@treeseed/sdk 0.10.28 → 0.12.4

package/dist/platform/desired-state.js

@@ -0,0 +1,1021 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { basename, dirname, resolve as resolvePath } from "node:path";
+import { parse as parseYaml } from "yaml";
+import {
+  discoverTreeseedPackageAdapters
+} from "../operations/services/package-adapters.js";
+import { resolveCapacityProviderLaunchPlan } from "../capacity-provider.js";
+import { workspaceRoot } from "../operations/services/workspace-tools.js";
+import {
+  checkedOutTemplateRepositories
+} from "../operations/services/managed-repositories.js";
+import { deriveTreeseedDesiredUnits } from "../reconcile/desired-state.js";
+import {
+  buildProjectLocalContentResources
+} from "./local-content-materialization.js";
+function resolveLocalGitCommonDir(tenantRoot) {
+  const dotGitPath = resolvePath(tenantRoot, ".git");
+  if (!existsSync(dotGitPath)) return "";
+  try {
+    if (statSync(dotGitPath).isDirectory()) return dotGitPath;
+    const stat = readFileSync(dotGitPath, "utf8");
+    const match = /^gitdir:\s*(.+)\s*$/imu.exec(stat);
+    if (!match?.[1]) return dotGitPath;
+    const gitDir = resolvePath(tenantRoot, match[1].trim());
+    const commonDirPath = resolvePath(gitDir, "commondir");
+    if (existsSync(commonDirPath)) {
+      const commonDir = readFileSync(commonDirPath, "utf8").trim();
+      if (commonDir) return resolvePath(gitDir, commonDir);
+    }
+    const marker = `${resolvePath("/").replace(/\/$/u, "")}.git/worktrees/`;
+    const normalized = gitDir.replace(/\\/gu, "/");
+    const markerIndex = normalized.indexOf("/.git/worktrees/");
+    if (markerIndex >= 0) return normalized.slice(0, markerIndex + "/.git".length);
+    if (normalized.includes(marker)) return normalized.slice(0, normalized.indexOf(marker) + "/.git".length);
+    return dirname(gitDir);
+  } catch {
+    return "";
+  }
+}
+const INTERNAL_PACKAGE_DEPENDENCY_FIELDS = [
+  "dependencies",
+  "optionalDependencies",
+  "peerDependencies",
+  "devDependencies"
+];
+function hashJson(value) {
+  return createHash("sha256").update(JSON.stringify(value)).digest("hex");
+}
+function reconcileIdentityForGraph(workspaceId, environment) {
+  return {
+    teamId: workspaceId,
+    projectId: workspaceId,
+    slug: workspaceId,
+    environment,
+    deploymentKey: `${workspaceId}:${environment}`,
+    environmentKey: environment
+  };
+}
+function environmentFromTarget(target) {
+  if (target.kind === "persistent") return target.scope;
+  return "staging";
+}
+function packageReleaseCapability(adapter) {
+  if (adapter.artifacts.some((artifact) => artifact.provider === "docker")) return "image";
+  if (adapter.artifacts.some((artifact) => artifact.provider === "npm")) return "npm";
+  if (adapter.releaseChecks.length > 0) return "deploy-only";
+  return "none";
+}
+function packageUnitFromAdapter(adapter) {
+  return {
+    id: adapter.id,
+    name: adapter.name,
+    kind: adapter.kind,
+    path: adapter.relativeDir,
+    version: adapter.version,
+    publishTarget: adapter.publishTarget,
+    manifestPath: adapter.manifestPath,
+    repository: typeof adapter.metadata.repository === "string" ? adapter.metadata.repository : null,
+    releaseCapability: packageReleaseCapability(adapter)
+  };
+}
+function templateReleaseTag(manifest) {
+  return manifest.version ? `${manifest.release.tagPrefix}${manifest.id}/v${manifest.version}` : null;
+}
+function templateUnitFromRepository(repo) {
+  const manifest = repo.templateManifest;
+  return {
+    id: manifest.id,
+    name: manifest.name,
+    category: manifest.category,
+    path: repo.relativeDir,
+    version: manifest.version,
+    repository: manifest.repository,
+    manifestPath: manifest.manifestPath,
+    releaseTag: templateReleaseTag(manifest),
+    recordPath: manifest.release.recordPath
+  };
+}
+function stringRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function stringArray(value) {
+  return Array.isArray(value) ? value.filter((entry) => typeof entry === "string" && entry.trim().length > 0) : [];
+}
+function workflowName(value, fallback) {
+  return (typeof value === "string" && value.trim() ? value.trim() : fallback).replace(/^\.github\/workflows\//u, "");
+}
+function packageShortSha(adapter) {
+  const envSha = process.env.GITHUB_SHA;
+  if (typeof envSha === "string" && /^[a-f0-9]{7,40}$/iu.test(envSha)) return envSha.slice(0, 12).toLowerCase();
+  return createHash("sha256").update(`${adapter.id}:${adapter.dir}:${adapter.version ?? ""}`).digest("hex").slice(0, 12);
+}
+function materializeDockerImageTags(tags, adapter, branch) {
+  const shortSha = packageShortSha(adapter);
+  const branchSlug = branch.replace(/[^A-Za-z0-9_.-]+/gu, "-").replace(/^-+|-+$/gu, "") || "branch";
+  return tags.map((tag) => tag.replace(/<short-sha>/gu, shortSha).replace(/<branch-slug>/gu, branchSlug).replace(/<branch>/gu, branchSlug).replace(/<version>/gu, String(adapter.version ?? "latest").replace(/[^A-Za-z0-9_.-]+/gu, "-")));
+}
+function dockerPlatforms(artifactArchitectures, adapterArchitectures) {
+  const architectures = stringArray(artifactArchitectures).length > 0 ? stringArray(artifactArchitectures) : stringArray(adapterArchitectures);
+  const normalized = architectures.length > 0 ? architectures : ["amd64", "arm64"];
+  return normalized.map((arch) => arch.startsWith("linux/") ? arch : `linux/${arch}`);
+}
+function localDockerPlatform() {
+  if (process.arch === "arm64") return "linux/arm64";
+  if (process.arch === "arm") return "linux/arm/v7";
+  return "linux/amd64";
+}
+function safeTreeDxRepositoryName(value) {
+  return value.trim().toLowerCase().replace(/[^a-z0-9_.-]+/gu, "-").replace(/^-+|-+$/gu, "") || "project";
+}
+function localTreeDxContentProjects(tenantRoot) {
+  const seedPath = resolvePath(tenantRoot, "seeds", "treeseed.yaml");
+  if (!existsSync(seedPath)) return [];
+  const parsed = parseYaml(readFileSync(seedPath, "utf8"));
+  const resources = stringRecord(parsed?.resources);
+  const projects = Array.isArray(resources.projects) ? resources.projects : [];
+  return projects.flatMap((entry) => {
+    const project = stringRecord(entry);
+    const slug = typeof project.slug === "string" && project.slug.trim() ? project.slug.trim() : "";
+    const repository = stringRecord(project.repository);
+    const architecture = stringRecord(project.architecture);
+    const contentPath = typeof architecture.contentPath === "string" && architecture.contentPath.trim() ? architecture.contentPath.trim() : null;
+    if (!slug || !contentPath) return [];
+    const checkoutPath = typeof repository.checkoutPath === "string" && repository.checkoutPath.trim() ? repository.checkoutPath.trim() : ".";
+    return [{
+      projectKey: typeof project.key === "string" ? project.key : `project:treeseed/${slug}`,
+      slug,
+      repositoryName: safeTreeDxRepositoryName(`treeseed-${slug}`),
+      repositoryId: safeTreeDxRepositoryName(`treeseed-${slug}`),
+      localRoot: checkoutPath === "." ? tenantRoot : resolvePath(tenantRoot, checkoutPath),
+      contentPath,
+      defaultRef: "refs/heads/main",
+      seedPaths: [
+        `${contentPath.replace(/\/+$/u, "")}/objectives`,
+        `${contentPath.replace(/\/+$/u, "")}/agents`
+      ]
+    }];
+  });
+}
+function releasePhaseForEnvironment(environment) {
+  return environment === "prod" ? "release" : "stage";
+}
+function internalPackageDependencies(packages, pkg) {
+  const packageIds = new Set(packages.map((entry) => entry.id));
+  const packageJsonPath = resolvePath(pkg.path, "package.json");
+  if (!existsSync(packageJsonPath)) return [];
+  try {
+    const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+    const dependencies = /* @__PURE__ */ new Set();
+    for (const field of INTERNAL_PACKAGE_DEPENDENCY_FIELDS) {
+      const entries = packageJson[field];
+      if (!entries || typeof entries !== "object" || Array.isArray(entries)) continue;
+      for (const dependencyName of Object.keys(entries)) {
+        if (dependencyName !== pkg.id && packageIds.has(dependencyName)) {
+          dependencies.add(dependencyName);
+        }
+      }
+    }
+    return [...dependencies].sort();
+  } catch {
+    return [];
+  }
+}
+function resourceKindForUnit(unit) {
+  if (unit.provider === "railway") {
+    if (unit.unitType.startsWith("railway-service:")) return "railway-service";
+    if (unit.unitType === "custom-domain:api") return "railway-domain";
+  }
+  if (unit.provider === "cloudflare" || unit.provider === "cloudflare-dns") return "cloudflare-resource";
+  if (unit.provider === "treeseed" && /runtime$/u.test(unit.unitType)) return "release-gate";
+  return "cloudflare-resource";
+}
+function serviceIdForUnit(unit) {
+  const serviceKey = unit.metadata.serviceKey;
+  if (typeof serviceKey === "string" && serviceKey.trim()) return serviceKey;
+  if (unit.unitType.startsWith("railway-service:")) return unit.unitType.slice("railway-service:".length);
+  return null;
+}
+function packageIdForUnit(unit) {
+  const app = unit.metadata.applicationId ?? unit.metadata.packageId;
+  return typeof app === "string" && app.trim() ? app : null;
+}
+function resourceFromUnit(unit, environment) {
+  return {
+    id: unit.unitId,
+    kind: resourceKindForUnit(unit),
+    provider: unit.provider,
+    environment,
+    packageId: packageIdForUnit(unit),
+    serviceId: serviceIdForUnit(unit),
+    logicalName: unit.logicalName,
+    dependencies: unit.dependencies,
+    spec: {
+      unitType: unit.unitType,
+      identity: unit.identity,
+      target: unit.target,
+      spec: unit.spec,
+      secrets: Object.keys(unit.secrets),
+      metadata: unit.metadata
+    },
+    source: {
+      type: "reconcile-unit",
+      id: unit.unitId
+    }
+  };
+}
+function packageResources(adapter, environment) {
+  const resources = [];
+  const packageId = adapter.id;
+  const repository = typeof adapter.metadata.repository === "string" ? adapter.metadata.repository : null;
+  const dockerImageConfig = stringRecord(adapter.metadata.dockerImages);
+  const dockerWorkflow = workflowName(
+    environment === "prod" ? dockerImageConfig.releaseWorkflow : null,
+    environment === "prod" ? "publish.yml" : "source-build"
+  );
+  resources.push({
+    id: `package-manifest:${packageId}`,
+    kind: "package-manifest",
+    provider: "treeseed",
+    environment,
+    packageId,
+    serviceId: null,
+    logicalName: `${packageId} manifest`,
+    dependencies: [],
+    spec: {
+      packageId,
+      packageRoot: adapter.dir,
+      manifestPath: adapter.manifestPath,
+      kind: adapter.kind,
+      type: adapter.metadata.type ?? null,
+      releaseCapability: packageReleaseCapability(adapter),
+      requiredSecrets: adapter.metadata.requiredSecrets ?? [],
+      githubEnvironments: adapter.metadata.githubEnvironments ?? []
+    },
+    source: { type: "package-adapter", id: packageId }
+  });
+  if (adapter.releaseChecks.length > 0) {
+    resources.push({
+      id: `package-workflow:${packageId}`,
+      kind: "package-workflow",
+      provider: "github",
+      environment,
+      packageId,
+      serviceId: null,
+      logicalName: `${packageId} workflows`,
+      dependencies: [`package-manifest:${packageId}`],
+      spec: {
+        packageId,
+        packageRoot: adapter.dir,
+        repository,
+        releaseChecks: adapter.releaseChecks,
+        verifyCommands: adapter.verifyCommands,
+        githubEnvironments: adapter.metadata.githubEnvironments ?? [],
+        workflowTemplateVersion: adapter.metadata.workflowTemplateVersion ?? 1
+      },
+      source: { type: "package-adapter", id: packageId }
+    });
+    for (const environmentName of Array.isArray(adapter.metadata.githubEnvironments) ? adapter.metadata.githubEnvironments : []) {
+      if (typeof environmentName !== "string" || !environmentName.trim()) continue;
+      resources.push({
+        id: `github-environment:${packageId}:${environmentName}`,
+        kind: "github-environment",
+        provider: "github",
+        environment,
+        packageId,
+        serviceId: null,
+        logicalName: `${packageId} ${environmentName}`,
+        dependencies: [`package-workflow:${packageId}`],
+        spec: {
+          packageId,
+          packageRoot: adapter.dir,
+          repository,
+          environment: environmentName
+        },
+        source: { type: "package-adapter", id: packageId }
+      });
+      for (const secretName of Array.isArray(adapter.metadata.requiredSecrets) ? adapter.metadata.requiredSecrets : []) {
+        if (typeof secretName !== "string" || !secretName.trim()) continue;
+        resources.push({
+          id: `github-secret-binding:${packageId}:${environmentName}:${secretName}`,
+          kind: "github-secret-binding",
+          provider: "github",
+          environment,
+          packageId,
+          serviceId: null,
+          logicalName: `${packageId} ${environmentName} ${secretName}`,
+          dependencies: [`github-environment:${packageId}:${environmentName}`],
+          spec: {
+            packageId,
+            packageRoot: adapter.dir,
+            repository,
+            environment: environmentName,
+            secretName,
+            envName: secretName
+          },
+          source: { type: "package-adapter", id: packageId }
+        });
+      }
+    }
+  }
+  for (const artifact of adapter.artifacts) {
+    if (artifact.provider !== "docker") continue;
+    const dockerfile = artifact.dockerfile ?? "Dockerfile";
+    const context = artifact.context ?? ".";
+    const platforms = dockerPlatforms(artifact.architectures, adapter.metadata.dockerImageArchitectures);
+    const localBuildPlatforms = environment === "local" ? [localDockerPlatform()] : platforms;
+    const branch = environment === "prod" ? "main" : "staging";
+    const configuredTags = stringRecord(dockerImageConfig.tags);
+    const imageTagTemplates = environment === "prod" ? stringArray(configuredTags.release).length > 0 ? stringArray(configuredTags.release) : ["<version>"] : [];
+    const imageTags = materializeDockerImageTags(imageTagTemplates, adapter, branch);
+    const workflowSpec = repository ? {
+      packageId,
+      repository,
+      workflow: dockerWorkflow,
+      branch,
+      inputs: {
+        image: artifact.name,
+        ...artifact.target ? { target: artifact.target } : {}
+      },
+      wait: environment === "prod"
+    } : null;
+    resources.push({
+      id: `package-image:${artifact.name}`,
+      kind: "package-image",
+      provider: "dockerhub",
+      environment,
+      packageId,
+      serviceId: null,
+      logicalName: artifact.name,
+      dependencies: [`package-workflow:${packageId}`],
+      spec: {
+        packageId,
+        packageRoot: adapter.dir,
+        repository,
+        image: artifact.name,
+        role: artifact.role ?? null,
+        tags: imageTags,
+        architectures: platforms,
+        workflow: dockerWorkflow,
+        workflowDispatch: workflowSpec,
+        requiredSecrets: ["TREESEED_DOCKERHUB_TOKEN"],
+        requiredVariables: ["TREESEED_DOCKERHUB_USERNAME"]
+      },
+      source: { type: "package-adapter", id: packageId }
+    });
+    resources.push({
+      id: `docker-image-build:${artifact.name}`,
+      kind: "docker-image-build",
+      provider: "docker",
+      environment,
+      packageId,
+      serviceId: null,
+      logicalName: artifact.name,
+      dependencies: [`package-manifest:${packageId}`],
+      spec: {
+        packageId,
+        packageRoot: adapter.dir,
+        image: artifact.name,
+        dockerfile,
+        context,
+        prepareCommand: packageId === "@treeseed/agent" ? {
+          command: "bash",
+          args: ["-lc", "ulimit -n 65535 2>/dev/null || true; npm run capacity-provider:build -- --prepare-only"]
+        } : null,
+        target: artifact.target ?? null,
+        role: artifact.role ?? null,
+        platforms: localBuildPlatforms,
+        tags: imageTags.map((tag) => `${artifact.name}:${tag}`),
+        labels: {
+          "org.opencontainers.image.source": repository ? `https://github.com/${repository}` : adapter.relativeDir,
+          "org.treeseed.package": packageId
+        },
+        buildArgs: {},
+        push: false,
+        load: true,
+        provenance: false,
+        workflow: dockerWorkflow
+      },
+      source: { type: "package-adapter", id: packageId }
+    });
+  }
+  return resources;
+}
+function templateResources(templates, environment) {
+  return templates.map((template) => ({
+    id: `template-manifest:${template.id}`,
+    kind: "template-manifest",
+    provider: "treeseed",
+    environment,
+    packageId: template.id,
+    serviceId: null,
+    logicalName: `${template.name} template manifest`,
+    dependencies: [],
+    spec: {
+      templateId: template.id,
+      templateName: template.name,
+      category: template.category,
+      templateRoot: template.path,
+      manifestPath: template.manifestPath,
+      version: template.version,
+      repository: template.repository,
+      releaseTag: template.releaseTag,
+      recordPath: template.recordPath
+    },
+    source: { type: "package-adapter", id: `template:${template.id}` }
+  }));
+}
+function localDevelopmentResources(tenantRoot, environment, localContent) {
+  if (environment !== "local") return [];
+  const composeId = "local-docker-compose:agent-capacity-provider";
+  const treeDxComposeId = "local-docker-compose:treedx";
+  const apiPostgresComposeId = "local-docker-compose:api-postgres";
+  const mailpitComposeId = "local-docker-compose:mailpit";
+  const capacityProviderDataDir = resolvePath(tenantRoot, ".treeseed/local-capacity-provider/data");
+  const localGitCommonDir = resolveLocalGitCommonDir(tenantRoot);
+  const hostCodexAuthFile = [
+    process.env.TREESEED_CODEX_AUTH_FILE,
+    process.env.CODEX_AUTH_FILE,
+    process.env.HOME ? resolvePath(process.env.HOME, ".codex/auth.json") : ""
+  ].find((candidate) => candidate && existsSync(candidate)) ?? "";
+  const capacityPlan = resolveCapacityProviderLaunchPlan({
+    schemaVersion: 1,
+    provider: {
+      dataDir: capacityProviderDataDir,
+      environment: "local",
+      market: {
+        url: "http://host.docker.internal:3000",
+        id: "local"
+      }
+    },
+    runtime: {
+      images: {
+        roles: {
+          manager: { image: "treeseed/agent-manager", tag: "latest" },
+          runner: { image: "treeseed/agent-runner", tag: "latest" }
+        }
+      }
+    }
+  });
+  const localTreeDxApiEnv = {
+    TREESEED_TREEDX_JWT_ISSUER: "https://api.treeseed.local/treedx",
+    TREESEED_TREEDX_JWT_AUDIENCE: "treedx-local",
+    TREESEED_TREEDX_JWT_HS256_SECRET: "treeseed-local-treedx-jwt-secret",
+    TREESEED_TREEDX_PROXY_ACTOR_ID: "treeseed-api",
+    TREESEED_TREEDX_PROXY_TENANT_ID: "treeseed-control-plane"
+  };
+  const localCapacityProviderTreeDxEnv = {
+    TREESEED_TREEDX_BASE_URL: "http://host.docker.internal:4000",
+    TREESEED_TREEDX_URL: "http://host.docker.internal:4000",
+    ...localTreeDxApiEnv
+  };
+  const localCapacityProviderEnv = {
+    ...capacityPlan.composeEnv,
+    ...localCapacityProviderTreeDxEnv,
+    TREESEED_PROVIDER_HOST_DATA_DIR: capacityProviderDataDir,
+    ...hostCodexAuthFile ? {
+      TREESEED_HOST_CODEX_AUTH_FILE: hostCodexAuthFile,
+      TREESEED_CODEX_AUTH_FILE: "/data/codex/auth.json"
+    } : {},
+    ...localGitCommonDir ? {
+      TREESEED_PROVIDER_WORKSPACE_ABSOLUTE_CONTAINER: tenantRoot,
+      TREESEED_PROVIDER_WORKSPACE_GITDIR_CONTAINER: `/.treeseed/worktrees/${basename(tenantRoot)}`,
+      TREESEED_MARKET_GIT_COMMON_DIR_HOST: localGitCommonDir,
+      TREESEED_MARKET_GIT_COMMON_DIR_ABSOLUTE_CONTAINER: localGitCommonDir,
+      TREESEED_MARKET_GIT_COMMON_DIR_ROOT_CONTAINER: "/.git"
+    } : {},
+    TREESEED_PROVIDER_CONTAINER_UID: String(process.getuid?.() ?? 1e3),
+    TREESEED_PROVIDER_CONTAINER_GID: String(process.getgid?.() ?? 1e3),
+    TREESEED_CAPACITY_PROVIDER_API_KEY: "tsp_local_treeseed_demo_capacity_provider",
+    TREESEED_CAPACITY_PROVIDER_ID: "treeseed-local-dev",
+    TREESEED_CAPACITY_PROVIDER_TEAM_ID: "treeseed",
+    TREESEED_MANAGEMENT_API_URL: "http://host.docker.internal:3000"
+  };
+  return [
+    {
+      id: apiPostgresComposeId,
+      kind: "local-docker-compose",
+      provider: "local",
+      environment,
+      packageId: "@treeseed/api",
+      serviceId: "api-postgres",
+      logicalName: "local API PostgreSQL compose",
+      dependencies: [],
+      spec: {
+        composeFile: "packages/api/compose.postgres.yml",
+        projectName: "treeseed-local-api-postgres",
+        cwd: ".",
+        dataDir: ".treeseed/local-api-postgres/data",
+        env: {
+          TREESEED_LOCAL_POSTGRES_PASSWORD: "treeseed-local-dev",
+          TREESEED_LOCAL_POSTGRES_PORT: "54329"
+        },
+        ports: [{ host: 54329, container: 5432 }],
+        volumes: [{ name: "treeseed-api-postgres-volume", mountPath: "/var/lib/postgresql/data", sharedLocalOnly: true }],
+        healthChecks: [
+          { id: "api-postgres-compose", kind: "container", service: "treeseed-api-postgres" }
+        ]
+      },
+      source: { type: "package-adapter", id: "@treeseed/api" }
+    },
+    {
+      id: mailpitComposeId,
+      kind: "local-docker-compose",
+      provider: "local",
+      environment,
+      packageId: "@treeseed/sdk",
+      serviceId: "mailpit",
+      logicalName: "local Mailpit email capture compose",
+      dependencies: [],
+      spec: {
+        composeFile: "packages/sdk/src/treeseed/services/compose.yml",
+        projectName: "treeseed-local-mailpit",
+        cwd: ".",
+        env: {
+          TREESEED_MAILPIT_SMTP_BIND: "127.0.0.1",
+          TREESEED_MAILPIT_SMTP_PORT: "1025",
+          TREESEED_MAILPIT_UI_BIND: "127.0.0.1",
+          TREESEED_MAILPIT_UI_PORT: "8025"
+        },
+        ports: [
+          { host: 1025, container: 1025 },
+          { host: 8025, container: 8025 }
+        ],
+        healthChecks: [
+          { id: "mailpit-ui", kind: "http", url: "http://127.0.0.1:8025" }
+        ]
+      },
+      source: { type: "package-adapter", id: "@treeseed/sdk" }
+    },
+    {
+      id: "local-treedx:team-primary",
+      kind: "local-treedx",
+      provider: "local",
+      environment,
+      packageId: "treedx",
+      serviceId: "treedx",
+      logicalName: "local TreeDX team content repository plane",
+      dependencies: [treeDxComposeId],
+      spec: {
+        mode: "private-team",
+        contentRepositoryAccessMode: "treedx",
+        siteRepositoryAccessMode: "filesystem",
+        projectRepositoryAccessMode: "filesystem",
+        baseUrl: "http://127.0.0.1:4000",
+        dataDir: ".treeseed/local-treedx/data",
+        healthEndpoint: "http://127.0.0.1:4000/api/v1/health",
+        auth: localTreeDxApiEnv,
+        projects: localTreeDxContentProjects(tenantRoot)
+      },
+      source: { type: "package-adapter", id: "treedx" }
+    },
+    {
+      id: treeDxComposeId,
+      kind: "local-docker-compose",
+      provider: "local",
+      environment,
+      packageId: "treedx",
+      serviceId: "treedx",
+      logicalName: "local TreeDX compose",
+      dependencies: [],
+      spec: {
+        composeFile: "packages/treedx/compose.yaml",
+        projectName: "treeseed-local-treedx",
+        cwd: "packages/treedx",
+        dataDir: ".treeseed/local-treedx/data",
+        ports: [{ host: 4e3, container: 4e3 }],
+        env: {
+          TREEDX_ALLOW_DEV_VERIFIER_IN_PROD: "true",
+          ...localTreeDxApiEnv
+        },
+        volumes: [{ name: "treeseed-local-treedx-data", mountPath: "/data", sharedLocalOnly: true }],
+        healthChecks: [
+          { id: "treedx-api", kind: "http", url: "http://127.0.0.1:4000/api/v1/health" }
+        ]
+      },
+      source: { type: "package-adapter", id: "treedx" }
+    },
+    {
+      id: "capacity-provider:local",
+      kind: "capacity-provider",
+      provider: "local",
+      environment,
+      packageId: "@treeseed/agent",
+      serviceId: "capacity-provider",
+      logicalName: "local capacity provider",
+      dependencies: [composeId],
+      spec: {
+        mode: "local",
+        roles: ["api", "manager", "runner"],
+        volumePolicy: "shared-local",
+        healthEndpoint: "http://127.0.0.1:4783/healthz"
+      },
+      source: { type: "package-adapter", id: "@treeseed/agent" }
+    },
+    {
+      id: composeId,
+      kind: "local-docker-compose",
+      provider: "local",
+      environment,
+      packageId: "@treeseed/agent",
+      serviceId: "agent-capacity-provider",
+      logicalName: "agent capacity provider compose",
+      dependencies: ["local-process:api", treeDxComposeId],
+      spec: {
+        composeFile: "packages/agent/compose.capacity-provider.yml",
+        composeFiles: [
+          "packages/agent/compose.capacity-provider.yml",
+          "packages/agent/compose.capacity-provider.dev.yml"
+        ],
+        projectName: "treeseed-capacity-provider",
+        cwd: ".",
+        dataDir: ".treeseed/local-capacity-provider/data",
+        buildPolicy: "missing",
+        devMode: "typescript",
+        redactedEnv: capacityPlan.redactedEnv,
+        envKeys: Object.keys(localCapacityProviderEnv).sort(),
+        env: localCapacityProviderEnv,
+        services: ["agent-manager", "agent-runner"],
+        volumes: [{ name: "treeseed-capacity-provider-data", mountPath: "/data", sharedLocalOnly: true }],
+        healthChecks: [
+          { id: "compose-services", kind: "container", service: "agent-manager" }
+        ]
+      },
+      source: { type: "package-adapter", id: "@treeseed/agent" }
+    },
+    ...[
+      ["market-web", "Market web dev process"],
+      ["api", "API dev process"],
+      ["operations-runner", "Operations runner dev process"]
+    ].map(([id, label]) => ({
+      id: `local-process:${id}`,
+      kind: "local-process",
+      provider: "local",
+      environment,
+      packageId: id === "market-web" ? "@treeseed/market" : "@treeseed/api",
+      serviceId: id,
+      logicalName: label,
+      dependencies: id === "market-web" ? ["local-process:api", mailpitComposeId] : id === "api" ? [apiPostgresComposeId, mailpitComposeId] : ["local-process:api"],
+      spec: {
+        processId: id,
+        surfaces: id === "market-web" ? ["web"] : id === "api" ? ["api"] : ["operations-runner"],
+        supervisor: "sdk-managed-dev",
+        action: "start",
+        options: {
+          apiPort: 3e3
+        },
+        stateDir: ".treeseed/dev",
+        logDir: ".treeseed/logs",
+        cwd: id === "market-web" ? "." : "packages/api"
+      },
+      source: { type: "package-adapter", id }
+    })),
+    ...buildProjectLocalContentResources({ tenantRoot, environment, localContent })
+  ];
+}
+function releaseGateResources(packages, templates, environment) {
+  const phase = releasePhaseForEnvironment(environment);
+  const hostedEnvironment = environment === "prod" ? "prod" : "staging";
+  const packageGates = packages.flatMap((pkg) => {
+    const fingerprint = hashJson({ packageId: pkg.id, version: pkg.version, capability: pkg.releaseCapability, environment, phase });
+    const verifyDependencies = [
+      `package-manifest:${pkg.id}`,
+      ...internalPackageDependencies(packages, pkg).map((dependencyId) => `release-gate:verify:${dependencyId}`)
+    ];
+    const verifyGate = {
+      id: `release-gate:verify:${pkg.id}`,
+      kind: "release-gate",
+      provider: "treeseed",
+      environment,
+      packageId: pkg.id,
+      serviceId: null,
+      logicalName: `${pkg.id} verify gate`,
+      dependencies: verifyDependencies,
+      spec: {
+        gateKind: "release-gate:verify",
+        phase,
+        packageId: pkg.id,
+        environment: hostedEnvironment,
+        fingerprint,
+        capability: pkg.releaseCapability,
+        command: "verify.release"
+      },
+      source: { type: "package-adapter", id: pkg.id }
+    };
+    const publishGateKind = pkg.releaseCapability === "npm" ? "release-gate:npm-publish" : pkg.releaseCapability === "image" ? "release-gate:image-publish" : null;
+    return [
+      verifyGate,
+      ...publishGateKind ? [{
+        id: `${publishGateKind}:${pkg.id}`,
+        kind: "release-gate",
+        provider: "treeseed",
+        environment,
+        packageId: pkg.id,
+        serviceId: null,
+        logicalName: `${pkg.id} publish gate`,
+        dependencies: [verifyGate.id],
+        spec: {
+          gateKind: publishGateKind,
+          phase,
+          packageId: pkg.id,
+          environment: hostedEnvironment,
+          repository: pkg.repository,
+          fingerprint: hashJson({ publishGateKind, packageId: pkg.id, version: pkg.version, environment, phase }),
+          capability: pkg.releaseCapability
+        },
+        source: { type: "package-adapter", id: pkg.id }
+      }] : []
+    ];
+  });
+  const templateGates = templates.flatMap((template) => {
+    const verifyGate = {
+      id: `release-gate:template-verify:${template.id}`,
+      kind: "release-gate",
+      provider: "treeseed",
+      environment,
+      packageId: template.id,
+      serviceId: null,
+      logicalName: `${template.name} template verify gate`,
+      dependencies: [`template-manifest:${template.id}`],
+      spec: {
+        gateKind: "release-gate:template-verify",
+        phase,
+        templateId: template.id,
+        environment: hostedEnvironment,
+        fingerprint: hashJson({ templateId: template.id, version: template.version, repository: template.repository, environment, phase }),
+        releaseTag: template.releaseTag,
+        recordPath: template.recordPath
+      },
+      source: { type: "package-adapter", id: `template:${template.id}` }
+    };
+    return [
+      verifyGate,
+      {
+        id: `release-gate:template-release-record:${template.id}`,
+        kind: "release-gate",
+        provider: "treeseed",
+        environment,
+        packageId: template.id,
+        serviceId: null,
+        logicalName: `${template.name} template release record`,
+        dependencies: [verifyGate.id],
+        spec: {
+          gateKind: "release-gate:template-release-record",
+          phase,
+          templateId: template.id,
+          environment: hostedEnvironment,
+          fingerprint: hashJson({ gate: "template-release-record", templateId: template.id, version: template.version, releaseTag: template.releaseTag, environment, phase }),
+          releaseTag: template.releaseTag,
+          recordPath: template.recordPath
+        },
+        source: { type: "package-adapter", id: `template:${template.id}` }
+      }
+    ];
+  });
+  const releaseDependencies = [...packageGates.map((gate) => gate.id), ...templateGates.map((gate) => gate.id)];
+  return [
+    ...packageGates,
+    ...templateGates,
+    {
+      id: `release-gate:hosted-reconcile:${hostedEnvironment}:all`,
+      kind: "release-gate",
+      provider: "treeseed",
+      environment,
+      packageId: null,
+      serviceId: "hosted-reconcile",
+      logicalName: `${hostedEnvironment} hosted reconciliation gate`,
+      dependencies: releaseDependencies,
+      spec: {
+        gateKind: "release-gate:hosted-reconcile",
+        phase,
+        environment: hostedEnvironment,
+        appId: "all",
+        fingerprint: hashJson({ gate: "hosted-reconcile", environment: hostedEnvironment, packages, templates }),
+        hostedSelector: {
+          environment: hostedEnvironment,
+          provider: ["cloudflare", "cloudflare-dns", "railway"]
+        }
+      },
+      source: { type: "package-adapter", id: "release" }
+    },
+    {
+      id: `release-gate:live-verify:${hostedEnvironment}:all`,
+      kind: "release-gate",
+      provider: "treeseed",
+      environment,
+      packageId: null,
+      serviceId: "live-verify",
+      logicalName: `${hostedEnvironment} live verification gate`,
+      dependencies: [`release-gate:hosted-reconcile:${hostedEnvironment}:all`],
+      spec: {
+        gateKind: "release-gate:live-verify",
+        phase,
+        environment: hostedEnvironment,
+        appId: "all",
+        fingerprint: hashJson({ gate: "live-verify", environment: hostedEnvironment, packages, templates }),
+        hostedSelector: {
+          environment: hostedEnvironment,
+          provider: ["cloudflare", "cloudflare-dns", "railway"]
+        }
+      },
+      source: { type: "package-adapter", id: "release" }
+    },
+    {
+      id: environment === "prod" ? "release-gate:production-record:prod" : "release-gate:candidate-record:staging",
+      kind: "release-gate",
+      provider: "treeseed",
+      environment,
+      packageId: null,
+      serviceId: environment === "prod" ? "production-record" : "candidate-record",
+      logicalName: environment === "prod" ? "production release record" : "staging candidate record",
+      dependencies: [`release-gate:live-verify:${hostedEnvironment}:all`],
+      spec: {
+        gateKind: environment === "prod" ? "release-gate:production-record" : "release-gate:candidate-record",
+        phase,
+        environment,
+        fingerprint: hashJson({ gate: environment === "prod" ? "production-record" : "candidate-record", packages, templates }),
+        recordPath: environment === "prod" ? ".treeseed/workflow/releases/latest-production.json" : ".treeseed/workflow/release-candidates/latest-staging.json"
+      },
+      source: { type: "package-adapter", id: "release" }
+    }
+  ];
+}
+function slugBranchName(branchName) {
+  return branchName.toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 48) || "preview";
+}
+function branchPreviewResources(target, environment) {
+  if (target.kind !== "branch") return [];
+  const branchSlug = slugBranchName(target.branchName);
+  const previewId = `branch-preview:${branchSlug}:web`;
+  return [
+    {
+      id: previewId,
+      kind: "branch-preview",
+      provider: "treeseed",
+      environment,
+      packageId: "@treeseed/market",
+      serviceId: "market-web",
+      logicalName: `Branch preview for ${target.branchName}`,
+      dependencies: [],
+      spec: {
+        branch: target.branchName,
+        branchSlug,
+        environment: "staging",
+        appId: "web",
+        host: "cloudflare",
+        ttlHours: 72,
+        resources: {
+          environment: "staging",
+          appId: ["web"],
+          provider: ["cloudflare", "cloudflare-dns"]
+        }
+      },
+      source: { type: "package-adapter", id: "branch-preview" }
+    },
+    {
+      id: `branch-preview-cleanup:${branchSlug}:web`,
+      kind: "branch-preview-cleanup",
+      provider: "treeseed",
+      environment,
+      packageId: "@treeseed/market",
+      serviceId: "market-web",
+      logicalName: `Branch preview cleanup for ${target.branchName}`,
+      dependencies: [previewId],
+      spec: {
+        branch: target.branchName,
+        branchSlug,
+        environment: "staging",
+        reason: "manual",
+        selector: {
+          environment: "staging",
+          unitId: [previewId]
+        }
+      },
+      source: { type: "package-adapter", id: "branch-preview-cleanup" }
+    }
+  ];
+}
+function resourceMatchesSelector(resource, selector) {
+  if (!selector) return true;
+  const has = (values, candidates) => {
+    const normalized = new Set((values ?? []).map((value) => value.trim()).filter(Boolean));
+    return normalized.size === 0 || candidates.some((candidate) => candidate != null && normalized.has(candidate));
+  };
+  return has(selector.host ?? selector.provider, [resource.provider]) && has(selector.packageId, [resource.packageId]) && has(selector.serviceId, [resource.serviceId, resource.logicalName]) && has(selector.resourceKind, [resource.kind]) && has(selector.unitId, [resource.id, resource.source.type === "reconcile-unit" ? resource.source.id : null]) && has(selector.serviceType, [typeof resource.spec.unitType === "string" ? resource.spec.unitType : null]);
+}
+function compileTreeseedDesiredResourceGraph({
+  tenantRoot = workspaceRoot(),
+  target,
+  localContent = "auto"
+}) {
+  const environment = environmentFromTarget(target);
+  const derived = deriveTreeseedDesiredUnits({ tenantRoot, target });
+  const packageAdapters = discoverTreeseedPackageAdapters(tenantRoot);
+  const packages = packageAdapters.map(packageUnitFromAdapter);
+  const templates = checkedOutTemplateRepositories(tenantRoot).map(templateUnitFromRepository);
+  const resources = [
+    ...derived.units.map((unit) => resourceFromUnit(unit, environment)),
+    ...packageAdapters.flatMap((adapter) => packageResources(adapter, environment)),
+    ...templateResources(templates, environment),
+    ...localDevelopmentResources(tenantRoot, environment, localContent),
+    ...branchPreviewResources(target, environment),
+    ...releaseGateResources(packages, templates, environment)
+  ];
+  const edges = resources.flatMap((resource) => resource.dependencies.map((dependency) => ({
+    from: dependency,
+    to: resource.id,
+    reason: "depends-on"
+  })));
+  const fingerprints = Object.fromEntries(resources.map((resource) => [resource.id, hashJson(resource)]));
+  return {
+    workspaceId: derived.deployConfig.slug,
+    environment,
+    packages,
+    templates,
+    resources,
+    edges,
+    fingerprints
+  };
+}
+function selectTreeseedDesiredResources(graph, selector) {
+  if (!selector) return graph;
+  const selected = graph.resources.filter((resource) => resourceMatchesSelector(resource, selector));
+  const selectedIds = new Set(selected.map((resource) => resource.id));
+  const include = new Map(selected.map((resource) => [resource.id, resource]));
+  const byId = new Map(graph.resources.map((resource) => [resource.id, resource]));
+  const visit = (resource) => {
+    for (const dependencyId of resource.dependencies) {
+      const dependency = byId.get(dependencyId);
+      if (!dependency || include.has(dependency.id)) continue;
+      include.set(dependency.id, dependency);
+      visit(dependency);
+    }
+  };
+  for (const resource of selected) visit(resource);
+  const resources = graph.resources.filter((resource) => include.has(resource.id));
+  const resourceIds = new Set(resources.map((resource) => resource.id));
+  return {
+    ...graph,
+    resources,
+    edges: graph.edges.filter((edge) => resourceIds.has(edge.from) && resourceIds.has(edge.to)),
+    fingerprints: Object.fromEntries(Object.entries(graph.fingerprints).filter(([id]) => resourceIds.has(id))),
+    packages: graph.packages.filter((pkg) => resources.some((resource) => resource.packageId === pkg.id) || selectedIds.size === 0),
+    templates: graph.templates.filter((template) => resources.some((resource) => resource.packageId === template.id) || selectedIds.size === 0)
+  };
+}
+function convertDesiredResourceToReconcileUnit(graph, resource) {
+  const identity = reconcileIdentityForGraph(graph.workspaceId, graph.environment);
+  if (resource.source.type !== "reconcile-unit") {
+    const unitType2 = (() => {
+      if (resource.kind === "release-gate") return String(resource.spec.gateKind ?? "release-gate:verify");
+      if (resource.kind === "save-gate") return String(resource.spec.gateKind ?? "save-gate:promotion-readiness");
+      return resource.kind;
+    })();
+    return {
+      unitId: resource.id,
+      unitType: unitType2,
+      provider: resource.provider,
+      identity,
+      target: { kind: "persistent", scope: graph.environment },
+      logicalName: resource.logicalName,
+      dependencies: resource.dependencies,
+      spec: resource.spec,
+      secrets: {},
+      metadata: {
+        resourceKind: resource.kind,
+        packageId: resource.packageId,
+        serviceId: resource.serviceId,
+        source: resource.source
+      }
+    };
+  }
+  const spec = resource.spec;
+  const unitType = typeof spec.unitType === "string" ? spec.unitType : null;
+  const resourceIdentity = spec.identity && typeof spec.identity === "object" ? spec.identity : null;
+  const target = spec.target && typeof spec.target === "object" ? spec.target : { kind: "persistent", scope: graph.environment };
+  const unitSpec = spec.spec && typeof spec.spec === "object" ? spec.spec : {};
+  const metadata = spec.metadata && typeof spec.metadata === "object" ? spec.metadata : {};
+  if (!unitType || !resourceIdentity) return null;
+  return {
+    unitId: resource.source.id,
+    unitType,
+    provider: resource.provider,
+    identity: resourceIdentity,
+    target,
+    logicalName: resource.logicalName,
+    dependencies: resource.dependencies,
+    spec: unitSpec,
+    secrets: {},
+    metadata
+  };
+}
+function compileTreeseedDesiredUnitsFromGraph(graph, selector) {
+  return selectTreeseedDesiredResources(graph, selector).resources.map((resource) => convertDesiredResourceToReconcileUnit(graph, resource)).filter((unit) => Boolean(unit));
+}
+export {
+  compileTreeseedDesiredResourceGraph,
+  compileTreeseedDesiredUnitsFromGraph,
+  convertDesiredResourceToReconcileUnit,
+  selectTreeseedDesiredResources
+};