@treeseed/sdk 0.12.16 → 0.12.18

package/dist/hosting/builtins.js

@@ -54,7 +54,7 @@ function defaultVerify(input) {
       issues: []
     }
   ];
-  if (input.unit.host.id === "railway" && input.environment === "prod" && unitConfig(input).sourceMode === "image") {
+  if (input.unit.host.id === "railway" && input.environment === "prod" && unitConfig(input).sourceMode === "image" && input.unit.serviceType.id !== "relational-database" && unitConfig(input).resourceType !== "postgres") {
     const imageRef = unitConfig(input).imageRef;
     const hasImageRef = typeof imageRef === "string" && imageRef.trim().length > 0;
     checks.push({

package/dist/reconcile/builtin-adapters.js

@@ -2134,7 +2134,7 @@ function getPersistedCustomDomainState(input, provider, domain) {
   }
   if (provider === "railway") {
     try {
-      const state = loadTreeseedReconcileState(input.context.tenantRoot, input.context.target);
+      const state = loadTreeseedReconcileState(input.context.tenantRoot, input.context.target, input.context.launchEnv);
       const unitId = createTreeseedReconcileUnitId("custom-domain:api", domain);
       const unit = state.units[unitId];
       const reconciled = unit?.lastReconciledState;

package/dist/reconcile/engine.js

@@ -204,7 +204,7 @@ async function refreshTreeseedUnits({
   const units = filterUnitsBySelector(baseUnits, selector);
   const deployConfig = derived.deployConfig;
   const registry = createTreeseedReconcileRegistry(deployConfig);
-  const reconcileState = loadTreeseedReconcileState(tenantRoot, target);
+  const reconcileState = loadTreeseedReconcileState(tenantRoot, target, env);
   const context = createRunContext(tenantRoot, target, env, write);
   const observations = /* @__PURE__ */ new Map();
   await runByDependencyLevel(topologicallySortDesiredUnits(units), async (unit) => {
@@ -294,7 +294,7 @@ async function reconcileTreeseedTarget({
   const persistVerifiedResult = async (persisted, verifiedResult) => {
     persistChain = persistChain.then(() => {
       persistResult(planned.state, persisted, verifiedResult);
-      writeTreeseedReconcileState(tenantRoot, planned.state);
+      writeTreeseedReconcileState(tenantRoot, planned.state, env);
     });
     await persistChain;
   };
@@ -458,7 +458,7 @@ async function reconcileTreeseedTarget({
     results.push(verifiedResult);
   });
   if (!dryRun) {
-    writeTreeseedReconcileState(tenantRoot, planned.state);
+    writeTreeseedReconcileState(tenantRoot, planned.state, env);
   }
   return {
     target,
@@ -477,10 +477,10 @@ async function destroyTreeseedTargetUnits({
   units: explicitUnits,
   write
 }) {
-  const { units: allUnits, deployConfig } = deriveTreeseedDesiredUnits({ tenantRoot, target });
+  const { units: allUnits, deployConfig } = deriveTreeseedDesiredUnits({ tenantRoot, target, env });
   const units = filterUnitsBySelector(explicitUnits ?? allUnits, selector);
   const registry = createTreeseedReconcileRegistry(deployConfig);
-  const reconcileState = loadTreeseedReconcileState(tenantRoot, target);
+  const reconcileState = loadTreeseedReconcileState(tenantRoot, target, env);
   const context = createRunContext(tenantRoot, target, env, write);
   const results = [];
   for (const unit of reverseTopologicallySortedUnits(units)) {

package/dist/reconcile/state.d.ts

@@ -1,7 +1,7 @@
 import type { TreeseedDesiredUnit, TreeseedReconcileStateRecord, TreeseedReconcileTarget, TreeseedUnitPersistedState } from './contracts.js';
 export declare function migrateLegacyDeployStateUnits(legacyState: Record<string, any>, target: TreeseedReconcileTarget): Record<string, TreeseedUnitPersistedState>;
-export declare function loadTreeseedReconcileState(tenantRoot: string, target: TreeseedReconcileTarget): TreeseedReconcileStateRecord;
-export declare function writeTreeseedReconcileState(tenantRoot: string, reconcileState: TreeseedReconcileStateRecord): void;
+export declare function loadTreeseedReconcileState(tenantRoot: string, target: TreeseedReconcileTarget, env?: NodeJS.ProcessEnv | Record<string, string | undefined>): TreeseedReconcileStateRecord;
+export declare function writeTreeseedReconcileState(tenantRoot: string, reconcileState: TreeseedReconcileStateRecord, env?: NodeJS.ProcessEnv | Record<string, string | undefined>): void;
 export declare function ensureTreeseedPersistedUnitState(reconcileState: TreeseedReconcileStateRecord, unit: TreeseedDesiredUnit): TreeseedUnitPersistedState;
 export declare function updateTreeseedPersistedUnitState(reconcileState: TreeseedReconcileStateRecord, state: TreeseedUnitPersistedState): void;
 export declare function desiredUnitSpecHash(unit: TreeseedDesiredUnit): string;

package/dist/reconcile/state.js

@@ -227,8 +227,8 @@ function migrateLegacyDeployStateUnits(legacyState, target) {
   }
   return units;
 }
-function loadTreeseedReconcileState(tenantRoot, target) {
-  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target.kind === "persistent" ? target.scope : "staging", env: process.env }).deployConfig;
+function loadTreeseedReconcileState(tenantRoot, target, env = process.env) {
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target.kind === "persistent" ? target.scope : "staging", env }).deployConfig;
   const legacyState = loadDeployState(tenantRoot, deployConfig, { target });
   const persistedUnits = legacyState.units && typeof legacyState.units === "object" ? legacyState.units : migrateLegacyDeployStateUnits(legacyState, target);
   return {
@@ -238,8 +238,8 @@ function loadTreeseedReconcileState(tenantRoot, target) {
     units: { ...persistedUnits }
   };
 }
-function writeTreeseedReconcileState(tenantRoot, reconcileState) {
-  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: reconcileState.target.kind === "persistent" ? reconcileState.target.scope : "staging", env: process.env }).deployConfig;
+function writeTreeseedReconcileState(tenantRoot, reconcileState, env = process.env) {
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: reconcileState.target.kind === "persistent" ? reconcileState.target.scope : "staging", env }).deployConfig;
   const legacyState = loadDeployState(tenantRoot, deployConfig, { target: reconcileState.target });
   writeDeployState(tenantRoot, {
     ...legacyState,

package/dist/workflow/operations.d.ts

@@ -12,7 +12,7 @@ import type { TreeseedCloseInput, TreeseedCiInput, TreeseedConfigInput, Treeseed
 type WorkflowWrite = NonNullable<TreeseedWorkflowContext['write']>;
 type WorkflowStatePayload = ReturnType<typeof resolveTreeseedWorkflowState>;
 type ReleaseCandidateMode = TreeseedReleaseCandidateMode;
-export type TreeseedWorkflowErrorCode = 'validation_failed' | 'merge_conflict' | 'missing_runtime_auth' | 'deployment_timeout' | 'confirmation_required' | 'unsupported_transport' | 'unsupported_state' | 'workflow_locked' | 'resume_unavailable' | 'workflow_contract_missing' | 'github_workflow_failed' | 'github_auth_unavailable' | 'hosted_reconcile_failed' | 'hosted_live_verification_failed';
+export type TreeseedWorkflowErrorCode = 'validation_failed' | 'merge_conflict' | 'missing_runtime_auth' | 'deployment_timeout' | 'confirmation_required' | 'unsupported_transport' | 'unsupported_state' | 'workflow_locked' | 'resume_unavailable' | 'workflow_contract_missing' | 'github_workflow_failed' | 'github_auth_unavailable' | 'release_gate_failed' | 'hosted_reconcile_failed' | 'hosted_live_verification_failed';
 export declare class TreeseedWorkflowError extends Error {
     code: TreeseedWorkflowErrorCode;
     operation: TreeseedWorkflowOperationId;
@@ -1153,6 +1153,20 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         liveVerification: import("../workflow-support.js").TreeseedLiveHostedServiceCheckReport;
         reason?: undefined;
     };
+    productionApiGuarantees: {
+        ok: true;
+        environment: string;
+        runId: string;
+        outputRoot: string;
+        counts: {
+            planned: number;
+            passed: number;
+            failed: number;
+            skipped: number;
+            blocked: number;
+            releaseBlockingFailures: number;
+        };
+    };
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -159,6 +159,7 @@ import {
 } from "./session.js";
 import { checkedOutManagedWorkflowRepos } from "../operations/services/managed-repositories.js";
 import { runTreeseedLocalCleanup } from "../operations/services/local-cleanup.js";
+import { runTreeseedGuarantees } from "../guarantees/index.js";
 import {
   classifyTreeseedBranchRole,
   resolveTreeseedWorkflowPaths
@@ -633,6 +634,49 @@ function productionReleaseImageRefEnv(selectedVersions) {
   }
   return refs;
 }
+async function runReleaseApiGuarantees(root, environment, helpers, operation, sceneArtifacts) {
+  const env = {
+    ...helpers.context.env,
+    ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
+  };
+  env.TREESEED_ACCEPTANCE_SERVICE_ID ??= env.TREESEED_API_WEB_SERVICE_ID ?? env.TREESEED_WEB_SERVICE_ID;
+  env.TREESEED_ACCEPTANCE_SERVICE_SECRET ??= env.TREESEED_API_WEB_SERVICE_SECRET ?? env.TREESEED_WEB_SERVICE_SECRET;
+  if (!env.TREESEED_ACCEPTANCE_SERVICE_ID || !env.TREESEED_ACCEPTANCE_SERVICE_SECRET) {
+    workflowError(operation, "release_gate_failed", `${environment} API release guarantees cannot run because API acceptance service credentials are missing.`, {
+      details: {
+        environment,
+        missing: [
+          !env.TREESEED_ACCEPTANCE_SERVICE_ID ? "TREESEED_ACCEPTANCE_SERVICE_ID" : null,
+          !env.TREESEED_ACCEPTANCE_SERVICE_SECRET ? "TREESEED_ACCEPTANCE_SERVICE_SECRET" : null
+        ].filter((value) => Boolean(value))
+      }
+    });
+  }
+  helpers.write(`[${operation}][workflow] Running ${environment} API release guarantees before root deployment.`);
+  return await withContextEnv(env, async () => {
+    const report = await runTreeseedGuarantees({
+      workspaceRoot: root,
+      filter: { ownerPackage: "@treeseed/api" },
+      environment,
+      evidenceTarget: "release",
+      sceneArtifacts
+    });
+    if (!report.ok) {
+      const diagnostics = report.diagnostics.filter((entry) => entry.severity === "error").slice(0, 20).map((entry) => `${entry.code}: ${entry.message}${entry.sourcePath ? ` (${entry.sourcePath})` : ""}`);
+      workflowError(operation, "release_gate_failed", `API release guarantees for ${environment} failed:
+${diagnostics.join("\n") || `See ${report.outputRoot}`}`, {
+        details: { environment, outputRoot: report.outputRoot, counts: report.counts, diagnostics: report.diagnostics }
+      });
+    }
+    return {
+      ok: report.ok,
+      environment: report.environment,
+      runId: report.runId,
+      outputRoot: report.outputRoot,
+      counts: report.counts
+    };
+  });
+}
 function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGates) {
   const gates = Array.isArray(workflowGates) ? workflowGates.map((gate) => stringRecord(gate)).filter((gate) => Boolean(gate)) : [];
   const releaseRecord = stringRecord(rootRelease) ?? {};
@@ -5372,10 +5416,11 @@ ${blockers.join("\n")}`, {
               resumable: true
             };
           }),
+          { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-hosting", description: "Reconcile and live-verify production hosted resources before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-api-guarantees", description: "Run production API release guarantees before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "production-hosting", description: "Reconcile and live-verify production hosted resources after publish", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "workspace-link", description: "Restore local workspace links after release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }
         ],
@@ -5482,6 +5527,9 @@ ${rendered}`);
           });
           packageReleases.push(packageRelease);
         }
+        const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
+        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions)));
+        const productionApiGuarantees = await executeJournalStep(root, workflowRun.runId, "production-api-guarantees", () => runReleaseApiGuarantees(root, "prod", helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
@@ -5532,8 +5580,6 @@ ${rendered}`);
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
-        const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
-        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions)));
         const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
           const packageBackMerges = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
             subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
@@ -5561,6 +5607,7 @@ ${rendered}`);
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionHosting,
+          productionApiGuarantees,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.16",
+  "version": "0.12.18",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {