@treeseed/sdk 0.12.58 → 0.12.59

package/dist/operations/services/repository-save-orchestrator.js

@@ -944,9 +944,10 @@ async function runGitDependencySmoke(node, options, reference) {
   void reference;
 }
 async function runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs = []) {
-  if (shouldSkipNetworkInstall()) {
-    emitProgress(options, node, "install", "Skipped npm install because network install mode is disabled.");
-    return { status: "skipped", attempts: 0, reason: "disabled" };
+  if (shouldSkipNetworkInstall() || options.deferPushUntilVerified === true) {
+    const reason = options.deferPushUntilVerified === true ? "atomic-save" : "disabled";
+    emitProgress(options, node, "install", `Skipped npm install because ${reason === "atomic-save" ? "atomic save validates local lock metadata before publishing commits" : "network install mode is disabled"}.`);
+    return { status: "skipped", attempts: 0, reason };
   }
   let lastError = null;
   const packageJson = node.packageJson ?? (existsSync(resolve(node.path, "package.json")) ? readJson(resolve(node.path, "package.json")) : null);
@@ -1030,9 +1031,10 @@ async function validateRepositoryLockfile(node, options) {
   }
   const { command, args } = lockfileValidationCommand(node, options);
   const commandText = `${command} ${args.join(" ")}`;
-  if (shouldSkipNetworkInstall()) {
-    emitProgress(options, node, "lockfile", `Skipped ${commandText} because network install mode is disabled.`);
-    return { status: "skipped", command: commandText, issues: [], error: "disabled" };
+  if (shouldSkipNetworkInstall() || options.deferPushUntilVerified === true) {
+    const reason = options.deferPushUntilVerified === true ? "atomic-save" : "disabled";
+    emitProgress(options, node, "lockfile", `Validated lockfile structure without ${commandText} because ${reason === "atomic-save" ? "upstream commits are intentionally unpublished" : "network install mode is disabled"}.`);
+    return { status: "passed", command: "treeseed structural lockfile validation", issues: [], error: null };
   }
   try {
     runCapturedCommand(node, options, "lockfile", command, args, { timeoutMs: lockfileValidationTimeoutMs(node, options), emitOutputOnSuccess: false });
@@ -1773,8 +1775,9 @@ async function saveOneRepository(node, options, state) {
     return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value) : [];
   }));
   const gitDependencyRefreshReferences = [...state.finalizedReferences.values()].filter((reference) => reference.mode === "dev-git-commit" && directDependencyNames.has(reference.packageName));
+  const deferredGitDependencyValidation = options.deferPushUntilVerified === true && gitDependencyRefreshReferences.length > 0;
   const lockfileGitDependenciesSynced = syncDirectGitDependencyLockfileEntries(node, options, gitDependencyRefreshReferences);
-  if (!isRootWorkspaceRepository(node, options) && (lockfileGitDependenciesSynced || gitDependencyRefreshReferences.length > 0 && !existsSync(resolve(node.path, "package-lock.json")))) {
+  if (!isRootWorkspaceRepository(node, options) && (lockfileGitDependenciesSynced || gitDependencyRefreshReferences.length > 0 && !existsSync(resolve(node.path, "package-lock.json"))) && !deferredGitDependencyValidation) {
     validateStandaloneGitDependencyLockfile(node, options);
   }
   const gitDependencyRefreshSpecs = lockfileGitDependenciesSynced ? [] : gitDependencyRefreshReferences.map((reference) => `${reference.packageName}@${reference.installSpec ?? reference.spec}`);
@@ -1809,7 +1812,7 @@ async function saveOneRepository(node, options, state) {
   } else if (node.kind === "project" && (dependencyChanged || node.path === options.root && submodulesChanged) && hasNpmLockfile(node.path)) {
     report.install = await runNpmInstallWithRetry(node, options, gitDependencyRefreshSpecs);
   }
-  if (!isRootWorkspaceRepository(node, options) && hasNpmLockfile(node.path) && (packageNeedsVersion || dependencyChanged)) {
+  if (!isRootWorkspaceRepository(node, options) && hasNpmLockfile(node.path) && (packageNeedsVersion || dependencyChanged) && !deferredGitDependencyValidation) {
     validateStandaloneGitDependencyLockfile(node, options);
   }
   if (hasNpmLockfile(node.path) && (node.kind === "project" || packageNeedsVersion || dependencyChanged || submodulesChanged)) {

package/dist/workflow/operations.d.ts

@@ -1144,6 +1144,10 @@ export declare function workflowRelease(helpers: WorkflowOperationHelpers, input
             cached: boolean;
         }[];
     };
+    productionImageRefs: {
+        persisted: Record<string, string>;
+        readiness: import("../workflow-support.js").TreeseedDeploymentReadinessReport;
+    };
     backMerge: {
         packages: {
             status: string;

package/dist/workflow/operations.js

@@ -17,6 +17,7 @@ import {
   applyTreeseedSafeRepairs,
   assertTreeseedCommandEnvironment,
   checkTreeseedProviderConnections,
+  collectTreeseedEnvironmentContext,
   collectTreeseedConfigContext,
   collectTreeseedConfigSeedValues,
   collectTreeseedPrintEnvReport,
@@ -33,6 +34,7 @@ import {
   resolveTreeseedRemoteSession,
   rotateTreeseedMachineKey,
   setTreeseedRemoteSession,
+  setTreeseedMachineEnvironmentValue,
   writeTreeseedMachineConfig
 } from "../operations/services/config-runtime.js";
 import { formatTreeseedDependencyFailureDetails, installTreeseedDependencies } from "../managed-dependencies.js";
@@ -746,6 +748,20 @@ function productionReleaseImageRefVersions(root, selectedVersions) {
   }
   return versions;
 }
+function persistProductionReleaseImageRefs(root, releaseImageRefs) {
+  const registry = collectTreeseedEnvironmentContext(root);
+  const entries = new Map(registry.entries.map((entry) => [entry.id, entry]));
+  const persisted = {};
+  for (const [id, value] of Object.entries(releaseImageRefs)) {
+    const entry = entries.get(id) ?? { id, storage: "scoped", sensitivity: "plain" };
+    if (entry.sensitivity === "secret") {
+      workflowError("release", "validation_failed", `Production release image ref ${id} must be a non-secret environment value.`);
+    }
+    setTreeseedMachineEnvironmentValue(root, "prod", entry, value);
+    persisted[id] = value;
+  }
+  return persisted;
+}
 function stableVersionLine(version) {
   const match = version.match(/^(\d+\.\d+)\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
   return match?.[1] ?? null;
@@ -2225,7 +2241,7 @@ function runReleaseNpmInstall(repoDir, options = {}) {
   if (shouldSkipReleaseInstall()) {
     return { status: "skipped", reason: "disabled" };
   }
-  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
+  const args = repoDir === options.workspaceRoot ? ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"] : ["install", "--package-lock-only", "--ignore-scripts", "--workspaces=false", "--no-audit", "--no-fund"];
   const spawnCommand = npmCommandForWorkflowSpawn(args);
   let lastDetail = "";
   for (let attempt = 1; attempt <= 10; attempt += 1) {
@@ -4722,7 +4738,7 @@ async function workflowSave(helpers, input) {
               verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
               commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
               workflowRunId: workflowRun.runId,
-              deferPushUntilVerified: false,
+              deferPushUntilVerified: true,
               onProgress: (line, stream) => helpers.write(line, stream),
               onWaveSaved: branch === STAGING_BRANCH && shouldUseHostedSaveCi(effectiveInput, branch, saveLane) ? async ({ nodes, reports, rootRepo: waveRootRepo }) => {
                 const nonRootReportsForWave = reports.filter((repo, index) => nodes[index]?.id !== ".");
@@ -5695,10 +5711,12 @@ ${currentBlockers.map((entry) => `- ${entry}`).join("\n")}`, {
           { root, runId: workflowRun.runId, onProgress: (line, stream) => helpers.write(line, stream) }
         )) : (skipJournalStep(root, workflowRun.runId, "hosted-ci", { skippedReason: "ci off" }), { status: "skipped", reason: "ci off" });
         const workspaceLinks = await executeJournalStep(root, workflowRun.runId, "workspace-link-restore", () => ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto"));
-        for (const repo of checkedOutStagePromotionRepos(root)) {
-          syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+        if (!managedWorkflowWorktreeMetadata(root)) {
+          for (const repo of checkedOutStagePromotionRepos(root)) {
+            syncBranchWithOrigin(repo.dir, STAGING_BRANCH);
+          }
+          syncBranchWithOrigin(repoRoot(root), STAGING_BRANCH);
         }
-        syncBranchWithOrigin(repoRoot(root), STAGING_BRANCH);
         const cleanup = cleanupMode === "success" ? await executeJournalStep(root, workflowRun.runId, "cleanup-source", () => cleanupStageSourceBranches(root, featureBranch, typedManifest)) : (skipJournalStep(root, workflowRun.runId, "cleanup-source", { skippedReason: "manual cleanup selected" }), { status: "skipped", reason: "manual cleanup selected" });
         const payload = {
           ...basePayload,
@@ -6000,6 +6018,7 @@ ${blockers.join("\n")}`, {
           },
           { id: "verify-published-artifacts", description: "Verify immutable registry artifacts exist after publish workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "production-package-deploy-workflows", description: "Wait for production package deploy workflows before live verification", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
+          { id: "persist-production-image-refs", description: "Persist released production image refs and verify deployment readiness", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-root", description: `Release market ${plannedRelease.rootVersion}`, repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "publish-wait", description: "Wait for production release workflows", repoName: rootRepo.name, repoPath: rootRepo.path, branch: PRODUCTION_BRANCH, resumable: true },
           { id: "release-back-merge", description: "Back-merge production release history into staging", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
@@ -6132,6 +6151,26 @@ ${rendered}`);
             onProgress: (line, stream) => helpers.write(line, stream)
           }).then((workflowGates) => ({ workflowGates }));
         });
+        const productionImageRefs = await executeJournalStep(root, workflowRun.runId, "persist-production-image-refs", async () => {
+          const persisted = persistProductionReleaseImageRefs(root, releaseImageRefs);
+          if (helpers.context.env) {
+            Object.assign(helpers.context.env, persisted);
+            Object.assign(process.env, persisted);
+          }
+          const readiness = await withContextEnv(persisted, () => collectTreeseedDeploymentReadiness({
+            tenantRoot: root,
+            environment: "prod",
+            appId: singleSelectedWorkflowAppId(plannedRelease.applicationSelection)
+          }));
+          const failures = readiness.checks.filter((check) => check.status === "failed").map((check) => `${check.id}: ${check.message}${check.remediation ? ` Remediation: ${check.remediation}` : ""}`);
+          if (failures.length > 0) {
+            workflowError("release", "hosted_live_verification_failed", `Production readiness failed after persisting released image refs:
+${failures.join("\n")}`, {
+              details: { releaseImageRefs: persisted, readiness }
+            });
+          }
+          return { persisted, readiness };
+        });
         const rootRelease = await executeJournalStep(root, workflowRun.runId, "release-root", () => {
           const rootInstall = runReleaseNpmInstall(root, { workspaceRoot: root });
           const changelog = updateReleaseChangelog(repoRoot(root), {
@@ -6205,6 +6244,7 @@ ${rendered}`);
           publishWait: publishWait.workflowGates,
           publishedArtifacts,
           productionPackageDeployWorkflows,
+          productionImageRefs,
           backMerge,
           workspaceLinks,
           releasedCommit: String(rootRelease.commit.commitSha ?? ""),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.58",
+  "version": "0.12.59",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {