@treeseed/sdk 0.12.62 → 0.13.0-rc.10

package/dist/operations/services/project-platform.js

@@ -1,1603 +0,0 @@
-import { createHash } from "node:crypto";
-import { spawnSync } from "node:child_process";
-import { runTreeseedGit } from "./git-runner.js";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, extname, join, resolve } from "node:path";
-import { elapsedMs, formatTimingMarkdown, formatTimingSummary } from "../../timing.js";
-import {
-  createControlPlaneReporter
-} from "../../control-plane.js";
-import {
-  resolvePublishedContentPreviewTtlHours,
-  resolveTeamScopedContentLocator,
-  signEditorialPreviewToken
-} from "../../platform/published-content.js";
-import { createPublishedContentPipeline } from "../../platform/published-content-pipeline.js";
-import { collectTreeseedReconcileStatus, reconcileTreeseedTarget, resolveTreeseedBootstrapSelection } from "../../reconcile/index.js";
-import { loadTreeseedManifest } from "../../platform/tenant-config.js";
-import { applyTreeseedEnvironmentToProcess, assertTreeseedCommandEnvironment } from "./config-runtime.js";
-import { runTreeseedHostingAudit } from "./hosting-audit.js";
-import {
-  assertDeploymentInitialized,
-  createPersistentDeployTarget,
-  deployTargetLabel,
-  ensureGeneratedWranglerConfig,
-  finalizeDeploymentState,
-  loadDeployState,
-  markDeploymentInitialized,
-  purgePublishedContentCaches,
-  resolveConfiguredCloudflareAccountId,
-  resolveConfiguredSurfaceBaseUrl,
-  resolveTreeseedResourceIdentity,
-  syncCloudflareSecrets,
-  writeDeployState
-} from "./deploy.js";
-import { currentManagedBranch, PRODUCTION_BRANCH, STAGING_BRANCH } from "./git-workflow.js";
-import {
-  configuredRailwayServices,
-  deployRailwayService,
-  ensureRailwayScheduledJobs,
-  validateRailwayDeployPrerequisites,
-  validateRailwayServiceConfiguration,
-  verifyRailwayManagedResources,
-  verifyRailwayScheduledJobs
-} from "./railway-deploy.js";
-import { loadCliDeployConfig, packageScriptPath } from "./runtime-tools.js";
-import { resolveTreeseedToolCommand } from "../../managed-dependencies.js";
-import { runPrefixedCommand, runTreeseedBootstrapDag, sleep, writeTreeseedBootstrapLine } from "./bootstrap-runner.js";
-import { runTenantDeployPreflight } from "./save-deploy-preflight.js";
-const PROJECT_PLATFORM_BOOTSTRAP_SYSTEMS = ["data", "web", "api", "agents"];
-const WEB_PLATFORM_BOOTSTRAP_SYSTEMS = ["data", "web"];
-const PROCESSING_PLATFORM_BOOTSTRAP_SYSTEMS = ["api", "agents"];
-function stableHash(value) {
-  return createHash("sha256").update(value).digest("hex");
-}
-function recordTiming(timings, name, startMs, status = "success", metadata) {
-  const entry = {
-    name,
-    durationMs: elapsedMs(startMs),
-    status,
-    ...metadata ? { metadata } : {}
-  };
-  timings.push(entry);
-  return entry;
-}
-function writeWorkflowStatus(message) {
-  if (!process.env.TREESEED_WORKFLOW_ACTION && !process.env.TREESEED_WORKFLOW_DEBUG) {
-    return;
-  }
-  process.stderr.write(`[project-platform] ${message}
-`);
-}
-async function timedPhase(timings, name, run, metadata) {
-  const startMs = performance.now();
-  try {
-    const result = await Promise.resolve(run());
-    recordTiming(timings, name, startMs, "success", metadata);
-    return result;
-  } catch (error) {
-    recordTiming(timings, name, startMs, "failed", {
-      ...metadata ?? {},
-      error: error instanceof Error ? error.message : String(error)
-    });
-    throw error;
-  }
-}
-function writeProviderTimingSummary(options, timings) {
-  const text = formatTimingSummary(timings);
-  options.write?.(text);
-  const summaryPath = String(options.env?.TREESEED_PROVIDER_TIMING_SUMMARY_PATH ?? process.env.TREESEED_PROVIDER_TIMING_SUMMARY_PATH ?? "").trim();
-  if (!summaryPath) {
-    return;
-  }
-  writeFileSync(summaryPath, formatTimingMarkdown(timings), { flag: "a" });
-}
-function inferEnvironmentFromBranch(tenantRoot) {
-  const branch = currentManagedBranch(tenantRoot);
-  if (branch === STAGING_BRANCH) {
-    return "staging";
-  }
-  if (branch === PRODUCTION_BRANCH) {
-    return "prod";
-  }
-  return "staging";
-}
-function resolveScope(environment) {
-  const scope = environment ?? (process.env.CI ? inferEnvironmentFromBranch(process.cwd()) : "local");
-  if (!["local", "staging", "prod"].includes(scope)) {
-    throw new Error(`Unsupported environment "${scope}". Expected local, staging, or prod.`);
-  }
-  return scope;
-}
-function currentCommit(tenantRoot) {
-  const result = runTreeseedGit(["rev-parse", "HEAD"], {
-    cwd: tenantRoot,
-    mode: "read",
-    allowFailure: true
-  });
-  return result.status === 0 ? result.stdout.trim() : null;
-}
-function currentRef(tenantRoot) {
-  const result = runTreeseedGit(["rev-parse", "--abbrev-ref", "HEAD"], {
-    cwd: tenantRoot,
-    mode: "read",
-    allowFailure: true
-  });
-  return result.status === 0 ? result.stdout.trim() : null;
-}
-function sanitizeSegment(value, fallback) {
-  const normalized = String(value ?? "").trim().replaceAll(/[\\/]+/g, "-").replaceAll(/[^a-zA-Z0-9._-]+/g, "-").replaceAll(/-+/g, "-").replaceAll(/^-|-$/g, "");
-  return normalized || fallback;
-}
-function runNodeScript(tenantRoot, scriptName, scriptArgs = []) {
-  const result = spawnSync(process.execPath, [packageScriptPath(scriptName), ...scriptArgs], {
-    cwd: tenantRoot,
-    stdio: "inherit",
-    env: { ...process.env }
-  });
-  if (result.status !== 0) {
-    throw new Error(`${scriptName} failed.`);
-  }
-}
-function resolveProjectPlatformBootstrapSystems(options, siteConfig = loadCliDeployConfig(options.tenantRoot)) {
-  if (options.bootstrapSystems && options.bootstrapSystems.length > 0) {
-    return [...options.bootstrapSystems];
-  }
-  const selection = resolveTreeseedBootstrapSelection({
-    deployConfig: siteConfig,
-    env: { ...process.env, ...options.env ?? {} },
-    systems: PROJECT_PLATFORM_BOOTSTRAP_SYSTEMS,
-    skipUnavailable: true
-  });
-  for (const skipped of selection.skipped) {
-    writeTreeseedBootstrapLine(
-      options.write,
-      {
-        scope: options.scope,
-        system: skipped.system,
-        task: "availability",
-        stage: "skip"
-      },
-      skipped.reason
-    );
-  }
-  return selection.runnable.filter((system) => system !== "github");
-}
-function runTenantPublishContentPreflight(options) {
-  const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
-  applyTreeseedEnvironmentToProcess({ tenantRoot: options.tenantRoot, scope: options.scope, override: true });
-  if (options.scope !== "local") {
-    assertTreeseedCommandEnvironment({
-      tenantRoot: options.tenantRoot,
-      scope: options.scope,
-      purpose: "deploy"
-    });
-    assertDeploymentInitialized(options.tenantRoot, { target });
-  }
-  return target;
-}
-function runWrangler(tenantRoot, args, extraEnv = {}, options = {}) {
-  const wrangler = resolveTreeseedToolCommand("wrangler");
-  if (!wrangler) {
-    throw new Error("Wrangler CLI is unavailable.");
-  }
-  const result = spawnSync(wrangler.command, [...wrangler.argsPrefix, ...args], {
-    cwd: tenantRoot,
-    stdio: options.capture ? "pipe" : "inherit",
-    encoding: options.capture ? "utf8" : void 0,
-    env: { ...process.env, ...extraEnv }
-  });
-  if (result.status !== 0 && !options.allowFailure) {
-    throw new Error(`wrangler ${args.join(" ")} failed`);
-  }
-  return result;
-}
-const WRANGLER_TRANSIENT_MAX_ATTEMPTS = 6;
-const WRANGLER_COMMAND_TIMEOUT_MS = 18e4;
-function wranglerTransientRetryDelayMs(attempt) {
-  return Math.min(5e3 * 2 ** (attempt - 1), 6e4);
-}
-function isTransientWranglerOutput(output) {
-  return /fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|connectivity issue|internal error|code:\s*7500|aborted/i.test(output);
-}
-async function runPrefixedWranglerWithRetry(tenantRoot, args, {
-  env: env2 = {},
-  write,
-  prefix
-}) {
-  let lastOutput = "";
-  for (let attempt = 1; attempt <= WRANGLER_TRANSIENT_MAX_ATTEMPTS; attempt += 1) {
-    const wrangler = resolveTreeseedToolCommand("wrangler");
-    if (!wrangler) {
-      throw new Error("Wrangler CLI is unavailable.");
-    }
-    const result = await runPrefixedCommand(wrangler.command, [...wrangler.argsPrefix, ...args], {
-      cwd: tenantRoot,
-      env: env2,
-      write,
-      prefix,
-      timeoutMs: WRANGLER_COMMAND_TIMEOUT_MS
-    });
-    if (result.status === 0) {
-      return result;
-    }
-    lastOutput = [result.stderr?.trim(), result.stdout?.trim()].filter(Boolean).join("\n");
-    if (attempt === WRANGLER_TRANSIENT_MAX_ATTEMPTS || !isTransientWranglerOutput(lastOutput)) {
-      throw new Error(lastOutput || `wrangler ${args.join(" ")} failed`);
-    }
-    const retryDelayMs = wranglerTransientRetryDelayMs(attempt);
-    writeTreeseedBootstrapLine(
-      write,
-      { ...prefix, stage: "retry" },
-      `Wrangler command hit a transient failure; retrying in ${Math.round(retryDelayMs / 1e3)}s...`,
-      "stderr"
-    );
-    await sleep(retryDelayMs);
-  }
-  throw new Error(lastOutput || `wrangler ${args.join(" ")} failed`);
-}
-function prepareTenantCloudflareDeploy({
-  tenantRoot,
-  scope,
-  target: explicitTarget,
-  planOnly,
-  write,
-  env: env2 = process.env
-}) {
-  const target = explicitTarget ?? createPersistentDeployTarget(scope === "local" ? "staging" : scope);
-  if (scope !== "local") {
-    assertDeploymentInitialized(tenantRoot, { target });
-    runTenantDeployPreflight({ cwd: tenantRoot, scope });
-  }
-  const { wranglerPath, deployConfig, state } = ensureGeneratedWranglerConfig(tenantRoot, { target });
-  if (scope !== "local") {
-    syncCloudflareSecrets(tenantRoot, { target, planOnly });
-  }
-  const deployState = loadDeployState(tenantRoot, deployConfig, { target });
-  const pagesProjectName = target.kind === "persistent" ? deployState.pages?.projectName ?? null : null;
-  const pagesBranchName = target.kind === "persistent" ? target.scope === "prod" ? deployState.pages?.productionBranch ?? "main" : deployState.pages?.stagingBranch ?? "staging" : null;
-  return {
-    tenantRoot,
-    scope,
-    target,
-    planOnly,
-    wranglerPath,
-    databaseName: state.d1Databases.SITE_DATA_DB.databaseName,
-    pagesProjectName,
-    pagesBranchName,
-    env: {
-      ...process.env,
-      ...env2,
-      CLOUDFLARE_ACCOUNT_ID: resolveConfiguredCloudflareAccountId(deployConfig),
-      ...target.kind === "persistent" && target.scope !== "local" ? { TREESEED_CONTENT_SERVING_MODE: "published_runtime" } : {}
-    },
-    write
-  };
-}
-async function runTenantDataMigration(context) {
-  if (context.planOnly) {
-    writeTreeseedBootstrapLine(context.write, {
-      scope: context.scope,
-      system: "data",
-      task: "d1-migrate",
-      stage: "deploy"
-    }, `Plan: would apply remote migrations for ${context.databaseName}.`);
-    return { databaseName: context.databaseName, planOnly: true };
-  }
-  await runPrefixedWranglerWithRetry(context.tenantRoot, [
-    "d1",
-    "migrations",
-    "apply",
-    context.databaseName,
-    "--remote",
-    "--config",
-    context.wranglerPath
-  ], {
-    env: context.env,
-    write: context.write,
-    prefix: {
-      scope: context.scope,
-      system: "data",
-      task: "d1-migrate",
-      stage: "deploy"
-    }
-  });
-  return { databaseName: context.databaseName, planOnly: false };
-}
-async function runTenantWebBuild(context) {
-  const prefix = {
-    scope: context.scope,
-    system: "web",
-    task: "build",
-    stage: "deploy"
-  };
-  if (context.planOnly) {
-    writeTreeseedBootstrapLine(context.write, prefix, "Plan: skipped tenant build.");
-    return { planOnly: true };
-  }
-  const result = await runPrefixedCommand(process.execPath, [packageScriptPath("tenant-build")], {
-    cwd: context.tenantRoot,
-    env: context.env,
-    write: context.write,
-    prefix
-  });
-  if (result.status !== 0) {
-    throw new Error("tenant-build failed.");
-  }
-  return { planOnly: false };
-}
-async function runTenantWebPublish(context) {
-  const prefix = {
-    scope: context.scope,
-    system: "web",
-    task: "publish",
-    stage: "deploy"
-  };
-  if (context.planOnly) {
-    if (context.pagesProjectName) {
-      writeTreeseedBootstrapLine(context.write, prefix, `Plan: would deploy ${deployTargetLabel(context.target)} to Pages project ${context.pagesProjectName} from ${resolve(context.tenantRoot, "dist")}.`);
-    } else {
-      writeTreeseedBootstrapLine(context.write, prefix, `Plan: would deploy ${deployTargetLabel(context.target)} with generated Wrangler config at ${resolve(context.wranglerPath)}.`);
-    }
-    return { planOnly: true };
-  }
-  if (context.pagesProjectName) {
-    const args = [
-      "pages",
-      "deploy",
-      resolve(context.tenantRoot, "dist"),
-      "--project-name",
-      context.pagesProjectName
-    ];
-    if (context.pagesBranchName) {
-      args.push("--branch", context.pagesBranchName);
-    }
-    await runPrefixedWranglerWithRetry(context.tenantRoot, args, {
-      env: context.env,
-      write: context.write,
-      prefix
-    });
-  } else {
-    await runPrefixedWranglerWithRetry(context.tenantRoot, ["deploy", "--config", context.wranglerPath], {
-      env: context.env,
-      write: context.write,
-      prefix
-    });
-  }
-  return { planOnly: false };
-}
-function inferContentType(filePath) {
-  const extension = extname(filePath).toLowerCase();
-  if (extension === ".json") return "application/json";
-  if (extension === ".md") return "text/markdown; charset=utf-8";
-  if (extension === ".mdx") return "text/mdx; charset=utf-8";
-  return "application/octet-stream";
-}
-function writeTempFile(root, name, body) {
-  const filePath = resolve(root, name);
-  writeFileSync(filePath, body);
-  return filePath;
-}
-function projectPlatformTempRoot(tenantRoot, scope) {
-  const base = resolve(tenantRoot, ".treeseed", "tmp", scope);
-  mkdirSync(base, { recursive: true });
-  return base;
-}
-function toBuffer(body) {
-  if (typeof body === "string") {
-    return Buffer.from(body);
-  }
-  if (body instanceof ArrayBuffer) {
-    return Buffer.from(body);
-  }
-  return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
-}
-function readR2JsonObject(tenantRoot, bucketName, objectKey, wranglerPath, wranglerEnv) {
-  const tempRoot = mkdtempSync(join(projectPlatformTempRoot(tenantRoot, "r2-read"), "treeseed-r2-read-"));
-  const filePath = resolve(tempRoot, basename(objectKey) || "payload.json");
-  try {
-    const result = runWrangler(tenantRoot, [
-      "r2",
-      "object",
-      "get",
-      `${bucketName}/${objectKey}`,
-      "--config",
-      wranglerPath,
-      "--remote",
-      "--file",
-      filePath
-    ], wranglerEnv, { allowFailure: true });
-    if (result.status !== 0 || !statSafe(filePath)) {
-      return null;
-    }
-    return JSON.parse(readFileSync(filePath, "utf8"));
-  } finally {
-    rmSync(tempRoot, { recursive: true, force: true });
-  }
-}
-function statSafe(filePath) {
-  try {
-    return statSync(filePath);
-  } catch {
-    return null;
-  }
-}
-async function reportDeployment(reporter, input) {
-  await reporter.reportDeployment(input);
-}
-function summarizePostDeployHostingAudit(report, phase) {
-  const failedChecks = report.checks.filter((check) => check.status === "failed").length;
-  const repairedChecks = report.checks.filter((check) => check.status === "repaired").length;
-  return {
-    ok: report.ok,
-    phase,
-    environment: report.environment,
-    repairMode: report.repairMode,
-    repaired: report.repaired || repairedChecks > 0,
-    repairedChecks,
-    failedChecks,
-    blockers: report.blockers,
-    warnings: report.warnings,
-    checkedAt: report.checkedAt
-  };
-}
-function hostingAuditHostKindsForSystems(systems) {
-  const hostKinds = /* @__PURE__ */ new Set();
-  for (const system of systems) {
-    if (system === "github") {
-      hostKinds.add("repository");
-    } else if (system === "data" || system === "web") {
-      hostKinds.add("web");
-    } else if (system === "api" || system === "agents") {
-      hostKinds.add("processing");
-    }
-  }
-  return [...hostKinds];
-}
-async function repairHostingAfterSuccessfulDeploy(options, systems) {
