@treeseed/sdk 0.8.3 → 0.8.5

package/dist/workflow/operations.js

@@ -209,7 +209,8 @@ function readPackageScript(root, packageDir, scriptName) {
 function ensureWorkflowWorkspacePackageArtifacts(root, helpers) {
   const packages = [
     { name: "@treeseed/sdk", dir: "packages/sdk", artifacts: ["dist/workflow-support.js", "dist/plugin-default.js", "dist/platform/env.yaml"] },
-    { name: "@treeseed/core", dir: "packages/core", artifacts: ["dist/api.js", "dist/plugin-default.js"] },
+    { name: "@treeseed/agent", dir: "packages/agent", artifacts: ["dist/api/index.js", "dist/services/worker.js"] },
+    { name: "@treeseed/core", dir: "packages/core", artifacts: ["dist/plugin-default.js"] },
     { name: "@treeseed/cli", dir: "packages/cli", artifacts: ["dist/cli/main.js"] }
   ];
   for (const entry of packages) {
@@ -301,6 +302,10 @@ function normalizeCiMode(mode, operation) {
   if (mode === "hosted" || mode === "off") return mode;
   return operation === "save" ? "off" : "hosted";
 }
+function normalizeSaveCiMode(mode, branch) {
+  if (mode === "hosted" || mode === "off") return mode;
+  return branch === STAGING_BRANCH ? "hosted" : "off";
+}
 function normalizeSaveVerifyMode(mode) {
   switch (mode) {
     case "skip":
@@ -319,8 +324,8 @@ function normalizeSaveVerifyMode(mode) {
       return "skip";
   }
 }
-function shouldUseHostedSaveCi(input) {
-  return normalizeCiMode(input.ciMode, "save") === "hosted" || input.verifyMode === "hosted" || input.verifyMode === "both" || input.verifyDeployedResources === true;
+function shouldUseHostedSaveCi(input, branch) {
+  return normalizeSaveCiMode(input.ciMode, branch) === "hosted" || input.verifyMode === "hosted" || input.verifyMode === "both" || input.verifyDeployedResources === true;
 }
 function worktreePayload(root, requestedMode) {
   const metadata = managedWorkflowWorktreeMetadata(root);
@@ -425,11 +430,11 @@ async function waitForWorkflowGates(operation, gates, ciMode, options = {}) {
   }
   return results;
 }
-const RELEASE_DEPLOY_GATE_TIMEOUT_SECONDS = 45 * 60;
-function releaseDeployGate(gate) {
+const HOSTED_DEPLOY_GATE_TIMEOUT_SECONDS = 45 * 60;
+function hostedDeployGate(gate) {
   return {
     ...gate,
-    timeoutSeconds: gate.timeoutSeconds ?? RELEASE_DEPLOY_GATE_TIMEOUT_SECONDS
+    timeoutSeconds: gate.timeoutSeconds ?? HOSTED_DEPLOY_GATE_TIMEOUT_SECONDS
   };
 }
 function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGates) {
@@ -441,7 +446,7 @@ function recordHostedDeploymentStatesFromRootGates(root, rootRelease, workflowGa
     { scope: "staging", branch: STAGING_BRANCH, commit: releaseRecord.stagingCommit },
     { scope: "prod", branch: releaseTag ?? PRODUCTION_BRANCH, commit: releaseRecord.releasedCommit }
   ]) {
-    const gate = gates.find((candidate) => candidate.workflow === "deploy.yml" && candidate.branch === target.branch && candidate.status === "completed" && candidate.conclusion === "success");
+    const gate = gates.find((candidate) => (candidate.workflow === "deploy-web.yml" || candidate.workflow === "deploy-processing.yml") && candidate.branch === target.branch && candidate.status === "completed" && candidate.conclusion === "success");
     const timestamp = typeof gate?.updatedAt === "string" && gate.updatedAt.trim() ? gate.updatedAt : null;
     if (!gate || !timestamp) {
       continue;
@@ -478,7 +483,7 @@ function ensureTreeseedCommandReadiness(root) {
     { id: "sdk", path: resolve(root, "node_modules/@treeseed/sdk/package.json") },
     { id: "sdk-workflow-support", path: resolve(root, "node_modules/@treeseed/sdk/dist/workflow-support.js") },
     { id: "core", path: resolve(root, "node_modules/@treeseed/core/package.json") },
-    { id: "core-api", path: resolve(root, "node_modules/@treeseed/core/dist/api.js") },
+    { id: "agent-api", path: resolve(root, "node_modules/@treeseed/agent/dist/api/index.js") },
     { id: "cli", path: resolve(root, "node_modules/@treeseed/cli/package.json") },
     { id: "cli-entrypoint", path: resolve(root, "node_modules/@treeseed/cli/dist/cli/main.js") },
