@treeseed/sdk 0.6.7 → 0.6.9

package/dist/operations/services/git-workflow.js

@@ -1,11 +1,20 @@
 import { run, workspaceRoot } from "./workspace-tools.js";
 import { currentBranch, gitStatusPorcelain, repoRoot } from "./workspace-save.js";
+import { ensureSshPushUrlForOrigin } from "./git-remote-policy.js";
+import { createTreeseedManagedToolEnv, resolveTreeseedToolBinary } from "../../managed-dependencies.js";
 const STAGING_BRANCH = "staging";
 const PRODUCTION_BRANCH = "main";
 const RESERVED_BRANCHES = /* @__PURE__ */ new Set([STAGING_BRANCH, PRODUCTION_BRANCH]);
 function runGit(args, { cwd, capture = false } = {}) {
   return run("git", args, { cwd, capture });
 }
+function ensureWritableOrigin(repoDir) {
+  try {
+    const remoteUrl = runGit(["remote", "get-url", "origin"], { cwd: repoDir, capture: true }).trim();
+    ensureSshPushUrlForOrigin(repoDir, remoteUrl);
+  } catch {
+  }
+}
 function repoHasStagedChanges(repoDir) {
   try {
     runGit(["diff", "--cached", "--quiet"], { cwd: repoDir });
@@ -130,7 +139,7 @@ function syncBranchWithOrigin(repoDir, branchName) {
     checkoutBranch(repoDir, branchName);
   }
   if (remoteBranchExists(repoDir, branchName)) {
-    runGit(["pull", "--rebase", "origin", branchName], { cwd: repoDir });
+    runGit(["merge", "--ff-only", `origin/${branchName}`], { cwd: repoDir });
   }
 }
 function createFeatureBranchFromStaging(cwd, branchName) {
@@ -144,6 +153,7 @@ function createFeatureBranchFromStaging(cwd, branchName) {
   return result;
 }
 function pushBranch(repoDir, branchName, { setUpstream = false } = {}) {
+  ensureWritableOrigin(repoDir);
   const args = setUpstream ? ["push", "-u", "origin", branchName] : ["push", "origin", branchName];
   runGit(args, { cwd: repoDir });
 }
@@ -188,6 +198,7 @@ function deleteRemoteBranch(repoDir, branchName) {
   if (!remoteBranchExists(repoDir, branchName)) {
     return false;
   }
+  ensureWritableOrigin(repoDir);
   runGit(["push", "origin", "--delete", branchName], { cwd: repoDir });
   return true;
 }
@@ -268,6 +279,7 @@ function createDeprecatedTaskTag(repoDir, branchName, message) {
   const shortSha = head.slice(0, 12);
   const tagName = `deprecated/${taskTagSlug(branchName)}/${shortSha}`;
   runGit(["tag", "-a", tagName, head, "-m", message], { cwd: repoDir });
+  ensureWritableOrigin(repoDir);
   runGit(["push", "origin", tagName], { cwd: repoDir, capture: true });
   return { tagName, head };
 }
@@ -276,7 +288,14 @@ function waitForStagingAutomation(repoDir) {
     return { status: "skipped", reason: "stubbed" };
   }
   try {
-    run("gh", ["run", "watch", "--branch", STAGING_BRANCH, "--exit-status"], { cwd: repoDir });
+    const gh = resolveTreeseedToolBinary("gh");
+    if (!gh) {
+      throw new Error("GitHub CLI `gh` is unavailable.");
+    }
+    run(gh, ["run", "watch", "--branch", STAGING_BRANCH, "--exit-status"], {
+      cwd: repoDir,
+      env: createTreeseedManagedToolEnv(process.env)
+    });
     return { status: "completed", branch: STAGING_BRANCH };
   } catch (error) {
     throw new Error([
@@ -308,7 +327,7 @@ function mergeBranchIntoTarget(cwd = workspaceRoot(), { sourceBranch, targetBran
   const repoDir = prepareReleaseBranches(cwd);
   checkoutBranch(repoDir, targetBranch);
   if (remoteBranchExists(repoDir, targetBranch)) {
-    runGit(["pull", "--rebase", "origin", targetBranch], { cwd: repoDir });
+    runGit(["merge", "--ff-only", `origin/${targetBranch}`], { cwd: repoDir });
   }
   runGit(["merge", "--no-ff", sourceBranch, "-m", message], { cwd: repoDir });
   pushBranch(repoDir, STAGING_BRANCH);

package/dist/operations/services/github-api.js

@@ -2,6 +2,7 @@ import { Buffer } from "node:buffer";
 import { spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
 import { Octokit } from "octokit";
+import { createTreeseedManagedToolEnv, resolveTreeseedToolBinary } from "../../managed-dependencies.js";
 const require2 = createRequire(import.meta.url);
 const sodium = require2("libsodium-wrappers");
 const DEFAULT_GITHUB_API_TIMEOUT_MS = 6e4;
@@ -465,8 +466,12 @@ function upsertGitHubRepositoryVariableWithGhCli(repository, name, value, {
     GH_TOKEN: token,
     GITHUB_TOKEN: token
   };
+  const gh = resolveTreeseedToolBinary("gh", { env: ghEnv });
+  if (!gh) {
+    throw new Error("GitHub CLI `gh` is unavailable.");
+  }
   const create = spawnSync(
-    "gh",
+    gh,
     [
       "api",
       `repos/${owner}/${repo}/actions/variables`,
@@ -477,7 +482,7 @@ function upsertGitHubRepositoryVariableWithGhCli(repository, name, value, {
       "-f",
       `value=${value}`
     ],
-    { encoding: "utf8", env: ghEnv }
+    { encoding: "utf8", env: createTreeseedManagedToolEnv(ghEnv) }
   );
   if (create.status === 0) {
     return;
@@ -488,7 +493,7 @@ ${create.stderr ?? ""}`.trim();
     throw new Error(combinedCreateOutput || `gh api exited with status ${create.status ?? 1}`);
   }
   const update = spawnSync(
-    "gh",
+    gh,
     [
       "api",
       `repos/${owner}/${repo}/actions/variables/${name}`,
@@ -499,7 +504,7 @@ ${create.stderr ?? ""}`.trim();
       "-f",
       `value=${value}`
     ],
-    { encoding: "utf8", env: ghEnv }
+    { encoding: "utf8", env: createTreeseedManagedToolEnv(ghEnv) }
   );
   if (update.status === 0) {
     return;

package/dist/operations/services/knowledge-coop-launch.js

@@ -17,6 +17,7 @@ import { loadCliDeployConfig } from "./runtime-tools.js";
 import { templateCatalogRoot } from "./runtime-paths.js";
 import { scaffoldTemplateProject } from "./template-registry.js";
 import { buildKnowledgeCoopKnowledgePackPackage, buildKnowledgeCoopTemplatePackage, importKnowledgeCoopKnowledgePack } from "./knowledge-coop-packaging.js";
+import { resolveTreeseedToolBinary } from "../../managed-dependencies.js";
 class KnowledgeCoopLaunchError extends Error {
   phase;
   phases;
@@ -531,6 +532,9 @@ function loadProjectMetadata(projectId, input, seed, workstream, siteUrl, projec
   };
 }
 function commandAvailable(command) {
+  if (command === "gh" || command === "wrangler" || command === "railway") {
+    return Boolean(resolveTreeseedToolBinary(command));
+  }
   return spawnSync("bash", ["-lc", `command -v ${command}`], { stdio: "ignore" }).status === 0;
 }
 function appendPhase(phases, phase, status, detail) {

package/dist/operations/services/local-dev.js

@@ -7,6 +7,7 @@ import {
   fixtureWranglerConfig,
   corePackageRoot
 } from "./runtime-paths.js";
+import { resolveTreeseedToolCommand } from "../../managed-dependencies.js";
 function mergeEnv(extraEnv = {}) {
   return { ...process.env, ...extraEnv };
 }
@@ -74,9 +75,13 @@ function prepareCloudflareLocalRuntime({ envOverrides = {}, persistTo, outDir }
   });
 }
 function startWranglerDev(args = [], options = {}) {
+  const wrangler = resolveTreeseedToolCommand("wrangler");
+  if (!wrangler) {
+    throw new Error("Wrangler CLI is unavailable.");
+  }
   return spawnProcess(
-    "wrangler",
-    ["dev", "--local", "--config", fixtureWranglerConfig, ...args],
+    wrangler.command,
+    [...wrangler.argsPrefix, "dev", "--local", "--config", fixtureWranglerConfig, ...args],
     {
       ...options,
       cwd: options.cwd ?? fixtureRoot

package/dist/operations/services/package-reference-policy.d.ts

@@ -0,0 +1,70 @@
+export type DevDependencyReferenceMode = 'git-tag' | 'registry-prerelease';
+export type DevTagCleanupMode = 'safe-after-release' | 'off';
+export type GitDependencyProtocol = 'preserve-origin' | 'https' | 'ssh';
+export type PackageDependencyReference = {
+    packageName: string;
+    version: string;
+    spec: string;
+    manifestSpec: string;
+    installSpec: string;
+    tagName: string | null;
+    remoteUrl: string | null;
+    mode: 'stable-semver' | 'dev-git-tag' | 'dev-registry-prerelease';
+};
+export type RewrittenDevReference = {
+    packageName: string;
+    field: string;
+    from: string;
+    to: string;
+    tagName: string | null;
+};
+export declare function internalDependencyFields(packageJson: Record<string, unknown> | null): string[];
+export declare function isPrereleaseVersion(version: string): boolean;
+export declare function isStableVersion(version: string): boolean;
+export declare function isGitDependencySpec(spec: string): boolean;
+export declare function devTagFromDependencySpec(spec: string): string | null;
+export declare function normalizeGitRemoteForDependency(remoteUrl: string, protocol?: GitDependencyProtocol): string | null;
+export declare function normalizeGitRemoteForManifest(remoteUrl: string, protocol?: GitDependencyProtocol): string | null;
+export declare function createPackageDependencyReference(input: {
+    packageName: string;
+    version: string;
+    branchMode: 'package-release-main' | 'package-dev-save';
+    remoteUrl?: string | null;
+    devDependencyReferenceMode?: DevDependencyReferenceMode;
+    gitDependencyProtocol?: GitDependencyProtocol;
+}): PackageDependencyReference;
+export declare function updateInternalDependencySpecs(packageJson: Record<string, unknown> | null, references: Map<string, PackageDependencyReference>): RewrittenDevReference[];
+export declare function rewriteInternalDependenciesToStableVersions(root: any, versions: Map<string, string>): (RewrittenDevReference & {
+    repoName: string;
+    packageJsonPath: string;
+})[];
+export declare function rewriteProjectInternalDependenciesToStableVersions(root: any, versions: Map<string, string>): (RewrittenDevReference & {
+    repoName: string;
+    packageJsonPath: string;
+})[];
+export declare function collectInternalDevReferenceIssues(root?: any, packageNames?: Set<any>): {
+    repoName: string;
+    filePath: string;
+    field?: string;
+    dependencyName?: string;
+    spec: string;
+    reason: string;
+}[];
+export declare function assertNoInternalDevReferences(root?: any, packageNames?: Set<string>): void;
+export declare function createDevTagMessage(input: {
+    packageName: string;
+    version: string;
+    branch: string;
+    commitSha: string;
+    workflowRunId?: string | null;
+    createdAt?: string;
+}): string;
+export declare function gitTagMessage(repoDir: string, tagName: string): string;
+export declare function tagHasTreeseedDevMetadata(repoDir: string, tagName: string): boolean;
+export declare function cleanupDevTags(repoDir: string, tagNames: string[], activeReferences?: string[]): {
+    cleaned: string[];
+    skipped: {
+        tagName: string;
+        reason: string;
+    }[];
+};

package/dist/operations/services/package-reference-policy.js

@@ -0,0 +1,330 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { run, workspacePackages, workspaceRoot } from "./workspace-tools.js";
+const INTERNAL_DEPENDENCY_FIELDS = ["dependencies", "optionalDependencies", "peerDependencies", "devDependencies"];
+function readJson(filePath) {
+  return JSON.parse(readFileSync(filePath, "utf8"));
+}
+function writeJson(filePath, value) {
+  writeFileSync(filePath, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+function internalDependencyFields(packageJson) {
+  if (!packageJson) return [];
+  return INTERNAL_DEPENDENCY_FIELDS.filter((field) => packageJson[field] && typeof packageJson[field] === "object" && !Array.isArray(packageJson[field]));
+}
+function isPrereleaseVersion(version) {
+  return /^\d+\.\d+\.\d+-[0-9A-Za-z.-]+$/u.test(String(version).trim());
+}
+function isStableVersion(version) {
+  return /^\d+\.\d+\.\d+$/u.test(String(version).trim());
+}
+function isGitDependencySpec(spec) {
+  return /^(?:git\+|github:|gitlab:|bitbucket:|ssh:\/\/|https:\/\/|file:)/u.test(String(spec).trim()) && String(spec).includes("#");
+}
+function devTagFromDependencySpec(spec) {
+  const value = String(spec).trim();
+  const hashIndex = value.lastIndexOf("#");
+  if (hashIndex === -1) return null;
+  const ref = decodeURIComponent(value.slice(hashIndex + 1));
+  return ref.includes("-dev.") ? ref : null;
+}
+function normalizeGitRemoteForDependency(remoteUrl, protocol = "preserve-origin") {
+  const remote = String(remoteUrl).trim();
+  if (!remote) return null;
+  if (/^file:\/\//u.test(remote)) return remote;
+  if (remote.startsWith("/") || remote.startsWith("./") || remote.startsWith("../")) {
+    return `git+${pathToFileURL(remote).href}`;
+  }
+  if (remote.endsWith(".git") && existsSync(remote)) {
+    return `git+${pathToFileURL(remote).href}`;
+  }
+  const sshMatch = remote.match(/^git@([^:]+):(.+?)(?:\.git)?$/u);
+  if (sshMatch) {
+    if (protocol === "https") {
+      return `git+https://${sshMatch[1]}/${sshMatch[2]}.git`;
+    }
+    return `git+ssh://git@${sshMatch[1]}/${sshMatch[2]}.git`;
+  }
+  const httpsMatch = remote.match(/^https:\/\/([^/]+)\/(.+?)(?:\.git)?$/u);
+  if (httpsMatch) {
+    if (protocol === "ssh") {
+      return `git+ssh://git@${httpsMatch[1]}/${httpsMatch[2]}.git`;
+    }
+    return `git+https://${httpsMatch[1]}/${httpsMatch[2]}.git`;
+  }
+  if (/^ssh:\/\//u.test(remote)) return `git+${remote}`;
+  if (/^git\+/u.test(remote)) return remote;
+  return remote;
+}
+function normalizeGitRemoteForManifest(remoteUrl, protocol = "preserve-origin") {
+  const dependencyRemote = normalizeGitRemoteForDependency(remoteUrl, protocol);
+  if (!dependencyRemote) return null;
+  const githubSshMatch = dependencyRemote.match(/^git\+ssh:\/\/git@github\.com\/(.+?)(?:\.git)?$/u);
+  if (githubSshMatch) {
+    return `github:${githubSshMatch[1]}`;
+  }
+  const githubHttpsMatch = dependencyRemote.match(/^git\+https:\/\/github\.com\/(.+?)(?:\.git)?$/u);
+  if (githubHttpsMatch) {
+    return `github:${githubHttpsMatch[1]}`;
+  }
+  return dependencyRemote;
+}
+function createPackageDependencyReference(input) {
+  if (input.branchMode === "package-release-main") {
+    return {
+      packageName: input.packageName,
+      version: input.version,
+      spec: input.version,
+      manifestSpec: input.version,
+      installSpec: input.version,
+      tagName: input.version,
+      remoteUrl: input.remoteUrl ?? null,
+      mode: "stable-semver"
+    };
+  }
+  if ((input.devDependencyReferenceMode ?? "git-tag") === "registry-prerelease") {
+    return {
+      packageName: input.packageName,
+      version: input.version,
+      spec: input.version,
+      manifestSpec: input.version,
+      installSpec: input.version,
+      tagName: input.version,
+      remoteUrl: input.remoteUrl ?? null,
+      mode: "dev-registry-prerelease"
+    };
+  }
+  const installRemote = normalizeGitRemoteForDependency(input.remoteUrl ?? "", input.gitDependencyProtocol ?? "preserve-origin");
+  const manifestRemote = normalizeGitRemoteForManifest(input.remoteUrl ?? "", input.gitDependencyProtocol ?? "preserve-origin");
+  if (!installRemote || !manifestRemote) {
+    throw new Error(`Unable to create Git-tag dependency for ${input.packageName}; origin remote is missing.`);
+  }
+  const manifestSpec = `${manifestRemote}#${input.version}`;
+  return {
+    packageName: input.packageName,
+    version: input.version,
+    spec: manifestSpec,
+    manifestSpec,
+    installSpec: manifestSpec,
+    tagName: input.version,
+    remoteUrl: input.remoteUrl ?? null,
+    mode: "dev-git-tag"
+  };
+}
+function updateInternalDependencySpecs(packageJson, references) {
+  if (!packageJson) return [];
+  const changed = [];
+  for (const field of internalDependencyFields(packageJson)) {
+    const values = packageJson[field];
+    for (const [depName, reference] of references.entries()) {
+      if (!(depName in values)) continue;
+      const current = String(values[depName]);
+      const nextSpec = reference.manifestSpec ?? reference.spec;
+      if (current === nextSpec) continue;
+      values[depName] = nextSpec;
+      changed.push({
+        packageName: depName,
+        field,
+        from: current,
+        to: nextSpec,
+        tagName: devTagFromDependencySpec(current) ?? (isPrereleaseVersion(current) ? current : null)
+      });
+    }
+  }
+  return changed;
+}
+function rewriteInternalDependenciesToStableVersions(root = workspaceRoot(), versions) {
+  const rewrites = [];
+  for (const pkg of workspacePackages(root)) {
+    const packageJsonPath = resolve(pkg.dir, "package.json");
+    const packageJson = readJson(packageJsonPath);
+    const changed = updateInternalDependencySpecs(
+      packageJson,
+      new Map([...versions.entries()].map(([packageName, version]) => [packageName, {
+        packageName,
+        version,
+        spec: version,
+        manifestSpec: version,
+        installSpec: version,
+        tagName: version,
+        remoteUrl: null,
+        mode: "stable-semver"
+      }]))
+    );
+    if (changed.length === 0) continue;
+    writeJson(packageJsonPath, packageJson);
+    rewrites.push(...changed.map((entry) => ({
+      ...entry,
+      repoName: pkg.name,
+      packageJsonPath
+    })));
+  }
+  return rewrites;
+}
+function rewriteProjectInternalDependenciesToStableVersions(root = workspaceRoot(), versions) {
+  const rewrites = [];
+  const targets = [
+    { name: "@treeseed/market", dir: root },
+    ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))
+  ];
+  for (const target of targets) {
+    const packageJsonPath = resolve(target.dir, "package.json");
+    if (!existsSync(packageJsonPath)) continue;
+    const packageJson = readJson(packageJsonPath);
+    const changed = updateInternalDependencySpecs(
+      packageJson,
+      new Map([...versions.entries()].map(([packageName, version]) => [packageName, {
+        packageName,
+        version,
+        spec: version,
+        manifestSpec: version,
+        installSpec: version,
+        tagName: version,
+        remoteUrl: null,
+        mode: "stable-semver"
+      }]))
+    );
+    if (changed.length === 0) continue;
+    writeJson(packageJsonPath, packageJson);
+    rewrites.push(...changed.map((entry) => ({
+      ...entry,
+      repoName: target.name,
+      packageJsonPath
+    })));
+  }
+  return rewrites;
+}
+function collectInternalDevReferenceIssues(root = workspaceRoot(), packageNames = new Set(workspacePackages(root).map((pkg) => pkg.name))) {
+  const issues = [];
+  const manifestRoots = [
+    { name: "@treeseed/market", dir: root },
+    ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))
+  ];
+  for (const pkg of manifestRoots) {
+    const packageJsonPath = resolve(pkg.dir, "package.json");
+    if (!existsSync(packageJsonPath)) continue;
+    const packageJson = readJson(packageJsonPath);
+    for (const field of internalDependencyFields(packageJson)) {
+      const values = packageJson[field];
+      for (const [depName, specValue] of Object.entries(values)) {
+        if (!packageNames.has(depName)) continue;
+        const spec = String(specValue);
+        if (isGitDependencySpec(spec) || devTagFromDependencySpec(spec)) {
+          issues.push({ repoName: pkg.name, filePath: packageJsonPath, field, dependencyName: depName, spec, reason: "git-dev-ref" });
+        } else if (isPrereleaseVersion(spec)) {
+          issues.push({ repoName: pkg.name, filePath: packageJsonPath, field, dependencyName: depName, spec, reason: "prerelease-dev-ref" });
+        }
+      }
+    }
+  }
+  const lockRoots = [{ name: "@treeseed/market", dir: root }, ...workspacePackages(root).map((pkg) => ({ name: pkg.name, dir: pkg.dir }))];
+  for (const lockRoot of lockRoots) {
+    for (const lockName of ["package-lock.json", "npm-shrinkwrap.json"]) {
+      const lockPath = resolve(lockRoot.dir, lockName);
+      if (!existsSync(lockPath)) continue;
+      const lockfile = readJson(lockPath);
+      const packageEntries = lockfile.packages && typeof lockfile.packages === "object" ? Object.values(lockfile.packages) : [];
+      for (const packageName of packageNames) {
+        const entries = [
+          lockfile.dependencies?.[packageName],
+          ...packageEntries.map((entry) => entry && typeof entry === "object" ? entry.dependencies?.[packageName] : null)
+        ];
+        for (const entry of entries) {
+          if (!entry || typeof entry !== "object") continue;
+          const record = entry;
+          const spec = [
+            record.version,
+            record.resolved,
+            record.from
+          ].map((value) => typeof value === "string" ? value : "").find(
+            (value) => isGitDependencySpec(value) || devTagFromDependencySpec(value) || isPrereleaseVersion(value)
+          );
+          if (spec) {
+            issues.push({ repoName: lockRoot.name, filePath: lockPath, spec, reason: "lockfile-dev-ref", dependencyName: packageName });
+          }
+        }
+      }
+    }
+  }
+  return issues;
+}
+function assertNoInternalDevReferences(root = workspaceRoot(), packageNames) {
+  const issues = collectInternalDevReferenceIssues(root, packageNames);
+  if (issues.length === 0) return;
+  const rendered = issues.map((issue) => `${issue.filePath}${issue.field ? ` ${issue.field}.${issue.dependencyName}` : ""}: ${issue.reason} ${issue.spec}`).join("\n");
+  throw new Error(`Stable release still contains internal Git/dev dependency references.
+${rendered}`);
+}
+function createDevTagMessage(input) {
+  const branchSlug = input.branch.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "dev";
+  return [
+    `save: ${input.packageName} ${input.version}`,
+    "",
+    "treeseed-dev-tag: true",
+    `package: ${input.packageName}`,
+    `version: ${input.version}`,
+    `branch: ${input.branch}`,
+    `branchSlug: ${branchSlug}`,
+    `createdAt: ${input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()}`,
+    `workflowRunId: ${input.workflowRunId ?? ""}`,
+    `commitSha: ${input.commitSha}`
+  ].join("\n");
+}
+function gitTagMessage(repoDir, tagName) {
+  try {
+    return run("git", ["tag", "-l", tagName, "--format=%(contents)"], { cwd: repoDir, capture: true });
+  } catch {
+    return "";
+  }
+}
+function tagHasTreeseedDevMetadata(repoDir, tagName) {
+  return gitTagMessage(repoDir, tagName).includes("treeseed-dev-tag: true");
+}
+function cleanupDevTags(repoDir, tagNames, activeReferences = []) {
+  const active = new Set(activeReferences.filter(Boolean));
+  const cleaned = [];
+  const skipped = [];
+  for (const tagName of [...new Set(tagNames.filter(Boolean))].sort()) {
+    if (!tagName.includes("-dev.")) {
+      skipped.push({ tagName, reason: "not-dev-tag" });
+      continue;
+    }
+    if (active.has(tagName)) {
+      skipped.push({ tagName, reason: "still-referenced" });
+      continue;
+    }
+    if (!tagHasTreeseedDevMetadata(repoDir, tagName)) {
+      skipped.push({ tagName, reason: "missing-treeseed-metadata" });
+      continue;
+    }
+    try {
+      run("git", ["tag", "-d", tagName], { cwd: repoDir });
+      run("git", ["push", "origin", `:refs/tags/${tagName}`], { cwd: repoDir });
+      cleaned.push(tagName);
+    } catch (error) {
+      skipped.push({ tagName, reason: error instanceof Error ? error.message : String(error) });
+    }
+  }
+  return { cleaned, skipped };
+}
+export {
+  assertNoInternalDevReferences,
+  cleanupDevTags,
+  collectInternalDevReferenceIssues,
+  createDevTagMessage,
+  createPackageDependencyReference,
+  devTagFromDependencySpec,
+  gitTagMessage,
+  internalDependencyFields,
+  isGitDependencySpec,
+  isPrereleaseVersion,
+  isStableVersion,
+  normalizeGitRemoteForDependency,
+  normalizeGitRemoteForManifest,
+  rewriteInternalDependenciesToStableVersions,
+  rewriteProjectInternalDependenciesToStableVersions,
+  tagHasTreeseedDevMetadata,
+  updateInternalDependencySpecs
+};

package/dist/operations/services/project-platform.d.ts

@@ -247,6 +247,10 @@ export declare function deployProjectPlatform(options: ProjectPlatformActionOpti
         } | null;
     } | undefined)[];
 }>;
+export declare function resolveRailwayServiceDeployDependencies({ includeDataDependency, previousRailwayDeployNodeId, }: {
+    includeDataDependency: boolean;
+    previousRailwayDeployNodeId?: string | null;
+}): string[];
 export declare function publishProjectContent(options: ProjectPlatformActionOptions): Promise<{
     ok: boolean;
     scope: ProjectPlatformScope;

package/dist/operations/services/project-platform.js

@@ -37,7 +37,8 @@ import {
   validateRailwayServiceConfiguration,
   verifyRailwayScheduledJobs
 } from "./railway-deploy.js";
-import { loadCliDeployConfig, packageScriptPath, resolveWranglerBin } from "./runtime-tools.js";
+import { loadCliDeployConfig, packageScriptPath } from "./runtime-tools.js";
+import { resolveTreeseedToolCommand } from "../../managed-dependencies.js";
 import { CloudflareQueuePullClient, CloudflareQueuePushClient } from "../../remote.js";
 import { runPrefixedCommand, runTreeseedBootstrapDag, sleep, writeTreeseedBootstrapLine } from "./bootstrap-runner.js";
 import { runTenantDeployPreflight } from "./save-deploy-preflight.js";
@@ -130,7 +131,11 @@ function runTenantPublishContentPreflight(options) {
   return target;
 }
 function runWrangler(tenantRoot, args, extraEnv = {}, options = {}) {
-  const result = spawnSync(process.execPath, [resolveWranglerBin(), ...args], {
+  const wrangler = resolveTreeseedToolCommand("wrangler");
+  if (!wrangler) {
+    throw new Error("Wrangler CLI is unavailable.");
+  }
+  const result = spawnSync(wrangler.command, [...wrangler.argsPrefix, ...args], {
     cwd: tenantRoot,
     stdio: options.capture ? "pipe" : "inherit",
     encoding: options.capture ? "utf8" : void 0,
@@ -151,7 +156,11 @@ async function runPrefixedWranglerWithRetry(tenantRoot, args, {
 }) {
   let lastOutput = "";
   for (let attempt = 1; attempt <= 3; attempt += 1) {
-    const result = await runPrefixedCommand(process.execPath, [resolveWranglerBin(), ...args], {
+    const wrangler = resolveTreeseedToolCommand("wrangler");
+    if (!wrangler) {
+      throw new Error("Wrangler CLI is unavailable.");
+    }
+    const result = await runPrefixedCommand(wrangler.command, [...wrangler.argsPrefix, ...args], {
       cwd: tenantRoot,
       env,
       write,
@@ -1080,13 +1089,17 @@ async function deployProjectPlatform(options) {
     const selectedServices = validation.services.filter(
       (service) => service.key === "api" ? selectedSystems.has("api") : selectedSystems.has("agents")
     );
+    let previousRailwayDeployNodeId = null;
     for (const service of selectedServices) {
       const system = service.key === "api" ? "api" : "agents";
       const nodeId = `${system}:${service.key}-railway-deploy`;
       selectedRailwayServiceKeys.push(service.key);
       nodes.push({
         id: nodeId,
-        dependencies: selectedSystems.has("data") ? ["data:d1-migrate"] : [],
+        dependencies: resolveRailwayServiceDeployDependencies({
+          includeDataDependency: selectedSystems.has("data"),
+          previousRailwayDeployNodeId
+        }),
         run: async () => {
           const result = await deployRailwayService(options.tenantRoot, service, {
             dryRun: options.dryRun,
@@ -1103,6 +1116,7 @@ async function deployProjectPlatform(options) {
           return result;
         }
       });
+      previousRailwayDeployNodeId = nodeId;
     }
   }
   let railwaySchedules = [];
@@ -1178,6 +1192,15 @@ async function deployProjectPlatform(options) {
     serviceResults
   };
 }
+function resolveRailwayServiceDeployDependencies({
+  includeDataDependency,
+  previousRailwayDeployNodeId
+}) {
+  return [
+    ...includeDataDependency ? ["data:d1-migrate"] : [],
+    ...previousRailwayDeployNodeId ? [previousRailwayDeployNodeId] : []
+  ];
+}
 async function publishProjectContent(options) {
   const reporter = resolveReporter(options.tenantRoot, options.reporter);
   return publishContent(options, reporter);
@@ -1303,6 +1326,7 @@ export {
   prepareTenantCloudflareDeploy,
   provisionProjectPlatform,
   publishProjectContent,
+  resolveRailwayServiceDeployDependencies,
   resolveScope,
   runProjectPlatformAction,
   runTenantDataMigration,