@treeseed/sdk 0.6.16 → 0.6.17

package/dist/operations/services/deploy.js

@@ -226,7 +226,7 @@ function resolveTargetPaths(tenantRoot, scopeOrTarget = "prod") {
     target,
     generatedRoot,
     wranglerPath: resolve(generatedRoot, "wrangler.toml"),
-    workerEntryPath: resolve(generatedRoot, "worker/index.js"),
+    workerEntryPath: resolve(tenantRoot, "dist/_worker.js/index.js"),
     statePath
   };
 }
@@ -314,6 +314,59 @@ function buildPublicVars(deployConfig) {
     TREESEED_WEB_CACHE_R2_STALE_IF_ERROR_SECONDS: String(webCachePolicy.r2PublishedObjects.staleIfErrorSeconds)
   };
 }
+function envValue(env, key) {
+  const value = env?.[key] ?? process.env[key];
+  return typeof value === "string" && value.trim() ? value.trim() : null;
+}
+const LOCAL_RUNTIME_AUTH_ENV_KEYS = [
+  "BETTER_AUTH_URL",
+  "TREESEED_SITE_URL",
+  "TREESEED_AUTH_MODE",
+  "TREESEED_AUTH_INTERNAL_SIGNUP",
+  "TREESEED_AUTH_EMAIL_LINKING",
+  "TREESEED_AUTH_ALLOW_MEMORY_DB",
+  "TREESEED_AUTH_LOCAL_USE_MAILPIT",
+  "TREESEED_AUTH_EMAIL_FROM",
+  "TREESEED_WEB_SESSION_TTL",
+  "TREESEED_API_BOOTSTRAP_ADMIN_ALLOWLIST",
+  "TREESEED_API_AUTH_SECRET",
+  "TREESEED_API_ISSUER",
+  "TREESEED_API_ACCESS_TOKEN_TTL",
+  "TREESEED_API_REFRESH_TOKEN_TTL",
+  "TREESEED_API_DEVICE_CODE_TTL",
+  "TREESEED_API_DEVICE_ACCESS_TOKEN_TTL",
+  "TREESEED_API_DEVICE_POLL_INTERVAL",
+  "TREESEED_API_WEB_EXCHANGE_TTL",
+  "TREESEED_GITHUB_CLIENT_ID",
+  "TREESEED_GITHUB_CLIENT_SECRET",
+  "TREESEED_GOOGLE_CLIENT_ID",
+  "TREESEED_GOOGLE_CLIENT_SECRET",
+  "TREESEED_MICROSOFT_CLIENT_ID",
+  "TREESEED_MICROSOFT_CLIENT_SECRET",
+  "TREESEED_APPLE_CLIENT_ID",
+  "TREESEED_APPLE_CLIENT_SECRET"
+];
+function localAuthRuntimeVars(env) {
+  return Object.fromEntries(
+    LOCAL_RUNTIME_AUTH_ENV_KEYS.map((key) => [key, envValue(env, key)]).filter(([, value]) => value != null)
+  );
+}
+function buildLocalRuntimeVars(deployConfig, state, target, env) {
+  if (target.kind !== "persistent" || target.scope !== "local") {
+    return {};
+  }
+  return {
+    ...localAuthRuntimeVars(env),
+    TREESEED_LOCAL_DEV_MODE: envValue(env, "TREESEED_LOCAL_DEV_MODE") ?? "cloudflare",
+    TREESEED_FORM_TOKEN_SECRET: envValue(env, "TREESEED_FORM_TOKEN_SECRET") ?? state.generatedSecrets?.TREESEED_FORM_TOKEN_SECRET ?? "treeseed-local-form-token-secret",
+    TREESEED_BETTER_AUTH_SECRET: envValue(env, "TREESEED_BETTER_AUTH_SECRET") ?? state.generatedSecrets?.TREESEED_BETTER_AUTH_SECRET ?? state.generatedSecrets?.TREESEED_FORM_TOKEN_SECRET ?? "treeseed-local-better-auth-secret-minimum-32-characters",
+    TREESEED_EDITORIAL_PREVIEW_SECRET: envValue(env, "TREESEED_EDITORIAL_PREVIEW_SECRET") ?? state.generatedSecrets?.TREESEED_EDITORIAL_PREVIEW_SECRET ?? "treeseed-local-editorial-preview-secret",
+    TREESEED_FORMS_LOCAL_BYPASS_CLOUDFLARE_GUARDS: envValue(env, "TREESEED_FORMS_LOCAL_BYPASS_CLOUDFLARE_GUARDS") ?? "",
+    TREESEED_FORMS_LOCAL_USE_MAILPIT: envValue(env, "TREESEED_FORMS_LOCAL_USE_MAILPIT") ?? "false",
+    TREESEED_MAILPIT_SMTP_HOST: envValue(env, "TREESEED_MAILPIT_SMTP_HOST") ?? "127.0.0.1",
+    TREESEED_MAILPIT_SMTP_PORT: envValue(env, "TREESEED_MAILPIT_SMTP_PORT") ?? "1025"
+  };
+}
 function buildSecretMap(deployConfig, state) {
   const generatedSecret = state.generatedSecrets?.TREESEED_FORM_TOKEN_SECRET ?? randomBytes(24).toString("hex");
   const previewSecret = state.generatedSecrets?.TREESEED_EDITORIAL_PREVIEW_SECRET ?? randomBytes(24).toString("hex");
@@ -344,12 +397,6 @@ function defaultStateFromConfig(deployConfig, target) {
         binding: "FORM_GUARD_KV",
