@treeseed/sdk 0.12.5 → 0.12.6

package/dist/operations/services/package-adapters.js

@@ -221,6 +221,7 @@ function beamPackageAdapter(root, dir) {
   const versionSourceRel = typeof manifest?.versionSource === "string" && manifest.versionSource.trim() ? manifest.versionSource.trim() : existsSync(resolve(dir, "apps/api/mix.exs")) ? "apps/api/mix.exs" : "mix.exs";
   const versionSource = resolve(dir, versionSourceRel);
   const image = typeof manifest?.image === "string" && manifest.image.trim() ? manifest.image.trim() : id === "treedx" ? "treeseed/treedx" : null;
+  const dockerArtifacts = manifestDockerArtifacts(manifest?.artifacts);
   const repository = stringValue(manifest?.repository) ?? (id === "treedx" ? "treeseed-ai/treedx" : null);
   const hostedVerifyWorkflow = stringValue(manifest?.hostedVerifyWorkflow) ?? stringValue(stringRecord(manifest?.releaseGate).workflow) ?? (existsSync(resolve(dir, ".github/workflows/release-gate.yml")) ? "release-gate.yml" : null);
   const projectArchitecture = normalizeTreeseedPackageProjectArchitecture(manifest?.projectArchitecture, id);
@@ -246,7 +247,16 @@ function beamPackageAdapter(root, dir) {
       local: commandFromScript(dir, local, "local"),
       release: commandFromScript(dir, releaseGate, "release")
     },
-    artifacts: image ? [{
+    artifacts: dockerArtifacts.length > 0 ? dockerArtifacts.map((artifact) => ({
+      provider: "docker",
+      name: artifact.name,
+      tags: version ? [version, shaTag] : [shaTag],
+      dockerfile: artifact.dockerfile ?? "Dockerfile",
+      context: artifact.context ?? ".",
+      target: artifact.target,
+      role: artifact.role ?? id,
+      architectures: artifact.architectures.length > 0 ? artifact.architectures : stringArray(stringRecord(manifest?.dockerImages).architectures)
+    })) : image ? [{
       provider: "docker",
       name: image,
       tags: version ? [version, shaTag] : [shaTag],
@@ -256,7 +266,7 @@ function beamPackageAdapter(root, dir) {
       role: id,
       architectures: stringArray(stringRecord(manifest?.dockerImages).architectures)
     }] : [],
-    releaseChecks: image ? [{ kind: "docker-manifest", name: "Docker image manifest", detail: `${image}:${version ?? "<version>"}` }] : [],
+    releaseChecks: dockerArtifacts.length > 0 ? dockerArtifacts.map((artifact) => ({ kind: "docker-manifest", name: `${artifact.name} Docker image manifest`, detail: `${artifact.name}:${version ?? "<version>"}` })) : image ? [{ kind: "docker-manifest", name: "Docker image manifest", detail: `${image}:${version ?? "<version>"}` }] : [],
     metadata: {
       hasCargo: existsSync(resolve(dir, "Cargo.toml")),
       hasDockerfile: existsSync(resolve(dir, "Dockerfile")),

package/dist/operations/services/package-reference-policy.js

@@ -16,7 +16,7 @@ function internalDependencyFields(packageJson) {
   return INTERNAL_DEPENDENCY_FIELDS.filter((field) => packageJson[field] && typeof packageJson[field] === "object" && !Array.isArray(packageJson[field]));
 }
 function isPrereleaseVersion(version) {
-  return /^\d+\.\d+\.\d+-[0-9A-Za-z.-]+$/u.test(String(version).trim());
+  return /^[~^]?\d+\.\d+\.\d+-[0-9A-Za-z.-]+$/u.test(String(version).trim());
 }
 function isStableVersion(version) {
   return /^\d+\.\d+\.\d+$/u.test(String(version).trim());
@@ -136,13 +136,22 @@ function updateInternalDependencySpecs(packageJson, references) {
   return changed;
 }
 function installableInternalDependencyVersions(root = workspaceRoot(), versions) {
-  const publishTargets = /* @__PURE__ */ new Map();
+  const installablePackages = /* @__PURE__ */ new Set();
   for (const adapter of discoverTreeseedPackageAdapters(root)) {
-    const publishTarget = adapter.publishTarget ?? "npm";
-    publishTargets.set(adapter.id, publishTarget);
-    publishTargets.set(adapter.name, publishTarget);
+    if (adapter.publishTarget === "npm" || publicNpmPackageManifest(adapter.dir)) {
+      installablePackages.add(adapter.id);
+      installablePackages.add(adapter.name);
+    }
   }
-  return new Map([...versions.entries()].filter(([packageName]) => (publishTargets.get(packageName) ?? "npm") === "npm"));
+  return new Map([...versions.entries()].filter(([packageName]) => installablePackages.has(packageName)));
+}
+function publicNpmPackageManifest(packageRoot) {
+  const packageJsonPath = resolve(packageRoot, "package.json");
+  if (!existsSync(packageJsonPath)) return false;
+  const packageJson = readJson(packageJsonPath);
+  if (packageJson.private === true) return false;
+  const publishConfig = packageJson.publishConfig;
+  return Boolean(publishConfig && typeof publishConfig === "object" && publishConfig.access === "public");
 }
 function rewriteInternalDependenciesToStableVersions(root = workspaceRoot(), versions) {
   const rewrites = [];

package/dist/platform/desired-state.js

@@ -83,6 +83,27 @@ function packageUnitFromAdapter(adapter) {
     githubEnvironments: Array.isArray(adapter.metadata.githubEnvironments) ? adapter.metadata.githubEnvironments : []
   };
 }
+const PRODUCTION_ONLY_GITHUB_SECRET_NAMES = /* @__PURE__ */ new Set([
+  "NPM_TOKEN",
+  "PYPI_API_TOKEN",
+  "CARGO_REGISTRY_TOKEN",
+  "HEX_API_KEY"
+]);
+function packageRequiredSecretsForGitHubEnvironment(adapter, environmentName) {
+  const requiredSecrets = Array.isArray(adapter.metadata.requiredSecrets) ? adapter.metadata.requiredSecrets : [];
+  const isProduction = environmentName === "production";
+  return requiredSecrets.filter((secretName) => {
+    if (typeof secretName !== "string" || !secretName.trim()) return false;
+    return isProduction || !PRODUCTION_ONLY_GITHUB_SECRET_NAMES.has(secretName);
+  });
+}
+function packageRequiredVariablesForGitHubEnvironment(adapter, _environmentName) {
+  return (Array.isArray(adapter.metadata.requiredVariables) ? adapter.metadata.requiredVariables : []).filter((variableName) => typeof variableName === "string" && Boolean(variableName.trim()));
+}
+function packageUnitRequiredSecretsForGitHubEnvironment(pkg, environmentName) {
+  const isProduction = environmentName === "production";
+  return pkg.requiredSecrets.filter((secretName) => isProduction || !PRODUCTION_ONLY_GITHUB_SECRET_NAMES.has(secretName));
+}
 function templateReleaseTag(manifest) {
   return manifest.version ? `${manifest.release.tagPrefix}${manifest.id}/v${manifest.version}` : null;
 }
@@ -299,8 +320,7 @@ function packageResources(adapter, environment) {
         },
         source: { type: "package-adapter", id: packageId }
       });
-      for (const secretName of Array.isArray(adapter.metadata.requiredSecrets) ? adapter.metadata.requiredSecrets : []) {
-        if (typeof secretName !== "string" || !secretName.trim()) continue;
+      for (const secretName of packageRequiredSecretsForGitHubEnvironment(adapter, environmentName)) {
         resources.push({
           id: `github-secret-binding:${packageId}:${environmentName}:${secretName}`,
           kind: "github-secret-binding",
@@ -321,8 +341,7 @@ function packageResources(adapter, environment) {
           source: { type: "package-adapter", id: packageId }
         });
       }
-      for (const variableName of Array.isArray(adapter.metadata.requiredVariables) ? adapter.metadata.requiredVariables : []) {
-        if (typeof variableName !== "string" || !variableName.trim()) continue;
+      for (const variableName of packageRequiredVariablesForGitHubEnvironment(adapter, environmentName)) {
         resources.push({
           id: `github-variable-binding:${packageId}:${environmentName}:${variableName}`,
           kind: "github-variable-binding",
@@ -731,7 +750,7 @@ function releaseGateResources(packages, templates, environment) {
     };
     const publishGateKind = pkg.releaseCapability === "npm" ? "release-gate:npm-publish" : pkg.releaseCapability === "image" ? "release-gate:image-publish" : null;
     const imageCredentialDependencies = publishGateKind === "release-gate:image-publish" && pkg.githubEnvironments.includes(hostedEnvironment) ? [
-      ...pkg.requiredSecrets.map((secretName) => `github-secret-binding:${pkg.id}:${hostedEnvironment}:${secretName}`),
+      ...packageUnitRequiredSecretsForGitHubEnvironment(pkg, hostedEnvironment).map((secretName) => `github-secret-binding:${pkg.id}:${hostedEnvironment}:${secretName}`),
       ...pkg.requiredVariables.map((variableName) => `github-variable-binding:${pkg.id}:${hostedEnvironment}:${variableName}`)
     ] : [];
     const publishDependencies = publishGateKind === "release-gate:image-publish" ? [verifyGate.id, ...imageCredentialDependencies] : [verifyGate.id];

package/dist/workflow/operations.d.ts

@@ -12,7 +12,7 @@ import type { TreeseedCloseInput, TreeseedCiInput, TreeseedConfigInput, Treeseed
 type WorkflowWrite = NonNullable<TreeseedWorkflowContext['write']>;
 type WorkflowStatePayload = ReturnType<typeof resolveTreeseedWorkflowState>;
 type ReleaseCandidateMode = TreeseedReleaseCandidateMode;
-export type TreeseedWorkflowErrorCode = 'validation_failed' | 'merge_conflict' | 'missing_runtime_auth' | 'deployment_timeout' | 'confirmation_required' | 'unsupported_transport' | 'unsupported_state' | 'workflow_locked' | 'resume_unavailable' | 'workflow_contract_missing' | 'github_workflow_failed' | 'github_auth_unavailable';
+export type TreeseedWorkflowErrorCode = 'validation_failed' | 'merge_conflict' | 'missing_runtime_auth' | 'deployment_timeout' | 'confirmation_required' | 'unsupported_transport' | 'unsupported_state' | 'workflow_locked' | 'resume_unavailable' | 'workflow_contract_missing' | 'github_workflow_failed' | 'github_auth_unavailable' | 'hosted_reconcile_failed' | 'hosted_live_verification_failed';
 export declare class TreeseedWorkflowError extends Error {
     code: TreeseedWorkflowErrorCode;
     operation: TreeseedWorkflowOperationId;
@@ -89,6 +89,16 @@ export declare function workflowReleaseCandidate(helpers: WorkflowOperationHelpe
     finalState?: WorkflowStatePayload;
     timing?: TreeseedWorkflowTiming;
 }>>;
+type PublishedArtifactCheck = {
+    id: string;
+    kind: 'npm' | 'docker' | 'pypi' | 'crates' | 'hex';
+    name: string;
+    version: string;
+    url: string;
+    ok: boolean;
+    status?: number | null;
+    message?: string;
+};
 export declare function reconcileTreeseedBranchPreview(input: {
     root: string;
     branch: string;
@@ -1003,27 +1013,41 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
                 status: string;
                 adapter: string;
                 command: string;
+                packageLock?: undefined;
+                reason?: undefined;
             } | {
                 status: string;
-                reason: string;
                 adapter: string;
+                packageLock: {
+                    status: string;
+                    reason: string;
+                    path?: undefined;
+                } | {
+                    status: string;
+                    path: string;
+                    reason?: undefined;
+                };
                 command?: undefined;
+                reason?: undefined;
             } | {
                 status: string;
-                reason: null;
                 adapter: string;
+                reason: string;
                 command?: undefined;
+                packageLock?: undefined;
             } | {
                 status: string;
                 reason: string;
             };
         }[];
-        rootInstall: {
+        rootPackageLock: {
             status: string;
             reason: string;
+            path?: undefined;
         } | {
             status: string;
-            reason: null;
+            path: string;
+            reason?: undefined;
         };
         workspaceUnlink: import("../operations/services/workspace-dependency-mode.js").WorkspaceDependencyModeReport;
     };
@@ -1077,6 +1101,62 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
         timeoutSeconds: number | null;
         cached: boolean;
     }[];
+    publishedArtifacts: {
+        checks: PublishedArtifactCheck[];
+    };
+    productionHosting: {
+        status: "skipped";
+        reason: string;
+        environment: "staging" | "prod";
+        selectedApps: string[];
+        selectedResources: {
+            id: string;
+            host: string;
+            serviceType: string;
+            placement: import("../hosting/contracts.js").TreeseedServicePlacement;
+            serviceName: string | null;
+        }[];
+        reconcile?: undefined;
+        postApplyStatus?: undefined;
+        liveVerification?: undefined;
+    } | {
+        status: "reconciled";
+        environment: "staging" | "prod";
+        selectedApps: string[];
+        selectedResources: {
+            id: string;
+            host: string;
+            serviceType: string;
+            placement: import("../hosting/contracts.js").TreeseedServicePlacement;
+            serviceName: string | null;
+        }[];
+        reconcile: {
+            target: TreeseedReconcileTarget;
+            units: import("../reconcile/contracts.js").TreeseedDesiredUnit[];
+            plans: import("../reconcile/contracts.js").TreeseedReconcilePlan[];
+            results: TreeseedReconcileResult[];
+            state: import("../reconcile/contracts.js").TreeseedReconcileStateRecord;
+            timings: import("../timing.js").TreeseedTimingEntry[];
+        };
+        postApplyStatus: {
+            target: TreeseedReconcileTarget;
+            ready: boolean;
+            blockers: string[];
+            warnings: string[];
+            units: {
+                unitId: string;
+                unitType: import("../reconcile/contracts.js").TreeseedReconcileUnitType;
+                provider: string;
+                status: import("../reconcile/contracts.js").TreeseedReconcileStatusKind;
+                exists: boolean;
+                locators: Record<string, string | null>;
+                warnings: string[];
+                verification: import("../reconcile/contracts.js").TreeseedUnitVerificationResult | null;
+            }[];
+        };
+        liveVerification: import("../workflow-support.js").TreeseedLiveHostedServiceCheckReport;
+        reason?: undefined;
+    };
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -114,8 +114,7 @@ import {
 import { discoverTreeseedPackageAdapters } from "../operations/services/package-adapters.js";
 import {
   collectInternalDevReferenceIssues,
-  installableInternalDependencyVersions,
-  normalizeGitRemoteForManifest
+  rewriteProjectInternalDependenciesToStableVersions
 } from "../operations/services/package-reference-policy.js";
 import {
   ensureLocalWorkspaceLinks,
@@ -525,7 +524,7 @@ function selectorFromWorkflowHostingGraph(graph) {
     }))]
   };
 }
-async function reconcileSaveHostedEnvironment(root, environment, helpers, workflowRunId) {
+async function reconcileSaveHostedEnvironment(root, environment, helpers, workflowRunId, operation = "save") {
   const graph = compileTreeseedHostingGraph({ tenantRoot: root, environment });
   const selector = selectorFromWorkflowHostingGraph(graph);
   if (process.env.TREESEED_WORKFLOW_HOSTED_RECONCILE_MODE === "skip") {
@@ -548,24 +547,26 @@ async function reconcileSaveHostedEnvironment(root, environment, helpers, workfl
     ...helpers.context.env,
     ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
   };
-  helpers.write(`[save][workflow] Reconciling ${environment} hosted deployments for ${graph.units.length} selected resources.`);
+  const reconcileSession = /* @__PURE__ */ new Map([["workflowRunId", workflowRunId]]);
+  helpers.write(`[${operation}][workflow] Reconciling ${environment} hosted deployments for ${graph.units.length} selected resources.`);
   const reconcile = await reconcileTreeseedTarget({
     tenantRoot: root,
     target,
     env,
     selector,
     dryRun: false,
-    write: (line) => helpers.write(`[save][reconcile] ${line}`, "stderr"),
-    session: /* @__PURE__ */ new Map([["workflowRunId", workflowRunId]])
+    write: (line) => helpers.write(`[${operation}][reconcile] ${line}`, "stderr"),
+    session: reconcileSession
   });
   const status = await collectTreeseedReconcileStatus({
     tenantRoot: root,
     target,
     env,
-    selector
+    selector,
+    session: reconcileSession
   });
   if (!status.ready) {
-    workflowError("save", "hosted_reconcile_failed", `Hosted reconciliation for ${environment} did not verify:
+    workflowError(operation, "hosted_reconcile_failed", `Hosted reconciliation for ${environment} did not verify:
 ${status.blockers.join("\n")}`, {
       details: { environment, selector, status, reconcile }
     });
@@ -583,7 +584,7 @@ ${status.blockers.join("\n")}`, {
     ...live.liveObservation.issues
   ];
   if (liveFailures.length > 0) {
-    workflowError("save", "hosted_live_verification_failed", `Hosted live verification for ${environment} failed:
+    workflowError(operation, "hosted_live_verification_failed", `Hosted live verification for ${environment} failed:
 ${liveFailures.join("\n")}`, {
       details: { environment, selector, live, reconcile }
     });
@@ -972,9 +973,31 @@ function writeJsonFile(path, value) {
   writeFileSync(path, `${JSON.stringify(value, null, 2)}
 `, "utf8");
 }
+function updatePackageLockRootVersion(root, version) {
+  const packageLockPath = resolve(root, "package-lock.json");
+  if (!existsSync(packageLockPath)) return { status: "skipped", reason: "no package-lock.json" };
+  const packageLock = JSON.parse(readFileSync(packageLockPath, "utf8"));
+  let changed = false;
+  if (packageLock.version !== version) {
+    packageLock.version = version;
+    changed = true;
+  }
+  const packages = packageLock.packages;
+  if (packages && typeof packages === "object" && !Array.isArray(packages)) {
+    const rootPackage = packages[""];
+    if (rootPackage && typeof rootPackage === "object" && !Array.isArray(rootPackage)) {
+      if (rootPackage.version !== version) {
+        rootPackage.version = version;
+        changed = true;
+      }
+    }
+  }
+  if (changed) {
+    writeJsonFile(packageLockPath, packageLock);
+  }
+  return { status: changed ? "updated" : "unchanged", path: "package-lock.json" };
+}
 function applyStableWorkspaceVersionChanges(root, versions) {
-  const dependencyVersions = installableInternalDependencyVersions(root, versions);
-  const stableGitReferences = stablePackageGitReferences(root, dependencyVersions);
   for (const target of [{ name: "@treeseed/market", dir: root }, ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))]) {
     const packageJsonPath = resolve(target.dir, "package.json");
     if (!existsSync(packageJsonPath)) continue;
@@ -988,9 +1011,9 @@ function applyStableWorkspaceVersionChanges(root, versions) {
     for (const field of ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies"]) {
       const values = packageJson[field];
       if (!values || typeof values !== "object" || Array.isArray(values)) continue;
-      for (const [dependencyName, version] of dependencyVersions.entries()) {
+      for (const [dependencyName, version] of versions.entries()) {
         if (!(dependencyName in values)) continue;
-        const dependencySpec = stableGitReferences.get(dependencyName) ?? version;
+        const dependencySpec = version;
         if (String(values[dependencyName]) === dependencySpec) continue;
         values[dependencyName] = dependencySpec;
         changed = true;
@@ -1000,20 +1023,7 @@ function applyStableWorkspaceVersionChanges(root, versions) {
       writeJsonFile(packageJsonPath, packageJson);
     }
   }
-}
-function stablePackageGitReferences(root, versions) {
-  return new Map(workspacePackages(root).map((pkg) => {
-    const version = versions.get(pkg.name);
-    if (!version) return null;
-    let remote = null;
-    try {
-      remote = originRemoteUrl(pkg.dir);
-    } catch {
-      remote = null;
-    }
-    const manifestRemote = normalizeGitRemoteForManifest(remote ?? "", "preserve-origin");
-    return manifestRemote ? [pkg.name, `${manifestRemote}#${version}`] : null;
-  }).filter((entry) => Boolean(entry)));
+  rewriteProjectInternalDependenciesToStableVersions(root, versions);
 }
 function gitObjectCommit(repoDir, ref) {
   try {
@@ -1855,12 +1865,7 @@ function failWorkflowRun(root, runId, error, recovery) {
   releaseWorkflowLock(root, runId);
 }
 function validatePackageReleaseWorkflows(root, packageNames) {
-  const adapterById = new Map(discoverTreeseedPackageAdapters(root).map((adapter) => [adapter.id, adapter]));
-  const missing = checkedOutWorkspacePackageRepos(root).filter((pkg) => packageNames.includes(pkg.name)).filter((pkg) => {
-    const adapter = adapterById.get(pkg.name);
-    const workflow = adapter?.kind === "beam-elixir-rust" && typeof adapter.metadata.hostedVerifyWorkflow === "string" ? String(adapter.metadata.hostedVerifyWorkflow) : ".github/workflows/publish.yml";
-    return !existsSync(resolve(pkg.dir, workflow));
-  }).map((pkg) => pkg.name);
+  const missing = checkedOutWorkspacePackageRepos(root).filter((pkg) => packageNames.includes(pkg.name)).filter((pkg) => !existsSync(resolve(pkg.dir, ".github/workflows/publish.yml"))).map((pkg) => pkg.name);
   if (missing.length > 0) {
     workflowError("release", "workflow_contract_missing", `Treeseed release requires .github/workflows/publish.yml in: ${missing.join(", ")}.`, {
       details: {
@@ -1870,9 +1875,9 @@ function validatePackageReleaseWorkflows(root, packageNames) {
   }
 }
 function releaseWorkflowForPackage(root, packageName) {
-  const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === packageName || entry.name === packageName);
-  const workflow = adapter?.kind === "beam-elixir-rust" && typeof adapter.metadata.hostedVerifyWorkflow === "string" ? String(adapter.metadata.hostedVerifyWorkflow) : ".github/workflows/publish.yml";
-  return workflow.split("/").at(-1) || "publish.yml";
+  void root;
+  void packageName;
+  return "publish.yml";
 }
 function prepareAdapterReleaseMetadata(root, pkg, version) {
   const adapter = discoverTreeseedPackageAdapters(root).find((entry) => entry.id === pkg.name || entry.name === pkg.name);
@@ -1882,9 +1887,9 @@ function prepareAdapterReleaseMetadata(root, pkg, version) {
   }
   if (existsSync(resolve(pkg.dir, "package.json"))) {
     return {
-      status: "npm-install",
+      status: "updated",
       adapter: adapter?.id ?? pkg.name,
-      ...runReleaseNpmInstall(pkg.dir, { workspaceRoot: root })
+      packageLock: updatePackageLockRootVersion(pkg.dir, version)
     };
   }
   return { status: "skipped", adapter: adapter?.id ?? pkg.name, reason: "no package metadata updater" };
@@ -1970,8 +1975,10 @@ function assertNoInternalDevReferencesForRepo(root, repoDir, packageNames) {
 ${rendered}`);
 }
 function backMergeProductionIntoStaging(repoDir, repoName, message) {
-  syncBranchWithOrigin(repoDir, PRODUCTION_BRANCH);
   syncBranchWithOrigin(repoDir, STAGING_BRANCH);
+  if (!remoteBranchExists(repoDir, PRODUCTION_BRANCH)) {
+    throw new Error(`Remote branch "origin/${PRODUCTION_BRANCH}" does not exist.`);
+  }
   checkoutBranch(repoDir, STAGING_BRANCH);
   try {
     runGit(["merge-base", "--is-ancestor", `origin/${PRODUCTION_BRANCH}`, "HEAD"], { cwd: repoDir, capture: true });
@@ -2435,6 +2442,180 @@ ${workflow.url}` : "";
     }
   });
 }
+function npmRegistryPackageUrl(packageName) {
+  return `https://registry.npmjs.org/${packageName.replace("/", "%2f")}`;
+}
+async function fetchJsonForArtifact(url) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 2e4);
+  try {
+    const response = await fetch(url, {
+      headers: { accept: "application/json" },
+      signal: controller.signal
+    });
+    let json = null;
+    try {
+      json = await response.json();
+    } catch {
+      json = null;
+    }
+    return { ok: response.ok, status: response.status, json };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+function hasObjectKey(value, key) {
+  return Boolean(value && typeof value === "object" && Object.prototype.hasOwnProperty.call(value, key));
+}
+async function verifyNpmArtifact(packageName, version) {
+  const url = npmRegistryPackageUrl(packageName);
+  try {
+    const response = await fetchJsonForArtifact(url);
+    const versions = stringRecord(response.json)?.versions;
+    const ok = response.ok && hasObjectKey(versions, version);
+    return {
+      id: `npm:${packageName}:${version}`,
+      kind: "npm",
+      name: packageName,
+      version,
+      url,
+      ok,
+      status: response.status,
+      ...ok ? {} : { message: `${packageName}@${version} was not found in npm registry metadata.` }
+    };
+  } catch (error) {
+    return {
+      id: `npm:${packageName}:${version}`,
+      kind: "npm",
+      name: packageName,
+      version,
+      url,
+      ok: false,
+      status: null,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function verifyDockerHubArtifact(image, version) {
+  const [namespace, repository] = image.split("/");
+  const url = `https://hub.docker.com/v2/repositories/${namespace}/${repository}/tags/${version}`;
+  try {
+    const response = await fetchJsonForArtifact(url);
+    const images = Array.isArray(stringRecord(response.json)?.images) ? stringRecord(response.json)?.images : [];
+    const architectures = new Set(images.map((entry) => stringRecord(entry)).map((entry) => typeof entry?.architecture === "string" ? entry.architecture : null).filter((entry) => Boolean(entry)));
+    const ok = response.ok && architectures.has("amd64") && architectures.has("arm64");
+    return {
+      id: `docker:${image}:${version}`,
+      kind: "docker",
+      name: image,
+      version,
+      url,
+      ok,
+      status: response.status,
+      ...ok ? {} : { message: `${image}:${version} was not found on Docker Hub with amd64 and arm64 images.` }
+    };
+  } catch (error) {
+    return {
+      id: `docker:${image}:${version}`,
+      kind: "docker",
+      name: image,
+      version,
+      url,
+      ok: false,
+      status: null,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function verifySimpleRegistryArtifact(input) {
+  try {
+    const response = await fetchJsonForArtifact(input.url);
+    return {
+      id: `${input.kind}:${input.name}:${input.version}`,
+      kind: input.kind,
+      name: input.name,
+      version: input.version,
+      url: input.url,
+      ok: response.ok,
+      status: response.status,
+      ...response.ok ? {} : { message: `${input.name} ${input.version} was not found in ${input.kind}.` }
+    };
+  } catch (error) {
+    return {
+      id: `${input.kind}:${input.name}:${input.version}`,
+      kind: input.kind,
+      name: input.name,
+      version: input.version,
+      url: input.url,
+      ok: false,
+      status: null,
+      message: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function collectPublishedReleaseArtifactChecks(selectedVersions) {
+  const checks = [];
+  const npmPackages = ["@treeseed/sdk", "@treeseed/ui", "@treeseed/core", "@treeseed/admin", "@treeseed/cli", "@treeseed/agent"];
+  for (const packageName of npmPackages) {
+    const version = selectedVersions.get(packageName);
+    if (version) checks.push(await verifyNpmArtifact(packageName, version));
+  }
+  const agentVersion = selectedVersions.get("@treeseed/agent");
+  if (agentVersion) {
+    for (const image of ["treeseed/agent-manager", "treeseed/agent-runner"]) {
+      checks.push(await verifyDockerHubArtifact(image, agentVersion));
+    }
+  }
+  const apiVersion = selectedVersions.get("@treeseed/api");
+  if (apiVersion) {
+    for (const image of ["treeseed/api", "treeseed/op-runner"]) {
+      checks.push(await verifyDockerHubArtifact(image, apiVersion));
+    }
+  }
+  const treedxVersion = selectedVersions.get("treedx") ?? selectedVersions.get("@treeseed/treedx");
+  if (treedxVersion) {
+    checks.push(await verifyNpmArtifact("@treeseed/treedx", treedxVersion));
+    checks.push(await verifySimpleRegistryArtifact({
+      kind: "pypi",
+      name: "treedx",
+      version: treedxVersion,
+      url: `https://pypi.org/pypi/treedx/${treedxVersion}/json`
+    }));
+    checks.push(await verifySimpleRegistryArtifact({
+      kind: "crates",
+      name: "treedx",
+      version: treedxVersion,
+      url: `https://crates.io/api/v1/crates/treedx/${treedxVersion}`
+    }));
+    checks.push(await verifySimpleRegistryArtifact({
+      kind: "hex",
+      name: "treedx",
+      version: treedxVersion,
+      url: `https://hex.pm/api/packages/treedx/releases/${treedxVersion}`
+    }));
+    for (const image of ["treeseed/treedx", "treeseed/treedx-profiler"]) {
+      checks.push(await verifyDockerHubArtifact(image, treedxVersion));
+    }
+  }
+  return checks;
+}
+async function verifyPublishedReleaseArtifacts(selectedVersions) {
+  let checks = await collectPublishedReleaseArtifactChecks(selectedVersions);
+  const deadline = Date.now() + 5 * 60 * 1e3;
+  while (checks.some((check) => !check.ok) && Date.now() < deadline) {
+    await sleep(15e3);
+    checks = await collectPublishedReleaseArtifactChecks(selectedVersions);
+  }
+  const failures = checks.filter((check) => !check.ok);
+  if (failures.length > 0) {
+    const rendered = failures.map((check) => `${check.id}: ${check.message ?? `registry returned ${check.status ?? "unknown"}`} (${check.url})`).join("\n");
+    workflowError("release", "validation_failed", `Published release artifact verification failed.
+${rendered}`, {
+      details: { checks }
+    });
+  }
+  return { checks };
+}
 function assertSessionBranchSafety(operation, session, {
   requireCleanPackages = false,
   requireCurrentBranch = false,
@@ -5128,6 +5309,8 @@ ${blockers.join("\n")}`, {
           }),
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "production-hosting", description: "Reconcile and live-verify production hosted resources after publish", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "workspace-link", description: "Restore local workspace links after release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }
         ],
@@ -5169,8 +5352,8 @@ ${blockers.join("\n")}`, {
             version: selectedVersions.get(pkg.name) ?? null,
             result: selectedVersions.has(pkg.name) ? prepareAdapterReleaseMetadata(root, pkg, selectedVersions.get(pkg.name)) : { status: "skipped", reason: "no planned version" }
           }));
-          const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
-          const remainingDevReferences = collectInternalDevReferenceIssues(root, selectedPackageSet).filter((issue) => issue.reason !== "git-release-ref" && issue.reason !== "lockfile-git-release-ref");
+          const rootPackageLock = updatePackageLockRootVersion(root, plannedRelease.rootVersion);
+          const remainingDevReferences = collectInternalDevReferenceIssues(root, selectedPackageSet).filter((issue) => issue.reason !== "lockfile-git-release-ref");
           if (remainingDevReferences.length > 0) {
             const rendered = remainingDevReferences.map((issue) => `${issue.repoName}: ${issue.filePath} ${issue.dependencyName ?? ""} ${issue.reason} ${issue.spec}`).join("\n");
             throw new Error(`Stable release metadata still contains development references.
@@ -5179,7 +5362,7 @@ ${rendered}`);
           return {
             versions: Object.fromEntries(allVersions.entries()),
             adapterMetadata,
-            rootInstall,
+            rootPackageLock,
             workspaceUnlink
           };
         });
@@ -5187,7 +5370,7 @@ ${rendered}`);
         for (const pkg of checkedOutWorkspacePackageRepos(root).filter((entry) => selectedPackageSet.has(entry.name))) {
           const version = selectedVersions.get(pkg.name);
           if (!version) continue;
-          const packageRelease = await executeJournalStep(root, workflowRun.runId, `release-${pkg.name}`, () => {
+          const packageRelease = await executeJournalStep(root, workflowRun.runId, `release-${pkg.name}`, async () => {
             const changelog = updateReleaseChangelog(pkg.dir, {
               version,
               sourceRef: `origin/${PRODUCTION_BRANCH}`,
@@ -5204,6 +5387,19 @@ ${rendered}`);
             pushBranch(pkg.dir, STAGING_BRANCH);
             const promotion = promoteCommitToProductionBranch(pkg.dir, commit.commitSha);
             const tag = ensureReleaseTag(pkg.dir, version, commit.commitSha, `release: ${pkg.name} ${version}`);
+            const publishGate = {
+              name: pkg.name,
+              repoPath: pkg.dir,
+              workflow: releaseWorkflowForPackage(root, pkg.name),
+              branch: version,
+              headSha: commit.commitSha
+            };
+            const publishWait2 = await waitForWorkflowGates("release", [publishGate], ciMode, {
+              root,
+              runId: workflowRun.runId,
+              onProgress: (line, stream) => helpers.write(line, stream)
+            });
+            const publishedArtifacts2 = await verifyPublishedReleaseArtifacts(/* @__PURE__ */ new Map([[pkg.name, version]]));
             return {
               name: pkg.name,
               path: relative(root, pkg.dir),
@@ -5211,7 +5407,9 @@ ${rendered}`);
               changelog,
               commit,
               promotion,
-              tag
+              tag,
+              publishWait: publishWait2,
+              publishedArtifacts: publishedArtifacts2
             };
           });
           packageReleases.push(packageRelease);
@@ -5257,20 +5455,15 @@ ${rendered}`);
               environment: "prod",
               action_kind: "deploy_web"
             }
-          }),
-          ...packageReleases.map((entry) => ({
-            name: String(entry.name),
-            repoPath: resolve(root, String(entry.path)),
-            workflow: releaseWorkflowForPackage(root, String(entry.name)),
-            branch: String(entry.version),
-            headSha: String(entry.commit.commitSha ?? "")
-          }))
+          })
         ].filter((gate) => gate.headSha);
         const publishWait = await executeJournalStep(root, workflowRun.runId, "publish-wait", () => waitForWorkflowGates("release", publishGates, ciMode, {
           root,
           runId: workflowRun.runId,
           onProgress: (line, stream) => helpers.write(line, stream)
         }).then((workflowGates) => ({ workflowGates })));
+        const publishedArtifacts = await executeJournalStep(root, workflowRun.runId, "verify-published-artifacts", () => verifyPublishedReleaseArtifacts(selectedVersions));
+        const productionHosting = await executeJournalStep(root, workflowRun.runId, "production-hosting", () => reconcileSaveHostedEnvironment(root, "prod", helpers, workflowRun.runId, "release"));
         const backMerge = await executeJournalStep(root, workflowRun.runId, "release-back-merge", () => {
           const packageBackMerges = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => backMergeProductionIntoStaging(pkg.dir, pkg.name, releaseAdminMessage({
             subject: `release: back-merge ${PRODUCTION_BRANCH} into ${STAGING_BRANCH}`,
@@ -5296,6 +5489,8 @@ ${rendered}`);
           packageReleases,
           rootRelease,
           publishWait: publishWait.workflowGates,
+          publishedArtifacts,
+          productionHosting,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.5",
+  "version": "0.12.6",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {