@treeseed/sdk 0.6.0 → 0.6.2

package/dist/reconcile/bootstrap-systems.js

@@ -0,0 +1,175 @@
+const TREESEED_BOOTSTRAP_SYSTEMS = ["github", "data", "web", "api", "agents"];
+const BOOTSTRAP_SYSTEM_SET = new Set(TREESEED_BOOTSTRAP_SYSTEMS);
+const SYSTEM_DEPENDENCIES = {
+  github: [],
+  data: [],
+  web: ["data"],
+  api: ["data"],
+  agents: ["data"]
+};
+function uniqueSystems(values) {
+  return [...new Set(values)];
+}
+function parseTreeseedBootstrapSystems(value) {
+  const raw = Array.isArray(value) ? value : typeof value === "string" ? [value] : ["all"];
+  const systems = raw.flatMap((entry) => String(entry).split(",")).map((entry) => entry.trim()).filter(Boolean);
+  if (systems.length === 0 || systems.includes("all")) {
+    return ["all"];
+  }
+  const invalid = systems.filter((system) => !BOOTSTRAP_SYSTEM_SET.has(system));
+  if (invalid.length > 0) {
+    throw new Error(`Unknown Treeseed bootstrap system "${invalid[0]}". Expected one of all, ${TREESEED_BOOTSTRAP_SYSTEMS.join(", ")}.`);
+  }
+  return uniqueSystems(systems);
+}
+function expandBootstrapSystems(systems) {
+  const expanded = /* @__PURE__ */ new Set();
+  const visit = (system) => {
+    for (const dependency of SYSTEM_DEPENDENCIES[system]) {
+      visit(dependency);
+    }
+    expanded.add(system);
+  };
+  for (const system of systems) {
+    visit(system);
+  }
+  return [...expanded];
+}
+function serviceEnabled(config, serviceKey) {
+  const service = config.services?.[serviceKey];
+  return Boolean(service && service.enabled !== false && (service.provider ?? "railway") === "railway");
+}
+function apiSystemDisabled(config) {
+  if (config.runtime?.mode === "none") {
+    return "runtime.mode is none.";
+  }
+  if (config.surfaces?.api?.enabled === false) {
+    return "surfaces.api.enabled is false.";
+  }
+  if (!serviceEnabled(config, "api")) {
+    return "services.api is not enabled for Railway.";
+  }
+  return null;
+}
+function agentsSystemDisabled(config) {
+  if (config.runtime?.mode === "none") {
+    return "runtime.mode is none.";
+  }
+  const enabled = ["manager", "worker", "workdayStart", "workdayReport"].some((serviceKey) => serviceEnabled(config, serviceKey));
+  return enabled ? null : "No agent Railway services are enabled.";
+}
+function hasValue(env, key) {
+  return typeof env[key] === "string" && String(env[key]).trim().length > 0;
+}
+function missingForSystem(system, env) {
+  switch (system) {
+    case "github":
+      return hasValue(env, "GH_TOKEN") || hasValue(env, "GITHUB_TOKEN") ? [] : ["GH_TOKEN"];
+    case "data":
+    case "web":
+      return hasValue(env, "CLOUDFLARE_API_TOKEN") ? [] : ["CLOUDFLARE_API_TOKEN"];
+    case "api":
+    case "agents":
+      return hasValue(env, "RAILWAY_API_TOKEN") ? [] : ["RAILWAY_API_TOKEN"];
+    default:
+      return [];
+  }
+}
+function resolveTreeseedBootstrapSelection({
+  deployConfig,
+  env,
+  systems,
+  skipUnavailable
+}) {
+  const requested = parseTreeseedBootstrapSystems(systems);
+  const explicit = !(systems === void 0 || systems === null) && requested.length > 0;
+  const selected = requested.includes("all") ? [...TREESEED_BOOTSTRAP_SYSTEMS] : requested;
+  const expanded = expandBootstrapSystems(selected);
+  const defaultSkipUnavailable = requested.includes("all");
+  const effectiveSkipUnavailable = skipUnavailable ?? defaultSkipUnavailable;
+  const canSkipUnavailable = (system) => effectiveSkipUnavailable && (skipUnavailable === true || system === "api" || system === "agents");
+  const statuses = [];
+  const configDisabled = [];
+  const unavailable = [];
+  const skipped = [];
+  const runnable = [];
+  for (const system of expanded) {
+    const disabledReason = system === "api" ? apiSystemDisabled(deployConfig) : system === "agents" ? agentsSystemDisabled(deployConfig) : null;
+    if (disabledReason) {
+      const status2 = { system, status: "config_disabled", reason: disabledReason, missing: [] };
+      configDisabled.push(status2);
+      skipped.push(status2);
+      statuses.push(status2);
+      continue;
+    }
+    const missing = missingForSystem(system, env);
+    if (missing.length > 0) {
+      const reason = `${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not configured.`;
+      const status2 = {
+        system,
+        status: "unavailable",
+        reason,
+        missing
+      };
+      if (!canSkipUnavailable(system) && (selected.includes(system) || !requested.includes("all"))) {
+        unavailable.push(status2);
+        statuses.push(status2);
+        continue;
+      }
+      unavailable.push(status2);
+      skipped.push(status2);
+      statuses.push(status2);
+      continue;
+    }
+    const status = {
+      system,
+      status: selected.includes(system) ? "selected" : "included_dependency",
+      reason: selected.includes(system) ? "Selected for bootstrap." : "Included as a dependency.",
+      missing: []
+    };
+    runnable.push(system);
+    statuses.push(status);
+  }
+  return {
+    requested,
+    explicit,
+    skipUnavailable: effectiveSkipUnavailable,
+    selected,
+    expanded,
+    runnable,
+    configDisabled,
+    unavailable,
+    skipped,
+    statuses
+  };
+}
+function bootstrapSystemForUnit(unit) {
+  const metadataSystem = unit.metadata?.bootstrapSystem;
+  if (typeof metadataSystem === "string" && BOOTSTRAP_SYSTEM_SET.has(metadataSystem)) {
+    return metadataSystem;
+  }
+  if (unit.unitType === "queue" || unit.unitType === "database" || unit.unitType === "content-store") {
+    return "data";
+  }
+  if (unit.unitType === "api-runtime" || unit.unitType === "railway-service:api" || unit.unitType === "custom-domain:api") {
+    return "api";
+  }
+  if (unit.unitType.startsWith("railway-service:") || unit.unitType.endsWith("-runtime")) {
+    return "agents";
+  }
+  return "web";
+}
+function filterTreeseedDesiredUnitsByBootstrapSystems(units, systems) {
+  if (!systems || systems.length === 0) {
+    return units;
+  }
+  const allowed = new Set(systems);
+  return units.filter((unit) => allowed.has(bootstrapSystemForUnit(unit)));
+}
+export {
+  TREESEED_BOOTSTRAP_SYSTEMS,
+  bootstrapSystemForUnit,
+  filterTreeseedDesiredUnitsByBootstrapSystems,
+  parseTreeseedBootstrapSystems,
+  resolveTreeseedBootstrapSelection
+};

