@treeseed/sdk 0.13.0-rc.2 → 0.13.0-rc.21

package/dist/reconcile/providers/railway-iac/run-railway-iac-with-rate-limit-retry.js

@@ -1,174 +0,0 @@
-async function runRailwayIacWithRateLimitRetry(run, {
-  delaysMs = [15e3, 45e3, 9e4],
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-  onRetry,
-  onWait
-} = {}) {
-  for (let attempt = 1; ; attempt += 1) {
-    try {
-      const result = await run();
-      if (result && typeof result === "object" && "ok" in result && result.ok === false) {
-        const diagnostics = Array.isArray(result.diagnostics) ? result.diagnostics.map((entry) => typeof entry === "string" ? entry : String(entry?.message ?? "")).filter(Boolean).join("; ") : "";
-        if (/fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|aborted|HTTP\s+429|rate[ -]?limit/iu.test(diagnostics)) {
-          throw new Error(diagnostics || "Railway IaC transport failed.");
-        }
-      }
-      return result;
-    } catch (error) {
-      const delayMs = delaysMs[attempt - 1];
-      if (delayMs === void 0 || !/fetch failed|timed out|etimedout|econnreset|enetunreach|temporarily unavailable|aborted|HTTP\s+429|rate[ -]?limit/iu.test(String(error))) throw error;
-      onRetry?.(attempt + 1, delayMs, error);
-      let remainingMs = delayMs;
-      while (remainingMs > 0) {
-        const sliceMs = Math.min(15e3, remainingMs);
-        await sleep(sliceMs);
-        remainingMs -= sliceMs;
-        if (remainingMs > 0) onWait?.(attempt + 1, remainingMs);
-      }
-    }
-  }
-}
-function js(value) {
-  return JSON.stringify(value);
-}
-function id(prefix, index) {
-  return `${prefix}${index}`;
-}
-function codeObject(entries) {
-  const rendered = entries.filter(([, value]) => typeof value === "string" && value.length > 0).map(([key, value]) => `${js(key)}: ${value}`);
-  return rendered.length > 0 ? `{
-${rendered.map((line) => `      ${line}`).join(",\n")}
-    }` : "{}";
-}
-function literalVariable(value) {
-  return js(value);
-}
-function validateGeneratedVariables(service) {
-  const keys = [...Object.keys(service.variables ?? {}), ...Object.keys(service.secrets ?? {})];
-  const isTreeDxService = service.serviceName.includes("treedx") || service.key.includes("treedx");
-  return keys.filter((key) => {
-    if (key === "PORT") return false;
-    if (key.startsWith("TREESEED_")) return false;
-    if (isTreeDxService && key.startsWith("TREEDX_")) return false;
-    return true;
-  });
-}
-function serviceSource(service) {
-  if (service.imageRef) {
-    return `image(${js(service.imageRef)})`;
-  }
-  if (service.sourceMode === "git" && service.sourceRepo) {
-    const sourceConfig = {
-      ...service.sourceBranch ? { branch: service.sourceBranch } : {},
-      ...service.sourceRootDirectory ? { rootDirectory: service.sourceRootDirectory } : {},
-      ...service.sourceCommit ? { commitSha: service.sourceCommit } : {}
-    };
-    return `github(${js(service.sourceRepo)}, ${js(sourceConfig)})`;
-  }
-  return "empty()";
-}
-function buildConfig(service) {
-  if (service.imageRef) return null;
-  if (service.dockerfilePath) {
-    return {
-      builder: "DOCKERFILE",
-      dockerfilePath: service.dockerfilePath
-    };
-  }
-  if (service.buildCommand) {
-    return {
-      builder: "NIXPACKS",
-      buildCommand: service.buildCommand
-    };
-  }
-  return null;
-}
-function deployConfig(service) {
-  const runtimeMode = String(service.runtimeMode ?? "").trim();
-  const deploy = {
-    ...service.startCommand ? { startCommand: service.startCommand } : {},
-    ...service.healthcheckPath ? { healthcheckPath: service.healthcheckPath } : {},
-    ...service.healthcheckTimeoutSeconds ? { healthcheckTimeout: service.healthcheckTimeoutSeconds } : {},
-    ...typeof service.numReplicas === "number" ? { numReplicas: service.numReplicas } : {},
-    ...runtimeMode === "serverless" ? { sleepApplication: true } : {}
-  };
-  return Object.keys(deploy).length > 0 ? deploy : null;
-}
-function renderServiceEnv(service, databaseVariableName, databaseEnvName) {
-  const variables = {
-    ...service.variables ?? {},
-    ...service.secrets ?? {}
-  };
-  const entries = Object.entries(variables).filter(([key]) => key.startsWith("TREESEED_") || key.startsWith("TREEDX_") || key === "PORT").map(([key, value]) => {
-    const dbRef = databaseVariableName && databaseEnvName && key === databaseEnvName;
-    return [key, dbRef ? `${databaseVariableName}.env.DATABASE_URL` : literalVariable(value)];
-  });
-  return codeObject(entries);
-}
-function renderPostgresEnv() {
-  return codeObject([
-    ["PGDATA", js("/var/lib/postgresql/data/pgdata")],
-    ["PGHOST", js("${{RAILWAY_PRIVATE_DOMAIN}}")],
-    ["PGPORT", js("5432")],
-    ["PGUSER", js("${{POSTGRES_USER}}")],
-    ["PGDATABASE", js("${{POSTGRES_DB}}")],
-    ["PGPASSWORD", js("${{POSTGRES_PASSWORD}}")],
-    ["POSTGRES_DB", js("railway")],
-    ["DATABASE_URL", js("postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_PRIVATE_DOMAIN}}:5432/${{PGDATABASE}}")],
-    ["POSTGRES_USER", js("postgres")],
-    ["SSL_CERT_DAYS", js("820")],
-    ["POSTGRES_PASSWORD", '{ generator: "secret(32, \\"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\\")" }'],
-    ["DATABASE_PUBLIC_URL", js("postgresql://${{PGUSER}}:${{POSTGRES_PASSWORD}}@${{RAILWAY_TCP_PROXY_DOMAIN}}:${{RAILWAY_TCP_PROXY_PORT}}/${{PGDATABASE}}")],
-    ["RAILWAY_DEPLOYMENT_DRAINING_SECONDS", js("60")]
-  ]);
-}
-function normalizeIacScope(input) {
-  if (input.scope === "prod" || input.scope === "staging") return input.scope;
-  const environmentName = String(input.environmentName ?? "").trim().toLowerCase();
-  return environmentName === "production" || environmentName === "prod" ? "prod" : environmentName === "staging" ? "staging" : "local";
-}
-function activeObservedVolumeInstances(volume) {
-  return volume.instances.filter((instance) => {
-    const state = String(instance.state ?? "READY").toUpperCase();
-    return instance.isPendingDeletion !== true && !(typeof instance.deletedAt === "string" && instance.deletedAt.trim()) && state !== "DELETING" && state !== "DELETED";
-  });
-}
-function pendingObservedVolumeInstances(volume) {
-  return volume.instances.filter((instance) => {
-    const state = String(instance.state ?? "").toUpperCase();
-    return instance.isPendingDeletion === true || Boolean(typeof instance.deletedAt === "string" && instance.deletedAt.trim()) || state === "DELETING" || state === "DELETED";
-  });
-}
-function findRailwayPendingVolumeNameCollisions(input) {
-  const serviceIdByName = new Map((input.liveServices ?? []).map((service) => [service.name, service.id]));
-  return input.services.flatMap((service) => {
-    if (!service.volumeMountPath) return [];
-    const canonicalVolumeName = `${service.serviceName}-volume`;
-    const desiredServiceId = serviceIdByName.get(service.serviceName) ?? null;
-    const activeCanonicalVolumeIds = new Set(input.volumes.filter((volume) => volume.name === canonicalVolumeName && activeObservedVolumeInstances(volume).length > 0).map((volume) => volume.id));
-    return input.volumes.filter((volume) => volume.name === canonicalVolumeName || String(volume.name ?? "").startsWith("pending-delete-") && Boolean(desiredServiceId) && volume.instances.some((instance) => instance.serviceId === desiredServiceId)).filter((volume) => pendingObservedVolumeInstances(volume).length > 0).filter((volume) => activeCanonicalVolumeIds.size === 0 || activeCanonicalVolumeIds.has(volume.id)).map((volume) => ({
-      serviceName: service.serviceName,
-      volumeId: volume.id,
-      canonicalVolumeName,
-      mountPath: service.volumeMountPath,
-      serviceId: pendingObservedVolumeInstances(volume).find((instance) => instance.serviceId)?.serviceId ?? volume.instances.find((instance) => instance.serviceId)?.serviceId ?? null
-    }));
-  });
-}
-export {
-  activeObservedVolumeInstances,
-  buildConfig,
-  codeObject,
-  deployConfig,
-  findRailwayPendingVolumeNameCollisions,
-  id,
-  js,
-  literalVariable,
-  normalizeIacScope,
-  pendingObservedVolumeInstances,
-  renderPostgresEnv,
-  renderServiceEnv,
-  runRailwayIacWithRateLimitRetry,
-  serviceSource,
-  validateGeneratedVariables
-};

package/dist/reconcile/providers/railway-iac/validate-railway-iac-change-set.d.ts

@@ -1,30 +0,0 @@
-import { IacClient, type RailwayChangeSet, type RailwayIacApplyResponse, type RailwayIacPlanResponse } from 'railway/iac';
-import { RailwayIacProjectInput, RailwayIacValidationResult } from './railway-iac-service.js';
-export declare function validateRailwayIacChangeSet(changeSet: RailwayChangeSet | undefined, desiredNames: {
-    services: string[];
-    volumes: string[];
-    database: string | null;
-    scope: string;
-    serviceSourceModes?: Record<string, string | null | undefined>;
-    serviceSourceRefs?: Record<string, string | null | undefined>;
-    allowedResourceDeletions?: string[];
-    protectedResourceNames?: string[];
-}): RailwayIacValidationResult;
-export declare function planRailwayIacProject(input: RailwayIacProjectInput, rendered?: import("./railway-iac-service.js").RailwayIacRenderResult): Promise<RailwayIacPlanResponse>;
-export declare function applyRailwayIacProject(input: RailwayIacProjectInput, rendered?: import("./railway-iac-service.js").RailwayIacRenderResult): Promise<RailwayIacApplyResponse>;
-export type RailwayStagedPatch = {
-    id: string;
-    status: string;
-    patch: Record<string, unknown>;
-} | null;
-export declare function canonicalRailwayPatch(value: unknown): unknown;
-export declare function railwayStagedPatchMatchesPlan(patch: NonNullable<RailwayStagedPatch>, plan: RailwayIacPlanResponse): boolean;
-export declare function railwayPatchForPlan(plan: RailwayIacPlanResponse): import("railway").EnvironmentConfig | null;
-export declare function railwayIacClient(input: RailwayIacProjectInput): IacClient;
-export declare function readRailwayStagedPatch(input: RailwayIacProjectInput): Promise<RailwayStagedPatch>;
-export declare function commitAndVerifyRailwayStagedPatch(client: IacClient, input: RailwayIacProjectInput, patch: NonNullable<RailwayStagedPatch>, { attempts, intervalMs, sleep, skipDeploys, }?: {
-    attempts?: number;
-    intervalMs?: number;
-    sleep?: (milliseconds: number) => Promise<unknown>;
-    skipDeploys?: boolean;
-}): Promise<void>;

package/dist/reconcile/providers/railway-iac/validate-railway-iac-change-set.js

@@ -1,174 +0,0 @@
-import {
-  changeSetToEnvironmentPatch,
-  IacClient,
-  runRailwayIac
-} from "railway/iac";
-import { railwayGraphqlRequest } from "../../../operations/services/hosting/railway/railway-api.js";
-import { isApiRailwaySourcePolicyService } from "../../../operations/services/hosting/railway/railway-source-policy.js";
-import { applyRailwayIacProjectWithPlan } from "./apply-railway-iac-project-with-plan.js";
-import { changeName, isRailwayGitSourceChange, isRailwayImageSourceChange, isRailwaySourceChange, renderRailwayIacProject } from "./resolve-railway-iac-volume-bindings.js";
-import { runRailwayIacWithRateLimitRetry } from "./run-railway-iac-with-rate-limit-retry.js";
-function validateRailwayIacChangeSet(changeSet, desiredNames) {
-  const blockedReasons = [];
-  const destructiveChanges = [];
-  const desired = /* @__PURE__ */ new Set([...desiredNames.services, ...desiredNames.volumes, ...desiredNames.database ? [desiredNames.database] : []]);
-  const allowedResourceDeletions = new Set(desiredNames.allowedResourceDeletions ?? []);
-  const protectedResourceNames = new Set(desiredNames.protectedResourceNames ?? []);
-  const created = new Set((changeSet?.changes ?? []).filter((change) => change.kind === "resource.create").map((change) => changeName(change)));
-  for (const change of changeSet?.changes ?? []) {
-    const name = changeName(change);
-    const serviceName = name.replace(/^(service|database|volume)\./u, "");
-    const sourceMode = desiredNames.serviceSourceModes?.[name] ?? desiredNames.serviceSourceModes?.[serviceName] ?? null;
-    const sourceRef = desiredNames.serviceSourceRefs?.[name] ?? desiredNames.serviceSourceRefs?.[serviceName] ?? null;
-    const sourceChanged = change.kind === "resource.update" && isRailwaySourceChange(change);
-    const imageSourceChange = sourceChanged && isRailwayImageSourceChange(change);
-    const gitSourceChange = sourceChanged && isRailwayGitSourceChange(change);
-    const desiredGitSource = sourceMode === "git" && typeof sourceRef === "string" && sourceRef.startsWith("github:");
-    const desiredImageSource = sourceMode === "image" && typeof sourceRef === "string" && sourceRef.startsWith("image:");
-    const apiPolicyService = isApiRailwaySourcePolicyService({ serviceName });
-    if (protectedResourceNames.has(name) && (change.kind === "resource.update" || change.kind === "resource.delete")) {
-      blockedReasons.push(`Railway IaC plan would ${change.kind === "resource.delete" ? "delete" : "update"} sibling-environment resource ${name}.`);
-    }
-    if (change.kind === "resource.delete") {
-      destructiveChanges.push(change.summary);
-      if (!allowedResourceDeletions.has(name) && !allowedResourceDeletions.has(serviceName)) {
-        blockedReasons.push(`Railway IaC plan would delete resource ${name || change.summary}; hosting reconciliation only deletes explicitly recognized obsolete aliases. Use the explicit destroy workflow for other deletions.`);
-      }
-      if (desired.has(name) && !created.has(name)) {
-        blockedReasons.push(`Railway IaC plan would delete desired resource ${name}.`);
-      }
-    }
-    if (desiredNames.scope === "staging" && sourceChanged && apiPolicyService && sourceMode === "git" && !gitSourceChange && !desiredGitSource) {
-      blockedReasons.push(`Railway IaC plan would change staging API resource ${name} source without confirming a GitHub source.`);
-    }
-    if (desiredNames.scope === "staging" && sourceChanged && imageSourceChange && !(apiPolicyService && sourceMode === "git" && (gitSourceChange || desiredGitSource))) {
-      blockedReasons.push(`Railway IaC plan would switch staging resource ${name} to an image source.`);
-    }
-    if (desiredNames.scope === "staging" && sourceChanged && (!sourceMode || sourceMode === "image")) {
-      blockedReasons.push(`Railway IaC plan would apply an image-backed desired source to staging resource ${name}.`);
-    }
-    if (desiredNames.scope === "prod" && sourceChanged && apiPolicyService && sourceMode === "image" && !imageSourceChange && !desiredImageSource) {
-      blockedReasons.push(`Railway IaC plan would change production API resource ${name} source without confirming an image source.`);
-    }
-    if (desiredNames.scope === "prod" && sourceChanged && gitSourceChange) {
-      blockedReasons.push(`Railway IaC plan would switch production resource ${name} to a Git source.`);
-    }
-    if (desiredNames.scope === "prod" && sourceChanged && (!sourceMode || sourceMode === "git")) {
-      blockedReasons.push(`Railway IaC plan would apply a Git-backed desired source to production resource ${name}.`);
-    }
-  }
-  return {
-    ok: blockedReasons.length === 0,
-    destructiveChanges,
-    blockedReasons,
-    allowedDrift: []
-  };
-}
-async function planRailwayIacProject(input, rendered = renderRailwayIacProject(input)) {
-  return runRailwayIacWithRateLimitRetry(() => runRailwayIac({
-    command: "plan",
-    cwd: rendered.tempDir,
-    file: rendered.filePath,
-    backboard: {
-      endpoint: input.railwayApiUrl?.trim() || void 0,
-      token: input.railwayApiToken,
-      authType: "bearer",
-      projectId: input.projectId,
-      environmentId: input.environmentId,
-      decryptVariables: false,
-      merge: true
-    }
-  }), {
-    onRetry: (attempt, delayMs, error) => process.stderr.write(`[trsd][railway][iac:retry] command=plan attempt=${attempt} waitMs=${delayMs} reason=${error instanceof Error ? error.message : String(error)}
-`),
-    onWait: (attempt, remainingMs) => process.stderr.write(`[trsd][railway][iac:retry] command=plan attempt=${attempt} cooldownRemainingMs=${remainingMs}
-`)
-  });
-}
-async function applyRailwayIacProject(input, rendered = renderRailwayIacProject(input)) {
-  return applyRailwayIacProjectWithPlan(input, rendered);
-}
-function canonicalRailwayPatch(value) {
-  if (Array.isArray(value)) return value.map(canonicalRailwayPatch);
-  if (!value || typeof value !== "object") return value;
-  return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalRailwayPatch(entry)]));
-}
-function railwayStagedPatchMatchesPlan(patch, plan) {
-  const expected = railwayPatchForPlan(plan);
-  if (!expected) return false;
-  return JSON.stringify(canonicalRailwayPatch(patch.patch)) === JSON.stringify(canonicalRailwayPatch(expected));
-}
-function railwayPatchForPlan(plan) {
-  if (!plan.currentGraph || !plan.currentConfig || !plan.changeSet) return null;
-  return changeSetToEnvironmentPatch({
-    currentGraph: plan.currentGraph,
-    currentConfig: plan.currentConfig,
-    changeSet: plan.changeSet
-  });
-}
-function railwayIacClient(input) {
-  return new IacClient({
-    token: input.railwayApiToken,
-    authType: "bearer",
-    ...input.railwayApiUrl?.trim() ? { graphqlEndpoint: input.railwayApiUrl.trim() } : {}
-  });
-}
-async function readRailwayStagedPatch(input) {
-  return runRailwayIacWithRateLimitRetry(async () => {
-    const response = await railwayGraphqlRequest({
-      query: `query TreeseedRailwayStagedPatch($environmentId: String!) {
-				environmentStagedChanges(environmentId: $environmentId) {
-					id
-					status
-					patch(decryptVariables: true)
-				}
-			}`,
-      variables: { environmentId: input.environmentId },
-      apiToken: input.railwayApiToken,
-      apiUrl: input.railwayApiUrl?.trim() || void 0,
-      retries: 0
-    });
-    const staged = response.data.environmentStagedChanges;
-    const id = String(staged?.id ?? "").trim();
-    return !id || id === "<empty>" ? null : staged;
-  });
-}
-async function commitAndVerifyRailwayStagedPatch(client, input, patch, {
-  attempts = 450,
-  intervalMs = 2e3,
-  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
-  skipDeploys = false
-} = {}) {
-  const commitResult = await runRailwayIacWithRateLimitRetry(() => client.commitStagedPatch({
-    environmentId: input.environmentId,
-    message: "Apply TreeSeed reconciled Railway configuration",
-    skipDeploys
-  }));
-  if (typeof commitResult !== "string" || !commitResult.trim()) {
-    throw new Error(`Railway did not return a commit identifier for staged patch ${patch.id}.`);
-  }
-  for (let attempt = 1; attempt <= attempts; attempt += 1) {
-    const observed = await readRailwayStagedPatch(input);
-    if (!observed) return;
-    if (observed.id !== patch.id) {
-      throw new Error(`Railway staged patch changed from ${patch.id} to ${observed.id} while TreeSeed was committing it.`);
-    }
-    if (attempt === 1 || attempt % Math.max(1, Math.round(15e3 / intervalMs)) === 0) {
-      process.stderr.write(`[trsd][railway][iac:commit-settle] patch=${patch.id} status=${observed.status || "unknown"} elapsedMs=${attempt * intervalMs}
-`);
-    }
-    if (attempt < attempts) await sleep(intervalMs);
-  }
-  throw new Error(`Railway staged patch ${patch.id} remained pending after it was committed.`);
-}
-export {
-  applyRailwayIacProject,
-  canonicalRailwayPatch,
-  commitAndVerifyRailwayStagedPatch,
-  planRailwayIacProject,
-  railwayIacClient,
-  railwayPatchForPlan,
-  railwayStagedPatchMatchesPlan,
-  readRailwayStagedPatch,
-  validateRailwayIacChangeSet
-};

package/dist/reconcile/providers/railway-iac.d.ts

@@ -1,5 +0,0 @@
-export * from './railway-iac/apply-railway-iac-project-with-plan.js';
-export * from './railway-iac/railway-iac-service.js';
-export * from './railway-iac/resolve-railway-iac-volume-bindings.js';
-export * from './railway-iac/run-railway-iac-with-rate-limit-retry.js';
-export * from './railway-iac/validate-railway-iac-change-set.js';

package/dist/reconcile/providers/railway-iac.js

@@ -1,5 +0,0 @@
-export * from "./railway-iac/apply-railway-iac-project-with-plan.js";
-export * from "./railway-iac/railway-iac-service.js";
-export * from "./railway-iac/resolve-railway-iac-volume-bindings.js";
-export * from "./railway-iac/run-railway-iac-with-rate-limit-retry.js";
-export * from "./railway-iac/validate-railway-iac-change-set.js";

package/dist/reconcile/providers/release-private.d.ts

@@ -1,89 +0,0 @@
-import type { ReconcileRunContext, ReconcileSelector, ReconcileTarget } from '../support/contracts/contracts.js';
-export declare function runReleaseVerifyCommand(input: {
-    tenantRoot: string;
-    packageId: string;
-    env?: NodeJS.ProcessEnv;
-    onProgress?: (message: string) => void;
-}): Promise<{
-    ok: boolean;
-    skipped: boolean;
-    reason: string;
-    dependencies?: undefined;
-} | {
-    ok: boolean;
-    skipped: boolean;
-    reason: string;
-    dependencies: {
-        status: "staging-proof-reused";
-        candidatePath: string;
-        packageCommit: string;
-        rootCommit: string;
-    };
-}>;
-export declare function runTemplateReleaseVerifyCommand(input: {
-    tenantRoot: string;
-    templateId: string;
-    env?: NodeJS.ProcessEnv;
-}): {
-    ok: boolean;
-    status: number | null;
-    command: string;
-    stdout: string;
-    stderr: string;
-} | {
-    ok: boolean;
-    skipped: boolean;
-    reason: string;
-};
-export declare function ensureTemplateReleaseTag(input: {
-    tenantRoot: string;
-    templateId: string;
-    tagName: string;
-}): {
-    templateId: string;
-    tagName: string;
-    head: string;
-    local: string;
-    remote: string;
-};
-export declare function writeReleaseRecord(input: {
-    tenantRoot: string;
-    recordPath: string;
-    record: Record<string, unknown>;
-}): {
-    path: string;
-    record: Record<string, unknown>;
-};
-export declare function runHostedReconcileGate(input: {
-    parentContext: ReconcileRunContext;
-    selector: ReconcileSelector;
-    target: ReconcileTarget;
-    planOnly: boolean;
-}): Promise<{
-    target: ReconcileTarget;
-    units: import("../index.js").DesiredUnit[];
-    plans: import("../index.js").ReconcilePlan[];
-    results: import("../index.js").ReconcileResult[];
-    state: import("../index.js").ReconcileStateRecord;
-    timings: import("../../entrypoints/runtime/timing.js").TimingEntry[];
-}>;
-export declare function runHostedVerifyGate(input: {
-    parentContext: ReconcileRunContext;
-    selector: ReconcileSelector;
-    target: ReconcileTarget;
-}): Promise<{
-    target: ReconcileTarget;
-    ready: boolean;
-    blockers: string[];
-    warnings: string[];
-    units: {
-        unitId: string;
-        unitType: import("../index.js").ReconcileUnitType;
-        provider: string;
-        status: import("../index.js").ReconcileStatusKind;
-        exists: boolean;
-        locators: Record<string, string | null>;
-        warnings: string[];
-        verification: import("../index.js").UnitVerificationResult | null;
-    }[];
-}>;