         id: `dryrun-${suffix}-form-guard`,
         previewId: `dryrun-${suffix}-form-guard-preview`
-      },
-      SESSION: {
-        name: environmentScopedIdentityName(identity, "session", target),
-        binding: "SESSION",
-        id: `dryrun-${suffix}-session`,
-        previewId: `dryrun-${suffix}-session-preview`
       }
     },
     d1Databases: {
@@ -508,19 +555,13 @@ function loadDeployState(tenantRoot, deployConfig, options = {}) {
     workerName: defaults.workerName,
     kvNamespaces: {
       ...defaults.kvNamespaces,
-      ...persisted.kvNamespaces ?? {},
       FORM_GUARD_KV: {
         ...defaults.kvNamespaces.FORM_GUARD_KV,
         ...persisted.kvNamespaces?.FORM_GUARD_KV ?? {},
         name: defaults.kvNamespaces.FORM_GUARD_KV.name,
         binding: defaults.kvNamespaces.FORM_GUARD_KV.binding
       },
-      SESSION: {
-        ...defaults.kvNamespaces.SESSION,
-        ...persisted.kvNamespaces?.SESSION ?? {},
-        name: defaults.kvNamespaces.SESSION.name,
-        binding: defaults.kvNamespaces.SESSION.binding
-      }
+      ...persisted.kvNamespaces?.SESSION ? { SESSION: persisted.kvNamespaces.SESSION } : {}
     },
     d1Databases: {
       ...defaults.d1Databases,
@@ -685,10 +726,13 @@ function buildWranglerConfigContents(tenantRoot, deployConfig, state, options =
   const target = normalizeTarget(options.scope ?? options.target ?? state.target ?? "prod");
   const { generatedRoot } = resolveTargetPaths(tenantRoot, target);
   const workerName = state.workerName ?? targetWorkerName(deployConfig, target);
-  const mainPath = relativeFromGeneratedRoot(resolve(generatedRoot, "worker/index.js"), generatedRoot);
+  const mainPath = relativeFromGeneratedRoot(resolve(tenantRoot, "dist/_worker.js/index.js"), generatedRoot);
   const assetsDirectory = relativeFromGeneratedRoot(resolve(tenantRoot, "dist"), generatedRoot);
   const migrationsDir = relativeFromGeneratedRoot(resolve(tenantRoot, "migrations"), generatedRoot);
-  const vars = buildPublicVars(deployConfig);
+  const vars = {
+    ...buildPublicVars(deployConfig),
+    ...buildLocalRuntimeVars(deployConfig, state, target, options.env)
+  };
   const r2Config = deployConfig.cloudflare.r2;
   const r2Binding = resolveConfiguredContentBucketBinding(deployConfig);
   const r2BucketName = resolveConfiguredContentBucketName(deployConfig);
@@ -711,11 +755,6 @@ function buildWranglerConfigContents(tenantRoot, deployConfig, state, options =
     `id = ${renderTomlString(state.kvNamespaces.FORM_GUARD_KV.id)}`,
     `preview_id = ${renderTomlString(state.kvNamespaces.FORM_GUARD_KV.previewId ?? state.kvNamespaces.FORM_GUARD_KV.id)}`,
     "",
-    "[[kv_namespaces]]",
-    'binding = "SESSION"',
-    `id = ${renderTomlString(state.kvNamespaces.SESSION.id)}`,
-    `preview_id = ${renderTomlString(state.kvNamespaces.SESSION.previewId ?? state.kvNamespaces.SESSION.id)}`,
-    "",
     "[[d1_databases]]",
     'binding = "SITE_DATA_DB"',
     `database_name = ${renderTomlString(state.d1Databases.SITE_DATA_DB.databaseName)}`,
@@ -737,7 +776,7 @@ function ensureGeneratedWranglerConfig(tenantRoot, options = {}) {
   const state = loadDeployState(tenantRoot, deployConfig, { target });
   const { wranglerPath } = resolveTargetPaths(tenantRoot, target);
   const manifestFingerprint = stableHash(JSON.stringify({ deployConfig, targetKey: targetKey(target) }));
-  const contents = buildWranglerConfigContents(tenantRoot, deployConfig, state, { target });
+  const contents = buildWranglerConfigContents(tenantRoot, deployConfig, state, { target, env: options.env });
   ensureParent(wranglerPath);
   writeFileSync(wranglerPath, contents, "utf8");
   state.lastManifestFingerprint = manifestFingerprint;
@@ -887,7 +926,7 @@ function buildProvisioningSummary(deployConfig, state, target) {
     accountId: resolveConfiguredCloudflareAccountId(deployConfig),
     pages: state.pages ?? null,
     formGuardKv: state.kvNamespaces.FORM_GUARD_KV,
-    sessionKv: state.kvNamespaces.SESSION,
+    sessionKv: state.kvNamespaces.SESSION ?? null,
     siteDataDb: state.d1Databases.SITE_DATA_DB,
     queue: state.queues?.agentWork ?? null,
     content: state.content ?? null,
@@ -898,7 +937,6 @@ function buildProvisioningSummary(deployConfig, state, target) {
       dlq: state.queues?.agentWork?.dlqName ?? null,
       database: state.d1Databases?.SITE_DATA_DB?.databaseName ?? null,
       formGuardKv: state.kvNamespaces?.FORM_GUARD_KV?.name ?? null,
-      sessionKv: state.kvNamespaces?.SESSION?.name ?? null,
       railwayProject: state.services?.worker?.projectName ?? state.services?.api?.projectName ?? null,
       webDomain: configuredWebDomain,
       apiDomain: configuredApiDomain,
@@ -1254,7 +1292,7 @@ function queueId(entry) {
 }
 function hasProvisionedCloudflareResources(state) {
   return Boolean(
-    state?.pages?.projectName && state?.pages?.url && state?.d1Databases?.SITE_DATA_DB?.databaseId && state?.kvNamespaces?.FORM_GUARD_KV?.id && state?.kvNamespaces?.SESSION?.id && state?.queues?.agentWork?.name && state?.content?.bucketName
+    state?.pages?.projectName && state?.pages?.url && state?.d1Databases?.SITE_DATA_DB?.databaseId && state?.kvNamespaces?.FORM_GUARD_KV?.id && state?.queues?.agentWork?.name && state?.content?.bucketName
   );
 }
 function absoluteUrlForPath(baseUrl, path) {
@@ -1593,11 +1631,13 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
     state.kvNamespaces.FORM_GUARD_KV.name,
     state.kvNamespaces.FORM_GUARD_KV.id
   );
-  state.kvNamespaces.SESSION.id = resolveExistingKvIdByName(
-    kvNamespaces,
-    state.kvNamespaces.SESSION.name,
-    state.kvNamespaces.SESSION.id
-  );
+  if (state.kvNamespaces.SESSION?.name) {
+    state.kvNamespaces.SESSION.id = resolveExistingKvIdByName(
+      kvNamespaces,
+      state.kvNamespaces.SESSION.name,
+      state.kvNamespaces.SESSION.id
+    );
+  }
   state.d1Databases.SITE_DATA_DB = resolveExistingD1ByName(
     d1Databases,
     state.d1Databases.SITE_DATA_DB.databaseName,
@@ -1606,8 +1646,8 @@ function destroyCloudflareResources(tenantRoot, options = {}) {
   const worker = deleteWorker(tenantRoot, state.workerName, { env, dryRun, force });
   const formGuard = deleteKvNamespace(tenantRoot, state.kvNamespaces.FORM_GUARD_KV.id, { env, dryRun });
   const formGuardPreview = state.kvNamespaces.FORM_GUARD_KV.previewId && state.kvNamespaces.FORM_GUARD_KV.previewId !== state.kvNamespaces.FORM_GUARD_KV.id ? deleteKvNamespace(tenantRoot, state.kvNamespaces.FORM_GUARD_KV.previewId, { env, dryRun, preview: true }) : null;
-  const session = deleteKvNamespace(tenantRoot, state.kvNamespaces.SESSION.id, { env, dryRun });
-  const sessionPreview = state.kvNamespaces.SESSION.previewId && state.kvNamespaces.SESSION.previewId !== state.kvNamespaces.SESSION.id ? deleteKvNamespace(tenantRoot, state.kvNamespaces.SESSION.previewId, { env, dryRun, preview: true }) : null;
+  const session = state.kvNamespaces.SESSION?.id ? deleteKvNamespace(tenantRoot, state.kvNamespaces.SESSION.id, { env, dryRun }) : null;
