,29 +160,32 @@ function resolveApiWebServiceId(values = {}) {
   return values.TREESEED_WEB_SERVICE_ID?.trim() || "web";
 }
 function resolvePagesProjectName(context) {
-  return context.deployConfig.cloudflare.pages?.projectName?.trim() || context.deployConfig.slug;
+  return context.deployConfig.slug;
 }
-function resolvePagesPreviewProjectName(context) {
-  return context.deployConfig.cloudflare.pages?.previewProjectName?.trim() || `${context.deployConfig.cloudflare.pages?.projectName?.trim() || context.deployConfig.slug}-staging`;
+function resolvePagesPreviewProjectName(context, _scope, values = {}) {
+  return values.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME?.trim() || `${context.deployConfig.slug}-staging`;
 }
 function resolveContentBucketName(context) {
-  return context.deployConfig.cloudflare.r2?.bucketName?.trim() || `${context.deployConfig.slug}-content`;
+  return `${context.deployConfig.slug}-content`;
 }
 function resolveContentBucketBinding(context) {
   return context.deployConfig.cloudflare.r2?.binding?.trim() || "TREESEED_CONTENT_BUCKET";
 }
-function resolveMarketBaseUrl(context) {
-  return context.deployConfig.hosting?.marketBaseUrl?.trim() || context.deployConfig.services?.api?.environments?.prod?.baseUrl?.trim() || context.deployConfig.services?.api?.publicBaseUrl?.trim() || "https://api.treeseed.ai";
+function resolveMarketBaseUrl(context, _scope, values = {}) {
+  return values.TREESEED_API_BASE_URL?.trim() || context.deployConfig.services?.api?.environments?.prod?.baseUrl?.trim() || "https://api.treeseed.ai";
 }
 function resolveHostedTeamId(context) {
-  return context.deployConfig.hosting?.teamId?.trim() || context.deployConfig.slug;
+  return context.deployConfig.slug;
 }
 function resolveHostedProjectId(context) {
-  return context.deployConfig.hosting?.projectId?.trim() || context.deployConfig.slug;
+  return context.deployConfig.slug;
 }
 const VALUE_RESOLVERS = {
   generatedSecret: () => generatedSecret(),
   localFormsBypassDefault: () => "true",
+  localMailpitHostDefault: () => localMailpitHostDefault(),
+  localMailpitPortDefault: () => localMailpitPortDefault(),
+  contactEmailDefault: (context) => contactEmailDefault(context),
   projectDomainsDefault: (context) => primaryHostFromUrl(context.deployConfig.siteUrl),
   apiBaseUrlDefault: (context, scope, values) => resolveConfiguredApiBaseUrl(context, scope, values),
   webServiceIdDefault: (_context, _scope, values) => resolveWebServiceId(values),
@@ -157,9 +196,24 @@ const VALUE_RESOLVERS = {
   contentBucketBindingDefault: (context) => resolveContentBucketBinding(context),
   hostingKindDefault: (context) => resolveHostingKind(context),
   hostingRegistrationDefault: (context) => resolveHostingRegistration(context),
+  hubModeDefault: (context) => resolveHubMode(context),
+  runtimeModeDefault: (context) => resolveRuntimeMode(context),
+  runtimeRegistrationDefault: (context) => resolveRuntimeRegistration(context),
   marketBaseUrlDefault: (context) => resolveMarketBaseUrl(context),
   hostingTeamIdDefault: (context) => resolveHostedTeamId(context),
-  hostingProjectIdDefault: (context) => resolveHostedProjectId(context)
+  hostingProjectIdDefault: (context) => resolveHostedProjectId(context),
+  agentPoolMinWorkersDefault: () => "0",
+  agentPoolMaxWorkersDefault: () => "2",
+  agentPoolTargetQueueDepthDefault: () => "1",
+  agentPoolCooldownSecondsDefault: () => "60",
+  workdayTimezoneDefault: () => localTimezoneDefault(),
+  workdayWindowsDefault: () => workdayWindowsDefault(),
+  workdayTaskCreditBudgetDefault: () => "20",
+  managerMaxQueuedTasksDefault: () => "5",
+  managerMaxQueuedCreditsDefault: () => "20",
+  managerPriorityModelsDefault: () => "objective,question,note,page,book,knowledge",
+  taskCreditWeightsDefault: () => "[]",
+  workerPoolScalerDefault: (context) => railwayManagedEnabled(context) ? "railway" : "noop"
 };
 const PREDICATES = {
   turnstileEnabled: (context) => turnstileEnabled(context),
@@ -167,6 +221,11 @@ const PREDICATES = {
   smtpEnabled: (context) => smtpEnabled(context),
   smtpNonLocal: (context, scope) => smtpEnabled(context) && scope !== "local",
   railwayManagedEnabled: (context) => railwayManagedEnabled(context),
+  hubTreeseedHosted: (context) => resolveHubMode(context) === "treeseed_hosted",
+  hubCustomerHosted: (context) => resolveHubMode(context) === "customer_hosted",
+  runtimeNone: (context) => resolveRuntimeMode(context) === "none",
+  runtimeByoAttached: (context) => resolveRuntimeMode(context) === "byo_attached",
+  runtimeTreeseedManaged: (context) => resolveRuntimeMode(context) === "treeseed_managed",
   marketControlPlaneEnabled: (context) => marketControlPlaneEnabled(context),
   hostedProjectEnabled: (context) => hostedProjectEnabled(context),
   selfHostedProjectEnabled: (context) => selfHostedProjectEnabled(context),
@@ -251,6 +310,9 @@ function materializeEntry(id, entry) {
   return {
     ...entry,
     id,
+    cluster: entry.cluster ?? `${entry.group}:${id}`,
+    onboardingFeature: entry.onboardingFeature,
+    startupProfile: entry.startupProfile ?? (entry.onboardingFeature ? "optional" : entry.group === "auth" || entry.id === "TREESEED_FORM_TOKEN_SECRET" || entry.group === "local-development" ? "core" : "advanced"),
     storage: entry.storage ?? "scoped",
     defaultValue: resolveNamedValueResolver(entry.defaultValueRef),
     localDefaultValue: resolveNamedValueResolver(entry.localDefaultValueRef),
@@ -260,7 +322,7 @@ function materializeEntry(id, entry) {
 }
 function mergeEntryYaml(baseEntry, id, override) {
   const merged = baseEntry ? deepMerge(baseEntry, override) : override;
-  if (typeof merged.label !== "string" || typeof merged.group !== "string" || typeof merged.description !== "string" || typeof merged.howToGet !== "string" || !Array.isArray(merged.targets) || !Array.isArray(merged.scopes) || typeof merged.requirement !== "string" || !Array.isArray(merged.purposes) || typeof merged.sensitivity !== "string") {
+  if (typeof merged.label !== "string" || typeof merged.group !== "string" || merged.cluster !== void 0 && typeof merged.cluster !== "string" || merged.onboardingFeature !== void 0 && typeof merged.onboardingFeature !== "string" || merged.startupProfile !== void 0 && !TREESEED_CONFIG_STARTUP_PROFILES.includes(merged.startupProfile) || typeof merged.description !== "string" || typeof merged.howToGet !== "string" || !Array.isArray(merged.targets) || !Array.isArray(merged.scopes) || typeof merged.requirement !== "string" || !Array.isArray(merged.purposes) || typeof merged.sensitivity !== "string") {
     throw new Error(`Treeseed environment registry entry "${id}" is missing required metadata after merge.`);
   }
   return merged;
@@ -384,8 +446,15 @@ function validateValue(entry, value) {
   }
   switch (entry.validation.kind) {
     case "string":
-    case "nonempty":
-      return valuePresent(value) ? null : `${entry.id} must be a non-empty string.`;
+    case "nonempty": {
+      if (!valuePresent(value)) {
+        return `${entry.id} must be a non-empty string.`;
+      }
+      if (typeof entry.validation.minLength === "number" && value.trim().length < entry.validation.minLength) {
+        return `${entry.id} must be at least ${entry.validation.minLength} characters.`;
+      }
+      return null;
+    }
     case "boolean":
       return /^(true|false|1|0)$/i.test(value) ? null : `${entry.id} must be true or false.`;
     case "number":
@@ -447,6 +516,7 @@ function validateTreeseedEnvironmentValues(options) {
   };
 }
 export {
+  TREESEED_CONFIG_STARTUP_PROFILES,
   TREESEED_ENVIRONMENT_PURPOSES,
   TREESEED_ENVIRONMENT_REQUIREMENTS,
   TREESEED_ENVIRONMENT_SCOPES,

package/dist/platform/plugins/constants.d.ts

@@ -15,6 +15,7 @@ export declare const TREESEED_DEFAULT_PROVIDER_SELECTIONS: {
         runtime: string;
         publish: string;
         docs: string;
+        serving: string;
     };
     site: string;
 };

package/dist/platform/plugins/constants.js

@@ -3,18 +3,19 @@ const TREESEED_DEFAULT_PROVIDER_SELECTIONS = {
   forms: "store_only",
   operations: "default",
   agents: {
-    execution: "stub",
+    execution: "copilot",
     mutation: "local_branch",
-    repository: "stub",
-    verification: "stub",
-    notification: "stub",
-    research: "stub"
+    repository: "git",
+    verification: "local",
+    notification: "sdk_message",
+    research: "project_graph"
   },
   deploy: "cloudflare",
   content: {
     runtime: "team_scoped_r2_overlay",
     publish: "team_scoped_r2_overlay",
-    docs: "default"
+    docs: "default",
+    serving: "local_collections"
   },
   site: "default"
 };

package/dist/platform/tenant/runtime-config.js

@@ -14,6 +14,8 @@ function fallbackTenantConfig(projectRoot) {
       notes: resolve(projectRoot, "src/content/notes"),
       questions: resolve(projectRoot, "src/content/questions"),
       objectives: resolve(projectRoot, "src/content/objectives"),
+      proposals: resolve(projectRoot, "src/content/proposals"),
+      decisions: resolve(projectRoot, "src/content/decisions"),
       people: resolve(projectRoot, "src/content/people"),
       agents: resolve(projectRoot, "src/content/agents"),
       books: resolve(projectRoot, "src/content/books"),
@@ -24,7 +26,12 @@ function fallbackTenantConfig(projectRoot) {
     },
     features: {
       docs: true,
-      books: true
+      books: true,
+      notes: true,
+      questions: true,
+      objectives: true,
+      proposals: true,
+      decisions: true
     }
   };
 }

package/dist/platform/tenant-config.js

@@ -21,6 +21,8 @@ const manifestContentFieldAliases = {
   notes: { key: "notes", aliases: ["notes_root"] },
   questions: { key: "questions", aliases: ["questions_root"] },
   objectives: { key: "objectives", aliases: ["objectives_root"] },
+  proposals: { key: "proposals", aliases: ["proposals_root"] },
+  decisions: { key: "decisions", aliases: ["decisions_root"] },
   people: { key: "people", aliases: ["people_root"] },
   agents: { key: "agents", aliases: ["agents_root"] },
   books: { key: "books", aliases: ["books_root"] },
@@ -183,6 +185,8 @@ const MODEL_FEATURE_MAP = {
   notes: "notes",
   questions: "questions",
   objectives: "objectives",
+  proposals: "proposals",
+  decisions: "decisions",
   agents: "agents"
 };
 function tenantModelRendered(tenantConfig, modelName) {

package/dist/platform/utils/site-config-schema.js

@@ -312,6 +312,8 @@ export function parseSiteConfig(source) {
 	const noteModel = expectRecord(models.notes ?? {}, 'models.notes');
 	const questionModel = expectRecord(models.questions ?? {}, 'models.questions');
 	const objectiveModel = expectRecord(models.objectives ?? {}, 'models.objectives');
+	const proposalModel = expectRecord(models.proposals ?? {}, 'models.proposals');
+	const decisionModel = expectRecord(models.decisions ?? {}, 'models.decisions');
 	const peopleModel = expectRecord(models.people ?? {}, 'models.people');
 	const agentModel = expectRecord(models.agents ?? {}, 'models.agents');
 	const bookModel = expectRecord(models.books ?? {}, 'models.books');
@@ -320,6 +322,8 @@ export function parseSiteConfig(source) {
 	const noteDefaults = expectRecord(noteModel.defaults ?? {}, 'models.notes.defaults');
 	const questionDefaults = expectRecord(questionModel.defaults ?? {}, 'models.questions.defaults');
 	const objectiveDefaults = expectRecord(objectiveModel.defaults ?? {}, 'models.objectives.defaults');
+	const proposalDefaults = expectRecord(proposalModel.defaults ?? {}, 'models.proposals.defaults');
+	const decisionDefaults = expectRecord(decisionModel.defaults ?? {}, 'models.decisions.defaults');
 	const peopleDefaults = expectRecord(peopleModel.defaults ?? {}, 'models.people.defaults');
 	const agentDefaults = normalizeAliasedRecord(agentDefaultsFieldAliases, expectRecord(agentModel.defaults ?? {}, 'models.agents.defaults'));
 	const bookDefaults = expectRecord(bookModel.defaults ?? {}, 'models.books.defaults');
@@ -394,6 +398,20 @@ export function parseSiteConfig(source) {
 					status: optionalString(objectiveDefaults.status, 'models.objectives.defaults.status'),
 				},
 			},
+			proposals: {
+				defaults: {
+					draft: optionalBoolean(proposalDefaults.draft, 'models.proposals.defaults.draft'),
+					tags: stringArray(proposalDefaults.tags, 'models.proposals.defaults.tags'),
+					status: optionalString(proposalDefaults.status, 'models.proposals.defaults.status'),
+				},
+			},
+			decisions: {
+				defaults: {
+					draft: optionalBoolean(decisionDefaults.draft, 'models.decisions.defaults.draft'),
+					tags: stringArray(decisionDefaults.tags, 'models.decisions.defaults.tags'),
+					status: optionalString(decisionDefaults.status, 'models.decisions.defaults.status'),
+				},
+			},
 			people: {
 				defaults: {
 					status: optionalString(peopleDefaults.status, 'models.people.defaults.status'),

package/dist/plugin-default.js

@@ -10,8 +10,8 @@ var plugin_default_default = defineTreeseedPlugin({
       mutation: ["local_branch"],
       repository: ["stub", "git"],
       verification: ["stub", "local"],
-      notification: ["stub"],
-      research: ["stub"],
+      notification: ["stub", "sdk_message"],
+      research: ["stub", "project_graph"],
       handlers: [
         "planner",
         "architect",

package/dist/scripts/key-agent.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import { createInterface } from 'node:readline';
+import { stdin as input, stdout as output } from 'node:process';
+import { assertTreeseedKeyAgentResponse, getTreeseedKeyAgentPaths, readWrappedMachineKeyFile, requestTreeseedKeyAgent, startTreeseedKeyAgentServer, TREESEED_KEY_AGENT_IDLE_TIMEOUT_MS, TreeseedKeyAgentError, TRESEED_MACHINE_KEY_PASSPHRASE_ENV, } from '../operations/services/key-agent.js';
+function parseArgs(argv) {
+    const [mode = 'request', ...rest] = argv;
+    const parsed = {
+        mode,
+        payload: '',
+        keyPath: '',
+        socketPath: '',
+        idleTimeoutMs: TREESEED_KEY_AGENT_IDLE_TIMEOUT_MS,
+        allowMigration: false,
+        createIfMissing: false,
+    };
+    while (rest.length > 0) {
+        const current = rest.shift();
+        if (!current) {
+            continue;
+        }
+        if (!parsed.payload && !current.startsWith('--')) {
+            parsed.payload = current;
+            continue;
+        }
+        if (current === '--key-path') {
+            parsed.keyPath = rest.shift() ?? '';
+            continue;
+        }
+        if (current === '--socket-path') {
+            parsed.socketPath = rest.shift() ?? '';
+            continue;
+        }
+        if (current === '--idle-timeout-ms') {
+            parsed.idleTimeoutMs = Number.parseInt(rest.shift() ?? String(TREESEED_KEY_AGENT_IDLE_TIMEOUT_MS), 10);
+            continue;
+        }
+        if (current === '--allow-migration') {
+            parsed.allowMigration = true;
+            continue;
+        }
+        if (current === '--create-if-missing') {
+            parsed.createIfMissing = true;
+            continue;
+        }
+    }
+    return parsed;
+}
+function writeJson(payload) {
+    process.stdout.write(`${JSON.stringify(payload)}\n`);
+}
+function prompt(question, secret = false) {
+    return new Promise((resolvePromise) => {
+        if (!secret) {
+            const rl = createInterface({ input, output });
+            rl.question(question, (answer) => {
+                rl.close();
+                resolvePromise(answer);
+            });
+            return;
+        }
+        const rl = createInterface({ input, output, terminal: true });
+        const previousWrite = rl._writeToOutput;
+        rl._writeToOutput = function _writeToOutput(text) {
+            if (text.trim()) {
+                output.write('*');
+            }
+        };
+        rl.question(question, (answer) => {
+            output.write('\n');
+            rl.close();
+            rl._writeToOutput = previousWrite;
+            resolvePromise(answer);
+        });
+    });
+}
+async function runInteractiveUnlock(parsed) {
+    const wrapped = readWrappedMachineKeyFile(parsed.keyPath);
+    if (wrapped.exists && !wrapped.wrapped && !wrapped.migrationRequired) {
+        throw new TreeseedKeyAgentError('corrupt_wrapped_key', 'Unable to read the existing Treeseed machine key file.');
+    }
+    const needsCreation = !wrapped.exists;
+    const needsMigration = wrapped.migrationRequired;
+    let passphrase = '';
+    if (needsCreation || needsMigration) {
+        const action = needsCreation ? 'Create a new Treeseed passphrase: ' : 'Create a new Treeseed passphrase to wrap the existing machine key: ';
+        const first = (await prompt(action, true)).trim();
+        if (!first) {
+            throw new TreeseedKeyAgentError('interactive_required', 'A non-empty passphrase is required.');
+        }
+        const second = (await prompt('Confirm passphrase: ', true)).trim();
+        if (first !== second) {
+            throw new TreeseedKeyAgentError('unlock_failed', 'The passphrase confirmation did not match.');
+        }
+        passphrase = first;
+    }
+    else {
+        passphrase = (await prompt('Treeseed passphrase: ', true)).trim();
+        if (!passphrase) {
+            throw new TreeseedKeyAgentError('interactive_required', 'A passphrase is required to unlock the Treeseed machine key.');
+        }
+    }
+    const response = await requestTreeseedKeyAgent({
+        command: 'unlock',
+        keyPath: parsed.keyPath,
+        socketPath: parsed.socketPath,
+        idleTimeoutMs: parsed.idleTimeoutMs,
+        passphrase,
+        createIfMissing: needsCreation || parsed.createIfMissing,
+        allowMigration: needsMigration || parsed.allowMigration,
+    });
+    assertTreeseedKeyAgentResponse(response);
+    writeJson(response);
+}
+async function main() {
+    const parsed = parseArgs(process.argv.slice(2));
+    const defaults = getTreeseedKeyAgentPaths();
+    parsed.socketPath ||= defaults.socketPath;
+    if (parsed.mode === 'serve') {
+        if (!parsed.keyPath) {
+            throw new Error('Missing --key-path for key-agent serve mode.');
+        }
+        await startTreeseedKeyAgentServer({
+            keyPath: parsed.keyPath,
+            socketPath: parsed.socketPath,
+            idleTimeoutMs: parsed.idleTimeoutMs,
+        });
+        await new Promise(() => { });
+        return;
+    }
+    if (parsed.mode === 'unlock-interactive') {
+        await runInteractiveUnlock(parsed);
+        return;
+    }
+    if (parsed.mode === 'unlock-from-env') {
+        const passphrase = String(process.env[TRESEED_MACHINE_KEY_PASSPHRASE_ENV] ?? '').trim();
+        if (!passphrase) {
+            throw new TreeseedKeyAgentError('interactive_required', `Set ${TRESEED_MACHINE_KEY_PASSPHRASE_ENV} before using unlock-from-env.`);
+        }
+        const response = await requestTreeseedKeyAgent({
+            command: 'unlock',
+            keyPath: parsed.keyPath,
+            socketPath: parsed.socketPath,
+            idleTimeoutMs: parsed.idleTimeoutMs,
+            passphrase,
+            createIfMissing: parsed.createIfMissing,
+            allowMigration: parsed.allowMigration,
+        });
+        assertTreeseedKeyAgentResponse(response);
+        writeJson(response);
+        return;
+    }
+    const payload = JSON.parse(parsed.payload);
+    const response = await requestTreeseedKeyAgent(payload);
+    writeJson(response);
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error instanceof TreeseedKeyAgentError ? error.code : 'unlock_failed';
+    writeJson({
+        ok: false,
+        code,
+        message,
+    });
+    process.exit(1);
+});

package/dist/scripts/tenant-build.js

@@ -1,7 +1,10 @@
 import { resolveAstroBin, createProductionBuildEnv, packageScriptPath, runNodeBinary, runNodeScript } from '../operations/services/runtime-tools.js';
 process.env.TREESEED_LOCAL_DEV_MODE = process.env.TREESEED_LOCAL_DEV_MODE ?? 'cloudflare';
+const publishedRuntime = process.env.TREESEED_CONTENT_SERVING_MODE === 'published_runtime';
 runNodeScript(packageScriptPath('patch-starlight-content-path'), [], { cwd: process.cwd() });
-runNodeScript(packageScriptPath('aggregate-book'), [], { cwd: process.cwd() });
+if (!publishedRuntime) {
+    runNodeScript(packageScriptPath('aggregate-book'), [], { cwd: process.cwd() });
+}
 runNodeBinary(resolveAstroBin(), ['build'], {
     cwd: process.cwd(),
     env: createProductionBuildEnv({

package/dist/scripts/tenant-check.js

@@ -1,6 +1,9 @@
 import { resolveAstroBin, createProductionBuildEnv, packageScriptPath, runNodeBinary, runNodeScript } from '../operations/services/runtime-tools.js';
+const publishedRuntime = process.env.TREESEED_CONTENT_SERVING_MODE === 'published_runtime';
 runNodeScript(packageScriptPath('patch-starlight-content-path'), [], { cwd: process.cwd() });
-runNodeScript(packageScriptPath('aggregate-book'), [], { cwd: process.cwd() });
+if (!publishedRuntime) {
+    runNodeScript(packageScriptPath('aggregate-book'), [], { cwd: process.cwd() });
+}
 runNodeBinary(resolveAstroBin(), ['check'], {
     cwd: process.cwd(),
     env: createProductionBuildEnv(),

package/dist/scripts/tenant-deploy.js

@@ -3,9 +3,9 @@ import { spawnSync } from 'node:child_process';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { applyTreeseedEnvironmentToProcess } from '../operations/services/config-runtime.js';
-import { assertDeploymentInitialized, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, ensureGeneratedWranglerConfig, finalizeDeploymentState, runRemoteD1Migrations, } from '../operations/services/deploy.js';
+import { assertDeploymentInitialized, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, ensureGeneratedWranglerConfig, finalizeDeploymentState, loadDeployState, runRemoteD1Migrations, } from '../operations/services/deploy.js';
 import { currentManagedBranch, PRODUCTION_BRANCH, STAGING_BRANCH } from '../operations/services/git-workflow.js';
-import { packageScriptPath, resolveWranglerBin } from '../operations/services/runtime-tools.js';
+import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin } from '../operations/services/runtime-tools.js';
 import { runTenantDeployPreflight } from '../operations/services/save-deploy-preflight.js';
 const tenantRoot = process.cwd();
 const args = process.argv.slice(2);
@@ -109,6 +109,27 @@ function runWranglerDeploy(configPath) {
         process.exit(result.status ?? 1);
     }
 }
+function runWranglerPagesDeploy(projectName, branchName, outputDir = 'dist') {
+    const args = [
+        resolveWranglerBin(),
+        'pages',
+        'deploy',
+        outputDir,
+        '--project-name',
+        projectName,
+    ];
+    if (branchName) {
+        args.push('--branch', branchName);
+    }
+    const result = spawnSync(process.execPath, args, {
+        stdio: 'inherit',
+        cwd: tenantRoot,
+        env: { ...process.env },
+    });
+    if (result.status !== 0) {
+        process.exit(result.status ?? 1);
+    }
+}
 async function main() {
     const options = parseArgs(args);
     const { target, scope } = resolveTarget(options);
@@ -142,6 +163,14 @@ async function main() {
         throw error;
     }
     const { wranglerPath } = ensureGeneratedWranglerConfig(tenantRoot, { target });
+    const deployConfig = loadCliDeployConfig(tenantRoot);
+    const deployState = loadDeployState(tenantRoot, deployConfig, { target });
+    const pagesProjectName = target.kind === 'persistent' ? deployState.pages?.projectName ?? null : null;
+    const pagesBranchName = target.kind === 'persistent'
+        ? (target.scope === 'prod'
+            ? deployState.pages?.productionBranch ?? 'main'
+            : deployState.pages?.stagingBranch ?? 'staging')
+        : null;
     if (shouldRun('migrate')) {
         const result = runRemoteD1Migrations(tenantRoot, { dryRun: options.dryRun, target });
         console.log(`${options.dryRun ? 'Planned' : 'Applied'} remote migrations for ${result.databaseName}.`);
@@ -156,10 +185,20 @@ async function main() {
     }
     if (shouldRun('publish')) {
         if (options.dryRun) {
-            console.log(`Dry run: would deploy ${deployTargetLabel(target)} with generated Wrangler config at ${resolve(wranglerPath)}.`);
+            if (pagesProjectName) {
+                console.log(`Dry run: would deploy ${deployTargetLabel(target)} to Pages project ${pagesProjectName} from ${resolve(tenantRoot, 'dist')}.`);
+            }
+            else {
+                console.log(`Dry run: would deploy ${deployTargetLabel(target)} with generated Wrangler config at ${resolve(wranglerPath)}.`);
+            }
         }
         else {
-            runWranglerDeploy(wranglerPath);
+            if (pagesProjectName) {
+                runWranglerPagesDeploy(pagesProjectName, pagesBranchName, resolve(tenantRoot, 'dist'));
+            }
+            else {
+                runWranglerDeploy(wranglerPath);
+            }
             finalizeDeploymentState(tenantRoot, { target });
         }
     }