package/dist/reconcile/providers/release-private.js

@@ -1,140 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { runGitText } from "../../operations/services/operations/git-runner.js";
-import { findPackageAdapter } from "../../operations/services/reconciliation/package-adapters.js";
-import { checkedOutTemplateRepositories } from "../../operations/services/support/managed-repositories.js";
-function requireMatchingStageCandidate(tenantRoot, packageId, packageDir) {
-  const candidatePath = resolve(tenantRoot, ".treeseed/workflow/stage-candidates/latest.json");
-  if (!existsSync(candidatePath)) {
-    throw new Error(`Release verification requires a successful staged candidate; ${candidatePath} is missing.`);
-  }
-  const candidate = JSON.parse(readFileSync(candidatePath, "utf8"));
-  const packageProof = candidate.packages?.find((entry) => entry.name === packageId);
-  const packageHead = runGitText(["rev-parse", "HEAD"], { cwd: packageDir, mode: "read" }).trim();
-  const rootHead = runGitText(["rev-parse", "HEAD"], { cwd: tenantRoot, mode: "read" }).trim();
-  if (candidate.targetBranch !== "staging" || candidate.root?.verified !== true || candidate.root.commit !== rootHead || packageProof?.verified !== true || packageProof.commit !== packageHead) {
-    throw new Error(`Release verification requires ${packageId} and the Market root to match the latest verified staging candidate.`);
-  }
-  return {
-    status: "staging-proof-reused",
-    candidatePath,
-    packageCommit: packageHead,
-    rootCommit: rootHead
-  };
-}
-async function runReleaseVerifyCommand(input) {
-  const adapter = findPackageAdapter(input.tenantRoot, input.packageId);
-  if (!adapter) {
-    throw new Error(`Package ${input.packageId} was not discovered.`);
-  }
-  const command = adapter.verifyCommands.release ?? adapter.verifyCommands.local;
-  if (!command) {
-    return {
-      ok: true,
-      skipped: true,
-      reason: `${input.packageId} has no release verify command.`
-    };
-  }
-  const stagingProof = requireMatchingStageCandidate(input.tenantRoot, input.packageId, adapter.dir);
-  input.onProgress?.(`Reusing exact-SHA staging verification for ${input.packageId} at ${stagingProof.packageCommit.slice(0, 12)}.`);
-  return {
-    ok: true,
-    skipped: true,
-    reason: `${input.packageId} matches the latest verified staging candidate; tag workflows perform independent release verification before publication or deployment.`,
-    dependencies: stagingProof
-  };
-}
-function runTemplateCommand(command, cwd, env) {
-  const result = spawnSync("bash", ["-lc", command], {
-    cwd,
-    env: { ...process.env, ...env ?? {} },
-    encoding: "utf8"
-  });
-  return {
-    ok: (result.status ?? 1) === 0,
-    status: result.status,
-    command,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? ""
-  };
-}
-function runTemplateReleaseVerifyCommand(input) {
-  const repo = checkedOutTemplateRepositories(input.tenantRoot).find((candidate) => candidate.templateManifest?.id === input.templateId);
-  if (!repo?.templateManifest) {
-    throw new Error(`Template ${input.templateId} was not discovered.`);
-  }
-  const command = repo.templateManifest.verify.release ?? repo.templateManifest.verify.local;
-  if (!command) {
-    return {
-      ok: true,
-      skipped: true,
-      reason: `${input.templateId} has no release verify command.`
-    };
-  }
-  return runTemplateCommand(command, repo.dir, input.env);
-}
-function gitText(repoDir, args) {
-  return runGitText(args, { cwd: repoDir, mode: "mutate" }).trim();
-}
-function gitTextAllowFailure(repoDir, args) {
-  try {
-    return gitText(repoDir, args);
-  } catch {
-    return null;
-  }
-}
-function ensureTemplateReleaseTag(input) {
-  const repo = checkedOutTemplateRepositories(input.tenantRoot).find((candidate) => candidate.templateManifest?.id === input.templateId);
-  if (!repo?.templateManifest) {
-    throw new Error(`Template ${input.templateId} was not discovered.`);
-  }
-  const head = gitText(repo.dir, ["rev-parse", "HEAD"]);
-  const local = gitTextAllowFailure(repo.dir, ["rev-list", "-n", "1", input.tagName]);
-  if (local && local !== head) {
-    throw new Error(`Template tag ${input.tagName} already exists at ${local}, expected ${head}.`);
-  }
-  if (!local) {
-    gitText(repo.dir, ["tag", "-a", input.tagName, head, "-m", `release: ${input.tagName}`]);
-  }
-  const remote = gitTextAllowFailure(repo.dir, ["ls-remote", "origin", `refs/tags/${input.tagName}`])?.split(/\s+/u)[0] ?? null;
-  if (remote && remote !== head) {
-    throw new Error(`Remote template tag ${input.tagName} already exists at ${remote}, expected ${head}.`);
-  }
-  if (!remote && repo.hasOriginRemote) {
-    gitText(repo.dir, ["push", "origin", input.tagName]);
-  }
-  return {
-    templateId: input.templateId,
-    tagName: input.tagName,
-    head,
-    local: local ? "existing" : "created",
-    remote: remote ? "existing" : repo.hasOriginRemote ? "pushed" : "skipped-no-origin"
-  };
-}
-function writeReleaseRecord(input) {
-  const absolutePath = resolve(input.tenantRoot, input.recordPath);
-  mkdirSync(dirname(absolutePath), { recursive: true });
-  writeFileSync(absolutePath, `${JSON.stringify(input.record, null, 2)}
-`, "utf8");
-  return {
-    path: absolutePath,
-    record: input.record
-  };
-}
-async function runHostedReconcileGate(input) {
-  const { reconcileNestedTarget } = await import("../support/engine/engine.js");
-  return reconcileNestedTarget(input);
-}
-async function runHostedVerifyGate(input) {
-  const { verifyNestedTarget } = await import("../support/engine/engine.js");
-  return verifyNestedTarget(input);
-}
-export {
-  ensureTemplateReleaseTag,
-  runHostedReconcileGate,
-  runHostedVerifyGate,
-  runReleaseVerifyCommand,
-  runTemplateReleaseVerifyCommand,
-  writeReleaseRecord
-};

