@treeseed/sdk 0.6.29 → 0.6.31

package/dist/control-plane-client.d.ts

@@ -1,4 +1,4 @@
-import type { AgentPool, AgentPoolRegistration, AgentPoolScaleDecision, CatalogArtifactVersion, CatalogItem, CatalogItemFilters, CreateProjectDeploymentRequest, PriorityOverride, PrioritySnapshot, ProjectConnection, ProjectDeployment, ProjectEnvironment, ProjectEnvironmentName, ProjectHosting, ProjectInfrastructureResource, ProjectWorkdaySummary, RecordAgentPoolRegistrationRequest, ScaleDecision, TeamStorageLocator, UpsertAgentPoolRequest, UpsertCatalogArtifactVersionRequest, UpsertCatalogItemRequest, UpsertProjectEnvironmentRequest, UpsertProjectHostingRequest, UpsertProjectInfrastructureResourceRequest, UpsertTeamStorageLocatorRequest, WorkdayPolicy, SdkPriorityOverrideRequest, SdkUpsertWorkPolicyRequest } from './sdk-types.ts';
+import type { AgentPool, AgentPoolRegistration, AgentPoolScaleDecision, CatalogArtifactVersion, CatalogItem, CatalogItemFilters, CreateProjectDeploymentRequest, PriorityOverride, PrioritySnapshot, ProjectConnection, ProjectDeployment, ProjectEnvironment, ProjectEnvironmentName, ProjectHosting, ProjectInfrastructureResource, ProjectWorkdaySummary, RecordAgentPoolRegistrationRequest, ScaleDecision, TeamStorageLocator, TeamWebHost, UpsertAgentPoolRequest, UpsertCatalogArtifactVersionRequest, UpsertCatalogItemRequest, UpsertProjectEnvironmentRequest, UpsertProjectHostingRequest, UpsertProjectInfrastructureResourceRequest, UpsertTeamStorageLocatorRequest, UpsertTeamWebHostRequest, WorkdayPolicy, SdkPriorityOverrideRequest, SdkUpsertWorkPolicyRequest } from './sdk-types.ts';
 import type { AgentMessageRecord, AgentStatusRecord, DirectBoardItemSummary, InboxItem, LaunchProjectRequest, LaunchProjectResult, ProjectOverviewSummary, ReleaseDetail, ReleaseSummary, SharePackageStatus, TeamHomeSummary, TeamMemberSummary, WorkstreamDetail, WorkstreamSummary } from './knowledge-coop.ts';
 export interface ControlPlaneClientOptions {
     baseUrl: string;
@@ -56,6 +56,20 @@ export declare class ControlPlaneClient {
     getTeamHomeSummary(teamId: string): Promise<TeamHomeSummary>;
     listTeamInboxItems(teamId: string): Promise<InboxItem[]>;
     listTeamMembers(teamId: string): Promise<TeamMemberSummary[]>;
+    listTeamWebHosts(teamId: string): Promise<TeamWebHost[]>;
+    createTeamWebHost(teamId: string, input: UpsertTeamWebHostRequest): Promise<TeamWebHost>;
+    updateTeamWebHost(teamId: string, hostId: string, input: Partial<UpsertTeamWebHostRequest>): Promise<TeamWebHost>;
+    deleteTeamWebHost(teamId: string, hostId: string): Promise<{
+        ok: boolean;
+        payload?: TeamWebHost;
+        error?: string;
+    }>;
+    validateTeamWebHost(teamId: string, hostId: string, input: {
+        decryptedConfig?: Record<string, unknown> | null;
+    }): Promise<{
+        host: TeamWebHost;
+        validation: Record<string, unknown> | null;
+    }>;
     listTeamProducts(teamId: string): Promise<CatalogItem[]>;
     launchProject(teamId: string, input: LaunchProjectRequest): Promise<LaunchProjectResult>;
     getProjectSummary(projectId: string): Promise<ProjectOverviewSummary>;

package/dist/control-plane-client.js

@@ -237,6 +237,29 @@ class ControlPlaneClient {
   listTeamMembers(teamId) {
     return this.requestJson("GET", `/v1/teams/${encodeURIComponent(teamId)}/members`);
   }
+  listTeamWebHosts(teamId) {
+    return this.requestJson("GET", `/v1/teams/${encodeURIComponent(teamId)}/hosts`);
+  }
+  createTeamWebHost(teamId, input) {
+    return this.requestJson("POST", `/v1/teams/${encodeURIComponent(teamId)}/hosts`, {
+      body: input
+    });
+  }
+  updateTeamWebHost(teamId, hostId, input) {
+    return this.requestJson("PUT", `/v1/teams/${encodeURIComponent(teamId)}/hosts/${encodeURIComponent(hostId)}`, {
+      body: input
+    });
+  }
+  deleteTeamWebHost(teamId, hostId) {
+    return this.requestJson("DELETE", `/v1/teams/${encodeURIComponent(teamId)}/hosts/${encodeURIComponent(hostId)}`);
+  }
+  validateTeamWebHost(teamId, hostId, input) {
+    return this.requestJson(
+      "POST",
+      `/v1/teams/${encodeURIComponent(teamId)}/hosts/${encodeURIComponent(hostId)}/validate`,
+      { body: input }
+    );
+  }
   listTeamProducts(teamId) {
     return this.requestJson("GET", `/v1/teams/${encodeURIComponent(teamId)}/products`);
   }

package/dist/index.d.ts

@@ -30,7 +30,7 @@ export { TreeseedWorkflowSdk } from './workflow.ts';
 export * from './db/index.ts';
 export { collectTreeseedReconcileStatus, createTreeseedReconcileRegistry, deriveTreeseedDesiredUnits, destroyTreeseedTargetUnits, observeTreeseedUnits, planTreeseedReconciliation, reconcileTreeseedTarget, } from './reconcile/index.ts';
 export { getTreeseedVerifyDriverStatus, runTreeseedVerifyDriver } from './verification.ts';
-export type { KnowledgeCoopLaunchPreflightReport, KnowledgeCoopLaunchFailurePhase, KnowledgeCoopManagedLaunchInput, KnowledgeCoopManagedLaunchResult, AgentMessageKind, AgentMessageRecord, AgentStatusRecord, DirectBoardItemSummary, InboxItem, KnowledgeCoopJobStatus, LaunchProjectRequest, LaunchProjectResult, LinkedProjectRecordRef, ProjectConnectionStatus, ProjectOverviewSummary, ReleaseDetail, ReleaseState, ReleaseSummary, SharePackageState, SharePackageStatus, TeamCapability, TeamHomeSummary, TeamMemberSummary, WorkstreamDetail, WorkstreamEvent, WorkstreamState, WorkstreamSummary, SdkContentEntry, SdkDispatchCapability, SdkDispatchConfig, SdkDispatchCredentialSource, SdkDispatchExecutionClass, SdkDispatchNamespace, SdkDispatchPolicy, SdkDispatchRequest, SdkDispatchResult, SdkDispatchTarget, SdkCursorEntity, SdkFilterCondition, SdkFollowRequest, SdkGraphEdge, SdkGraphEdgeType, SdkGraphDslRelation, SdkGraphDslParseResult, SdkGraphModelConfig, SdkGraphNode, SdkGraphNodeType, SdkGraphPathExplanation, SdkGraphQueryStage, SdkGraphQueryView, SdkGraphQueryOptions, SdkGraphQueryRequest, SdkGraphQueryResult, SdkGraphRankingBuildInput, SdkGraphRankingDiagnostics, SdkGraphRankingIndex, SdkGraphRankingNodeResult, SdkGraphRankingProvider, SdkGraphRankingQueryRequest, SdkGraphRankingQueryResult, SdkGraphRankingSearchRequest, SdkGraphRefreshPayload, SdkGraphRefreshRequest, SdkGraphSearchOptions, SdkGraphSearchResult, SdkGraphSeed, SdkGraphSeedResolution, SdkGraphTraversalResult, SdkGraphWhereFilter, SdkContextPack, SdkContextPackRequest, SdkGetRequest, SdkJsonEnvelope, SdkLeaseEntity, SdkManagerContextPayload, SdkMessageEntity, SdkModelFieldBinding, SdkModelDefinition, SdkModelRegistry, SdkModelName, SdkMutationRequest, SdkOperation, SdkPickRequest, SdkPickResult, SdkQueueMessageEnvelope, SdkRunEntity, SdkSearchRequest, SdkTaskEntity, SdkTaskEventEntity, SdkTaskOutputEntity, SdkWorkDayEntity, SdkGraphRunEntity, SdkReportEntity, SdkSubscriptionEntity, SdkTemplateCatalogEntry, SdkTemplateCatalogPublisher, SdkTemplateCatalogResponse, SdkTemplateCatalogSource, SdkUpdateRequest, ProjectCapabilityGrant, ProjectConnection, ProjectConnectionMode, ProjectDeployment, ProjectDeploymentKind, ProjectDeploymentStatus, ProjectEnvironment, ProjectExecutionOwner, ProjectHosting, ProjectInfrastructureResource, ProjectInfrastructureResourceKind, ProjectInfrastructureResourceProvider, ProjectRunnerRegistrationState, RemoteJob, RemoteJobEvent, RemoteJobStatus, AgentPool, AgentPoolAutoscalePolicy, AgentPoolRegistration, AgentPoolScaleDecision, AgentPoolStatus, CatalogArtifactVersion, CatalogItem, CatalogItemFilters, CatalogItemOfferMode, ProjectEnvironmentName, ProjectWorkdaySummary, TreeseedHostingKind, TreeseedHostingRegistration, PriorityOverride, WorkdayWindow, WorkdaySchedule, TaskCreditWeight, TaskCreditBudget, WorkdayPolicy, PrioritySnapshotItem, PrioritySnapshot, TaskCreditLedgerEntry, ScaleDecision, TeamStorageLocator, UpsertAgentPoolRequest, UpsertCatalogArtifactVersionRequest, UpsertCatalogItemRequest, UpsertProjectEnvironmentRequest, UpsertProjectHostingRequest, UpsertProjectInfrastructureResourceRequest, UpsertTeamStorageLocatorRequest, CreateProjectDeploymentRequest, RecordAgentPoolRegistrationRequest, WorkerPoolScaleResult, WorkerPoolScaler, } from './sdk-types.ts';
+export type { KnowledgeCoopLaunchPreflightReport, KnowledgeCoopLaunchFailurePhase, KnowledgeCoopManagedLaunchInput, KnowledgeCoopManagedLaunchResult, AgentMessageKind, AgentMessageRecord, AgentStatusRecord, DirectBoardItemSummary, InboxItem, KnowledgeCoopJobStatus, LaunchProjectRequest, LaunchProjectResult, LinkedProjectRecordRef, ProjectConnectionStatus, ProjectOverviewSummary, ReleaseDetail, ReleaseState, ReleaseSummary, SharePackageState, SharePackageStatus, TeamCapability, TeamHomeSummary, TeamMemberSummary, WorkstreamDetail, WorkstreamEvent, WorkstreamState, WorkstreamSummary, SdkContentEntry, SdkDispatchCapability, SdkDispatchConfig, SdkDispatchCredentialSource, SdkDispatchExecutionClass, SdkDispatchNamespace, SdkDispatchPolicy, SdkDispatchRequest, SdkDispatchResult, SdkDispatchTarget, SdkCursorEntity, SdkFilterCondition, SdkFollowRequest, SdkGraphEdge, SdkGraphEdgeType, SdkGraphDslRelation, SdkGraphDslParseResult, SdkGraphModelConfig, SdkGraphNode, SdkGraphNodeType, SdkGraphPathExplanation, SdkGraphQueryStage, SdkGraphQueryView, SdkGraphQueryOptions, SdkGraphQueryRequest, SdkGraphQueryResult, SdkGraphRankingBuildInput, SdkGraphRankingDiagnostics, SdkGraphRankingIndex, SdkGraphRankingNodeResult, SdkGraphRankingProvider, SdkGraphRankingQueryRequest, SdkGraphRankingQueryResult, SdkGraphRankingSearchRequest, SdkGraphRefreshPayload, SdkGraphRefreshRequest, SdkGraphSearchOptions, SdkGraphSearchResult, SdkGraphSeed, SdkGraphSeedResolution, SdkGraphTraversalResult, SdkGraphWhereFilter, SdkContextPack, SdkContextPackRequest, SdkGetRequest, SdkJsonEnvelope, SdkLeaseEntity, SdkManagerContextPayload, SdkMessageEntity, SdkModelFieldBinding, SdkModelDefinition, SdkModelRegistry, SdkModelName, SdkMutationRequest, SdkOperation, SdkPickRequest, SdkPickResult, SdkQueueMessageEnvelope, SdkRunEntity, SdkSearchRequest, SdkTaskEntity, SdkTaskEventEntity, SdkTaskOutputEntity, SdkWorkDayEntity, SdkGraphRunEntity, SdkReportEntity, SdkSubscriptionEntity, SdkTemplateCatalogEntry, SdkTemplateCatalogPublisher, SdkTemplateCatalogResponse, SdkTemplateCatalogSource, SdkUpdateRequest, ProjectCapabilityGrant, ProjectConnection, ProjectConnectionMode, ProjectDeployment, ProjectDeploymentKind, ProjectDeploymentStatus, ProjectEnvironment, ProjectExecutionOwner, ProjectHosting, ProjectInfrastructureResource, ProjectInfrastructureResourceKind, ProjectInfrastructureResourceProvider, ProjectRunnerRegistrationState, RemoteJob, RemoteJobEvent, RemoteJobStatus, AgentPool, AgentPoolAutoscalePolicy, AgentPoolRegistration, AgentPoolScaleDecision, AgentPoolStatus, CatalogArtifactVersion, CatalogItem, CatalogItemFilters, CatalogItemOfferMode, ProjectEnvironmentName, ProjectWorkdaySummary, TreeseedHostingKind, TreeseedHostingRegistration, PriorityOverride, WorkdayWindow, WorkdaySchedule, TaskCreditWeight, TaskCreditBudget, WorkdayPolicy, PrioritySnapshotItem, PrioritySnapshot, TaskCreditLedgerEntry, ScaleDecision, TeamStorageLocator, TeamWebHost, TeamWebHostOwnership, TeamWebHostProvider, EncryptedWebHostPayload, UpsertAgentPoolRequest, UpsertCatalogArtifactVersionRequest, UpsertCatalogItemRequest, UpsertProjectEnvironmentRequest, UpsertProjectHostingRequest, UpsertProjectInfrastructureResourceRequest, UpsertTeamStorageLocatorRequest, UpsertTeamWebHostRequest, CreateProjectDeploymentRequest, RecordAgentPoolRegistrationRequest, WorkerPoolScaleResult, WorkerPoolScaler, } from './sdk-types.ts';
 export type * from './knowledge-coop.ts';
 export type { ControlPlaneAgentPoolHeartbeat, ControlPlaneDeploymentReport, ControlPlaneEnvironmentReport, ControlPlaneReporter, ControlPlaneReporterKind, ControlPlaneResourceReport, ControlPlaneScaleDecisionReport, ControlPlaneWorkdaySummaryReport, } from './control-plane.ts';
 export type { ControlPlaneClientOptions } from './control-plane-client.ts';

package/dist/knowledge-coop.d.ts

@@ -201,6 +201,13 @@ export interface LaunchProjectRequest {
     sourceKind: 'blank' | 'template' | 'knowledge_pack';
     sourceRef?: string | null;
     hostingMode: 'managed' | 'hybrid' | 'self_hosted';
+    cloudflareHostId?: string | null;
+    cloudflareHostMode?: 'team_owned' | 'treeseed_managed' | null;
+    cloudflareHostConfig?: Record<string, unknown> | null;
+    processingHostId?: string | null;
+    processingHostMode?: 'team_owned' | 'treeseed_managed' | null;
+    processingHostConfig?: Record<string, unknown> | null;
+    targetEnvironments?: Array<'local' | 'staging' | 'prod'>;
     publicSite?: boolean;
     repoProvider?: 'github';
     repoVisibility?: 'private' | 'public';

package/dist/operations/services/config-runtime.d.ts

@@ -229,7 +229,7 @@ export declare function applyTreeseedSafeRepairs(tenantRoot: string): TreeseedRe
 export declare function resolveTreeseedMachineEnvironmentValues(tenantRoot: any, scope: any): {};
 export declare function setTreeseedMachineEnvironmentValue(tenantRoot: any, scope: any, entry: any, value: any): any;
 export declare function collectTreeseedEnvironmentContext(tenantRoot: any): import("../../platform/environment.ts").TreeseedResolvedEnvironmentRegistry;
-export declare function collectTreeseedConfigSeedValues(tenantRoot: any, scope: any, env?: NodeJS.ProcessEnv): {
+export declare function collectTreeseedConfigSeedValues(tenantRoot: any, scope: any, env?: NodeJS.ProcessEnv, valuesOverlay?: {}): {
     [k: string]: unknown;
 };
 export declare function resolveTreeseedLaunchEnvironment({ tenantRoot, scope, baseEnv, overrides, }: {
@@ -300,9 +300,10 @@ export declare function ensureTreeseedActVerificationTooling({ tenantRoot, insta
     actVerificationReady: any;
     remediation: string[];
 };
-export declare function checkTreeseedProviderConnections({ tenantRoot, scope, env }?: {
+export declare function checkTreeseedProviderConnections({ tenantRoot, scope, env, valuesOverlay }?: {
     scope?: string | undefined;
     env?: NodeJS.ProcessEnv | undefined;
+    valuesOverlay?: {} | undefined;
 }): Promise<{
     scope: string;
     ok: boolean;
@@ -314,11 +315,12 @@ export declare function checkTreeseedProviderConnections({ tenantRoot, scope, en
     issues: any[];
 }>;
 export declare function formatTreeseedProviderConnectionReport(report: any): string;
-export declare function syncTreeseedGitHubEnvironment({ tenantRoot, scope, dryRun, repository: repositoryInput, execution, concurrency, onProgress, }: {
+export declare function syncTreeseedGitHubEnvironment({ tenantRoot, scope, dryRun, repository: repositoryInput, valuesOverlay, execution, concurrency, onProgress, }: {
     tenantRoot: string;
     scope?: TreeseedConfigScope;
     dryRun?: boolean;
     repository?: string | null;
+    valuesOverlay?: Record<string, string | undefined>;
     execution?: 'parallel' | 'sequential';
     concurrency?: number;
     onProgress?: (message: string, stream?: 'stdout' | 'stderr') => void;

package/dist/operations/services/config-runtime.js

@@ -1452,7 +1452,7 @@ function collectTreeseedEnvironmentContext(tenantRoot) {
     tenantConfig
   });
 }
-function collectTreeseedConfigSeedValues(tenantRoot, scope, env = process.env) {
+function collectTreeseedConfigSeedValues(tenantRoot, scope, env = process.env, valuesOverlay = {}) {
   warnDeprecatedTreeseedLocalEnvFiles(tenantRoot);
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
   let machineValues = {};
@@ -1465,7 +1465,8 @@ function collectTreeseedConfigSeedValues(tenantRoot, scope, env = process.env) {
   }
   return filterEnvironmentValuesByRegistry({
     ...machineValues,
-    ...nonEmptyEnvironmentValues(env)
+    ...nonEmptyEnvironmentValues(env),
+    ...nonEmptyEnvironmentValues(valuesOverlay)
   }, registry, scope);
 }
 function nonEmptyEnvironmentValues(env = process.env) {
@@ -1912,8 +1913,8 @@ async function checkRailwayConnection({ tenantRoot, env }) {
     throw error;
   }
 }
-async function checkTreeseedProviderConnections({ tenantRoot, scope = "prod", env = process.env } = {}) {
-  const values = collectTreeseedConfigSeedValues(tenantRoot, scope, env);
+async function checkTreeseedProviderConnections({ tenantRoot, scope = "prod", env = process.env, valuesOverlay = {} } = {}) {
+  const values = collectTreeseedConfigSeedValues(tenantRoot, scope, env, valuesOverlay);
   const rawCommandEnv = {
     GH_TOKEN: values.GH_TOKEN,
     CLOUDFLARE_API_TOKEN: values.CLOUDFLARE_API_TOKEN,
@@ -1977,6 +1978,7 @@ async function syncTreeseedGitHubEnvironment({
   scope = "prod",
   dryRun = false,
   repository: repositoryInput,
+  valuesOverlay = {},
   execution = "parallel",
   concurrency = 4,
   onProgress
@@ -1986,7 +1988,10 @@ async function syncTreeseedGitHubEnvironment({
     throw new Error("Unable to determine the GitHub repository from the origin remote.");
   }
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
-  const values = resolveTreeseedMachineEnvironmentValues(tenantRoot, scope);
+  const values = {
+    ...resolveTreeseedMachineEnvironmentValues(tenantRoot, scope),
+    ...nonEmptyEnvironmentValues(valuesOverlay)
+  };
   const relevant = registry.entries.filter((entry) => entry.scopes.includes(scope));
   const ghToken = values.GH_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "";
   const ghEnv = ghToken ? {

package/dist/operations/services/deploy.js

@@ -364,8 +364,12 @@ function buildLocalRuntimeVars(deployConfig, state, target, env) {
     TREESEED_BETTER_AUTH_SECRET: envValue(env, "TREESEED_BETTER_AUTH_SECRET") ?? state.generatedSecrets?.TREESEED_BETTER_AUTH_SECRET ?? state.generatedSecrets?.TREESEED_FORM_TOKEN_SECRET ?? "treeseed-local-better-auth-secret-minimum-32-characters",
     TREESEED_EDITORIAL_PREVIEW_SECRET: envValue(env, "TREESEED_EDITORIAL_PREVIEW_SECRET") ?? state.generatedSecrets?.TREESEED_EDITORIAL_PREVIEW_SECRET ?? "treeseed-local-editorial-preview-secret",
     TREESEED_FORMS_LOCAL_BYPASS_CLOUDFLARE_GUARDS: envValue(env, "TREESEED_FORMS_LOCAL_BYPASS_CLOUDFLARE_GUARDS") ?? "",
-    TREESEED_SMTP_HOST: envValue(env, "TREESEED_SMTP_HOST") ?? "127.0.0.1",
-    TREESEED_SMTP_PORT: envValue(env, "TREESEED_SMTP_PORT") ?? "1025"
+    TREESEED_MAILPIT_SMTP_HOST: "127.0.0.1",
+    TREESEED_MAILPIT_SMTP_PORT: "1025",
+    TREESEED_SMTP_HOST: "127.0.0.1",
+    TREESEED_SMTP_PORT: "1025",
+    TREESEED_SMTP_USERNAME: "",
+    TREESEED_SMTP_PASSWORD: ""
   };
 }
 function buildSecretMap(deployConfig, state) {

package/dist/operations/services/github-automation.d.ts

@@ -146,10 +146,11 @@ export declare function ensureGitHubSecrets(tenantRoot: any, { dryRun }?: {
     existing: string[];
     created: string[];
 }>;
-export declare function ensureGitHubEnvironment(tenantRoot: any, { dryRun, scope, purpose }?: {
+export declare function ensureGitHubEnvironment(tenantRoot: any, { dryRun, scope, purpose, valuesOverlay }?: {
     dryRun?: boolean | undefined;
     scope?: string | undefined;
     purpose?: string | undefined;
+    valuesOverlay?: {} | undefined;
 }): Promise<{
     repository: string | null;
     secrets: {
@@ -187,8 +188,9 @@ export declare function ensureGitHubEnvironment(tenantRoot: any, { dryRun, scope
     skipped?: undefined;
     mode?: undefined;
 }>;
-export declare function ensureGitHubDeployAutomation(tenantRoot: any, { dryRun }?: {
+export declare function ensureGitHubDeployAutomation(tenantRoot: any, { dryRun, valuesOverlay }?: {
     dryRun?: boolean | undefined;
+    valuesOverlay?: {} | undefined;
 }): Promise<{
     mode: string;
     workflow: {

package/dist/operations/services/github-automation.js

@@ -413,7 +413,12 @@ function formatMissingSecretsReport(repository, missingSecrets, reason = "missin
 async function ensureGitHubSecrets(tenantRoot, { dryRun = false } = {}) {
   return (await ensureGitHubEnvironment(tenantRoot, { dryRun })).secrets;
 }
-async function ensureGitHubEnvironment(tenantRoot, { dryRun = false, scope = "prod", purpose = "save" } = {}) {
+function nonEmptyValues(values = {}) {
+  return Object.fromEntries(
+    Object.entries(values).filter(([, value]) => typeof value === "string" && value.length > 0)
+  );
+}
+async function ensureGitHubEnvironment(tenantRoot, { dryRun = false, scope = "prod", purpose = "save", valuesOverlay = {} } = {}) {
   if (isGitHubAutomationStubbed()) {
     return {
       repository: maybeResolveGitHubRepositorySlug(tenantRoot),
@@ -449,8 +454,16 @@ async function ensureGitHubEnvironment(tenantRoot, { dryRun = false, scope = "pr
   const existingVariables = await listGitHubRepositoryVariableNames(repository, { client });
   const missingRemote = requiredSecrets.filter((name) => !existingSecrets.has(name));
   const missingRemoteVariables = requiredVariables.filter((name) => !existingVariables.has(name));
-  const missingLocal = missingRemote.filter((name) => !envOrNull(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
-  const missingLocalVariables = missingRemoteVariables.filter((name) => !envOrNull(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
+  const resolvedValues = {
+    ...process.env,
+    ...nonEmptyValues(valuesOverlay)
+  };
+  const localValue = (name) => {
+    const value = resolvedValues[name];
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : "";
+  };
+  const missingLocal = missingRemote.filter((name) => !localValue(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
+  const missingLocalVariables = missingRemoteVariables.filter((name) => !localValue(name)).map((name) => ({ name, localEnvPresent: false, remotePresent: false }));
   if (missingLocal.length > 0 || missingLocalVariables.length > 0) {
     throw new Error(formatMissingSecretsReport(repository, [...missingLocal, ...missingLocalVariables]));
   }
@@ -460,7 +473,7 @@ async function ensureGitHubEnvironment(tenantRoot, { dryRun = false, scope = "pr
       createdSecrets.push(name);
       continue;
     }
-    await upsertGitHubRepositorySecret(repository, name, envOrNull(name) ?? "", { client });
+    await upsertGitHubRepositorySecret(repository, name, localValue(name), { client });
     createdSecrets.push(name);
   }
   const createdVariables = [];
@@ -469,7 +482,7 @@ async function ensureGitHubEnvironment(tenantRoot, { dryRun = false, scope = "pr
       createdVariables.push(name);
       continue;
     }
-    await upsertGitHubRepositoryVariable(repository, name, envOrNull(name) ?? "", { client });
+    await upsertGitHubRepositoryVariable(repository, name, localValue(name), { client });
     createdVariables.push(name);
   }
   return {
@@ -484,9 +497,9 @@ async function ensureGitHubEnvironment(tenantRoot, { dryRun = false, scope = "pr
     }
   };
 }
-async function ensureGitHubDeployAutomation(tenantRoot, { dryRun = false } = {}) {
+async function ensureGitHubDeployAutomation(tenantRoot, { dryRun = false, valuesOverlay = {} } = {}) {
   const workflows = ensureStandardizedGitHubWorkflows(tenantRoot);
-  const environment = await ensureGitHubEnvironment(tenantRoot, { dryRun });
+  const environment = await ensureGitHubEnvironment(tenantRoot, { dryRun, valuesOverlay });
   return {
     mode: getGitHubAutomationMode(),
     workflow: workflows[0],

package/dist/operations/services/knowledge-coop-launch.d.ts

@@ -1,4 +1,4 @@
-import { checkTreeseedProviderConnections } from './config-runtime.ts';
+import { checkTreeseedProviderConnections, syncTreeseedGitHubEnvironment } from './config-runtime.ts';
 import { configuredRailwayServices, deployRailwayService, ensureRailwayScheduledJobs, verifyRailwayScheduledJobs } from './railway-deploy.ts';
 import { buildKnowledgeCoopKnowledgePackPackage, buildKnowledgeCoopTemplatePackage } from './knowledge-coop-packaging.ts';
 export type KnowledgeCoopLaunchFailurePhase = 'repo_provision_failed' | 'content_bootstrap_failed' | 'workflow_bootstrap_failed' | 'hosting_registration_failed' | 'runtime_connection_failed';
@@ -20,6 +20,40 @@ export interface KnowledgeCoopManagedLaunchInput {
     contactEmail?: string | null;
     enableDefaultAgents?: boolean;
     preserveWorkingTree?: boolean;
+    cloudflareHost?: KnowledgeCoopCloudflareHostLaunchInput | null;
+    processingHost?: KnowledgeCoopProcessingHostLaunchInput | null;
+}
+export interface KnowledgeCoopCloudflareHostConfig {
+    CLOUDFLARE_API_TOKEN?: string;
+    CLOUDFLARE_ACCOUNT_ID?: string;
+    TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME?: string;
+    TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME?: string;
+    TREESEED_CONTENT_BUCKET_NAME?: string;
+    TREESEED_CONTENT_BUCKET_BINDING?: string;
+    TREESEED_PUBLIC_TURNSTILE_SITE_KEY?: string;
+    TREESEED_TURNSTILE_SECRET_KEY?: string;
+    environments?: Partial<Record<'staging' | 'prod', Record<string, unknown>>>;
+    [key: string]: unknown;
+}
+export interface KnowledgeCoopCloudflareHostLaunchInput {
+    mode: 'team_owned' | 'treeseed_managed';
+    hostId?: string | null;
+    targetEnvironments?: Array<'local' | 'staging' | 'prod'>;
+    config?: KnowledgeCoopCloudflareHostConfig | null;
+}
+export interface KnowledgeCoopProcessingHostConfig {
+    RAILWAY_API_TOKEN?: string;
+    TREESEED_RAILWAY_WORKSPACE?: string;
+    TREESEED_RAILWAY_API_URL?: string;
+    TREESEED_WORKER_POOL_SCALER?: string;
+    environments?: Partial<Record<'staging' | 'prod', Record<string, unknown>>>;
+    [key: string]: unknown;
+}
+export interface KnowledgeCoopProcessingHostLaunchInput {
+    mode: 'team_owned' | 'treeseed_managed';
+    hostId?: string | null;
+    targetEnvironments?: Array<'local' | 'staging' | 'prod'>;
+    config?: KnowledgeCoopProcessingHostConfig | null;
 }
 export interface KnowledgeCoopLaunchPhaseRecord {
     phase: string;
@@ -54,6 +88,7 @@ export interface KnowledgeCoopManagedLaunchResult {
             existing: string[];
             created: string[];
         };
+        environmentSync?: Array<Awaited<ReturnType<typeof syncTreeseedGitHubEnvironment>>>;
     };
     cloudflare: {
         staging: ReturnType<typeof provisionCloudflareResources>;
@@ -85,5 +120,7 @@ export interface KnowledgeCoopLaunchPreflightReport {
         railway: boolean;
     };
 }
-export declare function validateKnowledgeCoopManagedLaunchPrerequisites(tenantRoot?: string): Promise<KnowledgeCoopLaunchPreflightReport>;
+export declare function validateKnowledgeCoopManagedLaunchPrerequisites(tenantRoot?: string, { valuesOverlay }?: {
+    valuesOverlay?: Record<string, string | undefined>;
+}): Promise<KnowledgeCoopLaunchPreflightReport>;
 export declare function executeKnowledgeCoopManagedLaunch(input: KnowledgeCoopManagedLaunchInput): Promise<KnowledgeCoopManagedLaunchResult>;

package/dist/operations/services/knowledge-coop-launch.js

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { collectTreeseedReconcileStatus, reconcileTreeseedTarget } from "../../reconcile/index.js";
-import { checkTreeseedProviderConnections, collectTreeseedConfigSeedValues } from "./config-runtime.js";
+import { checkTreeseedProviderConnections, collectTreeseedConfigSeedValues, syncTreeseedGitHubEnvironment } from "./config-runtime.js";
 import { createPersistentDeployTarget, runRemoteD1Migrations, finalizeDeploymentState } from "./deploy.js";
 import {
   createGitHubRepository,
@@ -545,6 +545,48 @@ function appendPhase(phases, phase, status, detail) {
     timestamp: nowIso()
   });
 }
+function stringValue(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : "";
+}
+function overlayValue(target, key, value) {
+  const next = stringValue(value);
+  if (next) {
+    target[key] = next;
+  }
+}
+function buildCloudflareHostEnvironmentOverlay(input, scope) {
+  const config = input.cloudflareHost?.config ?? {};
+  const environmentConfig = config.environments?.[scope] ?? {};
+  const projectSlug = slugify(input.projectSlug, "project");
+  const overlay = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "environments") continue;
+    overlayValue(overlay, key, value);
+  }
+  for (const [key, value] of Object.entries(environmentConfig)) {
+    overlayValue(overlay, key, value);
+  }
+  overlay.CLOUDFLARE_ACCOUNT_ID = overlay.CLOUDFLARE_ACCOUNT_ID || overlay.TREESEED_CLOUDFLARE_ACCOUNT_ID || "";
+  overlayValue(overlay, "TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME", overlay.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME || projectSlug);
+  overlayValue(overlay, "TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME", overlay.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME || `${projectSlug}-staging`);
+  overlayValue(overlay, "TREESEED_CONTENT_BUCKET_NAME", overlay.TREESEED_CONTENT_BUCKET_NAME || `${projectSlug}-content`);
+  overlayValue(overlay, "TREESEED_CONTENT_BUCKET_BINDING", overlay.TREESEED_CONTENT_BUCKET_BINDING || "TREESEED_CONTENT_BUCKET");
+  return overlay;
+}
+function buildProcessingHostEnvironmentOverlay(input, scope) {
+  const config = input.processingHost?.config ?? {};
+  const environmentConfig = config.environments?.[scope] ?? {};
+  const overlay = {};
+  for (const [key, value] of Object.entries(config)) {
+    if (key === "environments") continue;
+    overlayValue(overlay, key, value);
+  }
+  for (const [key, value] of Object.entries(environmentConfig)) {
+    overlayValue(overlay, key, value);
+  }
+  overlayValue(overlay, "TREESEED_WORKER_POOL_SCALER", overlay.TREESEED_WORKER_POOL_SCALER || "railway");
+  return overlay;
+}
 function scaffoldKnowledgeCoopSource(projectRoot, input) {
   const templateId = input.sourceKind === "template" ? slugify(input.sourceRef ?? "starter-basic", "starter-basic") : "starter-basic";
   const templateCatalogEnv = { TREESEED_TEMPLATE_CATALOG_URL: currentTemplateCatalogUrl() };
@@ -577,8 +619,8 @@ function scaffoldKnowledgeCoopSource(projectRoot, input) {
     env: templateCatalogEnv
   });
 }
-async function validateKnowledgeCoopManagedLaunchPrerequisites(tenantRoot = process.cwd()) {
-  const values = collectTreeseedConfigSeedValues(tenantRoot, "prod", process.env);
+async function validateKnowledgeCoopManagedLaunchPrerequisites(tenantRoot = process.cwd(), { valuesOverlay = {} } = {}) {
+  const values = collectTreeseedConfigSeedValues(tenantRoot, "prod", process.env, valuesOverlay);
   const requiredConfig = [
     ["TREESEED_BETTER_AUTH_SECRET"],
     ["TREESEED_AGENT_POOL_MIN_WORKERS"],
@@ -594,7 +636,7 @@ async function validateKnowledgeCoopManagedLaunchPrerequisites(tenantRoot = proc
     const value = values[name];
     return typeof value === "string" && value.trim().length > 0;
   })).map((group) => group.join(" or "));
-  const providerChecks = await checkTreeseedProviderConnections({ tenantRoot, scope: "prod", env: process.env });
+  const providerChecks = await checkTreeseedProviderConnections({ tenantRoot, scope: "prod", env: process.env, valuesOverlay });
   const commands = {
     git: commandAvailable("git"),
     gh: commandAvailable("gh"),
@@ -611,7 +653,15 @@ async function validateKnowledgeCoopManagedLaunchPrerequisites(tenantRoot = proc
 }
 async function executeKnowledgeCoopManagedLaunch(input) {
   const phases = [];
-  const preflight = await validateKnowledgeCoopManagedLaunchPrerequisites(process.cwd());
+  const prodEnvOverlay = {
+    ...buildCloudflareHostEnvironmentOverlay(input, "prod"),
+    ...buildProcessingHostEnvironmentOverlay(input, "prod")
+  };
+  const stagingEnvOverlay = {
+    ...buildCloudflareHostEnvironmentOverlay(input, "staging"),
+    ...buildProcessingHostEnvironmentOverlay(input, "staging")
+  };
+  const preflight = await validateKnowledgeCoopManagedLaunchPrerequisites(process.cwd(), { valuesOverlay: prodEnvOverlay });
   if (!preflight.ok) {
     throw new KnowledgeCoopLaunchError(
       "runtime_connection_failed",
@@ -646,24 +696,35 @@ async function executeKnowledgeCoopManagedLaunch(input) {
       commitMessage: `Initialize ${input.projectName}`
     });
     pushDefaultWorkstreamBranch(workingRoot);
-    const workflows = await ensureGitHubDeployAutomation(workingRoot);
+    const workflows = await ensureGitHubDeployAutomation(workingRoot, { valuesOverlay: prodEnvOverlay });
+    const githubEnvironmentSync = [];
+    for (const [scope, valuesOverlay] of [["staging", stagingEnvOverlay], ["prod", prodEnvOverlay]]) {
+      githubEnvironmentSync.push(await syncTreeseedGitHubEnvironment({
+        tenantRoot: workingRoot,
+        scope,
+        repository: repository.slug,
+        valuesOverlay,
+        execution: "sequential"
+      }));
+    }
+    const workflowSummary = { ...workflows, environmentSync: githubEnvironmentSync };
     appendPhase(phases, "workflow_bootstrap", "completed", "Configured GitHub workflows, secrets, and variables.");
     appendPhase(phases, "hosting_registration", "running", "Provisioning Cloudflare resources and deploy state.");
     const staging = await reconcileTreeseedTarget({
       tenantRoot: workingRoot,
       target: createPersistentDeployTarget("staging"),
-      env: process.env
+      env: { ...process.env, ...stagingEnvOverlay }
     });
     const prod = await reconcileTreeseedTarget({
       tenantRoot: workingRoot,
       target: createPersistentDeployTarget("prod"),
-      env: process.env
+      env: { ...process.env, ...prodEnvOverlay }
     });
     runRemoteD1Migrations(workingRoot, { scope: "prod" });
     const verification = await collectTreeseedReconcileStatus({
       tenantRoot: workingRoot,
       target: createPersistentDeployTarget("prod"),
-      env: process.env
+      env: { ...process.env, ...prodEnvOverlay }
     });
     appendPhase(phases, "hosting_registration", "completed", "Provisioned Cloudflare resources.");
     const launchConfig = loadCliDeployConfig(workingRoot);
@@ -674,14 +735,15 @@ async function executeKnowledgeCoopManagedLaunch(input) {
     let railwayVerification = [];
     if (managedRuntime) {
       appendPhase(phases, "runtime_connection", "running", "Deploying Railway services and registering runtime connectivity.");
-      validateRailwayDeployPrerequisites(workingRoot, "prod");
+      const railwayEnv = { ...process.env, ...prodEnvOverlay };
+      validateRailwayDeployPrerequisites(workingRoot, "prod", { env: railwayEnv });
       services = configuredRailwayServices(workingRoot, "prod");
       deployments = [];
       for (const service of services) {
-        deployments.push(await deployRailwayService(workingRoot, service));
+        deployments.push(await deployRailwayService(workingRoot, service, { env: railwayEnv }));
       }
-      schedules = await ensureRailwayScheduledJobs(workingRoot, "prod");
-      railwayVerification = await verifyRailwayScheduledJobs(workingRoot, "prod");
+      schedules = await ensureRailwayScheduledJobs(workingRoot, "prod", { env: railwayEnv });
+      railwayVerification = await verifyRailwayScheduledJobs(workingRoot, "prod", { env: railwayEnv });
       finalizeDeploymentState(workingRoot, { scope: "prod", serviceResults: deployments });
       appendPhase(phases, "runtime_connection", "completed", "Deployed Railway services and recorded runtime readiness.");
     } else {
@@ -734,7 +796,7 @@ async function executeKnowledgeCoopManagedLaunch(input) {
         stagingBranch: initResult.stagingBranch,
         visibility: repository.visibility
       },
-      workflows,
+      workflows: workflowSummary,
       cloudflare: {
         staging,
         prod,

package/dist/operations.d.ts

@@ -1,4 +1,5 @@
 export { TRESEED_OPERATION_SPECS, findTreeseedOperation, listTreeseedOperationNames, } from './operations-registry.ts';
+export { collectTreeseedConfigSeedValues } from './operations/services/config-runtime.ts';
 export { TreeseedOperationsSdk } from './operations/runtime.ts';
 export type { TreeseedOperationContext, TreeseedOperationImplementation, TreeseedOperationId, TreeseedOperationMetadata, TreeseedOperationProvider, TreeseedOperationProviderId, TreeseedOperationRequest, TreeseedOperationResult, TreeseedOperationGroup, } from './operations-types.ts';
 export { TreeseedOperationError } from './operations-types.ts';

package/dist/operations.js

@@ -3,6 +3,7 @@ import {
   findTreeseedOperation,
   listTreeseedOperationNames
 } from "./operations-registry.js";
+import { collectTreeseedConfigSeedValues } from "./operations/services/config-runtime.js";
 import { TreeseedOperationsSdk } from "./operations/runtime.js";
 import { TreeseedOperationError } from "./operations-types.js";
 import { TreeseedWorkflowSdk } from "./workflow.js";
@@ -11,6 +12,7 @@ export {
   TreeseedOperationError,
   TreeseedOperationsSdk,
   TreeseedWorkflowSdk,
+  collectTreeseedConfigSeedValues,
   findTreeseedOperation,
   listTreeseedOperationNames
 };

package/dist/sdk-types.d.ts

@@ -121,6 +121,48 @@ export interface ProjectHosting {
     createdAt: string;
     updatedAt: string;
 }
+export interface EncryptedWebHostPayload {
+    version: number;
+    algorithm: string;
+    kdf: {
+        algorithm: string;
+        opsLimit?: number;
+        memLimit?: number;
+        [key: string]: unknown;
+    };
+    salt: string;
+    nonce: string;
+    ciphertext: string;
+}
+export type TeamWebHostProvider = 'cloudflare';
+export type TeamWebHostOwnership = 'team_owned' | 'treeseed_managed';
+export interface TeamWebHost {
+    id: string;
+    teamId: string;
+    provider: TeamWebHostProvider;
+    ownership: TeamWebHostOwnership;
+    name: string;
+    accountLabel: string | null;
+    allowedEnvironments: ProjectEnvironmentName[];
+    status: string;
+    encryptedPayload: EncryptedWebHostPayload | null;
+    metadata?: Record<string, unknown>;
+    createdById: string | null;
+    updatedById: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface UpsertTeamWebHostRequest {
+    id?: string;
+    provider?: TeamWebHostProvider;
+    ownership?: TeamWebHostOwnership;
+    name: string;
+    accountLabel?: string | null;
+    allowedEnvironments?: ProjectEnvironmentName[];
+    status?: string;
+    encryptedPayload?: EncryptedWebHostPayload | null;
+    metadata?: Record<string, unknown> | null;
+}
 export interface ProjectEnvironment {
     id: string;
     projectId: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.6.29",
+  "version": "0.6.31",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {

package/templates/github/deploy.workflow.yml

@@ -208,7 +208,6 @@ __WORKING_DIRECTORY_BLOCK__
       needs.classify.outputs.release_tag == 'true'
     permissions:
       contents: read
-      deployments: write
     environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
     env:
       TREESEED_BOOTSTRAP_MODE: auto
@@ -352,7 +351,6 @@ __WORKING_DIRECTORY_BLOCK__
       - provision
     permissions:
       contents: read
-      deployments: write
     if: |
       needs.classify.outputs.workflow_action == 'deploy_code' ||
       needs.classify.outputs.code_changed == 'true' ||
@@ -494,7 +492,6 @@ __WORKING_DIRECTORY_BLOCK__
       - deploy-code
     permissions:
       contents: read
-      deployments: write
     if: |
       always() &&
       needs.provision.result == 'success' &&
@@ -645,7 +642,6 @@ __WORKING_DIRECTORY_BLOCK__
       (needs['publish-content'].result == 'success' || needs['publish-content'].result == 'skipped')
     permissions:
       contents: read
-      deployments: write
     environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
     env:
       TREESEED_BOOTSTRAP_MODE: auto