     { id: "trsd-bin", path: resolve(root, "node_modules/.bin/trsd") }
@@ -838,7 +843,7 @@ function defaultCiWorkflows(kind, branch) {
     return ["verify.yml"];
   }
   if (branch === STAGING_BRANCH || branch === PRODUCTION_BRANCH) {
-    return ["deploy.yml"];
+    return ["deploy-web.yml", "deploy-processing.yml"];
   }
   return ["verify.yml"];
 }
@@ -1147,8 +1152,41 @@ function nextPendingJournalStep(journal) {
 }
 function findAutoResumableSaveRun(root, branch) {
   if (!branch) return null;
+  if (branch === STAGING_BRANCH && (hasMeaningfulChanges(repoRoot(root)) || checkedOutWorkspacePackageRepos(root).some((repo) => hasMeaningfulChanges(repo.dir)))) {
+    return null;
+  }
   return listInterruptedWorkflowRuns(root).find((journal) => journal.command === "save" && journal.resumable && journal.session.branchName === branch) ?? null;
 }
+function gatesForSavedPackageReports(reports) {
+  return reports.filter((repo) => repo.pushed && repo.commitSha && repo.branch).map((repo) => ({
+    name: repo.name,
+    repoPath: repo.path,
+    workflow: "verify.yml",
+    branch: String(repo.branch),
+    headSha: String(repo.commitSha)
+  }));
+}
+function gateForSavedRootReport(report, branch, scope) {
+  if (!branch || scope === "local" || !report.pushed || !report.commitSha) {
+    return [];
+  }
+  if (branch === STAGING_BRANCH) {
+    return [hostedDeployGate({
+      name: report.name,
+      repoPath: report.path,
+      workflow: "deploy.yml",
+      branch,
+      headSha: report.commitSha
+    })];
+  }
+  return [{
+    name: report.name,
+    repoPath: report.path,
+    workflow: "verify.yml",
+    branch,
+    headSha: report.commitSha
+  }];
+}
 function findAutoResumableTaskRun(root, command, branch) {
   if (!branch) return null;
   return listInterruptedWorkflowRuns(root).find((journal) => journal.command === command && journal.resumable && journal.session.branchName === branch) ?? null;
@@ -1476,7 +1514,7 @@ function validateStagingWorkflowContracts(root) {
     return;
   }
   const missing = [];
-  for (const fileName of ["verify.yml", "deploy.yml"]) {
+  for (const fileName of ["verify.yml", "deploy-web.yml", "deploy-processing.yml"]) {
     if (!existsSync(resolve(root, ".github", "workflows", fileName))) {
       missing.push(fileName);
     }
@@ -2863,7 +2901,7 @@ async function workflowSave(helpers, input) {
               failure: planAutoResumeRun.failure
             } : null,
             workspaceLinks,
-            ciMode: normalizeCiMode(effectiveInput.ciMode, "save"),
+            ciMode: normalizeSaveCiMode(effectiveInput.ciMode, branch),
             verifyMode: effectiveInput.verifyMode ?? "fast",
             ...worktreePayload(root, effectiveInput.worktreeMode),
             repositoryPlan,
@@ -2873,6 +2911,7 @@ async function workflowSave(helpers, input) {
               { id: "workspace-unlink", description: "Remove local workspace links before deployment install and lockfile updates" },
               ...repositoryPlan.plannedSteps,
               { id: "lockfile-validation", description: "Validate refreshed package-lock.json files before any save commit is pushed" },
+              ...shouldUseHostedSaveCi(effectiveInput, branch) ? [{ id: "hosted-ci", description: `Wait for hosted save workflows on ${branch}` }] : [],
               ...branch === STAGING_BRANCH ? [{ id: "release-candidate", description: "Run release-candidate readiness checks for the saved staging state" }] : [],
               { id: "workspace-link", description: "Restore local workspace links after save" },
               ...beforeState.branchRole === "feature" && (effectiveInput.preview === true || previewInitialized) ? [{ id: "preview", description: `Refresh preview deployment for ${branch}` }] : []
@@ -2909,7 +2948,7 @@ async function workflowSave(helpers, input) {
           gitDependencyProtocol: effectiveInput.gitDependencyProtocol ?? "preserve-origin",
           gitRemoteWriteMode: effectiveInput.gitRemoteWriteMode ?? "ssh-pushurl",
           verifyMode: effectiveInput.verifyMode ?? (effectiveInput.verify === false ? "skip" : "fast"),
-          ciMode: effectiveInput.ciMode ?? "auto",
+          ciMode: effectiveInput.ciMode ?? (branch === STAGING_BRANCH ? "hosted" : "auto"),
           worktreeMode: effectiveInput.worktreeMode ?? "auto",
           commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
           workspaceLinks: effectiveInput.workspaceLinks ?? "auto",
@@ -2924,7 +2963,7 @@ async function workflowSave(helpers, input) {
             branch,
             resumable: true
           },
-          ...shouldUseHostedSaveCi(effectiveInput) ? [{
+          ...shouldUseHostedSaveCi(effectiveInput, branch) ? [{
             id: "hosted-ci",
             description: `Wait for hosted save workflows on ${branch}`,
             repoName: rootRepo.name,
@@ -2979,7 +3018,29 @@ async function workflowSave(helpers, input) {
               verifyMode: normalizeSaveVerifyMode(effectiveInput.verify === false ? "skip" : effectiveInput.verifyMode),
               commitMessageMode: effectiveInput.commitMessageMode ?? "auto",
               workflowRunId: workflowRun.runId,
-              onProgress: (line, stream) => helpers.write(line, stream)
+              onProgress: (line, stream) => helpers.write(line, stream),
+              onWaveSaved: branch === STAGING_BRANCH && shouldUseHostedSaveCi(effectiveInput, branch) ? async ({ nodes, reports, rootRepo: waveRootRepo }) => {
+                const packageReportsForWave = reports.filter((repo, index) => nodes[index]?.kind === "package");
+                const rootReportForWave = nodes.some((node) => node.kind === "project") ? waveRootRepo : null;
+                const gates = [
+                  ...gatesForSavedPackageReports(packageReportsForWave),
+                  ...rootReportForWave ? gateForSavedRootReport(rootReportForWave, branch, scope) : []
+                ];
+                if (gates.length === 0) {
+                  return [];
+                }
+                const packageNames = packageReportsForWave.map((repo) => repo.name).join(", ");
+                if (packageNames) {
+                  helpers.write(`[save][workflow] Waiting for hosted package gates before saving dependents: ${packageNames}.`);
+                } else if (rootReportForWave) {
+                  helpers.write("[save][workflow] Waiting for hosted market deploy gate.");
+                }
+                return waitForWorkflowGates("save", gates, "hosted", {
+                  root,
+                  runId: workflowRun.runId,
+                  onProgress: (line, stream) => helpers.write(line, stream)
+                });
+              } : void 0
             });
           } finally {
             ensureWorkflowWorkspaceLinks(root, helpers, effectiveInput.workspaceLinks ?? "auto");
@@ -3004,23 +3065,26 @@ async function workflowSave(helpers, input) {
             lockfileValidation: repo.lockfileValidation
           }))
         };
-        const saveWorkflowGates = shouldUseHostedSaveCi(effectiveInput) ? await executeJournalStep(root, workflowRun.runId, "hosted-ci", () => {
+        const saveWorkflowGates = shouldUseHostedSaveCi(effectiveInput, branch) ? await executeJournalStep(root, workflowRun.runId, "hosted-ci", () => {
+          if (branch === STAGING_BRANCH) {
+            return { workflowGates: saveResult?.workflowGates ?? [] };
+          }
           helpers.write("[save][workflow] Waiting for hosted save workflow gates.");
           return waitForWorkflowGates("save", [
-            ...savedRootRepo.pushed && savedRootRepo.commitSha && branch ? [{
+            ...branch !== STAGING_BRANCH && savedRootRepo.pushed && savedRootRepo.commitSha && branch ? [{
               name: savedRootRepo.name,
               repoPath: savedRootRepo.path,
               workflow: "verify.yml",
               branch,
               headSha: savedRootRepo.commitSha
             }] : [],
-            ...effectiveInput.verifyDeployedResources === true && scope !== "local" && savedRootRepo.pushed && savedRootRepo.commitSha && branch ? [{
+            ...(branch === STAGING_BRANCH || effectiveInput.verifyDeployedResources === true) && scope !== "local" && savedRootRepo.pushed && savedRootRepo.commitSha && branch ? [hostedDeployGate({
               name: savedRootRepo.name,
               repoPath: savedRootRepo.path,
               workflow: "deploy.yml",
               branch,
               headSha: savedRootRepo.commitSha
-            }] : [],
+            })] : [],
             ...savedPackageReports.filter((repo) => repo.pushed && repo.commitSha && repo.branch).map((repo) => ({
               name: repo.name,
               repoPath: repo.path,
@@ -3092,7 +3156,7 @@ async function workflowSave(helpers, input) {
           workspaceLinks,
           commandReadiness,
           lockfileValidation,
-          ciMode: normalizeCiMode(effectiveInput.ciMode, "save"),
+          ciMode: normalizeSaveCiMode(effectiveInput.ciMode, branch),
           verifyMode: effectiveInput.verifyMode ?? "fast",
           workflowGates: saveWorkflowGates?.workflowGates ?? [],
           releaseCandidate,
@@ -3558,13 +3622,13 @@ async function workflowStage(helpers, input) {
           });
         }
         const stageWorkflowGateResult = !waitForStaging ? (skipJournalStep(root, workflowRun.runId, "wait-staging", { status: "skipped", reason: "disabled" }), { status: "skipped", reason: "disabled" }) : await executeJournalStep(root, workflowRun.runId, "wait-staging", () => waitForWorkflowGates("stage", [
-          {
+          hostedDeployGate({
             name: rootRepo.name,
             repoPath: rootRepo.path,
             workflow: "deploy.yml",
             branch: STAGING_BRANCH,
             headSha: rootRepo.commitSha
-          },
+          }),
           ...packageReports.filter((report) => report.merged && report.commitSha).map((report) => ({
             name: report.name,
             repoPath: report.path,
@@ -3791,6 +3855,7 @@ async function workflowRelease(helpers, input) {
         },
         [
           { id: "release-plan", description: "Record release plan", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
+          { id: "release-staging-gates", description: "Verify current staging GitHub Actions gates", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "release-candidate", description: "Run release-candidate readiness checks", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           { id: "workspace-unlink", description: "Remove local workspace links before release", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true },
           ...mode === "recursive-workspace" ? [{ id: "prepare-release-metadata", description: "Rewrite stable release metadata", repoName: rootRepo.name, repoPath: rootRepo.path, branch: STAGING_BRANCH, resumable: true }] : [],
@@ -3831,6 +3896,30 @@ async function workflowRelease(helpers, input) {
         const rootVersion = String(releasePlan.rootVersion);
         applyTreeseedEnvironmentToProcess({ tenantRoot: root, scope: "staging", override: true });
         assertReleaseGitHubAutomationReady(root, effectiveSelectedPackageNames, ciMode);
+        const stagingGateResult = resumeAtRootGates ? completedJournalStepData(root, workflowRun.runId, "release-staging-gates") : await executeJournalStep(root, workflowRun.runId, "release-staging-gates", () => {
+          helpers.write("[release][workflow] Verifying current staging gates before production release.");
+          const packageGates = checkedOutWorkspacePackageRepos(root).filter((pkg) => effectiveSelectedPackageNames.has(pkg.name)).map((pkg) => ({
+            name: pkg.name,
+            repoPath: pkg.dir,
+            workflow: "verify.yml",
+            branch: STAGING_BRANCH,
+            headSha: headCommit(pkg.dir)
+          }));
+          return waitForWorkflowGates("release", [
+            hostedDeployGate({
+              name: rootRepo.name,
+              repoPath: rootRepo.path,
+              workflow: "deploy.yml",
+              branch: STAGING_BRANCH,
+              headSha: headCommit(gitRoot)
+            }),
+            ...packageGates
+          ], ciMode, {
+            root,
+            runId: workflowRun.runId,
+            onProgress: (line, stream) => helpers.write(line, stream)
+          }).then((workflowGates) => ({ workflowGates }));
+        });
         const releaseCandidate = resumeAtRootGates ? completedJournalStepData(root, workflowRun.runId, "release-candidate") : await executeJournalStep(root, workflowRun.runId, "release-candidate", () => runReleaseCandidateForPlan("release", root, releasePlan, { allowReuse: true }));
         if (!resumeAtRootGates && !isResume) {
           assertSessionBranchSafety("release", session, { requireCleanPackages: true, requireCurrentBranch: true });
@@ -3901,7 +3990,7 @@ async function workflowRelease(helpers, input) {
           rootRepo.commitSha = String(rootRelease2?.releasedCommit ?? headCommit(gitRoot));
           rootRepo.tagName = String(rootRelease2?.rootVersion ?? "");
           const rootWorkflowGateResult2 = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
-            releaseDeployGate({
+            hostedDeployGate({
               name: rootRepo.name,
               repoPath: rootRepo.path,
               workflow: "deploy.yml",
@@ -3944,13 +4033,17 @@ async function workflowRelease(helpers, input) {
             repos: [],
             rootRepo,
             releaseCandidate,
+            stagingWorkflowGates: stagingGateResult?.workflowGates ?? [],
             releaseBackMerge: releaseBackMerge2,
             hostedDeploymentState: hostedDeploymentState2,
             finalBranch: currentBranch(gitRoot) || STAGING_BRANCH,
             pushStatus: { stagingPushed: true, productionPushed: true, tagPushed: true },
             workspaceLinks: workspaceLinks2,
             ciMode,
-            workflowGates: rootWorkflowGateResult2?.workflowGates ?? [],
+            workflowGates: [
+              ...Array.isArray(stagingGateResult?.workflowGates) ? stagingGateResult.workflowGates : [],
+              ...Array.isArray(rootWorkflowGateResult2?.workflowGates) ? rootWorkflowGateResult2.workflowGates : []
+            ],
             hostingAudit: hostingAudit2,
             ...worktreePayload(root, effectiveInput.worktreeMode)
           };
@@ -4208,7 +4301,7 @@ async function workflowRelease(helpers, input) {
         rootRepo.commitSha = String(rootRelease?.releasedCommit ?? headCommit(gitRoot));
         rootRepo.tagName = String(rootRelease?.rootVersion ?? "");
         const rootWorkflowGateResult = await executeJournalStep(root, workflowRun.runId, "release-root-gates", () => waitForWorkflowGates("release", [
-          releaseDeployGate({
+          hostedDeployGate({
             name: rootRepo.name,
             repoPath: rootRepo.path,
             workflow: "deploy.yml",
@@ -4264,6 +4357,7 @@ async function workflowRelease(helpers, input) {
           repos: packageReports,
           rootRepo,
           releaseCandidate,
+          stagingWorkflowGates: stagingGateResult?.workflowGates ?? [],
           releaseBackMerge,
           hostedDeploymentState,
           finalBranch: currentBranch(gitRoot) || STAGING_BRANCH,
@@ -4275,6 +4369,7 @@ async function workflowRelease(helpers, input) {
           workspaceLinks,
           ciMode,
           workflowGates: [
+            ...Array.isArray(stagingGateResult?.workflowGates) ? stagingGateResult.workflowGates : [],
             ...packageReports.flatMap((report) => report.workflowGates),
             ...Array.isArray(rootWorkflowGateResult?.workflowGates) ? rootWorkflowGateResult.workflowGates : []
           ],

package/dist/workflow/runs.js

@@ -257,6 +257,28 @@ function expectedPackageHeadAfterReleaseGate(journal, packageName) {
   if (typeof data?.commitSha === "string") return data.commitSha;
   return null;
 }
+function savePartialFailureData(journal) {
+  const details = stringRecord(journal.failure?.details);
+  return stringRecord(details?.partialFailure);
+}
+function collectSaveExpectedHeads(journal) {
+  const heads = {};
+  const saveData = stringRecord(journal.steps.find((step) => step.id === "save-repositories")?.data);
+  const partialFailure = savePartialFailureData(journal);
+  const source = saveData ?? partialFailure;
+  const rootRepo = stringRecord(source?.rootRepo);
+  if (typeof rootRepo?.commitSha === "string") {
+    heads["@treeseed/market"] = rootRepo.commitSha;
+  }
+  const repos = Array.isArray(source?.repos) ? source.repos : [];
+  for (const entry of repos) {
+    const repo = stringRecord(entry);
+    if (typeof repo?.name === "string" && typeof repo.commitSha === "string") {
+      heads[repo.name] = repo.commitSha;
+    }
+  }
+  return heads;
+}
 function classifyWorkflowRunJournal(journal, options = {}) {
   const reasons = [];
   const now = options.now ?? nowIso();
@@ -326,6 +348,15 @@ function classifyWorkflowRunJournal(journal, options = {}) {
       }
     }
   }
+  if (journal.command === "save" && options.currentHeads) {
+    const expectedHeads = collectSaveExpectedHeads(journal);
+    for (const [name, expectedHead] of Object.entries(expectedHeads)) {
+      const currentHead = options.currentHeads[name];
+      if (currentHead && expectedHead && currentHead !== expectedHead) {
+        reasons.push(`${name} head changed from ${expectedHead} to ${currentHead}`);
+      }
+    }
+  }
   return {
     state: reasons.length > 0 ? "stale" : "resumable",
     reasons: reasons.length > 0 ? reasons : releaseGateOnlyCompletion ? ["release commits already exist; remaining release gates can be rechecked"] : ["workflow run can be resumed"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {

package/templates/github/deploy-processing.workflow.yml

@@ -0,0 +1,120 @@
+name: Treeseed Processing Deploy
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        type: string
+      action_kind:
+        required: true
+        type: string
+      project_id:
+        required: false
+        type: string
+      preview_id:
+        required: false
+        type: string
+  workflow_dispatch:
+    inputs:
+      environment:
+        required: true
+        default: staging
+        type: choice
+        options:
+          - staging
+          - prod
+      action_kind:
+        required: true
+        default: deploy_processing
+        type: choice
+        options:
+          - deploy_processing
+          - monitor
+      project_id:
+        required: false
+        type: string
+      preview_id:
+        required: false
+        type: string
+
+jobs:
+__WORKING_DIRECTORY_BLOCK__  processing:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    environment: ${{ inputs.environment == 'prod' && 'production' || 'staging' }}
+    env:
+      TREESEED_BOOTSTRAP_MODE: auto
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
+      RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
+      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
+      TREESEED_API_AUTH_SECRET: ${{ secrets.TREESEED_API_AUTH_SECRET }}
+      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
+      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
+      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
+      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
+      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
+      TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
+      TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
+      TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
+      TREESEED_AGENT_POOL_MIN_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MIN_WORKERS }}
+      TREESEED_AGENT_POOL_MAX_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MAX_WORKERS }}
+      TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH: ${{ vars.TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH }}
+      TREESEED_AGENT_POOL_COOLDOWN_SECONDS: ${{ vars.TREESEED_AGENT_POOL_COOLDOWN_SECONDS }}
+      TREESEED_WORKDAY_TIMEZONE: ${{ vars.TREESEED_WORKDAY_TIMEZONE }}
+      TREESEED_WORKDAY_WINDOWS_JSON: ${{ vars.TREESEED_WORKDAY_WINDOWS_JSON }}
+      TREESEED_WORKDAY_TASK_CREDIT_BUDGET: ${{ vars.TREESEED_WORKDAY_TASK_CREDIT_BUDGET }}
+      TREESEED_MANAGER_MAX_QUEUED_TASKS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_TASKS }}
+      TREESEED_MANAGER_MAX_QUEUED_CREDITS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_CREDITS }}
+      TREESEED_MANAGER_PRIORITY_MODELS: ${{ vars.TREESEED_MANAGER_PRIORITY_MODELS }}
+      TREESEED_TASK_CREDIT_WEIGHTS_JSON: ${{ vars.TREESEED_TASK_CREDIT_WEIGHTS_JSON }}
+      TREESEED_RAILWAY_PROJECT_ID: ${{ vars.TREESEED_RAILWAY_PROJECT_ID }}
+      TREESEED_RAILWAY_ENVIRONMENT_ID: ${{ vars.TREESEED_RAILWAY_ENVIRONMENT_ID }}
+      TREESEED_RAILWAY_WORKER_SERVICE_ID: ${{ vars.TREESEED_RAILWAY_WORKER_SERVICE_ID }}
+      TREESEED_CAPACITY_PROVIDER_ID: ${{ vars.TREESEED_CAPACITY_PROVIDER_ID }}
+      TREESEED_CAPACITY_PROVIDER_TEAM_ID: ${{ vars.TREESEED_CAPACITY_PROVIDER_TEAM_ID }}
+      TREESEED_CAPACITY_PROVIDER_SERVICE_BASE_URL: ${{ vars.TREESEED_CAPACITY_PROVIDER_SERVICE_BASE_URL }}
+      TREESEED_PROCESSING_DRAIN: ${{ vars.TREESEED_PROCESSING_DRAIN }}
+      TREESEED_WORKFLOW_ACTION: ${{ inputs.action_kind }}
+      TREESEED_WORKFLOW_ENVIRONMENT: ${{ inputs.environment }}
+      TREESEED_WORKFLOW_PLANE: processing
+      TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
+      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: __CACHE_DEPENDENCY_PATH__
+
+      - name: Install dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          node -e "const fs = require('fs'); for (const file of ['packages/sdk/package.json', 'packages/agent/package.json', 'packages/core/package.json', 'packages/cli/package.json']) { if (!fs.existsSync(file)) continue; const p = JSON.parse(fs.readFileSync(file, 'utf8')); if (p.scripts) delete p.scripts.prepare; fs.writeFileSync(file, JSON.stringify(p, null, '\t') + '\n'); }"
+          npm ci --ignore-scripts
+
+      - name: Build package artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          for dir in packages/sdk packages/agent packages/core packages/cli; do
+            if test -f "${dir}/package.json"; then npm --prefix "${dir}" run build:dist; fi
+          done
+
+      - name: Run processing workflow action
+        shell: bash
+        run: |
+          set -euo pipefail
+          EXTRA_ARGS=()
+          if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi
+          if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi
+          node ./packages/sdk/scripts/run-ts.mjs ./packages/sdk/scripts/tenant-workflow-action.ts --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"

package/templates/github/deploy-web.workflow.yml

@@ -0,0 +1,116 @@
+name: Treeseed Web Deploy
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        type: string
+      action_kind:
+        required: true
+        type: string
+      project_id:
+        required: false
+        type: string
+      preview_id:
+        required: false
+        type: string
+  workflow_dispatch:
+    inputs:
+      environment:
+        required: true
+        default: staging
+        type: choice
+        options:
+          - staging
+          - prod
+      action_kind:
+        required: true
+        default: deploy_web
+        type: choice
+        options:
+          - deploy_web
+          - publish_content
+          - monitor
+      project_id:
+        required: false
+        type: string
+      preview_id:
+        required: false
+        type: string
+
+jobs:
+__WORKING_DIRECTORY_BLOCK__  web:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    environment: ${{ inputs.environment == 'prod' && 'production' || 'staging' }}
+    env:
+      TREESEED_BOOTSTRAP_MODE: auto
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+      TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
+      TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME }}
+      TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
+      TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
+      TREESEED_FORM_TOKEN_SECRET: ${{ secrets.TREESEED_FORM_TOKEN_SECRET }}
+      TREESEED_EDITORIAL_PREVIEW_SECRET: ${{ secrets.TREESEED_EDITORIAL_PREVIEW_SECRET }}
+      TREESEED_PUBLIC_TURNSTILE_SITE_KEY: ${{ vars.TREESEED_PUBLIC_TURNSTILE_SITE_KEY }}
+      TREESEED_TURNSTILE_SECRET_KEY: ${{ secrets.TREESEED_TURNSTILE_SECRET_KEY }}
+      TREESEED_SMTP_HOST: ${{ vars.TREESEED_SMTP_HOST }}
+      TREESEED_SMTP_PORT: ${{ vars.TREESEED_SMTP_PORT }}
+      TREESEED_SMTP_USERNAME: ${{ vars.TREESEED_SMTP_USERNAME }}
+      TREESEED_SMTP_PASSWORD: ${{ secrets.TREESEED_SMTP_PASSWORD }}
+      TREESEED_SMTP_FROM: ${{ vars.TREESEED_SMTP_FROM }}
+      TREESEED_SMTP_REPLY_TO: ${{ vars.TREESEED_SMTP_REPLY_TO }}
+      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
+      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
+      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
+      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
+      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
+      TREESEED_CENTRAL_MARKET_API_BASE_URL: ${{ vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
+      TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
+      TREESEED_CATALOG_MARKET_API_BASE_URLS: ${{ vars.TREESEED_CATALOG_MARKET_API_BASE_URLS || vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
+      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
+      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
+      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
+      TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
+      TREESEED_WORKFLOW_ACTION: ${{ inputs.action_kind }}
+      TREESEED_WORKFLOW_ENVIRONMENT: ${{ inputs.environment }}
+      TREESEED_WORKFLOW_PLANE: web
+      TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
+      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: __CACHE_DEPENDENCY_PATH__
+
+      - name: Install dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          node -e "const fs = require('fs'); for (const file of ['packages/sdk/package.json', 'packages/agent/package.json', 'packages/core/package.json', 'packages/cli/package.json']) { if (!fs.existsSync(file)) continue; const p = JSON.parse(fs.readFileSync(file, 'utf8')); if (p.scripts) delete p.scripts.prepare; fs.writeFileSync(file, JSON.stringify(p, null, '\t') + '\n'); }"
+          npm ci --ignore-scripts
+
+      - name: Build package artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          for dir in packages/sdk packages/agent packages/core packages/cli; do
+            if test -f "${dir}/package.json"; then npm --prefix "${dir}" run build:dist; fi
+          done
+
+      - name: Run web workflow action
+        shell: bash
+        run: |
+          set -euo pipefail
+          EXTRA_ARGS=()
+          if [[ -n "${TREESEED_WORKFLOW_PROJECT:-}" ]]; then EXTRA_ARGS+=(--project-id "${TREESEED_WORKFLOW_PROJECT}"); fi
+          if [[ -n "${TREESEED_WORKFLOW_PREVIEW_ID:-}" ]]; then EXTRA_ARGS+=(--preview-id "${TREESEED_WORKFLOW_PREVIEW_ID}"); fi
+          node ./packages/sdk/scripts/run-ts.mjs ./packages/sdk/scripts/tenant-workflow-action.ts --action "${TREESEED_WORKFLOW_ACTION}" --environment "${TREESEED_WORKFLOW_ENVIRONMENT}" "${EXTRA_ARGS[@]}"

package/templates/github/hosted-project.workflow.yml

@@ -14,7 +14,7 @@ on:
       workflow_file:
         description: Workflow file to dispatch in the tenant repository
         required: false
-        default: deploy.yml
+        default: deploy-web.yml
         type: string
       project_id:
         description: Treeseed project id recorded in the market control plane
@@ -31,11 +31,11 @@ on:
       action_kind:
         description: Requested orchestration action
         required: true
-        default: deploy_code
+        default: deploy_web
         type: choice
         options:
-          - provision
-          - deploy_code
+          - deploy_web
+          - deploy_processing
           - publish_content
           - monitor