package/dist/reconcile/builtin-adapters.js

@@ -155,28 +155,43 @@ function providerCache(input, key, loader, forceRefresh = false) {
   input.context.session.set(key, value);
   return value;
 }
+function normalizeEnvironmentValues(env) {
+  return Object.fromEntries(
+    Object.entries(env ?? {}).filter((entry) => typeof entry[1] === "string").map(([key, value]) => [key, value])
+  );
+}
+function resolveReconcileEnvironmentValues(input, scope) {
+  if (scope === "local") {
+    return resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope);
+  }
+  const values = {
+    ...normalizeEnvironmentValues(process.env),
+    ...normalizeEnvironmentValues(input.context.launchEnv)
+  };
+  return values;
+}
 function buildCloudflareEnv(input) {
   const scope = scopeFromTarget(toDeployTarget(input.context.target));
-  const machineValues = resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope);
+  const values = resolveReconcileEnvironmentValues(input, scope);
   return {
-    CLOUDFLARE_ACCOUNT_ID: machineValues.CLOUDFLARE_ACCOUNT_ID ?? input.context.launchEnv.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? resolveConfiguredCloudflareAccountId(input.context.deployConfig),
-    CLOUDFLARE_API_TOKEN: machineValues.CLOUDFLARE_API_TOKEN ?? input.context.launchEnv.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? ""
+    CLOUDFLARE_ACCOUNT_ID: values.CLOUDFLARE_ACCOUNT_ID ?? input.context.launchEnv.CLOUDFLARE_ACCOUNT_ID ?? process.env.CLOUDFLARE_ACCOUNT_ID ?? resolveConfiguredCloudflareAccountId(input.context.deployConfig),
+    CLOUDFLARE_API_TOKEN: values.CLOUDFLARE_API_TOKEN ?? input.context.launchEnv.CLOUDFLARE_API_TOKEN ?? process.env.CLOUDFLARE_API_TOKEN ?? ""
   };
 }
 function hasLiveResourceId(value) {
   return typeof value === "string" && value.length > 0 && !value.startsWith("dryrun-") && !value.startsWith("local-") && !value.endsWith("-id") && !value.endsWith("-preview-id");
 }
 function buildRailwayEnv(input, scope) {
-  const machineValues = resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope);
+  const values = resolveReconcileEnvironmentValues(input, scope);
   const token = [
-    machineValues.RAILWAY_API_TOKEN,
+    values.RAILWAY_API_TOKEN,
     input.context.launchEnv.RAILWAY_API_TOKEN,
     process.env.RAILWAY_API_TOKEN
   ].find((value) => typeof value === "string" && value.trim().length > 0)?.trim() ?? "";
   return {
     RAILWAY_API_TOKEN: token,
-    TREESEED_RAILWAY_API_URL: machineValues.TREESEED_RAILWAY_API_URL ?? input.context.launchEnv.TREESEED_RAILWAY_API_URL ?? process.env.TREESEED_RAILWAY_API_URL ?? "",
-    TREESEED_RAILWAY_WORKSPACE: machineValues.TREESEED_RAILWAY_WORKSPACE ?? input.context.launchEnv.TREESEED_RAILWAY_WORKSPACE ?? process.env.TREESEED_RAILWAY_WORKSPACE ?? ""
+    TREESEED_RAILWAY_API_URL: values.TREESEED_RAILWAY_API_URL ?? input.context.launchEnv.TREESEED_RAILWAY_API_URL ?? process.env.TREESEED_RAILWAY_API_URL ?? "",
+    TREESEED_RAILWAY_WORKSPACE: values.TREESEED_RAILWAY_WORKSPACE ?? input.context.launchEnv.TREESEED_RAILWAY_WORKSPACE ?? process.env.TREESEED_RAILWAY_WORKSPACE ?? ""
   };
 }
 function findCloudflareQueueByName(input, env, expectedName, { attempts = 6, delayMs = 350 } = {}) {
@@ -434,7 +449,7 @@ ${result.stdout ?? ""}`;
 function collectCloudflareEnvironmentSync(input) {
   const target = toDeployTarget(input.context.target);
   const scope = scopeFromTarget(target);
-  const values = resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope);
+  const values = resolveReconcileEnvironmentValues(input, scope);
   const registry = collectTreeseedEnvironmentContext(input.context.tenantRoot);
   const state = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target });
   const generatedSecrets = buildSecretMap(input.context.deployConfig, state);
@@ -1463,7 +1478,7 @@ async function observeRailwayUnit(input, { refresh = false } = {}) {
 }
 function collectRailwayEnvironmentSync(input) {
   const scope = input.context.target.kind === "persistent" ? input.context.target.scope : "staging";
-  const values = resolveTreeseedMachineEnvironmentValues(input.context.tenantRoot, scope);
+  const values = resolveReconcileEnvironmentValues(input, scope);
   const registry = collectTreeseedEnvironmentContext(input.context.tenantRoot);
   const state = loadDeployState(input.context.tenantRoot, input.context.deployConfig, { target: toDeployTarget(input.context.target) });
   const secrets = Object.fromEntries(

package/dist/reconcile/desired-state.js

@@ -49,7 +49,7 @@ function deriveTreeseedDesiredUnits({
       binding: legacyState.queues.agentWork.binding
     },
     secrets: {},
-    metadata: {}
+    metadata: { bootstrapSystem: "data" }
   });
   const databaseId = add({
     unitId: createTreeseedReconcileUnitId("database", legacyState.d1Databases.SITE_DATA_DB.databaseName),
@@ -64,7 +64,7 @@ function deriveTreeseedDesiredUnits({
       binding: "SITE_DATA_DB"
     },
     secrets: {},
-    metadata: {}
+    metadata: { bootstrapSystem: "data" }
   });
   const formGuardKvId = add({
     unitId: createTreeseedReconcileUnitId("kv-form-guard", legacyState.kvNamespaces.FORM_GUARD_KV.name),
@@ -76,7 +76,7 @@ function deriveTreeseedDesiredUnits({
     dependencies: [],
     spec: { binding: "FORM_GUARD_KV", name: legacyState.kvNamespaces.FORM_GUARD_KV.name },
     secrets: {},
-    metadata: {}
+    metadata: { bootstrapSystem: "web" }
   });
   const sessionKvId = add({
     unitId: createTreeseedReconcileUnitId("kv-session", legacyState.kvNamespaces.SESSION.name),
@@ -88,7 +88,7 @@ function deriveTreeseedDesiredUnits({
     dependencies: [],
     spec: { binding: "SESSION", name: legacyState.kvNamespaces.SESSION.name },
     secrets: {},
-    metadata: {}
+    metadata: { bootstrapSystem: "web" }
   });
   const contentStoreId = add({
     unitId: createTreeseedReconcileUnitId("content-store", legacyState.content.bucketName ?? deployConfig.slug),
@@ -106,7 +106,7 @@ function deriveTreeseedDesiredUnits({
       previewRootTemplate: legacyState.content.previewRootTemplate
     },
     secrets: {},
-    metadata: { shared: true }
+    metadata: { shared: true, bootstrapSystem: "data" }
   });
   const pagesProjectId = add({
     unitId: createTreeseedReconcileUnitId("pages-project", legacyState.pages.projectName),
@@ -123,7 +123,7 @@ function deriveTreeseedDesiredUnits({
       buildOutputDir: legacyState.pages.buildOutputDir
     },
     secrets: {},
-    metadata: {}
+    metadata: { bootstrapSystem: "web" }
   });
   const edgeWorkerId = add({
     unitId: createTreeseedReconcileUnitId("edge-worker", legacyState.workerName),
@@ -137,7 +137,7 @@ function deriveTreeseedDesiredUnits({
       workerName: legacyState.workerName
     },
     secrets: {},
-    metadata: {}
+    metadata: { bootstrapSystem: "web" }
   });
   if (deployConfig.surfaces?.web?.enabled !== false) {
     const scope2 = target.kind === "persistent" ? target.scope : "staging";
@@ -155,7 +155,7 @@ function deriveTreeseedDesiredUnits({
         projectName: legacyState.pages.projectName
       },
       secrets: {},
-      metadata: { surface: "web" }
+      metadata: { surface: "web", bootstrapSystem: "web" }
     }) : null;
     const webDnsUnitId = webDomain ? add({
       unitId: createTreeseedReconcileUnitId("dns-record", `web:${webDomain}`),
@@ -175,7 +175,7 @@ function deriveTreeseedDesiredUnits({
         targetKind: "pages-project"
       },
       secrets: {},
-      metadata: { surface: "web" }
+      metadata: { surface: "web", bootstrapSystem: "web" }
     }) : null;
     add({
       unitId: createTreeseedReconcileUnitId("web-ui", "web-ui"),
@@ -196,7 +196,7 @@ function deriveTreeseedDesiredUnits({
         localBaseUrl: deployConfig.surfaces?.web?.localBaseUrl ?? null
       },
       secrets: {},
-      metadata: {}
+      metadata: { bootstrapSystem: "web" }
     });
   }
   const scope = target.kind === "persistent" ? target.scope : "staging";
@@ -208,6 +208,7 @@ function deriveTreeseedDesiredUnits({
       continue;
     }
     const concreteType = railwayConcreteUnitTypeForServiceKey(serviceKey);
+    const serviceBootstrapSystem = serviceKey === "api" ? "api" : "agents";
     const concreteId = add({
       unitId: createTreeseedReconcileUnitId(concreteType, serviceState?.serviceName ?? configuredService.serviceName ?? serviceKey),
       unitType: concreteType,
@@ -238,7 +239,8 @@ function deriveTreeseedDesiredUnits({
         serviceKey,
         scheduleManaged: Array.isArray(configuredService.schedule) && configuredService.schedule.length > 0,
         scheduleBootstrap: false,
-        scheduleDeployScopes: ["prod"]
+        scheduleDeployScopes: ["prod"],
+        bootstrapSystem: serviceBootstrapSystem
       }
     });
     const apiDomain = serviceKey === "api" && target.kind === "persistent" ? resolveConfiguredSurfaceDomain(deployConfig, target, "api") : null;
@@ -257,7 +259,7 @@ function deriveTreeseedDesiredUnits({
         environment: normalizeRailwayEnvironmentName(serviceState?.environment ?? configuredService.railwayEnvironment)
       },
       secrets: {},
-      metadata: { surface: "api", serviceKey }
+      metadata: { surface: "api", serviceKey, bootstrapSystem: "api" }
     }) : null;
     const apiDnsUnitId = apiDomain ? add({
       unitId: createTreeseedReconcileUnitId("dns-record", `api:${apiDomain}`),
@@ -274,7 +276,7 @@ function deriveTreeseedDesiredUnits({
         serviceKey
       },
       secrets: {},
-      metadata: { surface: "api", serviceKey }
+      metadata: { surface: "api", serviceKey, bootstrapSystem: "api" }
     }) : null;
     const runtimeUnitType = (() => {
       switch (serviceKey) {
@@ -309,7 +311,7 @@ function deriveTreeseedDesiredUnits({
         publicBaseUrl: serviceState?.publicBaseUrl ?? null
       },
       secrets: {},
-      metadata: {}
+      metadata: { bootstrapSystem: serviceBootstrapSystem }
     });
   }
   return { deployConfig, legacyState, units };

package/dist/reconcile/engine.d.ts

@@ -1,8 +1,10 @@
 import type { TreeseedObservedUnitState, TreeseedReconcilePlan, TreeseedReconcileResult, TreeseedReconcileStateRecord, TreeseedReconcileTarget, TreeseedUnitVerificationResult } from './contracts.ts';
-export declare function observeTreeseedUnits({ tenantRoot, target, env, write, }: {
+import { type TreeseedRunnableBootstrapSystem } from './bootstrap-systems.ts';
+export declare function observeTreeseedUnits({ tenantRoot, target, env, systems, write, }: {
     tenantRoot: string;
     target: TreeseedReconcileTarget;
     env?: NodeJS.ProcessEnv;
+    systems?: TreeseedRunnableBootstrapSystem[];
     write?: (line: string) => void;
 }): Promise<{
     units: import("./contracts.ts").TreeseedDesiredUnit[];
@@ -180,10 +182,11 @@ export declare function observeTreeseedUnits({ tenantRoot, target, env, write, }
         };
     };
 }>;
-export declare function planTreeseedReconciliation({ tenantRoot, target, env, write, }: {
+export declare function planTreeseedReconciliation({ tenantRoot, target, env, systems, write, }: {
     tenantRoot: string;
     target: TreeseedReconcileTarget;
     env?: NodeJS.ProcessEnv;
+    systems?: TreeseedRunnableBootstrapSystem[];
     write?: (line: string) => void;
 }): Promise<{
     plans: TreeseedReconcilePlan[];
@@ -362,10 +365,11 @@ export declare function planTreeseedReconciliation({ tenantRoot, target, env, wr
         };
     };
 }>;
-export declare function reconcileTreeseedTarget({ tenantRoot, target, env, write, }: {
+export declare function reconcileTreeseedTarget({ tenantRoot, target, env, systems, write, }: {
     tenantRoot: string;
     target: TreeseedReconcileTarget;
     env?: NodeJS.ProcessEnv;
+    systems?: TreeseedRunnableBootstrapSystem[];
     write?: (line: string) => void;
 }): Promise<{
     target: TreeseedReconcileTarget;
@@ -383,10 +387,11 @@ export declare function destroyTreeseedTargetUnits({ tenantRoot, target, env, wr
     target: TreeseedReconcileTarget;
     results: TreeseedReconcileResult[];
 }>;
-export declare function collectTreeseedReconcileStatus({ tenantRoot, target, env, }: {
+export declare function collectTreeseedReconcileStatus({ tenantRoot, target, env, systems, }: {
     tenantRoot: string;
     target: TreeseedReconcileTarget;
     env?: NodeJS.ProcessEnv;
+    systems?: TreeseedRunnableBootstrapSystem[];
 }): Promise<{
     target: TreeseedReconcileTarget;
     ready: boolean;

package/dist/reconcile/engine.js

@@ -2,6 +2,7 @@ import { createTreeseedReconcileRegistry } from "./registry.js";
 import { deriveTreeseedDesiredUnits } from "./desired-state.js";
 import { ensureTreeseedPersistedUnitState, desiredUnitSpecHash, loadTreeseedReconcileState, updateTreeseedPersistedUnitState, writeTreeseedReconcileState } from "./state.js";
 import { reverseTopologicallySortedUnits, topologicallySortDesiredUnits } from "./units.js";
+import { filterTreeseedDesiredUnitsByBootstrapSystems } from "./bootstrap-systems.js";
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
@@ -35,6 +36,33 @@ function createRunContext(tenantRoot, target, launchEnv, write) {
     session: /* @__PURE__ */ new Map()
   };
 }
+function dependencyLevels(units) {
+  const remaining = new Map(units.map((unit) => [unit.unitId, unit]));
+  const completed = /* @__PURE__ */ new Set();
+  const levels = [];
+  while (remaining.size > 0) {
+    const ready = [...remaining.values()].filter(
+      (unit) => unit.dependencies.every((dependencyId) => completed.has(dependencyId) || !remaining.has(dependencyId))
+    );
+    if (ready.length === 0) {
+      topologicallySortDesiredUnits(units);
+      throw new Error("Treeseed reconcile dependency graph could not be scheduled.");
+    }
+    for (const unit of ready) {
+      remaining.delete(unit.unitId);
+      completed.add(unit.unitId);
+    }
+    levels.push(ready);
+  }
+  return levels;
+}
+async function runByDependencyLevel(units, action) {
+  const results = [];
+  for (const level of dependencyLevels(units)) {
+    results.push(...await Promise.all(level.map((unit) => action(unit))));
+  }
+  return results;
+}
 function persistResult(reconcileState, previous, result) {
   updateTreeseedPersistedUnitState(reconcileState, {
     ...previous,
@@ -98,14 +126,17 @@ async function observeTreeseedUnits({
   tenantRoot,
   target,
   env = process.env,
+  systems,
   write
 }) {
-  const { units, deployConfig } = deriveTreeseedDesiredUnits({ tenantRoot, target });
+  const derived = deriveTreeseedDesiredUnits({ tenantRoot, target });
+  const units = filterTreeseedDesiredUnitsByBootstrapSystems(derived.units, systems);
+  const deployConfig = derived.deployConfig;
   const registry = createTreeseedReconcileRegistry(deployConfig);
   const reconcileState = loadTreeseedReconcileState(tenantRoot, target);
   const context = createRunContext(tenantRoot, target, env, write);
   const observations = /* @__PURE__ */ new Map();
-  for (const unit of topologicallySortDesiredUnits(units)) {
+  await runByDependencyLevel(topologicallySortDesiredUnits(units), async (unit) => {
     write?.(`Observing ${unit.provider}:${unit.unitType}...`);
     const adapter = registry.get(unit.unitType, unit.provider);
     const persisted = ensureTreeseedPersistedUnitState(reconcileState, unit);
@@ -120,7 +151,7 @@ async function observeTreeseedUnits({
       wrapAdapterFailure("observe", unit.provider, unit.unitType, unit.unitId, error);
     }
     observations.set(unit.unitId, observed);
-  }
+  });
   return {
     units,
     observations,
@@ -132,13 +163,14 @@ async function planTreeseedReconciliation({
   tenantRoot,
   target,
   env = process.env,
+  systems,
   write
 }) {
-  const observed = await observeTreeseedUnits({ tenantRoot, target, env, write });
+  const observed = await observeTreeseedUnits({ tenantRoot, target, env, systems, write });
   const registry = createTreeseedReconcileRegistry(observed.deployConfig);
   const context = createRunContext(tenantRoot, target, env, write);
   const plans = [];
-  for (const unit of topologicallySortDesiredUnits(observed.units)) {
+  await runByDependencyLevel(topologicallySortDesiredUnits(observed.units), async (unit) => {
     const adapter = registry.get(unit.unitType, unit.provider);
     const persisted = ensureTreeseedPersistedUnitState(observed.state, unit);
     const observation = observed.observations.get(unit.unitId);
@@ -159,7 +191,7 @@ async function planTreeseedReconciliation({
       diff,
       persisted
     });
-  }
+  });
   return {
     ...observed,
     plans
@@ -169,15 +201,26 @@ async function reconcileTreeseedTarget({
   tenantRoot,
   target,
   env = process.env,
+  systems,
   write
 }) {
-  const planned = await planTreeseedReconciliation({ tenantRoot, target, env, write });
+  const planned = await planTreeseedReconciliation({ tenantRoot, target, env, systems, write });
   const registry = createTreeseedReconcileRegistry(planned.deployConfig);
   const context = createRunContext(tenantRoot, target, env, write);
   const results = [];
   const verificationMap = /* @__PURE__ */ new Map();
   context.session.set("treeseed:verification-results", verificationMap);
-  for (const plan of planned.plans) {
+  const planByUnitId = new Map(planned.plans.map((plan) => [plan.unit.unitId, plan]));
+  let persistChain = Promise.resolve();
+  const persistVerifiedResult = async (persisted, verifiedResult) => {
+    persistChain = persistChain.then(() => {
+      persistResult(planned.state, persisted, verifiedResult);
+      writeTreeseedReconcileState(tenantRoot, planned.state);
+    });
+    await persistChain;
+  };
+  await runByDependencyLevel(topologicallySortDesiredUnits(planned.units), async (unit) => {
+    const plan = planByUnitId.get(unit.unitId);
     write?.(`Reconciling ${plan.unit.provider}:${plan.unit.unitType}...`);
     const adapter = registry.get(plan.unit.unitType, plan.unit.provider);
     const persisted = ensureTreeseedPersistedUnitState(planned.state, plan.unit);
@@ -232,13 +275,12 @@ async function reconcileTreeseedTarget({
     };
     verificationMap.set(plan.unit.unitId, verification);
     if (!verification.verified) {
-      persistResult(planned.state, persisted, verifiedResult);
-      writeTreeseedReconcileState(tenantRoot, planned.state);
+      await persistVerifiedResult(persisted, verifiedResult);
       throw new Error(`Treeseed reconcile verification failed for ${plan.unit.provider}:${plan.unit.unitType} (${plan.unit.unitId}): ${formatVerificationFailure(verification)}`);
     }
-    persistResult(planned.state, persisted, verifiedResult);
+    await persistVerifiedResult(persisted, verifiedResult);
     results.push(verifiedResult);
-  }
+  });
   writeTreeseedReconcileState(tenantRoot, planned.state);
   return {
     target,
@@ -294,9 +336,10 @@ async function destroyTreeseedTargetUnits({
 async function collectTreeseedReconcileStatus({
   tenantRoot,
   target,
-  env = process.env
+  env = process.env,
+  systems
 }) {
-  const observed = await observeTreeseedUnits({ tenantRoot, target, env });
+  const observed = await observeTreeseedUnits({ tenantRoot, target, env, systems });
   const registry = createTreeseedReconcileRegistry(observed.deployConfig);
   const context = createRunContext(tenantRoot, target, env);
   const plans = await Promise.all(observed.units.map(async (unit) => {

package/dist/reconcile/index.d.ts

@@ -1,4 +1,5 @@
 export * from './contracts.ts';
+export * from './bootstrap-systems.ts';
 export * from './desired-state.ts';
 export * from './engine.ts';
 export * from './errors.ts';

package/dist/reconcile/index.js

@@ -1,4 +1,5 @@
 export * from "./contracts.js";
+export * from "./bootstrap-systems.js";
 export * from "./desired-state.js";
 export * from "./engine.js";
 export * from "./errors.js";

package/dist/scripts/config-treeseed.js

@@ -5,6 +5,9 @@ function parseArgs(argv) {
     const parsed = {
         scopes: [],
         sync: 'all',
+        systems: [],
+        skipUnavailable: undefined,
+        bootstrapExecution: 'parallel',
         bootstrap: false,
         rotateMachineKey: false,
     };
@@ -34,6 +37,30 @@ function parseArgs(argv) {
             parsed.bootstrap = true;
             continue;
         }
+        if (current === '--system') {
+            parsed.systems.push(rest.shift() ?? '');
+            continue;
+        }
+        if (current.startsWith('--system=')) {
+            parsed.systems.push(current.split('=', 2)[1] ?? '');
+            continue;
+        }
+        if (current === '--systems') {
+            parsed.systems.push(...String(rest.shift() ?? '').split(','));
+            continue;
+        }
+        if (current.startsWith('--systems=')) {
+            parsed.systems.push(...String(current.split('=', 2)[1] ?? '').split(','));
+            continue;
+        }
+        if (current === '--skip-unavailable') {
+            parsed.skipUnavailable = true;
+            continue;
+        }
+        if (current === '--bootstrap-sequential') {
+            parsed.bootstrapExecution = 'sequential';
+            continue;
+        }
         if (current === '--rotate-machine-key') {
             parsed.rotateMachineKey = true;
             continue;
@@ -75,6 +102,9 @@ try {
             tenantRoot,
             scopes,
             sync: options.sync,
+            systems: options.systems.length > 0 ? options.systems : undefined,
+            skipUnavailable: options.skipUnavailable,
+            bootstrapExecution: options.bootstrapExecution,
             env: process.env,
         });
         const { configPath, keyPath } = getTreeseedMachineConfigPaths(tenantRoot);

package/dist/scripts/package-tools.js

@@ -34,8 +34,6 @@ export function resolveWranglerBin() {
 export function createProductionBuildEnv(extraEnv = {}) {
     return {
         TREESEED_LOCAL_DEV_MODE: 'cloudflare',
-        TREESEED_PUBLIC_FORMS_LOCAL_BYPASS_TURNSTILE: '',
-        TREESEED_FORMS_LOCAL_BYPASS_TURNSTILE: '',
         TREESEED_FORMS_LOCAL_BYPASS_CLOUDFLARE_GUARDS: '',
         TREESEED_PUBLIC_DEV_WATCH_RELOAD: '',
         ...extraEnv,