-  if (options.scope === "local") {
-    return {
-      ok: true,
-      skipped: true,
-      reason: "local_environment"
-    };
-  }
-  if (options.planOnly) {
-    return {
-      ok: true,
-      skipped: true,
-      reason: "plan"
-    };
-  }
-  if (process.env.TREESEED_POST_DEPLOY_HOSTING_REPAIR === "off") {
-    return {
-      ok: true,
-      skipped: true,
-      reason: "disabled"
-    };
-  }
-  const hostKinds = hostingAuditHostKindsForSystems(systems);
-  if (hostKinds.length === 0) {
-    return {
-      ok: true,
-      skipped: true,
-      reason: "no_host_kinds"
-    };
-  }
-  const environment = options.scope === "prod" ? "prod" : "staging";
-  const env2 = { ...process.env, ...options.env ?? {} };
-  const audit = await runTreeseedHostingAudit({
-    tenantRoot: options.tenantRoot,
-    environment,
-    repair: false,
-    env: env2,
-    hostKinds: [...hostKinds]
-  });
-  if (audit.ok) {
-    return summarizePostDeployHostingAudit(audit, "already_ready");
-  }
-  options.write?.(`[${environment}][hosting][repair] Hosting readiness needs repair after deploy for ${hostKinds.join(", ")}.`);
-  const repaired = await runTreeseedHostingAudit({
-    tenantRoot: options.tenantRoot,
-    environment,
-    repair: true,
-    env: env2,
-    hostKinds: [...hostKinds],
-    write: (line) => options.write?.(`[${environment}][hosting][repair] ${line}`)
-  });
-  const summary = summarizePostDeployHostingAudit(repaired, "repaired");
-  if (!summary.ok) {
-    throw new Error(`Post-deploy hosting repair failed: ${summary.blockers[0] ?? `${summary.failedChecks} failed hosting readiness checks remain.`}`);
-  }
-  return summary;
-}
-function resolveReporter(tenantRoot, explicit) {
-  if (explicit) {
-    return explicit;
-  }
-  const deployConfig = loadCliDeployConfig(tenantRoot);
-  return createControlPlaneReporter({ deployConfig });
-}
-async function uploadObject(tenantRoot, wranglerPath, wranglerEnv, bucketName, pointer, filePath, options) {
-  await runPrefixedWranglerWithRetry(tenantRoot, [
-    "r2",
-    "object",
-    "put",
-    `${bucketName}/${pointer.objectKey}`,
-    "--config",
-    wranglerPath,
-    "--remote",
-    "--force",
-    "--file",
-    filePath,
-    "--content-type",
-    pointer.contentType ?? inferContentType(filePath)
-  ], {
-    env: wranglerEnv,
-    write: options.write,
-    prefix: options.prefix
-  });
-}
-function deleteObject(tenantRoot, wranglerPath, wranglerEnv, bucketName, objectKey) {
-  runWrangler(tenantRoot, [
-    "r2",
-    "object",
-    "delete",
-    `${bucketName}/${objectKey}`,
-    "--config",
-    wranglerPath,
-    "--remote"
-  ], wranglerEnv, { allowFailure: true });
-}
-function objectFileName(pointer) {
-  const ext = extname(pointer.objectKey) || ".json";
-  return `${pointer.sha256}${ext}`;
-}
-function canonicalSitePathForEntry(entry) {
-  return entry.model === "pages" ? `/${entry.slug || entry.id || ""}`.replace(/\/+$/u, "") || "/" : `/${entry.model}/${entry.slug || entry.id || ""}`.replace(/\/+$/u, "");
-}
-function contentIndexPathForModel(model) {
-  return model === "pages" ? null : `/${model}`;
-}
-function sourceLikeFreshnessPaths() {
-  return ["/", "/feed.xml", "/sitemap-index.xml"];
-}
-function entrySignature(entry) {
-  const { publishedAt, ...rest } = entry;
-  return stableHash(JSON.stringify(rest));
-}
-function artifactSignature(artifact) {
-  const { publishedAt, ...rest } = artifact;
-  return stableHash(JSON.stringify(rest));
-}
-function canonicalEntryPath(entry) {
-  return `${entry.model}/${entry.slug || entry.id || ""}`.replace(/^\/+|\/+$/gu, "");
-}
-function changedEntries(previousManifest, nextEntries) {
-  const previous = new Map((previousManifest?.entries ?? []).map((entry) => [canonicalEntryPath(entry), entrySignature(entry)]));
-  return nextEntries.filter((entry) => previous.get(canonicalEntryPath(entry)) !== entrySignature(entry));
-}
-function changedArtifacts(previousManifest, nextArtifacts) {
-  const previous = new Map((previousManifest?.artifacts ?? []).map((artifact) => [`${artifact.kind}:${artifact.itemId}`, artifactSignature(artifact)]));
-  return nextArtifacts.filter((artifact) => previous.get(`${artifact.kind}:${artifact.itemId}`) !== artifactSignature(artifact));
-}
-function absoluteUrl(baseUrl, path) {
-  if (!baseUrl) {
-    return null;
-  }
-  try {
-    return new URL(path.startsWith("/") ? path : `/${path}`, baseUrl).toString();
-  } catch {
-    return null;
-  }
-}
-function stableEntryAliasKey(teamId, entry) {
-  const ext = extname(entry.content.objectKey) || ".md";
-  return `teams/${teamId}/published/entries/${entry.model}/${entry.slug || entry.id}${ext}`;
-}
-function stableArtifactAliasKey(teamId, artifact) {
-  const fileName = typeof artifact.metadata?.fileName === "string" && artifact.metadata.fileName ? artifact.metadata.fileName : `${artifact.itemId}${extname(artifact.content.objectKey) || ".bin"}`;
-  return `teams/${teamId}/published/artifacts/${artifact.kind}/${artifact.itemId}/${fileName}`;
-}
-async function probeHttp(url, { attempts = 1, delayMs = 2e3 } = {}) {
-  let result = {
-    ok: false,
-    status: null,
-    url
-  };
-  const maxAttempts = Math.max(1, Math.floor(attempts));
-  for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
-    try {
-      const response = await fetch(url, {
-        headers: { accept: "application/json,text/html;q=0.9,*/*;q=0.8" }
-      });
-      result = {
-        ok: response.ok,
-        status: response.status,
-        url,
-        attempts: attempt
-      };
-    } catch (error) {
-      result = {
-        ok: false,
-        status: null,
-        url,
-        error: error instanceof Error ? error.message : String(error),
-        attempts: attempt
-      };
-    }
-    if (result.ok || attempt >= maxAttempts) {
-      return result;
-    }
-    await sleep(delayMs);
-  }
-  return result;
-}
-function findFirstMatchingString(value, matcher, seen = /* @__PURE__ */ new Set()) {
-  if (typeof value === "string") {
-    return matcher(value) ? value : null;
-  }
-  if (!value || typeof value !== "object") {
-    return null;
-  }
-  if (seen.has(value)) {
-    return null;
-  }
-  seen.add(value);
-  if (Array.isArray(value)) {
-    for (const entry of value) {
-      const match = findFirstMatchingString(entry, matcher, seen);
-      if (match) {
-        return match;
-      }
-    }
-    return null;
-  }
-  for (const entry of Object.values(value)) {
-    const match = findFirstMatchingString(entry, matcher, seen);
-    if (match) {
-      return match;
-    }
-  }
-  return null;
-}
-function resolveImmediatePagesProbeUrl(siteConfig, state, target) {
-  if (target.kind === "persistent" && target.scope === "prod" && state.pages?.projectName) {
-    return `https://${state.pages.projectName}.pages.dev`;
-  }
-  const configuredUrl = resolveConfiguredSurfaceBaseUrl(siteConfig, target, "web");
-  if (configuredUrl) {
-    return configuredUrl;
-  }
-  if (target.kind === "persistent" && target.scope === "staging" && state.pages?.projectName) {
-    return `https://${state.pages?.stagingBranch ?? "staging"}.${state.pages.projectName}.pages.dev`;
-  }
-  return state.pages?.url ?? siteConfig.siteUrl;
-}
-function resolveImmediateApiProbeUrl(siteConfig, state, target) {
-  const configuredUrl = resolveConfiguredSurfaceBaseUrl(siteConfig, target, "api") ?? siteConfig.services?.api?.environments?.[target.kind === "persistent" ? target.scope : "prod"]?.baseUrl ?? siteConfig.services?.api?.publicBaseUrl ?? process.env.TREESEED_API_BASE_URL ?? state.services?.api?.lastDeployedUrl ?? null;
-  if (configuredUrl) {
-    return configuredUrl;
-  }
-  const railwayHost = findFirstMatchingString(
-    state,
-    (value) => /^[a-z0-9-]+\.up\.railway\.app$/iu.test(String(value).trim())
-  );
-  if (railwayHost) {
-    return `https://${railwayHost}`;
-  }
-  return null;
-}
-function resolveApiMonitorEndpoints(siteConfig, apiBaseUrl) {
-  if (!apiBaseUrl) {
-    return {
-      apiHealth: null,
-      apiReady: null,
-      d1Health: null,
-      agentHealth: null,
-      processingAgentApi: false
-    };
-  }
-  const baseUrl = String(apiBaseUrl).replace(/\/+$/u, "");
-  return {
-    apiHealth: `${baseUrl}/healthz`,
-    apiReady: `${baseUrl}/readyz`,
-    d1Health: `${baseUrl}/healthz/deep`,
-    agentHealth: null,
-    processingAgentApi: false
-  };
-}
-function r2HealthKey(state) {
-  return `${state.content?.manifestKey?.replace(/\/common\.json$/u, "") ?? "health"}/healthchecks/${Date.now()}.json`;
-}
-function deleteR2Object(tenantRoot, bucketName, objectKey, wranglerPath, wranglerEnv) {
-  runWrangler(tenantRoot, [
-    "r2",
-    "object",
-    "delete",
-    `${bucketName}/${objectKey}`,
-    "--config",
-    wranglerPath,
-    "--remote"
-  ], wranglerEnv, { allowFailure: true });
-}
-function probeR2(tenantRoot, siteConfig, state, target) {
-  const bucketName = state.content?.bucketName;
-  const cloudflareAccountId = String(process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? siteConfig.cloudflare.accountId ?? "").trim();
-  if (!bucketName) {
-    return { ok: false, skipped: true, reason: "r2_unconfigured" };
-  }
-  const { wranglerPath } = ensureGeneratedWranglerConfig(tenantRoot, { target });
-  const wranglerEnv = { CLOUDFLARE_ACCOUNT_ID: cloudflareAccountId };
-  const tempRoot = mkdtempSync(join(projectPlatformTempRoot(tenantRoot, "r2-health"), "treeseed-r2-health-"));
-  const objectKey = r2HealthKey(state);
-  try {
-    const payload = JSON.stringify({ ok: true, createdAt: (/* @__PURE__ */ new Date()).toISOString() });
-    const writeFile = writeTempFile(tempRoot, "probe.json", payload);
-    runWrangler(tenantRoot, [
-      "r2",
-      "object",
-      "put",
-      `${bucketName}/${objectKey}`,
-      "--config",
-      wranglerPath,
-      "--remote",
-      "--force",
-      "--file",
-      writeFile,
-      "--content-type",
-      "application/json"
-    ], wranglerEnv);
-    const readBack = readR2JsonObject(tenantRoot, bucketName, objectKey, wranglerPath, wranglerEnv);
-    return {
-      ok: Boolean(readBack?.ok),
-      objectKey
-    };
-  } finally {
-    deleteR2Object(tenantRoot, bucketName, objectKey, wranglerPath, wranglerEnv);
-    rmSync(tempRoot, { recursive: true, force: true });
-  }
-}
-function probeScaleConfiguration(siteConfig, state) {
-  const marketRunner = state.services?.operationsRunner ?? {};
-  const marketRunnerConfig = siteConfig.services?.operationsRunner ?? {};
-  const scalerKind = String(process.env.TREESEED_WORKER_POOL_SCALER ?? "").trim();
-  if (marketRunnerConfig.provider === "railway") {
-    const runnerServiceId = marketRunner.serviceId ?? null;
-    const runnerServiceName = marketRunner.serviceName ?? marketRunnerConfig.railway?.serviceName ?? null;
-    return {
-      ok: Boolean(runnerServiceId || runnerServiceName),
-      mocked: true,
-      serviceId: runnerServiceId,
-      serviceName: runnerServiceName,
-      runnerKind: "market_operations_runner"
-    };
-  }
-  if (scalerKind !== "railway") {
-    return {
-      ok: true,
-      skipped: true,
-      reason: "scaler_unconfigured",
-      mocked: true,
-      serviceId: null
-    };
-  }
-  const serviceIdentifier = process.env.TREESEED_RAILWAY_WORKER_SERVICE_ID;
-  const environmentIdentifier = process.env.TREESEED_RAILWAY_ENVIRONMENT_ID;
-  const projectIdentifier = process.env.TREESEED_RAILWAY_PROJECT_ID;
-  return {
-    ok: Boolean(serviceIdentifier && (environmentIdentifier || projectIdentifier)),
-    mocked: true,
-    serviceId: worker.serviceId ?? null,
-    serviceName: worker.serviceName ?? null
-  };
-}
-async function publishContent(options, reporter, publishOptions = {}) {
-  const target = runTenantPublishContentPreflight(options);
-  const siteConfig = loadCliDeployConfig(options.tenantRoot);
-  const tenantConfig = loadTreeseedManifest(resolve(options.tenantRoot, "src", "manifest.yaml"));
-  const teamId = resolveTreeseedResourceIdentity(siteConfig, target).teamId;
-  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-  const commitSha = currentCommit(options.tenantRoot);
-  const branchName = currentRef(options.tenantRoot);
-  const previewId = options.previewId ?? `staging-${sanitizeSegment(branchName, "preview")}-${sanitizeSegment(commitSha?.slice(0, 12), "latest")}`;
-  const locator = resolveTeamScopedContentLocator(siteConfig, teamId);
-  const { wranglerPath } = ensureGeneratedWranglerConfig(options.tenantRoot, { target });
-  const wranglerEnv = { CLOUDFLARE_ACCOUNT_ID: String(process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? siteConfig.cloudflare.accountId ?? "").trim() };
-  const bucketName = String(process.env.TREESEED_CONTENT_BUCKET_NAME ?? siteConfig.cloudflare.r2?.bucketName ?? "").trim();
-  if (!bucketName) {
-    throw new Error("Treeseed content publish requires TREESEED_CONTENT_BUCKET_NAME to be configured.");
-  }
-  const previousManifest = readR2JsonObject(
-    options.tenantRoot,
-    bucketName,
-    locator.manifestKey,
-    wranglerPath,
-    wranglerEnv
-  );
-  const pipeline = createPublishedContentPipeline({
-    projectRoot: options.tenantRoot,
-    siteConfig,
-    tenantConfig,
-    teamId,
-    generatedAt: timestamp,
-    sourceCommit: commitSha,
-    sourceRef: branchName,
-    previewId
-  });
-  const publishMode = publishOptions.mode ?? (options.scope === "staging" ? "editorial_overlay" : "production");
-  const built = publishMode === "editorial_overlay" ? await pipeline.buildEditorialOverlay({ previousManifest, previewId }) : await pipeline.buildProductionRevision({ previousManifest });
-  const changedEntrySet = "manifest" in built ? changedEntries(previousManifest, built.manifest.entries) : [];
-  const changedArtifactSet = "manifest" in built ? changedArtifacts(previousManifest, built.manifest.artifacts ?? []) : [];
-  const tombstones = "manifest" in built ? built.manifest.tombstones ?? [] : [];
-  const objectByKey = new Map(built.objects.map((object) => [object.pointer.objectKey, object]));
-  const publicObjectBaseUrl = process.env.TREESEED_CONTENT_PUBLIC_BASE_URL ?? siteConfig.cloudflare.r2?.publicBaseUrl ?? null;
-  const stableObjectUploads = [];
-  const deletedObjectKeys = [];
-  const contentPurgeUrls = /* @__PURE__ */ new Set();
-  if ("manifest" in built && publicObjectBaseUrl) {
-    for (const entry of built.manifest.entries) {
-      entry.content.publicUrl = absoluteUrl(publicObjectBaseUrl, stableEntryAliasKey(teamId, entry)) ?? void 0;
-    }
-    for (const artifact of built.manifest.artifacts ?? []) {
-      artifact.content.publicUrl = artifact.content.publicUrl ?? absoluteUrl(publicObjectBaseUrl, stableArtifactAliasKey(teamId, artifact)) ?? void 0;
-    }
-    for (const entry of changedEntrySet) {
-      const current = entry;
-      const sourceObject = objectByKey.get(current.content.objectKey);
-      const publicUrl = current.content.publicUrl ?? absoluteUrl(publicObjectBaseUrl, stableEntryAliasKey(teamId, current));
-      if (sourceObject) {
-        stableObjectUploads.push({
-          pointer: {
-            objectKey: stableEntryAliasKey(teamId, current),
-            sha256: sourceObject.pointer.sha256,
-            size: sourceObject.pointer.size,
-            contentType: sourceObject.pointer.contentType,
-            publicUrl: publicUrl ?? void 0
-          },
-          body: toBuffer(sourceObject.body)
-        });
-      }
-      if (publicUrl) {
-        contentPurgeUrls.add(publicUrl);
-      }
-      contentPurgeUrls.add(absoluteUrl(siteConfig.siteUrl, canonicalSitePathForEntry(current)) ?? "");
-      const indexPath = contentIndexPathForModel(current.model);
-      if (indexPath) {
-        contentPurgeUrls.add(absoluteUrl(siteConfig.siteUrl, indexPath) ?? "");
-      }
-    }
-    for (const artifact of changedArtifactSet) {
-      const current = artifact;
-      const sourceObject = objectByKey.get(current.content.objectKey);
-      const publicUrl = current.content.publicUrl ?? absoluteUrl(publicObjectBaseUrl, stableArtifactAliasKey(teamId, current));
-      if (sourceObject && publicUrl) {
-        stableObjectUploads.push({
-          pointer: {
-            objectKey: stableArtifactAliasKey(teamId, current),
-            sha256: sourceObject.pointer.sha256,
-            size: sourceObject.pointer.size,
-            contentType: sourceObject.pointer.contentType,
-            publicUrl
-          },
-          body: toBuffer(sourceObject.body)
-        });
-      }
-      if (publicUrl) {
-        contentPurgeUrls.add(publicUrl);
-      }
-    }
-    for (const tombstone of tombstones) {
-      const [model, ...slugParts] = String(tombstone.path ?? "").split("/");
-      if (!model || slugParts.length === 0) {
-        continue;
-      }
-      const slug = slugParts.join("/");
-      const aliasKey = stableEntryAliasKey(teamId, { model, slug, content: { objectKey: `${slug}.md` } });
-      deletedObjectKeys.push(aliasKey);
-      contentPurgeUrls.add(absoluteUrl(publicObjectBaseUrl, aliasKey) ?? "");
-      contentPurgeUrls.add(absoluteUrl(siteConfig.siteUrl, canonicalSitePathForEntry({ model, slug })) ?? "");
-      const indexPath = contentIndexPathForModel(model);
-      if (indexPath) {
-        contentPurgeUrls.add(absoluteUrl(siteConfig.siteUrl, indexPath) ?? "");
-      }
-    }
-    for (const freshnessPath of sourceLikeFreshnessPaths()) {
-      contentPurgeUrls.add(absoluteUrl(siteConfig.siteUrl, freshnessPath) ?? "");
-    }
-  }
-  const tempRoot = mkdtempSync(join(projectPlatformTempRoot(options.tenantRoot, "content-publish"), "treeseed-content-publish-"));
-  try {
-    if (!options.planOnly) {
-      const uploadOptions = {
-        write: options.write,
-        prefix: {
-          scope: options.scope,
-          system: "content",
-          task: "publish",
-          stage: "upload"
-        }
-      };
-      for (const object of built.objects) {
-        const filePath = writeTempFile(tempRoot, objectFileName(object.pointer), toBuffer(object.body));
-        await uploadObject(options.tenantRoot, wranglerPath, wranglerEnv, bucketName, object.pointer, filePath, uploadOptions);
-      }
-      for (const alias of stableObjectUploads) {
-        const filePath = writeTempFile(tempRoot, objectFileName(alias.pointer), alias.body);
-        await uploadObject(options.tenantRoot, wranglerPath, wranglerEnv, bucketName, alias.pointer, filePath, uploadOptions);
-      }
-      for (const objectKey of deletedObjectKeys) {
-        deleteObject(options.tenantRoot, wranglerPath, wranglerEnv, bucketName, objectKey);
-      }
-      if ("overlay" in built) {
-        const overlayFile = writeTempFile(tempRoot, "overlay.json", Buffer.from(JSON.stringify(built.overlay, null, 2)));
-        await uploadObject(
-          options.tenantRoot,
-          wranglerPath,
-          wranglerEnv,
-          bucketName,
-          {
-            objectKey: built.overlay.locator?.overlayKey ?? `${locator.previewRoot}/${previewId}/overlay.json`,
-            sha256: stableHash(readFileSync(overlayFile)),
-            size: statSync(overlayFile).size,
-            contentType: "application/json"
-          },
-          overlayFile,
-          uploadOptions
-        );
-      } else {
-        const manifestFile = writeTempFile(tempRoot, "manifest.json", Buffer.from(JSON.stringify(built.manifest, null, 2)));
-        const snapshotKey = locator.manifestKey.replace(/\/common\.json$/u, `/manifests/${built.manifest.revision}.json`);
-        await uploadObject(options.tenantRoot, wranglerPath, wranglerEnv, bucketName, {
-          objectKey: snapshotKey,
-          sha256: stableHash(readFileSync(manifestFile)),
-          size: statSync(manifestFile).size,
-          contentType: "application/json"
-        }, manifestFile, uploadOptions);
-        await uploadObject(options.tenantRoot, wranglerPath, wranglerEnv, bucketName, {
-          objectKey: locator.manifestKey,
-          sha256: stableHash(readFileSync(manifestFile)),
-          size: statSync(manifestFile).size,
-          contentType: "application/json"
-        }, manifestFile, uploadOptions);
-        if (contentPurgeUrls.size > 0) {
-          try {
-            purgePublishedContentCaches(options.tenantRoot, [...contentPurgeUrls].filter(Boolean), { target, env });
-          } catch {
-          }
-        }
-      }
-    }
-    const state = loadDeployState(options.tenantRoot, siteConfig, { target });
-    if (!options.planOnly) {
-      state.content.lastPublishedManifestRevision = "overlay" in built ? built.overlay.previewId : built.manifest.revision;
-      state.content.lastPublishedManifestSha256 = stableHash(
-        JSON.stringify("overlay" in built ? built.overlay : built.manifest)
-      );
-      writeDeployState(options.tenantRoot, state, { target });
-    }
-    const previewToken = publishMode === "editorial_overlay" && process.env.TREESEED_EDITORIAL_PREVIEW_SECRET ? signEditorialPreviewToken({
-      teamId,
-      previewId,
-      expiresAt: "overlay" in built ? built.overlay.expiresAt ?? new Date(Date.now() + resolvePublishedContentPreviewTtlHours(siteConfig) * 60 * 60 * 1e3).toISOString() : new Date(Date.now() + resolvePublishedContentPreviewTtlHours(siteConfig) * 60 * 60 * 1e3).toISOString()
-    }, process.env.TREESEED_EDITORIAL_PREVIEW_SECRET) : null;
-    const previewBaseUrl = state.pages?.url ?? siteConfig.siteUrl;
-    const previewUrl = previewToken ? `${previewBaseUrl}?preview=${encodeURIComponent(previewToken)}` : null;
-    await reportDeployment(reporter, {
-      environment: options.scope,
-      deploymentKind: "content",
-      status: "success",
-      sourceRef: branchName,
-      commitSha,
-      triggeredByType: "project_runner",
-      metadata: {
-        mode: publishMode,
-        revision: "overlay" in built ? built.overlay.previewId : built.manifest.revision,
-        previewId: publishMode === "editorial_overlay" ? previewId : null,
-        previewUrl,
-        entries: ("overlay" in built ? built.overlay.entries : built.manifest.entries).length,
-        artifacts: ("overlay" in built ? built.overlay.artifacts : built.manifest.artifacts)?.length ?? 0,
-        catalog: built.catalog.length,
-        cachePurgeCount: contentPurgeUrls.size
-      },
-      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-    });
-    return {
-      ok: true,
-      scope: options.scope,
-      mode: publishMode,
-      revision: "overlay" in built ? built.overlay.previewId : built.manifest.revision,
-      previewId: publishMode === "editorial_overlay" ? previewId : null,
-      previewUrl,
-      target: deployTargetLabel(target)
-    };
-  } finally {
-    rmSync(tempRoot, { recursive: true, force: true });
-  }
-}
-async function provisionProjectPlatform(options) {
-  writeWorkflowStatus(`provision:start scope=${options.scope}`);
-  const timings = [];
-  writeWorkflowStatus("provision:resolve-reporter");
-  const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  writeWorkflowStatus(`provision:reporter kind=${reporter.kind} enabled=${reporter.enabled ? "true" : "false"}`);
-  const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
-  writeWorkflowStatus(`provision:target ${deployTargetLabel(target)}`);
-  const siteConfig = loadCliDeployConfig(options.tenantRoot);
-  writeWorkflowStatus("provision:resolve-bootstrap-systems");
-  const bootstrapSystems = resolveProjectPlatformBootstrapSystems(options, siteConfig);
-  const selectedSystems = new Set(bootstrapSystems);
-  const env2 = { ...process.env, ...options.env ?? {} };
-  writeWorkflowStatus(`provision:reconcile:start systems=${bootstrapSystems.join(",") || "(none)"}`);
-  const summary = await timedPhase(timings, "provision:reconcile", () => reconcileTreeseedTarget({
-    tenantRoot: options.tenantRoot,
-    target,
-    env: env2,
-    systems: bootstrapSystems,
-    write: options.write,
-    planOnly: options.planOnly
-  }));
-  writeWorkflowStatus("provision:reconcile:done");
-  timings.push(...summary.timings ?? []);
-  writeWorkflowStatus("provision:collect-reconcile-status:start");
-  const verification = await timedPhase(timings, "provision:collect-reconcile-status", () => collectTreeseedReconcileStatus({
-    tenantRoot: options.tenantRoot,
-    target,
-    env: env2,
-    systems: bootstrapSystems
-  }));
-  writeWorkflowStatus("provision:collect-reconcile-status:done");
-  if (selectedSystems.has("data") || selectedSystems.has("web")) {
-    writeWorkflowStatus("provision:ensure-wrangler-config:start");
-    await timedPhase(timings, "provision:ensure-wrangler-config", () => {
-      ensureGeneratedWranglerConfig(options.tenantRoot, { target });
-    });
-    writeWorkflowStatus("provision:ensure-wrangler-config:done");
-  } else {
-    writeWorkflowStatus("provision:ensure-wrangler-config:skipped");
-  }
-  const shouldValidateRailway = selectedSystems.has("api") || selectedSystems.has("agents");
-  const railwayValidation = shouldValidateRailway ? options.scope === "local" ? validateRailwayServiceConfiguration(options.tenantRoot, options.scope) : validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env: env2 }) : { services: [] };
-  const railwaySchedules = [];
-  const railwayScheduleVerification = {
-    ok: true,
-    checks: [],
-    skipped: true,
-    reason: "deploy_only"
-  };
-  const state = loadDeployState(options.tenantRoot, siteConfig, { target });
-  await reporter.reportEnvironment({
-    environment: options.scope,
-    deploymentProfile: siteConfig.hosting?.kind ?? "self_hosted_project",
-    baseUrl: state.lastDeployedUrl,
-    cloudflareAccountId: String(process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? siteConfig.cloudflare.accountId ?? "").trim() || null,
-    pagesProjectName: state.pages?.projectName ?? null,
-    workerName: state.workerName,
-    r2BucketName: state.content?.bucketName ?? null,
-    d1DatabaseName: state.d1Databases?.SITE_DATA_DB?.databaseName ?? null,
-    railwayProjectName: railwayValidation.services[0]?.projectName ?? null,
-    metadata: {
-      target: deployTargetLabel(target),
-      previewEnabled: state.previewEnabled ?? false,
-      readiness: state.readiness
-    }
-  });
-  const resourceReports = [
-    {
-      environment: options.scope,
-      provider: "cloudflare",
-      resourceKind: "pages",
-      logicalName: state.pages?.projectName ?? "pages",
-      locator: state.pages?.url ?? null,
-      metadata: state.pages ?? {}
-    },
-    {
-      environment: options.scope,
-      provider: "cloudflare",
-      resourceKind: "worker",
-      logicalName: state.workerName,
-      locator: state.lastDeployedUrl ?? null,
-      metadata: { workerName: state.workerName }
-    },
-    {
-      environment: options.scope,
-      provider: "cloudflare",
-      resourceKind: "kv",
-      logicalName: state.kvNamespaces?.FORM_GUARD_KV?.name ?? "form-guard",
-      locator: state.kvNamespaces?.FORM_GUARD_KV?.id ?? null,
-      metadata: state.kvNamespaces?.FORM_GUARD_KV ?? {}
-    },
-    {
-      environment: options.scope,
-      provider: "cloudflare",
-      resourceKind: "turnstile-widget",
-      logicalName: state.turnstileWidgets?.formGuard?.name ?? "form-guard-turnstile",
-      locator: state.turnstileWidgets?.formGuard?.sitekey ?? null,
-      metadata: state.turnstileWidgets?.formGuard ?? {}
-    },
-    {
-      environment: options.scope,
-      provider: "cloudflare",
-      resourceKind: "r2",
-      logicalName: state.content?.bucketName ?? "content",
-      locator: state.content?.manifestKey ?? null,
-      metadata: state.content ?? {}
-    },
-    {
-      environment: options.scope,
-      provider: "cloudflare",
-      resourceKind: "d1",
-      logicalName: state.d1Databases?.SITE_DATA_DB?.databaseName ?? "site-data",
-      locator: state.d1Databases?.SITE_DATA_DB?.databaseId ?? null,
-      metadata: state.d1Databases?.SITE_DATA_DB ?? {}
-    }
-  ];
-  for (const resource of resourceReports) {
-    await reporter.reportResource(resource);
-  }
-  for (const service of railwayValidation.services) {
-    await reporter.reportResource({
-      environment: options.scope,
-      provider: "railway",
-      resourceKind: service.serviceId ? "railway_service" : "railway_project",
-      logicalName: service.key,
-      locator: service.serviceName ?? service.serviceId ?? service.projectName ?? service.projectId ?? null,
-      metadata: service
-    });
-  }
-  for (const schedule of railwaySchedules) {
-    const serviceState = state.services?.[schedule.service];
-    if (serviceState) {
-      serviceState.lastScheduleSyncAt = (/* @__PURE__ */ new Date()).toISOString();
-    }
-    state.railwaySchedules[schedule.logicalName] = {
-      ...state.railwaySchedules[schedule.logicalName] ?? {},
-      ...schedule,
-      lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await reporter.reportResource({
-      environment: options.scope,
-      provider: "railway",
-      resourceKind: "railway_schedule",
-      logicalName: schedule.logicalName,
-      locator: schedule.id ?? schedule.expression,
-      metadata: schedule
-    });
-  }
-  writeDeployState(options.tenantRoot, state, { target });
-  markDeploymentInitialized(options.tenantRoot, { target });
-  await reportDeployment(reporter, {
-    environment: options.scope,
-    deploymentKind: "provision",
-    status: "success",
-    sourceRef: currentRef(options.tenantRoot),
-    commitSha: currentCommit(options.tenantRoot),
-    triggeredByType: "project_runner",
-    metadata: {
-      target: deployTargetLabel(target),
-      summary,
-      verification,
-      timings,
-      reconcileActions: summary.results.map((result) => ({
-        unitId: result.unit.unitId,
-        action: result.action,
-        provider: result.unit.provider
-      })),
-      railwayServices: railwayValidation.services.map((service) => service.key),
-      railwaySchedules,
-      railwayScheduleVerification
-    },
-    finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  return {
-    ok: true,
-    scope: options.scope,
-    target: deployTargetLabel(target),
-    summary,
-    verification,
-    timings,
-    railway: {
-      services: railwayValidation.services.map((service) => service.key),
-      schedules: railwaySchedules,
-      verification: railwayScheduleVerification
-    }
-  };
-}
-async function deployProjectPlatform(options) {
-  writeWorkflowStatus(`deploy:start scope=${options.scope} planOnly=${options.planOnly ? "true" : "false"}`);
-  const timings = [];
-  const deployStartMs = performance.now();
-  writeWorkflowStatus("deploy:resolve-reporter");
-  const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  writeWorkflowStatus(`deploy:reporter kind=${reporter.kind} enabled=${reporter.enabled ? "true" : "false"}`);
-  const commitSha = currentCommit(options.tenantRoot);
-  const branchName = currentRef(options.tenantRoot);
-  writeWorkflowStatus("deploy:resolve-bootstrap-systems");
-  const bootstrapSystems = resolveProjectPlatformBootstrapSystems(options);
-  const selectedSystems = new Set(bootstrapSystems);
-  const execution = options.bootstrapExecution ?? "parallel";
-  const write = options.write;
-  const env2 = { ...process.env, ...options.env ?? {} };
-  writeWorkflowStatus(`deploy:bootstrap-systems ${bootstrapSystems.join(",") || "(none)"}`);
-  writeWorkflowStatus("deploy:report-running");
-  await reportDeployment(reporter, {
-    environment: options.scope,
-    deploymentKind: "code",
-    status: "running",
-    sourceRef: branchName,
-    commitSha,
-    triggeredByType: "project_runner",
-    metadata: { scope: options.scope }
-  });
-  writeWorkflowStatus("deploy:reported-running");
-  if (!options.skipProvision) {
-    writeWorkflowStatus("deploy:provision:start");
-    const provision = await timedPhase(timings, "deploy:provision", () => provisionProjectPlatform({ ...options, reporter, bootstrapSystems }));
-    timings.push(...provision.timings ?? []);
-    writeWorkflowStatus("deploy:provision:done");
-  }
-  const nodes = [];
-  let cloudflareContext = null;
-  if (options.scope === "local" && selectedSystems.has("web")) {
-    nodes.push({
-      id: "web:build",
-      run: () => runTenantWebBuild({
-        tenantRoot: options.tenantRoot,
-        scope: "local",
-        planOnly: options.planOnly,
-        env: env2,
-        write
-      })
-    });
-  } else if (selectedSystems.has("data") || selectedSystems.has("web")) {
-    cloudflareContext = prepareTenantCloudflareDeploy({
-      tenantRoot: options.tenantRoot,
-      scope: options.scope,
-      planOnly: options.planOnly,
-      write,
-      env: env2
-    });
-  }
-  if (cloudflareContext && selectedSystems.has("data")) {
-    const context = cloudflareContext;
-    nodes.push({
-      id: "data:d1-migrate",
-      run: () => runTenantDataMigration(context)
-    });
-  }
-  if (cloudflareContext && selectedSystems.has("web")) {
-    const context = cloudflareContext;
-    const contentNodeId = "content:publish-runtime";
-    nodes.push({
-      id: contentNodeId,
-      dependencies: selectedSystems.has("data") ? ["data:d1-migrate"] : [],
-      run: () => publishContent({
-        ...options,
-        reporter,
-        bootstrapSystems: ["web"]
-      }, reporter, { mode: "production" })
-    });
-    nodes.push({
-      id: "web:build",
-      run: () => runTenantWebBuild(context)
-    });
-    nodes.push({
-      id: "web:publish",
-      dependencies: ["web:build", contentNodeId, ...selectedSystems.has("data") ? ["data:d1-migrate"] : []],
-      run: () => runTenantWebPublish(context)
-    });
-  }
-  const serviceResultsByKey = /* @__PURE__ */ new Map();
-  let selectedRailwayServiceKeys = [];
-  if (options.scope !== "local" && (selectedSystems.has("api") || selectedSystems.has("agents"))) {
-    const validation = validateRailwayDeployPrerequisites(options.tenantRoot, options.scope, { env: env2 });
-    const selectedServices = validation.services.filter(
-      (service) => service.key === "api" ? selectedSystems.has("api") : selectedSystems.has("agents")
-    );
-    const sequentialRailwayDeploys = String(env2.TREESEED_RAILWAY_DEPLOY_SEQUENTIAL ?? "").trim() === "1";
-    let previousRailwayDeployNodeId = null;
-    for (const service of selectedServices) {
-      const system = service.key === "api" ? "api" : "agents";
-      const nodeId = `${system}:${service.key}-railway-deploy`;
-      selectedRailwayServiceKeys.push(service.key);
-      nodes.push({
-        id: nodeId,
-        dependencies: resolveRailwayServiceDeployDependencies({
-          includeDataDependency: selectedSystems.has("data"),
-          previousRailwayDeployNodeId,
-          sequentialRailwayDeploys
-        }),
-        run: async () => {
-          const result = await deployRailwayService(options.tenantRoot, service, {
-            planOnly: options.planOnly,
-            write,
-            env: env2,
-            prefix: {
-              scope: options.scope,
-              system,
-              task: `${service.key}-railway-deploy`,
-              stage: "deploy"
-            }
-          });
-          serviceResultsByKey.set(service.key, result);
-          return result;
-        }
-      });
-      if (sequentialRailwayDeploys) {
-        previousRailwayDeployNodeId = nodeId;
-      }
-    }
-  }
-  const managesRailwaySchedules = options.scope === "staging" || options.scope === "prod";
-  let railwaySchedules = [];
-  let railwayScheduleVerification = { ok: true, checks: [], skipped: true, reason: !selectedSystems.has("agents") ? "agents_not_selected" : !managesRailwaySchedules ? "scope_not_scheduled" : "plan" };
-  if (managesRailwaySchedules && selectedSystems.has("agents")) {
-    const agentDeployNodeIds = nodes.filter((node) => node.id.startsWith("agents:") && node.id.endsWith("-railway-deploy")).map((node) => node.id);
-    nodes.push({
-      id: "agents:schedules",
-      dependencies: agentDeployNodeIds,
-      run: async () => {
-        writeTreeseedBootstrapLine(write, {
-          scope: options.scope,
-          system: "agents",
-          task: "schedules",
-          stage: "deploy"
-        }, "Reconciling Railway schedules...");
-        railwaySchedules = await ensureRailwayScheduledJobs(options.tenantRoot, options.scope, { planOnly: options.planOnly, env: env2 });
-        railwayScheduleVerification = !options.planOnly ? await verifyRailwayScheduledJobs(options.tenantRoot, options.scope) : { ok: true, checks: railwaySchedules, skipped: true, reason: "plan" };
-        return {
-          service: "railway-schedules",
-          status: railwayScheduleVerification.ok ? "verified" : "failed",
-          command: "railway schedules reconcile",
-          cwd: options.tenantRoot,
-          publicBaseUrl: null,
-          schedules: railwaySchedules,
-          scheduleVerification: railwayScheduleVerification
-        };
-      }
-    });
-  }
-  await runTreeseedBootstrapDag({ nodes, execution, write, timings });
-  const serviceResults = selectedRailwayServiceKeys.map((serviceKey) => serviceResultsByKey.get(serviceKey)).filter(Boolean);
-  for (const result of serviceResults) {
-    timings.push(...result.timings ?? []);
-  }
-  if (options.scope !== "local" && !options.planOnly && (selectedSystems.has("web") || serviceResults.length > 0)) {
-    finalizeDeploymentState(options.tenantRoot, {
-      target: createPersistentDeployTarget(options.scope),
-      serviceResults,
-      env: env2
-    });
-  }
-  if (!managesRailwaySchedules || !selectedSystems.has("agents")) {
-    railwaySchedules = [];
-    railwayScheduleVerification = { ok: true, checks: railwaySchedules, skipped: true, reason: !selectedSystems.has("agents") ? "agents_not_selected" : !managesRailwaySchedules ? "scope_not_scheduled" : "plan" };
-  }
-  if (selectedSystems.has("agents")) {
-    serviceResults.push({
-      service: "railway-schedules",
-      status: railwayScheduleVerification.ok ? "verified" : "failed",
-      command: "railway schedules reconcile",
-      cwd: options.tenantRoot,
-      publicBaseUrl: null,
-      schedules: railwaySchedules,
-      scheduleVerification: railwayScheduleVerification
-    });
-  }
-  const monitor = await timedPhase(timings, "deploy:monitor", () => monitorProjectPlatform({ ...options, reporter, bootstrapSystems }));
-  timings.push(...monitor.timings ?? []);
-  const hostingRepair = await timedPhase(timings, "deploy:hosting-repair", () => repairHostingAfterSuccessfulDeploy(options, bootstrapSystems));
-  recordTiming(timings, "deploy:total", deployStartMs);
-  writeProviderTimingSummary(options, timings);
-  await reportDeployment(reporter, {
-    environment: options.scope,
-    deploymentKind: "code",
-    status: "success",
-    sourceRef: branchName,
-    commitSha,
-    triggeredByType: "project_runner",
-    metadata: {
-      scope: options.scope,
-      railway: options.scope === "local" ? [] : configuredRailwayServices(options.tenantRoot, options.scope).map((service) => service.key).filter((serviceKey) => serviceKey === "api" ? selectedSystems.has("api") : selectedSystems.has("agents")),
-      monitor,
-      hostingRepair,
-      timings
-    },
-    finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  return {
-    ok: true,
-    scope: options.scope,
-    monitor,
-    hostingRepair,
-    serviceResults,
-    timings
-  };
-}
-function resolveRailwayServiceDeployDependencies({
-  includeDataDependency,
-  previousRailwayDeployNodeId,
-  sequentialRailwayDeploys = false
-}) {
-  return [
-    ...includeDataDependency ? ["data:d1-migrate"] : [],
-    ...sequentialRailwayDeploys && previousRailwayDeployNodeId ? [previousRailwayDeployNodeId] : []
-  ];
-}
-async function publishProjectContent(options) {
-  const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  return publishContent(options, reporter);
-}
-async function monitorProjectPlatform(options) {
-  const timings = [];
-  const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  const env2 = { ...process.env, ...options.env ?? {} };
-  const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
-  const siteConfig = loadCliDeployConfig(options.tenantRoot);
-  const selectedSystems = new Set(resolveProjectPlatformBootstrapSystems(options, siteConfig));
-  const apiSelected = selectedSystems.has("api");
-  const agentsSelected = selectedSystems.has("agents");
-  const state = loadDeployState(options.tenantRoot, siteConfig, { target });
-  const webProbeUrl = resolveImmediatePagesProbeUrl(siteConfig, state, target);
-  const apiBaseUrl = resolveImmediateApiProbeUrl(siteConfig, state, target);
-  const apiMonitorEndpoints = resolveApiMonitorEndpoints(siteConfig, apiBaseUrl);
-  const railwayResourcesPromise = options.scope === "local" || !apiSelected && !agentsSelected ? { ok: true, skipped: true, reason: options.scope === "local" ? "local_scope" : "railway_not_selected" } : timedPhase(timings, "monitor:railway-resources", () => verifyRailwayManagedResources(options.tenantRoot, options.scope, {
-    env: env2,
-    settleDeployments: true,
-    onProgress: options.write
-  }));
-  const skippedApiCheck = apiSelected ? { ok: false, skipped: true, reason: "api_url_unconfigured" } : { ok: true, skipped: true, reason: "api_not_selected" };
-  const skippedAgentCheck = agentsSelected ? { ok: false, skipped: true, reason: "api_url_unconfigured" } : { ok: true, skipped: true, reason: "agents_not_selected" };
-  const skippedD1Check = apiMonitorEndpoints.processingAgentApi ? { ok: true, skipped: true, reason: "processing_agent_api" } : skippedApiCheck;
-  const pagesProbeOptions = options.scope === "prod" ? { attempts: 18, delayMs: 1e4 } : { attempts: 3, delayMs: 5e3 };
-  const checks = {
-    pages: timedPhase(timings, "monitor:probe-pages", () => probeHttp(webProbeUrl, pagesProbeOptions)),
-    apiHealth: apiSelected && apiMonitorEndpoints.apiHealth ? timedPhase(timings, "monitor:probe-api-health", () => probeHttp(apiMonitorEndpoints.apiHealth, { attempts: 8, delayMs: 1e4 })) : Promise.resolve(skippedApiCheck),
-    apiReady: apiSelected && apiMonitorEndpoints.apiReady ? timedPhase(timings, "monitor:probe-api-ready", () => probeHttp(apiMonitorEndpoints.apiReady, { attempts: 8, delayMs: 1e4 })) : Promise.resolve(skippedApiCheck),
-    d1Health: apiSelected && apiMonitorEndpoints.d1Health ? timedPhase(timings, "monitor:probe-d1-health", () => probeHttp(apiMonitorEndpoints.d1Health, { attempts: 8, delayMs: 1e4 })) : Promise.resolve(skippedD1Check),
-    agentHealth: agentsSelected && apiMonitorEndpoints.agentHealth ? timedPhase(timings, "monitor:probe-agent-health", () => probeHttp(apiMonitorEndpoints.agentHealth, { attempts: 8, delayMs: 1e4 })) : Promise.resolve(skippedAgentCheck),
-    r2: options.planOnly ? Promise.resolve({ ok: true, skipped: true, reason: "plan" }) : timedPhase(timings, "monitor:probe-r2", () => probeR2(options.tenantRoot, siteConfig, state, target)),
-    scaleProbe: timedPhase(timings, "monitor:probe-scale", () => probeScaleConfiguration(siteConfig, state)),
-    railwayResources: Promise.resolve(railwayResourcesPromise),
-    readiness: state.readiness,
-    apiMonitor: {
-      ok: true,
-      processingAgentApi: apiMonitorEndpoints.processingAgentApi,
-      endpoints: apiMonitorEndpoints
-    }
-  };
-  const resolvedChecks = {
-    ...checks,
-    pages: await checks.pages,
-    apiHealth: await checks.apiHealth,
-    apiReady: await checks.apiReady,
-    d1Health: await checks.d1Health,
-    agentHealth: await checks.agentHealth,
-    r2: await checks.r2,
-    scaleProbe: await checks.scaleProbe,
-    railwayResources: await checks.railwayResources
-  };
-  const ok = [
-    resolvedChecks.pages,
-    resolvedChecks.apiHealth,
-    resolvedChecks.apiReady,
-    resolvedChecks.d1Health,
-    resolvedChecks.agentHealth,
-    resolvedChecks.r2,
-    resolvedChecks.scaleProbe,
-    resolvedChecks.railwayResources
-  ].every((check) => check?.ok === true || check?.skipped === true);
-  if (!ok) {
-    const failedChecks = Object.entries(resolvedChecks).filter(([, check]) => check && typeof check === "object" && check.ok !== true && check.skipped !== true).map(([name, check]) => `${name}: ${JSON.stringify(check)}`);
-    throw new Error(`Treeseed monitor failed for ${options.scope}.
-${failedChecks.join("\n")}`);
-  }
-  await reportDeployment(reporter, {
-    environment: options.scope,
-    deploymentKind: "mixed",
-    status: "success",
-    sourceRef: currentRef(options.tenantRoot),
-    commitSha: currentCommit(options.tenantRoot),
-    triggeredByType: "project_runner",
-    metadata: {
-      mode: "monitor",
-      target: deployTargetLabel(target),
-      checks: resolvedChecks,
-      timings
-    },
-    finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-  });
-  return {
-    ok,
-    target: deployTargetLabel(target),
-    checks: resolvedChecks,
-    timings
-  };
-}
-async function syncControlPlaneState(options) {
-  const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
-  const siteConfig = loadCliDeployConfig(options.tenantRoot);
-  const state = loadDeployState(options.tenantRoot, siteConfig, { target });
-  await reporter.reportEnvironment({
-    environment: options.scope,
-    deploymentProfile: siteConfig.hosting?.kind ?? "self_hosted_project",
-    baseUrl: state.lastDeployedUrl,
-    cloudflareAccountId: String(process.env.TREESEED_CLOUDFLARE_ACCOUNT_ID ?? siteConfig.cloudflare.accountId ?? "").trim() || null,
-    pagesProjectName: state.pages?.projectName ?? null,
-    workerName: state.workerName,
-    r2BucketName: state.content?.bucketName ?? null,
-    d1DatabaseName: state.d1Databases?.SITE_DATA_DB?.databaseName ?? null,
-    railwayProjectName: state.services.api?.provider === "railway" ? state.services.api?.lastDeployedUrl ?? null : null,
-    metadata: { target: deployTargetLabel(target) }
-  });
-}
-async function runProjectPlatformAction(action, options) {
-  const previousWorkflowAction = process.env.TREESEED_WORKFLOW_ACTION;
-  const previousWorkflowPlane = process.env.TREESEED_WORKFLOW_PLANE;
-  process.env.TREESEED_WORKFLOW_ACTION = action;
-  process.env.TREESEED_WORKFLOW_PLANE = previousWorkflowPlane ?? "all";
-  writeWorkflowStatus(`action:start ${action} scope=${options.scope}`);
-  writeWorkflowStatus("action:apply-environment:start");
-  applyTreeseedEnvironmentToProcess({ tenantRoot: options.tenantRoot, scope: options.scope, override: true });
-  writeWorkflowStatus("action:apply-environment:done");
-  writeWorkflowStatus("action:resolve-reporter:start");
-  const reporter = resolveReporter(options.tenantRoot, options.reporter);
-  writeWorkflowStatus(`action:resolve-reporter:done kind=${reporter.kind} enabled=${reporter.enabled ? "true" : "false"}`);
-  try {
-    switch (action) {
-      case "deploy_web":
-        return await deployProjectPlatform({
-          ...options,
-          reporter,
-          bootstrapSystems: options.bootstrapSystems ?? WEB_PLATFORM_BOOTSTRAP_SYSTEMS
-        });
-      case "publish_content":
-        return await publishProjectContent({ ...options, reporter });
-      case "monitor":
-        return await monitorProjectPlatform({ ...options, reporter });
-      default:
-        throw new Error(`Unsupported workflow action "${action}".`);
-    }
-  } catch (error) {
-    await reportDeployment(reporter, {
-      environment: options.scope,
-      deploymentKind: action === "publish_content" ? "content" : action === "deploy_web" ? "code" : "mixed",
-      status: "failed",
-      sourceRef: currentRef(options.tenantRoot),
-      commitSha: currentCommit(options.tenantRoot),
-      triggeredByType: "project_runner",
-      metadata: {
-        message: error instanceof Error ? error.message : String(error)
-      },
-      finishedAt: (/* @__PURE__ */ new Date()).toISOString()
-    }).catch(() => void 0);
-    throw error;
-  } finally {
-    if (previousWorkflowAction === void 0) {
-      delete process.env.TREESEED_WORKFLOW_ACTION;
-    } else {
-      process.env.TREESEED_WORKFLOW_ACTION = previousWorkflowAction;
-    }
-    if (previousWorkflowPlane === void 0) {
-      delete process.env.TREESEED_WORKFLOW_PLANE;
-    } else {
-      process.env.TREESEED_WORKFLOW_PLANE = previousWorkflowPlane;
-    }
-  }
-}
-export {
-  deployProjectPlatform,
-  inferEnvironmentFromBranch,
-  monitorProjectPlatform,
-  prepareTenantCloudflareDeploy,
-  provisionProjectPlatform,
-  publishProjectContent,
-  resolveRailwayServiceDeployDependencies,
-  resolveScope,
-  runProjectPlatformAction,
-  runTenantDataMigration,
-  runTenantWebBuild,
-  runTenantWebPublish,
-  syncControlPlaneState
-};