@treeseed/sdk 0.10.28 → 0.12.4

package/dist/operations/services/release-candidate.js

@@ -1,616 +0,0 @@
-import { createHash } from "node:crypto";
-import { spawnSync } from "node:child_process";
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { dirname, join, relative, resolve } from "node:path";
-import { isTreeseedEnvironmentEntryRelevant, isTreeseedEnvironmentEntryRequired } from "../../platform/environment.js";
-import { maybeResolveGitHubRepositorySlug } from "./github-automation.js";
-import { createGitHubApiClient, listGitHubEnvironmentSecretNames, listGitHubEnvironmentVariableNames } from "./github-api.js";
-import { collectInternalDevReferenceIssues, normalizeGitRemoteForManifest } from "./package-reference-policy.js";
-import { collectTreeseedEnvironmentContext, resolveTreeseedMachineEnvironmentValues, validateTreeseedCommandEnvironment } from "./config-runtime.js";
-import { loadDeployState } from "./deploy.js";
-import { loadCliDeployConfig } from "./runtime-tools.js";
-import { packagesWithScript, run, workspacePackages } from "./workspace-tools.js";
-import { createBuildWarningSummary, formatAllowedBuildWarnings } from "./build-warning-policy.js";
-const RELEASE_CANDIDATE_CACHE_DIR = ".treeseed/workflow/release-candidates";
-const RELEASE_CANDIDATE_POLICY_VERSION = "strict-output-v1";
-const STABLE_SEMVER = /^\d+\.\d+\.\d+$/u;
-const REHEARSAL_IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
-  ".git",
-  ".treeseed",
-  ".wrangler",
-  ".astro",
-  "coverage",
-  "dist",
-  "node_modules"
-]);
-function nowIso() {
-  return (/* @__PURE__ */ new Date()).toISOString();
-}
-function sortedRecord(record) {
-  return Object.fromEntries(Object.entries(record).sort(([left], [right]) => left.localeCompare(right)));
-}
-function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
-}
-function fileSha256(filePath) {
-  if (!existsSync(filePath)) return null;
-  return createHash("sha256").update(readFileSync(filePath)).digest("hex");
-}
-function safeGitHead(repoDir) {
-  try {
-    return run("git", ["rev-parse", "HEAD"], { cwd: repoDir, capture: true }).trim();
-  } catch {
-    return null;
-  }
-}
-function safePackageJson(filePath) {
-  try {
-    return JSON.parse(readFileSync(filePath, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeJsonFile(filePath, value) {
-  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-}
-function packageScripts(filePath) {
-  const packageJson = safePackageJson(filePath);
-  return packageJson?.scripts && typeof packageJson.scripts === "object" && !Array.isArray(packageJson.scripts) ? packageJson.scripts : {};
-}
-function releaseCandidateCachePath(root, key) {
-  return resolve(root, RELEASE_CANDIDATE_CACHE_DIR, `${key}.json`);
-}
-function ensureReleaseCandidateCacheDir(root) {
-  const dir = resolve(root, RELEASE_CANDIDATE_CACHE_DIR);
-  mkdirSync(dir, { recursive: true });
-  const gitignorePath = resolve(root, ".treeseed", "workflow", ".gitignore");
-  mkdirSync(dirname(gitignorePath), { recursive: true });
-  if (!existsSync(gitignorePath)) {
-    writeFileSync(gitignorePath, "*\n!.gitignore\n!runs/\nruns/*\n!runs/.gitignore\n", "utf8");
-  }
-  return dir;
-}
-function buildReleaseCandidateFingerprint(input) {
-  const selectedPackages = [...new Set((input.selectedPackageNames ?? []).map(String))].sort();
-  const selectedPackageSet = new Set(selectedPackages);
-  const packages = workspacePackages(input.root).filter((pkg) => typeof pkg.name === "string" && pkg.name.startsWith("@treeseed/"));
-  const packageShas = sortedRecord(Object.fromEntries(
-    packages.map((pkg) => [pkg.name, safeGitHead(pkg.dir)])
-  ));
-  const plannedVersions = sortedRecord(Object.fromEntries(
-    Object.entries(input.plannedVersions).filter(([name]) => name === "@treeseed/market" || selectedPackageSet.has(name)).map(([name, version]) => [name, String(version)])
-  ));
-  const lockfiles = sortedRecord({
-    "@treeseed/market": fileSha256(resolve(input.root, "package-lock.json")),
-    ...Object.fromEntries(packages.map((pkg) => [pkg.name, fileSha256(resolve(pkg.dir, "package-lock.json"))]))
-  });
-  const base = {
-    policyVersion: RELEASE_CANDIDATE_POLICY_VERSION,
-    rootSha: safeGitHead(input.root),
-    packageShas,
-    plannedVersions,
-    lockfiles,
-    selectedPackages
-  };
-  return {
-    ...base,
-    key: sha256(JSON.stringify(base))
-  };
-}
-function readCachedReleaseCandidateReport(root, key) {
-  const cachePath = releaseCandidateCachePath(root, key);
-  if (!existsSync(cachePath)) return null;
-  try {
-    return JSON.parse(readFileSync(cachePath, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeReleaseCandidateReport(root, report) {
-  ensureReleaseCandidateCacheDir(root);
-  writeFileSync(releaseCandidateCachePath(root, report.fingerprint.key), `${JSON.stringify(report, null, 2)}
-`, "utf8");
-  return report;
-}
-function addFailure(failures, failure) {
-  failures.push({
-    ...failure,
-    details: failure.details ?? null,
-    provider: failure.provider ?? null
-  });
-}
-function packageReadinessChecks(root, selectedPackageNames, failures) {
-  if (selectedPackageNames.length === 0) {
-    return { name: "package-release-readiness", status: "skipped", detail: "No packages are selected for this release." };
-  }
-  const selected = new Set(selectedPackageNames);
-  const packages = workspacePackages(root).filter((pkg) => selected.has(pkg.name));
-  for (const pkg of packages) {
-    const packageJson = safePackageJson(resolve(pkg.dir, "package.json"));
-    const scripts = packageJson?.scripts && typeof packageJson.scripts === "object" && !Array.isArray(packageJson.scripts) ? packageJson.scripts : {};
-    if (!existsSync(resolve(pkg.dir, ".github", "workflows", "publish.yml"))) {
-      addFailure(failures, {
-        code: "missing_publish_workflow",
-        scope: pkg.name,
-        provider: "github",
-        message: `${pkg.name} is missing .github/workflows/publish.yml.`
-      });
-    }
-    if (typeof scripts["release:publish"] !== "string") {
-      addFailure(failures, {
-        code: "missing_publish_script",
-        scope: pkg.name,
-        message: `${pkg.name} is missing a release:publish script.`
-      });
-    }
-    if (typeof scripts["verify:local"] !== "string" && typeof scripts["verify"] !== "string" && typeof scripts["verify:action"] !== "string") {
-      addFailure(failures, {
-        code: "missing_verify_script",
-        scope: pkg.name,
-        message: `${pkg.name} is missing a release-ready verify script.`
-      });
-    }
-    try {
-      run("npm", ["pack", "--dry-run"], { cwd: pkg.dir, capture: true, timeoutMs: 12e4 });
-    } catch (error) {
-      addFailure(failures, {
-        code: "npm_pack_dry_run_failed",
-        scope: pkg.name,
-        message: `${pkg.name} failed npm pack --dry-run.`,
-        details: { error: error instanceof Error ? error.message : String(error) }
-      });
-    }
-  }
-  return {
-    name: "package-release-readiness",
-    status: failures.some((failure) => failure.code.startsWith("missing_") || failure.code === "npm_pack_dry_run_failed") ? "failed" : "passed",
-    detail: `Checked ${packages.length} selected package${packages.length === 1 ? "" : "s"}.`
-  };
-}
-function copyWorkspaceForProductionRehearsal(root) {
-  const tempParent = mkdtempSync(join(tmpdir(), "treeseed-release-candidate-"));
-  const tempRoot = join(tempParent, "workspace");
-  cpSync(root, tempRoot, {
-    recursive: true,
-    filter: (source) => {
-      const rel = relative(root, source);
-      if (!rel) return true;
-      const segments = rel.split(/[\\/]+/u);
-      return !segments.some((segment) => REHEARSAL_IGNORED_SEGMENTS.has(segment));
-    }
-  });
-  return { tempParent, tempRoot };
-}
-function applyPlannedStableMetadata(root, plannedVersions) {
-  const stableVersions = new Map(
-    Object.entries(plannedVersions).filter(([, version]) => STABLE_SEMVER.test(version))
-  );
-  const stableGitReferences = stablePackageGitReferences(root, stableVersions);
-  const targets = [
-    { name: "@treeseed/market", dir: root },
-    ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))
-  ];
-  for (const target of targets) {
-    const packageJsonPath = resolve(target.dir, "package.json");
-    const packageJson = safePackageJson(packageJsonPath);
-    if (!packageJson) continue;
-    let changed = false;
-    const plannedVersion = stableVersions.get(target.name);
-    if (plannedVersion && packageJson.version !== plannedVersion) {
-      packageJson.version = plannedVersion;
-      changed = true;
-    }
-    for (const field of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies"]) {
-      const values = packageJson[field];
-      if (!values || typeof values !== "object" || Array.isArray(values)) continue;
-      for (const [dependencyName, version] of stableVersions.entries()) {
-        if (!(dependencyName in values)) continue;
-        const dependencySpec = stableGitReferences.get(dependencyName) ?? version;
-        if (String(values[dependencyName]) === dependencySpec) continue;
-        values[dependencyName] = dependencySpec;
-        changed = true;
-      }
-    }
-    if (changed) {
-      writeJsonFile(packageJsonPath, packageJson);
-    }
-  }
-}
-function stablePackageGitReferences(root, versions) {
-  return new Map(workspacePackages(root).map((pkg) => {
-    const version = versions.get(pkg.name);
-    if (!version) return null;
-    let remote = null;
-    try {
-      remote = run("git", ["remote", "get-url", "origin"], { cwd: pkg.dir, capture: true }).trim();
-    } catch {
-      remote = null;
-    }
-    const manifestRemote = normalizeGitRemoteForManifest(remote ?? "", "preserve-origin");
-    return manifestRemote ? [pkg.name, `${manifestRemote}#${version}`] : null;
-  }).filter((entry) => Boolean(entry)));
-}
-function rehearsalVerifyScript(root) {
-  const scripts = packageScripts(resolve(root, "package.json"));
-  for (const scriptName of ["verify:direct", "verify:local", "verify", "build"]) {
-    if (typeof scripts[scriptName] === "string") {
-      return scriptName;
-    }
-  }
-  return null;
-}
-function runNpmRehearsalCommand(args, options) {
-  const result = spawnSync("npm", args, {
-    cwd: options.cwd,
-    env: options.env ?? process.env,
-    stdio: "pipe",
-    encoding: "utf8",
-    timeout: options.timeoutMs
-  });
-  const stdout = result.stdout ?? "";
-  const stderr = result.stderr ?? "";
-  if (result.status !== 0) {
-    if (stdout) process.stdout.write(stdout);
-    if (stderr) process.stderr.write(stderr);
-    const message = (result.error?.message ? `${result.error.message}
-` : "") + (stderr.trim() || stdout.trim() || `npm ${args.join(" ")} failed`);
-    throw new Error(message);
-  }
-  const warningSummary = createBuildWarningSummary();
-  const outputFailures = [];
-  const emitFiltered = (text, stream) => {
-    for (const line of text.split(/\r?\n/u)) {
-      if (!line) continue;
-      const classified = warningSummary.record(line);
-      if (classified.kind === "allowed") continue;
-      for (const failure of collectReleaseCandidateOutputFailures(line)) {
-        outputFailures.push(failure);
-      }
-      stream.write(`${line}
-`);
-    }
-  };
-  emitFiltered(stdout, process.stdout);
-  emitFiltered(stderr, process.stderr);
-  for (const line of formatAllowedBuildWarnings(warningSummary.allowedWarnings)) {
-    process.stdout.write(`${line}
-`);
-  }
-  if (outputFailures.length > 0) {
-    throw new Error([
-      `npm ${args.join(" ")} completed with error output despite exit code 0.`,
-      ...outputFailures.slice(0, 12)
-    ].join("\n"));
-  }
-}
-function collectReleaseCandidateOutputFailures(line) {
-  const value = String(line ?? "").trim();
-  if (!value) return [];
-  const failures = [];
-  if (/^stderr\s+\|\s+/u.test(value)) {
-    failures.push(`Captured test stderr: ${value}`);
-  }
-  if (/(^|\s)ERROR(?:\s|\[|:)/u.test(value)) {
-    failures.push(`Error output: ${value}`);
-  }
-  if (/\bFailed to run background task\b/u.test(value)) {
-    failures.push(`Background task failure output: ${value}`);
-  }
-  return failures;
-}
-function buildRehearsalWorkspacePackageArtifacts(root) {
-  for (const pkg of packagesWithScript("build:dist", root)) {
-    runNpmRehearsalCommand(["--prefix", pkg.dir, "run", "build:dist"], { cwd: root, timeoutMs: 3e5 });
-  }
-}
-function runProductionDependencyRehearsal(root, plannedVersions, selectedPackageNames, failures) {
-  if (process.env.TREESEED_RELEASE_CANDIDATE_REHEARSAL_MODE === "skip") {
-    return "Skipped clean install rehearsal by request.";
-  }
-  const selectedPackageSet = new Set(selectedPackageNames);
-  let tempParent = null;
-  try {
-    const copied = copyWorkspaceForProductionRehearsal(root);
-    tempParent = copied.tempParent;
-    applyPlannedStableMetadata(copied.tempRoot, plannedVersions);
-    runNpmRehearsalCommand(["install", "--package-lock-only", "--ignore-scripts"], { cwd: copied.tempRoot, timeoutMs: 3e5 });
-    runNpmRehearsalCommand(["ci", "--ignore-scripts"], { cwd: copied.tempRoot, timeoutMs: 6e5 });
-    buildRehearsalWorkspacePackageArtifacts(copied.tempRoot);
-    const scriptName = rehearsalVerifyScript(copied.tempRoot);
-    if (scriptName) {
-      const packageJson = safePackageJson(resolve(copied.tempRoot, "package.json"));
-      const parallelMarketVerify = packageJson?.name === "@treeseed/market" && (scriptName === "verify:direct" || scriptName === "verify:local" || scriptName === "verify");
-      runNpmRehearsalCommand(["run", scriptName], {
-        cwd: copied.tempRoot,
-        timeoutMs: 9e5,
-        env: parallelMarketVerify ? { ...process.env, TREESEED_VERIFY_PARALLEL: "1" } : process.env
-      });
-    }
-    const postInstallIssues = collectInternalDevReferenceIssues(copied.tempRoot, selectedPackageSet);
-    if (postInstallIssues.length > 0) {
-      addFailure(failures, {
-        code: "internal_dev_references_after_rehearsal",
-        scope: "@treeseed/market",
-        message: "Production dependency rehearsal still found internal dev references after clean install.",
-        details: {
-          references: postInstallIssues.map((issue) => ({
-            filePath: issue.filePath,
-            field: issue.field,
-            dependencyName: issue.dependencyName,
-            spec: issue.spec,
-            reason: issue.reason
-          }))
-        }
-      });
-    }
-    return scriptName ? `Ran clean install and npm run ${scriptName} in a temporary production rehearsal workspace.` : "Ran clean install in a temporary production rehearsal workspace.";
-  } catch (error) {
-    addFailure(failures, {
-      code: "production_dependency_rehearsal_failed",
-      scope: "@treeseed/market",
-      message: "Production dependency rehearsal failed in the temporary workspace.",
-      details: { error: error instanceof Error ? error.message : String(error) }
-    });
-    return "Production dependency rehearsal failed.";
-  } finally {
-    if (tempParent) {
-      rmSync(tempParent, { recursive: true, force: true });
-    }
-  }
-}
-function dependencyRehearsalChecks(root, plannedVersions, selectedPackageNames, failures) {
-  const before = failures.length;
-  for (const [name, version] of Object.entries(plannedVersions)) {
-    if ((name === "@treeseed/market" || selectedPackageNames.includes(name)) && !STABLE_SEMVER.test(version)) {
-      addFailure(failures, {
-        code: "unstable_planned_version",
-        scope: name,
-        message: `${name} planned release version is not stable semver: ${version}.`
-      });
-    }
-  }
-  const devReferenceIssues = collectInternalDevReferenceIssues(root);
-  const unrehearsableDevReferences = devReferenceIssues.filter((issue) => {
-    const dependencyName = issue.dependencyName ?? "";
-    const planned = plannedVersions[dependencyName];
-    return !planned || !STABLE_SEMVER.test(planned);
-  });
-  if (unrehearsableDevReferences.length > 0) {
-    addFailure(failures, {
-      code: "internal_dev_references",
-      scope: "@treeseed/market",
-      message: "Production dependency rehearsal found internal dev references without a stable planned replacement.",
-      details: {
-        references: unrehearsableDevReferences.map((issue) => ({
-          filePath: issue.filePath,
-          field: issue.field,
-          dependencyName: issue.dependencyName,
-          spec: issue.spec,
-          reason: issue.reason
-        }))
-      }
-    });
-  }
-  const rehearsalDetail = unrehearsableDevReferences.length === 0 && failures.length === before ? runProductionDependencyRehearsal(root, plannedVersions, selectedPackageNames, failures) : "Skipped clean install rehearsal because stable dependency metadata is incomplete.";
-  return {
-    name: "production-dependency-rehearsal",
-    status: failures.length > before ? "failed" : "passed",
-    detail: `${devReferenceIssues.length > 0 ? `Rehearsed stable replacements for ${devReferenceIssues.length} internal dev reference${devReferenceIssues.length === 1 ? "" : "s"}.` : "Checked planned stable versions and internal dependency references."} ${rehearsalDetail}`
-  };
-}
-function localConfigCheck(root, scope, failures) {
-  try {
-    const report = validateTreeseedCommandEnvironment({ tenantRoot: root, scope, purpose: "deploy" });
-    const problems = [...report.validation.missing, ...report.validation.invalid];
-    for (const problem of problems) {
-      addFailure(failures, {
-        code: "missing_local_config",
-        scope,
-        provider: problem.entry.group ?? "config",
-        message: `${scope} deploy config is missing or invalid: ${problem.id}.`,
-        details: { key: problem.id, provider: problem.entry.group ?? null }
-      });
-    }
-  } catch (error) {
-    addFailure(failures, {
-      code: "config_validation_failed",
-      scope,
-      provider: "config",
-      message: `${scope} deploy config could not be validated.`,
-      details: { error: error instanceof Error ? error.message : String(error) }
-    });
-  }
-}
-async function githubRemoteConfigCheck(root, scope, failures) {
-  const repository = maybeResolveGitHubRepositorySlug(root);
-  if (!repository) {
-    addFailure(failures, {
-      code: "missing_github_repository",
-      scope,
-      provider: "github",
-      message: `${scope} GitHub config parity could not determine the repository from origin.`
-    });
-    return;
-  }
-  try {
-    const environment = scope === "prod" ? "production" : scope;
-    const expected = expectedGitHubDeployEnvironment(root, scope);
-    const client = createGitHubApiClient();
-    const [secretNames, variableNames] = await Promise.all([
-      listGitHubEnvironmentSecretNames(repository, environment, { client }),
-      listGitHubEnvironmentVariableNames(repository, environment, { client })
-    ]);
-    const missingSecrets = expected.secrets.filter((key) => !secretNames.has(key));
-    const missingVariables = expected.variables.filter((key) => !variableNames.has(key));
-    for (const key of missingSecrets) {
-      addFailure(failures, {
-        code: "missing_remote_config",
-        scope,
-        provider: "github-secret",
-        message: `${scope} GitHub secret is missing: ${key}.`,
-        details: { key, provider: "github-secret", repository, environment }
-      });
-    }
-    for (const key of missingVariables) {
-      addFailure(failures, {
-        code: "missing_remote_config",
-        scope,
-        provider: "github-variable",
-        message: `${scope} GitHub variable is missing: ${key}.`,
-        details: { key, provider: "github-variable", repository, environment }
-      });
-    }
-  } catch (error) {
-    addFailure(failures, {
-      code: "remote_config_check_failed",
-      scope,
-      provider: "github",
-      message: `${scope} GitHub config parity check failed.`,
-      details: { error: error instanceof Error ? error.message : String(error) }
-    });
-  }
-}
-function expectedGitHubDeployEnvironment(root, scope) {
-  const registry = collectTreeseedEnvironmentContext(root);
-  const values = resolveTreeseedMachineEnvironmentValues(root, scope);
-  const expectedEntries = registry.entries.filter((entry) => {
-    if (!isTreeseedEnvironmentEntryRelevant(entry, registry.context, scope, "deploy")) return false;
-    if (isTreeseedEnvironmentEntryRequired(entry, registry.context, scope, "deploy")) return true;
-    return typeof values[entry.id] === "string" && values[entry.id].trim().length > 0;
-  });
-  return {
-    secrets: [...new Set(expectedEntries.filter((entry) => entry.targets.includes("github-secret")).map((entry) => entry.id))],
-    variables: [...new Set(expectedEntries.filter((entry) => entry.targets.includes("github-variable")).map((entry) => entry.id))]
-  };
-}
-function providerResourceIdentifierCheck(root, scope, failures) {
-  try {
-    const deployConfig = loadCliDeployConfig(root);
-    const state = loadDeployState(root, deployConfig, { scope });
-    const siteDataDb = state.d1Databases?.SITE_DATA_DB;
-    if (!siteDataDb?.databaseName || !siteDataDb?.databaseId) {
-      addFailure(failures, {
-        code: "missing_remote_resource_identifier",
-        scope,
-        provider: "cloudflare-d1",
-        message: `${scope} Cloudflare D1 SITE_DATA_DB is missing a database name or id.`,
-        details: { resource: "SITE_DATA_DB", required: ["databaseName", "databaseId"] }
-      });
-    }
-    const services = state.services && typeof state.services === "object" && !Array.isArray(state.services) ? state.services : {};
-    for (const [serviceKey, service] of Object.entries(services)) {
-      if ((service.provider ?? "railway") !== "railway") continue;
-      if (!service.projectName && !service.projectId) {
-        addFailure(failures, {
-          code: "missing_remote_resource_identifier",
-          scope,
-          provider: "railway",
-          message: `${scope} Railway service ${serviceKey} is missing a project name or id.`,
-          details: { service: serviceKey, required: ["projectName", "projectId"] }
-        });
-      }
-      if (!service.serviceName && !service.serviceId) {
-        addFailure(failures, {
-          code: "missing_remote_resource_identifier",
-          scope,
-          provider: "railway",
-          message: `${scope} Railway service ${serviceKey} is missing a service name or id.`,
-          details: { service: serviceKey, required: ["serviceName", "serviceId"] }
-        });
-      }
-    }
-  } catch (error) {
-    addFailure(failures, {
-      code: "provider_resource_check_failed",
-      scope,
-      provider: "deployment-state",
-      message: `${scope} provider resource identifiers could not be validated.`,
-      details: { error: error instanceof Error ? error.message : String(error) }
-    });
-  }
-}
-async function configParityChecks(root, failures) {
-  if (process.env.TREESEED_RELEASE_CANDIDATE_CONFIG_PARITY_MODE === "skip") {
-    return { name: "config-parity", status: "skipped", detail: "Remote config parity skipped by request." };
-  }
-  const before = failures.length;
-  localConfigCheck(root, "staging", failures);
-  localConfigCheck(root, "prod", failures);
-  await githubRemoteConfigCheck(root, "staging", failures);
-  await githubRemoteConfigCheck(root, "prod", failures);
-  providerResourceIdentifierCheck(root, "staging", failures);
-  providerResourceIdentifierCheck(root, "prod", failures);
-  return {
-    name: "config-parity",
-    status: failures.length > before ? "failed" : "passed",
-    detail: "Checked staging and production config, GitHub names, Railway service identifiers, and D1 identifiers without reading secret values."
-  };
-}
-function migrationCompatibilityChecks(root, failures) {
-  if (!existsSync(resolve(root, "packages/sdk/package.json"))) {
-    return {
-      name: "migration-compatibility",
-      status: "skipped",
-      detail: "No SDK package checkout is present in this workspace."
-    };
-  }
-  const requiredArtifacts = [
-    "packages/sdk/drizzle/d1/0000_treeseed_d1.sql",
-    "packages/sdk/drizzle/market/0000_market_control_plane.sql"
-  ];
-  const missing = requiredArtifacts.filter((path) => !existsSync(resolve(root, path)));
-  for (const path of missing) {
-    addFailure(failures, {
-      code: "missing_drizzle_migration_artifact",
-      scope: "@treeseed/market",
-      message: `Drizzle migration compatibility check is missing ${path}.`,
-      details: { path }
-    });
-  }
-  return {
-    name: "migration-compatibility",
-    status: missing.length > 0 ? "failed" : "passed",
-    detail: "Checked required Drizzle migration artifacts for Market PostgreSQL and SDK D1."
-  };
-}
-async function runReleaseCandidateGate(input) {
-  const fingerprint = buildReleaseCandidateFingerprint(input);
-  if (input.allowReuse !== false) {
-    const cached = readCachedReleaseCandidateReport(input.root, fingerprint.key);
-    if (cached?.status === "passed") {
-      return {
-        ...cached,
-        reused: true
-      };
-    }
-  }
-  const selectedPackageNames = [...new Set((input.selectedPackageNames ?? []).map(String))].sort();
-  const plannedVersions = Object.fromEntries(
-    Object.entries(input.plannedVersions).map(([name, version]) => [name, String(version)])
-  );
-  const failures = [];
-  const checks = [];
-  checks.push(dependencyRehearsalChecks(input.root, plannedVersions, selectedPackageNames, failures));
-  checks.push(packageReadinessChecks(input.root, selectedPackageNames, failures));
-  checks.push(await configParityChecks(input.root, failures));
-  checks.push(migrationCompatibilityChecks(input.root, failures));
-  const report = {
-    status: failures.length === 0 ? "passed" : "failed",
-    fingerprint,
-    reused: false,
-    checkedAt: nowIso(),
-    failures,
-    checks
-  };
-  writeReleaseCandidateReport(input.root, report);
-  return report;
-}
-export {
-  buildReleaseCandidateFingerprint,
-  collectReleaseCandidateOutputFailures,
-  readCachedReleaseCandidateReport,
-  runReleaseCandidateGate,
-  writeReleaseCandidateReport
-};

package/dist/scripts/ensure-mailpit.js

@@ -1,48 +0,0 @@
-import { spawnSync } from 'node:child_process';
-import { dockerIsAvailable, findRunningMailpitContainer } from '../operations/services/mailpit-runtime.js';
-import { packageRoot } from '../operations/services/runtime-paths.js';
-function mailpitConfig() {
-    return {
-        containerName: process.env.TREESEED_MAILPIT_CONTAINER_NAME?.trim() || 'treeseed_mailpit',
-        smtpPort: process.env.TREESEED_MAILPIT_SMTP_PORT?.trim() || '1025',
-        uiPort: process.env.TREESEED_MAILPIT_UI_PORT?.trim() || '8025',
-    };
-}
-if (!dockerIsAvailable()) {
-    console.error('Docker is required for Treeseed form email testing. Start Docker and rerun the Mailpit command.');
-    process.exit(1);
-}
-const existingMailpit = findRunningMailpitContainer();
-const config = mailpitConfig();
-if (existingMailpit) {
-    console.log(`Reusing existing Mailpit container "${existingMailpit.name}" on ports ${config.smtpPort} and ${config.uiPort}.`);
-    process.exit(0);
-}
-spawnSync('docker', ['rm', '-f', config.containerName], { encoding: 'utf8', cwd: packageRoot, env: { ...process.env } });
-const result = spawnSync('docker', [
-    'run',
-    '-d',
-    '--name',
-    config.containerName,
-    '-p',
-    `127.0.0.1:${config.smtpPort}:1025`,
-    '-p',
-    `127.0.0.1:${config.uiPort}:8025`,
-    'axllent/mailpit:latest',
-], {
-    encoding: 'utf8',
-    cwd: packageRoot,
-    env: { ...process.env },
-});
-if (result.status !== 0) {
-    const reusedMailpit = findRunningMailpitContainer();
-    if (reusedMailpit) {
-        console.log(`Reusing existing Mailpit container "${reusedMailpit.name}" on ports ${config.smtpPort} and ${config.uiPort}.`);
-        process.exit(0);
-    }
-    if (result.stdout)
-        process.stdout.write(result.stdout);
-    if (result.stderr)
-        process.stderr.write(result.stderr);
-}
-process.exit(result.status ?? 1);

package/dist/scripts/logs-mailpit.js

@@ -1,2 +0,0 @@
-import { streamKnownMailpitLogs } from '../operations/services/mailpit-runtime.js';
-streamKnownMailpitLogs();