@treeseed/sdk 0.6.4 → 0.6.6

package/dist/operations/services/config-runtime.js

@@ -1452,7 +1452,20 @@ function resolveTreeseedLaunchEnvironment({
       throw error;
     }
   }
-  const scopedValues = scope === "local" ? { ...baseEnv, ...machineValues } : { ...machineValues, ...baseEnv };
+  const registry = collectTreeseedEnvironmentContext(tenantRoot);
+  const seedValues = scope === "local" ? { ...baseEnv, ...machineValues } : { ...machineValues, ...baseEnv };
+  const suggestedValues = getTreeseedEnvironmentSuggestedValues({
+    scope,
+    purpose: "deploy",
+    deployConfig: registry.context.deployConfig,
+    tenantConfig: registry.context.tenantConfig,
+    plugins: registry.context.plugins,
+    values: seedValues
+  });
+  const nonSecretSuggestedValues = Object.fromEntries(
+    registry.entries.filter((entry) => entry.sensitivity !== "secret" && typeof suggestedValues[entry.id] === "string" && suggestedValues[entry.id].length > 0).map((entry) => [entry.id, suggestedValues[entry.id]])
+  );
+  const scopedValues = scope === "local" ? { ...nonSecretSuggestedValues, ...baseEnv, ...machineValues } : { ...nonSecretSuggestedValues, ...machineValues, ...baseEnv };
   return {
     ...scopedValues,
     ...overrides

package/dist/operations/services/github-automation.js

@@ -305,6 +305,7 @@ function requiredGitHubSecrets(tenantRoot) {
 function renderTenantWorkflowActionCommand() {
   return [
     "EXTRA_ARGS=()",
+    'if [[ "${TREESEED_WORKFLOW_SKIP_PROVISION:-}" == "1" ]]; then EXTRA_ARGS+=(--skip-provision); fi',
     'if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi',
     'if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi',
     "if test -f ./packages/sdk/scripts/tenant-workflow-action.ts; then",

package/dist/operations/services/project-platform.js

@@ -14,7 +14,7 @@ import {
 import { createPublishedContentPipeline } from "../../platform/published-content-pipeline.js";
 import { collectTreeseedReconcileStatus, reconcileTreeseedTarget, resolveTreeseedBootstrapSelection } from "../../reconcile/index.js";
 import { loadTreeseedManifest } from "../../platform/tenant-config.js";
-import { applyTreeseedEnvironmentToProcess } from "./config-runtime.js";
+import { applyTreeseedEnvironmentToProcess, assertTreeseedCommandEnvironment } from "./config-runtime.js";
 import {
   assertDeploymentInitialized,
   createPersistentDeployTarget,
@@ -115,6 +115,19 @@ function resolveProjectPlatformBootstrapSystems(options, siteConfig = loadCliDep
   }
   return selection.runnable.filter((system) => system !== "github");
 }
+function runTenantPublishContentPreflight(options) {
+  const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
+  applyTreeseedEnvironmentToProcess({ tenantRoot: options.tenantRoot, scope: options.scope, override: true });
+  if (options.scope !== "local") {
+    assertTreeseedCommandEnvironment({
+      tenantRoot: options.tenantRoot,
+      scope: options.scope,
+      purpose: "deploy"
+    });
+    assertDeploymentInitialized(options.tenantRoot, { target });
+  }
+  return target;
+}
 function runWrangler(tenantRoot, args, extraEnv = {}, options = {}) {
   const result = spawnSync(process.execPath, [resolveWranglerBin(), ...args], {
     cwd: tenantRoot,
@@ -630,6 +643,7 @@ function probeScaleConfiguration(siteConfig, state) {
   };
 }
 async function publishContent(options, reporter) {
+  const target = runTenantPublishContentPreflight(options);
   const siteConfig = loadCliDeployConfig(options.tenantRoot);
   const tenantConfig = loadTreeseedManifest(resolve(options.tenantRoot, "src", "manifest.yaml"));
   const teamId = String(process.env.TREESEED_HOSTING_TEAM_ID ?? siteConfig.hosting?.teamId ?? siteConfig.slug).trim() || siteConfig.slug;
@@ -638,7 +652,6 @@ async function publishContent(options, reporter) {
   const branchName = currentRef(options.tenantRoot);
   const previewId = options.previewId ?? `staging-${sanitizeSegment(branchName, "preview")}-${sanitizeSegment(commitSha?.slice(0, 12), "latest")}`;
   const locator = resolveTeamScopedContentLocator(siteConfig, teamId);
-  const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
   const { wranglerPath } = ensureGeneratedWranglerConfig(options.tenantRoot, { target });
   const wranglerEnv = { CLOUDFLARE_ACCOUNT_ID: String(process.env.CLOUDFLARE_ACCOUNT_ID ?? siteConfig.cloudflare.accountId ?? "").trim() };
   const bucketName = String(process.env.TREESEED_CONTENT_BUCKET_NAME ?? siteConfig.cloudflare.r2?.bucketName ?? "").trim();
@@ -1141,7 +1154,7 @@ async function deployProjectPlatform(options) {
       scheduleVerification: railwayScheduleVerification
     });
   }
-  const monitor = await monitorProjectPlatform({ ...options, reporter });
+  const monitor = await monitorProjectPlatform({ ...options, reporter, bootstrapSystems });
   await reportDeployment(reporter, {
     environment: options.scope,
     deploymentKind: "code",
@@ -1171,15 +1184,20 @@ async function monitorProjectPlatform(options) {
   const reporter = resolveReporter(options.tenantRoot, options.reporter);
   const target = createPersistentDeployTarget(options.scope === "local" ? "staging" : options.scope);
   const siteConfig = loadCliDeployConfig(options.tenantRoot);
+  const selectedSystems = new Set(resolveProjectPlatformBootstrapSystems(options, siteConfig));
+  const apiSelected = selectedSystems.has("api");
+  const agentsSelected = selectedSystems.has("agents");
   const state = loadDeployState(options.tenantRoot, siteConfig, { target });
   const webProbeUrl = resolveImmediatePagesProbeUrl(siteConfig, state, target);
   const apiBaseUrl = resolveImmediateApiProbeUrl(siteConfig, state, target);
+  const skippedApiCheck = apiSelected ? { ok: false, skipped: true, reason: "api_url_unconfigured" } : { ok: true, skipped: true, reason: "api_not_selected" };
+  const skippedAgentCheck = agentsSelected ? { ok: false, skipped: true, reason: "api_url_unconfigured" } : { ok: true, skipped: true, reason: "agents_not_selected" };
   const checks = {
     pages: await probeHttp(webProbeUrl),
-    apiHealth: apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/healthz`) : { ok: false, skipped: true, reason: "api_url_unconfigured" },
-    apiReady: apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/readyz`) : { ok: false, skipped: true, reason: "api_url_unconfigured" },
-    d1Health: apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/healthz/deep`) : { ok: false, skipped: true, reason: "api_url_unconfigured" },
-    agentHealth: apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/internal/core/agent/healthz`) : { ok: false, skipped: true, reason: "api_url_unconfigured" },
+    apiHealth: apiSelected && apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/healthz`) : skippedApiCheck,
+    apiReady: apiSelected && apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/readyz`) : skippedApiCheck,
+    d1Health: apiSelected && apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/healthz/deep`) : skippedApiCheck,
+    agentHealth: agentsSelected && apiBaseUrl ? await probeHttp(`${String(apiBaseUrl).replace(/\/+$/u, "")}/internal/core/agent/healthz`) : skippedAgentCheck,
     r2: options.dryRun ? { ok: true, skipped: true, reason: "dry_run" } : probeR2(options.tenantRoot, siteConfig, state, target),
     queue: options.dryRun ? Promise.resolve({ ok: true, skipped: true, reason: "dry_run" }) : probeQueue(siteConfig, state),
     scaleProbe: probeScaleConfiguration(siteConfig, state),

package/dist/scripts/tenant-workflow-action.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { pathToFileURL } from 'node:url';
 import { resolveScope, runProjectPlatformAction, } from '../operations/services/project-platform.js';
 const tenantRoot = process.cwd();
 function parseArgs(argv) {
@@ -8,6 +9,7 @@ function parseArgs(argv) {
         projectId: null,
         previewId: null,
         dryRun: false,
+        skipProvision: false,
     };
     const rest = [...argv];
     while (rest.length) {
@@ -50,6 +52,10 @@ function parseArgs(argv) {
             parsed.dryRun = true;
             continue;
         }
+        if (current === '--skip-provision') {
+            parsed.skipProvision = true;
+            continue;
+        }
         throw new Error(`Unknown workflow action argument: ${current}`);
     }
     return parsed;
@@ -63,9 +69,13 @@ async function main() {
         projectId: options.projectId ?? process.env.TREESEED_PROJECT_ID ?? null,
         previewId: options.previewId,
         dryRun: options.dryRun,
+        skipProvision: options.skipProvision,
     });
     if (result !== undefined) {
         process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
     }
 }
-await main();
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    await main();
+}
+export { parseArgs };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {

package/templates/github/deploy.workflow.yml

@@ -98,9 +98,12 @@ jobs:
               while IFS= read -r path; do
                 [[ -z "${path}" ]] && continue
                 case "${path}" in
-                  src/content/*|content/*|books/*|docs/*|migrations/*)
+                  src/content/*|content/*|books/*|docs/*)
                     content_changed="true"
                     ;;
+                  migrations/*)
+                    code_changed="true"
+                    ;;
                   *)
                     code_changed="true"
                     ;;
@@ -131,6 +134,8 @@ jobs:
       needs.classify.outputs.release_tag == 'true'
     permissions:
       contents: read
+    env:
+      TREESEED_BOOTSTRAP_MODE: auto
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -178,6 +183,7 @@ __WORKING_DIRECTORY_BLOCK__
       deployments: write
     environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
     env:
+      TREESEED_BOOTSTRAP_MODE: auto
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
       CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
       TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
@@ -195,7 +201,31 @@ __WORKING_DIRECTORY_BLOCK__
       TREESEED_SMTP_FROM: ${{ vars.TREESEED_SMTP_FROM }}
       TREESEED_SMTP_REPLY_TO: ${{ vars.TREESEED_SMTP_REPLY_TO }}
       RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
+      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
+      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
+      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
+      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
       TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL }}
+      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
+      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
+      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
+      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
+      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
+      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
+      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
+      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
+      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
+      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
+      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
+      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
+      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
+      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
+      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
+      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
+      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
+      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
       TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
       TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
       TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
@@ -235,6 +265,16 @@ __WORKING_DIRECTORY_BLOCK__
         shell: bash
         run: |
 __TENANT_WORKFLOW_ACTION_COMMAND_BLOCK__
+
+      - name: Upload Treeseed deployment state
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
+          path: .treeseed/state
+          if-no-files-found: error
+          retention-days: 1
+          include-hidden-files: true
 __WORKING_DIRECTORY_BLOCK__
 
   deploy-code:
@@ -252,6 +292,7 @@ __WORKING_DIRECTORY_BLOCK__
       needs.classify.outputs.release_tag == 'true'
     environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
     env:
+      TREESEED_BOOTSTRAP_MODE: auto
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
       CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
       TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
@@ -269,7 +310,31 @@ __WORKING_DIRECTORY_BLOCK__
       TREESEED_SMTP_FROM: ${{ vars.TREESEED_SMTP_FROM }}
       TREESEED_SMTP_REPLY_TO: ${{ vars.TREESEED_SMTP_REPLY_TO }}
       RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
+      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
+      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
+      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
+      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
       TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL }}
+      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
+      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
+      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
+      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
+      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
+      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
+      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
+      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
+      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
+      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
+      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
+      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
+      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
+      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
+      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
+      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
+      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
+      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
       TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
       TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
       TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
@@ -290,6 +355,7 @@ __WORKING_DIRECTORY_BLOCK__
       TREESEED_CONTENT_SERVING_MODE: published_runtime
       TREESEED_WORKFLOW_ACTION: deploy_code
       TREESEED_WORKFLOW_ENVIRONMENT: ${{ needs.classify.outputs.scope }}
+      TREESEED_WORKFLOW_SKIP_PROVISION: "1"
       TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
       TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id || needs.classify.outputs.preview_id }}
     steps:
@@ -315,6 +381,12 @@ __WORKING_DIRECTORY_BLOCK__
       - name: Install dependencies
         run: npm ci
 
+      - name: Download Treeseed deployment state
+        uses: actions/download-artifact@v4
+        with:
+          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
+          path: .treeseed/state
+
       - name: Deploy Treeseed platform
         shell: bash
         run: |
@@ -332,11 +404,14 @@ __WORKING_DIRECTORY_BLOCK__
       contents: read
       deployments: write
     if: |
+      always() &&
+      needs.provision.result == 'success' &&
       (needs.classify.outputs.workflow_action == 'publish_content' ||
       needs.classify.outputs.content_changed == 'true') &&
       (needs['deploy-code'].result == 'success' || needs['deploy-code'].result == 'skipped')
     environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
     env:
+      TREESEED_BOOTSTRAP_MODE: auto
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
       CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
       TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
@@ -354,7 +429,31 @@ __WORKING_DIRECTORY_BLOCK__
       TREESEED_SMTP_FROM: ${{ vars.TREESEED_SMTP_FROM }}
       TREESEED_SMTP_REPLY_TO: ${{ vars.TREESEED_SMTP_REPLY_TO }}
       RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
+      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
+      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
+      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
+      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
       TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL }}
+      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
+      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
+      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
+      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
+      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
+      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
+      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
+      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
+      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
+      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
+      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
+      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
+      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
+      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
+      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
+      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
+      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
+      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
       TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
       TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
       TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
@@ -390,6 +489,12 @@ __WORKING_DIRECTORY_BLOCK__
       - name: Install dependencies
         run: npm ci
 
+      - name: Download Treeseed deployment state
+        uses: actions/download-artifact@v4
+        with:
+          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
+          path: .treeseed/state
+
       - name: Publish Treeseed content
         shell: bash
         run: |
@@ -404,6 +509,8 @@ __WORKING_DIRECTORY_BLOCK__
       - deploy-code
       - publish-content
     if: |
+      always() &&
+      needs.provision.result == 'success' &&
       (needs.classify.outputs.workflow_action == 'monitor' ||
       needs.classify.outputs.code_changed == 'true' ||
       needs.classify.outputs.content_changed == 'true' ||
@@ -415,12 +522,37 @@ __WORKING_DIRECTORY_BLOCK__
       deployments: write
     environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
     env:
+      TREESEED_BOOTSTRAP_MODE: auto
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
       CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
       TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
       TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
       RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
+      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
+      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
+      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
+      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
       TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL }}
+      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
+      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
+      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
+      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
+      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
+      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
+      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
+      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
+      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
+      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
+      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
+      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
+      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
+      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
+      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
+      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
+      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
+      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
+      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
       TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
       TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
       TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
@@ -445,6 +577,12 @@ __WORKING_DIRECTORY_BLOCK__
       - name: Install dependencies
         run: npm ci
 
+      - name: Download Treeseed deployment state
+        uses: actions/download-artifact@v4
+        with:
+          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
+          path: .treeseed/state
+
       - name: Report Treeseed deployment state
         shell: bash
         run: |