@treeseed/sdk 0.12.17 → 0.12.19

package/dist/reconcile/builtin-adapters.js

@@ -3308,12 +3308,20 @@ async function resolveRailwayTopologyForScope(input, scope, {
   includeInstances = ensure,
   includeVariables = false
 } = {}) {
+  const imageRefValues = resolveReconcileEnvironmentValues(input, scope);
+  const imageRefFingerprint = [
+    "TREESEED_API_IMAGE_REF",
+    "TREESEED_OPERATIONS_RUNNER_IMAGE_REF",
+    "TREESEED_AGENT_MANAGER_IMAGE_REF",
+    "TREESEED_AGENT_RUNNER_IMAGE_REF",
+    "TREESEED_PUBLIC_TREEDX_IMAGE_REF"
+  ].map((key) => `${key}=${imageRefValues[key] ?? ""}`).join("|");
   const normalizedServiceKeys = Array.isArray(serviceKeys) && serviceKeys.length > 0 ? [...new Set(serviceKeys.map((value) => String(value).trim()).filter(Boolean))].sort() : ["__all__"];
-  const cacheKey = `railway:topology:${scope}:${ensure ? "ensure" : "observe"}:${includeInstances ? "instances" : "no-instances"}:${includeVariables ? "variables" : "no-variables"}:${normalizedServiceKeys.join(",")}`;
+  const cacheKey = `railway:topology:${scope}:${ensure ? "ensure" : "observe"}:${includeInstances ? "instances" : "no-instances"}:${includeVariables ? "variables" : "no-variables"}:${normalizedServiceKeys.join(",")}:${imageRefFingerprint}`;
   return await providerCache(input, cacheKey, async () => {
     const env = buildRailwayEnv(input, scope);
     const deployState = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target: toDeployTarget(input.context.target) });
-    const services = configuredRailwayServices(input.context.tenantRoot, scope).filter((service) => normalizedServiceKeys.includes("__all__") || normalizedServiceKeys.includes(service.key));
+    const services = configuredRailwayServicesForInput(input, scope).filter((service) => normalizedServiceKeys.includes("__all__") || normalizedServiceKeys.includes(service.key));
     traceRailwayReconcile(env, "topology:start", `scope=${scope} ensure=${ensure ? "yes" : "no"} services=${services.map((service) => service.key).join(",")}`);
     let workspace = null;
     const knownProjects = [];

package/dist/reconcile/desired-state.js

@@ -190,7 +190,7 @@ function deriveTreeseedDesiredUnits({
     });
   }
   const scope = target.kind === "persistent" ? target.scope : "staging";
-  for (const configuredService of configuredRailwayServices(tenantRoot, scope)) {
+  for (const configuredService of configuredRailwayServices(tenantRoot, scope, env)) {
     const serviceKey = configuredService.key;
     const service = configuredService.serviceConfig ?? deployConfig.services?.[serviceKey];
     const serviceState = legacyState.services?.[serviceKey];
@@ -217,6 +217,13 @@ function deriveTreeseedDesiredUnits({
         serviceId: persistedServiceMatchesDesired ? serviceState?.serviceId ?? configuredService.serviceId : configuredService.serviceId,
         serviceName: desiredServiceName,
         rootDir: configuredService.rootDir ?? serviceState?.rootDir,
+        imageRef: configuredService.imageRef,
+        imageRefEnv: configuredService.serviceConfig?.railway?.imageRefEnv,
+        sourceMode: configuredService.sourceMode,
+        sourceRepo: configuredService.sourceRepo,
+        sourceBranch: configuredService.sourceBranch,
+        sourceCommit: configuredService.sourceCommit,
+        sourceRootDirectory: configuredService.sourceRootDirectory,
         environment: normalizeRailwayEnvironmentName(configuredService.railwayEnvironment ?? serviceState?.environment),
         buildCommand: configuredService.buildCommand,
         startCommand: configuredService.startCommand,

package/dist/workflow/operations.d.ts

@@ -12,7 +12,7 @@ import type { TreeseedCloseInput, TreeseedCiInput, TreeseedConfigInput, Treeseed
 type WorkflowWrite = NonNullable<TreeseedWorkflowContext['write']>;
 type WorkflowStatePayload = ReturnType<typeof resolveTreeseedWorkflowState>;
 type ReleaseCandidateMode = TreeseedReleaseCandidateMode;
-export type TreeseedWorkflowErrorCode = 'validation_failed' | 'merge_conflict' | 'missing_runtime_auth' | 'deployment_timeout' | 'confirmation_required' | 'unsupported_transport' | 'unsupported_state' | 'workflow_locked' | 'resume_unavailable' | 'workflow_contract_missing' | 'github_workflow_failed' | 'github_auth_unavailable' | 'hosted_reconcile_failed' | 'hosted_live_verification_failed';
+export type TreeseedWorkflowErrorCode = 'validation_failed' | 'merge_conflict' | 'missing_runtime_auth' | 'deployment_timeout' | 'confirmation_required' | 'unsupported_transport' | 'unsupported_state' | 'workflow_locked' | 'resume_unavailable' | 'workflow_contract_missing' | 'github_workflow_failed' | 'github_auth_unavailable' | 'release_gate_failed' | 'hosted_reconcile_failed' | 'hosted_live_verification_failed';
 export declare class TreeseedWorkflowError extends Error {
     code: TreeseedWorkflowErrorCode;
     operation: TreeseedWorkflowOperationId;
@@ -91,7 +91,7 @@ export declare function workflowReleaseCandidate(helpers: WorkflowOperationHelpe
 }>>;
 type PublishedArtifactCheck = {
     id: string;
-    kind: 'npm' | 'docker' | 'pypi' | 'crates' | 'hex';
+    kind: 'npm' | 'docker' | 'pypi' | 'crates' | 'hex' | 'github-tag';
     name: string;
     version: string;
     url: string;
@@ -1153,6 +1153,20 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         liveVerification: import("../workflow-support.js").TreeseedLiveHostedServiceCheckReport;
         reason?: undefined;
     };
+    productionApiGuarantees: {
+        ok: true;
+        environment: string;
+        runId: string;
+        outputRoot: string;
+        counts: {
+            planned: number;
+            passed: number;
+            failed: number;
+            skipped: number;
+            blocked: number;
+            releaseBlockingFailures: number;
+        };
+    };
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -159,6 +159,7 @@ import {
 } from "./session.js";
 import { checkedOutManagedWorkflowRepos } from "../operations/services/managed-repositories.js";
 import { runTreeseedLocalCleanup } from "../operations/services/local-cleanup.js";
+import { runTreeseedGuarantees } from "../guarantees/index.js";
 import {
   classifyTreeseedBranchRole,
   resolveTreeseedWorkflowPaths
@@ -633,6 +634,49 @@ function productionReleaseImageRefEnv(selectedVersions) {
   }
   return refs;
 }
+async function runReleaseApiGuarantees(root, environment, helpers, operation, sceneArtifacts) {
+  const env = {
+    ...helpers.context.env,
+    ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
+  };
+  env.TREESEED_ACCEPTANCE_SERVICE_ID ??= env.TREESEED_API_WEB_SERVICE_ID ?? env.TREESEED_WEB_SERVICE_ID;
+  env.TREESEED_ACCEPTANCE_SERVICE_SECRET ??= env.TREESEED_API_WEB_SERVICE_SECRET ?? env.TREESEED_WEB_SERVICE_SECRET;
+  if (!env.TREESEED_ACCEPTANCE_SERVICE_ID || !env.TREESEED_ACCEPTANCE_SERVICE_SECRET) {
+    workflowError(operation, "release_gate_failed", `${environment} API release guarantees cannot run because API acceptance service credentials are missing.`, {
+      details: {
+        environment,
+        missing: [
+          !env.TREESEED_ACCEPTANCE_SERVICE_ID ? "TREESEED_ACCEPTANCE_SERVICE_ID" : null,
+          !env.TREESEED_ACCEPTANCE_SERVICE_SECRET ? "TREESEED_ACCEPTANCE_SERVICE_SECRET" : null
+        ].filter((value) => Boolean(value))
+      }
+    });
+  }
+  helpers.write(`[${operation}][workflow] Running ${environment} API release guarantees before root deployment.`);
+  return await withContextEnv(env, async () => {
+    const report = await runTreeseedGuarantees({
+      workspaceRoot: root,
+      filter: { ownerPackage: "@treeseed/api" },
+      environment,
+      evidenceTarget: "release",
+      sceneArtifacts
+    });
+    if (!report.ok) {
+      const diagnostics = report.diagnostics.filter((entry) => entry.severity === "error").slice(0, 20).map((entry) => `${entry.code}: ${entry.message}${entry.sourcePath ? ` (${entry.sourcePath})` : ""}`);
+      workflowError(operation, "release_gate_failed", `API release guarantees for ${environment} failed:
+${diagnostics.join("\n") || `See ${report.outputRoot}`}`, {
+        details: { environment, outputRoot: report.outputRoot, counts: report.counts, diagnostics: report.diagnostics }
+      });
+    }
+    return {
+      ok: report.ok,
+      environment: report.environment,
+      runId: report.runId,
+      outputRoot: report.outputRoot,
+      counts: report.counts
+    };
+  });
+}
 function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGates) {
   const gates = Array.isArray(workflowGates) ? workflowGates.map((gate) => stringRecord(gate)).filter((gate) => Boolean(gate)) : [];
   const releaseRecord = stringRecord(rootRelease) ?? {};
@@ -2532,6 +2576,46 @@ async function verifyNpmArtifact(packageName, version) {
     };
   }
 }
+async function fetchDockerRegistryManifestStatus(image, version) {
+  const [namespace, repository] = image.split("/");
+  if (!namespace || !repository) {
+    return { ok: false, status: null, message: `Invalid Docker image name ${image}.` };
+  }
+  const tokenUrl = `https://auth.docker.io/token?service=registry.docker.io&scope=repository:${namespace}/${repository}:pull`;
+  try {
+    const tokenResponse = await fetchJsonForArtifact(tokenUrl);
+    const token = typeof stringRecord(tokenResponse.json)?.token === "string" ? String(stringRecord(tokenResponse.json)?.token) : "";
+    if (!tokenResponse.ok || !token) {
+      return { ok: false, status: tokenResponse.status, message: `Docker registry token request failed for ${image}.` };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2e4);
+    try {
+      const manifestResponse = await fetch(`https://registry-1.docker.io/v2/${namespace}/${repository}/manifests/${version}`, {
+        method: "HEAD",
+        headers: {
+          accept: [
+            "application/vnd.docker.distribution.manifest.list.v2+json",
+            "application/vnd.oci.image.index.v1+json",
+            "application/vnd.docker.distribution.manifest.v2+json"
+          ].join(", "),
+          authorization: `Bearer ${token}`,
+          "user-agent": "treeseed-release-verifier/1.0 (https://treeseed.dev)"
+        },
+        signal: controller.signal
+      });
+      return {
+        ok: manifestResponse.ok,
+        status: manifestResponse.status,
+        ...manifestResponse.ok ? {} : { message: `Docker registry manifest for ${image}:${version} is not pullable yet.` }
+      };
+    } finally {
+      clearTimeout(timeout);
+    }
+  } catch (error) {
+    return { ok: false, status: null, message: error instanceof Error ? error.message : String(error) };
+  }
+}
 async function verifyDockerHubArtifact(image, version) {
   const [namespace, repository] = image.split("/");
   const url = `https://hub.docker.com/v2/repositories/${namespace}/${repository}/tags/${version}`;
@@ -2539,7 +2623,8 @@ async function verifyDockerHubArtifact(image, version) {
     const response = await fetchJsonForArtifact(url);
     const images = Array.isArray(stringRecord(response.json)?.images) ? stringRecord(response.json)?.images : [];
     const architectures = new Set(images.map((entry) => stringRecord(entry)).map((entry) => typeof entry?.architecture === "string" ? entry.architecture : null).filter((entry) => Boolean(entry)));
-    const ok = response.ok && architectures.has("amd64") && architectures.has("arm64");
+    const registry = await fetchDockerRegistryManifestStatus(image, version);
+    const ok = response.ok && architectures.has("amd64") && architectures.has("arm64") && registry.ok;
     return {
       id: `docker:${image}:${version}`,
       kind: "docker",
@@ -2547,8 +2632,8 @@ async function verifyDockerHubArtifact(image, version) {
       version,
       url,
       ok,
-      status: response.status,
-      ...ok ? {} : { message: `${image}:${version} was not found on Docker Hub with amd64 and arm64 images.` }
+      status: registry.status ?? response.status,
+      ...ok ? {} : { message: registry.message ?? `${image}:${version} was not found on Docker Hub with amd64 and arm64 images.` }
     };
   } catch (error) {
     return {
@@ -2563,6 +2648,33 @@ async function verifyDockerHubArtifact(image, version) {
     };
   }
 }
+async function verifyGitHubTagArtifact(repository, version) {
+  const url = `https://api.github.com/repos/${repository}/git/ref/tags/${encodeURIComponent(version)}`;
+  try {
+    const response = await fetchJsonForArtifact(url);
+    return {
+      id: `github-tag:${repository}:${version}`,
+      kind: "github-tag",
+      name: repository,
+      version,
+      url,
+      ok: response.ok,
+      status: response.status,
+      ...response.ok ? {} : { message: `GitHub tag ${repository}@${version} was not found.` }
+    };
+  } catch (error) {
+    return {
+      id: `github-tag:${repository}:${version}`,
+      kind: "github-tag",
+      name: repository,
+      version,
+      url,
+      ok: false,
+      status: null,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
 async function verifySimpleRegistryArtifact(input) {
   try {
     const response = await fetchJsonForArtifact(input.url);
@@ -2591,6 +2703,21 @@ async function verifySimpleRegistryArtifact(input) {
 }
 async function collectPublishedReleaseArtifactChecks(selectedVersions) {
   const checks = [];
+  const githubRepositories = {
+    "@treeseed/sdk": "treeseed-ai/sdk",
+    "@treeseed/ui": "treeseed-ai/ui",
+    "@treeseed/core": "treeseed-ai/core",
+    "@treeseed/admin": "treeseed-ai/admin",
+    "@treeseed/cli": "treeseed-ai/cli",
+    "@treeseed/agent": "treeseed-ai/agent",
+    "@treeseed/api": "treeseed-ai/api",
+    treedx: "treeseed-ai/treedx",
+    "@treeseed/treedx": "treeseed-ai/treedx"
+  };
+  for (const [packageName, repository] of Object.entries(githubRepositories)) {
+    const version = selectedVersions.get(packageName);
+    if (version) checks.push(await verifyGitHubTagArtifact(repository, version));
+  }
   const npmPackages = ["@treeseed/sdk", "@treeseed/ui", "@treeseed/core", "@treeseed/admin", "@treeseed/cli", "@treeseed/agent"];
   for (const packageName of npmPackages) {
     const version = selectedVersions.get(packageName);
@@ -5372,10 +5499,11 @@ ${blockers.join("\n")}`, {
               resumable: true
             };
           }),
+          { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-hosting", description: "Reconcile and live-verify production hosted resources before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-api-guarantees", description: "Run production API release guarantees before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
-          { id: "production-hosting", description: "Reconcile and live-verify production hosted resources after publish", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "workspace-link", description: "Restore local workspace links after release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }
         ],
@@ -5482,6 +5610,9 @@ ${rendered}`);
           });
           packageReleases.push(packageRelease);
         }
+        const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
+        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions)));
+        const productionApiGuarantees = await executeJournalStep(root, workflowRun.runId, "production-api-guarantees", () => runReleaseApiGuarantees(root, "prod", helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
@@ -5532,8 +5663,6 @@ ${rendered}`);
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
-        const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
-        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions)));
         const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
           const packageBackMerges = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
             subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
@@ -5561,6 +5690,7 @@ ${rendered}`);
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionHosting,
+          productionApiGuarantees,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.17",
+  "version": "0.12.19",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {