@treeseed/sdk 0.12.36 → 0.12.38

package/dist/hosting/builtins.js

@@ -1,4 +1,5 @@
 import { existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
 import { dirname, resolve } from "node:path";
 import { resolveTreeseedLaunchEnvironment } from "../operations/services/config-runtime.js";
 import { cloudflareApiRequest, resolveCloudflareZoneIdForHost, resolveConfiguredCloudflareAccountId, runWrangler } from "../operations/services/deploy.js";
@@ -161,6 +162,62 @@ function cloudflarePagesDomain(input) {
 function cloudflarePagesDeploymentUrl(projectName, branchName, environment) {
   return environment === "prod" ? `https://${projectName}.pages.dev` : `https://${branchName}.${projectName}.pages.dev`;
 }
+function probeCloudflarePagesPublicUrl(url) {
+  if (!url) {
+    return { ok: false, status: null, finalUrl: null, headers: {}, error: "missing_url" };
+  }
+  const script = `
+const url = process.argv[1];
+try {
+	const response = await fetch(url, {
+		redirect: 'follow',
+		headers: {
+			'user-agent': 'treeseed-hosting-verifier/1.0',
+			'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
+		},
+		signal: AbortSignal.timeout(15000),
+	});
+	const headers = {};
+	for (const key of ['cf-cache-status', 'age', 'server', 'cache-control', 'content-type']) {
+		const value = response.headers.get(key);
+		if (value) headers[key] = value;
+	}
+	process.stdout.write(JSON.stringify({
+		ok: response.ok,
+		status: response.status,
+		finalUrl: response.url,
+		headers,
+		error: null,
+	}));
+} catch (error) {
+	process.stdout.write(JSON.stringify({
+		ok: false,
+		status: null,
+		finalUrl: url,
+		headers: {},
+		error: error instanceof Error ? error.message : String(error),
+	}));
+}
+`;
+  const result = spawnSync(process.execPath, ["--input-type=module", "-e", script, url], {
+    encoding: "utf8",
+    timeout: 2e4
+  });
+  if (result.error) {
+    return { ok: false, status: null, finalUrl: url, headers: {}, error: result.error.message };
+  }
+  try {
+    return JSON.parse(result.stdout || "{}");
+  } catch {
+    return {
+      ok: false,
+      status: null,
+      finalUrl: url,
+      headers: {},
+      error: result.stderr?.trim() || result.stdout?.trim() || "invalid_probe_output"
+    };
+  }
+}
 function cloudflarePagesDnsTarget(projectName, branchName, environment) {
   return environment === "prod" ? `${projectName}.pages.dev` : `${branchName}.${projectName}.pages.dev`;
 }
@@ -337,6 +394,8 @@ function createCloudflareHostAdapter() {
       const observedDomain = observedState.observedDomain ?? null;
       const observedDnsRecord = observedState.observedDnsRecord ?? null;
       const observedDeployment = observedState.observedDeployment ?? null;
+      const publicUrl = domain ? `https://${domain}` : projectName && branchName ? cloudflarePagesDeploymentUrl(projectName, branchName, input.environment) : null;
+      const publicProbe = input.environment === "prod" ? probeCloudflarePagesPublicUrl(publicUrl) : null;
       const checks = [
         {
           key: "pages-project.exists",
@@ -376,6 +435,16 @@ function createCloudflareHostAdapter() {
           issues: !domain || observedDnsRecord ? [] : [`Cloudflare DNS record ${domain} -> ${projectName && branchName ? cloudflarePagesDnsTarget(projectName, branchName, input.environment) : "(unset)"} is missing.`]
         }
       ];
+      if (input.environment === "prod") {
+        checks.push({
+          key: "pages-public-url.ok",
+          label: "Cloudflare Pages public URL responds successfully",
+          ok: publicProbe?.ok === true,
+          expected: { url: publicUrl, ok: true },
+          observed: publicProbe,
+          issues: publicProbe?.ok === true ? [] : [`Cloudflare Pages public URL ${publicUrl ?? "(unset)"} did not return a successful status.`]
+        });
+      }
       return {
         unitId: input.unit.id,
         status: checks.every((check) => check.ok) ? "ready" : "pending",

package/dist/operations/services/deploy.d.ts

@@ -300,11 +300,17 @@ export declare function purgeSourcePageCaches(tenantRoot: any, options?: {}): {
     results: never[];
 } | {
     urls: (string | null)[];
-    results: {
+    results: ({
         zoneId: any;
         count: number;
         success: boolean;
-    }[];
+        errors: any;
+    } | {
+        zoneId: unknown;
+        count: string;
+        success: boolean;
+        errors: any;
+    })[];
     skipped?: undefined;
     reason?: undefined;
 };
@@ -319,6 +325,7 @@ export declare function purgePublishedContentCaches(tenantRoot: any, urls: any,
         zoneId: any;
         count: number;
         success: boolean;
+        errors: any;
     }[];
     skipped?: undefined;
     reason?: undefined;

package/dist/operations/services/deploy.js

@@ -1249,8 +1249,8 @@ function shouldManageCloudflareWebCacheRules(deployConfig, target) {
   if ((deployConfig.surfaces?.web?.provider ?? deployConfig.providers?.deploy) !== "cloudflare") {
     return false;
   }
-  const webTarget = resolvePublicWebCacheTarget(deployConfig);
-  return Boolean(webTarget?.host && !webTarget.host.endsWith(".workers.dev") && !webTarget.host.endsWith(".pages.dev"));
+  const webTarget2 = resolvePublicWebCacheTarget(deployConfig);
+  return Boolean(webTarget2?.host && !webTarget2.host.endsWith(".workers.dev") && !webTarget2.host.endsWith(".pages.dev"));
 }
 function cloudflareApiRequest(path, { method = "GET", body, env, allowFailure = false } = {}) {
   const token = env?.TREESEED_CLOUDFLARE_API_TOKEN ?? env?.CLOUDFLARE_API_TOKEN ?? process.env.TREESEED_CLOUDFLARE_API_TOKEN ?? "";
@@ -1476,7 +1476,7 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
   ];
   if (sourcePathExpression) {
     rules.push({
-      description: "treeseed-managed: cache source html routes",
+      description: "treeseed-managed: bypass source html routes",
       expression: joinCloudflareAndExpression([
         hostExpression,
         pathExpression,
@@ -1485,15 +1485,7 @@ function buildTreeseedManagedCloudflareCacheRules(deployConfig, cacheTarget, kin
       ]),
       action: "set_cache_settings",
       action_parameters: {
-        cache: true,
-        edge_ttl: {
-          mode: "override_origin",
-          default: policy.sourcePages.edgeTtlSeconds
-        },
-        browser_ttl: {
-          mode: "override_origin",
-          default: policy.sourcePages.browserTtlSeconds
-        }
+        cache: false
       },
       enabled: true
     });
@@ -1576,10 +1568,10 @@ function reconcileCloudflareCacheRulesForTarget(role, deployConfig, state, cache
 }
 function reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, target, { planOnly = false, env: providedEnv } = {}) {
   if (!shouldManageCloudflareWebCacheRules(deployConfig, target)) {
-    const webTarget2 = resolvePublicWebCacheTarget(deployConfig);
-    const contentTarget2 = resolvePublicContentCacheTarget(deployConfig);
-    state.webCache.webHost = webTarget2?.host ?? null;
-    state.webCache.contentHost = contentTarget2?.host ?? null;
+    const webTarget3 = resolvePublicWebCacheTarget(deployConfig);
+    const contentTarget3 = resolvePublicContentCacheTarget(deployConfig);
+    state.webCache.webHost = webTarget3?.host ?? null;
+    state.webCache.contentHost = contentTarget3?.host ?? null;
     state.webCache.rulesManaged = false;
     state.webCache.lastError = null;
     return { managed: false, skipped: true, reason: "unsupported_target_or_host" };
@@ -1594,15 +1586,15 @@ function reconcileCloudflareWebCacheRules(tenantRoot, deployConfig, state, targe
     state.webCache.lastError = "CLOUDFLARE_API_TOKEN is required to manage Cloudflare Cache Rules.";
     return { managed: false, skipped: true, reason: "missing_api_token" };
   }
-  const webTarget = resolvePublicWebCacheTarget(deployConfig);
-  const contentTarget = resolvePublicContentCacheTarget(deployConfig);
+  const webTarget2 = resolvePublicWebCacheTarget(deployConfig);
+  const contentTarget2 = resolvePublicContentCacheTarget(deployConfig);
   try {
     const results = [];
-    if (webTarget?.host) {
-      results.push(reconcileCloudflareCacheRulesForTarget("web", deployConfig, state, webTarget, env, { planOnly }));
+    if (webTarget2?.host) {
+      results.push(reconcileCloudflareCacheRulesForTarget("web", deployConfig, state, webTarget2, env, { planOnly }));
     }
-    if (contentTarget?.host) {
-      results.push(reconcileCloudflareCacheRulesForTarget("content", deployConfig, state, contentTarget, env, { planOnly }));
+    if (contentTarget2?.host) {
+      results.push(reconcileCloudflareCacheRulesForTarget("content", deployConfig, state, contentTarget2, env, { planOnly }));
     }
     state.webCache.rulesManaged = true;
     state.webCache.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -1643,13 +1635,41 @@ function purgeCloudflareCacheByUrls(urls, deployConfig, { env } = {}) {
       body: { files: [...new Set(files)] },
       env
     });
+    const errors = Array.isArray(payload?.errors) ? payload.errors.map((entry) => entry?.message ?? JSON.stringify(entry)).filter(Boolean) : [];
     return {
       zoneId,
       count: [...new Set(files)].length,
-      success: payload?.success === true
+      success: payload?.success === true,
+      errors
     };
   });
 }
+function purgeCloudflareCacheEverythingByHosts(hosts, deployConfig, { env } = {}) {
+  const zoneIds = [...new Set((hosts ?? []).map((host) => typeof host === "string" ? host.trim() : "").filter(Boolean).map((host) => resolveCloudflareZoneIdForHost(deployConfig, host, env)).filter(Boolean))];
+  return zoneIds.map((zoneId) => {
+    const payload = cloudflareApiRequest(`/zones/${zoneId}/purge_cache`, {
+      method: "POST",
+      body: { purge_everything: true },
+      env
+    });
+    const errors = Array.isArray(payload?.errors) ? payload.errors.map((entry) => entry?.message ?? JSON.stringify(entry)).filter(Boolean) : [];
+    return {
+      zoneId,
+      count: "everything",
+      success: payload?.success === true,
+      errors
+    };
+  });
+}
+function assertCloudflareCachePurgeSucceeded(results) {
+  const failures = (results ?? []).filter((result) => result?.success !== true);
+  if (failures.length === 0) return;
+  const detail = failures.map((result) => {
+    const errors = Array.isArray(result?.errors) && result.errors.length > 0 ? `: ${result.errors.join("; ")}` : "";
+    return `${result?.zoneId ?? "unknown-zone"} (${result?.count ?? 0} urls)${errors}`;
+  }).join(", ");
+  throw new Error(`Cloudflare cache purge did not succeed for ${detail}.`);
+}
 function queueName(entry) {
   return entry?.queue_name ?? entry?.queueName ?? entry?.name ?? null;
 }
@@ -1708,9 +1728,11 @@ function purgeSourcePageCaches(tenantRoot, options = {}) {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
       env
     });
-    recordCachePurgeResult(state.webCache.deployPurge, results);
+    const allResults = target.scope === "prod" ? purgeCloudflareCacheEverythingByHosts([webTarget.host, contentTarget?.host], deployConfig, { env }) : [];
+    assertCloudflareCachePurgeSucceeded([...results, ...allResults]);
+    recordCachePurgeResult(state.webCache.deployPurge, [...results, ...allResults]);
     writeDeployState(tenantRoot, state, { target });
-    return { urls, results };
+    return { urls, results: [...results, ...allResults] };
   } catch (error) {
     recordCachePurgeResult(state.webCache.deployPurge, [], error);
     writeDeployState(tenantRoot, state, { target });
@@ -1736,6 +1758,7 @@ function purgePublishedContentCaches(tenantRoot, urls, options = {}) {
     const results = purgeCloudflareCacheByUrls(urls, deployConfig, {
       env
     });
+    assertCloudflareCachePurgeSucceeded(results);
     recordCachePurgeResult(state.webCache.contentPurge, results);
     writeDeployState(tenantRoot, state, { target });
     return { urls, results };

package/dist/operations/services/hosted-service-checks.js

@@ -79,12 +79,14 @@ function variableObserved(observed, key) {
 function valuePresence(values, observed, key, serviceTarget) {
   const providerPresent = variableObserved(observed, key);
   const machinePresent = hasConfiguredValue(values, key);
+  const providerObserved = Boolean(observed);
+  const present = providerObserved ? providerPresent : machinePresent;
   return {
     key,
     serviceTarget,
-    present: providerPresent || machinePresent,
-    source: providerPresent ? "provider" : machinePresent ? "machine-config" : "missing",
-    observation: observed ? "provider-live" : "not-observed"
+    present,
+    source: providerPresent ? "provider" : !providerObserved && machinePresent ? "machine-config" : "missing",
+    observation: providerObserved ? "provider-live" : "not-observed"
   };
 }
 function serviceTypeFor(key) {

package/dist/operations/services/repository-save-orchestrator.js

@@ -973,7 +973,7 @@ async function validateRepositoryLockfile(node, options) {
     return { status: "skipped", command: commandText, issues: [], error: "disabled" };
   }
   try {
-    runCapturedCommand(node, options, "lockfile", command, args, { timeoutMs: 12e4, emitOutputOnSuccess: false });
+    runCapturedCommand(node, options, "lockfile", command, args, { timeoutMs: 6e5, emitOutputOnSuccess: false });
     const packageCount = npmLockfilePackageCount(node.path);
     const countText = packageCount === null ? "package-lock entries" : `${packageCount} package${packageCount === 1 ? "" : "s"}`;
     emitProgress(options, node, "lockfile", `Lockfile validation passed: ${countText} checked, 0 issues.`);

package/dist/workflow/operations.js

@@ -44,6 +44,7 @@ import {
   createPersistentDeployTarget,
   destroyTreeseedEnvironmentResources,
   loadDeployState,
+  purgeSourcePageCaches,
   recordHostedDeploymentState,
   resolveConfiguredSurfaceDomain,
   validateDestroyPrerequisites
@@ -646,6 +647,21 @@ async function runReleaseWebLiveVerification(root, environment, helpers, operati
     ...helpers.context.env,
     ...collectTreeseedConfigSeedValues(root, environment, helpers.context.env)
   };
+  let purge;
+  try {
+    purge = purgeSourcePageCaches(root, { target: environment, env });
+  } catch (error) {
+    workflowError(operation, "hosted_live_verification_failed", `Production web cache purge failed before root live verification:
+${error instanceof Error ? error.message : String(error)}`, {
+      details: { environment }
+    });
+  }
+  if (purge?.skipped) {
+    workflowError(operation, "hosted_live_verification_failed", `Production web cache purge was skipped before root live verification: ${purge.reason ?? "unknown reason"}`, {
+      details: { environment, purge }
+    });
+  }
+  helpers.write(`[${operation}][cloudflare] purged production source page cache for ${purge?.urls?.length ?? 0} urls before web live verification.`, "stderr");
   const live = await collectTreeseedLiveHostedServiceChecks({
     tenantRoot: root,
     target: environment,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.12.36",
+  "version": "0.12.38",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {