@treeseed/sdk 0.12.21 → 0.12.23

package/dist/api/auth/d1-provider.d.ts

@@ -54,6 +54,7 @@ export declare class D1AuthProvider implements ApiAuthProvider {
     }>;
     createUser(input: {
         email?: string | null;
+        username?: string | null;
         displayName?: string | null;
         metadata?: Record<string, unknown>;
     }): Promise<{

package/dist/api/auth/d1-store.d.ts

@@ -31,6 +31,8 @@ export declare class D1AuthStore {
     private loadUser;
     private loadIdentityByProvider;
     private loadUserByVerifiedEmail;
+    private loadUserByUsername;
+    private canAdoptUsernameMatch;
     private rolesForUser;
     private permissionsForUser;
     private permissionsForRoles;

package/dist/api/auth/d1-store.js

@@ -250,6 +250,20 @@ class D1AuthStore {
       [email]
     );
   }
+  async loadUserByUsername(username) {
+    return this.first(
+      `SELECT * FROM users WHERE LOWER(username) = LOWER(?) AND status = 'active' LIMIT 1`,
+      [username]
+    );
+  }
+  canAdoptUsernameMatch(identity, user) {
+    if (!user?.id || !identity.username) return false;
+    const profile = identity.profile && typeof identity.profile === "object" ? identity.profile : {};
+    if (identity.provider === "acceptance" || profile.acceptance === true) return true;
+    const existingEmail = typeof user.email === "string" ? user.email.trim().toLowerCase() : "";
+    const requestedEmail = typeof identity.email === "string" ? identity.email.trim().toLowerCase() : "";
+    return Boolean(requestedEmail && existingEmail && requestedEmail === existingEmail && identity.emailVerified);
+  }
   async rolesForUser(userId) {
     const rows = await this.all(
       `SELECT roles.key AS key
@@ -381,7 +395,9 @@ class D1AuthStore {
     const existingIdentity = await this.loadIdentityByProvider(identity.provider, identity.providerSubject);
     let userId = existingIdentity?.user_id;
     if (!userId) {
-      const linkedUser = identity.email && identity.emailVerified ? await this.loadUserByVerifiedEmail(identity.email) : null;
+      const emailLinkedUser = identity.email && identity.emailVerified ? await this.loadUserByVerifiedEmail(identity.email) : null;
+      const usernameLinkedUser = !emailLinkedUser && identity.username ? await this.loadUserByUsername(identity.username) : null;
+      const linkedUser = emailLinkedUser ?? (this.canAdoptUsernameMatch(identity, usernameLinkedUser) ? usernameLinkedUser : null);
       userId = linkedUser?.id ?? randomUUID();
       if (linkedUser) {
         await this.run(

package/dist/operations/services/github-api.js

@@ -778,7 +778,27 @@ async function waitForGitHubWorkflowRunCompletion(repository, {
       });
       monitorErrorStartedAt = null;
       lastMonitorError = null;
-      const match = listed.data.workflow_runs.map((run) => normalizeWorkflowRun(run)).find((run) => (!headSha || run.headSha === headSha) && (!branch || run.headBranch === branch));
+      const matchingRuns = listed.data.workflow_runs.map((run) => normalizeWorkflowRun(run)).filter((run) => (!headSha || run.headSha === headSha) && (!branch || run.headBranch === branch));
+      const failedMatch = matchingRuns.find((run) => run.status === "completed" && run.conclusion !== "success");
+      if (failedMatch?.id) {
+        const failedJobs = await listWorkflowJobsForProgress(client, owner, name, failedMatch.id);
+        emitProgress("completed", failedMatch, failedJobs);
+        return {
+          status: "completed",
+          repository: `${owner}/${name}`,
+          workflow,
+          runId: failedMatch.id,
+          headSha: failedMatch.headSha,
+          branch: failedMatch.headBranch,
+          createdAt: failedMatch.createdAt,
+          updatedAt: failedMatch.updatedAt,
+          conclusion: failedMatch.conclusion,
+          url: failedMatch.url,
+          jobs: failedJobs,
+          failedJobs: failedJobs.filter((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped")
+        };
+      }
+      const match = matchingRuns[0];
       if (!match?.id) {
         emitProgress("waiting");
         if (dispatchIfMissing && branch && !dispatchedMissingRun && Date.now() - startedAt >= dispatchAfterSeconds * 1e3) {

package/dist/operations/services/live-hosted-service-checks.js

@@ -1,3 +1,4 @@
+import { resolve } from "node:path";
 import { loadTreeseedPlatformConfig } from "../../platform/config.js";
 import { resolveTreeseedLaunchEnvironment } from "./config-runtime.js";
 import {
@@ -21,7 +22,7 @@ const DEFAULT_RETRY_INTERVAL_MS = 1500;
 const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_ATTEMPTS = 60;
 const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_INTERVAL_MS = 5e3;
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function liveCheckErrorMessage(error, fallback) {
   const message = error instanceof Error ? error.message : String(error ?? "");
@@ -125,12 +126,22 @@ function selectedServiceKeySet(options) {
 function serviceIsSelected(selected, serviceKey) {
   return selected.size === 0 || selected.has(serviceKey);
 }
+function serviceMatchesAppSelection(service, tenantRoot, appId, applications) {
+  if (!appId) return true;
+  if (service.application?.id === appId) return true;
+  if (!service.application) {
+    const rootApplication = applications.find((application) => application.root === tenantRoot);
+    return rootApplication?.id === appId || rootApplication?.relativeRoot === appId;
+  }
+  return false;
+}
 function treeseedDatabaseDescriptors(tenantRoot, options) {
   const descriptors = [];
   const rootConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: options.target, env: process.env }).deployConfig;
+  const applications = discoverTreeseedApplications(tenantRoot);
   const candidates = [
-    { applicationId: "web", applicationRoot: tenantRoot, config: rootConfig },
-    ...discoverTreeseedApplications(tenantRoot).map((application) => ({
+    { applicationId: null, applicationRoot: tenantRoot, config: rootConfig },
+    ...applications.map((application) => ({
       applicationId: application.id,
       applicationRoot: application.root,
       config: application.config
@@ -152,8 +163,9 @@ function treeseedDatabaseDescriptors(tenantRoot, options) {
   return descriptors;
 }
 async function verifyRailwayPostgresTopology(input) {
+  const descriptorRoot = resolve(input.descriptor.applicationRoot);
   const ownerService = input.configuredServices.find(
-    (service) => ["api", "operationsRunner"].includes(service.key) && (!input.descriptor.applicationId || service.application?.id === input.descriptor.applicationId)
+    (service) => ["api", "operationsRunner"].includes(service.key) && (!input.descriptor.applicationId || service.application?.id === input.descriptor.applicationId || service.application?.root === descriptorRoot || !service.application && resolve(service.rootDir) === descriptorRoot)
   );
   if (!ownerService) {
     input.issues.push(`${input.descriptor.serviceName}: no Railway API or operations runner service is configured to own the database.`);
@@ -215,10 +227,11 @@ async function collectRailwayObservations(options) {
   const inspectedVolumeScopes = /* @__PURE__ */ new Set();
   const inspectedRunnerScopes = /* @__PURE__ */ new Set();
   const selectedServiceKeys = selectedServiceKeySet(options);
+  const applications = discoverTreeseedApplications(options.tenantRoot);
   try {
     const workspace = await resolveRailwayWorkspaceContext({ env: options.env, fetchImpl: options.fetchImpl });
     const projects = await listRailwayProjects({ workspaceId: workspace.id, env: options.env, fetchImpl: options.fetchImpl });
-    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
+    const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => serviceMatchesAppSelection(entry, options.tenantRoot, options.appId, applications)).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
     if (selectedServiceKeys.size === 0 || selectedServiceKeys.has("api") || selectedServiceKeys.has("operationsRunner")) {
       for (const descriptor of treeseedDatabaseDescriptors(options.tenantRoot, options)) {
         await verifyRailwayPostgresTopology({ descriptor, configuredServices, projects, options, issues });
@@ -422,7 +435,8 @@ async function collectHttpObservations(options) {
   const urls = /* @__PURE__ */ new Set();
   const fallbacks = /* @__PURE__ */ new Map();
   const selectedServiceKeys = selectedServiceKeySet(options);
-  const selectedApplication = options.appId ? discoverTreeseedApplications(options.tenantRoot).find((application) => application.id === options.appId || application.relativeRoot === options.appId) : null;
+  const applications = discoverTreeseedApplications(options.tenantRoot);
+  const selectedApplication = options.appId ? applications.find((application) => application.id === options.appId || application.relativeRoot === options.appId) : null;
   const webHttpSelected = selectedServiceKeys.size === 0 || selectedServiceKeys.has("web");
   if (webHttpSelected && (!options.appId || options.appId === "web" || selectedApplication?.roles.includes("web"))) {
     const webConfig = selectedWebConfig(deployConfig, selectedApplication);
@@ -441,7 +455,7 @@ async function collectHttpObservations(options) {
       }
     }
   }
-  for (const service of configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => !options.appId || entry.application?.id === options.appId).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
+  for (const service of configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => serviceMatchesAppSelection(entry, options.tenantRoot, options.appId, applications)).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key))) {
     const serviceConfig = deployConfig.services?.[service.key];
     const domain = service.publicBaseUrl ?? serviceConfig?.environments?.[options.target]?.baseUrl ?? serviceConfig?.environments?.[options.target]?.domain ?? (service.key === "api" ? deployConfig.surfaces?.api?.environments?.[options.target]?.domain : null);
     const baseUrl = urlForDomain(domain);

package/dist/operations/services/project-platform.js

@@ -192,8 +192,13 @@ function runWrangler(tenantRoot, args, extraEnv = {}, options = {}) {
   }
   return result;
 }
+const WRANGLER_TRANSIENT_MAX_ATTEMPTS = 6;
+const WRANGLER_COMMAND_TIMEOUT_MS = 18e4;
+function wranglerTransientRetryDelayMs(attempt) {
+  return Math.min(5e3 * 2 ** (attempt - 1), 6e4);
+}
 function isTransientWranglerOutput(output) {
-  return /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|connectivity issue|internal error|aborted/i.test(output);
+  return /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|connectivity issue|internal error|code:\s*7500|aborted/i.test(output);
 }
 async function runPrefixedWranglerWithRetry(tenantRoot, args, {
   env: env2 = {},
@@ -201,7 +206,7 @@ async function runPrefixedWranglerWithRetry(tenantRoot, args, {
   prefix
 }) {
   let lastOutput = "";
-  for (let attempt = 1; attempt <= 3; attempt += 1) {
+  for (let attempt = 1; attempt <= WRANGLER_TRANSIENT_MAX_ATTEMPTS; attempt += 1) {
     const wrangler = resolveTreeseedToolCommand("wrangler");
     if (!wrangler) {
       throw new Error("Wrangler CLI is unavailable.");
@@ -210,22 +215,24 @@ async function runPrefixedWranglerWithRetry(tenantRoot, args, {
       cwd: tenantRoot,
       env: env2,
       write,
-      prefix
+      prefix,
+      timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS
     });
     if (result.status === 0) {
       return result;
     }
     lastOutput = [result.stderr?.trim(), result.stdout?.trim()].filter(Boolean).join("\n");
-    if (attempt === 3 || !isTransientWranglerOutput(lastOutput)) {
+    if (attempt === WRANGLER_TRANSIENT_MAX_ATTEMPTS || !isTransientWranglerOutput(lastOutput)) {
       throw new Error(lastOutput || `wrangler ${args.join(" ")} failed`);
     }
+    const retryDelayMs = wranglerTransientRetryDelayMs(attempt);
     writeTreeseedBootstrapLine(
       write,
       { ...prefix, stage: "retry" },
-      `Wrangler command hit a transient failure; retrying in ${2 * attempt}s...`,
+      `Wrangler command hit a transient failure; retrying in ${Math.round(retryDelayMs / 1e3)}s...`,
       "stderr"
     );
-    await sleep(2e3 * attempt);
+    await sleep(retryDelayMs);
   }
   throw new Error(lastOutput || `wrangler ${args.join(" ")} failed`);
 }

package/dist/reconcile/builtin-adapters.js

@@ -3877,7 +3877,8 @@ async function syncRailwayEnvironmentForScope(input, { dryRun = false, serviceKe
         services: rendered.serviceNames,
         volumes: rendered.volumeNames,
         database: rendered.databaseName,
-        scope
+        scope,
+        serviceSourceModes: Object.fromEntries(effectiveIacInput.services.map((service) => [service.serviceName, service.sourceMode ?? null]))
       });
       if (!validation.ok && effectiveIacInput.database && !effectiveIacInput.database.useNativePostgres && railwayIacPlanDeletesResource(plan.changeSet, effectiveIacInput.database.serviceName)) {
         traceRailwayReconcile(topology.env, "sync:iac-native-postgres-adopt", `${project.name}/${environment.name}:${effectiveIacInput.database.serviceName}`);
@@ -3899,7 +3900,8 @@ async function syncRailwayEnvironmentForScope(input, { dryRun = false, serviceKe
           services: rendered.serviceNames,
           volumes: rendered.volumeNames,
           database: rendered.databaseName,
-          scope
+          scope,
+          serviceSourceModes: Object.fromEntries(effectiveIacInput.services.map((service) => [service.serviceName, service.sourceMode ?? null]))
         });
       }
       if (!validation.ok) {

package/dist/reconcile/providers/github-private.js

@@ -2,6 +2,7 @@ import {
   createGitHubApiClient,
   dispatchGitHubWorkflowRun,
   ensureGitHubActionsEnvironment,
+  formatGitHubWorkflowFailure,
   getLatestGitHubWorkflowRun,
   listGitHubEnvironmentSecretNames,
   listGitHubEnvironmentVariableNames,
@@ -106,6 +107,26 @@ async function dispatchReconcileGitHubWorkflow(input) {
     branch: input.branch,
     timeoutSeconds: input.timeoutMs ? Math.ceil(input.timeoutMs / 1e3) : void 0
   }) : null;
+  if (completed && completed.conclusion !== "success") {
+    const failedJob = completed.failedJobs?.[0] ?? completed.jobs?.find((job) => job.conclusion && job.conclusion !== "success" && job.conclusion !== "skipped") ?? null;
+    const failedStep = failedJob?.steps?.find((step) => step.conclusion && step.conclusion !== "success" && step.conclusion !== "skipped") ?? null;
+    const failure = formatGitHubWorkflowFailure({
+      repository: input.repository,
+      workflow: input.workflow,
+      runId: completed.runId,
+      runUrl: completed.url,
+      conclusion: completed.conclusion,
+      failedJobName: failedJob?.name,
+      lastActiveStep: failedStep?.name,
+      message: `GitHub workflow ${input.workflow} in ${input.repository} completed with conclusion ${completed.conclusion ?? "unknown"}.`,
+      resumeSafe: false
+    });
+    throw new Error([
+      failure.summary,
+      failure.runUrl ? `Run: ${failure.runUrl}` : null,
+      failure.inspectCommand ? `Inspect: ${failure.inspectCommand}` : null
+    ].filter(Boolean).join("\n"));
+  }
   return { dispatch, latest, completed };
 }
 export {

package/dist/reconcile/providers/railway-iac.d.ts

@@ -60,6 +60,7 @@ export declare function validateRailwayIacChangeSet(changeSet: RailwayChangeSet
     volumes: string[];
     database: string | null;
     scope: string;
+    serviceSourceModes?: Record<string, string | null | undefined>;
 }): RailwayIacValidationResult;
 export declare function planRailwayIacProject(input: TreeseedRailwayIacProjectInput, rendered?: TreeseedRailwayIacRenderResult): Promise<RailwayIacPlanResponse>;
 export declare function applyRailwayIacProject(input: TreeseedRailwayIacProjectInput, rendered?: TreeseedRailwayIacRenderResult): Promise<RailwayIacApplyResponse>;

package/dist/reconcile/providers/railway-iac.js

@@ -203,6 +203,28 @@ ${declarations.join("\n")}
 function changeName(change) {
   return String(change?.resource?.name ?? change?.previous?.name ?? change?.address ?? change?.path ?? "");
 }
+function changeFieldText(change) {
+  return [
+    change?.field,
+    change?.path,
+    change?.address,
+    change?.summary
+  ].map((value) => String(value ?? "").toLowerCase()).join(" ");
+}
+function isRailwaySourceChange(change) {
+  const field = String(change?.field ?? "").toLowerCase();
+  const path = String(change?.path ?? "").toLowerCase();
+  const summary = String(change?.summary ?? "").toLowerCase();
+  return field === "source" || /\.source\b/u.test(path) || /source/u.test(summary) && !/\b(env|environment|variable|variables)\b/u.test(summary);
+}
+function isRailwayImageSourceChange(change) {
+  if (!isRailwaySourceChange(change)) return false;
+  return /image|docker-image/u.test(changeFieldText(change));
+}
+function isRailwayGitSourceChange(change) {
+  if (!isRailwaySourceChange(change)) return false;
+  return /github|repo|branch/u.test(changeFieldText(change));
+}
 function validateRailwayIacChangeSet(changeSet, desiredNames) {
   const blockedReasons = [];
   const destructiveChanges = [];
@@ -210,6 +232,7 @@ function validateRailwayIacChangeSet(changeSet, desiredNames) {
   const created = new Set((changeSet?.changes ?? []).filter((change) => change.kind === "resource.create").map((change) => changeName(change)));
   for (const change of changeSet?.changes ?? []) {
     const name = changeName(change);
+    const sourceMode = desiredNames.serviceSourceModes?.[name] ?? desiredNames.serviceSourceModes?.[name.replace(/^(service|database)\./u, "")] ?? null;
     if (change.kind === "resource.delete") {
       destructiveChanges.push(change.summary);
       blockedReasons.push(`Railway IaC plan would delete resource ${name || change.summary}; hosting reconciliation only updates or creates resources. Use the explicit destroy workflow for deletions.`);
@@ -217,10 +240,10 @@ function validateRailwayIacChangeSet(changeSet, desiredNames) {
         blockedReasons.push(`Railway IaC plan would delete desired resource ${name}.`);
       }
     }
-    if (desiredNames.scope === "staging" && change.kind === "resource.update" && /image/iu.test(String(change.summary))) {
+    if (desiredNames.scope === "staging" && change.kind === "resource.update" && isRailwayImageSourceChange(change) && (!sourceMode || sourceMode === "image")) {
       blockedReasons.push(`Railway IaC plan would switch staging resource ${name} to an image source.`);
     }
-    if (desiredNames.scope === "prod" && change.kind === "resource.update" && /github|repo|branch/iu.test(String(change.summary))) {
+    if (desiredNames.scope === "prod" && change.kind === "resource.update" && isRailwayGitSourceChange(change) && (!sourceMode || sourceMode === "git")) {
       blockedReasons.push(`Railway IaC plan would switch production resource ${name} to a Git source.`);
     }
   }

package/dist/workflow/operations.d.ts

@@ -1010,7 +1010,10 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         }[];
         blockers: string[];
     };
-    releaseGates: Record<string, unknown>;
+    releaseGates: {
+        workspaceLinks: import("../operations/services/workspace-dependency-mode.js").WorkspaceDependencyModeReport;
+        gates: Record<string, unknown>;
+    };
     workspaceUnlink: import("../operations/services/workspace-dependency-mode.js").WorkspaceDependencyModeReport;
     releaseMetadata: {
         versions: {
@@ -1100,6 +1103,24 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
     publishedArtifacts: {
         checks: PublishedArtifactCheck[];
     };
+    productionPackageDeployWorkflows: {
+        workflowGates: Record<string, unknown>[] | {
+            name: string;
+            repository: string | null;
+            workflow: string;
+            branch: string;
+            headSha: string;
+            status: string;
+            reason: string;
+            conclusion: null;
+            runId: null;
+            url: null;
+            createdAt: null;
+            updatedAt: null;
+            timeoutSeconds: number | null;
+            cached: boolean;
+        }[];
+    };
     productionHosting: {
         status: "skipped";
         reason: string;

package/dist/workflow/operations.js

@@ -132,6 +132,10 @@ import {
 import { classifyTreeseedGitMode, runTreeseedGit, runTreeseedGitOk, runTreeseedGitText } from "../operations/services/git-runner.js";
 import { collectTreeseedDeploymentReadiness } from "../operations/services/deployment-readiness.js";
 import { collectTreeseedLiveHostedServiceChecks } from "../operations/services/live-hosted-service-checks.js";
+import {
+  configuredRailwayServices,
+  waitForRailwayManagedDeploymentsSettled
+} from "../operations/services/railway-deploy.js";
 import { discoverTreeseedApplications } from "../hosting/apps.js";
 import { compileTreeseedHostingGraph } from "../hosting/graph.js";
 import { resolveTreeseedWorkflowState } from "../workflow-state.js";
@@ -228,7 +232,7 @@ function readPackageScript(root, packageDir, scriptName) {
 }
 function ensureWorkflowWorkspacePackageArtifacts(root, helpers) {
   const packages = [
-    { name: "@treeseed/sdk", dir: "packages/sdk", artifacts: ["dist/workflow-support.js", "dist/plugin-default.js", "dist/platform/env.yaml"] },
+    { name: "@treeseed/sdk", dir: "packages/sdk", artifacts: ["dist/index.js", "dist/workflow-support.js", "dist/plugin-default.js", "dist/platform/env.yaml"] },
     { name: "@treeseed/ui", dir: "packages/ui", artifacts: ["dist/index.js"] },
     { name: "@treeseed/agent", dir: "packages/agent", artifacts: ["dist/api/index.js", "dist/services/manager.js", "dist/provider/runner.js"] },
     { name: "@treeseed/core", dir: "packages/core", artifacts: ["dist/plugin-default.js"] },
@@ -582,6 +586,23 @@ ${status.blockers.join("\n")}`, {
       details: { environment, selector, status, reconcile }
     });
   }
+  const selectedRailwayServiceNames = new Set(graph.units.filter((unit) => unit.host.id === "railway").map((unit) => typeof unit.config.serviceName === "string" ? unit.config.serviceName : null).filter((value) => Boolean(value)));
+  const selectedRailwayServices = configuredRailwayServices(root, environment, env).filter((service) => selectedRailwayServiceNames.has(service.serviceName));
+  if (selectedRailwayServices.length > 0) {
+    const deployments = await waitForRailwayManagedDeploymentsSettled(root, environment, {
+      services: selectedRailwayServices,
+      env,
+      timeoutMs: operation === "release" ? 9e5 : 6e5,
+      onProgress: (line, stream) => helpers.write(`[${operation}][railway] ${line}`, stream)
+    });
+    if (!deployments.ok) {
+      const deploymentFailures = deployments.checks.filter((check) => check.ok !== true && check.skipped !== true).map((check) => `${check.serviceName ?? check.service}: ${check.message ?? check.status ?? "deployment did not settle"}`);
+      workflowError(operation, "hosted_deployment_failed", `Hosted Railway deployments for ${environment} did not settle:
+${deploymentFailures.join("\n")}`, {
+        details: { environment, selector, deployments, reconcile }
+      });
+    }
+  }
   const live = await collectTreeseedLiveHostedServiceChecks({
     tenantRoot: root,
     target: environment,
@@ -1979,6 +2000,48 @@ function releaseWorkflowForPackage(root, packageName) {
   void packageName;
   return "publish.yml";
 }
+function productionDeployWorkflowForPackage(root, packageName) {
+  const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === packageName || entry.name === packageName);
+  const repoPath = adapter?.dir;
+  if (!repoPath || !existsSync(resolve(repoPath, "treeseed.site.yaml"))) {
+    return null;
+  }
+  if (!workflowFileExists(repoPath, "deploy.yml")) {
+    return null;
+  }
+  return "deploy.yml";
+}
+function tagCommitSha(repoDir, tagName) {
+  try {
+    return runGit(["rev-list", "-n", "1", tagName], { cwd: repoDir, capture: true }).trim();
+  } catch {
+    return "";
+  }
+}
+function productionPackageDeployGates(root, versions) {
+  return discoverTreeseedPackageAdapters(root).flatMap((adapter) => {
+    const name = adapter.id;
+    const version = versions.get(name);
+    const path = adapter.dir;
+    const workflow = productionDeployWorkflowForPackage(root, name);
+    if (!name || !version || !path || !workflow) {
+      return [];
+    }
+    const headSha = tagCommitSha(path, version);
+    if (!headSha) {
+      workflowError("release", "github_workflow_failed", `${name} ${workflow} cannot be checked because release tag ${version} is missing locally.`, {
+        details: { packageName: name, workflow, version, repoPath: path }
+      });
+    }
+    return [hostedDeployGate({
+      name,
+      repoPath: path,
+      workflow,
+      branch: version,
+      headSha
+    })];
+  });
+}
 function prepareAdapterReleaseMetadata(root, pkg, version) {
   const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === pkg.name || entry.name === pkg.name);
   if (adapter?.kind === "beam-elixir-rust" && existsSync(resolve(pkg.dir, "scripts", "bump-release-version.ts"))) {
@@ -5323,7 +5386,7 @@ async function runReleaseGateReconcileFacade(operation, helpers, root, target, i
     provider: ["treeseed"]
   };
   const desiredGraph = compileTreeseedDesiredResourceGraph({ tenantRoot: root, target });
-  const rawUnits = compileTreeseedDesiredUnitsFromGraph(desiredGraph).filter((unit) => unit.provider === "treeseed" && (unit.unitType === "package-manifest" || unit.unitType.startsWith("release-gate:")) && (includeHostedReleaseGates || unit.unitType !== "release-gate:hosted-reconcile" && unit.unitType !== "release-gate:live-verify") || unit.provider === "github" && (unit.unitType === "github-environment" || unit.unitType === "github-secret-binding" || unit.unitType === "github-variable-binding"));
+  const rawUnits = compileTreeseedDesiredUnitsFromGraph(desiredGraph).filter((unit) => unit.provider === "treeseed" && (unit.unitType === "package-manifest" || unit.unitType.startsWith("release-gate:")) && unit.unitType !== "release-gate:npm-publish" && unit.unitType !== "release-gate:image-publish" && (includeHostedReleaseGates || unit.unitType !== "release-gate:hosted-reconcile" && unit.unitType !== "release-gate:live-verify") || unit.provider === "github" && (unit.unitType === "github-environment" || unit.unitType === "github-secret-binding" || unit.unitType === "github-variable-binding"));
   const rawUnitIds = new Set(rawUnits.map((unit) => unit.unitId));
   const units = rawUnits.map((unit) => ({
     ...unit,
@@ -5528,6 +5591,7 @@ ${blockers.join("\n")}`, {
             };
           }),
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-hosting", description: "Reconcile and live-verify production hosted resources before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-api-guarantees", description: "Run production API release guarantees before root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
@@ -5551,21 +5615,25 @@ ${blockers.join("\n")}`, {
           ...releaseBasePayload,
           freshArchivedRuns: freshPreparation.archived
         }));
-        const releaseGates = await executeJournalStep(root, workflowRun.runId, "release-gates", async () => runReleaseGateReconcileFacade(
-          "release",
-          helpers,
-          root,
-          { kind: "persistent", scope: "prod" },
-          {
-            execute: true,
-            verifyDeployedResources: effectiveInput.verifyDeployedResources,
-            releaseImageRefs: productionReleaseImageRefEnv(selectedVersions)
-          },
-          {
-            ...releaseBasePayload,
-            freshArchivedRuns: freshPreparation.archived
-          }
-        ));
+        const releaseGates = await executeJournalStep(root, workflowRun.runId, "release-gates", async () => {
+          const workspaceLinks2 = ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
+          const gates = await runReleaseGateReconcileFacade(
+            "release",
+            helpers,
+            root,
+            { kind: "persistent", scope: "prod" },
+            {
+              execute: true,
+              verifyDeployedResources: effectiveInput.verifyDeployedResources,
+              releaseImageRefs: productionReleaseImageRefEnv(selectedVersions)
+            },
+            {
+              ...releaseBasePayload,
+              freshArchivedRuns: freshPreparation.archived
+            }
+          );
+          return { workspaceLinks: workspaceLinks2, gates };
+        });
         const workspaceUnlink = await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
         const releaseMetadata = await executeJournalStep(root, workflowRun.runId, "prepare-release-metadata", () => {
           applyStableWorkspaceVersionChanges(root, allVersions);
@@ -5639,6 +5707,17 @@ ${rendered}`);
           packageReleases.push(packageRelease);
         }
         const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
+        const productionPackageDeployWorkflows = await executeJournalStep(root, workflowRun.runId, "production-package-deploy-workflows", () => {
+          const deployGates = productionPackageDeployGates(root, allVersions);
+          if (deployGates.length === 0) {
+            return { workflowGates: [], status: "skipped", reason: "no selected production package deploy workflows" };
+          }
+          return waitForWorkflowGates("release", deployGates, ciMode, {
+            root,
+            runId: workflowRun.runId,
+            onProgress: (line, stream) => helpers.write(line, stream)
+          }).then((workflowGates) => ({ workflowGates }));
+        });
         const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release", productionReleaseImageRefEnv(selectedVersions), { liveAppId: "api" }));
         const productionApiGuarantees = await executeJournalStep(root, workflowRun.runId, "production-api-guarantees", () => runReleaseApiGuarantees(root, "prod", helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
@@ -5718,6 +5797,7 @@ ${rendered}`);
           rootRelease,
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
+          productionPackageDeployWorkflows,
           productionHosting,
           productionApiGuarantees,
           productionWebVerification,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.21",
+  "version": "0.12.23",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {

package/templates/github/deploy-web.workflow.yml

@@ -154,6 +154,7 @@ __WORKING_DIRECTORY_BLOCK__  web:
           done
 
       - name: Run web workflow action
+        timeout-minutes: 30
         shell: bash
         run: |
           set -euo pipefail