@treeseed/sdk 0.12.56 → 0.12.59

package/dist/operations/services/package-reference-policy.d.ts

@@ -40,11 +40,11 @@ export declare function rewriteInternalDependenciesToStableVersions(root: any, v
     repoName: string;
     packageJsonPath: string;
 })[];
-export declare function rewriteProjectInternalDependenciesToStableVersions(root: any, versions: Map<string, string>): (RewrittenDevReference & {
+export declare function rewriteProjectInternalDependenciesToStableVersions(root: any, versions: Map<string, string>, targetPackageNames?: ReadonlySet<string>): (RewrittenDevReference & {
     repoName: string;
     packageJsonPath: string;
 })[];
-export declare function collectInternalDevReferenceIssues(root?: any, packageNames?: Set<any>): {
+export declare function collectInternalDevReferenceIssues(root?: any, packageNames?: Set<any>, targetPackageNames?: ReadonlySet<string>): {
     repoName: string;
     filePath: string;
     field?: string;

package/dist/operations/services/package-reference-policy.js

@@ -182,12 +182,12 @@ function rewriteInternalDependenciesToStableVersions(root = workspaceRoot(), ver
   }
   return rewrites;
 }
-function rewriteProjectInternalDependenciesToStableVersions(root = workspaceRoot(), versions) {
+function rewriteProjectInternalDependenciesToStableVersions(root = workspaceRoot(), versions, targetPackageNames) {
   const rewrites = [];
   const installableVersions = installableInternalDependencyVersions(root, versions);
   const targets = [
     { name: "@treeseed/market", dir: root },
-    ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))
+    ...workspacePackages(root).filter((pkg) => !targetPackageNames || targetPackageNames.has(pkg.name)).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))
   ];
   for (const target of targets) {
     const packageJsonPath = resolve(target.dir, "package.json");
@@ -216,11 +216,12 @@ function rewriteProjectInternalDependenciesToStableVersions(root = workspaceRoot
   }
   return rewrites;
 }
-function collectInternalDevReferenceIssues(root = workspaceRoot(), packageNames = new Set(workspacePackages(root).map((pkg) => pkg.name))) {
+function collectInternalDevReferenceIssues(root = workspaceRoot(), packageNames = new Set(workspacePackages(root).map((pkg) => pkg.name)), targetPackageNames) {
   const issues = [];
+  const workspaceTargets = workspacePackages(root).filter((pkg) => !targetPackageNames || targetPackageNames.has(pkg.name)).map((pkg) => ({ name: pkg.name, dir: pkg.dir }));
   const manifestRoots = [
     { name: "@treeseed/market", dir: root },
-    ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))
+    ...workspaceTargets
   ];
   for (const pkg of manifestRoots) {
     const packageJsonPath = resolve(pkg.dir, "package.json");
@@ -239,7 +240,7 @@ function collectInternalDevReferenceIssues(root = workspaceRoot(), packageNames
       }
     }
   }
-  const lockRoots = [{ name: "@treeseed/market", dir: root }, ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))];
+  const lockRoots = [{ name: "@treeseed/market", dir: root }, ...workspaceTargets];
   for (const lockRoot of lockRoots) {
     for (const lockName of ["package-lock.json", "npm-shrinkwrap.json"]) {
       const lockPath = resolve(lockRoot.dir, lockName);

package/dist/operations/services/repository-save-orchestrator.js

@@ -944,9 +944,10 @@ async function runGitDependencySmoke(node, options, reference) {
   void reference;
 }
 async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs = []) {
-  if (shouldSkipNetworkInstall()) {
-    emitProgress(options, node, "install", "Skipped npm install because network install mode is disabled.");
-    return { status: "skipped", attempts: 0, reason: "disabled" };
+  if (shouldSkipNetworkInstall() || options.deferPushUntilVerified === true) {
+    const reason = options.deferPushUntilVerified === true ? "atomic-save" : "disabled";
+    emitProgress(options, node, "install", `Skipped npm install because ${reason === "atomic-save" ? "atomic save validates local lock metadata before publishing commits" : "network install mode is disabled"}.`);
+    return { status: "skipped", attempts: 0, reason };
   }
   let lastError = null;
   const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
@@ -1030,9 +1031,10 @@ async function validateRepositoryLockfile(node, options) {
   }
   const { command, args } = lockfileValidationCommand(node, options);
   const commandText = `${command} ${args.join(" ")}`;
-  if (shouldSkipNetworkInstall()) {
-    emitProgress(options, node, "lockfile", `Skipped ${commandText} because network install mode is disabled.`);
-    return { status: "skipped", command: commandText, issues: [], error: "disabled" };
+  if (shouldSkipNetworkInstall() || options.deferPushUntilVerified === true) {
+    const reason = options.deferPushUntilVerified === true ? "atomic-save" : "disabled";
+    emitProgress(options, node, "lockfile", `Validated lockfile structure without ${commandText} because ${reason === "atomic-save" ? "upstream commits are intentionally unpublished" : "network install mode is disabled"}.`);
+    return { status: "passed", command: "treeseed structural lockfile validation", issues: [], error: null };
   }
   try {
     runCapturedCommand(node, options, "lockfile", command, args, { timeoutMs: lockfileValidationTimeoutMs(node, options), emitOutputOnSuccess: false });
@@ -1773,8 +1775,9 @@ async function saveOneRepository(node, options, state) {
     return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : [];
   }));
   const gitDependencyRefreshReferences = [...state.finalizedReferences.values()].filter((reference) => reference.mode === "dev-git-commit" && directDependencyNames.has(reference.packageName));
+  const deferredGitDependencyValidation = options.deferPushUntilVerified === true && gitDependencyRefreshReferences.length > 0;
   const lockfileGitDependenciesSynced = syncDirectGitDependencyLockfileEntries(node, options, gitDependencyRefreshReferences);
-  if (!isRootWorkspaceRepository(node, options) && (lockfileGitDependenciesSynced || gitDependencyRefreshReferences.length > 0 && !existsSync(resolve(node.path, "package-lock.json")))) {
+  if (!isRootWorkspaceRepository(node, options) && (lockfileGitDependenciesSynced || gitDependencyRefreshReferences.length > 0 && !existsSync(resolve(node.path, "package-lock.json"))) && !deferredGitDependencyValidation) {
     validateStandaloneGitDependencyLockfile(node, options);
   }
   const gitDependencyRefreshSpecs = lockfileGitDependenciesSynced ? [] : gitDependencyRefreshReferences.map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
@@ -1809,7 +1812,7 @@ async function saveOneRepository(node, options, state) {
   } else if (node.kind === "project" && (dependencyChanged || node.path === options.root && submodulesChanged) && hasNpmLockfile(node.path)) {
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   }
-  if (!isRootWorkspaceRepository(node, options) && hasNpmLockfile(node.path) && (packageNeedsVersion || dependencyChanged)) {
+  if (!isRootWorkspaceRepository(node, options) && hasNpmLockfile(node.path) && (packageNeedsVersion || dependencyChanged) && !deferredGitDependencyValidation) {
     validateStandaloneGitDependencyLockfile(node, options);
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || packageNeedsVersion || dependencyChanged || submodulesChanged)) {

package/dist/workflow/operations.d.ts

@@ -1144,6 +1144,10 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
             cached: boolean;
         }[];
     };
+    productionImageRefs: {
+        persisted: Record<string, string>;
+        readiness: import("../workflow-support.js").TreeseedDeploymentReadinessReport;
+    };
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -17,6 +17,7 @@ import {
   applyTreeseedSafeRepairs,
   assertTreeseedCommandEnvironment,
   checkTreeseedProviderConnections,
+  collectTreeseedEnvironmentContext,
   collectTreeseedConfigContext,
   collectTreeseedConfigSeedValues,
   collectTreeseedPrintEnvReport,
@@ -33,6 +34,7 @@ import {
   resolveTreeseedRemoteSession,
   rotateTreeseedMachineKey,
   setTreeseedRemoteSession,
+  setTreeseedMachineEnvironmentValue,
   writeTreeseedMachineConfig
 } from "../operations/services/config-runtime.js";
 import { formatTreeseedDependencyFailureDetails, installTreeseedDependencies } from "../managed-dependencies.js";
@@ -746,6 +748,20 @@ function productionReleaseImageRefVersions(root, selectedVersions) {
   }
   return versions;
 }
+function persistProductionReleaseImageRefs(root, releaseImageRefs) {
+  const registry = collectTreeseedEnvironmentContext(root);
+  const entries = new Map(registry.entries.map((entry) => [entry.id, entry]));
+  const persisted = {};
+  for (const [id, value] of Object.entries(releaseImageRefs)) {
+    const entry = entries.get(id) ?? { id, storage: "scoped", sensitivity: "plain" };
+    if (entry.sensitivity === "secret") {
+      workflowError("release", "validation_failed", `Production release image ref ${id} must be a non-secret environment value.`);
+    }
+    setTreeseedMachineEnvironmentValue(root, "prod", entry, value);
+    persisted[id] = value;
+  }
+  return persisted;
+}
 function stableVersionLine(version) {
   const match = version.match(/^(\d+\.\d+)\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
   return match?.[1] ?? null;
@@ -1194,8 +1210,12 @@ function updatePackageLockRootVersion(root, version) {
   }
   return { status: changed ? "updated" : "unchanged", path: "package-lock.json" };
 }
-function applyStableWorkspaceVersionChanges(root, versions) {
-  for (const target of [{ name: "@treeseed/market", dir: root }, ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))]) {
+function applyStableWorkspaceVersionChanges(root, versions, targetPackageNames) {
+  const targets = [
+    { name: "@treeseed/market", dir: root },
+    ...workspacePackages(root).filter((pkg) => targetPackageNames.has(pkg.name)).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))
+  ];
+  for (const target of targets) {
     const packageJsonPath = resolve(target.dir, "package.json");
     if (!existsSync(packageJsonPath)) continue;
     const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf8"));
@@ -1220,7 +1240,7 @@ function applyStableWorkspaceVersionChanges(root, versions) {
       writeJsonFile(packageJsonPath, packageJson);
     }
   }
-  rewriteProjectInternalDependenciesToStableVersions(root, versions);
+  rewriteProjectInternalDependenciesToStableVersions(root, versions, targetPackageNames);
 }
 function gitObjectCommit(repoDir, ref) {
   try {
@@ -2221,7 +2241,7 @@ function runReleaseNpmInstall(repoDir, options = {}) {
   if (shouldSkipReleaseInstall()) {
     return { status: "skipped", reason: "disabled" };
   }
-  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
+  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
   const spawnCommand = npmCommandForWorkflowSpawn(args);
   let lastDetail = "";
   for (let attempt = 1; attempt <= 10; attempt += 1) {
@@ -4718,7 +4738,7 @@ async function workflowSave(helpers, input) {
               verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
               commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
               workflowRunId: workflowRun.runId,
-              deferPushUntilVerified: false,
+              deferPushUntilVerified: true,
               onProgress: (line, stream) => helpers.write(line, stream),
               onWaveSaved: branch === STAGING_BRANCH && shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? async ({ nodes, reports, rootRepo: waveRootRepo }) => {
                 const nonRootReportsForWave = reports.filter((repo, index) => nodes[index]?.id !== ".");
@@ -5691,10 +5711,12 @@ ${currentBlockers.map((entry) => `- ${entry}`).join("\n")}`, {
           { root, runId: workflowRun.runId, onProgress: (line, stream) => helpers.write(line, stream) }
         )) : (skipJournalStep(root, workflowRun.runId, "hosted-ci", { skippedReason: "ci off" }), { status: "skipped", reason: "ci off" });
         const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link-restore", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
-        for (const repo of checkedOutStagePromotionRepos(root)) {
-          syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+        if (!managedWorkflowWorktreeMetadata(root)) {
+          for (const repo of checkedOutStagePromotionRepos(root)) {
+            syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+          }
+          syncBranchWithOrigin(repoRoot(root), STAGING_BRANCH);
         }
-        syncBranchWithOrigin(repoRoot(root), STAGING_BRANCH);
         const cleanup = cleanupMode === "success" ? await executeJournalStep(root, workflowRun.runId, "cleanup-source", () => cleanupStageSourceBranches(root, featureBranch, typedManifest)) : (skipJournalStep(root, workflowRun.runId, "cleanup-source", { skippedReason: "manual cleanup selected" }), { status: "skipped", reason: "manual cleanup selected" });
         const payload = {
           ...basePayload,
@@ -5996,6 +6018,7 @@ ${blockers.join("\n")}`, {
           },
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "persist-production-image-refs", description: "Persist released production image refs and verify deployment readiness", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
@@ -6038,14 +6061,14 @@ ${blockers.join("\n")}`, {
         });
         const workspaceUnlink = await executeJournalStep(root, workflowRun.runId, "workspace-unlink", () => unlinkWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
         const releaseMetadata = await executeJournalStep(root, workflowRun.runId, "prepare-release-metadata", () => {
-          applyStableWorkspaceVersionChanges(root, allVersions);
+          applyStableWorkspaceVersionChanges(root, allVersions, selectedPackageSet);
           const adapterMetadata = checkedOutWorkspacePackageRepos(root).filter((pkg) => selectedPackageSet.has(pkg.name)).map((pkg) => ({
             name: pkg.name,
             version: selectedVersions.get(pkg.name) ?? null,
             result: selectedVersions.has(pkg.name) ? { status: "pending-package-release-step" } : { status: "skipped", reason: "no planned version" }
           }));
           const rootPackageLock = updatePackageLockRootVersion(root, plannedRelease.rootVersion);
-          const remainingDevReferences = collectInternalDevReferenceIssues(root, selectedPackageSet).filter((issue) => !issue.reason.startsWith("lockfile-"));
+          const remainingDevReferences = collectInternalDevReferenceIssues(root, selectedPackageSet, selectedPackageSet).filter((issue) => !issue.reason.startsWith("lockfile-"));
           if (remainingDevReferences.length > 0) {
             const rendered = remainingDevReferences.map((issue) => `${issue.repoName}: ${issue.filePath} ${issue.dependencyName ?? ""} ${issue.reason} ${issue.spec}`).join("\n");
             throw new Error(`Stable release metadata still contains development references.
@@ -6128,6 +6151,26 @@ ${rendered}`);
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates }));
         });
+        const productionImageRefs = await executeJournalStep(root, workflowRun.runId, "persist-production-image-refs", async () => {
+          const persisted = persistProductionReleaseImageRefs(root, releaseImageRefs);
+          if (helpers.context.env) {
+            Object.assign(helpers.context.env, persisted);
+            Object.assign(process.env, persisted);
+          }
+          const readiness = await withContextEnv(persisted, () => collectTreeseedDeploymentReadiness({
+            tenantRoot: root,
+            environment: "prod",
+            appId: singleSelectedWorkflowAppId(plannedRelease.applicationSelection)
+          }));
+          const failures = readiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`);
+          if (failures.length > 0) {
+            workflowError("release", "hosted_live_verification_failed", `Production readiness failed after persisting released image refs:
+${failures.join("\n")}`, {
+              details: { releaseImageRefs: persisted, readiness }
+            });
+          }
+          return { persisted, readiness };
+        });
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
@@ -6201,6 +6244,7 @@ ${rendered}`);
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionPackageDeployWorkflows,
+          productionImageRefs,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.56",
+  "version": "0.12.59",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {