@treeseed/sdk 0.12.54 → 0.12.56

package/dist/operations/services/live-hosted-service-checks.js

@@ -12,7 +12,11 @@ import {
   normalizeRailwayEnvironmentName,
   resolveRailwayWorkspaceContext
 } from "./railway-api.js";
-import { configuredRailwayServices, findStaleTreeseedOperationsRunnerResources } from "./railway-deploy.js";
+import {
+  configuredRailwayServices,
+  findStaleTreeseedOperationsRunnerResources,
+  isTreeseedOperationsRunnerResourceName
+} from "./railway-deploy.js";
 import { discoverTreeseedApplications } from "../../hosting/apps.js";
 import {
   collectTreeseedHostedServiceChecks
@@ -235,6 +239,8 @@ async function collectRailwayObservations(options) {
     const workspace = await resolveRailwayWorkspaceContext({ env: options.env, fetchImpl: options.fetchImpl });
     const projects = await listRailwayProjects({ workspaceId: workspace.id, env: options.env, fetchImpl: options.fetchImpl });
     const configuredServices = configuredRailwayServices(options.tenantRoot, options.target, options.env).filter((entry) => serviceMatchesAppSelection(entry, options.tenantRoot, options.appId, applications)).filter((entry) => serviceIsSelected(selectedServiceKeys, entry.key));
+    const siblingTarget = options.target === "staging" ? "prod" : options.target === "prod" ? "staging" : null;
+    const configuredSiblingServices = siblingTarget ? configuredRailwayServices(options.tenantRoot, siblingTarget, options.env, { identityOnly: true }).filter((entry) => entry.enabled !== false).filter((entry) => entry.key === "operationsRunner") : [];
     if (selectedServiceKeys.size === 0 || selectedServiceKeys.has("api") || selectedServiceKeys.has("operationsRunner")) {
       for (const descriptor of treeseedDatabaseDescriptors(options.tenantRoot, options)) {
         await verifyRailwayPostgresTopology({ descriptor, configuredServices, projects, options, issues });
@@ -278,7 +284,10 @@ async function collectRailwayObservations(options) {
       const runnerScope = `${project.id}:${environment.id}`;
       if (service.key === "operationsRunner" && !inspectedRunnerScopes.has(runnerScope)) {
         inspectedRunnerScopes.add(runnerScope);
-        const desiredRunnerNames = new Set(configuredServices.filter((entry) => entry.key === "operationsRunner").filter((entry) => entry.projectId ? entry.projectId === project.id : entry.projectName === project.name).filter((entry) => normalizeRailwayEnvironmentName(entry.railwayEnvironment) === normalizeRailwayEnvironmentName(environment.name)).map((entry) => entry.serviceName).filter(Boolean));
+        const desiredRunnerNames = /* @__PURE__ */ new Set([
+          ...configuredServices.filter((entry) => entry.key === "operationsRunner").filter((entry) => entry.projectId ? entry.projectId === project.id : entry.projectName === project.name).filter((entry) => normalizeRailwayEnvironmentName(entry.railwayEnvironment) === normalizeRailwayEnvironmentName(environment.name)).map((entry) => entry.serviceName).filter(Boolean),
+          ...configuredSiblingServices.filter((entry) => entry.projectId ? entry.projectId === project.id : entry.projectName === project.name).map((entry) => entry.serviceName).filter((name) => Boolean(name) && isTreeseedOperationsRunnerResourceName(name))
+        ]);
         const desiredRunnerServiceIds = new Set(services.filter((entry) => desiredRunnerNames.has(entry.name)).map((entry) => entry.id));
         for (const staleService of findStaleTreeseedOperationsRunnerResources(services, desiredRunnerNames)) {
           issues.push(`${staleService.name}: stale operations runner Railway service remains in project ${project.name}.`);

package/dist/operations/services/railway-deploy.d.ts

@@ -59,7 +59,7 @@ export declare function waitForRailwayManagedDeploymentsSettled(tenantRoot: any,
     };
     message: string;
 }>;
-export declare function configuredRailwayServices(tenantRoot: any, scope: any, envOverlay?: {}): unknown[];
+export declare function configuredRailwayServices(tenantRoot: any, scope: any, envOverlay?: {}, options?: {}): unknown[];
 export declare function configuredRailwayScheduledJobs(tenantRoot: any, scope: any, { phase }?: {
     phase?: string | undefined;
 }): any[];

package/dist/operations/services/railway-deploy.js

@@ -641,8 +641,9 @@ query TreeseedRailwayDeploymentStatus($projectId: String!) {
   });
   return payload.data?.project ?? null;
 }
-function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, application = null, machineConfigRoot = tenantRoot, envOverlay = {}) {
+function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, application = null, machineConfigRoot = tenantRoot, envOverlay = {}, options = {}) {
   const normalizedScope = normalizeScope(scope);
+  const identityOnly = options.identityOnly === true;
   const imageRefKeys = [
     "TREESEED_API_IMAGE_REF",
     "TREESEED_OPERATIONS_RUNNER_IMAGE_REF",
@@ -702,7 +703,13 @@ function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, app
       const configuredImageRefEnv = service.railway?.imageRefEnv ?? railwayImageRefEnvForService(serviceKey);
       const canUseImageRefEnv = normalizedScope === "prod" || serviceKey === "capacityProviderManager" || serviceKey === "capacityProviderRunner";
       const imageRef = service.railway?.imageRef ?? (canUseImageRefEnv && configuredImageRefEnv ? envValue(configuredImageRefEnv, imageRefEnv) || null : null) ?? defaultRailwayImageRef(serviceKey, normalizedScope, imageRefEnv);
-      const sourcePolicy = resolveRailwayServiceSourcePolicy({
+      const sourcePolicy = identityOnly ? {
+        sourceMode: normalizedScope === "prod" ? "image" : "git",
+        sourceRepo: null,
+        sourceBranch: null,
+        sourceCommit: null,
+        sourceRootDirectory: null
+      } : resolveRailwayServiceSourcePolicy({
         tenantRoot,
         scope: normalizedScope,
         serviceKey,
@@ -760,11 +767,12 @@ function configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, app
       hostingKind,
       application,
       imageRefEnv,
-      workspaceRoot: machineConfigRoot
+      workspaceRoot: machineConfigRoot,
+      identityOnly
     })
   ];
 }
-function configuredPublicTreeDxRailwayServices({ tenantRoot, scope, deployConfig, identity, hostingKind, application, imageRefEnv, workspaceRoot }) {
+function configuredPublicTreeDxRailwayServices({ tenantRoot, scope, deployConfig, identity, hostingKind, application, imageRefEnv, workspaceRoot, identityOnly = false }) {
   if (deployConfig.hosting?.kind !== "treeseed_control_plane") {
     return [];
   }
@@ -803,7 +811,9 @@ function configuredPublicTreeDxRailwayServices({ tenantRoot, scope, deployConfig
       buildCommand: sourceMode === "git" ? railway.buildCommand ?? null : null,
       startCommand: sourceMode === "git" ? railway.startCommand ?? null : null
     };
-    assertApiRailwaySourcePolicy(scope, service);
+    if (!identityOnly) {
+      assertApiRailwaySourcePolicy(scope, service);
+    }
     return {
       key: service.key,
       instanceKey: serviceName,
@@ -957,9 +967,9 @@ function resolveRailwayCapacityProviderRoot(tenantRoot, service) {
   );
   return found ?? resolve(tenantRoot, "packages", "agent");
 }
-function configuredRailwayServices(tenantRoot, scope, envOverlay = {}) {
+function configuredRailwayServices(tenantRoot, scope, envOverlay = {}, options = {}) {
   const deployConfig = loadCliDeployConfig(tenantRoot);
-  const direct = configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, null, tenantRoot, envOverlay);
+  const direct = configuredRailwayServicesForConfig(tenantRoot, scope, deployConfig, null, tenantRoot, envOverlay, options);
   const nested = discoverTreeseedApplications(tenantRoot).filter((application) => application.root !== resolve(tenantRoot)).flatMap((application) => configuredRailwayServicesForConfig(
     application.root,
     scope,
@@ -970,7 +980,8 @@ function configuredRailwayServices(tenantRoot, scope, envOverlay = {}) {
       relativeRoot: application.relativeRoot
     },
     tenantRoot,
-    envOverlay
+    envOverlay,
+    options
   ));
   return [...direct, ...nested];
 }

package/dist/reconcile/builtin-adapters.js

@@ -42,6 +42,7 @@ import {
 import {
   configuredRailwayServices,
   findStaleTreeseedOperationsRunnerResources,
+  isTreeseedOperationsRunnerResourceName,
   validateRailwayDeployPrerequisites
 } from "../operations/services/railway-deploy.js";
 import { shouldExposeManagedHostRuntimeSecret } from "../operations/services/managed-host-security.js";
@@ -54,6 +55,7 @@ import {
   ensureRailwayServiceVolume,
   ensureRailwayPostgresService,
   deleteRailwayService,
+  deleteRailwayCustomDomain,
   deleteRailwayVolume,
   deployRailwayServiceInstance,
   inspectRailwayServiceDeploymentHealth,
@@ -2372,6 +2374,48 @@ async function ensureRailwayCustomDomain(input, service, domain, env, identifier
   if (matched) {
     return matched;
   }
+  const environmentServices = await listRailwayEnvironmentServices({
+    environmentId: identifiers.environmentId,
+    env
+  });
+  for (const candidate of environmentServices) {
+    const candidateServiceId = typeof candidate.id === "string" ? candidate.id.trim() : "";
+    if (!candidateServiceId || candidateServiceId === identifiers.serviceId) {
+      continue;
+    }
+    const candidateDomains = await listRailwayCustomDomains({
+      projectId: identifiers.projectId,
+      environmentId: identifiers.environmentId,
+      serviceId: candidateServiceId,
+      env
+    });
+    const staleAttachment = candidateDomains.find((entry) => entry.domain === domain) ?? null;
+    if (!staleAttachment) {
+      continue;
+    }
+    if (!staleAttachment.id) {
+      throw new Error(`Railway custom domain ${domain} is attached to service ${candidateServiceId}, but Railway did not return its domain id for exact-state reattachment.`);
+    }
+    await deleteRailwayCustomDomain({ domainId: staleAttachment.id, env });
+    let detached = false;
+    for (let attempt = 0; attempt < 12; attempt += 1) {
+      const remaining = await listRailwayCustomDomains({
+        projectId: identifiers.projectId,
+        environmentId: identifiers.environmentId,
+        serviceId: candidateServiceId,
+        env
+      });
+      if (!remaining.some((entry) => entry.domain === domain)) {
+        detached = true;
+        break;
+      }
+      await new Promise((resolve2) => setTimeout(resolve2, 1e3));
+    }
+    if (!detached) {
+      throw new Error(`Railway custom domain ${domain} remained attached to service ${candidateServiceId} after deletion.`);
+    }
+    break;
+  }
   const ensured = await ensureRailwayCustomDomainViaApi({
     projectId: identifiers.projectId,
     environmentId: identifiers.environmentId,
@@ -3657,6 +3701,24 @@ function configuredRailwayProjectSyncGroups(input, scope, serviceKeys) {
   }
   return [...grouped.values()];
 }
+function configuredRailwaySiblingResourceNames(input, scope, projectName) {
+  const siblingScope = scope === "prod" ? "staging" : scope === "staging" ? "prod" : null;
+  if (!siblingScope) return [];
+  const siblingServices = configuredRailwayServices(
+    input.context.tenantRoot,
+    siblingScope,
+    resolveReconcileEnvironmentValues(input, siblingScope),
+    { identityOnly: true }
+  ).filter((service) => service.enabled !== false).filter((service) => !isRailwayCapacityProviderService(service)).filter((service) => service.projectName === projectName);
+  const database = configuredRailwayIacDatabase(input, siblingServices);
+  return [.../* @__PURE__ */ new Set([
+    ...siblingServices.flatMap((service) => [
+      service.serviceName,
+      ...service.volumeMountPath ? [`${service.serviceName}-volume`] : []
+    ]),
+    ...database ? [database.serviceName, `${database.serviceName}-volume`] : []
+  ])];
+}
 function railwayIacServiceInput(input, sync, service, scope) {
   if (scope === "staging" && service.imageRef) {
     throw new Error(`Railway staging service ${service.serviceName} must build from Git source, not Docker image ${service.imageRef}.`);
@@ -3766,13 +3828,16 @@ async function reconcileStaleOperationsRunnerResourcesForScope(input, topology)
   );
   const projects = new Map(projectEntries.map((entry) => [entry.project.id, entry]));
   for (const { project, environment } of projects.values()) {
+    const siblingResourceNames = configuredRailwaySiblingResourceNames(input, scope, project.name);
+    const retainedSiblingServiceNames = siblingResourceNames.filter((name) => !name.endsWith("-volume")).filter(isTreeseedOperationsRunnerResourceName);
+    const retainedSiblingVolumeNames = siblingResourceNames.filter((name) => name.endsWith("-volume")).filter(isTreeseedOperationsRunnerResourceName);
     await reconcileStaleOperationsRunnerResourcesForProject(input, {
       scope,
       env: topology.env,
       project,
       environment,
-      desiredServiceNames,
-      desiredVolumeNames
+      desiredServiceNames: /* @__PURE__ */ new Set([...desiredServiceNames, ...retainedSiblingServiceNames]),
+      desiredVolumeNames: /* @__PURE__ */ new Set([...desiredVolumeNames, ...retainedSiblingVolumeNames])
     });
   }
 }
@@ -3931,11 +3996,13 @@ async function syncRailwayEnvironmentForScope(input, { planOnly = false, service
       })),
       database: databaseForIac
     };
+    const siblingResourceNames = configuredRailwaySiblingResourceNames(input, scope, project.name);
     const {
       applyRailwayIacProject,
       cleanupRailwayIacRender,
       planRailwayIacProject,
       renderRailwayIacProject,
+      selectRailwayIacRetainedResources,
       validateRailwayIacChangeSet
     } = await import("./providers/railway-iac.js");
     let effectiveIacInput = iacInput;
@@ -3986,6 +4053,33 @@ async function syncRailwayEnvironmentForScope(input, { planOnly = false, service
           ]))
         });
       }
+      const retainedResources = selectRailwayIacRetainedResources(plan, siblingResourceNames);
+      if (retainedResources.length > 0) {
+        traceRailwayReconcile(
+          topology.env,
+          "sync:iac-retain-sibling-environment",
+          `${project.name}/${environment.name}:${retainedResources.map((resource) => resource.name).join(",")}`
+        );
+        cleanupRailwayIacRender(rendered);
+        effectiveIacInput = { ...effectiveIacInput, retainedResources };
+        rendered = renderRailwayIacProject(effectiveIacInput);
+        plan = await planRailwayIacProject(effectiveIacInput, rendered);
+        if (!plan.ok) {
+          const diagnostics = plan.diagnostics.map((entry) => entry.message).filter(Boolean).join("; ");
+          throw new Error(`Railway IaC plan failed for ${project.name}/${environment.name}${diagnostics ? `: ${diagnostics}` : "."}`);
+        }
+        validation = validateRailwayIacChangeSet(plan.changeSet, {
+          services: rendered.serviceNames,
+          volumes: rendered.volumeNames,
+          database: rendered.databaseName,
+          scope,
+          serviceSourceModes: Object.fromEntries(effectiveIacInput.services.map((service) => [service.serviceName, service.sourceMode ?? null])),
+          serviceSourceRefs: Object.fromEntries(effectiveIacInput.services.map((service) => [
+            service.serviceName,
+            service.sourceMode === "git" && service.sourceRepo ? `github:${service.sourceRepo}:${service.sourceBranch ?? ""}:${service.sourceRootDirectory ?? ""}:${service.sourceCommit ?? ""}` : service.sourceMode === "image" && service.imageRef ? `image:${service.imageRef}` : null
+          ]))
+        });
+      }
       if (!validation.ok) {
         throw new Error(`Railway IaC plan rejected for ${project.name}/${environment.name}: ${validation.blockedReasons.join("; ")}`);
       }

package/dist/reconcile/providers/railway-iac.d.ts

@@ -1,4 +1,4 @@
-import { type RailwayChangeSet, type RailwayIacApplyResponse, type RailwayIacPlanResponse } from 'railway/iac';
+import { type RailwayChangeSet, type RailwayIacApplyResponse, type RailwayIacPlanResponse, type ResourceNode } from 'railway/iac';
 export type TreeseedRailwayIacService = {
     key: string;
     serviceName: string;
@@ -37,6 +37,7 @@ export type TreeseedRailwayIacProjectInput = {
     railwayApiUrl?: string | null;
     services: TreeseedRailwayIacService[];
     database: TreeseedRailwayIacDatabase | null;
+    retainedResources?: ResourceNode[];
     region?: string | null;
 };
 export type TreeseedRailwayIacRenderResult = {
@@ -47,6 +48,7 @@ export type TreeseedRailwayIacRenderResult = {
     serviceNames: string[];
     volumeNames: string[];
     databaseName: string | null;
+    retainedResourceNames: string[];
     source: string;
 };
 export type RailwayIacValidationResult = {
@@ -56,6 +58,7 @@ export type RailwayIacValidationResult = {
     allowedDrift: string[];
 };
 export declare function renderRailwayIacProject(input: TreeseedRailwayIacProjectInput): TreeseedRailwayIacRenderResult;
+export declare function selectRailwayIacRetainedResources(plan: Pick<RailwayIacPlanResponse, 'changeSet' | 'currentGraph'>, allowedNames: Iterable<string>): ResourceNode[];
 export declare function validateRailwayIacChangeSet(changeSet: RailwayChangeSet | undefined, desiredNames: {
     services: string[];
     volumes: string[];

package/dist/reconcile/providers/railway-iac.js

@@ -1,6 +1,8 @@
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { runRailwayIac } from "railway/iac";
+import {
+  runRailwayIac
+} from "railway/iac";
 import { assertApiRailwaySourcePolicy, isApiRailwaySourcePolicyService } from "../../operations/services/railway-source-policy.js";
 function js(value) {
   return JSON.stringify(value);
@@ -115,6 +117,16 @@ function renderRailwayIacProject(input) {
   const volumeNames = [];
   const databaseVariableName = input.database ? "db" : null;
   const databaseEnvName = input.database?.environmentVariable ?? null;
+  const desiredResourceNames = /* @__PURE__ */ new Set([
+    ...input.services.map((service) => service.serviceName),
+    ...input.services.filter((service) => service.volumeMountPath).map((service) => `${service.serviceName}-volume`),
+    ...input.database ? [input.database.serviceName, `${input.database.serviceName}-volume`] : []
+  ]);
+  const retainedResources = (input.retainedResources ?? []).filter((resource) => !desiredResourceNames.has(resource.name));
+  if (retainedResources.length > 0) {
+    declarations.push(`  const retainedResources = ${js(retainedResources)};`);
+    resources.push("...retainedResources");
+  }
   if (input.database) {
     const postgresVolumeName = `${input.database.serviceName}-volume`;
     const postgresMountPath = input.database.mountPath?.trim() || "/var/lib/postgresql/data";
@@ -205,9 +217,15 @@ ${declarations.join("\n")}
     serviceNames: input.services.map((service) => service.serviceName),
     volumeNames,
     databaseName: input.database?.serviceName ?? null,
+    retainedResourceNames: retainedResources.map((resource) => resource.name),
     source
   };
 }
+function selectRailwayIacRetainedResources(plan, allowedNames) {
+  const allowed = new Set(allowedNames);
+  const deletedAllowedNames = new Set((plan.changeSet?.changes ?? []).filter((change) => change.kind === "resource.delete").map((change) => changeName(change)).filter((name) => allowed.has(name)));
+  return (plan.currentGraph?.resources ?? []).filter((resource) => deletedAllowedNames.has(resource.name));
+}
 function changeName(change) {
   return String(change?.resource?.name ?? change?.previous?.name ?? change?.address ?? change?.path ?? "");
 }
@@ -322,5 +340,6 @@ export {
   cleanupRailwayIacRender,
   planRailwayIacProject,
   renderRailwayIacProject,
+  selectRailwayIacRetainedResources,
   validateRailwayIacChangeSet
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.54",
+  "version": "0.12.56",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {