@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/operations/services/hosted-service-checks.js

@@ -1,527 +0,0 @@
-import { relative, resolve } from "node:path";
-import { collectTreeseedEnvironmentContext, resolveTreeseedMachineEnvironmentValues } from "./config-runtime.js";
-import { configuredRailwayServices } from "./railway-deploy.js";
-import { isApiRailwaySourcePolicyService, isImmutableRailwayImageRef } from "./railway-source-policy.js";
-import { loadTreeseedPlatformConfig } from "../../platform/config.js";
-import { discoverTreeseedApplications } from "../../hosting/apps.js";
-const RAILWAY_SECRET_KEYS_BY_SERVICE = {
-  api: [
-    "TREESEED_DATABASE_URL",
-    "TREESEED_WEB_SERVICE_SECRET",
-    "TREESEED_PLATFORM_RUNNER_SECRET",
-    "TREESEED_CREDENTIAL_SESSION_SECRET"
-  ],
-  operationsRunner: [
-    "TREESEED_DATABASE_URL",
-    "TREESEED_PLATFORM_RUNNER_SECRET",
-    "TREESEED_CREDENTIAL_SESSION_SECRET"
-  ],
-  capacityProviderManager: [
-    "TREESEED_CAPACITY_PROVIDER_API_KEY"
-  ],
-  capacityProviderRunner: [
-    "TREESEED_CAPACITY_PROVIDER_API_KEY"
-  ]
-};
-const RAILWAY_VARIABLE_KEYS_BY_SERVICE = {
-  operationsRunner: [
-    "TREESEED_PLATFORM_RUNNER_ID",
-    "TREESEED_PLATFORM_RUNNER_DATA_DIR",
-    "TREESEED_PLATFORM_RUNNER_ENVIRONMENT",
-    "TREESEED_MANAGER_ID"
-  ],
-  capacityProviderManager: [
-    "TREESEED_PROVIDER_ENVIRONMENT",
-    "TREESEED_PROVIDER_ROLE",
-    "TREESEED_MARKET_URL"
-  ],
-  capacityProviderRunner: [
-    "TREESEED_PROVIDER_ENVIRONMENT",
-    "TREESEED_PROVIDER_ROLE",
-    "TREESEED_MARKET_URL",
-    "TREESEED_PROVIDER_RUNNER_ID",
-    "TREESEED_PROVIDER_DATA_DIR"
-  ]
-};
-function check(input) {
-  return {
-    ...input,
-    issues: input.issues ?? []
-  };
-}
-function statusForMatch(observed, expected) {
-  return observed === expected ? "passed" : "failed";
-}
-function rootDirectory(tenantRoot, rootDir) {
-  const rel = relative(tenantRoot, rootDir).split("\\").join("/");
-  return rel || ".";
-}
-function railwayServiceRootDirectory(tenantRoot, service) {
-  const sourceRootDirectory = String(service.sourceRootDirectory ?? "").trim();
-  if (sourceRootDirectory) {
-    return sourceRootDirectory;
-  }
-  return rootDirectory(service.application?.root ?? tenantRoot, service.rootDir);
-}
-function railwayServiceUsesImageSource(service) {
-  return Boolean(service.imageRef || service.sourceMode === "image");
-}
-function hasConfiguredValue(values, key) {
-  return typeof values[key] === "string" && Boolean(values[key]?.trim());
-}
-function hasProviderKey(record, key) {
-  if (Array.isArray(record)) return record.includes(key);
-  if (record && typeof record === "object") return Object.prototype.hasOwnProperty.call(record, key);
-  return false;
-}
-function variableObserved(observed, key) {
-  return hasProviderKey(observed?.variables, key) || hasProviderKey(observed?.secrets, key);
-}
-function valuePresence(values, observed, key, serviceTarget) {
-  const providerPresent = variableObserved(observed, key);
-  const machinePresent = hasConfiguredValue(values, key);
-  const providerObserved = Boolean(observed);
-  const present = providerObserved ? providerPresent : machinePresent;
-  return {
-    key,
-    serviceTarget,
-    present,
-    source: providerPresent ? "provider" : !providerObserved && machinePresent ? "machine-config" : "missing",
-    observation: providerObserved ? "provider-live" : "not-observed"
-  };
-}
-function serviceTypeFor(key) {
-  if (key === "api") return "api";
-  if (key === "operationsRunner") return "operationsRunner";
-  if (key === "capacityProviderManager") return "capacityProviderManager";
-  if (key === "capacityProviderRunner") return "capacityProviderRunner";
-  if (key === "treeseedDatabase") return "treeseedDatabase";
-  return "unknown";
-}
-function observedFor(options, serviceName) {
-  return serviceName ? options.observedRailwayServices?.[serviceName] : void 0;
-}
-function webCheckConfig(deployConfig, selectedApplication) {
-  const selectedConfig = selectedApplication?.roles.includes("web") ? selectedApplication.config : deployConfig;
-  return {
-    appId: selectedApplication?.roles.includes("web") ? selectedApplication.id : "web",
-    config: selectedConfig,
-    web: selectedConfig.surfaces?.web
-  };
-}
-function httpStatus(url, options) {
-  const observed = options.httpChecks?.[url];
-  if (!observed) {
-    return check({
-      id: `http:${url}`,
-      provider: "http",
-      serviceType: "unknown",
-      target: options.target ?? "prod",
-      description: `HTTP check ${url}`,
-      expected: { ok: true },
-      observed: { skipped: true },
-      status: "skipped",
-      issues: ["No live HTTP observation was provided."]
-    });
-  }
-  const ok = observed.ok === true || typeof observed.status === "number" && observed.status >= 200 && observed.status < 400;
-  const fallbackOk = observed.fallbackOk === true || typeof observed.fallbackStatus === "number" && observed.fallbackStatus >= 200 && observed.fallbackStatus < 400;
-  return check({
-    id: `http:${url}`,
-    provider: "http",
-    serviceType: "unknown",
-    target: options.target ?? "prod",
-    description: `HTTP check ${url}`,
-    expected: { ok: true },
-    observed: {
-      status: observed.status ?? null,
-      ok,
-      skipped: observed.skipped === true,
-      fallbackUrl: observed.fallbackUrl,
-      fallbackStatus: observed.fallbackStatus,
-      fallbackOk
-    },
-    status: observed.skipped ? "skipped" : ok ? "passed" : fallbackOk ? "warning" : "failed",
-    issues: ok ? [] : fallbackOk ? [observed.error ?? `HTTP check ${url} did not return a successful status yet; fallback ${observed.fallbackUrl} responded.`] : [observed.error ?? `HTTP check ${url} did not return a successful status.`]
-  });
-}
-function collectTreeseedHostedServiceChecks(options) {
-  const target = options.target ?? "prod";
-  const tenantRoot = options.tenantRoot;
-  const configEnv = { ...process.env, ...options.env ?? {} };
-  const deployConfig = loadTreeseedPlatformConfig({ tenantRoot, environment: target, env: configEnv }).deployConfig;
-  const registry = collectTreeseedEnvironmentContext(tenantRoot);
-  let machineValues = {};
-  try {
-    machineValues = resolveTreeseedMachineEnvironmentValues(tenantRoot, target);
-  } catch {
-    machineValues = {};
-  }
-  const values = { ...machineValues, ...configEnv, ...options.valuesOverlay ?? {} };
-  const checks = [];
-  const selectedServiceKeys = new Set((options.serviceKeys ?? []).map((key) => key.trim()).filter(Boolean));
-  const selectedAppId = options.appId?.trim() || null;
-  const applications = discoverTreeseedApplications(tenantRoot);
-  const selectedApplication = selectedAppId ? applications.find((application) => application.id === selectedAppId || application.relativeRoot === selectedAppId) : null;
-  const selectedService = (serviceKey) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(serviceKey);
-  const workspaceHasApiApplication = applications.some(
-    (application) => application.roles.includes("api") || application.config.surfaces?.api?.enabled === true || application.config.services?.api?.enabled !== false && Boolean(application.config.services?.api)
-  );
-  const includeWeb = selectedService("web") && (!selectedAppId || selectedAppId === "web" || selectedApplication?.roles.includes("web") === true);
-  const includeApi = selectedService("api") && (!selectedAppId || selectedAppId === "api" || selectedApplication?.roles.includes("api") === true);
-  const selectedAppHasApi = Boolean(
-    selectedApplication?.roles.includes("api") || selectedApplication?.config.surfaces?.api?.enabled === true || selectedApplication?.config.services?.api?.enabled !== false && selectedApplication?.config.services?.api || selectedAppId === "web" && workspaceHasApiApplication || selectedAppId === "web" && (deployConfig.surfaces?.api?.enabled === true || deployConfig.services?.api?.enabled !== false && deployConfig.services?.api)
-  );
-  const selectedWeb = webCheckConfig(deployConfig, selectedApplication);
-  const web = selectedWeb.web;
-  if (includeWeb && web?.enabled !== false && web?.provider === "cloudflare") {
-    const domain = web.environments?.[target]?.domain ?? web.publicBaseUrl ?? selectedWeb.config.siteUrl ?? null;
-    checks.push(check({
-      id: `cloudflare:${selectedWeb.appId}:surface`,
-      provider: "cloudflare",
-      serviceKey: selectedWeb.appId,
-      serviceType: "web",
-      target,
-      description: "Cloudflare web surface is configured.",
-      expected: {
-        provider: "cloudflare",
-        domain,
-        pagesProjectName: selectedWeb.config.cloudflare?.pages?.projectName ?? null
-      },
-      observed: { configured: true },
-      status: "passed"
-    }));
-    if (domain) {
-      const url = String(domain).startsWith("http") ? String(domain) : `https://${domain}`;
-      checks.push({ ...httpStatus(url, options), id: `http:${selectedWeb.appId}`, serviceKey: selectedWeb.appId, serviceType: "web", description: "Web public URL responds." });
-      if (selectedServiceKeys.size === 0 && (!selectedAppId || selectedAppHasApi)) {
-        checks.push({ ...httpStatus(`${url.replace(/\/+$/u, "")}/v1/healthz`, options), id: `http:${selectedWeb.appId}:v1-healthz`, serviceKey: selectedWeb.appId, serviceType: "web", description: "Web proxy reaches API health." });
-      }
-    }
-  }
-  for (const [surfaceKey, surface] of Object.entries(deployConfig.surfaces ?? {})) {
-    if (!selectedService(surfaceKey)) continue;
-    if (selectedAppId === "api" && surfaceKey === "web") continue;
-    if (surface && typeof surface === "object" && surface.enabled !== false && surface.provider && !["cloudflare", "railway"].includes(surface.provider)) {
-      checks.push(check({
-        id: `surface-provider:${surfaceKey}:${surface.provider}`,
-        provider: surface.provider === "github" ? "github" : "http",
-        serviceKey: surfaceKey,
-        serviceType: surfaceKey === "web" ? "web" : surfaceKey === "api" ? "api" : "unknown",
-        target,
-        description: `Unsupported hosted surface provider ${surface.provider}.`,
-        expected: { supportedProviders: ["cloudflare", "railway"] },
-        observed: { provider: surface.provider },
-        status: "warning",
-        issues: [`Hosted service checker does not yet support provider ${surface.provider}.`]
-      }));
-    }
-  }
-  const configuredServices = configuredRailwayServices(tenantRoot, target, configEnv).filter((service) => !selectedAppId || service.application?.id === selectedAppId).filter((service) => selectedServiceKeys.size === 0 || selectedServiceKeys.has(service.key));
-  for (const service of configuredServices) {
-    const serviceType = serviceTypeFor(service.key);
-    const observed = observedFor(options, service.serviceName);
-    const expectedRootDirectory = railwayServiceRootDirectory(tenantRoot, service);
-    const apiSourcePolicyService = isApiRailwaySourcePolicyService(service);
-    if (target === "prod" && apiSourcePolicyService && railwayServiceUsesImageSource(service)) {
-      checks.push(check({
-        id: `railway:${service.instanceKey}:image-ref-policy`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} uses an immutable production image reference.`,
-        expected: { imageRef: "<released-image>:<immutable-tag>" },
-        observed: { imageRef: service.imageRef ?? null },
-        status: isImmutableRailwayImageRef(service.imageRef) ? "passed" : "failed",
-        issues: isImmutableRailwayImageRef(service.imageRef) ? [] : [`Production API Railway service ${service.serviceName} is missing an immutable image ref.`]
-      }));
-      const observedGitSource = Boolean(observed?.deploymentRepo || observed?.deploymentBranch);
-      checks.push(check({
-        id: `railway:${service.instanceKey}:production-source-isolation`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} production deployment has no Git source.`,
-        expected: { repo: null, branch: null },
-        observed: observed ? { repo: observed.deploymentRepo ?? null, branch: observed.deploymentBranch ?? null } : { skipped: true },
-        status: observed ? observedGitSource ? "failed" : "passed" : "skipped",
-        issues: observed && observedGitSource ? [`Production API Railway service ${service.serviceName} still reports Git source metadata.`] : []
-      }));
-    }
-    checks.push(check({
-      id: `railway:${service.instanceKey}:service`,
-      provider: "railway",
-      serviceKey: service.key,
-      serviceType,
-      target,
-      description: `Railway service ${service.serviceName} is configured.`,
-      expected: { projectName: service.projectName, serviceName: service.serviceName, environmentName: service.railwayEnvironment },
-      observed: observed ? { projectName: observed.projectName ?? null, serviceName: observed.serviceName ?? null, environmentName: observed.environmentName ?? null } : { skipped: true },
-      status: observed ? "passed" : "skipped",
-      issues: observed ? [] : ["No live Railway observation was provided."]
-    }));
-    for (const [key, expected] of Object.entries({
-      rootDirectory: railwayServiceUsesImageSource(service) ? null : expectedRootDirectory,
-      buildCommand: service.buildCommand,
-      dockerfilePath: service.dockerfilePath,
-      startCommand: service.startCommand,
-      healthcheckPath: service.healthcheckPath,
-      healthcheckTimeoutSeconds: service.healthcheckTimeoutSeconds,
-      runtimeMode: service.runtimeMode
-    })) {
-      if (expected == null) continue;
-      const actual = observed?.[key] ?? null;
-      checks.push(check({
-        id: `railway:${service.instanceKey}:${key}`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} ${key} matches config.`,
-        expected: { [key]: expected },
-        observed: observed ? { [key]: actual } : { skipped: true },
-        status: observed ? statusForMatch(actual, expected) : "skipped",
-        issues: !observed || actual === expected ? [] : [`Expected ${key}=${expected}, observed ${actual ?? "(unset)"}.`]
-      }));
-    }
-    if (!railwayServiceUsesImageSource(service) && service.sourceRepo) {
-      const actualRepo = observed?.deploymentRepo ?? null;
-      const actualBranch = observed?.deploymentBranch ?? null;
-      const actualRootDirectory = observed?.deploymentRootDirectory ?? null;
-      const sourceUploadDeployment = target === "staging" && !apiSourcePolicyService && actualRepo === null && actualBranch === null && observed?.deploymentHealthy === true;
-      checks.push(check({
-        id: `railway:${service.instanceKey}:deployment-repo`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} latest deployment uses the desired Git repo.`,
-        expected: { repo: service.sourceRepo },
-        observed: observed ? { repo: actualRepo, sourceUpload: sourceUploadDeployment } : { skipped: true },
-        status: observed ? sourceUploadDeployment ? "passed" : statusForMatch(actualRepo, service.sourceRepo) : "skipped",
-        issues: !observed || sourceUploadDeployment || actualRepo === service.sourceRepo ? [] : [`Expected deployment repo=${service.sourceRepo}, observed ${actualRepo ?? "(unset)"}.`]
-      }));
-      if (service.sourceBranch) {
-        checks.push(check({
-          id: `railway:${service.instanceKey}:deployment-branch`,
-          provider: "railway",
-          serviceKey: service.key,
-          serviceType,
-          target,
-          description: `Railway ${service.serviceName} latest deployment uses the desired Git branch.`,
-          expected: { branch: service.sourceBranch },
-          observed: observed ? { branch: actualBranch, commitHash: observed.deploymentCommitHash ?? null, sourceUpload: sourceUploadDeployment } : { skipped: true },
-          status: observed ? sourceUploadDeployment ? "passed" : statusForMatch(actualBranch, service.sourceBranch) : "skipped",
-          issues: !observed || sourceUploadDeployment || actualBranch === service.sourceBranch ? [] : [`Expected deployment branch=${service.sourceBranch}, observed ${actualBranch ?? "(unset)"}.`]
-        }));
-      }
-      if (service.sourceCommit) {
-        const actualCommit = observed?.deploymentCommitHash ?? null;
-        checks.push(check({
-          id: `railway:${service.instanceKey}:deployment-commit`,
-          provider: "railway",
-          serviceKey: service.key,
-          serviceType,
-          target,
-          description: `Railway ${service.serviceName} latest deployment uses the exact promoted commit.`,
-          expected: { commitHash: service.sourceCommit },
-          observed: observed ? { commitHash: actualCommit } : { skipped: true },
-          status: observed ? statusForMatch(actualCommit, service.sourceCommit) : "skipped",
-          issues: !observed || actualCommit === service.sourceCommit ? [] : [`Expected deployment commitHash=${service.sourceCommit}, observed ${actualCommit ?? "(unset)"}.`]
-        }));
-      }
-      if (expectedRootDirectory) {
-        checks.push(check({
-          id: `railway:${service.instanceKey}:deployment-root-directory`,
-          provider: "railway",
-          serviceKey: service.key,
-          serviceType,
-          target,
-          description: `Railway ${service.serviceName} latest deployment uses the desired Git root directory.`,
-          expected: { rootDirectory: expectedRootDirectory },
-          observed: observed ? { rootDirectory: actualRootDirectory } : { skipped: true },
-          status: observed ? statusForMatch(actualRootDirectory, expectedRootDirectory) : "skipped",
-          issues: !observed || actualRootDirectory === expectedRootDirectory ? [] : [`Expected deployment rootDirectory=${expectedRootDirectory}, observed ${actualRootDirectory ?? "(unset)"}.`]
-        }));
-      }
-    }
-    if (observed && observed.deploymentHealthy === false) {
-      checks.push(check({
-        id: `railway:${service.instanceKey}:deployment`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} latest deployment is healthy.`,
-        expected: { healthy: true },
-        observed: { healthy: false, status: observed.deploymentStatus ?? null },
-        status: "failed",
-        issues: [`Latest Railway deployment status is ${observed.deploymentStatus ?? "unknown"}.`]
-      }));
-    } else if (observed) {
-      checks.push(check({
-        id: `railway:${service.instanceKey}:deployment`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} latest deployment is healthy.`,
-        expected: { healthy: true },
-        observed: { healthy: observed.deploymentHealthy ?? null, status: observed.deploymentStatus ?? null },
-        status: observed.deploymentHealthy === true ? "passed" : "skipped",
-        issues: observed.deploymentHealthy === true ? [] : ["No live Railway deployment health observation was provided."]
-      }));
-    }
-    if (service.volumeMountPath) {
-      const volumeAttached = Boolean(observed?.volumeId) && observed?.volumeMountPath === service.volumeMountPath && (!observed?.serviceName || !observed?.volumeServiceId || observed.volumeServiceId === observed.serviceId) && observed?.volumePendingDeletion !== true && !(typeof observed?.volumeDeletedAt === "string" && observed.volumeDeletedAt.trim()) && !["DELETING", "DELETED"].includes(String(observed?.volumeState ?? "").toUpperCase());
-      checks.push(check({
-        id: `railway:${service.instanceKey}:volume`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} volume mount matches config.`,
-        expected: { volumeMountPath: service.volumeMountPath },
-        observed: observed ? {
-          volumeName: observed.volumeName ?? null,
-          volumeId: observed.volumeId ?? null,
-          volumeMountPath: observed.volumeMountPath ?? null,
-          volumeServiceId: observed.volumeServiceId ?? null,
-          volumeEnvironmentId: observed.volumeEnvironmentId ?? null,
-          volumeState: observed.volumeState ?? null,
-          volumePendingDeletion: observed.volumePendingDeletion ?? null,
-          volumeDeletedAt: observed.volumeDeletedAt ?? null
-        } : { skipped: true },
-        status: observed ? volumeAttached ? "passed" : "failed" : "skipped",
-        issues: !observed || volumeAttached ? [] : [`Expected an attached persistent volume mounted at ${service.volumeMountPath}, observed ${observed.volumeMountPath ?? "(unset)"} on volume ${observed.volumeName ?? "(none)"}.`]
-      }));
-      const volumeNotPendingDeletion = observed?.volumePendingDeletion === false && !["DELETING", "DELETED"].includes(String(observed?.volumeState ?? "").toUpperCase());
-      checks.push(check({
-        id: `railway:${service.instanceKey}:volume-retained`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} volume is retained and active.`,
-        expected: { pendingDeletion: false },
-        observed: observed ? {
-          volumeName: observed.volumeName ?? null,
-          volumeId: observed.volumeId ?? null,
-          state: observed.volumeState ?? null,
-          pendingDeletion: observed.volumePendingDeletion ?? null,
-          deletedAt: observed.volumeDeletedAt ?? null
-        } : { skipped: true },
-        status: observed ? volumeNotPendingDeletion ? "passed" : "failed" : "skipped",
-        issues: !observed || volumeNotPendingDeletion ? [] : [`Expected an active retained volume, observed state=${observed.volumeState ?? "(unset)"} pendingDeletion=${String(observed.volumePendingDeletion ?? null)} deletedAt=${observed.volumeDeletedAt ?? "(unset)"}.`]
-      }));
-      const deploymentHasVolumeMount = observed?.deploymentRequiredMountPath === service.volumeMountPath || (observed?.deploymentVolumeMounts ?? []).includes(service.volumeMountPath);
-      checks.push(check({
-        id: `railway:${service.instanceKey}:deployment-required-mount`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} deployment metadata includes the volume mount.`,
-        expected: { volumeMountPath: service.volumeMountPath },
-        observed: observed ? {
-          requiredMountPath: observed.deploymentRequiredMountPath ?? null,
-          volumeMounts: observed.deploymentVolumeMounts ?? []
-        } : { skipped: true },
-        status: observed ? deploymentHasVolumeMount ? "passed" : "failed" : "skipped",
-        issues: !observed || deploymentHasVolumeMount ? [] : [`Expected deployment metadata to include volume mount ${service.volumeMountPath}.`]
-      }));
-    }
-    for (const key of [...RAILWAY_SECRET_KEYS_BY_SERVICE[service.key] ?? [], ...RAILWAY_VARIABLE_KEYS_BY_SERVICE[service.key] ?? []]) {
-      const presence = valuePresence(values, observed, key, service.key);
-      const status = presence.present ? "passed" : observed ? "failed" : "skipped";
-      checks.push(check({
-        id: `railway:${service.instanceKey}:env:${key}`,
-        provider: "railway",
-        serviceKey: service.key,
-        serviceType,
-        target,
-        description: `Railway ${service.serviceName} has ${key}.`,
-        expected: { key, serviceTarget: service.key, present: true },
-        observed: presence,
-        status,
-        issues: presence.present ? [] : observed ? [`${key} is missing for ${service.key}.`] : ["No live Railway variable observation was provided."]
-      }));
-    }
-    if (service.publicBaseUrl) {
-      const baseUrl = service.publicBaseUrl.replace(/\/+$/u, "");
-      checks.push({ ...httpStatus(`${baseUrl}${service.healthcheckPath ?? "/healthz"}`, options), id: `http:${service.instanceKey}:healthz`, serviceKey: service.key, serviceType, description: `${service.serviceName} health endpoint responds.` });
-      if (service.key === "api") {
-        checks.push({ ...httpStatus(`${baseUrl}/healthz/deep`, options), id: `http:${service.instanceKey}:healthz-deep`, serviceKey: service.key, serviceType, description: `${service.serviceName} deep health endpoint responds.` });
-      }
-    }
-  }
-  const applicationConfigs = [
-    ...includeWeb ? [deployConfig] : [],
-    ...discoverTreeseedApplications(tenantRoot).filter((application) => application.root !== resolve(tenantRoot)).filter((application) => !selectedAppId || application.id === selectedAppId).map((application) => application.config)
-  ];
-  const treeseedDatabaseService = applicationConfigs.map((config) => config.services?.treeseedDatabase).find((service) => service?.enabled !== false);
-  if (includeApi && (selectedServiceKeys.size === 0 || selectedServiceKeys.has("treeseedDatabase")) && treeseedDatabaseService?.enabled !== false && treeseedDatabaseService?.provider === "railway") {
-    const targets = treeseedDatabaseService.railway?.serviceTargets ?? [];
-    checks.push(check({
-      id: "railway:treeseedDatabase:targets",
-      provider: "railway",
-      serviceKey: "treeseedDatabase",
-      serviceType: "treeseedDatabase",
-      target,
-      description: "Treeseed database targets API and runner services.",
-      expected: { serviceTargets: ["api", "operationsRunner"] },
-      observed: { serviceTargets: targets },
-      status: targets.includes("api") && targets.includes("operationsRunner") ? "passed" : "failed",
-      issues: targets.includes("api") && targets.includes("operationsRunner") ? [] : ["Treeseed database must target api and operationsRunner."]
-    }));
-  }
-  for (const service of Object.values(selectedAppId ? {} : deployConfig.services ?? {})) {
-    if (service && typeof service === "object" && service.enabled !== false && service.provider && !["railway"].includes(service.provider)) {
-      checks.push(check({
-        id: `provider:${service.provider}`,
-        provider: "railway",
-        serviceType: "unknown",
-        target,
-        description: `Unsupported hosted service provider ${service.provider}.`,
-        expected: { supportedProviders: ["railway"] },
-        observed: { provider: service.provider },
-        status: "warning",
-        issues: [`Hosted service checker does not yet support provider ${service.provider}.`]
-      }));
-    }
-  }
-  const entryIds = new Set(registry.entries.map((entry) => entry.id));
-  for (const key of includeApi ? ["TREESEED_DATABASE_URL", "TREESEED_WEB_SERVICE_SECRET", "TREESEED_PLATFORM_RUNNER_SECRET"] : []) {
-    if (!entryIds.has(key)) {
-      checks.push(check({
-        id: `registry:${key}`,
-        provider: "railway",
-        serviceType: "unknown",
-        target,
-        description: `Environment registry declares ${key}.`,
-        expected: { registryEntry: key },
-        observed: { registryEntry: null },
-        status: "failed",
-        issues: [`${key} is missing from the environment registry.`]
-      }));
-    }
-  }
-  const summary = {
-    passed: checks.filter((entry) => entry.status === "passed").length,
-    failed: checks.filter((entry) => entry.status === "failed").length,
-    skipped: checks.filter((entry) => entry.status === "skipped").length,
-    warning: checks.filter((entry) => entry.status === "warning").length
-  };
-  return {
-    target,
-    tenantRoot: resolve(tenantRoot),
-    generatedAt: (options.now ?? /* @__PURE__ */ new Date()).toISOString(),
-    summary,
-    checks
-  };
-}
-export {
-  collectTreeseedHostedServiceChecks
-};

package/dist/operations/services/hosting-audit.d.ts

@@ -1,69 +0,0 @@
-import { type TreeseedEnvironmentScope } from '../../platform/environment.js';
-import type { TreeseedReconcileTarget } from '../../reconcile/contracts.js';
-export type TreeseedHostingAuditEnvironment = 'current' | 'local' | 'staging' | 'prod';
-export type TreeseedHostingAuditResolvedEnvironment = 'local' | 'staging' | 'prod' | 'preview';
-export type TreeseedHostingAuditHostKind = 'repository' | 'web' | 'email';
-export type TreeseedHostingAuditCheckStatus = 'passed' | 'warning' | 'failed' | 'skipped' | 'repaired';
-export type TreeseedHostingAuditSeverity = 'info' | 'warning' | 'critical';
-export type TreeseedHostingAuditCheck = {
-    id: string;
-    hostType: TreeseedHostingAuditHostKind | 'platform';
-    provider: string;
-    category: 'config' | 'identity' | 'resource' | 'connectivity' | 'repair' | 'security';
-    status: TreeseedHostingAuditCheckStatus;
-    severity: TreeseedHostingAuditSeverity;
-    summary: string;
-    detail?: string;
-    resourceRef?: string;
-    repairAvailable?: boolean;
-    repaired?: boolean;
-    remediation?: string;
-};
-export type TreeseedHostingAuditReport = {
-    ok: boolean;
-    environment: TreeseedHostingAuditResolvedEnvironment;
-    requestedEnvironment: TreeseedHostingAuditEnvironment;
-    repairMode: boolean;
-    repaired: boolean;
-    target: {
-        kind: TreeseedReconcileTarget['kind'];
-        scope?: string;
-        branchName?: string;
-        label: string;
-    };
-    hostKinds: TreeseedHostingAuditHostKind[];
-    checkedAt: string;
-    checks: TreeseedHostingAuditCheck[];
-    missingConfig: Array<{
-        key: string;
-        hostType: TreeseedHostingAuditHostKind | 'platform';
-        severity: TreeseedHostingAuditSeverity;
-        summary: string;
-    }>;
-    resources: Record<string, unknown>;
-    warnings: string[];
-    blockers: string[];
-    nextActions: string[];
-};
-export type TreeseedHostingAuditOptions = {
-    tenantRoot: string;
-    environment?: TreeseedHostingAuditEnvironment;
-    repair?: boolean;
-    env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
-    valuesOverlay?: Record<string, string | undefined>;
-    hostKinds?: TreeseedHostingAuditHostKind[];
-    providerConnectionChecks?: boolean;
-    resourceChecks?: boolean;
-    write?: (line: string) => void;
-};
-export declare function resolveTreeseedHostingAuditTarget({ tenantRoot, environment, }: {
-    tenantRoot: string;
-    environment?: TreeseedHostingAuditEnvironment;
-}): {
-    environment: TreeseedHostingAuditResolvedEnvironment;
-    scope: TreeseedEnvironmentScope;
-    target: TreeseedReconcileTarget;
-    branchName: string | null;
-};
-export declare function runTreeseedHostingAudit({ tenantRoot, environment, repair, env, valuesOverlay, hostKinds: requestedHostKinds, providerConnectionChecks: shouldCheckProviderConnections, resourceChecks: shouldCheckResources, write, }: TreeseedHostingAuditOptions): Promise<TreeseedHostingAuditReport>;
-export declare function formatTreeseedHostingAuditReport(report: TreeseedHostingAuditReport): string;