@treeseed/sdk 0.4.13 → 0.5.1

package/dist/workflow-state.js

@@ -1,6 +1,16 @@
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { getTreeseedMachineConfigPaths, resolveTreeseedRemoteSession } from "./operations/services/config-runtime.js";
+import {
+  getTreeseedMachineConfigPaths,
+  inspectTreeseedKeyAgentStatus,
+  loadTreeseedMachineConfig,
+  resolveTreeseedMachineEnvironmentValues,
+  resolveTreeseedRemoteSession,
+  collectTreeseedEnvironmentContext,
+  withTreeseedKeyAgentAutopromptDisabled
+} from "./operations/services/config-runtime.js";
+import { validateTreeseedEnvironmentValues } from "./platform/environment.js";
+import { resolveTreeseedWebCachePolicy } from "./platform/deploy-config.js";
 import {
   createBranchPreviewDeployTarget,
   createPersistentDeployTarget,
@@ -17,31 +27,33 @@ import {
 } from "./workflow/policy.js";
 function emptyPersistentEnvironments() {
   return {
-    local: { initialized: false, lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
-    staging: { initialized: false, lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
-    prod: { initialized: false, lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null }
+    local: { initialized: false, phase: "pending", configured: false, provisioned: false, deployable: false, blockers: [], warnings: [], lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
+    staging: { initialized: false, phase: "pending", configured: false, provisioned: false, deployable: false, blockers: [], warnings: [], lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
+    prod: { initialized: false, phase: "pending", configured: false, provisioned: false, deployable: false, blockers: [], warnings: [], lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null }
   };
 }
 function readinessForEnvironment(state, scope) {
-  const blockers = [];
-  const warnings = [];
+  const blockers = [...state.persistentEnvironments[scope].blockers];
+  const warnings = [...state.persistentEnvironments[scope].warnings];
   if (!state.deployConfigPresent) {
     blockers.push("Missing treeseed.site.yaml.");
   }
   if (!state.files.machineConfig) {
     blockers.push("Missing Treeseed machine config.");
   }
-  if (scope === "local") {
-    if (!state.files.envLocal) {
-      blockers.push("Missing .env.local.");
-    }
-    if (!state.files.devVars) {
-      warnings.push("Missing .dev.vars.");
-    }
-  } else {
+  if (!state.secrets.wrappedKeyPresent) {
+    blockers.push("Missing wrapped Treeseed machine key.");
+  }
+  if (state.secrets.migrationRequired) {
+    blockers.push("Treeseed machine key migration is still required.");
+  }
+  if (scope !== "local") {
     if (!state.persistentEnvironments[scope].initialized) {
       blockers.push(`Environment ${scope} is not initialized.`);
     }
+    if (state.persistentEnvironments[scope].configured && !state.persistentEnvironments[scope].provisioned) {
+      warnings.push(`Environment ${scope} is configured but foundational infrastructure has not been provisioned yet.`);
+    }
   }
   return {
     ready: blockers.length === 0,
@@ -49,6 +61,20 @@ function readinessForEnvironment(state, scope) {
     warnings
   };
 }
+function safeResolveRemoteSession(cwd, hostId) {
+  try {
+    return withTreeseedKeyAgentAutopromptDisabled(() => resolveTreeseedRemoteSession(cwd, hostId ?? void 0));
+  } catch {
+    return null;
+  }
+}
+function safeResolveMachineEnvironmentValues(cwd, scope) {
+  try {
+    return withTreeseedKeyAgentAutopromptDisabled(() => resolveTreeseedMachineEnvironmentValues(cwd, scope));
+  } catch {
+    return {};
+  }
+}
 function knownRemoteTrackingBranchExists(repoDir, branchName) {
   try {
     run("git", ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branchName}`], { cwd: repoDir, capture: true });
@@ -111,6 +137,11 @@ function resolveTreeseedWorkflowState(cwd) {
   }
   const preflight = collectCliPreflight({ cwd: effectiveCwd, requireAuth: false });
   const { configPath, keyPath } = getTreeseedMachineConfigPaths(effectiveCwd);
+  const machineConfig = existsSync(configPath) ? loadTreeseedMachineConfig(effectiveCwd) : null;
+  const keyStatus = inspectTreeseedKeyAgentStatus(effectiveCwd);
+  const marketSettings = machineConfig?.settings?.market && typeof machineConfig.settings.market === "object" ? machineConfig.settings.market : null;
+  const runnerHostId = typeof marketSettings?.runnerHostId === "string" && marketSettings.runnerHostId.trim() ? marketSettings.runnerHostId.trim() : typeof marketSettings?.projectId === "string" && marketSettings.projectId.trim() ? `market-runner:${marketSettings.projectId.trim()}` : null;
+  const runnerSession = runnerHostId ? safeResolveRemoteSession(effectiveCwd, runnerHostId) : null;
   const workflowLock = inspectWorkflowLock(effectiveCwd);
   const interruptedRuns = listInterruptedWorkflowRuns(effectiveCwd).map((journal) => ({
     runId: journal.runId,
@@ -164,29 +195,75 @@ function resolveTreeseedWorkflowState(cwd) {
       url: null,
       lastDeploymentTimestamp: null
     },
+    webCache: {
+      webHost: null,
+      contentHost: null,
+      sourcePagePolicy: null,
+      contentPagePolicy: null,
+      r2ObjectPolicy: null,
+      cloudflareRulesManaged: false,
+      lastDeployPurgeAt: null,
+      lastDeployPurgeCount: null,
+      lastContentPurgeAt: null,
+      lastContentPurgeCount: null
+    },
     persistentEnvironments: emptyPersistentEnvironments(),
     auth: {
       gh: preflight.checks.auth.gh?.authenticated === true,
       wrangler: preflight.checks.auth.wrangler?.authenticated === true,
       railway: preflight.checks.auth.railway?.authenticated === true,
       copilot: preflight.checks.auth.copilot?.configured === true,
-      remoteApi: Boolean(resolveTreeseedRemoteSession(cwd))
+      remoteApi: Boolean(safeResolveRemoteSession(cwd))
+    },
+    marketConnection: {
+      configured: Boolean(marketSettings?.baseUrl && marketSettings?.projectId),
+      baseUrl: typeof marketSettings?.baseUrl === "string" ? marketSettings.baseUrl : null,
+      hostId: typeof marketSettings?.hostId === "string" ? marketSettings.hostId : null,
+      teamId: typeof marketSettings?.teamId === "string" ? marketSettings.teamId : null,
+      teamSlug: typeof marketSettings?.teamSlug === "string" ? marketSettings.teamSlug : null,
+      projectId: typeof marketSettings?.projectId === "string" ? marketSettings.projectId : null,
+      projectSlug: typeof marketSettings?.projectSlug === "string" ? marketSettings.projectSlug : null,
+      connectionMode: typeof marketSettings?.connectionMode === "string" ? marketSettings.connectionMode : null,
+      projectApiBaseUrl: typeof marketSettings?.projectApiBaseUrl === "string" ? marketSettings.projectApiBaseUrl : null,
+      hubMode: null,
+      runtimeMode: null,
+      runtimeRegistration: null,
+      runtimeAttached: false,
+      runtimeReady: true,
+      runnerHostId,
+      runnerReady: Boolean(
+        marketSettings?.runnerReady === true || typeof runnerSession?.accessToken === "string" && runnerSession.accessToken.length > 0
+      ),
+      runnerRegisteredAt: typeof marketSettings?.runnerRegisteredAt === "string" ? marketSettings.runnerRegisteredAt : null,
+      runnerLastSeenAt: typeof marketSettings?.runnerLastSeenAt === "string" ? marketSettings.runnerLastSeenAt : null,
+      launchPhase: typeof marketSettings?.launchPhase === "string" ? marketSettings.launchPhase : null,
+      lastSuccessfulPhase: typeof marketSettings?.lastSuccessfulPhase === "string" ? marketSettings.lastSuccessfulPhase : null,
+      githubRepository: typeof marketSettings?.githubRepository === "string" ? marketSettings.githubRepository : null,
+      workflowBootstrapReady: marketSettings?.workflowBootstrapReady === true,
+      currentWorkstreamId: branchRole === "feature" ? branchName : null,
+      verificationPosture: typeof marketSettings?.launchPhase === "string" && marketSettings.launchPhase === "failed" ? "blocked" : "pending",
+      approvalBlockers: Array.isArray(marketSettings?.approvalBlockers) ? marketSettings.approvalBlockers.map(String) : []
     },
     managedServices: {
       api: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
-      agents: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       manager: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       worker: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
-      runner: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       workdayStart: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null },
       workdayReport: { enabled: false, initialized: false, lastDeploymentTimestamp: null, lastDeployedUrl: null, provider: null }
     },
     files: {
       treeseedConfig: tenantRoot,
       machineConfig: existsSync(configPath),
-      machineKey: existsSync(keyPath),
-      envLocal: existsSync(resolve(cwd, ".env.local")),
-      devVars: existsSync(resolve(cwd, ".dev.vars"))
+      machineKey: existsSync(keyPath)
+    },
+    secrets: {
+      keyAgentRunning: keyStatus.running,
+      keyAgentUnlocked: keyStatus.unlocked,
+      wrappedKeyPresent: keyStatus.wrappedKeyPresent,
+      migrationRequired: keyStatus.migrationRequired,
+      idleTimeoutMs: keyStatus.idleTimeoutMs,
+      idleRemainingMs: keyStatus.idleRemainingMs,
+      startupPassphraseConfigured: Boolean(process.env.TREESEED_KEY_PASSPHRASE?.trim())
     },
     releaseReady: branchRole === "staging" && !dirtyWorktree,
     readiness: {
@@ -200,10 +277,59 @@ function resolveTreeseedWorkflowState(cwd) {
   if (tenantRoot) {
     try {
       const deployConfig = loadCliDeployConfig(effectiveCwd);
+      const environmentContext = collectTreeseedEnvironmentContext(effectiveCwd);
+      const sharedConfigValues = safeResolveMachineEnvironmentValues(effectiveCwd, "prod");
+      const runtimeMode = deployConfig.runtime?.mode ?? "none";
+      const runtimeRegistration = deployConfig.runtime?.registration ?? "none";
+      const webCachePolicy = resolveTreeseedWebCachePolicy(deployConfig);
+      const registrationRequired2 = runtimeRegistration === "required";
+      const registrationEnabled = runtimeRegistration === "required" || runtimeRegistration === "optional";
+      const runtimeSessionReady = Boolean(
+        marketSettings?.runnerReady === true || typeof runnerSession?.accessToken === "string" && runnerSession.accessToken.length > 0
+      );
+      state.marketConnection.baseUrl = state.marketConnection.baseUrl ?? sharedConfigValues.TREESEED_MARKET_API_BASE_URL ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? null;
+      state.marketConnection.teamId = state.marketConnection.teamId ?? sharedConfigValues.TREESEED_HOSTING_TEAM_ID ?? deployConfig.runtime?.teamId ?? deployConfig.hosting?.teamId ?? null;
+      state.marketConnection.projectId = state.marketConnection.projectId ?? sharedConfigValues.TREESEED_PROJECT_ID ?? deployConfig.runtime?.projectId ?? deployConfig.hosting?.projectId ?? null;
+      state.marketConnection.hubMode = deployConfig.hub?.mode ?? null;
+      state.marketConnection.runtimeMode = runtimeMode;
+      state.marketConnection.runtimeRegistration = runtimeRegistration;
+      state.marketConnection.runtimeAttached = runtimeMode !== "none" && (!registrationEnabled || state.marketConnection.configured);
+      state.marketConnection.runtimeReady = runtimeMode === "none" || !registrationEnabled || runtimeSessionReady;
+      state.marketConnection.runnerReady = runtimeSessionReady;
+      state.webCache.webHost = deployConfig.surfaces?.web?.publicBaseUrl ?? deployConfig.siteUrl ?? null;
+      state.webCache.contentHost = sharedConfigValues.TREESEED_CONTENT_PUBLIC_BASE_URL ?? deployConfig.cloudflare.r2?.publicBaseUrl ?? null;
+      state.webCache.sourcePagePolicy = `browser=${webCachePolicy.sourcePages.browserTtlSeconds}s edge=${webCachePolicy.sourcePages.edgeTtlSeconds}s swr=${webCachePolicy.sourcePages.staleWhileRevalidateSeconds}s sie=${webCachePolicy.sourcePages.staleIfErrorSeconds}s`;
+      state.webCache.contentPagePolicy = `browser=${webCachePolicy.contentPages.browserTtlSeconds}s edge=${webCachePolicy.contentPages.edgeTtlSeconds}s swr=${webCachePolicy.contentPages.staleWhileRevalidateSeconds}s sie=${webCachePolicy.contentPages.staleIfErrorSeconds}s`;
+      state.webCache.r2ObjectPolicy = `browser=${webCachePolicy.r2PublishedObjects.browserTtlSeconds}s edge=${webCachePolicy.r2PublishedObjects.edgeTtlSeconds}s swr=${webCachePolicy.r2PublishedObjects.staleWhileRevalidateSeconds}s sie=${webCachePolicy.r2PublishedObjects.staleIfErrorSeconds}s`;
+      state.marketConnection.configured = registrationRequired2 ? Boolean(state.marketConnection.baseUrl && state.marketConnection.projectId) : state.marketConnection.configured;
       for (const scope of ["local", "staging", "prod"]) {
         const deployState = loadDeployState(effectiveCwd, deployConfig, { target: createPersistentDeployTarget(scope) });
+        const validation = validateTreeseedEnvironmentValues({
+          values: safeResolveMachineEnvironmentValues(effectiveCwd, scope),
+          scope,
+          purpose: "config",
+          deployConfig: environmentContext.context.deployConfig,
+          tenantConfig: environmentContext.context.tenantConfig,
+          plugins: environmentContext.context.plugins
+        });
+        const validationProblems = [...validation.missing, ...validation.invalid].map((problem) => problem.message);
+        const persistentBlockers = Array.isArray(deployState.readiness?.blockers) ? deployState.readiness.blockers.map(String) : [];
+        const persistentWarnings = Array.isArray(deployState.readiness?.warnings) ? deployState.readiness.warnings.map(String) : [];
+        const configured = scope === "local" ? validation.ok : deployState.readiness?.configured === true && validation.ok;
+        const provisioned = scope === "local" ? true : configured && deployState.readiness?.provisioned === true;
+        const deployable = scope === "local" ? validation.ok : configured && deployState.readiness?.deployable === true;
+        const initialized = deployState.readiness?.initialized === true || scope === "local";
         state.persistentEnvironments[scope] = {
-          initialized: deployState.readiness?.initialized === true || scope === "local",
+          initialized,
