@treeseed/sdk 0.12.38 → 0.12.40

package/dist/operations/services/deploy.js

@@ -1249,8 +1249,8 @@ function shouldManageCloudflareWebCacheRules(deployConfig, target) {
   if ((deployConfig.surfaces?.web?.provider ?? deployConfig.providers?.deploy) !== "cloudflare") {
     return false;
   }
-  const webTarget2 = resolvePublicWebCacheTarget(deployConfig);
-  return Boolean(webTarget2?.host && !webTarget2.host.endsWith(".workers.dev") && !webTarget2.host.endsWith(".pages.dev"));
+  const webTarget = resolvePublicWebCacheTarget(deployConfig);
+  return Boolean(webTarget?.host && !webTarget.host.endsWith(".workers.dev") && !webTarget.host.endsWith(".pages.dev"));
 }
 function cloudflareApiRequest(path, { method = "GET", body, env, allowFailure = false } = {}) {
   const token = env?.TREESEED_CLOUDFLARE_API_TOKEN ?? env?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? "";
@@ -1568,10 +1568,10 @@ function reconcileCloudflareCacheRulesForTarget(role, deployConfig, state, cache
 }
 function reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, target, { planOnly = false, env: providedEnv } = {}) {
   if (!shouldManageCloudflareWebCacheRules(deployConfig, target)) {
-    const webTarget3 = resolvePublicWebCacheTarget(deployConfig);
-    const contentTarget3 = resolvePublicContentCacheTarget(deployConfig);
-    state.webCache.webHost = webTarget3?.host ?? null;
-    state.webCache.contentHost = contentTarget3?.host ?? null;
+    const webTarget2 = resolvePublicWebCacheTarget(deployConfig);
+    const contentTarget2 = resolvePublicContentCacheTarget(deployConfig);
+    state.webCache.webHost = webTarget2?.host ?? null;
+    state.webCache.contentHost = contentTarget2?.host ?? null;
     state.webCache.rulesManaged = false;
     state.webCache.lastError = null;
     return { managed: false, skipped: true, reason: "unsupported_target_or_host" };
@@ -1586,15 +1586,15 @@ function reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, targe
     state.webCache.lastError = "CLOUDFLARE_API_TOKEN is required to manage Cloudflare Cache Rules.";
     return { managed: false, skipped: true, reason: "missing_api_token" };
   }
-  const webTarget2 = resolvePublicWebCacheTarget(deployConfig);
-  const contentTarget2 = resolvePublicContentCacheTarget(deployConfig);
+  const webTarget = resolvePublicWebCacheTarget(deployConfig);
+  const contentTarget = resolvePublicContentCacheTarget(deployConfig);
   try {
     const results = [];
-    if (webTarget2?.host) {
-      results.push(reconcileCloudflareCacheRulesForTarget("web", deployConfig, state, webTarget2, env, { planOnly }));
+    if (webTarget?.host) {
+      results.push(reconcileCloudflareCacheRulesForTarget("web", deployConfig, state, webTarget, env, { planOnly }));
     }
-    if (contentTarget2?.host) {
-      results.push(reconcileCloudflareCacheRulesForTarget("content", deployConfig, state, contentTarget2, env, { planOnly }));
+    if (contentTarget?.host) {
+      results.push(reconcileCloudflareCacheRulesForTarget("content", deployConfig, state, contentTarget, env, { planOnly }));
     }
     state.webCache.rulesManaged = true;
     state.webCache.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1700,7 +1700,7 @@ function recordCachePurgeResult(targetState, results, error = null) {
     return;
   }
   targetState.lastPurgedAt = (/* @__PURE__ */ new Date()).toISOString();
-  targetState.purgeCount = Array.isArray(results) ? results.reduce((sum, result) => sum + (result?.count ?? 0), 0) : 0;
+  targetState.purgeCount = Array.isArray(results) ? results.reduce((sum, result) => sum + (typeof result?.count === "number" ? result.count : 0), 0) : 0;
   targetState.lastError = null;
 }
 function resolveCloudflareCachePurgeEnv(options = {}) {
@@ -1728,7 +1728,8 @@ function purgeSourcePageCaches(tenantRoot, options = {}) {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
       env
     });
-    const allResults = target.scope === "prod" ? purgeCloudflareCacheEverythingByHosts([webTarget.host, contentTarget?.host], deployConfig, { env }) : [];
+    const hosts = [...new Set(urls.map((url) => safeUrl(url)?.hostname).filter(Boolean))];
+    const allResults = target.scope === "prod" ? purgeCloudflareCacheEverythingByHosts(hosts, deployConfig, { env }) : [];
     assertCloudflareCachePurgeSucceeded([...results, ...allResults]);
     recordCachePurgeResult(state.webCache.deployPurge, [...results, ...allResults]);
     writeDeployState(tenantRoot, state, { target });

package/dist/workflow/operations.d.ts

@@ -1192,6 +1192,20 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         };
     };
     productionWebVerification: Record<string, unknown> | null;
+    productionFinalGuarantees: {
+        ok: true;
+        environment: string;
+        runId: string;
+        outputRoot: string;
+        counts: {
+            planned: number;
+            passed: number;
+            failed: number;
+            skipped: number;
+            blocked: number;
+            releaseBlockingFailures: number;
+        };
+    };
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -762,6 +762,54 @@ ${diagnostics.join("\n") || `See ${report.outputRoot}`}`, {
     };
   });
 }
+async function runReleaseProductionGuarantees(root, helpers, operation, sceneArtifacts) {
+  const environment = "prod";
+  const env = {
+    ...helpers.context.env,
+    ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
+  };
+  env.TREESEED_ACCEPTANCE_SERVICE_ID ??= env.TREESEED_API_WEB_SERVICE_ID ?? env.TREESEED_WEB_SERVICE_ID;
+  env.TREESEED_ACCEPTANCE_SERVICE_SECRET ??= env.TREESEED_API_WEB_SERVICE_SECRET ?? env.TREESEED_WEB_SERVICE_SECRET;
+  if (!env.TREESEED_ACCEPTANCE_SERVICE_ID || !env.TREESEED_ACCEPTANCE_SERVICE_SECRET) {
+    workflowError(operation, "release_gate_failed", "Final production release guarantees cannot run because production acceptance service credentials are missing.", {
+      details: {
+        environment,
+        missing: [
+          !env.TREESEED_ACCEPTANCE_SERVICE_ID ? "TREESEED_ACCEPTANCE_SERVICE_ID" : null,
+          !env.TREESEED_ACCEPTANCE_SERVICE_SECRET ? "TREESEED_ACCEPTANCE_SERVICE_SECRET" : null
+        ].filter((value) => Boolean(value))
+      }
+    });
+  }
+  helpers.write(`[${operation}][workflow] Running final production release guarantees against the fully deployed production environment.`);
+  return await withContextEnv(env, async () => {
+    const report = await runTreeseedGuarantees({
+      workspaceRoot: root,
+      environment,
+      evidenceTarget: "release",
+      sceneArtifacts
+    });
+    if (!report.ok) {
+      const diagnostics = report.diagnostics.filter((entry) => entry.severity === "error").slice(0, 20).map((entry) => `${entry.code}: ${entry.message}${entry.sourcePath ? ` (${entry.sourcePath})` : ""}`);
+      const failedGuarantees = report.results.filter((entry) => entry.status === "failed" || entry.status === "blocked").slice(0, 20).map((entry) => `${entry.id}: ${entry.status}`);
+      workflowError(operation, "release_gate_failed", [
+        "Final production release guarantees failed after production deployment.",
+        ...failedGuarantees,
+        ...diagnostics,
+        failedGuarantees.length === 0 && diagnostics.length === 0 ? `See ${report.outputRoot}` : null
+      ].filter((line) => Boolean(line)).join("\n"), {
+        details: { environment, outputRoot: report.outputRoot, counts: report.counts, diagnostics: report.diagnostics }
+      });
+    }
+    return {
+      ok: report.ok,
+      environment: report.environment,
+      runId: report.runId,
+      outputRoot: report.outputRoot,
+      counts: report.counts
+    };
+  });
+}
 function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGates) {
   const gates = Array.isArray(workflowGates) ? workflowGates.map((gate) => stringRecord(gate)).filter((gate) => Boolean(gate)) : [];
   const releaseRecord = stringRecord(rootRelease) ?? {};
@@ -5697,6 +5745,7 @@ ${blockers.join("\n")}`, {
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-web-live-verification", description: "Run production web live verification after root deploy", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-final-guarantees", description: "Run final production release guarantees after all production deploys", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "workspace-link", description: "Restore local workspace links after release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }
         ],
@@ -5875,6 +5924,7 @@ ${rendered}`);
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
         const productionWebVerification = await executeJournalStep(root, workflowRun.runId, "production-web-live-verification", () => runReleaseWebLiveVerification(root, "prod", helpers, "release"));
+        const productionFinalGuarantees = await executeJournalStep(root, workflowRun.runId, "production-final-guarantees", () => runReleaseProductionGuarantees(root, helpers, "release", normalizeSceneArtifactsMode(effectiveInput.sceneArtifacts)));
         const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
           const packageBackMerges = selectedPackageNames.map((name) => packageRepoByName.get(name)).filter((pkg) => Boolean(pkg)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
             subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
@@ -5905,6 +5955,7 @@ ${rendered}`);
           productionHosting,
           productionApiGuarantees,
           productionWebVerification,
+          productionFinalGuarantees,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.38",
+  "version": "0.12.40",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {