@treeseed/sdk 0.12.20 → 0.12.22

package/dist/api/auth/d1-provider.d.ts

@@ -54,6 +54,7 @@ export declare class D1AuthProvider implements ApiAuthProvider {
     }>;
     createUser(input: {
         email?: string | null;
+        username?: string | null;
         displayName?: string | null;
         metadata?: Record<string, unknown>;
     }): Promise<{

package/dist/api/auth/d1-store.d.ts

@@ -31,6 +31,8 @@ export declare class D1AuthStore {
     private loadUser;
     private loadIdentityByProvider;
     private loadUserByVerifiedEmail;
+    private loadUserByUsername;
+    private canAdoptUsernameMatch;
     private rolesForUser;
     private permissionsForUser;
     private permissionsForRoles;

package/dist/api/auth/d1-store.js

@@ -250,6 +250,20 @@ class D1AuthStore {
       [email]
     );
   }
+  async loadUserByUsername(username) {
+    return this.first(
+      `SELECT * FROM users WHERE LOWER(username) = LOWER(?) AND status = 'active' LIMIT 1`,
+      [username]
+    );
+  }
+  canAdoptUsernameMatch(identity, user) {
+    if (!user?.id || !identity.username) return false;
+    const profile = identity.profile && typeof identity.profile === "object" ? identity.profile : {};
+    if (identity.provider === "acceptance" || profile.acceptance === true) return true;
+    const existingEmail = typeof user.email === "string" ? user.email.trim().toLowerCase() : "";
+    const requestedEmail = typeof identity.email === "string" ? identity.email.trim().toLowerCase() : "";
+    return Boolean(requestedEmail && existingEmail && requestedEmail === existingEmail && identity.emailVerified);
+  }
   async rolesForUser(userId) {
     const rows = await this.all(
       `SELECT roles.key AS key
@@ -381,7 +395,9 @@ class D1AuthStore {
     const existingIdentity = await this.loadIdentityByProvider(identity.provider, identity.providerSubject);
     let userId = existingIdentity?.user_id;
     if (!userId) {
-      const linkedUser = identity.email && identity.emailVerified ? await this.loadUserByVerifiedEmail(identity.email) : null;
+      const emailLinkedUser = identity.email && identity.emailVerified ? await this.loadUserByVerifiedEmail(identity.email) : null;
+      const usernameLinkedUser = !emailLinkedUser && identity.username ? await this.loadUserByUsername(identity.username) : null;
+      const linkedUser = emailLinkedUser ?? (this.canAdoptUsernameMatch(identity, usernameLinkedUser) ? usernameLinkedUser : null);
       userId = linkedUser?.id ?? randomUUID();
       if (linkedUser) {
         await this.run(

package/dist/operations/services/deploy.d.ts

@@ -294,7 +294,8 @@ export declare function queueName(entry: any): any;
 export declare function queueId(entry: any): any;
 export declare function hasProvisionedCloudflareResources(state: any): boolean;
 export declare function purgeSourcePageCaches(tenantRoot: any, options?: {}): {
-    skipped: any;
+    skipped: boolean;
+    reason: string;
     urls: (string | null)[];
     results: never[];
 } | {
@@ -305,9 +306,11 @@ export declare function purgeSourcePageCaches(tenantRoot: any, options?: {}): {
         success: boolean;
     }[];
     skipped?: undefined;
+    reason?: undefined;
 };
 export declare function purgePublishedContentCaches(tenantRoot: any, urls: any, options?: {}): {
-    skipped: any;
+    skipped: boolean;
+    reason: string;
     urls: any;
     results: never[];
 } | {
@@ -318,6 +321,7 @@ export declare function purgePublishedContentCaches(tenantRoot: any, urls: any,
         success: boolean;
     }[];
     skipped?: undefined;
+    reason?: undefined;
 };
 export declare function resolveConfiguredCloudflareAccountId(deployConfig: any): any;
 export declare function collectMissingDeployInputs(tenantRoot: any): {

package/dist/operations/services/deploy.js

@@ -1683,19 +1683,30 @@ function recordCachePurgeResult(targetState, results, error = null) {
   targetState.purgeCount = Array.isArray(results) ? results.reduce((sum, result) => sum + (result?.count ?? 0), 0) : 0;
   targetState.lastError = null;
 }
+function resolveCloudflareCachePurgeEnv(options = {}) {
+  const env = options.env ?? {};
+  const token = env.TREESEED_CLOUDFLARE_API_TOKEN ?? env.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN;
+  return token ? { ...env, TREESEED_CLOUDFLARE_API_TOKEN: token, CLOUDFLARE_API_TOKEN: token } : null;
+}
 function purgeSourcePageCaches(tenantRoot, options = {}) {
   const target = normalizeTarget(options.scope ?? options.target ?? "prod");
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
   const urls = resolveSourcePagePurgeUrls(deployConfig);
-  if ((options.dryRun ?? false) || urls.length === 0 || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
+  const env = resolveCloudflareCachePurgeEnv(options);
+  if ((options.dryRun ?? false) || urls.length === 0 || !env) {
     recordCachePurgeResult(state.webCache.deployPurge, urls.map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
-    return { skipped: options.dryRun ?? false, urls, results: [] };
+    return {
+      skipped: true,
+      reason: options.dryRun ? "dry_run" : urls.length === 0 ? "no_urls" : "missing_cloudflare_token",
+      urls,
+      results: []
+    };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
+      env
     });
     recordCachePurgeResult(state.webCache.deployPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -1710,14 +1721,20 @@ function purgePublishedContentCaches(tenantRoot, urls, options = {}) {
   const target = normalizeTarget(options.scope ?? options.target ?? "prod");
   const deployConfig = loadTenantDeployConfig(tenantRoot);
   const state = loadDeployState(tenantRoot, deployConfig, { target });
-  if ((options.dryRun ?? false) || !urls?.length || !process.env.TREESEED_CLOUDFLARE_API_TOKEN) {
+  const env = resolveCloudflareCachePurgeEnv(options);
+  if ((options.dryRun ?? false) || !urls?.length || !env) {
     recordCachePurgeResult(state.webCache.contentPurge, (urls ?? []).map((url) => ({ count: url ? 1 : 0 })));
     writeDeployState(tenantRoot, state, { target });
-    return { skipped: options.dryRun ?? false, urls: urls ?? [], results: [] };
+    return {
+      skipped: true,
+      reason: options.dryRun ? "dry_run" : !urls?.length ? "no_urls" : "missing_cloudflare_token",
+      urls: urls ?? [],
+      results: []
+    };
   }
   try {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
-      env: { CLOUDFLARE_API_TOKEN: process.env.TREESEED_CLOUDFLARE_API_TOKEN }
+      env
     });
     recordCachePurgeResult(state.webCache.contentPurge, results);
     writeDeployState(tenantRoot, state, { target });
@@ -3657,8 +3674,14 @@ function finalizeDeploymentState(tenantRoot, options = {}) {
   writeDeployState(tenantRoot, state, { target });
   if (target.kind === "persistent") {
     try {
-      purgeSourcePageCaches(tenantRoot, { target });
-    } catch {
+      const purgeResult = purgeSourcePageCaches(tenantRoot, { target, env: options.env });
+      if (target.scope === "prod" && purgeResult?.skipped) {
+        throw new Error(`Production source-page cache purge was skipped: ${purgeResult.reason ?? "unknown"}.`);
+      }
+    } catch (error) {
+      if (target.scope === "prod") {
+        throw error;
+      }
     }
     return loadDeployState(tenantRoot, deployConfig, { target });
   }

package/dist/operations/services/github-api.js

@@ -778,7 +778,27 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
       });
       monitorErrorStartedAt = null;
       lastMonitorError = null;
-      const match = listed.data.workflow_runs.map((run) => normalizeWorkflowRun(run)).find((run) => (!headSha || run.headSha === headSha) && (!branch || run.headBranch === branch));
+      const matchingRuns = listed.data.workflow_runs.map((run) => normalizeWorkflowRun(run)).filter((run) => (!headSha || run.headSha === headSha) && (!branch || run.headBranch === branch));
+      const failedMatch = matchingRuns.find((run) => run.status === "completed" && run.conclusion !== "success");
+      if (failedMatch?.id) {
+        const failedJobs = await listWorkflowJobsForProgress(client, owner, name, failedMatch.id);
+        emitProgress("completed", failedMatch, failedJobs);
+        return {
+          status: "completed",
+          repository: `${owner}/${name}`,
+          workflow,
+          runId: failedMatch.id,
+          headSha: failedMatch.headSha,
+          branch: failedMatch.headBranch,
+          createdAt: failedMatch.createdAt,
+          updatedAt: failedMatch.updatedAt,
+          conclusion: failedMatch.conclusion,
+          url: failedMatch.url,
+          jobs: failedJobs,
+          failedJobs: failedJobs.filter((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped")
+        };
+      }
+      const match = matchingRuns[0];
       if (!match?.id) {
         emitProgress("waiting");
         if (dispatchIfMissing && branch && !dispatchedMissingRun && Date.now() - startedAt >= dispatchAfterSeconds * 1e3) {

package/dist/operations/services/hosted-service-checks.js

@@ -160,11 +160,12 @@ function collectTreeseedHostedServiceChecks(options) {
   const selectedAppId = options.appId?.trim() || null;
   const applications = discoverTreeseedApplications(tenantRoot);
   const selectedApplication = selectedAppId ? applications.find((application) => application.id === selectedAppId || application.relativeRoot === selectedAppId) : null;
+  const selectedService = (serviceKey) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(serviceKey);
   const workspaceHasApiApplication = applications.some(
     (application) => application.roles.includes("api") || application.config.surfaces?.api?.enabled === true || application.config.services?.api?.enabled !== false && Boolean(application.config.services?.api)
   );
-  const includeWeb = !selectedAppId || selectedAppId === "web" || selectedApplication?.roles.includes("web") === true;
-  const includeApi = !selectedAppId || selectedAppId === "api" || selectedApplication?.roles.includes("api") === true;
+  const includeWeb = selectedService("web") && (!selectedAppId || selectedAppId === "web" || selectedApplication?.roles.includes("web") === true);
+  const includeApi = selectedService("api") && (!selectedAppId || selectedAppId === "api" || selectedApplication?.roles.includes("api") === true);
   const selectedAppHasApi = Boolean(
     selectedApplication?.roles.includes("api") || selectedApplication?.config.surfaces?.api?.enabled === true || selectedApplication?.config.services?.api?.enabled !== false && selectedApplication?.config.services?.api || selectedAppId === "web" && workspaceHasApiApplication || selectedAppId === "web" && (deployConfig.surfaces?.api?.enabled === true || deployConfig.services?.api?.enabled !== false && deployConfig.services?.api)
   );
@@ -190,12 +191,13 @@ function collectTreeseedHostedServiceChecks(options) {
     if (domain) {
       const url = String(domain).startsWith("http") ? String(domain) : `https://${domain}`;
       checks.push({ ...httpStatus(url, options), id: `http:${selectedWeb.appId}`, serviceKey: selectedWeb.appId, serviceType: "web", description: "Web public URL responds." });
-      if (!selectedAppId || selectedAppHasApi) {
+      if (selectedServiceKeys.size === 0 && (!selectedAppId || selectedAppHasApi)) {
         checks.push({ ...httpStatus(`${url.replace(/\/+$/u, "")}/v1/healthz`, options), id: `http:${selectedWeb.appId}:v1-healthz`, serviceKey: selectedWeb.appId, serviceType: "web", description: "Web proxy reaches API health." });
       }
     }
   }
   for (const [surfaceKey, surface] of Object.entries(deployConfig.surfaces ?? {})) {
+    if (!selectedService(surfaceKey)) continue;
     if (selectedAppId === "api" && surfaceKey === "web") continue;
     if (surface && typeof surface === "object" && surface.enabled !== false && surface.provider && !["cloudflare", "railway"].includes(surface.provider)) {
       checks.push(check({

package/dist/operations/services/live-hosted-service-checks.js

@@ -1,3 +1,4 @@
+import { resolve } from "node:path";
 import { loadTreeseedPlatformConfig } from "../../platform/config.js";
 import { resolveTreeseedLaunchEnvironment } from "./config-runtime.js";
 import {
@@ -21,7 +22,7 @@ const DEFAULT_RETRY_INTERVAL_MS = 1500;
 const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_ATTEMPTS = 60;
 const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_INTERVAL_MS = 5e3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function liveCheckErrorMessage(error, fallback) {
   const message = error instanceof Error ? error.message : String(error ?? "");
@@ -125,12 +126,22 @@ function selectedServiceKeySet(options) {
 function serviceIsSelected(selected, serviceKey) {
   return selected.size === 0 || selected.has(serviceKey);
 }
+function serviceMatchesAppSelection(service, tenantRoot, appId, applications) {
+  if (!appId) return true;
+  if (service.application?.id === appId) return true;
+  if (!service.application) {
+    const rootApplication = applications.find((application) => application.root === tenantRoot);
+    return rootApplication?.id === appId || rootApplication?.relativeRoot === appId;
+  }
+  return false;
+}
 function treeseedDatabaseDescriptors(tenantRoot, options) {
   const descriptors = [];
   const rootConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: options.target, env: process.env }).deployConfig;
+  const applications = discoverTreeseedApplications(tenantRoot);
   const candidates = [
-    { applicationId: "web", applicationRoot: tenantRoot, config: rootConfig },
-    ...discoverTreeseedApplications(tenantRoot).map((application) => ({
+    { applicationId: null, applicationRoot: tenantRoot, config: rootConfig },
+    ...applications.map((application) => ({
       applicationId: application.id,
       applicationRoot: application.root,
       config: application.config
@@ -152,8 +163,9 @@ function treeseedDatabaseDescriptors(tenantRoot, options) {
   return descriptors;
 }
 async function verifyRailwayPostgresTopology(input) {
+  const descriptorRoot = resolve(input.descriptor.applicationRoot);
   const ownerService = input.configuredServices.find(
-    (service) => ["api", "operationsRunner"].includes(service.key) && (!input.descriptor.applicationId || service.application?.id === input.descriptor.applicationId)
+    (service) => ["api", "operationsRunner"].includes(service.key) && (!input.descriptor.applicationId || service.application?.id === input.descriptor.applicationId || service.application?.root === descriptorRoot || !service.application && resolve(service.rootDir) === descriptorRoot)
   );
   if (!ownerService) {
     input.issues.push(`${input.descriptor.serviceName}: no Railway API or operations runner service is configured to own the database.`);
@@ -215,10 +227,11 @@ async function collectRailwayObservations(options) {
   const inspectedVolumeScopes = /* @__PURE__ */ new Set();
   const inspectedRunnerScopes = /* @__PURE__ */ new Set();
   const selectedServiceKeys = selectedServiceKeySet(options);
+  const applications = discoverTreeseedApplications(options.tenantRoot);
   try {
     const workspace = await resolveRailwayWorkspaceContext({ env: options.env, fetchImpl: options.fetchImpl });
     const projects = await listRailwayProjects({ workspaceId: workspace.id, env: options.env, fetchImpl: options.fetchImpl });
-    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
+    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => serviceMatchesAppSelection(entry, options.tenantRoot, options.appId, applications)).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
     if (selectedServiceKeys.size === 0 || selectedServiceKeys.has("api") || selectedServiceKeys.has("operationsRunner")) {
       for (const descriptor of treeseedDatabaseDescriptors(options.tenantRoot, options)) {
         await verifyRailwayPostgresTopology({ descriptor, configuredServices, projects, options, issues });
@@ -422,14 +435,16 @@ async function collectHttpObservations(options) {
   const urls = /* @__PURE__ */ new Set();
   const fallbacks = /* @__PURE__ */ new Map();
   const selectedServiceKeys = selectedServiceKeySet(options);
-  const selectedApplication = options.appId ? discoverTreeseedApplications(options.tenantRoot).find((application) => application.id === options.appId || application.relativeRoot === options.appId) : null;
-  if (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("web")) {
+  const applications = discoverTreeseedApplications(options.tenantRoot);
+  const selectedApplication = options.appId ? applications.find((application) => application.id === options.appId || application.relativeRoot === options.appId) : null;
+  const webHttpSelected = selectedServiceKeys.size === 0 || selectedServiceKeys.has("web");
+  if (webHttpSelected && (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("web"))) {
     const webConfig = selectedWebConfig(deployConfig, selectedApplication);
     const webDomain = webConfig.surfaces?.web?.environments?.[options.target]?.domain ?? webConfig.surfaces?.web?.publicBaseUrl ?? webConfig.siteUrl;
     const webUrl = urlForDomain(webDomain);
     if (webUrl) {
       urls.add(webUrl);
-      if (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("api")) {
+      if (selectedServiceKeys.size === 0 && (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("api"))) {
         urls.add(`${webUrl}/v1/healthz`);
       }
       const pagesProjectName = webConfig.cloudflare?.pages?.projectName;
@@ -440,7 +455,7 @@ async function collectHttpObservations(options) {
       }
     }
   }
-  for (const service of configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
+  for (const service of configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => serviceMatchesAppSelection(entry, options.tenantRoot, options.appId, applications)).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
     const serviceConfig = deployConfig.services?.[service.key];
     const domain = service.publicBaseUrl ?? serviceConfig?.environments?.[options.target]?.baseUrl ?? serviceConfig?.environments?.[options.target]?.domain ?? (service.key === "api" ? deployConfig.surfaces?.api?.environments?.[options.target]?.domain : null);
     const baseUrl = urlForDomain(domain);

package/dist/operations/services/project-platform.js

@@ -196,7 +196,7 @@ function isTransientWranglerOutput(output) {
   return /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|connectivity issue|internal error|aborted/i.test(output);
 }
 async function runPrefixedWranglerWithRetry(tenantRoot, args, {
-  env = {},
+  env: env2 = {},
   write,
   prefix
 }) {
@@ -208,7 +208,7 @@ async function runPrefixedWranglerWithRetry(tenantRoot, args, {
     }
     const result = await runPrefixedCommand(wrangler.command, [...wrangler.argsPrefix, ...args], {
       cwd: tenantRoot,
-      env,
+      env: env2,
       write,
       prefix
     });
@@ -235,7 +235,7 @@ function prepareTenantCloudflareDeploy({
   target: explicitTarget,
   dryRun,
   write,
-  env = process.env
+  env: env2 = process.env
 }) {
   const target = explicitTarget ?? createPersistentDeployTarget(scope === "local" ? "staging" : scope);
   if (scope !== "local") {
@@ -260,7 +260,7 @@ function prepareTenantCloudflareDeploy({
     pagesBranchName,
     env: {
       ...process.env,
-      ...env,
+      ...env2,
       CLOUDFLARE_ACCOUNT_ID: resolveConfiguredCloudflareAccountId(deployConfig),
       ...target.kind === "persistent" && target.scope !== "local" ? { TREESEED_CONTENT_SERVING_MODE: "published_runtime" } : {}
     },
@@ -478,12 +478,12 @@ async function repairHostingAfterSuccessfulDeploy(options, systems) {
     };
   }
   const environment = options.scope === "prod" ? "prod" : "staging";
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   const audit = await runTreeseedHostingAudit({
     tenantRoot: options.tenantRoot,
     environment,
     repair: false,
-    env,
+    env: env2,
     hostKinds: [...hostKinds]
   });
   if (audit.ok) {
@@ -494,7 +494,7 @@ async function repairHostingAfterSuccessfulDeploy(options, systems) {
     tenantRoot: options.tenantRoot,
     environment,
     repair: true,
-    env,
+    env: env2,
     hostKinds: [...hostKinds],
     write: (line) => options.write?.(`[${environment}][hosting][repair] ${line}`)
   });
@@ -955,7 +955,7 @@ async function publishContent(options, reporter, publishOptions = {}) {
         }, manifestFile, uploadOptions);
         if (contentPurgeUrls.size > 0) {
           try {
-            purgePublishedContentCaches(options.tenantRoot, [...contentPurgeUrls].filter(Boolean), { target });
+            purgePublishedContentCaches(options.tenantRoot, [...contentPurgeUrls].filter(Boolean), { target, env });
           } catch {
           }
         }
@@ -1020,12 +1020,12 @@ async function provisionProjectPlatform(options) {
   writeWorkflowStatus("provision:resolve-bootstrap-systems");
   const bootstrapSystems = resolveProjectPlatformBootstrapSystems(options, siteConfig);
   const selectedSystems = new Set(bootstrapSystems);
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   writeWorkflowStatus(`provision:reconcile:start systems=${bootstrapSystems.join(",") || "(none)"}`);
   const summary = await timedPhase(timings, "provision:reconcile", () => reconcileTreeseedTarget({
     tenantRoot: options.tenantRoot,
     target,
-    env,
+    env: env2,
     systems: bootstrapSystems,
     write: options.write,
     dryRun: options.dryRun
@@ -1036,7 +1036,7 @@ async function provisionProjectPlatform(options) {
   const verification = await timedPhase(timings, "provision:collect-reconcile-status", () => collectTreeseedReconcileStatus({
     tenantRoot: options.tenantRoot,
     target,
-    env,
+    env: env2,
     systems: bootstrapSystems
   }));
   writeWorkflowStatus("provision:collect-reconcile-status:done");
@@ -1050,7 +1050,7 @@ async function provisionProjectPlatform(options) {
     writeWorkflowStatus("provision:ensure-wrangler-config:skipped");
   }
   const shouldValidateRailway = selectedSystems.has("api") || selectedSystems.has("agents");
-  const railwayValidation = shouldValidateRailway ? options.scope === "local" ? validateRailwayServiceConfiguration(options.tenantRoot, options.scope) : validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env }) : { services: [] };
+  const railwayValidation = shouldValidateRailway ? options.scope === "local" ? validateRailwayServiceConfiguration(options.tenantRoot, options.scope) : validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env: env2 }) : { services: [] };
   const railwaySchedules = [];
   const railwayScheduleVerification = {
     ok: true,
@@ -1210,7 +1210,7 @@ async function deployProjectPlatform(options) {
   const selectedSystems = new Set(bootstrapSystems);
   const execution = options.bootstrapExecution ?? "parallel";
   const write = options.write;
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   writeWorkflowStatus(`deploy:bootstrap-systems ${bootstrapSystems.join(",") || "(none)"}`);
   writeWorkflowStatus("deploy:report-running");
   await reportDeployment(reporter, {
@@ -1238,7 +1238,7 @@ async function deployProjectPlatform(options) {
         tenantRoot: options.tenantRoot,
         scope: "local",
         dryRun: options.dryRun,
-        env,
+        env: env2,
         write
       })
     });
@@ -1248,7 +1248,7 @@ async function deployProjectPlatform(options) {
       scope: options.scope,
       dryRun: options.dryRun,
       write,
-      env
+      env: env2
     });
   }
   if (cloudflareContext && selectedSystems.has("data")) {
@@ -1283,11 +1283,11 @@ async function deployProjectPlatform(options) {
   const serviceResultsByKey = /* @__PURE__ */ new Map();
   let selectedRailwayServiceKeys = [];
   if (options.scope !== "local" && (selectedSystems.has("api") || selectedSystems.has("agents"))) {
-    const validation = validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env });
+    const validation = validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env: env2 });
     const selectedServices = validation.services.filter(
       (service) => service.key === "api" ? selectedSystems.has("api") : selectedSystems.has("agents")
     );
-    const sequentialRailwayDeploys = String(env.TREESEED_RAILWAY_DEPLOY_SEQUENTIAL ?? "").trim() === "1";
+    const sequentialRailwayDeploys = String(env2.TREESEED_RAILWAY_DEPLOY_SEQUENTIAL ?? "").trim() === "1";
     let previousRailwayDeployNodeId = null;
     for (const service of selectedServices) {
       const system = service.key === "api" ? "api" : "agents";
@@ -1304,7 +1304,7 @@ async function deployProjectPlatform(options) {
           const result = await deployRailwayService(options.tenantRoot, service, {
             dryRun: options.dryRun,
             write,
-            env,
+            env: env2,
             prefix: {
               scope: options.scope,
               system,
@@ -1336,7 +1336,7 @@ async function deployProjectPlatform(options) {
           task: "schedules",
           stage: "deploy"
         }, "Reconciling Railway schedules...");
-        railwaySchedules = await ensureRailwayScheduledJobs(options.tenantRoot, options.scope, { dryRun: options.dryRun, env });
+        railwaySchedules = await ensureRailwayScheduledJobs(options.tenantRoot, options.scope, { dryRun: options.dryRun, env: env2 });
         railwayScheduleVerification = !options.dryRun ? await verifyRailwayScheduledJobs(options.tenantRoot, options.scope) : { ok: true, checks: railwaySchedules, skipped: true, reason: "dry_run" };
         return {
           service: "railway-schedules",
@@ -1358,7 +1358,8 @@ async function deployProjectPlatform(options) {
   if (options.scope !== "local" && !options.dryRun && (selectedSystems.has("web") || serviceResults.length > 0)) {
     finalizeDeploymentState(options.tenantRoot, {
       target: createPersistentDeployTarget(options.scope),
-      serviceResults
+      serviceResults,
+      env: env2
     });
   }
   if (!managesRailwaySchedules || !selectedSystems.has("agents")) {
@@ -1423,7 +1424,7 @@ async function publishProjectContent(options) {
 async function monitorProjectPlatform(options) {
   const timings = [];
   const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  const env = { ...process.env, ...options.env ?? {} };
+  const env2 = { ...process.env, ...options.env ?? {} };
   const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
   const siteConfig = loadCliDeployConfig(options.tenantRoot);
   const selectedSystems = new Set(resolveProjectPlatformBootstrapSystems(options, siteConfig));
@@ -1434,7 +1435,7 @@ async function monitorProjectPlatform(options) {
   const apiBaseUrl = resolveImmediateApiProbeUrl(siteConfig, state, target);
   const apiMonitorEndpoints = resolveApiMonitorEndpoints(siteConfig, apiBaseUrl);
   const railwayResourcesPromise = options.scope === "local" || !apiSelected && !agentsSelected ? { ok: true, skipped: true, reason: options.scope === "local" ? "local_scope" : "railway_not_selected" } : timedPhase(timings, "monitor:railway-resources", () => verifyRailwayManagedResources(options.tenantRoot, options.scope, {
-    env,
+    env: env2,
     settleDeployments: true,
     onProgress: options.write
   }));

package/dist/reconcile/builtin-adapters.js

@@ -3877,7 +3877,8 @@ async function syncRailwayEnvironmentForScope(input, { dryRun = false, serviceKe
         services: rendered.serviceNames,
         volumes: rendered.volumeNames,
         database: rendered.databaseName,
-        scope
+        scope,
+        serviceSourceModes: Object.fromEntries(effectiveIacInput.services.map((service) => [service.serviceName, service.sourceMode ?? null]))
       });
       if (!validation.ok && effectiveIacInput.database && !effectiveIacInput.database.useNativePostgres && railwayIacPlanDeletesResource(plan.changeSet, effectiveIacInput.database.serviceName)) {
         traceRailwayReconcile(topology.env, "sync:iac-native-postgres-adopt", `${project.name}/${environment.name}:${effectiveIacInput.database.serviceName}`);
@@ -3899,7 +3900,8 @@ async function syncRailwayEnvironmentForScope(input, { dryRun = false, serviceKe
           services: rendered.serviceNames,
           volumes: rendered.volumeNames,
           database: rendered.databaseName,
-          scope
+          scope,
+          serviceSourceModes: Object.fromEntries(effectiveIacInput.services.map((service) => [service.serviceName, service.sourceMode ?? null]))
         });
       }
       if (!validation.ok) {

package/dist/reconcile/providers/github-private.js

@@ -2,6 +2,7 @@ import {
   createGitHubApiClient,
   dispatchGitHubWorkflowRun,
   ensureGitHubActionsEnvironment,
+  formatGitHubWorkflowFailure,
   getLatestGitHubWorkflowRun,
   listGitHubEnvironmentSecretNames,
   listGitHubEnvironmentVariableNames,
@@ -106,6 +107,26 @@ async function dispatchReconcileGitHubWorkflow(input) {
     branch: input.branch,
     timeoutSeconds: input.timeoutMs ? Math.ceil(input.timeoutMs / 1e3) : void 0
   }) : null;
+  if (completed && completed.conclusion !== "success") {
+    const failedJob = completed.failedJobs?.[0] ?? completed.jobs?.find((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped") ?? null;
+    const failedStep = failedJob?.steps?.find((step) => step.conclusion && step.conclusion !== "success" && step.conclusion !== "skipped") ?? null;
+    const failure = formatGitHubWorkflowFailure({
+      repository: input.repository,
+      workflow: input.workflow,
+      runId: completed.runId,
+      runUrl: completed.url,
+      conclusion: completed.conclusion,
+      failedJobName: failedJob?.name,
+      lastActiveStep: failedStep?.name,
+      message: `GitHub workflow ${input.workflow} in ${input.repository} completed with conclusion ${completed.conclusion ?? "unknown"}.`,
+      resumeSafe: false
+    });
+    throw new Error([
+      failure.summary,
+      failure.runUrl ? `Run: ${failure.runUrl}` : null,
+      failure.inspectCommand ? `Inspect: ${failure.inspectCommand}` : null
+    ].filter(Boolean).join("\n"));
+  }
   return { dispatch, latest, completed };
 }
 export {

package/dist/reconcile/providers/railway-iac.d.ts

@@ -60,6 +60,7 @@ export declare function validateRailwayIacChangeSet(changeSet: RailwayChangeSet
     volumes: string[];
     database: string | null;
     scope: string;
+    serviceSourceModes?: Record<string, string | null | undefined>;
 }): RailwayIacValidationResult;
 export declare function planRailwayIacProject(input: TreeseedRailwayIacProjectInput, rendered?: TreeseedRailwayIacRenderResult): Promise<RailwayIacPlanResponse>;
 export declare function applyRailwayIacProject(input: TreeseedRailwayIacProjectInput, rendered?: TreeseedRailwayIacRenderResult): Promise<RailwayIacApplyResponse>;

package/dist/reconcile/providers/railway-iac.js

@@ -203,6 +203,28 @@ ${declarations.join("\n")}
 function changeName(change) {
   return String(change?.resource?.name ?? change?.previous?.name ?? change?.address ?? change?.path ?? "");
 }
+function changeFieldText(change) {
+  return [
+    change?.field,
+    change?.path,
+    change?.address,
+    change?.summary
+  ].map((value) => String(value ?? "").toLowerCase()).join(" ");
+}
+function isRailwaySourceChange(change) {
+  const field = String(change?.field ?? "").toLowerCase();
+  const path = String(change?.path ?? "").toLowerCase();
+  const summary = String(change?.summary ?? "").toLowerCase();
+  return field === "source" || /\.source\b/u.test(path) || /source/u.test(summary) && !/\b(env|environment|variable|variables)\b/u.test(summary);
+}
+function isRailwayImageSourceChange(change) {
+  if (!isRailwaySourceChange(change)) return false;
+  return /image|docker-image/u.test(changeFieldText(change));
+}
+function isRailwayGitSourceChange(change) {
+  if (!isRailwaySourceChange(change)) return false;
+  return /github|repo|branch/u.test(changeFieldText(change));
+}
 function validateRailwayIacChangeSet(changeSet, desiredNames) {
   const blockedReasons = [];
   const destructiveChanges = [];
@@ -210,6 +232,7 @@ function validateRailwayIacChangeSet(changeSet, desiredNames) {
   const created = new Set((changeSet?.changes ?? []).filter((change) => change.kind === "resource.create").map((change) => changeName(change)));
   for (const change of changeSet?.changes ?? []) {
     const name = changeName(change);
+    const sourceMode = desiredNames.serviceSourceModes?.[name] ?? desiredNames.serviceSourceModes?.[name.replace(/^(service|database)\./u, "")] ?? null;
     if (change.kind === "resource.delete") {
       destructiveChanges.push(change.summary);
       blockedReasons.push(`Railway IaC plan would delete resource ${name || change.summary}; hosting reconciliation only updates or creates resources. Use the explicit destroy workflow for deletions.`);
@@ -217,10 +240,10 @@ function validateRailwayIacChangeSet(changeSet, desiredNames) {
         blockedReasons.push(`Railway IaC plan would delete desired resource ${name}.`);
       }
     }
-    if (desiredNames.scope === "staging" && change.kind === "resource.update" && /image/iu.test(String(change.summary))) {
+    if (desiredNames.scope === "staging" && change.kind === "resource.update" && isRailwayImageSourceChange(change) && (!sourceMode || sourceMode === "image")) {
       blockedReasons.push(`Railway IaC plan would switch staging resource ${name} to an image source.`);
     }
-    if (desiredNames.scope === "prod" && change.kind === "resource.update" && /github|repo|branch/iu.test(String(change.summary))) {
+    if (desiredNames.scope === "prod" && change.kind === "resource.update" && isRailwayGitSourceChange(change) && (!sourceMode || sourceMode === "git")) {
       blockedReasons.push(`Railway IaC plan would switch production resource ${name} to a Git source.`);
     }
   }

package/dist/workflow/operations.d.ts

@@ -1010,7 +1010,10 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         }[];
         blockers: string[];
     };
-    releaseGates: Record<string, unknown>;
+    releaseGates: {
+        workspaceLinks: import("../operations/services/workspace-dependency-mode.js").WorkspaceDependencyModeReport;
+        gates: Record<string, unknown>;
+    };
     workspaceUnlink: import("../operations/services/workspace-dependency-mode.js").WorkspaceDependencyModeReport;
     releaseMetadata: {
         versions: {
@@ -1100,6 +1103,24 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
     publishedArtifacts: {
         checks: PublishedArtifactCheck[];
     };
+    productionPackageDeployWorkflows: {
+        workflowGates: Record<string, unknown>[] | {
+            name: string;
+            repository: string | null;
+            workflow: string;
+            branch: string;
+            headSha: string;
+            status: string;
+            reason: string;
+            conclusion: null;
+            runId: null;
+            url: null;
+            createdAt: null;
+            updatedAt: null;
+            timeoutSeconds: number | null;
+            cached: boolean;
+        }[];
+    };
     productionHosting: {
         status: "skipped";
         reason: string;
@@ -1167,6 +1188,7 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
             releaseBlockingFailures: number;
         };
     };
+    productionWebVerification: Record<string, unknown> | null;
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -132,6 +132,10 @@ import {
 import { classifyTreeseedGitMode, runTreeseedGit, runTreeseedGitOk, runTreeseedGitText } from "../operations/services/git-runner.js";
 import { collectTreeseedDeploymentReadiness } from "../operations/services/deployment-readiness.js";
 import { collectTreeseedLiveHostedServiceChecks } from "../operations/services/live-hosted-service-checks.js";
+import {
+  configuredRailwayServices,
+  waitForRailwayManagedDeploymentsSettled
+} from "../operations/services/railway-deploy.js";
 import { discoverTreeseedApplications } from "../hosting/apps.js";
 import { compileTreeseedHostingGraph } from "../hosting/graph.js";
 import { resolveTreeseedWorkflowState } from "../workflow-state.js";
@@ -228,7 +232,7 @@ function readPackageScript(root, packageDir, scriptName) {
 }
 function ensureWorkflowWorkspacePackageArtifacts(root, helpers) {
   const packages = [
-    { name: "@treeseed/sdk", dir: "packages/sdk", artifacts: ["dist/workflow-support.js", "dist/plugin-default.js", "dist/platform/env.yaml"] },
+    { name: "@treeseed/sdk", dir: "packages/sdk", artifacts: ["dist/index.js", "dist/workflow-support.js", "dist/plugin-default.js", "dist/platform/env.yaml"] },
     { name: "@treeseed/ui", dir: "packages/ui", artifacts: ["dist/index.js"] },
     { name: "@treeseed/agent", dir: "packages/agent", artifacts: ["dist/api/index.js", "dist/services/manager.js", "dist/provider/runner.js"] },
     { name: "@treeseed/core", dir: "packages/core", artifacts: ["dist/plugin-default.js"] },
@@ -582,6 +586,23 @@ ${status.blockers.join("\n")}`, {
       details: { environment, selector, status, reconcile }
     });
   }
+  const selectedRailwayServiceNames = new Set(graph.units.filter((unit) => unit.host.id === "railway").map((unit) => typeof unit.config.serviceName === "string" ? unit.config.serviceName : null).filter((value) => Boolean(value)));
+  const selectedRailwayServices = configuredRailwayServices(root, environment, env).filter((service) => selectedRailwayServiceNames.has(service.serviceName));
+  if (selectedRailwayServices.length > 0) {
+    const deployments = await waitForRailwayManagedDeploymentsSettled(root, environment, {
+      services: selectedRailwayServices,
+      env,
+      timeoutMs: operation === "release" ? 9e5 : 6e5,
+      onProgress: (line, stream) => helpers.write(`[${operation}][railway] ${line}`, stream)
+    });
+    if (!deployments.ok) {
+      const deploymentFailures = deployments.checks.filter((check) => check.ok !== true && check.skipped !== true).map((check) => `${check.serviceName ?? check.service}: ${check.message ?? check.status ?? "deployment did not settle"}`);
+      workflowError(operation, "hosted_deployment_failed", `Hosted Railway deployments for ${environment} did not settle:
+${deploymentFailures.join("\n")}`, {
+        details: { environment, selector, deployments, reconcile }
+      });
+    }
+  }
   const live = await collectTreeseedLiveHostedServiceChecks({
     tenantRoot: root,
     target: environment,
@@ -617,6 +638,33 @@ ${liveFailures.join("\n")}`, {
     liveVerification: live
   };
 }
+async function runReleaseWebLiveVerification(root, environment, helpers, operation) {
+  const env = {
+    ...helpers.context.env,
+    ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
+  };
+  const live = await collectTreeseedLiveHostedServiceChecks({
+    tenantRoot: root,
+    target: environment,
+    appId: "web",
+    serviceKeys: ["web"],
+    strict: true,
+    requireLiveRailway: false,
+    requireLiveHttp: true,
+    env
+  });
+  const liveFailures = [
+    ...live.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.issues.join("; ") || "failed"}`),
+    ...live.liveObservation.issues
+  ];
+  if (liveFailures.length > 0) {
+    workflowError(operation, "hosted_live_verification_failed", `Production web live verification failed after root deployment:
+${liveFailures.join("\n")}`, {
+      details: { environment, live }
+    });
+  }
+  return live;
+}
 function productionReleaseImageRefEnv(selectedVersions) {
   const refs = {};
   const apiVersion = selectedVersions.get("@treeseed/api");
@@ -1952,6 +2000,48 @@ function releaseWorkflowForPackage(root, packageName) {
   void packageName;
   return "publish.yml";
 }
+function productionDeployWorkflowForPackage(root, packageName) {
+  const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === packageName || entry.name === packageName);
+  const repoPath = adapter?.dir;
+  if (!repoPath || !existsSync(resolve(repoPath, "treeseed.site.yaml"))) {
+    return null;
+  }
+  if (!workflowFileExists(repoPath, "deploy.yml")) {
+    return null;
+  }
+  return "deploy.yml";
+}
+function tagCommitSha(repoDir, tagName) {
+  try {
+    return runGit(["rev-list", "-n", "1", tagName], { cwd: repoDir, capture: true }).trim();
+  } catch {
+    return "";
+  }
+}
+function productionPackageDeployGates(root, versions) {
+  return discoverTreeseedPackageAdapters(root).flatMap((adapter) => {
+    const name = adapter.id;
+    const version = versions.get(name);
+    const path = adapter.dir;
+    const workflow = productionDeployWorkflowForPackage(root, name);
+    if (!name || !version || !path || !workflow) {
+      return [];
+    }
+    const headSha = tagCommitSha(path, version);
+    if (!headSha) {
+      workflowError("release", "github_workflow_failed", `${name} ${workflow} cannot be checked because release tag ${version} is missing locally.`, {
+        details: { packageName: name, workflow, version, repoPath: path }
+      });
+    }
+    return [hostedDeployGate({
+      name,
+      repoPath: path,
+      workflow,
+      branch: version,
+      headSha
+    })];
+  });
+}
 function prepareAdapterReleaseMetadata(root, pkg, version) {
   const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === pkg.name || entry.name === pkg.name);
   if (adapter?.kind === "beam-elixir-rust" && existsSync(resolve(pkg.dir, "scripts", "bump-release-version.ts"))) {
@@ -5296,7 +5386,7 @@ async function runReleaseGateReconcileFacade(operation, helpers, root, target, i
     provider: ["treeseed"]
   };
   const desiredGraph = compileTreeseedDesiredResourceGraph({ tenantRoot: root, target });
-  const rawUnits = compileTreeseedDesiredUnitsFromGraph(desiredGraph).filter((unit) => unit.provider === "treeseed" && (unit.unitType === "package-manifest" || unit.unitType.startsWith("release-gate:")) && (includeHostedReleaseGates || unit.unitType !== "release-gate:hosted-reconcile" && unit.unitType !== "release-gate:live-verify") || unit.provider === "github" && (unit.unitType === "github-environment" || unit.unitType === "github-secret-binding" || unit.unitType === "github-variable-binding"));
+  const rawUnits = compileTreeseedDesiredUnitsFromGraph(desiredGraph).filter((unit) => unit.provider === "treeseed" && (unit.unitType === "package-manifest" || unit.unitType.startsWith("release-gate:")) && unit.unitType !== "release-gate:npm-publish" && unit.unitType !== "release-gate:image-publish" && (includeHostedReleaseGates || unit.unitType !== "release-gate:hosted-reconcile" && unit.unitType !== "release-gate:live-verify") || unit.provider === "github" && (unit.unitType === "github-environment" || unit.unitType === "github-secret-binding" || unit.unitType === "github-variable-binding"));
   const rawUnitIds = new Set(rawUnits.map((unit) => unit.unitId));
   const units = rawUnits.map((unit) => ({
     ...unit,
@@ -5501,6 +5591,7 @@ ${blockers.join("\n")}`, {
             };
           }),
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-hosting", description: "Reconcile and live-verify production hosted resources before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-api-guarantees", description: "Run production API release guarantees before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
@@ -5524,21 +5615,25 @@ ${blockers.join("\n")}`, {
           ...releaseBasePayload,
           freshArchivedRuns: freshPreparation.archived
         }));
-        const releaseGates = await executeJournalStep(root, workflowRun.runId, "release-gates", async () => runReleaseGateReconcileFacade(
-          "release",
-          helpers,
-          root,
-          { kind: "persistent", scope: "prod" },
-          {
-            execute: true,
-            verifyDeployedResources: effectiveInput.verifyDeployedResources,
-            releaseImageRefs: productionReleaseImageRefEnv(selectedVersions)
-          },
-          {
-            ...releaseBasePayload,
-            freshArchivedRuns: freshPreparation.archived
-          }
-        ));
+        const releaseGates = await executeJournalStep(root, workflowRun.runId, "release-gates", async () => {
+          const workspaceLinks2 = ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+          const gates = await runReleaseGateReconcileFacade(
+            "release",
+            helpers,
+            root,
+            { kind: "persistent", scope: "prod" },
+            {
+              execute: true,
+              verifyDeployedResources: effectiveInput.verifyDeployedResources,
+              releaseImageRefs: productionReleaseImageRefEnv(selectedVersions)
+            },
+            {
+              ...releaseBasePayload,
+              freshArchivedRuns: freshPreparation.archived
+            }
+          );
+          return { workspaceLinks: workspaceLinks2, gates };
+        });
         const workspaceUnlink = await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
         const releaseMetadata = await executeJournalStep(root, workflowRun.runId, "prepare-release-metadata", () => {
           applyStableWorkspaceVersionChanges(root, allVersions);
@@ -5612,6 +5707,17 @@ ${rendered}`);
           packageReleases.push(packageRelease);
         }
         const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
+        const productionPackageDeployWorkflows = await executeJournalStep(root, workflowRun.runId, "production-package-deploy-workflows", () => {
+          const deployGates = productionPackageDeployGates(root, allVersions);
+          if (deployGates.length === 0) {
+            return { workflowGates: [], status: "skipped", reason: "no selected production package deploy workflows" };
+          }
+          return waitForWorkflowGates("release", deployGates, ciMode, {
+            root,
+            runId: workflowRun.runId,
+            onProgress: (line, stream) => helpers.write(line, stream)
+          }).then((workflowGates) => ({ workflowGates }));
+        });
         const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions), { liveAppId: "api" }));
         const productionApiGuarantees = await executeJournalStep(root, workflowRun.runId, "production-api-guarantees", () => runReleaseApiGuarantees(root, "prod", helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
@@ -5664,6 +5770,7 @@ ${rendered}`);
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
+        const productionWebVerification = await executeJournalStep(root, workflowRun.runId, "production-web-live-verification", () => runReleaseWebLiveVerification(root, "prod", helpers, "release"));
         const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
           const packageBackMerges = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
             subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
@@ -5690,8 +5797,10 @@ ${rendered}`);
           rootRelease,
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
+          productionPackageDeployWorkflows,
           productionHosting,
           productionApiGuarantees,
+          productionWebVerification,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.20",
+  "version": "0.12.22",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {