@treeseed/sdk 0.13.0-rc.8 → 0.13.0-rc.80

package/dist/reconcile/builtin-adapters/hosting/first-railway-domain-string.js

@@ -1,212 +0,0 @@
-import { collectEnvironmentContext } from "../../../operations/services/configuration/config-runtime.js";
-import { shouldExposeManagedHostRuntimeSecret } from "../../../operations/services/hosting/audit/managed-host-security.js";
-import { buildPublicVars, buildSecretMap, loadDeployState, scopeFromTarget } from "../../../operations/services/hosting/deployment/deploy.js";
-import { listRailwayCustomDomains, listRailwayServiceDomains } from "../../../operations/services/hosting/railway/railway-api.js";
-import { resolveReconcileEnvironmentValues } from "../reconciliation/build-workflow-meta-adapter.js";
-import { normalizeRailwayDomainDnsRecord } from "../support/normalize-turnstile-domains.js";
-import { findRailwayTopologyEntry, resolveRailwayUnitTopology } from "./railway-verification-may-settle.js";
-import { toDeployTarget } from "./to-deploy-target.js";
-function firstRailwayDomainString(...values) {
-  for (const value of values) {
-    if (typeof value === "string" && value.trim()) {
-      return value.trim();
-    }
-  }
-  return null;
-}
-function firstRailwayDomainArray(...values) {
-  for (const value of values) {
-    if (Array.isArray(value)) {
-      return value;
-    }
-  }
-  return [];
-}
-function normalizeRailwayDomainPayload(value) {
-  if (!value || typeof value !== "object") {
-    return null;
-  }
-  const record = value;
-  const status = record.status && typeof record.status === "object" ? record.status : {};
-  const certificate = record.certificate && typeof record.certificate === "object" ? record.certificate : status.certificate && typeof status.certificate === "object" ? status.certificate : {};
-  const verification = record.verification && typeof record.verification === "object" ? record.verification : status.verification && typeof status.verification === "object" ? status.verification : {};
-  const domain = typeof record.domain === "string" ? record.domain.trim() : typeof record.name === "string" ? record.name.trim() : "";
-  const serviceDomain = firstRailwayDomainString(
-    record.serviceDomain,
-    record.target,
-    record.targetDomain,
-    record.cnameTarget,
-    record.cname,
-    record.dnsTarget,
-    status.serviceDomain,
-    status.target,
-    status.targetDomain,
-    status.cnameTarget,
-    status.cname,
-    status.dnsTarget
-  );
-  const dnsRecordCandidates = firstRailwayDomainArray(
-    record.dnsRecords,
-    record.requiredDnsRecords,
-    record.requiredRecords,
-    record.records,
-    record.dns,
-    status.dnsRecords,
-    status.requiredDnsRecords,
-    status.requiredRecords,
-    status.records,
-    status.dns
-  );
-  const dnsRecords = dnsRecordCandidates.map((entry) => normalizeRailwayDomainDnsRecord(entry)).filter(Boolean);
-  const effectiveDnsRecords = dnsRecords.length > 0 || !domain || !serviceDomain || serviceDomain === domain ? dnsRecords : [{
-    type: "CNAME",
-    name: domain,
-    content: serviceDomain,
-    status: ""
-  }];
-  return {
-    id: typeof record.id === "string" ? record.id.trim() : null,
-    domain,
-    serviceId: typeof record.serviceId === "string" ? record.serviceId.trim() : null,
-    serviceName: typeof record.serviceName === "string" ? record.serviceName.trim() : null,
-    serviceDomain,
-    verified: record.verified === true || status.verified === true || verification.verified === true,
-    certificateStatus: firstRailwayDomainString(
-      record.certificateStatus,
-      status.certificateStatus,
-      certificate.status
-    )?.toUpperCase() ?? null,
-    verificationDnsHost: typeof record.verificationDnsHost === "string" ? record.verificationDnsHost.trim() : typeof status.verificationDnsHost === "string" ? String(status.verificationDnsHost).trim() : typeof verification.dnsHost === "string" ? String(verification.dnsHost).trim() : null,
-    verificationToken: typeof record.verificationToken === "string" ? record.verificationToken.trim() : typeof status.verificationToken === "string" ? String(status.verificationToken).trim() : typeof verification.token === "string" ? String(verification.token).trim() : null,
-    dnsRecords: effectiveDnsRecords
-  };
-}
-async function observeRailwayCustomDomainLive(input, domain) {
-  if (!domain) {
-    return null;
-  }
-  const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
-  const serviceKey = String(input.unit.metadata.serviceKey ?? "api").trim();
-  const topology = await resolveRailwayUnitTopology(input, scope, {
-    refresh: false,
-    includeInstances: false,
-    includeVariables: false
-  });
-  const entry = findRailwayTopologyEntry(topology, serviceKey);
-  const identifiers = {
-    projectId: entry?.project?.id ?? null,
-    environmentId: entry?.environment?.id ?? null,
-    serviceId: entry?.service?.id ?? null
-  };
-  if (!identifiers.projectId || !identifiers.environmentId || !identifiers.serviceId) {
-    return {
-      domain: null,
-      serviceId: null,
-      serviceName: entry?.configuredService?.serviceName ?? null
-    };
-  }
-  const [customDomains, serviceDomains] = await Promise.all([
-    listRailwayCustomDomains({
-      projectId: identifiers.projectId,
-      environmentId: identifiers.environmentId,
-      serviceId: identifiers.serviceId,
-      env: topology.env
-    }),
-    listRailwayServiceDomains({
-      projectId: identifiers.projectId,
-      environmentId: identifiers.environmentId,
-      serviceId: identifiers.serviceId,
-      env: topology.env
-    })
-  ]);
-  const customDomain = customDomains.find((entry2) => entry2.domain === domain) ?? null;
-  if (!customDomain) {
-    return null;
-  }
-  const serviceDomain = serviceDomains.find((entry2) => entry2.kind === "service") ?? null;
-  const normalized = normalizeRailwayDomainPayload({
-    ...customDomain,
-    serviceId: identifiers.serviceId,
-    serviceName: entry?.configuredService?.serviceName ?? null,
-    serviceDomain: serviceDomain?.domain ?? null
-  });
-  return normalized?.domain ? normalized : {
-    ...customDomain,
-    serviceId: identifiers.serviceId,
-    serviceName: entry?.configuredService?.serviceName ?? null
-  };
-}
-function railwayCustomDomainHasDnsRequirements(live) {
-  if (!live) {
-    return false;
-  }
-  return Array.isArray(live.dnsRecords) && live.dnsRecords.length > 0 || typeof live.serviceDomain === "string" && live.serviceDomain.trim().length > 0 || typeof live.verificationDnsHost === "string" && live.verificationDnsHost.trim().length > 0 && typeof live.verificationToken === "string" && live.verificationToken.trim().length > 0;
-}
-function collectCloudflareEnvironmentSync(input) {
-  const target = toDeployTarget(input.context.target);
-  const scope = scopeFromTarget(target);
-  const values = resolveReconcileEnvironmentValues(input, scope);
-  const registry = collectEnvironmentContext(input.context.tenantRoot);
-  const state = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target });
-  const generatedSecrets = buildSecretMap(input.context.deployConfig, state);
-  const publicVars = buildPublicVars(input.context.deployConfig, { target });
-  const secrets = {};
-  const generatedTurnstileSiteKey = typeof state.turnstileWidgets?.formGuard?.sitekey === "string" ? state.turnstileWidgets.formGuard.sitekey : "";
-  const vars = {
-    ...publicVars
-  };
-  const secretNames = /* @__PURE__ */ new Set();
-  const varNames = new Set(Object.keys(publicVars));
-  for (const entry of registry.entries) {
-    if (!entry.scopes.includes(scope)) {
-      continue;
-    }
-    const value = typeof values[entry.id] === "string" ? values[entry.id] : "";
-    if (entry.targets.includes("cloudflare-secret")) {
-      const secretValue = value || (typeof generatedSecrets[entry.id] === "string" ? generatedSecrets[entry.id] : "");
-      if (secretValue && shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, entry.id)) {
-        secrets[entry.id] = secretValue;
-        secretNames.add(entry.id);
-      }
-    }
-    if (entry.targets.includes("cloudflare-var") && value && entry.id !== "TREESEED_PROJECT_DOMAINS") {
-      vars[entry.id] = value;
-      varNames.add(entry.id);
-    }
-  }
-  if (generatedTurnstileSiteKey) {
-    vars.PUBLIC_TURNSTILE_SITE_KEY = generatedTurnstileSiteKey;
-    varNames.add("TREESEED_PUBLIC_TURNSTILE_SITE_KEY");
-  }
-  for (const [key, value] of Object.entries(generatedSecrets)) {
-    const exposeRuntimeSecret = key === "TREESEED_TURNSTILE_SECRET_KEY" || shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, key);
-    if (typeof value === "string" && value.length > 0 && exposeRuntimeSecret) {
-      secrets[key] = value;
-      secretNames.add(key);
-    }
-  }
-  return { scope, state, secrets, vars, secretNames: [...secretNames], varNames: [...varNames] };
-}
-function verificationCheck(key, description, source, options) {
-  return {
-    key,
-    description,
-    source,
-    exists: options.exists,
-    configured: options.configured ?? options.exists,
-    ready: options.ready ?? options.exists,
-    verified: options.verified ?? (options.exists && (options.configured ?? true) && (options.ready ?? true) && (options.issues?.length ?? 0) === 0),
-    expected: options.expected,
-    observed: options.observed,
-    issues: options.issues ?? []
-  };
-}
-export {
-  collectCloudflareEnvironmentSync,
-  firstRailwayDomainArray,
-  firstRailwayDomainString,
-  normalizeRailwayDomainPayload,
-  observeRailwayCustomDomainLive,
-  railwayCustomDomainHasDnsRequirements,
-  verificationCheck
-};

package/dist/reconcile/builtin-adapters/hosting/observe-cloudflare-unit.d.ts

@@ -1,2 +0,0 @@
-import type { ObservedUnitState, ReconcileAdapterInput } from "../../support/contracts/contracts.js";
-export declare function observeCloudflareUnit(input: ReconcileAdapterInput): ObservedUnitState;

package/dist/reconcile/builtin-adapters/hosting/observe-cloudflare-unit.js

@@ -1,97 +0,0 @@
-import { queueId, queueName } from "../../../operations/services/hosting/deployment/deploy.js";
-import { hasLiveResourceId } from "../reconciliation/build-workflow-meta-adapter.js";
-import { cloudflareObservationSnapshot, findTurnstileWidget } from "../support/normalize-turnstile-domains.js";
-import { noopObservedState } from "./to-deploy-target.js";
-function observeCloudflareUnit(input) {
-  const snapshot = cloudflareObservationSnapshot(input);
-  const { state, kvNamespaces, d1Databases, queues, buckets, pagesProjects, turnstileWidgets } = snapshot;
-  switch (input.unit.unitType) {
-    case "queue": {
-      const name = input.unit.spec.name;
-      const dlqName = input.unit.spec.dlqName;
-      const liveQueue = queues.find((entry) => queueName(entry) === name);
-      const liveDlq = dlqName ? queues.find((entry) => queueName(entry) === dlqName) : null;
-      return {
-        exists: Boolean(liveQueue),
-        status: liveQueue ? "ready" : "pending",
-        live: { name, dlqName },
-        locators: {
-          queueId: queueId(liveQueue) ?? null,
-          dlqId: queueId(liveDlq) ?? null
-        },
-        warnings: []
-      };
-    }
-    case "database": {
-      const liveDatabase = d1Databases.find((entry) => entry?.name === state.d1Databases?.SITE_DATA_DB?.databaseName);
-      return {
-        exists: Boolean(liveDatabase || hasLiveResourceId(state.d1Databases?.SITE_DATA_DB?.databaseId)),
-        status: liveDatabase ? "ready" : "pending",
-        live: { ...state.d1Databases?.SITE_DATA_DB ?? {} },
-        locators: {
-          databaseId: liveDatabase?.uuid ?? state.d1Databases?.SITE_DATA_DB?.databaseId ?? null
-        },
-        warnings: []
-      };
-    }
-    case "content-store": {
-      const liveBucket = buckets.find((entry) => entry?.name === state.content?.bucketName);
-      return {
-        exists: Boolean(liveBucket),
-        status: liveBucket ? "ready" : "pending",
-        live: { ...state.content ?? {} },
-        locators: {
-          bucketName: liveBucket?.name ?? null
-        },
-        warnings: []
-      };
-    }
-    case "kv-form-guard": {
-      const liveNamespace = kvNamespaces.find((entry) => entry?.title === state.kvNamespaces?.FORM_GUARD_KV?.name);
-      return {
-        exists: Boolean(liveNamespace || hasLiveResourceId(state.kvNamespaces?.FORM_GUARD_KV?.id)),
-        status: liveNamespace ? "ready" : "pending",
-        live: { ...state.kvNamespaces?.FORM_GUARD_KV ?? {} },
-        locators: { id: liveNamespace?.id ?? state.kvNamespaces?.FORM_GUARD_KV?.id ?? null },
-        warnings: []
-      };
-    }
-    case "turnstile-widget": {
-      const current = state.turnstileWidgets?.formGuard ?? {};
-      const liveWidget = findTurnstileWidget(turnstileWidgets, current, input.unit.spec.name);
-      return {
-        exists: Boolean(liveWidget?.sitekey || current?.sitekey),
-        status: liveWidget?.sitekey ? "ready" : "pending",
-        live: { ...current, ...liveWidget ?? {} },
-        locators: { sitekey: String(liveWidget?.sitekey ?? current?.sitekey ?? "") || null },
-        warnings: []
-      };
-    }
-    case "pages-project": {
-      const liveProject = pagesProjects.find((entry) => entry?.name === state.pages?.projectName);
-      return {
-        exists: Boolean(liveProject || state.pages?.projectName),
-        status: liveProject ? "ready" : "pending",
-        live: { ...state.pages ?? {} },
-        locators: {
-          projectName: liveProject?.name ?? state.pages?.projectName ?? null,
-          url: liveProject?.subdomain ? `https://${liveProject.subdomain}` : state.pages?.url ?? null
-        },
-        warnings: []
-      };
-    }
-    case "edge-worker":
-      return {
-        exists: Boolean(state.workerName),
-        status: state.workerName ? "ready" : "pending",
-        live: { workerName: state.workerName, lastDeployedUrl: state.lastDeployedUrl ?? null },
-        locators: { workerName: state.workerName ?? null, url: state.lastDeployedUrl ?? null },
-        warnings: []
-      };
-    default:
-      return noopObservedState(input);
-  }
-}
-export {
-  observeCloudflareUnit
-};

package/dist/reconcile/builtin-adapters/hosting/observe-railway-unit.d.ts

@@ -1,32 +0,0 @@
-import { collectEnvironmentContext } from "../../../operations/services/configuration/config-runtime.js";
-import { configuredRailwayServices } from "../../../operations/services/hosting/railway/railway-deploy.js";
-import type { ObservedUnitState, ReconcileAdapterInput } from "../../support/contracts/contracts.js";
-import { resolveRailwayTopologyForScope } from './resolve-railway-topology-for-scope.js';
-export declare function observeRailwayUnit(input: ReconcileAdapterInput, { refresh, topology: providedTopology, }?: {
-    refresh?: boolean;
-    topology?: Awaited<ReturnType<typeof resolveRailwayTopologyForScope>>;
-}): Promise<ObservedUnitState>;
-export declare function collectRailwayEnvironmentSync(input: ReconcileAdapterInput, valuesOverlay?: Record<string, string | undefined>): {
-    scope: "local" | "staging" | "prod";
-    secrets: {
-        [k: string]: string | undefined;
-    };
-    variables: {
-        [k: string]: string | undefined;
-    };
-    forService(serviceKey: string, configuredService?: ReturnType<typeof configuredRailwayServices>[number]): {
-        secrets: {
-            TREESEED_DATABASE_URL?: string | undefined;
-        };
-        variables: {
-            TREESEED_MANAGER_ID?: "local" | "staging" | "prod" | undefined;
-            TREESEED_PLATFORM_RUNNER_ID?: any;
-            TREESEED_PLATFORM_RUNNER_DATA_DIR?: any;
-            TREESEED_PLATFORM_RUNNER_ENVIRONMENT?: string | undefined;
-        };
-    };
-};
-export declare function isLoopbackServiceUrl(value: unknown): boolean;
-export declare function sanitizeRemoteRailwayServiceUrls(input: ReconcileAdapterInput, scope: 'staging' | 'prod', values: Record<string, string | undefined>): void;
-export declare function capacityProviderRoleForService(serviceKey: string): "runner" | "manager" | null;
-export declare function ensurePublicTreeDxSecretsForRailwaySync(input: ReconcileAdapterInput, scope: 'local' | 'staging' | 'prod', values: Record<string, string | undefined>, registry: ReturnType<typeof collectEnvironmentContext>): Record<string, string>;

package/dist/reconcile/builtin-adapters/hosting/observe-railway-unit.js

@@ -1,219 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-import { collectEnvironmentContext, resolveMachineEnvironmentValues, setMachineEnvironmentValue } from "../../../operations/services/configuration/config-runtime.js";
-import { shouldExposeManagedHostRuntimeSecret } from "../../../operations/services/hosting/audit/managed-host-security.js";
-import { loadDeployState, resolveConfiguredSurfaceDomain } from "../../../operations/services/hosting/deployment/deploy.js";
-import { capacityProviderVariablesForService } from "../capacity/providers/capacity-provider-variables-for-service.js";
-import { buildCloudflareEnv, findCloudflareD1ByName, hasLiveResourceId, normalizeEnvironmentValues, resolveReconcileEnvironmentValues } from "../reconciliation/build-workflow-meta-adapter.js";
-import { configuredMarketDatabaseService } from "./build-cloudflare-diff.js";
-import { findRailwayTopologyEntry, railwayUnitServiceIdentity, resolveRailwayUnitTopology } from "./railway-verification-may-settle.js";
-import { configuredRailwayServicesForInput } from "./resolve-railway-topology-for-scope.js";
-import { isTransientRailwayReconcileError, sleepMs, toDeployTarget } from "./to-deploy-target.js";
-async function observeRailwayUnit(input, {
-  refresh = false,
-  topology: providedTopology
-} = {}) {
-  let attempt = 0;
-  for (; ; ) {
-    try {
-      const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
-      const serviceKey = String(input.unit.metadata.serviceKey ?? "").trim();
-      const state = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target: toDeployTarget(input.context.target) });
-      const persisted = state.services?.[serviceKey] ?? {};
-      const topology = providedTopology ?? await resolveRailwayUnitTopology(input, scope, {
-        refresh,
-        includeInstances: false,
-        includeVariables: false,
-        cacheSuffix: refresh ? "refresh" : "observe"
-      });
-      const entry = findRailwayTopologyEntry(topology, railwayUnitServiceIdentity(input));
-      const configuredService = entry?.configuredService ?? null;
-      const usesPortableSource = Boolean(
-        configuredService?.imageRef || configuredService?.sourceMode === "git" && configuredService?.sourceRepo
-      );
-      const configured = Boolean(
-        configuredService && (configuredService.serviceName || configuredService.serviceId) && (configuredService.projectName || configuredService.projectId) && (usesPortableSource || existsSync(resolve(configuredService.rootDir)))
-      );
-      return {
-        exists: Boolean(entry?.project && entry?.environment && entry?.service),
-        status: entry?.project && entry?.environment && entry?.service && configured ? "ready" : "pending",
-        live: {
-          ...persisted ?? {},
-          ...configuredService ?? {},
-          project: entry?.project ?? null,
-          environment: entry?.environment ?? null,
-          service: entry?.service ?? null,
-          instance: entry?.instance ?? null
-        },
-        locators: {
-          projectId: entry?.project?.id ?? entry?.configuredService.projectId ?? persisted.projectId ?? null,
-          serviceId: entry?.service?.id ?? entry?.configuredService.serviceId ?? persisted.serviceId ?? null,
-          serviceName: entry?.service?.name ?? entry?.configuredService.serviceName ?? persisted.serviceName ?? null,
-          publicBaseUrl: entry?.configuredService.publicBaseUrl ?? persisted.publicBaseUrl ?? null,
-          workspace: topology.workspace.name
-        },
-        warnings: []
-      };
-    } catch (error) {
-      if (attempt >= 2 || !isTransientRailwayReconcileError(error)) {
-        throw error;
-      }
-      attempt += 1;
-      sleepMs(1e3 * attempt);
-    }
-  }
-}
-function collectRailwayEnvironmentSync(input, valuesOverlay = {}) {
-  const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
-  const registry = collectEnvironmentContext(input.context.tenantRoot);
-  const configuredServices = configuredRailwayServicesForInput(input, scope);
-  const hasPublicTreeDxService = configuredServices.some((service) => service.key === "public-treedx-node-01" && service.enabled !== false);
-  const machineValues = hasPublicTreeDxService && scope === "local" ? normalizeEnvironmentValues(resolveMachineEnvironmentValues(input.context.tenantRoot, scope)) : {};
-  const baseValues = {
-    ...resolveReconcileEnvironmentValues(input, scope),
-    ...machineValues,
-    ...valuesOverlay
-  };
-  const values = {
-    ...baseValues,
-    ...ensurePublicTreeDxSecretsForRailwaySync(input, scope, baseValues, registry)
-  };
-  if (scope !== "local") {
-    sanitizeRemoteRailwayServiceUrls(input, scope, values);
-  }
-  const state = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target: toDeployTarget(input.context.target) });
-  const serviceTargetsEntry = (entry, serviceKey) => {
-    const targets = Array.isArray(entry.serviceTargets) ? entry.serviceTargets.map((value) => String(value).trim()).filter(Boolean) : [];
-    return targets.length === 0 || targets.includes(serviceKey);
-  };
-  const entriesForService = (target, serviceKey) => registry.entries.filter(
-    (entry) => entry.scopes.includes(scope) && entry.targets.includes(target) && serviceTargetsEntry(entry, serviceKey)
-  ).map((entry) => [entry.id, values[entry.id]]).filter(([, value]) => typeof value === "string" && value.length > 0);
-  const aggregateEntries = (target) => registry.entries.filter((entry) => entry.scopes.includes(scope) && entry.targets.includes(target)).map((entry) => [entry.id, values[entry.id]]).filter(([, value]) => typeof value === "string" && value.length > 0);
-  const secrets = Object.fromEntries(aggregateEntries("railway-secret"));
-  const variables = Object.fromEntries(aggregateEntries("railway-var"));
-  const apiOnlySecrets = {};
-  const apiOnlyVariables = {};
-  const Database = configuredMarketDatabaseService(input.context.tenantRoot, input.context.deployConfig);
-  const DatabaseService = Database?.service;
-  const DatabaseServiceName = Database?.serviceName ?? "";
-  const DatabaseUrl = typeof values.TREESEED_DATABASE_URL === "string" && values.TREESEED_DATABASE_URL.length > 0 ? values.TREESEED_DATABASE_URL : DatabaseService?.enabled !== false && DatabaseService?.provider === "railway" ? `\${{${DatabaseServiceName}.DATABASE_URL}}` : "";
-  if (typeof values.TREESEED_CLOUDFLARE_API_TOKEN === "string" && values.TREESEED_CLOUDFLARE_API_TOKEN.length > 0 && shouldExposeManagedHostRuntimeSecret(input.context.deployConfig, "TREESEED_CLOUDFLARE_API_TOKEN")) {
-    secrets.TREESEED_CLOUDFLARE_API_TOKEN = values.TREESEED_CLOUDFLARE_API_TOKEN;
-    apiOnlySecrets.TREESEED_CLOUDFLARE_API_TOKEN = values.TREESEED_CLOUDFLARE_API_TOKEN;
-  }
-  if (typeof values.TREESEED_CLOUDFLARE_ACCOUNT_ID === "string" && values.TREESEED_CLOUDFLARE_ACCOUNT_ID.length > 0) {
-    variables.TREESEED_CLOUDFLARE_ACCOUNT_ID = values.TREESEED_CLOUDFLARE_ACCOUNT_ID;
-    apiOnlyVariables.TREESEED_CLOUDFLARE_ACCOUNT_ID = values.TREESEED_CLOUDFLARE_ACCOUNT_ID;
-  }
-  const siteDataDb = state.d1Databases?.SITE_DATA_DB;
-  let apiD1DatabaseId = siteDataDb?.databaseId;
-  if (!hasLiveResourceId(apiD1DatabaseId)) {
-    const liveDatabase = findCloudflareD1ByName(input, buildCloudflareEnv(input), siteDataDb?.databaseName, { attempts: 3, delayMs: 250 });
-    apiD1DatabaseId = liveDatabase?.uuid ?? liveDatabase?.id ?? apiD1DatabaseId;
-  }
-  if (hasLiveResourceId(apiD1DatabaseId)) {
-    variables.TREESEED_API_D1_DATABASE_ID = apiD1DatabaseId;
-    apiOnlyVariables.TREESEED_API_D1_DATABASE_ID = apiD1DatabaseId;
-  }
-  if (DatabaseUrl) {
-    secrets.TREESEED_DATABASE_URL = DatabaseUrl;
-  }
-  return {
-    scope,
-    secrets,
-    variables,
-    forService(serviceKey, configuredService) {
-      const capacityVariables = capacityProviderVariablesForService(input, scope, values, serviceKey, configuredService);
-      const capacitySecrets = {};
-      const serviceVariables = configuredService?.environmentVariables && typeof configuredService.environmentVariables === "object" ? Object.fromEntries(Object.entries(configuredService.environmentVariables).filter(([, value]) => typeof value === "string" && value.length > 0)) : {};
-      const serviceSecretRefs = Array.isArray(configuredService?.secretRefs) ? configuredService.secretRefs.map((value) => String(value).trim()).filter(Boolean) : [];
-      const serviceVariableRefs = Array.isArray(configuredService?.variableRefs) ? configuredService.variableRefs.map((value) => String(value).trim()).filter(Boolean) : [];
-      const serviceValue = (key) => {
-        const direct = values[key];
-        if (typeof direct === "string" && direct.length > 0) return direct;
-        if (key.startsWith("TREEDX_")) {
-          const legacy = values[`TREESEED_${key}`];
-          if (typeof legacy === "string" && legacy.length > 0) return legacy;
-        }
-        return void 0;
-      };
-      const serviceRefSecrets = Object.fromEntries(serviceSecretRefs.map((key) => [key, serviceValue(key)]).filter(([, value]) => typeof value === "string" && value.length > 0));
-      const serviceRefVariables = Object.fromEntries(serviceVariableRefs.map((key) => [key, serviceValue(key)]).filter(([, value]) => typeof value === "string" && value.length > 0));
-      return {
-        secrets: {
-          ...Object.fromEntries(entriesForService("railway-secret", serviceKey)),
-          ...serviceRefSecrets,
-          ...DatabaseUrl && ["api", "operationsRunner"].includes(serviceKey) ? { TREESEED_DATABASE_URL: DatabaseUrl } : {},
-          ...serviceKey === "api" ? apiOnlySecrets : {},
-          ...capacitySecrets
-        },
-        variables: {
-          ...serviceVariables,
-          ...serviceRefVariables,
-          ...Object.fromEntries(entriesForService("railway-var", serviceKey)),
-          ...serviceKey === "operationsRunner" ? {
-            TREESEED_MANAGER_ID: scope,
-            TREESEED_PLATFORM_RUNNER_ID: configuredService?.runnerId ?? configuredService?.serviceName ?? "treeseed-api-operations-runner-01",
-            TREESEED_PLATFORM_RUNNER_DATA_DIR: configuredService?.volumeMountPath ?? "/data",
-            TREESEED_PLATFORM_RUNNER_ENVIRONMENT: scope === "prod" ? "production" : scope
-          } : {},
-          ...serviceKey === "api" ? apiOnlyVariables : {},
-          ...capacityVariables
-        }
-      };
-    }
-  };
-}
-function isLoopbackServiceUrl(value) {
-  if (typeof value !== "string" || !value.trim()) return false;
-  try {
-    const url = new URL(value);
-    return url.hostname === "127.0.0.1" || url.hostname === "localhost";
-  } catch {
-    return false;
-  }
-}
-function sanitizeRemoteRailwayServiceUrls(input, scope, values) {
-  const configuredApiDomain = resolveConfiguredSurfaceDomain(input.context.deployConfig, { kind: "persistent", scope }, "api");
-  const configuredApiBaseUrl = configuredApiDomain ? `https://${configuredApiDomain}` : "";
-  const apiBaseUrl = [values.TREESEED_API_BASE_URL, configuredApiBaseUrl].find((value) => typeof value === "string" && value.trim() && !isLoopbackServiceUrl(value))?.trim();
-  if (!apiBaseUrl) return;
-  if (isLoopbackServiceUrl(values.TREESEED_API_BASE_URL)) {
-    values.TREESEED_API_BASE_URL = apiBaseUrl;
-  }
-}
-function capacityProviderRoleForService(serviceKey) {
-  if (serviceKey === "capacityProviderManager") return "manager";
-  if (serviceKey === "capacityProviderRunner") return "runner";
-  return null;
-}
-function ensurePublicTreeDxSecretsForRailwaySync(input, scope, values, registry) {
-  const hasPublicTreeDxService = configuredRailwayServicesForInput(input, scope).some((service) => service.key === "public-treedx-node-01" && service.enabled !== false);
-  if (!hasPublicTreeDxService) return {};
-  const generated = {};
-  const specs = [
-    ["TREESEED_TREEDX_SECRET_KEY_BASE", () => randomBytes(64).toString("hex")],
-    ["TREESEED_TREEDX_ADMIN_TOKEN", () => `tdx_admin_${randomBytes(32).toString("base64url")}`],
-    ["TREESEED_TREEDX_JWT_HS256_SECRET", () => randomBytes(48).toString("base64url")]
-  ];
-  for (const [key, create] of specs) {
-    const existing = String(values[key] ?? "").trim();
-    if (existing) continue;
-    const entry = registry.entries.find((candidate) => candidate.id === key);
-    if (!entry) continue;
-    const value = create();
-    setMachineEnvironmentValue(input.context.tenantRoot, scope, entry, value);
-    generated[key] = value;
-  }
-  return generated;
-}
-export {
-  capacityProviderRoleForService,
-  collectRailwayEnvironmentSync,
-  ensurePublicTreeDxSecretsForRailwaySync,
-  isLoopbackServiceUrl,
-  observeRailwayUnit,
-  sanitizeRemoteRailwayServiceUrls
-};

package/dist/reconcile/builtin-adapters/hosting/railway-verification-may-settle.d.ts

@@ -1,41 +0,0 @@
-import type { ObservedUnitState, ReconcileAdapterInput, ReconcileResult, ReconcileUnitDiff, UnitVerificationResult } from "../../support/contracts/contracts.js";
-import { configuredRailwayServicesForInput, resolveRailwayTopologyForScope } from './resolve-railway-topology-for-scope.js';
-export declare function railwayVerificationMaySettle(verification: UnitVerificationResult): boolean;
-export declare function railwayStartCommandMatches(serviceKey: string, observed: string | null | undefined, expected: string): boolean;
-export declare function railwayProjectServiceKeys(input: ReconcileAdapterInput, scope: EnvironmentScope, configuredService: ReturnType<typeof configuredRailwayServicesForInput>[number]): any[];
-export declare function railwayUnitServiceIdentity(input: ReconcileAdapterInput): string;
-export declare function configuredRailwayServiceForUnit(input: ReconcileAdapterInput, scope: EnvironmentScope): {} | null;
-export declare function findRailwayTopologyEntry(topology: Awaited<ReturnType<typeof resolveRailwayTopologyForScope>>, identity: string): {
-    configuredService: ReturnType<typeof import("../../../operations/workflow-support.js").configuredRailwayServices>[number];
-    project: Awaited<ReturnType<typeof import("../../../index.js").ensureRailwayProject>>["project"] | null;
-    environment: Awaited<ReturnType<typeof import("../../../index.js").ensureRailwayEnvironment>>["environment"] | null;
-    service: import("../../../operations/services/railway-api/default-railway-api-url.js").RailwayServiceSummary | null;
-    instance: Awaited<ReturnType<typeof import("../../../operations/services/railway-api/inspect-railway-postgres-service.js").getRailwayServiceInstance>> | null;
-    currentVariables: Record<string, string | null>;
-} | null;
-export declare function resolveRailwayUnitTopology(input: ReconcileAdapterInput, scope: EnvironmentScope, options: {
-    refresh: boolean;
-    includeInstances: boolean;
-    includeVariables: boolean;
-    cacheSuffix?: string;
-}): Promise<{
-    scope: "local" | "staging" | "prod";
-    env: {
-        TREESEED_RAILWAY_API_TOKEN: string;
-        RAILWAY_API_TOKEN: string;
-        TREESEED_RAILWAY_API_URL: string;
-        TREESEED_RAILWAY_WORKSPACE: string;
-    };
-    workspace: import("../../../operations/services/railway-api/default-railway-api-url.js").RailwayWorkspaceSummary;
-    services: Map<string, {
-        configuredService: ReturnType<typeof import("../../../operations/workflow-support.js").configuredRailwayServices>[number];
-        project: Awaited<ReturnType<typeof import("../../../index.js").ensureRailwayProject>>["project"] | null;
-        environment: Awaited<ReturnType<typeof import("../../../index.js").ensureRailwayEnvironment>>["environment"] | null;
-        service: import("../../../operations/services/railway-api/default-railway-api-url.js").RailwayServiceSummary | null;
-        instance: Awaited<ReturnType<typeof import("../../../operations/services/railway-api/inspect-railway-postgres-service.js").getRailwayServiceInstance>> | null;
-        currentVariables: Record<string, string | null>;
-    }>;
-}>;
-export declare function buildRailwayDiff(input: ReconcileAdapterInput, observed: ObservedUnitState): Promise<ReconcileUnitDiff>;
-export declare function reconcileRailwayUnit(input: ReconcileAdapterInput, diff: ReconcileUnitDiff): Promise<ReconcileResult>;
-export declare function destroyRailwayUnit(input: ReconcileAdapterInput): Promise<ReconcileResult>;