package/dist/reconcile/reconciliation/builtin-adapters.d.ts

@@ -1,28 +0,0 @@
-export * from '../builtin-adapters/build/local-compose-build-policy.js';
-export * from '../builtin-adapters/capacity/providers/build-capacity-provider-adapter.js';
-export * from '../builtin-adapters/capacity/providers/capacity-provider-variables-for-service.js';
-export * from '../builtin-adapters/hosting/build-cloudflare-diff.js';
-export * from '../builtin-adapters/hosting/cloudflare-tunnel/build-cloudflare-tunnel-adapter.js';
-export * from '../builtin-adapters/hosting/first-railway-domain-string.js';
-export * from '../builtin-adapters/hosting/observe-cloudflare-unit.js';
-export * from '../builtin-adapters/hosting/observe-railway-unit.js';
-export * from '../builtin-adapters/hosting/railway-verification-may-settle.js';
-export * from '../builtin-adapters/hosting/resolve-railway-topology-for-scope.js';
-export * from '../builtin-adapters/hosting/sync-railway-environment-for-scope.js';
-export * from '../builtin-adapters/hosting/to-deploy-target.js';
-export * from '../builtin-adapters/hosting/verify-cloudflare-unit-once.js';
-export * from '../builtin-adapters/hosting/verify-railway-unit.js';
-export * from '../builtin-adapters/projects/knowledge/verify-local-tree-dx-project-content.js';
-export * from '../builtin-adapters/projects/projects-core/configured-railway-project-sync-groups.js';
-export * from '../builtin-adapters/projects/projects-core/reconcile-stale-operations-runner-resources-for-project.js';
-export * from '../builtin-adapters/reconciliation/build-git-hub-workflow-dispatch-adapter.js';
-export * from '../builtin-adapters/reconciliation/build-local-content-materialization-adapter.js';
-export * from '../builtin-adapters/reconciliation/build-local-docker-compose-adapter.js';
-export * from '../builtin-adapters/reconciliation/build-railway-adapter.js';
-export * from '../builtin-adapters/reconciliation/build-release-gate-adapter.js';
-export * from '../builtin-adapters/reconciliation/build-workflow-meta-adapter.js';
-export * from '../builtin-adapters/reconciliation/reconcile-cloudflare-target.js';
-export * from '../builtin-adapters/support/normalize-turnstile-domains.js';
-export * from '../builtin-adapters/support/summarize-verification.js';
-export * from '../builtin-adapters/support/verify-custom-domain-unit.js';
-export * from '../builtin-adapters/treedx/graph/build-graph-only-adapter.js';