@treeseed/sdk 0.12.18 → 0.12.20

package/dist/operations/services/hosted-service-checks.d.ts

@@ -65,6 +65,7 @@ export interface TreeseedHostedServiceCheckOptions {
     appId?: string;
     serviceKeys?: string[];
     now?: Date;
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
     valuesOverlay?: Record<string, string | undefined>;
     observedRailwayServices?: Record<string, TreeseedObservedRailwayServiceState | undefined>;
     httpChecks?: Record<string, {

package/dist/operations/services/hosted-service-checks.js

@@ -145,7 +145,8 @@ function httpStatus(url, options) {
 function collectTreeseedHostedServiceChecks(options) {
   const target = options.target ?? "prod";
   const tenantRoot = options.tenantRoot;
-  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target, env: process.env }).deployConfig;
+  const configEnv = { ...process.env, ...options.env ?? {} };
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target, env: configEnv }).deployConfig;
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
   let machineValues = {};
   try {
@@ -153,7 +154,7 @@ function collectTreeseedHostedServiceChecks(options) {
   } catch {
     machineValues = {};
   }
-  const values = { ...machineValues, ...options.valuesOverlay ?? {} };
+  const values = { ...machineValues, ...configEnv, ...options.valuesOverlay ?? {} };
   const checks = [];
   const selectedServiceKeys = new Set((options.serviceKeys ?? []).map((key) => key.trim()).filter(Boolean));
   const selectedAppId = options.appId?.trim() || null;
@@ -211,7 +212,7 @@ function collectTreeseedHostedServiceChecks(options) {
       }));
     }
   }
-  const configuredServices = configuredRailwayServices(tenantRoot, target).filter((service) => !selectedAppId || service.application?.id === selectedAppId).filter((service) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(service.key));
+  const configuredServices = configuredRailwayServices(tenantRoot, target, configEnv).filter((service) => !selectedAppId || service.application?.id === selectedAppId).filter((service) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(service.key));
   for (const service of configuredServices) {
     const serviceType = serviceTypeFor(service.key);
     const observed = observedFor(options, service.serviceName);

package/dist/operations/services/live-hosted-service-checks.js

@@ -218,7 +218,7 @@ async function collectRailwayObservations(options) {
   try {
     const workspace = await resolveRailwayWorkspaceContext({ env: options.env, fetchImpl: options.fetchImpl });
     const projects = await listRailwayProjects({ workspaceId: workspace.id, env: options.env, fetchImpl: options.fetchImpl });
-    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
+    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
     if (selectedServiceKeys.size === 0 || selectedServiceKeys.has("api") || selectedServiceKeys.has("operationsRunner")) {
       for (const descriptor of treeseedDatabaseDescriptors(options.tenantRoot, options)) {
         await verifyRailwayPostgresTopology({ descriptor, configuredServices, projects, options, issues });
@@ -347,7 +347,7 @@ async function collectRailwayObservations(options) {
       };
     }
     if (selectedServiceKeys.size === 0) {
-      const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: process.env }).deployConfig;
+      const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: options.env }).deployConfig;
       const appConfigs = [
         ...!options.appId || options.appId === "web" ? [deployConfig] : [],
         ...discoverTreeseedApplications(options.tenantRoot).filter((application) => application.id === "api" && (!options.appId || options.appId === "api")).map((application) => application.config)
@@ -418,7 +418,7 @@ async function collectRailwayObservations(options) {
   }
 }
 async function collectHttpObservations(options) {
-  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: process.env }).deployConfig;
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: options.env }).deployConfig;
   const urls = /* @__PURE__ */ new Set();
   const fallbacks = /* @__PURE__ */ new Map();
   const selectedServiceKeys = selectedServiceKeySet(options);
@@ -440,7 +440,7 @@ async function collectHttpObservations(options) {
       }
     }
   }
-  for (const service of configuredRailwayServices(options.tenantRoot, options.target).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
+  for (const service of configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
     const serviceConfig = deployConfig.services?.[service.key];
     const domain = service.publicBaseUrl ?? serviceConfig?.environments?.[options.target]?.baseUrl ?? serviceConfig?.environments?.[options.target]?.domain ?? (service.key === "api" ? deployConfig.surfaces?.api?.environments?.[options.target]?.domain : null);
     const baseUrl = urlForDomain(domain);
@@ -500,6 +500,7 @@ async function collectTreeseedLiveHostedServiceChecks(options) {
     target: effectiveOptions.target,
     appId: effectiveOptions.appId,
     serviceKeys: effectiveOptions.serviceKeys,
+    env: effectiveOptions.env,
     observedRailwayServices: railway.observed,
     httpChecks
   });

