@treeseed/sdk 0.12.19 → 0.12.21

package/dist/operations/services/deploy.d.ts

@@ -294,7 +294,8 @@ export declare function queueName(entry: any): any;
 export declare function queueId(entry: any): any;
 export declare function hasProvisionedCloudflareResources(state: any): boolean;
 export declare function purgeSourcePageCaches(tenantRoot: any, options?: {}): {
-    skipped: any;
+    skipped: boolean;
+    reason: string;
     urls: (string | null)[];
     results: never[];
 } | {
@@ -305,9 +306,11 @@ export declare function purgeSourcePageCaches(tenantRoot: any, options?: {}): {
         success: boolean;
     }[];
     skipped?: undefined;
+    reason?: undefined;
 };
 export declare function purgePublishedContentCaches(tenantRoot: any, urls: any, options?: {}): {
-    skipped: any;
+    skipped: boolean;
+    reason: string;
     urls: any;
     results: never[];
 } | {
@@ -318,6 +321,7 @@ export declare function purgePublishedContentCaches(tenantRoot: any, urls: any,
         success: boolean;
     }[];
     skipped?: undefined;
+    reason?: undefined;
 };
 export declare function resolveConfiguredCloudflareAccountId(deployConfig: any): any;
 export declare function collectMissingDeployInputs(tenantRoot: any): {

package/dist/operations/services/deploy.js

@@ -1683,19 +1683,30 @@ function recordCachePurgeResult(targetState, results, error = null) {
   targetState.purgeCount = Array.isArray(results) ? results.reduce((sum, result) => sum + (result?.count ?? 0), 0) : 0;
   targetState.lastError = null;
 }
+function resolveCloudflareCachePurgeEnv(options = {}) {
+  const env = options.env ?? {};
+  const token = env.TREESEED_CLOUDFLARE_API_TOKEN ?? env.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN;
+  return token ? { ...env, TREESEED_CLOUDFLARE_API_TOKEN: token, CLOUDFLARE_API_TOKEN: token } : null;
+}
 function purgeSourcePageCaches(tenantRoot, options = {}) {
   const target = normalizeTarget(options.scope ?? options.target ?? "prod");
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
   const urls = resolveSourcePagePurgeUrls(deployConfig);
-  if ((options.dryRun ?? false) || urls.length === 0 || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
+  const env = resolveCloudflareCachePurgeEnv(options);
+  if ((options.dryRun ?? false) || urls.length === 0 || !env) {
     recordCachePurgeResult(state.webCache.deployPurge, urls.map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
-    return { skipped: options.dryRun ?? false, urls, results: [] };
+    return {
+      skipped: true,
+      reason: options.dryRun ? "dry_run" : urls.length === 0 ? "no_urls" : "missing_cloudflare_token",
+      urls,
+      results: []
+    };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
+      env
     });
     recordCachePurgeResult(state.webCache.deployPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -1710,14 +1721,20 @@ function purgePublishedContentCaches(tenantRoot, urls, options = {}) {
   const target = normalizeTarget(options.scope ?? options.target ?? "prod");
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
-  if ((options.dryRun ?? false) || !urls?.length || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
+  const env = resolveCloudflareCachePurgeEnv(options);
+  if ((options.dryRun ?? false) || !urls?.length || !env) {
     recordCachePurgeResult(state.webCache.contentPurge, (urls ?? []).map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
-    return { skipped: options.dryRun ?? false, urls: urls ?? [], results: [] };
+    return {
+      skipped: true,
+      reason: options.dryRun ? "dry_run" : !urls?.length ? "no_urls" : "missing_cloudflare_token",
+      urls: urls ?? [],
+      results: []
+    };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
+      env
     });
     recordCachePurgeResult(state.webCache.contentPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -3657,8 +3674,14 @@ function finalizeDeploymentState(tenantRoot, options = {}) {
   writeDeployState(tenantRoot, state, { target });
   if (target.kind === "persistent") {
     try {
-      purgeSourcePageCaches(tenantRoot, { target });
-    } catch {
+      const purgeResult = purgeSourcePageCaches(tenantRoot, { target, env: options.env });
+      if (target.scope === "prod" && purgeResult?.skipped) {
+        throw new Error(`Production source-page cache purge was skipped: ${purgeResult.reason ?? "unknown"}.`);
+      }
+    } catch (error) {
+      if (target.scope === "prod") {
+        throw error;
+      }
     }
     return loadDeployState(tenantRoot, deployConfig, { target });
   }

package/dist/operations/services/hosted-service-checks.d.ts

@@ -65,6 +65,7 @@ export interface TreeseedHostedServiceCheckOptions {
     appId?: string;
     serviceKeys?: string[];
     now?: Date;
+    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
     valuesOverlay?: Record<string, string | undefined>;
     observedRailwayServices?: Record<string, TreeseedObservedRailwayServiceState | undefined>;
     httpChecks?: Record<string, {

package/dist/operations/services/hosted-service-checks.js

@@ -145,7 +145,8 @@ function httpStatus(url, options) {
 function collectTreeseedHostedServiceChecks(options) {
   const target = options.target ?? "prod";
   const tenantRoot = options.tenantRoot;
-  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target, env: process.env }).deployConfig;
+  const configEnv = { ...process.env, ...options.env ?? {} };
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target, env: configEnv }).deployConfig;
   const registry = collectTreeseedEnvironmentContext(tenantRoot);
   let machineValues = {};
   try {
@@ -153,17 +154,18 @@ function collectTreeseedHostedServiceChecks(options) {
   } catch {
     machineValues = {};
   }
-  const values = { ...machineValues, ...options.valuesOverlay ?? {} };
+  const values = { ...machineValues, ...configEnv, ...options.valuesOverlay ?? {} };
   const checks = [];
   const selectedServiceKeys = new Set((options.serviceKeys ?? []).map((key) => key.trim()).filter(Boolean));
   const selectedAppId = options.appId?.trim() || null;
   const applications = discoverTreeseedApplications(tenantRoot);
   const selectedApplication = selectedAppId ? applications.find((application) => application.id === selectedAppId || application.relativeRoot === selectedAppId) : null;
+  const selectedService = (serviceKey) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(serviceKey);
   const workspaceHasApiApplication = applications.some(
     (application) => application.roles.includes("api") || application.config.surfaces?.api?.enabled === true || application.config.services?.api?.enabled !== false && Boolean(application.config.services?.api)
   );
-  const includeWeb = !selectedAppId || selectedAppId === "web" || selectedApplication?.roles.includes("web") === true;
-  const includeApi = !selectedAppId || selectedAppId === "api" || selectedApplication?.roles.includes("api") === true;
+  const includeWeb = selectedService("web") && (!selectedAppId || selectedAppId === "web" || selectedApplication?.roles.includes("web") === true);
+  const includeApi = selectedService("api") && (!selectedAppId || selectedAppId === "api" || selectedApplication?.roles.includes("api") === true);
   const selectedAppHasApi = Boolean(
     selectedApplication?.roles.includes("api") || selectedApplication?.config.surfaces?.api?.enabled === true || selectedApplication?.config.services?.api?.enabled !== false && selectedApplication?.config.services?.api || selectedAppId === "web" && workspaceHasApiApplication || selectedAppId === "web" && (deployConfig.surfaces?.api?.enabled === true || deployConfig.services?.api?.enabled !== false && deployConfig.services?.api)
   );
@@ -189,12 +191,13 @@ function collectTreeseedHostedServiceChecks(options) {
     if (domain) {
       const url = String(domain).startsWith("http") ? String(domain) : `https://${domain}`;
       checks.push({ ...httpStatus(url, options), id: `http:${selectedWeb.appId}`, serviceKey: selectedWeb.appId, serviceType: "web", description: "Web public URL responds." });
-      if (!selectedAppId || selectedAppHasApi) {
+      if (selectedServiceKeys.size === 0 && (!selectedAppId || selectedAppHasApi)) {
         checks.push({ ...httpStatus(`${url.replace(/\/+$/u, "")}/v1/healthz`, options), id: `http:${selectedWeb.appId}:v1-healthz`, serviceKey: selectedWeb.appId, serviceType: "web", description: "Web proxy reaches API health." });
       }
     }
   }
   for (const [surfaceKey, surface] of Object.entries(deployConfig.surfaces ?? {})) {
+    if (!selectedService(surfaceKey)) continue;
     if (selectedAppId === "api" && surfaceKey === "web") continue;
     if (surface && typeof surface === "object" && surface.enabled !== false && surface.provider && !["cloudflare", "railway"].includes(surface.provider)) {
       checks.push(check({
@@ -211,7 +214,7 @@ function collectTreeseedHostedServiceChecks(options) {
       }));
     }
   }
-  const configuredServices = configuredRailwayServices(tenantRoot, target).filter((service) => !selectedAppId || service.application?.id === selectedAppId).filter((service) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(service.key));
+  const configuredServices = configuredRailwayServices(tenantRoot, target, configEnv).filter((service) => !selectedAppId || service.application?.id === selectedAppId).filter((service) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(service.key));
   for (const service of configuredServices) {
     const serviceType = serviceTypeFor(service.key);
     const observed = observedFor(options, service.serviceName);

package/dist/operations/services/live-hosted-service-checks.js

@@ -218,7 +218,7 @@ async function collectRailwayObservations(options) {
   try {
     const workspace = await resolveRailwayWorkspaceContext({ env: options.env, fetchImpl: options.fetchImpl });
     const projects = await listRailwayProjects({ workspaceId: workspace.id, env: options.env, fetchImpl: options.fetchImpl });
-    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
+    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
     if (selectedServiceKeys.size === 0 || selectedServiceKeys.has("api") || selectedServiceKeys.has("operationsRunner")) {
       for (const descriptor of treeseedDatabaseDescriptors(options.tenantRoot, options)) {
         await verifyRailwayPostgresTopology({ descriptor, configuredServices, projects, options, issues });
@@ -347,7 +347,7 @@ async function collectRailwayObservations(options) {
       };
     }
     if (selectedServiceKeys.size === 0) {
-      const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: process.env }).deployConfig;
+      const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: options.env }).deployConfig;
       const appConfigs = [
         ...!options.appId || options.appId === "web" ? [deployConfig] : [],
         ...discoverTreeseedApplications(options.tenantRoot).filter((application) => application.id === "api" && (!options.appId || options.appId === "api")).map((application) => application.config)
@@ -418,18 +418,19 @@ async function collectRailwayObservations(options) {
   }
 }
 async function collectHttpObservations(options) {
-  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: process.env }).deployConfig;
+  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: options.tenantRoot, environment: options.target, env: options.env }).deployConfig;
   const urls = /* @__PURE__ */ new Set();
   const fallbacks = /* @__PURE__ */ new Map();
   const selectedServiceKeys = selectedServiceKeySet(options);
   const selectedApplication = options.appId ? discoverTreeseedApplications(options.tenantRoot).find((application) => application.id === options.appId || application.relativeRoot === options.appId) : null;
-  if (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("web")) {
+  const webHttpSelected = selectedServiceKeys.size === 0 || selectedServiceKeys.has("web");
+  if (webHttpSelected && (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("web"))) {
     const webConfig = selectedWebConfig(deployConfig, selectedApplication);
     const webDomain = webConfig.surfaces?.web?.environments?.[options.target]?.domain ?? webConfig.surfaces?.web?.publicBaseUrl ?? webConfig.siteUrl;
     const webUrl = urlForDomain(webDomain);
     if (webUrl) {
       urls.add(webUrl);
-      if (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("api")) {
+      if (selectedServiceKeys.size === 0 && (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("api"))) {
         urls.add(`${webUrl}/v1/healthz`);
       }
       const pagesProjectName = webConfig.cloudflare?.pages?.projectName;
@@ -440,7 +441,7 @@ async function collectHttpObservations(options) {
       }
     }
   }
-  for (const service of configuredRailwayServices(options.tenantRoot, options.target).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
+  for (const service of configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
     const serviceConfig = deployConfig.services?.[service.key];
     const domain = service.publicBaseUrl ?? serviceConfig?.environments?.[options.target]?.baseUrl ?? serviceConfig?.environments?.[options.target]?.domain ?? (service.key === "api" ? deployConfig.surfaces?.api?.environments?.[options.target]?.domain : null);
     const baseUrl = urlForDomain(domain);
@@ -500,6 +501,7 @@ async function collectTreeseedLiveHostedServiceChecks(options) {
     target: effectiveOptions.target,
     appId: effectiveOptions.appId,
     serviceKeys: effectiveOptions.serviceKeys,
+    env: effectiveOptions.env,
     observedRailwayServices: railway.observed,
     httpChecks
   });

package/dist/operations/services/project-platform.js

@@ -196,7 +196,7 @@ function isTransientWranglerOutput(output) {
   return /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|connectivity issue|internal error|aborted/i.test(output);
 }
 async function runPrefixedWranglerWithRetry(tenantRoot, args, {
-  env = {},
+  env: env2 = {},
   write,
   prefix
 }) {
@@ -208,7 +208,7 @@ async function runPrefixedWranglerWithRetry(tenantRoot, args, {
     }
     const result = await runPrefixedCommand(wrangler.command, [...wrangler.argsPrefix, ...args], {
       cwd: tenantRoot,
-      env,
+      env: env2,
       write,
       prefix
     });
@@ -235,7 +235,7 @@ function prepareTenantCloudflareDeploy({
   target: explicitTarget,
   dryRun,
   write,
-  env = process.env
+  env: env2 = process.env
 }) {
   const target = explicitTarget ?? createPersistentDeployTarget(scope === "local" ? "staging" : scope);
   if (scope !== "local") {
@@ -260,7 +260,7 @@ function prepareTenantCloudflareDeploy({
     pagesBranchName,
     env: {
       ...process.env,
-      ...env,
+      ...env2,
       CLOUDFLARE_ACCOUNT_ID: resolveConfiguredCloudflareAccountId(deployConfig),
       ...target.kind === "persistent" && target.scope !== "local" ? { TREESEED_CONTENT_SERVING_MODE: "published_runtime" } : {}
     },
@@ -478,12 +478,12 @@ async function repairHostingAfterSuccessfulDeploy(options, systems) {
     };
   }
   const environment = options.scope === "prod" ? "prod" : "staging";
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   const audit = await runTreeseedHostingAudit({
     tenantRoot: options.tenantRoot,
     environment,
     repair: false,
-    env,
+    env: env2,
     hostKinds: [...hostKinds]
   });
   if (audit.ok) {
@@ -494,7 +494,7 @@ async function repairHostingAfterSuccessfulDeploy(options, systems) {
     tenantRoot: options.tenantRoot,
     environment,
     repair: true,
-    env,
+    env: env2,
     hostKinds: [...hostKinds],
     write: (line) => options.write?.(`[${environment}][hosting][repair] ${line}`)
   });
@@ -955,7 +955,7 @@ async function publishContent(options, reporter, publishOptions = {}) {
         }, manifestFile, uploadOptions);
         if (contentPurgeUrls.size > 0) {
           try {
-            purgePublishedContentCaches(options.tenantRoot, [...contentPurgeUrls].filter(Boolean), { target });
+            purgePublishedContentCaches(options.tenantRoot, [...contentPurgeUrls].filter(Boolean), { target, env });
           } catch {
           }
         }
@@ -1020,12 +1020,12 @@ async function provisionProjectPlatform(options) {
   writeWorkflowStatus("provision:resolve-bootstrap-systems");
   const bootstrapSystems = resolveProjectPlatformBootstrapSystems(options, siteConfig);
   const selectedSystems = new Set(bootstrapSystems);
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   writeWorkflowStatus(`provision:reconcile:start systems=${bootstrapSystems.join(",") || "(none)"}`);
   const summary = await timedPhase(timings, "provision:reconcile", () => reconcileTreeseedTarget({
     tenantRoot: options.tenantRoot,
     target,
-    env,
+    env: env2,
     systems: bootstrapSystems,
     write: options.write,
     dryRun: options.dryRun
@@ -1036,7 +1036,7 @@ async function provisionProjectPlatform(options) {
   const verification = await timedPhase(timings, "provision:collect-reconcile-status", () => collectTreeseedReconcileStatus({
     tenantRoot: options.tenantRoot,
     target,
-    env,
+    env: env2,
     systems: bootstrapSystems
   }));
   writeWorkflowStatus("provision:collect-reconcile-status:done");
@@ -1050,7 +1050,7 @@ async function provisionProjectPlatform(options) {
     writeWorkflowStatus("provision:ensure-wrangler-config:skipped");
   }
   const shouldValidateRailway = selectedSystems.has("api") || selectedSystems.has("agents");
-  const railwayValidation = shouldValidateRailway ? options.scope === "local" ? validateRailwayServiceConfiguration(options.tenantRoot, options.scope) : validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env }) : { services: [] };
+  const railwayValidation = shouldValidateRailway ? options.scope === "local" ? validateRailwayServiceConfiguration(options.tenantRoot, options.scope) : validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env: env2 }) : { services: [] };
   const railwaySchedules = [];
   const railwayScheduleVerification = {
     ok: true,
@@ -1210,7 +1210,7 @@ async function deployProjectPlatform(options) {
   const selectedSystems = new Set(bootstrapSystems);
   const execution = options.bootstrapExecution ?? "parallel";
   const write = options.write;
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   writeWorkflowStatus(`deploy:bootstrap-systems ${bootstrapSystems.join(",") || "(none)"}`);
   writeWorkflowStatus("deploy:report-running");
   await reportDeployment(reporter, {
@@ -1238,7 +1238,7 @@ async function deployProjectPlatform(options) {
         tenantRoot: options.tenantRoot,
         scope: "local",
         dryRun: options.dryRun,
-        env,
+        env: env2,
         write
       })
     });
@@ -1248,7 +1248,7 @@ async function deployProjectPlatform(options) {
       scope: options.scope,
       dryRun: options.dryRun,
       write,
-      env
+      env: env2
     });
   }
   if (cloudflareContext && selectedSystems.has("data")) {
@@ -1283,11 +1283,11 @@ async function deployProjectPlatform(options) {
   const serviceResultsByKey = /* @__PURE__ */ new Map();
   let selectedRailwayServiceKeys = [];
   if (options.scope !== "local" && (selectedSystems.has("api") || selectedSystems.has("agents"))) {
-    const validation = validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env });
+    const validation = validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env: env2 });
     const selectedServices = validation.services.filter(
       (service) => service.key === "api" ? selectedSystems.has("api") : selectedSystems.has("agents")
     );
-    const sequentialRailwayDeploys = String(env.TREESEED_RAILWAY_DEPLOY_SEQUENTIAL ?? "").trim() === "1";
+    const sequentialRailwayDeploys = String(env2.TREESEED_RAILWAY_DEPLOY_SEQUENTIAL ?? "").trim() === "1";
     let previousRailwayDeployNodeId = null;
     for (const service of selectedServices) {
       const system = service.key === "api" ? "api" : "agents";
@@ -1304,7 +1304,7 @@ async function deployProjectPlatform(options) {
           const result = await deployRailwayService(options.tenantRoot, service, {
             dryRun: options.dryRun,
             write,
-            env,
+            env: env2,
             prefix: {
               scope: options.scope,
               system,
@@ -1336,7 +1336,7 @@ async function deployProjectPlatform(options) {
           task: "schedules",
           stage: "deploy"
         }, "Reconciling Railway schedules...");
-        railwaySchedules = await ensureRailwayScheduledJobs(options.tenantRoot, options.scope, { dryRun: options.dryRun, env });
+        railwaySchedules = await ensureRailwayScheduledJobs(options.tenantRoot, options.scope, { dryRun: options.dryRun, env: env2 });
         railwayScheduleVerification = !options.dryRun ? await verifyRailwayScheduledJobs(options.tenantRoot, options.scope) : { ok: true, checks: railwaySchedules, skipped: true, reason: "dry_run" };
         return {
           service: "railway-schedules",
@@ -1358,7 +1358,8 @@ async function deployProjectPlatform(options) {
   if (options.scope !== "local" && !options.dryRun && (selectedSystems.has("web") || serviceResults.length > 0)) {
     finalizeDeploymentState(options.tenantRoot, {
       target: createPersistentDeployTarget(options.scope),
-      serviceResults
+      serviceResults,
+      env: env2
     });
   }
   if (!managesRailwaySchedules || !selectedSystems.has("agents")) {
@@ -1423,7 +1424,7 @@ async function publishProjectContent(options) {
 async function monitorProjectPlatform(options) {
   const timings = [];
   const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
   const siteConfig = loadCliDeployConfig(options.tenantRoot);
   const selectedSystems = new Set(resolveProjectPlatformBootstrapSystems(options, siteConfig));
@@ -1434,7 +1435,7 @@ async function monitorProjectPlatform(options) {
   const apiBaseUrl = resolveImmediateApiProbeUrl(siteConfig, state, target);
   const apiMonitorEndpoints = resolveApiMonitorEndpoints(siteConfig, apiBaseUrl);
   const railwayResourcesPromise = options.scope === "local" || !apiSelected && !agentsSelected ? { ok: true, skipped: true, reason: options.scope === "local" ? "local_scope" : "railway_not_selected" } : timedPhase(timings, "monitor:railway-resources", () => verifyRailwayManagedResources(options.tenantRoot, options.scope, {
-    env,
+    env: env2,
     settleDeployments: true,
     onProgress: options.write
   }));

package/dist/workflow/operations.d.ts

@@ -1167,6 +1167,7 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
             releaseBlockingFailures: number;
         };
     };
+    productionWebVerification: Record<string, unknown> | null;
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -534,7 +534,7 @@ function selectorFromWorkflowHostingGraph(graph) {
     }))]
   };
 }
-async function reconcileSaveHostedEnvironment(root, environment, helpers, workflowRunId, operation = "save", envOverlay = {}) {
+async function reconcileSaveHostedEnvironment(root, environment, helpers, workflowRunId, operation = "save", envOverlay = {}, options = {}) {
   const target = createPersistentDeployTarget(environment);
   const env = {
     ...helpers.context.env,
@@ -585,6 +585,7 @@ ${status.blockers.join("\n")}`, {
   const live = await collectTreeseedLiveHostedServiceChecks({
     tenantRoot: root,
     target: environment,
+    appId: options.liveAppId,
     strict: true,
     requireLiveRailway: true,
     requireLiveHttp: true,
@@ -616,6 +617,33 @@ ${liveFailures.join("\n")}`, {
     liveVerification: live
   };
 }
+async function runReleaseWebLiveVerification(root, environment, helpers, operation) {
+  const env = {
+    ...helpers.context.env,
+    ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
+  };
+  const live = await collectTreeseedLiveHostedServiceChecks({
+    tenantRoot: root,
+    target: environment,
+    appId: "web",
+    serviceKeys: ["web"],
+    strict: true,
+    requireLiveRailway: false,
+    requireLiveHttp: true,
+    env
+  });
+  const liveFailures = [
+    ...live.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.issues.join("; ") || "failed"}`),
+    ...live.liveObservation.issues
+  ];
+  if (liveFailures.length > 0) {
+    workflowError(operation, "hosted_live_verification_failed", `Production web live verification failed after root deployment:
+${liveFailures.join("\n")}`, {
+      details: { environment, live }
+    });
+  }
+  return live;
+}
 function productionReleaseImageRefEnv(selectedVersions) {
   const refs = {};
   const apiVersion = selectedVersions.get("@treeseed/api");
@@ -5611,7 +5639,7 @@ ${rendered}`);
           packageReleases.push(packageRelease);
         }
         const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
-        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions)));
+        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions), { liveAppId: "api" }));
         const productionApiGuarantees = await executeJournalStep(root, workflowRun.runId, "production-api-guarantees", () => runReleaseApiGuarantees(root, "prod", helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
@@ -5663,6 +5691,7 @@ ${rendered}`);
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
+        const productionWebVerification = await executeJournalStep(root, workflowRun.runId, "production-web-live-verification", () => runReleaseWebLiveVerification(root, "prod", helpers, "release"));
         const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
           const packageBackMerges = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
             subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
@@ -5691,6 +5720,7 @@ ${rendered}`);
           publishedArtifacts,
           productionHosting,
           productionApiGuarantees,
+          productionWebVerification,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.19",
+  "version": "0.12.21",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {