@treeseed/sdk 0.12.45 → 0.12.47

package/dist/operations/services/git-workflow.js

@@ -440,7 +440,12 @@ function checkoutTaskBranchFromStaging(cwd, branchName, { createIfMissing = true
 function checkoutNewTaskBranchWithChanges(cwd, branchName, { pushIfCreated = false } = {}) {
   const repoDir = repoRoot(cwd);
   if (currentBranch(repoDir) !== STAGING_BRANCH) {
-    throw new Error(`Dirty change adoption requires ${repoDir} to be on ${STAGING_BRANCH}.`);
+    const stagingHead = remoteBranchExists(repoDir, STAGING_BRANCH) ? remoteHeadCommit(repoDir, STAGING_BRANCH) : null;
+    const canNormalizeStagingCheckout = gitStatusPorcelain(repoDir).length === 0 && stagingHead !== null && headCommit(repoDir) === stagingHead;
+    if (!canNormalizeStagingCheckout) {
+      throw new Error(`Dirty change adoption requires ${repoDir} to be on ${STAGING_BRANCH}.`);
+    }
+    syncBranchWithOrigin(repoDir, STAGING_BRANCH);
   }
   if (branchExists(repoDir, branchName) || remoteBranchExists(repoDir, branchName)) {
     throw new Error(`Dirty change adoption requires a new branch; ${branchName} already exists.`);

package/dist/operations/services/live-hosted-service-checks.js

@@ -19,7 +19,7 @@ import {
 } from "./hosted-service-checks.js";
 const DEFAULT_RETRY_ATTEMPTS = 3;
 const DEFAULT_RETRY_INTERVAL_MS = 1500;
-const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_ATTEMPTS = 60;
+const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_ATTEMPTS = 120;
 const DEFAULT_RAILWAY_DEPLOYMENT_SETTLE_INTERVAL_MS = 5e3;
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));

package/dist/operations/services/repository-save-orchestrator.js

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { basename, resolve, relative } from "node:path";
 import { spawn, spawnSync } from "node:child_process";
 import { tmpdir } from "node:os";
@@ -731,18 +731,28 @@ function syncDirectGitDependencyLockfileEntries(node, options, references) {
   let changed = false;
   for (const reference of references) {
     const manifestSpec = reference.manifestSpec ?? reference.spec;
-    for (const field of dependencyFields(rootPackage)) {
-      const values = rootPackage[field];
-      if (!values || typeof values !== "object" || Array.isArray(values)) continue;
-      const dependencies = values;
-      if (reference.packageName in dependencies && dependencies[reference.packageName] !== manifestSpec) {
-        dependencies[reference.packageName] = manifestSpec;
-        changed = true;
+    const visitDependencyMaps = (value) => {
+      if (!value || typeof value !== "object") return;
+      if (Array.isArray(value)) {
+        for (const item of value) visitDependencyMaps(item);
+        return;
       }
-    }
-    const entryKey = `node_modules/${reference.packageName}`;
-    const entry = packageEntries[entryKey];
-    if (entry) {
+      const record = value;
+      for (const field of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+        const dependencies = record[field];
+        if (!dependencies || typeof dependencies !== "object" || Array.isArray(dependencies)) continue;
+        const dependencyMap = dependencies;
+        const current = dependencyMap[reference.packageName];
+        if (typeof current === "string" && current !== manifestSpec) {
+          dependencyMap[reference.packageName] = manifestSpec;
+          changed = true;
+        }
+      }
+      for (const nested of Object.values(record)) visitDependencyMaps(nested);
+    };
+    visitDependencyMaps(lockfile);
+    for (const [entryKey, entry] of Object.entries(packageEntries)) {
+      if (entryKey !== `node_modules/${reference.packageName}` && !entryKey.endsWith(`/node_modules/${reference.packageName}`)) continue;
       const nextResolved = normalizeGitRemoteForDependency(reference.remoteUrl ?? "", "ssh");
       const resolved = nextResolved ? `${nextResolved}#${manifestSpec.slice(manifestSpec.lastIndexOf("#") + 1)}` : manifestSpec;
       if (entry.resolved !== resolved) {
@@ -764,6 +774,51 @@ function syncDirectGitDependencyLockfileEntries(node, options, references) {
   emitProgress(options, node, "lockfile", "Synchronized direct internal Git dependency lockfile entries without npm git preparation.");
   return true;
 }
+function validateStandaloneGitDependencyLockfile(node, options) {
+  const lockfilePath = resolve(node.path, "package-lock.json");
+  const lockfileExists = existsSync(lockfilePath);
+  const validateArgs = [
+    "ci",
+    "--package-lock-only",
+    "--ignore-scripts",
+    "--workspaces=false",
+    "--no-audit",
+    "--no-fund"
+  ];
+  try {
+    if (!lockfileExists) throw new Error("standalone lockfile missing");
+    runCapturedCommand(node, options, "lockfile", "npm", validateArgs, { timeoutMs: 5 * 6e4 });
+  } catch (validationError) {
+    const previousLockfile = lockfileExists ? readFileSync(lockfilePath, "utf8") : null;
+    const isolatedRoot = mkdtempSync(resolve(tmpdir(), "treeseed-lockfile-"));
+    try {
+      copyFileSync(resolve(node.path, "package.json"), resolve(isolatedRoot, "package.json"));
+      runCapturedCommand(node, options, "lockfile", "npm", [
+        "install",
+        "--package-lock-only",
+        "--ignore-scripts",
+        "--workspaces=false",
+        "--no-audit",
+        "--no-fund"
+      ], {
+        cwd: isolatedRoot,
+        timeoutMs: 15 * 6e4
+      });
+      runCapturedCommand(node, options, "lockfile", "npm", validateArgs, {
+        cwd: isolatedRoot,
+        timeoutMs: 5 * 6e4
+      });
+      copyFileSync(resolve(isolatedRoot, "package-lock.json"), lockfilePath);
+    } catch (regenerationError) {
+      if (previousLockfile !== null) writeFileSync(lockfilePath, previousLockfile, "utf8");
+      throw regenerationError instanceof Error ? regenerationError : validationError;
+    } finally {
+      rmSync(isolatedRoot, { recursive: true, force: true });
+    }
+  }
+  emitProgress(options, node, "lockfile", "Validated the standalone lockfile for exact internal Git refs.");
+  return true;
+}
 function planPackageVersion(node, options) {
   if (!node.packageJson || !node.packageJsonPath) return null;
   const current = String(node.packageJson.version ?? "0.0.0");
@@ -827,7 +882,7 @@ function syncRootWorkspaceLockfileMetadata(node, options) {
       const mergedDeps = { ...currentDeps };
       let fieldChanged = false;
       for (const [dependencyName, dependencySpec] of Object.entries(nextValue)) {
-        if (mergedDeps[dependencyName] != null) continue;
+        if (mergedDeps[dependencyName] === dependencySpec) continue;
         mergedDeps[dependencyName] = dependencySpec;
         fieldChanged = true;
       }
@@ -1711,8 +1766,15 @@ async function saveOneRepository(node, options, state) {
   ensureWritableRemote(node, options);
   const dependencyUpdates = isRootWorkspaceRepository(node, options) ? [] : updateDependencyReferences(node, state.finalizedReferences);
   const dependencyChanged = dependencyUpdates.length > 0;
-  const gitDependencyRefreshReferences = dependencyUpdates.map((update) => state.finalizedReferences.get(update.packageName)).filter((reference) => Boolean(reference) && reference.mode === "dev-git-commit");
+  const directDependencyNames = new Set(dependencyFields(node.packageJson ?? {}).flatMap((field) => {
+    const value = node.packageJson?.[field];
+    return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : [];
+  }));
+  const gitDependencyRefreshReferences = [...state.finalizedReferences.values()].filter((reference) => reference.mode === "dev-git-commit" && directDependencyNames.has(reference.packageName));
   const lockfileGitDependenciesSynced = syncDirectGitDependencyLockfileEntries(node, options, gitDependencyRefreshReferences);
+  if (!isRootWorkspaceRepository(node, options) && (lockfileGitDependenciesSynced || gitDependencyRefreshReferences.length > 0 && !existsSync(resolve(node.path, "package-lock.json")))) {
+    validateStandaloneGitDependencyLockfile(node, options);
+  }
   const gitDependencyRefreshSpecs = lockfileGitDependenciesSynced ? [] : gitDependencyRefreshReferences.map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
   const submodulePointers = collectSubmodulePointerChanges(node, state.finalizedCommits);
   const submodulesChanged = submodulePointers.length > 0;

package/dist/operations/services/workspace-dependency-mode.js

@@ -274,6 +274,10 @@ function removeLinkCandidate(link, managedLinks) {
     unlinkSync(link.linkPath);
     return true;
   }
+  if (managed) {
+    rmSync(link.linkPath, { recursive: true, force: true });
+    return true;
+  }
   if (isInstalledTreeseedPackage(link.linkPath, link.packageName)) {
     rmSync(link.linkPath, { recursive: true, force: true });
     return true;

package/dist/platform/desired-state.js

@@ -62,6 +62,7 @@ function environmentFromTarget(target) {
   return "staging";
 }
 function packageReleaseCapability(adapter) {
+  if (!adapter.capabilities.publish) return adapter.releaseChecks.length > 0 ? "deploy-only" : "none";
   if (adapter.artifacts.some((artifact) => artifact.provider === "docker")) return "image";
   if (adapter.artifacts.some((artifact) => artifact.provider === "npm")) return "npm";
   if (adapter.releaseChecks.length > 0) return "deploy-only";

package/dist/reconcile/providers/release-private.d.ts

@@ -8,20 +8,17 @@ export declare function runReleaseVerifyCommand(input: {
     ok: boolean;
     skipped: boolean;
     reason: string;
-    status?: undefined;
-    signal?: undefined;
-    command?: undefined;
-    stdout?: undefined;
-    stderr?: undefined;
+    dependencies?: undefined;
 } | {
     ok: boolean;
-    status: number | null;
-    signal: NodeJS.Signals | null;
-    command: import("../../index.js").TreeseedPackageCommand;
-    stdout: string;
-    stderr: string;
-    skipped?: undefined;
-    reason?: undefined;
+    skipped: boolean;
+    reason: string;
+    dependencies: {
+        status: "staging-proof-reused";
+        candidatePath: string;
+        packageCommit: string;
+        rootCommit: string;
+    };
 }>;
 export declare function runTemplateReleaseVerifyCommand(input: {
     tenantRoot: string;

package/dist/reconcile/providers/release-private.js

@@ -1,9 +1,28 @@
-import { spawn, spawnSync } from "node:child_process";
-import { mkdirSync, writeFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { findTreeseedPackageAdapter } from "../../operations/services/package-adapters.js";
 import { checkedOutTemplateRepositories } from "../../operations/services/managed-repositories.js";
 import { runTreeseedGitText } from "../../operations/services/git-runner.js";
+function requireMatchingStageCandidate(tenantRoot, packageId, packageDir) {
+  const candidatePath = resolve(tenantRoot, ".treeseed/workflow/stage-candidates/latest.json");
+  if (!existsSync(candidatePath)) {
+    throw new Error(`Release verification requires a successful staged candidate; ${candidatePath} is missing.`);
+  }
+  const candidate = JSON.parse(readFileSync(candidatePath, "utf8"));
+  const packageProof = candidate.packages?.find((entry) => entry.name === packageId);
+  const packageHead = runTreeseedGitText(["rev-parse", "HEAD"], { cwd: packageDir, mode: "read" }).trim();
+  const rootHead = runTreeseedGitText(["rev-parse", "HEAD"], { cwd: tenantRoot, mode: "read" }).trim();
+  if (candidate.targetBranch !== "staging" || candidate.root?.verified !== true || candidate.root.commit !== rootHead || packageProof?.verified !== true || packageProof.commit !== packageHead) {
+    throw new Error(`Release verification requires ${packageId} and the Market root to match the latest verified staging candidate.`);
+  }
+  return {
+    status: "staging-proof-reused",
+    candidatePath,
+    packageCommit: packageHead,
+    rootCommit: rootHead
+  };
+}
 async function runReleaseVerifyCommand(input) {
   const adapter = findTreeseedPackageAdapter(input.tenantRoot, input.packageId);
   if (!adapter) {
@@ -17,44 +36,13 @@ async function runReleaseVerifyCommand(input) {
       reason: `${input.packageId} has no release verify command.`
     };
   }
-  const renderedCommand = [command.command, ...command.args].join(" ");
-  input.onProgress?.(`Running ${input.packageId} release verification: ${renderedCommand}`);
-  const started = Date.now();
-  let stdout = "";
-  let stderr = "";
-  const result = await new Promise((resolve2, reject) => {
-    const child = spawn(command.command, command.args, {
-      cwd: command.cwd,
-      env: { ...process.env, ...input.env ?? {} },
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const heartbeat = setInterval(() => {
-      input.onProgress?.(`Still running ${input.packageId} release verification after ${Math.round((Date.now() - started) / 1e3)}s.`);
-    }, 3e4);
-    child.stdout?.on("data", (chunk) => {
-      stdout += String(chunk);
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderr += String(chunk);
-    });
-    child.on("error", (error) => {
-      clearInterval(heartbeat);
-      reject(error);
-    });
-    child.on("close", (status, signal) => {
-      clearInterval(heartbeat);
-      resolve2({ status, signal });
-    });
-  });
-  const elapsedSeconds = Math.round((Date.now() - started) / 1e3);
-  input.onProgress?.(`${input.packageId} release verification ${result.status === 0 ? "passed" : "failed"} in ${elapsedSeconds}s.`);
+  const stagingProof = requireMatchingStageCandidate(input.tenantRoot, input.packageId, adapter.dir);
+  input.onProgress?.(`Reusing exact-SHA staging verification for ${input.packageId} at ${stagingProof.packageCommit.slice(0, 12)}.`);
   return {
-    ok: (result.status ?? 1) === 0,
-    status: result.status,
-    signal: result.signal,
-    command,
-    stdout,
-    stderr
+    ok: true,
+    skipped: true,
+    reason: `${input.packageId} matches the latest verified staging candidate; tag workflows perform independent release verification before publication or deployment.`,
+    dependencies: stagingProof
   };
 }
 function runTemplateCommand(command, cwd, env) {

package/dist/workflow/operations.js

@@ -1222,6 +1222,14 @@ function remoteTagCommit(repoDir, tagName) {
   const direct = output.split("\n").find((line) => line.endsWith(`refs/tags/${tagName}`));
   return (peeled ?? direct)?.split(/\s+/u)[0] ?? null;
 }
+function releaseTagExists(repoDir, tagName) {
+  if (gitObjectCommit(repoDir, tagName)) return true;
+  try {
+    return remoteTagCommit(repoDir, tagName) !== null;
+  } catch {
+    return false;
+  }
+}
 function ensureReleaseTag(repoDir, tagName, commitSha, message) {
   const localCommit = gitObjectCommit(repoDir, tagName);
   if (localCommit && localCommit !== commitSha) {
@@ -2125,8 +2133,12 @@ function productionPackageDeployGates(root, versions) {
 function prepareAdapterReleaseMetadata(root, pkg, version) {
   const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === pkg.name || entry.name === pkg.name);
   if (adapter?.kind === "beam-elixir-rust" && existsSync(resolve(pkg.dir, "scripts", "bump-release-version.ts"))) {
-    run("tsx", ["scripts/bump-release-version.ts", version], { cwd: pkg.dir });
-    return { status: "updated", adapter: adapter.id, command: "tsx scripts/bump-release-version.ts" };
+    const tsx = resolve(root, "node_modules/.bin/tsx");
+    if (!existsSync(tsx)) {
+      throw new Error(`TreeSeed release requires the workspace tsx executable at ${tsx}. Run trsd install and restore workspace dependencies before retrying.`);
+    }
+    run(tsx, ["scripts/bump-release-version.ts", version], { cwd: pkg.dir });
+    return { status: "updated", adapter: adapter.id, command: `${tsx} scripts/bump-release-version.ts` };
   }
   if (existsSync(resolve(pkg.dir, "package.json"))) {
     return {
@@ -2629,6 +2641,14 @@ function buildReleasePlanSnapshot(input) {
       versionPlan.versions.set(adapter.id, incrementVersion(adapter.version, input.level));
     }
   }
+  for (const adapter of discoverTreeseedPackageAdapters(input.root)) {
+    let version = versionPlan.versions.get(adapter.id);
+    if (!version) continue;
+    while (releaseTagExists(adapter.dir, version)) {
+      version = incrementVersion(version, input.level);
+    }
+    versionPlan.versions.set(adapter.id, version);
+  }
   const plannedSelected = orderReleasePackageNames([...versionPlan.selected].filter((name) => versionPlan.versions.has(name)));
   const plannedChanged = input.repairVersionLine === true ? plannedSelected : Array.from(new Set(publishablePackageSelection.changed.filter((name) => plannedSelected.includes(name))));
   const plannedDependents = plannedSelected.filter((name) => !plannedChanged.includes(name));
@@ -4633,7 +4653,7 @@ async function workflowSave(helpers, input) {
               verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
               commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
               workflowRunId: workflowRun.runId,
-              deferPushUntilVerified: true,
+              deferPushUntilVerified: false,
               onProgress: (line, stream) => helpers.write(line, stream),
               onWaveSaved: branch === STAGING_BRANCH && shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? async ({ nodes, reports, rootRepo: waveRootRepo }) => {
                 const nonRootReportsForWave = reports.filter((repo, index) => nodes[index]?.id !== ".");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.45",
+  "version": "0.12.47",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {