@treeseed/sdk 0.10.28 → 0.11.0

package/dist/operations/services/config-runtime.d.ts

@@ -232,9 +232,7 @@ export declare function applyTreeseedSafeRepairs(tenantRoot: string): TreeseedRe
 export declare function resolveTreeseedMachineEnvironmentValues(tenantRoot: any, scope: any, additionalKeys?: never[]): {};
 export declare function setTreeseedMachineEnvironmentValue(tenantRoot: any, scope: any, entry: any, value: any): any;
 export declare function collectTreeseedEnvironmentContext(tenantRoot: any): import("../../platform/environment.ts").TreeseedResolvedEnvironmentRegistry;
-export declare function collectTreeseedConfigSeedValues(tenantRoot: any, scope: any, env?: NodeJS.ProcessEnv, valuesOverlay?: {}): {
-    [k: string]: unknown;
-};
+export declare function collectTreeseedConfigSeedValues(tenantRoot: any, scope: any, env?: NodeJS.ProcessEnv, valuesOverlay?: {}): any;
 export declare function resolveTreeseedLaunchEnvironment({ tenantRoot, scope, baseEnv, overrides, }: {
     tenantRoot: string;
     scope: TreeseedConfigScope;
@@ -341,6 +339,13 @@ export declare function syncTreeseedGitHubEnvironment({ tenantRoot, scope, dryRu
     repository: string;
     scope: "local" | "staging" | "prod";
     environment: string;
+    credential: {
+        repository: string;
+        envName: string;
+        configured: boolean;
+        source: "repository" | "fallback" | "missing";
+        fallbackUsed: boolean;
+    };
     entryIds: string[] | undefined;
 }>;
 export declare function syncTreeseedCloudflareEnvironment({ tenantRoot, scope, dryRun, valuesOverlay, entryIds, onProgress, }: {
@@ -368,7 +373,7 @@ export declare function syncTreeseedRailwayEnvironment({ tenantRoot, scope, dryR
     valuesOverlay?: Record<string, string | undefined>;
     entryIds?: string[];
     onProgress?: (message: string, stream?: 'stdout' | 'stderr') => void;
-}): {
+}): Promise<{
     scope: "local" | "staging" | "prod";
     entryIds: string[] | undefined;
     services: {
@@ -384,7 +389,7 @@ export declare function syncTreeseedRailwayEnvironment({ tenantRoot, scope, dryR
         variables: any;
         dryRun: boolean;
     }[];
-};
+}>;
 export declare function initializeTreeseedPersistentEnvironment({ tenantRoot, scope, dryRun }?: {
     scope?: string | undefined;
     dryRun?: boolean | undefined;

package/dist/operations/services/config-runtime.js

@@ -34,10 +34,15 @@ import {
   configuredRailwayServices
 } from "./railway-deploy.js";
 import {
+  ensureRailwayEnvironment,
+  ensureRailwayProject,
+  ensureRailwayService,
   normalizeRailwayEnvironmentName,
   resolveRailwayWorkspace,
-  resolveRailwayWorkspaceContext
+  resolveRailwayWorkspaceContext,
+  upsertRailwayVariables
 } from "./railway-api.js";
+import { discoverTreeseedApplications } from "../../hosting/apps.js";
 import {
   createGitHubApiClient,
   ensureGitHubActionsEnvironment,
@@ -47,6 +52,7 @@ import {
   upsertGitHubEnvironmentSecret,
   upsertGitHubEnvironmentVariable
 } from "./github-api.js";
+import { resolveGitHubCredentialForRepository } from "./github-credentials.js";
 import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin, withProcessCwd } from "./runtime-tools.js";
 import { PRODUCTION_BRANCH, STAGING_BRANCH } from "./git-workflow.js";
 import {
@@ -86,6 +92,15 @@ const TREESEED_TEMPLATE_CATALOG_URL_ENV = "TREESEED_TEMPLATE_CATALOG_URL";
 const TREESEED_API_BASE_URL_ENV = "TREESEED_API_BASE_URL";
 const CLI_CHECK_TIMEOUT_MS = 5e3;
 const DEPRECATED_LOCAL_ENV_FILES = [".env.local", ".dev.vars"];
+const PROVIDER_CONTROL_ENV_KEYS = [
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "CLOUDFLARE_API_TOKEN",
+  "CLOUDFLARE_ACCOUNT_ID",
+  "CLOUDFLARE_ZONE_ID",
+  "RAILWAY_API_TOKEN",
+  "TREESEED_RAILWAY_WORKSPACE"
+];
 const warnedDeprecatedLocalEnvRoots = /* @__PURE__ */ new Set();
 const inlineTreeseedSecretSessions = /* @__PURE__ */ new Map();
 const railwayConnectionCheckCache = /* @__PURE__ */ new Map();
@@ -1523,18 +1538,71 @@ function collectTreeseedConfigSeedValues(tenantRoot, scope, env = process.env, v
   warnDeprecatedTreeseedLocalEnvFiles(tenantRoot);
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
   let machineValues = {};
+  let localMachineValues = {};
   try {
     machineValues = resolveTreeseedMachineEnvironmentValues(tenantRoot, scope);
+    if (scope !== "local") {
+      localMachineValues = resolveTreeseedMachineEnvironmentValues(tenantRoot, "local");
+    }
   } catch (error) {
     if (!(error instanceof TreeseedKeyAgentError)) {
       throw error;
     }
   }
-  return filterEnvironmentValuesByRegistry({
+  const providerCredentialFallbacks = Object.fromEntries(
+    PROVIDER_CONTROL_ENV_KEYS.map((key) => [key, localMachineValues[key]]).filter(([, value]) => typeof value === "string" && value.length > 0)
+  );
+  const values = {
+    ...providerCredentialFallbacks,
     ...machineValues,
     ...nonEmptyEnvironmentValues(env),
     ...nonEmptyEnvironmentValues(valuesOverlay)
-  }, registry, scope);
+  };
+  const providerControlValues = Object.fromEntries(
+    PROVIDER_CONTROL_ENV_KEYS.map((key) => [key, values[key]]).filter(([, value]) => typeof value === "string" && value.length > 0)
+  );
+  return {
+    ...providerControlValues,
+    ...filterEnvironmentValuesByRegistry(values, registry, scope)
+  };
+}
+function workspaceBootstrapDeployConfig(tenantRoot, deployConfig) {
+  const appConfigs = discoverTreeseedApplications(tenantRoot).map((application) => application.config).filter((config) => config && config !== deployConfig);
+  if (appConfigs.length === 0) {
+    return deployConfig;
+  }
+  const merged = {
+    ...deployConfig,
+    runtime: { ...deployConfig.runtime ?? {} },
+    surfaces: { ...deployConfig.surfaces ?? {} },
+    services: { ...deployConfig.services ?? {} }
+  };
+  for (const config of appConfigs) {
+    if (config.runtime?.mode && merged.runtime?.mode !== "treeseed_managed") {
+      merged.runtime = { ...merged.runtime, ...config.runtime };
+    }
+    merged.surfaces = { ...merged.surfaces, ...config.surfaces ?? {} };
+    merged.services = { ...merged.services, ...config.services ?? {} };
+  }
+  return merged;
+}
+function configuredMarketDatabaseService(tenantRoot, deployConfig) {
+  if (deployConfig.services?.treeseedDatabase) {
+    return treeseedDatabaseDescriptor(deployConfig.services.treeseedDatabase, deployConfig.slug);
+  }
+  for (const application of discoverTreeseedApplications(tenantRoot)) {
+    const service = application.config.services?.treeseedDatabase;
+    if (service) {
+      return treeseedDatabaseDescriptor(service, application.config.slug);
+    }
+  }
+  return null;
+}
+function treeseedDatabaseDescriptor(service, slug) {
+  return {
+    service,
+    serviceName: typeof service.railway?.serviceName === "string" && service.railway.serviceName.trim() ? service.railway.serviceName.trim() : `${slug ?? "treeseed-api"}-postgres`
+  };
 }
 function nonEmptyEnvironmentValues(env = process.env) {
   return Object.fromEntries(
@@ -1600,7 +1668,7 @@ function resolveTreeseedLaunchEnvironment({
   );
   const systemSecretSuggestedValues = Object.fromEntries(
     registry.entries.filter(
-      (entry) => entry.id === "TREESEED_PLATFORM_RUNNER_SECRET" && typeof suggestedValues[entry.id] === "string" && suggestedValues[entry.id].length > 0
+      (entry) => ["TREESEED_PLATFORM_RUNNER_SECRET", "TREESEED_CREDENTIAL_SESSION_SECRET"].includes(entry.id) && typeof suggestedValues[entry.id] === "string" && suggestedValues[entry.id].length > 0
     ).map((entry) => [entry.id, suggestedValues[entry.id]])
   );
   const scopedValues = scope === "local" ? { ...nonSecretSuggestedValues, ...systemSecretSuggestedValues, ...baseValues, ...machineValues } : { ...nonSecretSuggestedValues, ...systemSecretSuggestedValues, ...machineValues, ...baseValues };
@@ -1731,25 +1799,6 @@ function runGh(args, { cwd, dryRun = false, input, env } = {}) {
   }
   return result;
 }
-function runRailway(args, { cwd, dryRun = false, input } = {}) {
-  if (dryRun) {
-    return { status: 0, stdout: "", stderr: "" };
-  }
-  const railway = resolveTreeseedToolCommand("railway");
-  if (!railway) {
-    throw new Error("Railway CLI is unavailable.");
-  }
-  const result = spawnSync(railway.command, [...railway.argsPrefix, ...args], {
-    cwd,
-    stdio: input !== void 0 ? ["pipe", "pipe", "pipe"] : ["ignore", "pipe", "pipe"],
-    encoding: "utf8",
-    input
-  });
-  if (result.status !== 0) {
-    throw new Error(result.stderr?.trim() || result.stdout?.trim() || `railway ${args.join(" ")} failed`);
-  }
-  return result;
-}
 function commandAvailable(command) {
   if (command === "gh" || command === "wrangler" || command === "railway" || command === "copilot") {
     return Boolean(resolveTreeseedToolBinary(command));
@@ -2117,6 +2166,50 @@ async function runBounded(items, limit, worker) {
   });
   await Promise.all(workers);
 }
+function repositorySlugFromPackageJson(root) {
+  try {
+    const packageJson = JSON.parse(readFileSync(resolve(root, "package.json"), "utf8"));
+    const repository = packageJson.repository;
+    const raw = typeof repository === "string" ? repository : repository && typeof repository === "object" && !Array.isArray(repository) ? repository.url : null;
+    if (typeof raw !== "string") return null;
+    const normalized = raw.trim().replace(/^git\+/u, "").replace(/^ssh:\/\/git@github\.com[:/]/u, "").replace(/^git@github\.com:/u, "").replace(/^https:\/\/github\.com\//u, "").replace(/\.git$/u, "").replace(/\/$/u, "");
+    return /^[^/\s]+\/[^/\s]+$/u.test(normalized) ? normalized : null;
+  } catch {
+    return null;
+  }
+}
+function resolveGitHubRepositorySlugForPath(root) {
+  try {
+    return maybeResolveGitHubRepositorySlug(root);
+  } catch {
+    return null;
+  }
+}
+function discoverGitHubEnvironmentSyncTargets(tenantRoot, explicitRepository) {
+  const targets = /* @__PURE__ */ new Map();
+  const add = (repository, managedHostMode) => {
+    if (!repository || !repository.trim()) return;
+    const normalized = repository.trim();
+    const existing = targets.get(normalized);
+    if (!existing || existing.managedHostMode === "managed" && managedHostMode === "direct") {
+      targets.set(normalized, { repository: normalized, managedHostMode });
+    }
+  };
+  add(explicitRepository ?? resolveGitHubRepositorySlugForPath(tenantRoot), "auto");
+  for (const application of discoverTreeseedApplications(tenantRoot)) {
+    const repository = resolveGitHubRepositorySlugForPath(application.root) ?? repositorySlugFromPackageJson(application.root);
+    const managedHostMode = usesManagedHostOperationRequests(application.config) ? "managed" : "direct";
+    add(repository, managedHostMode);
+  }
+  return [...targets.values()];
+}
+function withGitHubEnvironmentCredentialContext(error, repository, credential) {
+  const message = error instanceof Error && error.message.trim() ? error.message.trim() : String(error ?? "GitHub environment sync failed.");
+  if (credential.fallbackUsed && /authentication failed|resource not accessible|403/iu.test(message)) {
+    return new Error(`${message} Configure ${credential.envName} with Actions environment secrets and variables permissions for ${repository}; the fallback GH_TOKEN is not sufficient for this repository.`);
+  }
+  return error;
+}
 async function syncTreeseedGitHubEnvironment({
   tenantRoot,
   scope = "prod",
@@ -2156,10 +2249,10 @@ async function syncTreeseedGitHubEnvironment({
     }
     return Boolean(entry.targets.includes("github-variable") && allowedVariables?.has(entry.id));
   });
-  const ghToken = values.GH_TOKEN || process.env.GH_TOKEN || process.env.GITHUB_TOKEN || "";
-  const ghEnv = ghToken ? {
-    GH_TOKEN: ghToken,
-    GITHUB_TOKEN: ghToken
+  const credential = resolveGitHubCredentialForRepository(repository, { values, env: process.env });
+  const ghEnv = credential.token ? {
+    GH_TOKEN: credential.token,
+    GITHUB_TOKEN: credential.token
   } : {};
   const githubClient = createGitHubApiClient({ env: ghEnv });
   const environment = scope === "prod" ? "production" : scope;
@@ -2168,17 +2261,27 @@ async function syncTreeseedGitHubEnvironment({
   const progress = (message, stream = "stdout") => onProgress?.(message, stream);
   if (!dryRun) {
     progress(`[${scope}][github][environment] Ensuring GitHub environment ${environment} exists...`);
-    await ensureGitHubActionsEnvironment(repository, environment, {
-      client: githubClient,
-      branchName: deploymentBranch,
-      tagName: deploymentTag
-    });
+    try {
+      await ensureGitHubActionsEnvironment(repository, environment, {
+        client: githubClient,
+        branchName: deploymentBranch,
+        tagName: deploymentTag
+      });
+    } catch (error) {
+      throw withGitHubEnvironmentCredentialContext(error, repository, credential);
+    }
   }
   progress(`[${scope}][github][sync] Loading existing GitHub secrets and variables...`);
-  const [secretNames, variableNames] = dryRun ? [/* @__PURE__ */ new Set(), /* @__PURE__ */ new Set()] : await Promise.all([
-    listGitHubEnvironmentSecretNames(repository, environment, { client: githubClient }),
-    listGitHubEnvironmentVariableNames(repository, environment, { client: githubClient })
-  ]);
+  const [secretNames, variableNames] = dryRun ? [/* @__PURE__ */ new Set(), /* @__PURE__ */ new Set()] : await (async () => {
+    try {
+      return await Promise.all([
+        listGitHubEnvironmentSecretNames(repository, environment, { client: githubClient }),
+        listGitHubEnvironmentVariableNames(repository, environment, { client: githubClient })
+      ]);
+    } catch (error) {
+      throw withGitHubEnvironmentCredentialContext(error, repository, credential);
+    }
+  })();
   const synced = {
     secrets: [],
     variables: []
@@ -2201,10 +2304,14 @@ async function syncTreeseedGitHubEnvironment({
   const limit = execution === "sequential" ? 1 : concurrency;
   await runBounded(items, limit, async (item) => {
     if (!dryRun) {
-      if (item.kind === "secret") {
-        await upsertGitHubEnvironmentSecret(repository, environment, item.name, item.value, { client: githubClient });
-      } else {
-        await upsertGitHubEnvironmentVariable(repository, environment, item.name, item.value, { client: githubClient });
+      try {
+        if (item.kind === "secret") {
+          await upsertGitHubEnvironmentSecret(repository, environment, item.name, item.value, { client: githubClient });
+        } else {
+          await upsertGitHubEnvironmentVariable(repository, environment, item.name, item.value, { client: githubClient });
+        }
+      } catch (error) {
+        throw withGitHubEnvironmentCredentialContext(error, repository, credential);
       }
     }
     completed += 1;
@@ -2221,6 +2328,13 @@ async function syncTreeseedGitHubEnvironment({
     repository,
     scope,
     environment,
+    credential: {
+      repository: credential.repository,
+      envName: credential.envName,
+      configured: credential.configured,
+      source: credential.source,
+      fallbackUsed: credential.fallbackUsed
+    },
     entryIds: entryFilter ? [...entryFilter] : void 0,
     ...synced
   };
@@ -2274,7 +2388,7 @@ function environmentEntryTargetsService(entry, serviceKey) {
 function railwayEnvironmentEntryIdsForService(registry, values, scope, target, serviceKey, entryFilter = null) {
   return registry.entries.filter((entry) => entry.scopes.includes(scope) && entry.targets.includes(target) && (!entryFilter || entryFilter.has(entry.id)) && environmentEntryTargetsService(entry, serviceKey)).map((entry) => entry.id).filter((key) => typeof values[key] === "string" && values[key].length > 0);
 }
-function syncTreeseedRailwayEnvironment({
+async function syncTreeseedRailwayEnvironment({
   tenantRoot,
   scope = "prod",
   dryRun = false,
@@ -2288,10 +2402,10 @@ function syncTreeseedRailwayEnvironment({
     ...nonEmptyEnvironmentValues(valuesOverlay)
   };
   const deployConfig = loadCliDeployConfig(tenantRoot);
-  const marketDatabaseService = deployConfig.services?.marketDatabase;
-  const marketDatabaseBaseName = typeof marketDatabaseService?.railway?.serviceName === "string" && marketDatabaseService.railway.serviceName.trim() ? marketDatabaseService.railway.serviceName.trim() : `${deployConfig.slug ?? "treeseed-market"}-postgres`;
-  const marketDatabaseServiceName = `${marketDatabaseBaseName.replace(/-(staging|prod|production)$/u, "")}-${scope === "prod" ? "prod" : scope}`;
-  const marketDatabaseUrl = typeof values.TREESEED_MARKET_DATABASE_URL === "string" && values.TREESEED_MARKET_DATABASE_URL.length > 0 ? values.TREESEED_MARKET_DATABASE_URL : marketDatabaseService?.enabled !== false && marketDatabaseService?.provider === "railway" ? `\${{${marketDatabaseServiceName}.DATABASE_URL}}` : "";
+  const treeseedDatabase = configuredMarketDatabaseService(tenantRoot, deployConfig);
+  const treeseedDatabaseService = treeseedDatabase?.service;
+  const treeseedDatabaseServiceName = treeseedDatabase?.serviceName ?? "";
+  const treeseedDatabaseUrl = typeof values.TREESEED_DATABASE_URL === "string" && values.TREESEED_DATABASE_URL.length > 0 ? values.TREESEED_DATABASE_URL : treeseedDatabaseService?.enabled !== false && treeseedDatabaseService?.provider === "railway" ? `\${{${treeseedDatabaseServiceName}.DATABASE_URL}}` : "";
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
   const entryFilter = Array.isArray(entryIds) && entryIds.length > 0 ? new Set(entryIds) : null;
   const progress = (message, stream = "stdout") => onProgress?.(message, stream);
@@ -2301,12 +2415,12 @@ function syncTreeseedRailwayEnvironment({
     const environmentName = normalizeRailwayEnvironmentName(service.railwayEnvironment ?? scope);
     const serviceValues = {
       ...values,
-      ...service.key === "marketOperationsRunner" ? {
+      ...service.key === "operationsRunner" ? {
         TREESEED_PLATFORM_RUNNER_ID: service.runnerId ?? service.serviceName,
         TREESEED_PLATFORM_RUNNER_DATA_DIR: service.volumeMountPath ?? values.TREESEED_PLATFORM_RUNNER_DATA_DIR,
         TREESEED_PLATFORM_RUNNER_ENVIRONMENT: scope === "prod" ? "production" : scope
       } : {},
-      ...marketDatabaseUrl && ["api", "marketOperationsRunner"].includes(service.key) ? { TREESEED_MARKET_DATABASE_URL: marketDatabaseUrl } : {}
+      ...treeseedDatabaseUrl && ["api", "operationsRunner"].includes(service.key) ? { TREESEED_DATABASE_URL: treeseedDatabaseUrl } : {}
     };
     const serviceName = service.serviceName ?? fallbackServiceName;
     serviceValuesByName.set(serviceName || service.serviceId || service.instanceKey || service.key, serviceValues);
@@ -2327,17 +2441,36 @@ function syncTreeseedRailwayEnvironment({
   for (const service of services) {
     const serviceValues = serviceValuesByName.get(service.serviceName || service.serviceId || service.instanceKey || service.service) ?? values;
     progress(`[${scope}][railway][${service.service}] Syncing ${service.secrets.length} secrets and ${service.variables.length} variables...`);
-    for (const key of service.secrets) {
-      runRailway(
-        ["variable", "set", "--service", service.serviceName || service.serviceId, "--environment", service.environmentName, "--stdin", "--skip-deploys", key],
-        { cwd: service.rootDir, dryRun, input: serviceValues[key] }
-      );
-    }
-    for (const key of service.variables) {
-      runRailway(
-        ["variable", "set", "--service", service.serviceName || service.serviceId, "--environment", service.environmentName, "--stdin", "--skip-deploys", key],
-        { cwd: service.rootDir, dryRun, input: serviceValues[key] }
+    if (!dryRun) {
+      const railwayEnv = { ...process.env, ...values };
+      const project = (await ensureRailwayProject({
+        projectId: "",
+        projectName: service.projectName,
+        env: railwayEnv
+      })).project;
+      const environment = (await ensureRailwayEnvironment({
+        projectId: project.id,
+        environmentName: service.environmentName,
+        env: railwayEnv
+      })).environment;
+      const railwayService = (await ensureRailwayService({
+        projectId: project.id,
+        serviceId: service.serviceId,
+        serviceName: service.serviceName,
+        env: railwayEnv
+      })).service;
+      const variableValues = Object.fromEntries(
+        [...service.secrets, ...service.variables].map((key) => [key, serviceValues[key]]).filter(([, value]) => typeof value === "string" && value.length > 0)
       );
+      if (Object.keys(variableValues).length > 0) {
+        await upsertRailwayVariables({
+          projectId: project.id,
+          environmentId: environment.id,
+          serviceId: railwayService.id,
+          variables: variableValues,
+          env: railwayEnv
+        });
+      }
     }
     progress(`[${scope}][railway][${service.service}] Complete.`);
   }
@@ -2621,7 +2754,7 @@ function buildConfigEntrySnapshot(scope, entry, currentValue, suggestedValue) {
         return true;
     }
   })();
-  const allowGeneratedSecretDefault = entry.id === "TREESEED_PLATFORM_RUNNER_SECRET";
+  const allowGeneratedSecretDefault = ["TREESEED_PLATFORM_RUNNER_SECRET", "TREESEED_WEB_SERVICE_SECRET", "TREESEED_API_WEB_SERVICE_SECRET", "TREESEED_CREDENTIAL_SESSION_SECRET"].includes(entry.id);
   const allowSuggestedDefault = allowGeneratedSecretDefault || !(entry.sensitivity === "secret" && entry.requirement !== "optional");
   const effectiveValue = currentValueValid ? currentValue || (allowSuggestedDefault ? suggestedValue : "") || "" : (allowSuggestedDefault ? suggestedValue : "") || currentValue || "";
   return {
@@ -2820,7 +2953,7 @@ async function finalizeTreeseedConfig({
   );
   for (const scope of scopes) {
     const selection = resolveTreeseedBootstrapSelection({
-      deployConfig: registry.context.deployConfig,
+      deployConfig: workspaceBootstrapDeployConfig(tenantRoot, registry.context.deployConfig),
       env: scopeSeedValues[scope],
       systems: scope === "local" ? ["github"] : systems,
       skipUnavailable: scope === "local" ? true : skipUnavailable
@@ -2968,7 +3101,7 @@ async function finalizeTreeseedConfig({
           result: {}
         });
       }
-      const deploySystems = selection.runnable.filter((system) => system === "data" || system === "web");
+      const deploySystems = selection.runnable.filter((system) => system === "data" || system === "web" || system === "api" || system === "agents");
       if (deploySystems.length > 0) {
         progress(`[${scope}][bootstrap][deploy] Deploying ${deploySystems.join(", ")}...`);
         applyTreeseedEnvironmentToProcess({ tenantRoot, scope, override: true });
@@ -3026,27 +3159,37 @@ async function finalizeTreeseedConfig({
   }
   if (sync === "github" || sync === "all") {
     const githubScopes = scopes.filter((scope) => scope !== "local" && summary.bootstrapSystemsByScope[scope].runnable.includes("github"));
-    const syncScope = async (scope) => {
-      progress(`[${scope}][github][sync] Syncing GitHub environment...`);
+    const githubTargets = discoverGitHubEnvironmentSyncTargets(tenantRoot, githubRepository);
+    if (githubTargets.length === 0 && githubScopes.length > 0) {
+      throw new Error("Unable to determine the GitHub repository from the origin remote.");
+    }
+    const syncScope = async (scope, target) => {
+      progress(`[${scope}][github][sync] Syncing GitHub environment for ${target.repository}...`);
       return await syncTreeseedGitHubEnvironment({
         tenantRoot,
         scope,
-        repository: githubRepository,
+        repository: target.repository,
+        managedHostMode: target.managedHostMode,
         execution: bootstrapExecution,
         onProgress: progress
       });
     };
     const githubResults = [];
     if (bootstrapExecution === "sequential") {
-      for (const scope of githubScopes) {
-        githubResults.push(await syncScope(scope));
+      for (const target of githubTargets) {
+        for (const scope of githubScopes) {
+          githubResults.push(await syncScope(scope, target));
+        }
       }
     } else {
-      githubResults.push(...await Promise.all(githubScopes.map((scope) => syncScope(scope))));
+      githubResults.push(...await Promise.all(githubTargets.flatMap(
+        (target) => githubScopes.map((scope) => syncScope(scope, target))
+      )));
     }
     summary.synced.github = {
       scopes: githubResults,
       repository: githubResults[0]?.repository ?? githubRepository ?? maybeResolveGitHubRepositorySlug(tenantRoot),
+      repositories: githubResults.map((entry) => entry.repository).filter((repository, index, all) => all.indexOf(repository) === index),
       secrets: githubResults.flatMap((entry) => entry.secrets),
       variables: githubResults.flatMap((entry) => entry.variables)
     };

package/dist/operations/services/deploy.d.ts

@@ -27,7 +27,7 @@ export declare function buildPublicVars(deployConfig: any, options?: {}): {
     TREESEED_RUNTIME_MODE: any;
     TREESEED_RUNTIME_REGISTRATION: any;
     TREESEED_CENTRAL_MARKET_API_BASE_URL: string;
-    TREESEED_MARKET_API_BASE_URL: any;
+    TREESEED_API_BASE_URL: any;
     TREESEED_CATALOG_MARKET_API_BASE_URLS: any;
     TREESEED_HOSTING_TEAM_ID: string;
     TREESEED_PROJECT_ID: string;
@@ -129,6 +129,7 @@ export declare function ensureGeneratedWranglerConfig(tenantRoot: any, options?:
                 previewProjectName: string | undefined;
                 productionBranch: string;
                 stagingBranch: string;
+                buildCommand: string | undefined;
                 buildOutputDir: string | undefined;
             } | undefined;
             r2: {
@@ -308,6 +309,9 @@ export declare function listQueues(tenantRoot: any, env: any): any;
 export declare function listR2Buckets(tenantRoot: any, env: any): any;
 export declare function listPagesProjects(tenantRoot: any, env: any): any;
 export declare function listTurnstileWidgets(tenantRoot: any, env: any): any;
+export declare function listWorkers(tenantRoot: any, env: any): any;
+export declare function listDnsZones(env: any): any;
+export declare function listDnsRecords(zoneId: any, env: any): any[];
 export declare function getTurnstileWidget(env: any, sitekey: any): any;
 export declare function createTurnstileWidget(env: any, input: any): any;
 export declare function updateTurnstileWidget(env: any, sitekey: any, input: any): any;
@@ -531,6 +535,7 @@ export declare function validateDeployPrerequisites(tenantRoot: any, { requireRe
             previewProjectName: string | undefined;
             productionBranch: string;
             stagingBranch: string;
+            buildCommand: string | undefined;
             buildOutputDir: string | undefined;
         } | undefined;
         r2: {
@@ -724,6 +729,7 @@ export declare function validateDestroyPrerequisites(tenantRoot: any, { requireR
             previewProjectName: string | undefined;
             productionBranch: string;
             stagingBranch: string;
+            buildCommand: string | undefined;
             buildOutputDir: string | undefined;
         } | undefined;
         r2: {
@@ -881,6 +887,26 @@ export declare function validateDestroyPrerequisites(tenantRoot: any, { requireR
     };
 };
 export declare function shouldDeleteRailwayProjectAfterEnvironmentDestroy(project: any, scope: any, deleteData: any, deletedEnvironmentId?: null): boolean;
+export declare function setDestroyDockerRunnerForTests(runner: any): void;
+export declare function dockerLocalRuntimeResourceOperations({ dryRun }?: {
+    dryRun?: boolean | undefined;
+}): any[];
+export declare function cloudflareDestroyVerification(tenantRoot: any, deployConfig: any, state: any, env: any): {
+    provider: string;
+    method: string;
+    status: string;
+    remaining: {
+        pages: any;
+        workers: any;
+        kvNamespaces: any;
+        queues: any;
+        d1Databases: any;
+        r2Buckets: any;
+        turnstileWidgets: any;
+        dnsRecords: any;
+    };
+    totalRemaining: any;
+};
 export declare function destroyTreeseedEnvironmentResources(tenantRoot: any, options?: {}): Promise<{
     target: {
         kind: string;
@@ -890,6 +916,7 @@ export declare function destroyTreeseedEnvironmentResources(tenantRoot: any, opt
         branchName: string;
     };
     deleteData: boolean;
+    sweepTreeseed: boolean;
     summary: {
         target: any;
         identity: any;
@@ -947,13 +974,49 @@ export declare function destroyTreeseedEnvironmentResources(tenantRoot: any, opt
             name: any;
             status: any;
         }[];
-        local: {
-            provider: any;
-            type: any;
-            name: any;
-            status: any;
-        }[];
+        local: any[];
     };
+    verification: {
+        localDocker?: {
+            provider: string;
+            method: string;
+            status: string;
+            reason: string;
+            remaining: {
+                containers: number;
+                volumes: number;
+                networks: number;
+            };
+            totalRemaining: number;
+        } | {
+            provider: string;
+            method: string;
+            status: string;
+            remaining: {
+                containers: any;
+                volumes: any;
+                networks: any;
+            };
+            totalRemaining: any;
+            reason?: undefined;
+        } | undefined;
+        cloudflare: {
+            provider: string;
+            method: string;
+            status: string;
+            remaining: {
+                pages: any;
+                workers: any;
+                kvNamespaces: any;
+                queues: any;
+                d1Databases: any;
+                r2Buckets: any;
+                turnstileWidgets: any;
+                dnsRecords: any;
+            };
+            totalRemaining: any;
+        };
+    } | null;
 }>;
 export declare function destroyCloudflareResources(tenantRoot: any, options?: {}): {
     target: {