package/dist/reconcile/builtin-adapters.js

@@ -3308,12 +3308,20 @@ async function resolveRailwayTopologyForScope(input, scope, {
   includeInstances = ensure,
   includeVariables = false
 } = {}) {
+  const imageRefValues = resolveReconcileEnvironmentValues(input, scope);
+  const imageRefFingerprint = [
+    "TREESEED_API_IMAGE_REF",
+    "TREESEED_OPERATIONS_RUNNER_IMAGE_REF",
+    "TREESEED_AGENT_MANAGER_IMAGE_REF",
+    "TREESEED_AGENT_RUNNER_IMAGE_REF",
+    "TREESEED_PUBLIC_TREEDX_IMAGE_REF"
+  ].map((key) => `${key}=${imageRefValues[key] ?? ""}`).join("|");
   const normalizedServiceKeys = Array.isArray(serviceKeys) && serviceKeys.length > 0 ? [...new Set(serviceKeys.map((value) => String(value).trim()).filter(Boolean))].sort() : ["__all__"];
-  const cacheKey = `railway:topology:${scope}:${ensure ? "ensure" : "observe"}:${includeInstances ? "instances" : "no-instances"}:${includeVariables ? "variables" : "no-variables"}:${normalizedServiceKeys.join(",")}`;
+  const cacheKey = `railway:topology:${scope}:${ensure ? "ensure" : "observe"}:${includeInstances ? "instances" : "no-instances"}:${includeVariables ? "variables" : "no-variables"}:${normalizedServiceKeys.join(",")}:${imageRefFingerprint}`;
   return await providerCache(input, cacheKey, async () => {
     const env = buildRailwayEnv(input, scope);
     const deployState = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target: toDeployTarget(input.context.target) });
-    const services = configuredRailwayServices(input.context.tenantRoot, scope).filter((service) => normalizedServiceKeys.includes("__all__") || normalizedServiceKeys.includes(service.key));
+    const services = configuredRailwayServicesForInput(input, scope).filter((service) => normalizedServiceKeys.includes("__all__") || normalizedServiceKeys.includes(service.key));
     traceRailwayReconcile(env, "topology:start", `scope=${scope} ensure=${ensure ? "yes" : "no"} services=${services.map((service) => service.key).join(",")}`);
     let workspace = null;
     const knownProjects = [];

package/dist/reconcile/desired-state.js

@@ -190,7 +190,7 @@ function deriveTreeseedDesiredUnits({
     });
   }
   const scope = target.kind === "persistent" ? target.scope : "staging";
-  for (const configuredService of configuredRailwayServices(tenantRoot, scope)) {
+  for (const configuredService of configuredRailwayServices(tenantRoot, scope, env)) {
     const serviceKey = configuredService.key;
     const service = configuredService.serviceConfig ?? deployConfig.services?.[serviceKey];
     const serviceState = legacyState.services?.[serviceKey];
@@ -217,6 +217,13 @@ function deriveTreeseedDesiredUnits({
         serviceId: persistedServiceMatchesDesired ? serviceState?.serviceId ?? configuredService.serviceId : configuredService.serviceId,
         serviceName: desiredServiceName,
         rootDir: configuredService.rootDir ?? serviceState?.rootDir,
+        imageRef: configuredService.imageRef,
+        imageRefEnv: configuredService.serviceConfig?.railway?.imageRefEnv,
+        sourceMode: configuredService.sourceMode,
+        sourceRepo: configuredService.sourceRepo,
+        sourceBranch: configuredService.sourceBranch,
+        sourceCommit: configuredService.sourceCommit,
+        sourceRootDirectory: configuredService.sourceRootDirectory,
         environment: normalizeRailwayEnvironmentName(configuredService.railwayEnvironment ?? serviceState?.environment),
         buildCommand: configuredService.buildCommand,
         startCommand: configuredService.startCommand,

package/dist/workflow/operations.d.ts

@@ -91,7 +91,7 @@ export declare function workflowReleaseCandidate(helpers: WorkflowOperationHelpe
 }>>;
 type PublishedArtifactCheck = {
     id: string;
-    kind: 'npm' | 'docker' | 'pypi' | 'crates' | 'hex';
+    kind: 'npm' | 'docker' | 'pypi' | 'crates' | 'hex' | 'github-tag';
     name: string;
     version: string;
     url: string;

package/dist/workflow/operations.js

@@ -534,7 +534,7 @@ function selectorFromWorkflowHostingGraph(graph) {
     }))]
   };
 }
-async function reconcileSaveHostedEnvironment(root, environment, helpers, workflowRunId, operation = "save", envOverlay = {}) {
+async function reconcileSaveHostedEnvironment(root, environment, helpers, workflowRunId, operation = "save", envOverlay = {}, options = {}) {
   const target = createPersistentDeployTarget(environment);
   const env = {
     ...helpers.context.env,
@@ -585,6 +585,7 @@ ${status.blockers.join("\n")}`, {
   const live = await collectTreeseedLiveHostedServiceChecks({
     tenantRoot: root,
     target: environment,
+    appId: options.liveAppId,
     strict: true,
     requireLiveRailway: true,
     requireLiveHttp: true,
@@ -2576,6 +2577,46 @@ async function verifyNpmArtifact(packageName, version) {
     };
   }
 }
+async function fetchDockerRegistryManifestStatus(image, version) {
+  const [namespace, repository] = image.split("/");
+  if (!namespace || !repository) {
+    return { ok: false, status: null, message: `Invalid Docker image name ${image}.` };
+  }
+  const tokenUrl = `https://auth.docker.io/token?service=registry.docker.io&scope=repository:${namespace}/${repository}:pull`;
+  try {
+    const tokenResponse = await fetchJsonForArtifact(tokenUrl);
+    const token = typeof stringRecord(tokenResponse.json)?.token === "string" ? String(stringRecord(tokenResponse.json)?.token) : "";
+    if (!tokenResponse.ok || !token) {
+      return { ok: false, status: tokenResponse.status, message: `Docker registry token request failed for ${image}.` };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 2e4);
+    try {
+      const manifestResponse = await fetch(`https://registry-1.docker.io/v2/${namespace}/${repository}/manifests/${version}`, {
+        method: "HEAD",
+        headers: {
+          accept: [
+            "application/vnd.docker.distribution.manifest.list.v2+json",
+            "application/vnd.oci.image.index.v1+json",
+            "application/vnd.docker.distribution.manifest.v2+json"
+          ].join(", "),
+          authorization: `Bearer ${token}`,
+          "user-agent": "treeseed-release-verifier/1.0 (https://treeseed.dev)"
+        },
+        signal: controller.signal
+      });
+      return {
+        ok: manifestResponse.ok,
+        status: manifestResponse.status,
+        ...manifestResponse.ok ? {} : { message: `Docker registry manifest for ${image}:${version} is not pullable yet.` }
+      };
+    } finally {
+      clearTimeout(timeout);
+    }
+  } catch (error) {
+    return { ok: false, status: null, message: error instanceof Error ? error.message : String(error) };
+  }
+}
 async function verifyDockerHubArtifact(image, version) {
   const [namespace, repository] = image.split("/");
   const url = `https://hub.docker.com/v2/repositories/${namespace}/${repository}/tags/${version}`;
@@ -2583,7 +2624,8 @@ async function verifyDockerHubArtifact(image, version) {
     const response = await fetchJsonForArtifact(url);
     const images = Array.isArray(stringRecord(response.json)?.images) ? stringRecord(response.json)?.images : [];
     const architectures = new Set(images.map((entry) => stringRecord(entry)).map((entry) => typeof entry?.architecture === "string" ? entry.architecture : null).filter((entry) => Boolean(entry)));
-    const ok = response.ok && architectures.has("amd64") && architectures.has("arm64");
+    const registry = await fetchDockerRegistryManifestStatus(image, version);
+    const ok = response.ok && architectures.has("amd64") && architectures.has("arm64") && registry.ok;
     return {
       id: `docker:${image}:${version}`,
       kind: "docker",
@@ -2591,8 +2633,8 @@ async function verifyDockerHubArtifact(image, version) {
       version,
       url,
       ok,
-      status: response.status,
-      ...ok ? {} : { message: `${image}:${version} was not found on Docker Hub with amd64 and arm64 images.` }
+      status: registry.status ?? response.status,
+      ...ok ? {} : { message: registry.message ?? `${image}:${version} was not found on Docker Hub with amd64 and arm64 images.` }
     };
   } catch (error) {
     return {
@@ -2607,6 +2649,33 @@ async function verifyDockerHubArtifact(image, version) {
     };
   }
 }
+async function verifyGitHubTagArtifact(repository, version) {
+  const url = `https://api.github.com/repos/${repository}/git/ref/tags/${encodeURIComponent(version)}`;
+  try {
+    const response = await fetchJsonForArtifact(url);
+    return {
+      id: `github-tag:${repository}:${version}`,
+      kind: "github-tag",
+      name: repository,
+      version,
+      url,
+      ok: response.ok,
+      status: response.status,
+      ...response.ok ? {} : { message: `GitHub tag ${repository}@${version} was not found.` }
+    };
+  } catch (error) {
+    return {
+      id: `github-tag:${repository}:${version}`,
+      kind: "github-tag",
+      name: repository,
+      version,
+      url,
+      ok: false,
+      status: null,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
 async function verifySimpleRegistryArtifact(input) {
   try {
     const response = await fetchJsonForArtifact(input.url);
@@ -2635,6 +2704,21 @@ async function verifySimpleRegistryArtifact(input) {
 }
 async function collectPublishedReleaseArtifactChecks(selectedVersions) {
   const checks = [];
+  const githubRepositories = {
+    "@treeseed/sdk": "treeseed-ai/sdk",
+    "@treeseed/ui": "treeseed-ai/ui",
+    "@treeseed/core": "treeseed-ai/core",
+    "@treeseed/admin": "treeseed-ai/admin",
+    "@treeseed/cli": "treeseed-ai/cli",
+    "@treeseed/agent": "treeseed-ai/agent",
+    "@treeseed/api": "treeseed-ai/api",
+    treedx: "treeseed-ai/treedx",
+    "@treeseed/treedx": "treeseed-ai/treedx"
+  };
+  for (const [packageName, repository] of Object.entries(githubRepositories)) {
+    const version = selectedVersions.get(packageName);
+    if (version) checks.push(await verifyGitHubTagArtifact(repository, version));
+  }
   const npmPackages = ["@treeseed/sdk", "@treeseed/ui", "@treeseed/core", "@treeseed/admin", "@treeseed/cli", "@treeseed/agent"];
   for (const packageName of npmPackages) {
     const version = selectedVersions.get(packageName);
@@ -5528,7 +5612,7 @@ ${rendered}`);
           packageReleases.push(packageRelease);
         }
         const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
-        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions)));
+        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions), { liveAppId: "api" }));
         const productionApiGuarantees = await executeJournalStep(root, workflowRun.runId, "production-api-guarantees", () => runReleaseApiGuarantees(root, "prod", helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.18",
+  "version": "0.12.20",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {