@treeseed/sdk 0.8.3 → 0.8.5

package/templates/github/deploy.workflow.yml

@@ -1,746 +0,0 @@
-name: Treeseed Deploy
-
-on:
-  push:
-    branches:
-      - staging
-    tags:
-      - '*.*.*'
-  workflow_dispatch:
-    inputs:
-      environment:
-        description: Target environment
-        required: true
-        default: staging
-        type: choice
-        options:
-          - staging
-          - prod
-      action_kind:
-        description: Workflow action to perform
-        required: true
-        default: deploy_code
-        type: choice
-        options:
-          - provision
-          - deploy_code
-          - publish_content
-          - monitor
-      project_id:
-        description: Treeseed project id for control-plane reporting
-        required: false
-        type: string
-      preview_id:
-        description: Optional preview overlay id for editorial publishes
-        required: false
-        type: string
-
-jobs:
-  classify:
-    runs-on: ubuntu-latest
-    outputs:
-      scope: ${{ steps.classify.outputs.scope }}
-      code_changed: ${{ steps.classify.outputs.code_changed }}
-      content_changed: ${{ steps.classify.outputs.content_changed }}
-      release_tag: ${{ steps.classify.outputs.release_tag }}
-      workflow_action: ${{ steps.classify.outputs.workflow_action }}
-      preview_id: ${{ steps.classify.outputs.preview_id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Classify changes
-        id: classify
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
-            scope="${{ inputs.environment }}"
-            workflow_action="${{ inputs.action_kind }}"
-            release_tag="false"
-            code_changed=$([[ "${workflow_action}" == "deploy_code" ]] && echo "true" || echo "false")
-            content_changed=$([[ "${workflow_action}" == "publish_content" ]] && echo "true" || echo "false")
-            preview_id="${{ inputs.preview_id }}"
-          else
-            ref_name="${GITHUB_REF_NAME}"
-            ref_type="${GITHUB_REF_TYPE}"
-            before_sha="${{ github.event.before }}"
-            head_sha="${GITHUB_SHA}"
-            workflow_action="auto"
-            preview_id="staging-${GITHUB_SHA}"
-
-            if [[ "${ref_type}" == "tag" ]]; then
-              scope="prod"
-              if [[ "${ref_name}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-                release_tag="true"
-                compare_ref="$(git rev-list --parents -n 1 "${head_sha}" | awk '{print $2}')"
-              else
-                release_tag="false"
-                compare_ref=""
-              fi
-            else
-              scope="staging"
-              release_tag="false"
-              compare_ref="${before_sha}"
-            fi
-
-            if [[ -z "${compare_ref}" || "${compare_ref}" == "0000000000000000000000000000000000000000" ]]; then
-              compare_ref="$(git rev-list --max-count=1 "${head_sha}^" 2>/dev/null || true)"
-            fi
-
-            code_changed="false"
-            content_changed="false"
-
-            if [[ "${ref_type}" == "tag" && "${release_tag}" != "true" ]]; then
-              code_changed="false"
-              content_changed="false"
-            elif [[ -n "${compare_ref}" ]]; then
-              while IFS= read -r path; do
-                [[ -z "${path}" ]] && continue
-                case "${path}" in
-                  src/content/*|content/*|books/*|docs/*)
-                    content_changed="true"
-                    ;;
-                  migrations/*)
-                    code_changed="true"
-                    ;;
-                  *)
-                    code_changed="true"
-                    ;;
-                esac
-              done < <(git diff --name-only "${compare_ref}" "${head_sha}")
-            else
-              code_changed="true"
-            fi
-          fi
-
-          {
-            echo "scope=${scope}"
-            echo "code_changed=${code_changed}"
-            echo "content_changed=${content_changed}"
-            echo "release_tag=${release_tag}"
-            echo "workflow_action=${workflow_action}"
-            echo "preview_id=${preview_id}"
-          } >> "${GITHUB_OUTPUT}"
-
-  verify:
-    runs-on: ubuntu-latest
-    needs: classify
-    if: |
-      needs.classify.outputs.workflow_action == 'deploy_code' ||
-      needs.classify.outputs.workflow_action == 'publish_content' ||
-      needs.classify.outputs.code_changed == 'true' ||
-      needs.classify.outputs.content_changed == 'true' ||
-      needs.classify.outputs.release_tag == 'true'
-    permissions:
-      contents: read
-    env:
-      TREESEED_BOOTSTRAP_MODE: auto
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: __CACHE_DEPENDENCY_PATH__
-
-      - name: Install dependencies
-        run: |
-          node -e "const fs = require('fs'); for (const file of ['packages/sdk/package.json', 'packages/core/package.json', 'packages/cli/package.json']) { if (!fs.existsSync(file)) continue; const p = JSON.parse(fs.readFileSync(file, 'utf8')); if (p.scripts) delete p.scripts.prepare; fs.writeFileSync(file, JSON.stringify(p, null, '\t') + '\n'); }"
-          for attempt in 1 2 3; do
-            if npm ci --ignore-scripts; then
-              break
-            fi
-            if test "${attempt}" = "3"; then
-              exit 1
-            fi
-            echo "npm ci failed; retrying (${attempt}/3)."
-            sleep $((attempt * 10))
-          done
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -d "${dir}/.git" || git -C "${dir}" rev-parse --git-dir >/dev/null 2>&1; then
-              git -C "${dir}" checkout -- package.json
-            fi
-          done
-
-      - name: Build workspace package artifacts
-        shell: bash
-        run: |
-          set -euo pipefail
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -f "${dir}/package.json"; then
-              npm --prefix "${dir}" run build:dist
-            fi
-          done
-
-      - name: Verify workspace
-        shell: bash
-        run: |
-          set -euo pipefail
-          npm run verify:local 2>&1 | tee verify.log
-          if test -f ./packages/sdk/scripts/check-build-warnings.mjs; then
-            node ./packages/sdk/scripts/check-build-warnings.mjs verify.log
-          elif test -f ./node_modules/@treeseed/sdk/dist/scripts/check-build-warnings.js; then
-            node ./node_modules/@treeseed/sdk/dist/scripts/check-build-warnings.js verify.log
-          else
-            echo "Unable to resolve @treeseed/sdk warning scanner entrypoint."
-            exit 1
-          fi
-__WORKING_DIRECTORY_BLOCK__
-
-  provision:
-    runs-on: ubuntu-latest
-    needs:
-      - classify
-      - verify
-    if: |
-      needs.classify.outputs.workflow_action == 'provision' ||
-      needs.classify.outputs.workflow_action == 'deploy_code' ||
-      needs.classify.outputs.workflow_action == 'publish_content' ||
-      needs.classify.outputs.workflow_action == 'monitor' ||
-      needs.classify.outputs.code_changed == 'true' ||
-      needs.classify.outputs.content_changed == 'true' ||
-      needs.classify.outputs.release_tag == 'true'
-    permissions:
-      contents: read
-    environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
-    env:
-      TREESEED_BOOTSTRAP_MODE: auto
-      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
-      TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
-      TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME }}
-      TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
-      TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
-      TREESEED_FORM_TOKEN_SECRET: ${{ secrets.TREESEED_FORM_TOKEN_SECRET }}
-      TREESEED_EDITORIAL_PREVIEW_SECRET: ${{ secrets.TREESEED_EDITORIAL_PREVIEW_SECRET }}
-      TREESEED_PUBLIC_TURNSTILE_SITE_KEY: ${{ vars.TREESEED_PUBLIC_TURNSTILE_SITE_KEY }}
-      TREESEED_TURNSTILE_SECRET_KEY: ${{ secrets.TREESEED_TURNSTILE_SECRET_KEY }}
-      TREESEED_SMTP_HOST: ${{ vars.TREESEED_SMTP_HOST }}
-      TREESEED_SMTP_PORT: ${{ vars.TREESEED_SMTP_PORT }}
-      TREESEED_SMTP_USERNAME: ${{ vars.TREESEED_SMTP_USERNAME }}
-      TREESEED_SMTP_PASSWORD: ${{ secrets.TREESEED_SMTP_PASSWORD }}
-      TREESEED_SMTP_FROM: ${{ vars.TREESEED_SMTP_FROM }}
-      TREESEED_SMTP_REPLY_TO: ${{ vars.TREESEED_SMTP_REPLY_TO }}
-      RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
-      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
-      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
-      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
-      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
-      TREESEED_CENTRAL_MARKET_API_BASE_URL: ${{ vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_CATALOG_MARKET_API_BASE_URLS: ${{ vars.TREESEED_CATALOG_MARKET_API_BASE_URLS || vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
-      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
-      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
-      TREESEED_API_AUTH_SECRET: ${{ secrets.TREESEED_API_AUTH_SECRET }}
-      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
-      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
-      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
-      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
-      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
-      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
-      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
-      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
-      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
-      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
-      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
-      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
-      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
-      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
-      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
-      TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
-      TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
-      TREESEED_AGENT_POOL_MIN_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MIN_WORKERS }}
-      TREESEED_AGENT_POOL_MAX_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MAX_WORKERS }}
-      TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH: ${{ vars.TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH }}
-      TREESEED_AGENT_POOL_COOLDOWN_SECONDS: ${{ vars.TREESEED_AGENT_POOL_COOLDOWN_SECONDS }}
-      TREESEED_WORKDAY_TIMEZONE: ${{ vars.TREESEED_WORKDAY_TIMEZONE }}
-      TREESEED_WORKDAY_WINDOWS_JSON: ${{ vars.TREESEED_WORKDAY_WINDOWS_JSON }}
-      TREESEED_WORKDAY_TASK_CREDIT_BUDGET: ${{ vars.TREESEED_WORKDAY_TASK_CREDIT_BUDGET }}
-      TREESEED_MANAGER_MAX_QUEUED_TASKS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_TASKS }}
-      TREESEED_MANAGER_MAX_QUEUED_CREDITS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_CREDITS }}
-      TREESEED_MANAGER_PRIORITY_MODELS: ${{ vars.TREESEED_MANAGER_PRIORITY_MODELS }}
-      TREESEED_TASK_CREDIT_WEIGHTS_JSON: ${{ vars.TREESEED_TASK_CREDIT_WEIGHTS_JSON }}
-      TREESEED_RAILWAY_PROJECT_ID: ${{ vars.TREESEED_RAILWAY_PROJECT_ID }}
-      TREESEED_RAILWAY_ENVIRONMENT_ID: ${{ vars.TREESEED_RAILWAY_ENVIRONMENT_ID }}
-      TREESEED_RAILWAY_WORKER_SERVICE_ID: ${{ vars.TREESEED_RAILWAY_WORKER_SERVICE_ID }}
-      TREESEED_WORKFLOW_ACTION: provision
-      TREESEED_WORKFLOW_ENVIRONMENT: ${{ needs.classify.outputs.scope }}
-      TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id || needs.classify.outputs.preview_id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: __CACHE_DEPENDENCY_PATH__
-
-      - name: Install dependencies
-        run: |
-          node -e "const fs = require('fs'); for (const file of ['packages/sdk/package.json', 'packages/core/package.json', 'packages/cli/package.json']) { if (!fs.existsSync(file)) continue; const p = JSON.parse(fs.readFileSync(file, 'utf8')); if (p.scripts) delete p.scripts.prepare; fs.writeFileSync(file, JSON.stringify(p, null, '\t') + '\n'); }"
-          for attempt in 1 2 3; do
-            if npm ci --ignore-scripts; then
-              break
-            fi
-            if test "${attempt}" = "3"; then
-              exit 1
-            fi
-            echo "npm ci failed; retrying (${attempt}/3)."
-            sleep $((attempt * 10))
-          done
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -d "${dir}/.git" || git -C "${dir}" rev-parse --git-dir >/dev/null 2>&1; then
-              git -C "${dir}" checkout -- package.json
-            fi
-          done
-
-      - name: Build workspace package artifacts
-        shell: bash
-        run: |
-          set -euo pipefail
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -f "${dir}/package.json"; then
-              npm --prefix "${dir}" run build:dist
-            fi
-          done
-
-      - name: Install Railway CLI
-        run: npm install -g @railway/cli
-
-      - name: Provision Treeseed platform
-        shell: bash
-        run: |
-__TENANT_WORKFLOW_ACTION_COMMAND_BLOCK__
-
-      - name: Ensure Treeseed deployment state
-        shell: bash
-        run: |
-          node --input-type=module -e "import { existsSync, readFileSync, writeFileSync } from 'node:fs'; const scope = process.env.TREESEED_WORKFLOW_ENVIRONMENT || 'staging'; const filePath = '.treeseed/state/environments/' + scope + '/deploy.json'; if (!existsSync(filePath)) { throw new Error('Provision did not write deployment state at ' + filePath); } const state = JSON.parse(readFileSync(filePath, 'utf8')); const dbId = state?.d1Databases?.SITE_DATA_DB?.databaseId; if (!dbId || String(dbId).startsWith('dryrun-')) { throw new Error('Provision deployment state is missing a live D1 database id.'); } const now = new Date().toISOString(); state.target = state.target || { kind: 'persistent', scope }; state.readiness = { ...(state.readiness || {}), initialized: true, configured: true, phase: state.readiness?.phase || 'config_complete', initializedAt: state.readiness?.initializedAt || now, lastValidatedAt: now, blockers: state.readiness?.blockers || [], warnings: state.readiness?.warnings || [] }; writeFileSync(filePath, JSON.stringify(state, null, 2) + '\n');"
-
-      - name: Upload Treeseed deployment state
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
-          path: .treeseed/state
-          if-no-files-found: error
-          retention-days: 1
-          include-hidden-files: true
-__WORKING_DIRECTORY_BLOCK__
-
-  deploy-code:
-    runs-on: ubuntu-latest
-    needs:
-      - classify
-      - verify
-      - provision
-    permissions:
-      contents: read
-    if: |
-      needs.classify.outputs.workflow_action == 'deploy_code' ||
-      needs.classify.outputs.code_changed == 'true' ||
-      needs.classify.outputs.release_tag == 'true'
-    environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
-    env:
-      TREESEED_BOOTSTRAP_MODE: auto
-      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
-      TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
-      TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME }}
-      TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
-      TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
-      TREESEED_FORM_TOKEN_SECRET: ${{ secrets.TREESEED_FORM_TOKEN_SECRET }}
-      TREESEED_EDITORIAL_PREVIEW_SECRET: ${{ secrets.TREESEED_EDITORIAL_PREVIEW_SECRET }}
-      TREESEED_PUBLIC_TURNSTILE_SITE_KEY: ${{ vars.TREESEED_PUBLIC_TURNSTILE_SITE_KEY }}
-      TREESEED_TURNSTILE_SECRET_KEY: ${{ secrets.TREESEED_TURNSTILE_SECRET_KEY }}
-      TREESEED_SMTP_HOST: ${{ vars.TREESEED_SMTP_HOST }}
-      TREESEED_SMTP_PORT: ${{ vars.TREESEED_SMTP_PORT }}
-      TREESEED_SMTP_USERNAME: ${{ vars.TREESEED_SMTP_USERNAME }}
-      TREESEED_SMTP_PASSWORD: ${{ secrets.TREESEED_SMTP_PASSWORD }}
-      TREESEED_SMTP_FROM: ${{ vars.TREESEED_SMTP_FROM }}
-      TREESEED_SMTP_REPLY_TO: ${{ vars.TREESEED_SMTP_REPLY_TO }}
-      RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
-      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
-      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
-      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
-      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
-      TREESEED_CENTRAL_MARKET_API_BASE_URL: ${{ vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_CATALOG_MARKET_API_BASE_URLS: ${{ vars.TREESEED_CATALOG_MARKET_API_BASE_URLS || vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
-      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
-      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
-      TREESEED_API_AUTH_SECRET: ${{ secrets.TREESEED_API_AUTH_SECRET }}
-      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
-      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
-      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
-      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
-      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
-      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
-      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
-      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
-      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
-      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
-      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
-      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
-      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
-      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
-      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
-      TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
-      TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
-      TREESEED_AGENT_POOL_MIN_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MIN_WORKERS }}
-      TREESEED_AGENT_POOL_MAX_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MAX_WORKERS }}
-      TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH: ${{ vars.TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH }}
-      TREESEED_AGENT_POOL_COOLDOWN_SECONDS: ${{ vars.TREESEED_AGENT_POOL_COOLDOWN_SECONDS }}
-      TREESEED_WORKDAY_TIMEZONE: ${{ vars.TREESEED_WORKDAY_TIMEZONE }}
-      TREESEED_WORKDAY_WINDOWS_JSON: ${{ vars.TREESEED_WORKDAY_WINDOWS_JSON }}
-      TREESEED_WORKDAY_TASK_CREDIT_BUDGET: ${{ vars.TREESEED_WORKDAY_TASK_CREDIT_BUDGET }}
-      TREESEED_MANAGER_MAX_QUEUED_TASKS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_TASKS }}
-      TREESEED_MANAGER_MAX_QUEUED_CREDITS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_CREDITS }}
-      TREESEED_MANAGER_PRIORITY_MODELS: ${{ vars.TREESEED_MANAGER_PRIORITY_MODELS }}
-      TREESEED_TASK_CREDIT_WEIGHTS_JSON: ${{ vars.TREESEED_TASK_CREDIT_WEIGHTS_JSON }}
-      TREESEED_RAILWAY_PROJECT_ID: ${{ vars.TREESEED_RAILWAY_PROJECT_ID }}
-      TREESEED_RAILWAY_ENVIRONMENT_ID: ${{ vars.TREESEED_RAILWAY_ENVIRONMENT_ID }}
-      TREESEED_RAILWAY_WORKER_SERVICE_ID: ${{ vars.TREESEED_RAILWAY_WORKER_SERVICE_ID }}
-      TREESEED_CONTENT_SERVING_MODE: published_runtime
-      TREESEED_WORKFLOW_ACTION: deploy_code
-      TREESEED_WORKFLOW_ENVIRONMENT: ${{ needs.classify.outputs.scope }}
-      TREESEED_WORKFLOW_SKIP_PROVISION: "1"
-      TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id || needs.classify.outputs.preview_id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: __CACHE_DEPENDENCY_PATH__
-
-      - name: Install dependencies
-        run: |
-          node -e "const fs = require('fs'); for (const file of ['packages/sdk/package.json', 'packages/core/package.json', 'packages/cli/package.json']) { if (!fs.existsSync(file)) continue; const p = JSON.parse(fs.readFileSync(file, 'utf8')); if (p.scripts) delete p.scripts.prepare; fs.writeFileSync(file, JSON.stringify(p, null, '\t') + '\n'); }"
-          for attempt in 1 2 3; do
-            if npm ci --ignore-scripts; then
-              break
-            fi
-            if test "${attempt}" = "3"; then
-              exit 1
-            fi
-            echo "npm ci failed; retrying (${attempt}/3)."
-            sleep $((attempt * 10))
-          done
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -d "${dir}/.git" || git -C "${dir}" rev-parse --git-dir >/dev/null 2>&1; then
-              git -C "${dir}" checkout -- package.json
-            fi
-          done
-
-      - name: Build workspace package artifacts
-        shell: bash
-        run: |
-          set -euo pipefail
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -f "${dir}/package.json"; then
-              npm --prefix "${dir}" run build:dist
-            fi
-          done
-
-      - name: Install Railway CLI
-        run: npm install -g @railway/cli
-
-      - name: Download Treeseed deployment state
-        uses: actions/download-artifact@v4
-        with:
-          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
-          path: .treeseed/state
-
-      - name: Deploy Treeseed platform
-        shell: bash
-        run: |
-__TENANT_WORKFLOW_ACTION_COMMAND_BLOCK__
-__WORKING_DIRECTORY_BLOCK__
-
-  publish-content:
-    runs-on: ubuntu-latest
-    needs:
-      - classify
-      - verify
-      - provision
-      - deploy-code
-    permissions:
-      contents: read
-    if: |
-      always() &&
-      needs.provision.result == 'success' &&
-      (needs.classify.outputs.workflow_action == 'publish_content' ||
-      needs.classify.outputs.content_changed == 'true') &&
-      (needs['deploy-code'].result == 'success' || needs['deploy-code'].result == 'skipped')
-    environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
-    env:
-      TREESEED_BOOTSTRAP_MODE: auto
-      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
-      TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PROJECT_NAME }}
-      TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME: ${{ vars.TREESEED_CLOUDFLARE_PAGES_PREVIEW_PROJECT_NAME }}
-      TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
-      TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
-      TREESEED_FORM_TOKEN_SECRET: ${{ secrets.TREESEED_FORM_TOKEN_SECRET }}
-      TREESEED_EDITORIAL_PREVIEW_SECRET: ${{ secrets.TREESEED_EDITORIAL_PREVIEW_SECRET }}
-      TREESEED_PUBLIC_TURNSTILE_SITE_KEY: ${{ vars.TREESEED_PUBLIC_TURNSTILE_SITE_KEY }}
-      TREESEED_TURNSTILE_SECRET_KEY: ${{ secrets.TREESEED_TURNSTILE_SECRET_KEY }}
-      TREESEED_SMTP_HOST: ${{ vars.TREESEED_SMTP_HOST }}
-      TREESEED_SMTP_PORT: ${{ vars.TREESEED_SMTP_PORT }}
-      TREESEED_SMTP_USERNAME: ${{ vars.TREESEED_SMTP_USERNAME }}
-      TREESEED_SMTP_PASSWORD: ${{ secrets.TREESEED_SMTP_PASSWORD }}
-      TREESEED_SMTP_FROM: ${{ vars.TREESEED_SMTP_FROM }}
-      TREESEED_SMTP_REPLY_TO: ${{ vars.TREESEED_SMTP_REPLY_TO }}
-      RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
-      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
-      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
-      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
-      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
-      TREESEED_CENTRAL_MARKET_API_BASE_URL: ${{ vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_CATALOG_MARKET_API_BASE_URLS: ${{ vars.TREESEED_CATALOG_MARKET_API_BASE_URLS || vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
-      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
-      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
-      TREESEED_API_AUTH_SECRET: ${{ secrets.TREESEED_API_AUTH_SECRET }}
-      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
-      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
-      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
-      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
-      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
-      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
-      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
-      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
-      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
-      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
-      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
-      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
-      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
-      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
-      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
-      TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
-      TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
-      TREESEED_AGENT_POOL_MIN_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MIN_WORKERS }}
-      TREESEED_AGENT_POOL_MAX_WORKERS: ${{ vars.TREESEED_AGENT_POOL_MAX_WORKERS }}
-      TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH: ${{ vars.TREESEED_AGENT_POOL_TARGET_QUEUE_DEPTH }}
-      TREESEED_AGENT_POOL_COOLDOWN_SECONDS: ${{ vars.TREESEED_AGENT_POOL_COOLDOWN_SECONDS }}
-      TREESEED_WORKDAY_TIMEZONE: ${{ vars.TREESEED_WORKDAY_TIMEZONE }}
-      TREESEED_WORKDAY_WINDOWS_JSON: ${{ vars.TREESEED_WORKDAY_WINDOWS_JSON }}
-      TREESEED_WORKDAY_TASK_CREDIT_BUDGET: ${{ vars.TREESEED_WORKDAY_TASK_CREDIT_BUDGET }}
-      TREESEED_MANAGER_MAX_QUEUED_TASKS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_TASKS }}
-      TREESEED_MANAGER_MAX_QUEUED_CREDITS: ${{ vars.TREESEED_MANAGER_MAX_QUEUED_CREDITS }}
-      TREESEED_MANAGER_PRIORITY_MODELS: ${{ vars.TREESEED_MANAGER_PRIORITY_MODELS }}
-      TREESEED_TASK_CREDIT_WEIGHTS_JSON: ${{ vars.TREESEED_TASK_CREDIT_WEIGHTS_JSON }}
-      TREESEED_RAILWAY_PROJECT_ID: ${{ vars.TREESEED_RAILWAY_PROJECT_ID }}
-      TREESEED_RAILWAY_ENVIRONMENT_ID: ${{ vars.TREESEED_RAILWAY_ENVIRONMENT_ID }}
-      TREESEED_RAILWAY_WORKER_SERVICE_ID: ${{ vars.TREESEED_RAILWAY_WORKER_SERVICE_ID }}
-      TREESEED_WORKFLOW_ACTION: publish_content
-      TREESEED_WORKFLOW_ENVIRONMENT: ${{ needs.classify.outputs.scope }}
-      TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id || needs.classify.outputs.preview_id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: __CACHE_DEPENDENCY_PATH__
-
-      - name: Install dependencies
-        run: |
-          node -e "const fs = require('fs'); for (const file of ['packages/sdk/package.json', 'packages/core/package.json', 'packages/cli/package.json']) { if (!fs.existsSync(file)) continue; const p = JSON.parse(fs.readFileSync(file, 'utf8')); if (p.scripts) delete p.scripts.prepare; fs.writeFileSync(file, JSON.stringify(p, null, '\t') + '\n'); }"
-          for attempt in 1 2 3; do
-            if npm ci --ignore-scripts; then
-              break
-            fi
-            if test "${attempt}" = "3"; then
-              exit 1
-            fi
-            echo "npm ci failed; retrying (${attempt}/3)."
-            sleep $((attempt * 10))
-          done
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -d "${dir}/.git" || git -C "${dir}" rev-parse --git-dir >/dev/null 2>&1; then
-              git -C "${dir}" checkout -- package.json
-            fi
-          done
-
-      - name: Build workspace package artifacts
-        shell: bash
-        run: |
-          set -euo pipefail
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -f "${dir}/package.json"; then
-              npm --prefix "${dir}" run build:dist
-            fi
-          done
-
-      - name: Install Railway CLI
-        run: npm install -g @railway/cli
-
-      - name: Download Treeseed deployment state
-        uses: actions/download-artifact@v4
-        with:
-          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
-          path: .treeseed/state
-
-      - name: Publish Treeseed content
-        shell: bash
-        run: |
-__TENANT_WORKFLOW_ACTION_COMMAND_BLOCK__
-__WORKING_DIRECTORY_BLOCK__
-
-  monitor:
-    runs-on: ubuntu-latest
-    needs:
-      - classify
-      - provision
-      - deploy-code
-      - publish-content
-    if: |
-      always() &&
-      needs.provision.result == 'success' &&
-      (needs.classify.outputs.workflow_action == 'monitor' ||
-      needs.classify.outputs.code_changed == 'true' ||
-      needs.classify.outputs.content_changed == 'true' ||
-      needs.classify.outputs.release_tag == 'true') &&
-      (needs['deploy-code'].result == 'success' || needs['deploy-code'].result == 'skipped') &&
-      (needs['publish-content'].result == 'success' || needs['publish-content'].result == 'skipped')
-    permissions:
-      contents: read
-    environment: ${{ needs.classify.outputs.scope == 'prod' && 'production' || 'staging' }}
-    env:
-      TREESEED_BOOTSTRAP_MODE: auto
-      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-      CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
-      TREESEED_CONTENT_BUCKET_NAME: ${{ vars.TREESEED_CONTENT_BUCKET_NAME }}
-      TREESEED_CONTENT_BUCKET_BINDING: ${{ vars.TREESEED_CONTENT_BUCKET_BINDING }}
-      RAILWAY_API_TOKEN: ${{ secrets.RAILWAY_API_TOKEN }}
-      TREESEED_RAILWAY_WORKSPACE: ${{ vars.TREESEED_RAILWAY_WORKSPACE }}
-      TREESEED_HOSTING_KIND: ${{ vars.TREESEED_HOSTING_KIND }}
-      TREESEED_HOSTING_REGISTRATION: ${{ vars.TREESEED_HOSTING_REGISTRATION }}
-      TREESEED_HOSTING_TEAM_ID: ${{ vars.TREESEED_HOSTING_TEAM_ID }}
-      TREESEED_CENTRAL_MARKET_API_BASE_URL: ${{ vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_MARKET_API_BASE_URL: ${{ vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_CATALOG_MARKET_API_BASE_URLS: ${{ vars.TREESEED_CATALOG_MARKET_API_BASE_URLS || vars.TREESEED_MARKET_API_BASE_URL || vars.TREESEED_CENTRAL_MARKET_API_BASE_URL || 'https://api.treeseed.ai' }}
-      TREESEED_PROJECT_DOMAINS: ${{ vars.TREESEED_PROJECT_DOMAINS }}
-      TREESEED_API_BASE_URL: ${{ vars.TREESEED_API_BASE_URL }}
-      TREESEED_BETTER_AUTH_SECRET: ${{ secrets.TREESEED_BETTER_AUTH_SECRET }}
-      TREESEED_API_AUTH_SECRET: ${{ secrets.TREESEED_API_AUTH_SECRET }}
-      TREESEED_WEB_SERVICE_ID: ${{ vars.TREESEED_WEB_SERVICE_ID }}
-      TREESEED_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_WEB_SERVICE_SECRET }}
-      TREESEED_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_WEB_ASSERTION_SECRET }}
-      TREESEED_WEB_CSRF_SECRET: ${{ secrets.TREESEED_WEB_CSRF_SECRET }}
-      TREESEED_AUTH_GITHUB_CLIENT_ID: ${{ vars.TREESEED_AUTH_GITHUB_CLIENT_ID }}
-      TREESEED_AUTH_GITHUB_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GITHUB_CLIENT_SECRET }}
-      TREESEED_AUTH_GOOGLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_GOOGLE_CLIENT_ID }}
-      TREESEED_AUTH_GOOGLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_GOOGLE_CLIENT_SECRET }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_ID: ${{ vars.TREESEED_AUTH_MICROSOFT_CLIENT_ID }}
-      TREESEED_AUTH_MICROSOFT_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_MICROSOFT_CLIENT_SECRET }}
-      TREESEED_AUTH_APPLE_CLIENT_ID: ${{ vars.TREESEED_AUTH_APPLE_CLIENT_ID }}
-      TREESEED_AUTH_APPLE_CLIENT_SECRET: ${{ secrets.TREESEED_AUTH_APPLE_CLIENT_SECRET }}
-      TREESEED_API_D1_DATABASE_ID: ${{ vars.TREESEED_API_D1_DATABASE_ID }}
-      TREESEED_API_WEB_SERVICE_ID: ${{ vars.TREESEED_API_WEB_SERVICE_ID }}
-      TREESEED_API_WEB_SERVICE_SECRET: ${{ secrets.TREESEED_API_WEB_SERVICE_SECRET }}
-      TREESEED_API_WEB_ASSERTION_SECRET: ${{ secrets.TREESEED_API_WEB_ASSERTION_SECRET }}
-      TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST: ${{ vars.TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST }}
-      TREESEED_PROJECT_ID: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_PROJECT_RUNNER_TOKEN: ${{ secrets.TREESEED_PROJECT_RUNNER_TOKEN }}
-      TREESEED_WORKER_POOL_SCALER: ${{ vars.TREESEED_WORKER_POOL_SCALER }}
-      TREESEED_RAILWAY_PROJECT_ID: ${{ vars.TREESEED_RAILWAY_PROJECT_ID }}
-      TREESEED_RAILWAY_ENVIRONMENT_ID: ${{ vars.TREESEED_RAILWAY_ENVIRONMENT_ID }}
-      TREESEED_RAILWAY_WORKER_SERVICE_ID: ${{ vars.TREESEED_RAILWAY_WORKER_SERVICE_ID }}
-      TREESEED_WORKFLOW_ACTION: monitor
-      TREESEED_WORKFLOW_ENVIRONMENT: ${{ needs.classify.outputs.scope }}
-      TREESEED_WORKFLOW_PROJECT: ${{ inputs.project_id || vars.TREESEED_PROJECT_ID }}
-      TREESEED_WORKFLOW_PREVIEW_ID: ${{ inputs.preview_id || needs.classify.outputs.preview_id }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-          cache: npm
-          cache-dependency-path: __CACHE_DEPENDENCY_PATH__
-
-      - name: Install dependencies
-        run: |
-          node -e "const fs = require('fs'); for (const file of ['packages/sdk/package.json', 'packages/core/package.json', 'packages/cli/package.json']) { if (!fs.existsSync(file)) continue; const p = JSON.parse(fs.readFileSync(file, 'utf8')); if (p.scripts) delete p.scripts.prepare; fs.writeFileSync(file, JSON.stringify(p, null, '\t') + '\n'); }"
-          for attempt in 1 2 3; do
-            if npm ci --ignore-scripts; then
-              break
-            fi
-            if test "${attempt}" = "3"; then
-              exit 1
-            fi
-            echo "npm ci failed; retrying (${attempt}/3)."
-            sleep $((attempt * 10))
-          done
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -d "${dir}/.git" || git -C "${dir}" rev-parse --git-dir >/dev/null 2>&1; then
-              git -C "${dir}" checkout -- package.json
-            fi
-          done
-
-      - name: Build workspace package artifacts
-        shell: bash
-        run: |
-          set -euo pipefail
-          for dir in packages/sdk packages/core packages/cli; do
-            if test -f "${dir}/package.json"; then
-              npm --prefix "${dir}" run build:dist
-            fi
-          done
-
-      - name: Download Treeseed deployment state
-        uses: actions/download-artifact@v4
-        with:
-          name: treeseed-deploy-state-${{ needs.classify.outputs.scope }}
-          path: .treeseed/state
-
-      - name: Report Treeseed deployment state
-        shell: bash
-        run: |
-__TENANT_WORKFLOW_ACTION_COMMAND_BLOCK__
-__WORKING_DIRECTORY_BLOCK__