+          phase: validation.ok ? scope === "local" ? "code_ready" : provisioned ? "provisioned" : configured ? "config_complete" : initialized ? "config_complete" : "pending" : "config_incomplete",
+          configured,
+          provisioned,
+          deployable,
+          blockers: [
+            ...validationProblems,
+            ...persistentBlockers
+          ],
+          warnings: persistentWarnings,
           lastValidatedAt: deployState.readiness?.lastValidatedAt ?? deployState.readiness?.initializedAt ?? null,
           lastDeploymentTimestamp: deployState.lastDeploymentTimestamp ?? null,
           lastDeployedUrl: deployState.lastDeployedUrl ?? null
@@ -218,7 +344,14 @@ function resolveTreeseedWorkflowState(cwd) {
             url: typeof latestHistory?.url === "string" ? latestHistory.url : deployState.lastDeployedUrl ?? null
           });
         }
-        for (const serviceKey of ["api", "agents", "manager", "worker", "runner", "workdayStart", "workdayReport"]) {
+        if (scope === "prod") {
+          state.webCache.cloudflareRulesManaged = deployState.webCache?.rulesManaged === true;
+          state.webCache.lastDeployPurgeAt = deployState.webCache?.deployPurge?.lastPurgedAt ?? null;
+          state.webCache.lastDeployPurgeCount = deployState.webCache?.deployPurge?.purgeCount ?? null;
+          state.webCache.lastContentPurgeAt = deployState.webCache?.contentPurge?.lastPurgedAt ?? null;
+          state.webCache.lastContentPurgeCount = deployState.webCache?.contentPurge?.purgeCount ?? null;
+        }
+        for (const serviceKey of ["api", "manager", "worker", "workdayStart", "workdayReport"]) {
           const service = deployState.services?.[serviceKey];
           if (!service) continue;
           state.managedServices[serviceKey] = {
@@ -244,6 +377,12 @@ function resolveTreeseedWorkflowState(cwd) {
   state.readiness.local = readinessForEnvironment(state, "local");
   state.readiness.staging = readinessForEnvironment(state, "staging");
   state.readiness.prod = readinessForEnvironment(state, "prod");
+  state.marketConnection.verificationPosture = state.readiness.local.ready ? "ready" : state.files.machineConfig ? "blocked" : "pending";
+  const registrationRequired = state.marketConnection.runtimeRegistration === "required";
+  state.marketConnection.approvalBlockers = [
+    ...registrationRequired && !state.marketConnection.configured ? ["Knowledge Coop runtime attachment is not configured."] : [],
+    ...registrationRequired && !state.marketConnection.runtimeReady ? ["Knowledge Coop runtime credential is missing or not ready."] : []
+  ];
   state.recommendations = recommendTreeseedNextSteps(state);
   return state;
 }
@@ -257,7 +396,14 @@ function recommendTreeseedNextSteps(state) {
   }
   if (!state.files.machineConfig) {
     recommendations.push({ operation: "status", reason: "Validate tooling, auth, and repository readiness first." });
-    recommendations.push({ operation: "config", reason: "Bootstrap the local machine config and local environment files." });
+    recommendations.push({ operation: "config", reason: "Bootstrap the local machine config and injected runtime environment." });
+    return recommendations;
+  }
+  if (!state.secrets.wrappedKeyPresent || state.secrets.migrationRequired) {
+    recommendations.push({
+      operation: state.secrets.migrationRequired ? "secrets:migrate-key" : "secrets:unlock",
+      reason: state.secrets.migrationRequired ? "Wrap the local machine key before running secret-backed commands." : "Create and unlock the local wrapped machine key before running secret-backed commands."
+    });
     return recommendations;
   }
   if (state.workflowControl.interruptedRuns.length > 0) {
@@ -303,7 +449,7 @@ function recommendTreeseedNextSteps(state) {
       recommendations.push({ operation: "config", reason: "Initialize the staging environment before releasing.", input: { environment: ["staging"] } });
     } else {
       recommendations.push({ operation: "release", reason: "Promote staging into main when the integration branch is ready for production.", input: { bump: "patch" } });
-      if (state.managedServices.api.enabled || state.managedServices.agents.enabled) {
+      if (state.managedServices.api.enabled) {
         recommendations.push({ operation: "auth:login", reason: "Keep the local runtime authenticated to the remote API used by managed services." });
       }
     }

package/dist/workflow-support.d.ts

@@ -1,4 +1,4 @@
-export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, resolveTreeseedMachineEnvironmentValues, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, setTreeseedRemoteSession, writeTreeseedLocalEnvironmentFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.ts';
+export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedActVerificationTooling, ensureTreeseedSecretSessionForConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, listDeprecatedTreeseedLocalEnvFiles, inspectTreeseedKeyAgentStatus, lockTreeseedSecretSession, migrateTreeseedMachineKeyToWrapped, resolveTreeseedMachineEnvironmentValues, resolveTreeseedLaunchEnvironment, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, rotateTreeseedMachineKeyPassphrase, setTreeseedRemoteSession, TREESEED_MACHINE_KEY_PASSPHRASE_ENV, TreeseedKeyAgentError, updateTreeseedDeployConfigFeatureToggles, unlockTreeseedSecretSessionFromEnv, unlockTreeseedSecretSessionInteractive, unlockTreeseedSecretSessionWithPassphrase, withTreeseedKeyAgentAutopromptDisabled, warnDeprecatedTreeseedLocalEnvFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.ts';
 export { exportTreeseedCodebase } from './operations/services/export-runtime.ts';
 export { assertDeploymentInitialized, cleanupDestroyedState, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, destroyCloudflareResources, ensureGeneratedWranglerConfig, finalizeDeploymentState, loadDeployState, printDeploySummary, printDestroySummary, provisionCloudflareResources, runRemoteD1Migrations, syncCloudflareSecrets, validateDeployPrerequisites, validateDestroyPrerequisites, } from './operations/services/deploy.ts';
 export { assertCleanWorktree, assertFeatureBranch, branchExists, checkoutBranch, createDeprecatedTaskTag, createFeatureBranchFromStaging, currentManagedBranch, deleteLocalBranch, deleteRemoteBranch, ensureLocalBranchTracking, gitWorkflowRoot, listTaskBranches, mergeCurrentBranchIntoStaging, mergeStagingIntoMain, prepareReleaseBranches, PRODUCTION_BRANCH, pushBranch, remoteBranchExists, STAGING_BRANCH, syncBranchWithOrigin, waitForStagingAutomation, } from './operations/services/git-workflow.ts';

package/dist/workflow-support.js

@@ -8,17 +8,32 @@ import {
   collectTreeseedConfigContext,
   collectTreeseedPrintEnvReport,
   createDefaultTreeseedMachineConfig,
+  ensureTreeseedActVerificationTooling,
+  ensureTreeseedSecretSessionForConfig,
   ensureTreeseedGitignoreEntries,
   getTreeseedMachineConfigPaths,
   loadTreeseedMachineConfig,
   listRelevantTreeseedConfigEntries,
   finalizeTreeseedConfig,
+  listDeprecatedTreeseedLocalEnvFiles,
+  inspectTreeseedKeyAgentStatus,
+  lockTreeseedSecretSession,
+  migrateTreeseedMachineKeyToWrapped,
   resolveTreeseedMachineEnvironmentValues,
+  resolveTreeseedLaunchEnvironment,
   resolveTreeseedRemoteConfig,
   resolveTreeseedRemoteSession,
   rotateTreeseedMachineKey,
+  rotateTreeseedMachineKeyPassphrase,
   setTreeseedRemoteSession,
-  writeTreeseedLocalEnvironmentFiles,
+  TREESEED_MACHINE_KEY_PASSPHRASE_ENV,
+  TreeseedKeyAgentError,
+  updateTreeseedDeployConfigFeatureToggles,
+  unlockTreeseedSecretSessionFromEnv,
+  unlockTreeseedSecretSessionInteractive,
+  unlockTreeseedSecretSessionWithPassphrase,
+  withTreeseedKeyAgentAutopromptDisabled,
+  warnDeprecatedTreeseedLocalEnvFiles,
   writeTreeseedMachineConfig
 } from "./operations/services/config-runtime.js";
 import { exportTreeseedCodebase } from "./operations/services/export-runtime.js";
@@ -100,6 +115,8 @@ import {
 export {
   PRODUCTION_BRANCH,
   STAGING_BRANCH,
+  TREESEED_MACHINE_KEY_PASSPHRASE_ENV,
+  TreeseedKeyAgentError,
   applyTreeseedConfigValues,
   applyTreeseedEnvironmentToProcess,
   applyTreeseedSafeRepairs,
@@ -132,7 +149,9 @@ export {
   destroyCloudflareResources,
   ensureGeneratedWranglerConfig,
   ensureLocalBranchTracking,
+  ensureTreeseedActVerificationTooling,
   ensureTreeseedGitignoreEntries,
+  ensureTreeseedSecretSessionForConfig,
   exportTreeseedCodebase,
   finalizeDeploymentState,
   finalizeTreeseedConfig,
@@ -144,14 +163,18 @@ export {
   gitWorkflowRoot,
   hasMeaningfulChanges,
   incrementVersion,
+  inspectTreeseedKeyAgentStatus,
   isWorkspaceRoot,
+  listDeprecatedTreeseedLocalEnvFiles,
   listRelevantTreeseedConfigEntries,
   listTaskBranches,
   loadCliDeployConfig,
   loadDeployState,
   loadTreeseedMachineConfig,
+  lockTreeseedSecretSession,
   mergeCurrentBranchIntoStaging,
   mergeStagingIntoMain,
+  migrateTreeseedMachineKeyToWrapped,
   originRemoteUrl,
   packageScriptPath,
   planWorkspaceReleaseBump,
@@ -162,11 +185,13 @@ export {
   pushBranch,
   remoteBranchExists,
   repoRoot,
+  resolveTreeseedLaunchEnvironment,
   resolveTreeseedMachineEnvironmentValues,
   resolveTreeseedRemoteConfig,
   resolveTreeseedRemoteSession,
   resolveWranglerBin,
   rotateTreeseedMachineKey,
+  rotateTreeseedMachineKeyPassphrase,
   run,
   runRemoteD1Migrations,
   runTenantDeployPreflight,
@@ -174,11 +199,16 @@ export {
   setTreeseedRemoteSession,
   syncBranchWithOrigin,
   syncCloudflareSecrets,
+  unlockTreeseedSecretSessionFromEnv,
+  unlockTreeseedSecretSessionInteractive,
+  unlockTreeseedSecretSessionWithPassphrase,
+  updateTreeseedDeployConfigFeatureToggles,
   validateDeployPrerequisites,
   validateDestroyPrerequisites,
   validateRailwayDeployPrerequisites,
   waitForStagingAutomation,
+  warnDeprecatedTreeseedLocalEnvFiles,
+  withTreeseedKeyAgentAutopromptDisabled,
   workspaceRoot,
-  writeTreeseedLocalEnvironmentFiles,
   writeTreeseedMachineConfig
 };

package/dist/workflow.d.ts

@@ -72,6 +72,23 @@ export type TreeseedTaskBranchMetadata = ReturnType<typeof listTaskBranches>[num
         aligned: boolean;
     }>;
 };
+export type TreeseedWorkflowWorkstreamSummary = {
+    id: string;
+    title: string;
+    linkedDirectRefs: Array<{
+        model: 'objective' | 'question' | 'note';
+        id: string;
+    }>;
+    branch: string;
+    local: boolean;
+    remote: boolean;
+    current: boolean;
+    previewUrl: string | null;
+    lastSaveAt: string | null;
+    verificationResult: 'ready' | 'needs_attention' | 'unknown';
+    stagingCandidate: boolean;
+    archived: boolean;
+};
 export type TreeseedSaveInput = {
     message: string;
     hotfix?: boolean;
@@ -125,6 +142,16 @@ export type TreeseedConfigInput = {
     printEnvOnly?: boolean;
     showSecrets?: boolean;
     rotateMachineKey?: boolean;
+    connectMarket?: boolean;
+    marketBaseUrl?: string;
+    marketTeamId?: string;
+    marketTeamSlug?: string;
+    marketProjectId?: string;
+    marketProjectSlug?: string;
+    marketProjectApiBaseUrl?: string;
+    marketAccessToken?: string;
+    rotateRunnerToken?: boolean;
+    installMissingTooling?: boolean;
     nonInteractive?: boolean;
 };
 export type TreeseedExportInput = {
@@ -166,10 +193,12 @@ export declare class TreeseedWorkflowSdk {
     private helpers;
     execute(operation: TreeseedWorkflowOperationId, input?: Record<string, unknown>): Promise<TreeseedWorkflowResult<import("./workflow-state.ts").TreeseedWorkflowState> | TreeseedWorkflowResult<{
         tasks: TreeseedTaskBranchMetadata[];
+        workstreams: TreeseedWorkflowWorkstreamSummary[];
     }> | TreeseedWorkflowResult<Record<string, unknown>>>;
     status(): Promise<TreeseedWorkflowResult<ReturnType<typeof resolveTreeseedWorkflowState>>>;
     tasks(): Promise<TreeseedWorkflowResult<{
         tasks: TreeseedTaskBranchMetadata[];
+        workstreams: TreeseedWorkflowWorkstreamSummary[];
     }>>;
     config(input?: TreeseedConfigInput): Promise<TreeseedWorkflowResult>;
     switchTask(input: TreeseedSwitchInput): Promise<TreeseedWorkflowResult>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.4.13",
+  "version": "0.5.1",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {

package/templates/github/deploy.workflow.yml

@@ -98,7 +98,7 @@ jobs:
               while IFS= read -r path; do
                 [[ -z "${path}" ]] && continue
                 case "${path}" in
-                  src/content/*|content/*|books/*|docs/*|public/books/*|migrations/*)
+                  src/content/*|content/*|books/*|docs/*|migrations/*)
                     content_changed="true"
                     ;;
                   *)
@@ -287,6 +287,7 @@ __WORKING_DIRECTORY_BLOCK__
       TREESEED_RAILWAY_PROJECT_ID: ${{ vars.TREESEED_RAILWAY_PROJECT_ID }}
       TREESEED_RAILWAY_ENVIRONMENT_ID: ${{ vars.TREESEED_RAILWAY_ENVIRONMENT_ID }}
       TREESEED_RAILWAY_WORKER_SERVICE_ID: ${{ vars.TREESEED_RAILWAY_WORKER_SERVICE_ID }}
+      TREESEED_CONTENT_SERVING_MODE: published_runtime
       TREESEED_WORKFLOW_ACTION: deploy_code
       TREESEED_WORKFLOW_ENVIRONMENT: ${{ needs.classify.outputs.scope }}
       TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
@@ -294,6 +295,15 @@ __WORKING_DIRECTORY_BLOCK__
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          submodules: false
+          sparse-checkout: |
+            /*
+            !/src/content/
+            !/src/content/**
+            !/public/books/
+            !/public/books/**
+          sparse-checkout-cone-mode: false
 
       - name: Setup Node
         uses: actions/setup-node@v4

package/dist/scripts/sync-dev-vars.js

@@ -1,6 +0,0 @@
-import { applyTreeseedEnvironmentToProcess, writeTreeseedLocalEnvironmentFiles } from '../operations/services/config-runtime.js';
-const tenantRoot = process.cwd();
-applyTreeseedEnvironmentToProcess({ tenantRoot, scope: 'local', override: true });
-const result = writeTreeseedLocalEnvironmentFiles(tenantRoot);
-console.log(`Wrote ${result.envLocalPath}`);
-console.log(`Wrote ${result.devVarsPath}`);