@treeseed/sdk 0.5.1 → 0.5.3

package/dist/operations/services/config-runtime.js

@@ -1543,12 +1543,22 @@ function ensureTreeseedActVerificationTooling({ tenantRoot = process.cwd(), inst
     attemptedInstall: false,
     installedDuringConfig: false
   });
-  const wranglerCheck = checkCommand(process.execPath, [resolveWranglerBin(), "--version"], { cwd: tenantRoot, env });
-  const wranglerCli = toolStatus(
-    "wranglerCli",
-    wranglerCheck.ok,
-    wranglerCheck.ok ? wranglerCheck.stdout.split("\n")[0] ?? "Wrangler CLI detected." : wranglerCheck.detail || "Wrangler CLI is unavailable."
-  );
+  const wranglerCli = (() => {
+    try {
+      const wranglerCheck = checkCommand(process.execPath, [resolveWranglerBin(), "--version"], { cwd: tenantRoot, env });
+      return toolStatus(
+        "wranglerCli",
+        wranglerCheck.ok,
+        wranglerCheck.ok ? wranglerCheck.stdout.split("\n")[0] ?? "Wrangler CLI detected." : wranglerCheck.detail || "Wrangler CLI is unavailable."
+      );
+    } catch (error) {
+      return toolStatus(
+        "wranglerCli",
+        false,
+        error instanceof Error && error.message ? error.message : "Wrangler CLI is unavailable."
+      );
+    }
+  })();
   const railwayCheck = checkCommand("railway", ["--version"], { cwd: tenantRoot, env });
   const railwayCli = toolStatus(
     "railwayCli",

package/dist/scripts/release-verify.js

@@ -1,18 +1,18 @@
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, readdirSync } from 'node:fs';
 import { basename, extname, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { packageRoot } from './package-tools.js';
-const npmCacheDir = resolve(tmpdir(), 'treeseed-npm-cache');
+const npmCacheDir = mkdtempSync(join(tmpdir(), 'treeseed-sdk-npm-cache-'));
 const textExtensions = new Set(['.js', '.ts', '.mjs', '.cjs', '.d.js', '.json', '.md']);
 const forbiddenPatterns = [
     /['"`]workspace:[^'"`\n]+['"`]/,
     /['"`](?:\.\.\/|\.\/)[^'"`\n]*src\/[^'"`\n]*\.(?:[cm]?js|ts|tsx|json|astro|css)['"`]/,
     /['"`][^'"`\n]*\/packages\/[^'"`\n]*\/src\/[^'"`\n]*['"`]/,
 ];
-function run(command, args) {
+function run(command, args, cwd = packageRoot) {
     const result = spawnSync(command, args, {
-        cwd: packageRoot,
+        cwd,
         stdio: 'inherit',
         env: {
             ...process.env,
@@ -24,6 +24,32 @@ function run(command, args) {
         process.exit(result.status ?? 1);
     }
 }
+function assertNoLocalDependencyLinks() {
+    const packageJson = JSON.parse(readFileSync(resolve(packageRoot, 'package.json'), 'utf8'));
+    for (const sectionName of ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']) {
+        for (const [dependencyName, version] of Object.entries(packageJson[sectionName] ?? {})) {
+            if (version.startsWith('workspace:') || version.startsWith('file:')) {
+                throw new Error(`package.json ${sectionName}.${dependencyName} must not use local dependency specifiers: ${version}`);
+            }
+        }
+    }
+    const lockfile = JSON.parse(readFileSync(resolve(packageRoot, 'package-lock.json'), 'utf8'));
+    for (const [entryKey, entryValue] of Object.entries(lockfile.packages ?? {})) {
+        if (entryKey.startsWith('../') || entryKey.includes('/../')) {
+            throw new Error(`package-lock.json contains forbidden local package entry: ${entryKey}`);
+        }
+        if (entryValue.link) {
+            throw new Error(`package-lock.json contains forbidden linked dependency entry: ${entryKey}`);
+        }
+        const resolved = entryValue.resolved ?? '';
+        if (resolved.startsWith('../')
+            || resolved.startsWith('./')
+            || resolved.startsWith('file:')
+            || resolved.startsWith('workspace:')) {
+            throw new Error(`package-lock.json contains forbidden local resolution for ${entryKey}: ${resolved}`);
+        }
+    }
+}
 function walkFiles(root) {
     const files = [];
     for (const entry of readdirSync(root, { withFileTypes: true })) {
@@ -71,6 +97,7 @@ function assertCleanDistArtifacts() {
         }
     }
 }
+assertNoLocalDependencyLinks();
 run('npm', ['run', 'lint']);
 scanDirectory(resolve(packageRoot, 'dist'));
 assertCleanDistArtifacts();

package/dist/scripts/verify-driver.js

@@ -10,8 +10,12 @@ const packageRoot = resolve(scriptRoot, '..');
 const sourceRunner = resolve(packageRoot, 'scripts', 'run-ts.mjs');
 const sourceEntry = resolve(packageRoot, 'src', 'verification.ts');
 const publishedEntry = resolve(packageRoot, 'dist', 'verification.js');
+const entrypointCheckOnly = process.env.TREESEED_VERIFY_ENTRYPOINT_CHECK === 'true';
 
 if (existsSync(sourceRunner) && existsSync(sourceEntry)) {
+	if (entrypointCheckOnly) {
+		process.exit(0);
+	}
 	const result = spawnSync(process.execPath, [sourceRunner, sourceEntry], {
 		cwd: process.cwd(),
 		env: process.env,
@@ -21,6 +25,9 @@ if (existsSync(sourceRunner) && existsSync(sourceEntry)) {
 }
 
 if (existsSync(publishedEntry)) {
+	if (entrypointCheckOnly) {
+		process.exit(0);
+	}
 	const { runTreeseedVerifyDriver } = await import('../dist/verification.js');
 	process.exit(runTreeseedVerifyDriver({ packageRoot: process.cwd() }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@treeseed/sdk",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Shared Treeseed SDK for content-backed and D1-backed object models.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -42,8 +42,8 @@
     "fixtures:check": "node ./scripts/run-ts.mjs ./scripts/fixture-tools.ts check",
     "lint": "npm run fixtures:check && npm run build:dist",
     "verify:direct": "npm run release:verify",
-    "verify:local": "node --input-type=module -e \"process.env.TREESEED_VERIFY_DRIVER='direct'; await import('@treeseed/sdk/scripts/verify-driver')\"",
-    "verify:action": "node --input-type=module -e \"process.env.TREESEED_VERIFY_DRIVER='act'; await import('@treeseed/sdk/scripts/verify-driver')\"",
+    "verify:local": "node --input-type=module -e \"process.env.TREESEED_VERIFY_DRIVER='direct'; await import('./scripts/verify-driver.mjs')\"",
+    "verify:action": "node --input-type=module -e \"process.env.TREESEED_VERIFY_DRIVER='act'; await import('./scripts/verify-driver.mjs')\"",
     "verify": "node ./scripts/verify-driver.mjs",
     "release:setup": "npm run setup:ci",
     "release:check-tag": "node ./scripts/run-ts.mjs ./scripts/assert-release-tag-version.ts",

package/scripts/verify-driver.mjs

@@ -10,8 +10,12 @@ const packageRoot = resolve(scriptRoot, '..');
 const sourceRunner = resolve(packageRoot, 'scripts', 'run-ts.mjs');
 const sourceEntry = resolve(packageRoot, 'src', 'verification.ts');
 const publishedEntry = resolve(packageRoot, 'dist', 'verification.js');
+const entrypointCheckOnly = process.env.TREESEED_VERIFY_ENTRYPOINT_CHECK === 'true';
 
 if (existsSync(sourceRunner) && existsSync(sourceEntry)) {
+	if (entrypointCheckOnly) {
+		process.exit(0);
+	}
 	const result = spawnSync(process.execPath, [sourceRunner, sourceEntry], {
 		cwd: process.cwd(),
 		env: process.env,
@@ -21,6 +25,9 @@ if (existsSync(sourceRunner) && existsSync(sourceEntry)) {
 }
 
 if (existsSync(publishedEntry)) {
+	if (entrypointCheckOnly) {
+		process.exit(0);
+	}
 	const { runTreeseedVerifyDriver } = await import('../dist/verification.js');
 	process.exit(runTreeseedVerifyDriver({ packageRoot: process.cwd() }));
 }