+  const sessionPreview = state.kvNamespaces.SESSION?.previewId && state.kvNamespaces.SESSION.previewId !== state.kvNamespaces.SESSION.id ? deleteKvNamespace(tenantRoot, state.kvNamespaces.SESSION.previewId, { env, dryRun, preview: true }) : null;
   const database = deleteD1Database(tenantRoot, state.d1Databases.SITE_DATA_DB.databaseName, { env, dryRun });
   return {
     target,
@@ -1820,7 +1860,6 @@ function provisionCloudflareResources(tenantRoot, options = {}) {
     current.url = `https://${current.projectName}.pages.dev`;
   };
   ensureKv("FORM_GUARD_KV");
-  ensureKv("SESSION");
   ensureD1();
   ensureQueue();
   ensureR2Bucket();
@@ -1897,7 +1936,6 @@ function verifyProvisionedCloudflareResources(tenantRoot, options = {}) {
   const checks = {
     pages: Boolean(state.pages?.projectName && pagesProjects.find((entry) => entry?.name === state.pages.projectName)),
     formGuardKv: Boolean(state.kvNamespaces?.FORM_GUARD_KV?.name && kvNamespaces.find((entry) => entry?.title === state.kvNamespaces.FORM_GUARD_KV.name)),
-    sessionKv: Boolean(state.kvNamespaces?.SESSION?.name && kvNamespaces.find((entry) => entry?.title === state.kvNamespaces.SESSION.name)),
     d1: Boolean(state.d1Databases?.SITE_DATA_DB?.databaseName && d1Databases.find((entry) => entry?.name === state.d1Databases.SITE_DATA_DB.databaseName)),
     queue: Boolean(state.queues?.agentWork?.name && queues.find((entry) => queueName(entry) === state.queues.agentWork.name)),
     dlq: !state.queues?.agentWork?.dlqName || Boolean(queues.find((entry) => queueName(entry) === state.queues.agentWork.dlqName)),
@@ -2078,7 +2116,6 @@ function printDeploySummary(summary) {
   console.log(`  Account ID: ${summary.accountId}`);
   console.log(`  D1: ${summary.siteDataDb.databaseName} (${summary.siteDataDb.databaseId})`);
   console.log(`  KV FORM_GUARD_KV: ${summary.formGuardKv.id}`);
-  console.log(`  KV SESSION: ${summary.sessionKv.id}`);
 }
 function printDestroySummary(result) {
   const { summary, operations } = result;
@@ -2092,7 +2129,9 @@ function printDestroySummary(result) {
   if (operations.formGuardPreview) {
     console.log(`  KV FORM_GUARD_KV preview -> ${operations.formGuardPreview.status}`);
   }
-  console.log(`  KV SESSION: ${summary.sessionKv.name} -> ${operations.session.status}`);
+  if (summary.sessionKv && operations.session) {
+    console.log(`  KV SESSION (deprecated): ${summary.sessionKv.name} -> ${operations.session.status}`);
+  }
   if (operations.sessionPreview) {
     console.log(`  KV SESSION preview -> ${operations.sessionPreview.status}`);
   }

package/dist/operations/services/github-actions-verification.d.ts

@@ -0,0 +1,123 @@
+import { type GitHubApiClient } from './github-api.ts';
+export type GitHubActionsWorkflowState = 'success' | 'failure' | 'pending' | 'missing' | 'not_pushed' | 'error';
+export type GitHubActionsVerificationTarget = {
+    name: string;
+    repoPath: string;
+    repository: string | null;
+    branch: string | null;
+    headSha: string | null;
+    workflows: string[];
+    kind?: 'root' | 'package';
+};
+export type GitHubActionsWorkflowGate = {
+    name: string;
+    repoPath: string;
+    repository?: string;
+    workflow: string;
+    branch: string;
+    headSha: string;
+};
+export type GitHubActionsWorkflowJobStep = {
+    name: string;
+    number: number | null;
+    status: string | null;
+    conclusion: string | null;
+    startedAt: string | null;
+    completedAt: string | null;
+};
+export type GitHubActionsWorkflowJob = {
+    id: number;
+    name: string;
+    status: string | null;
+    conclusion: string | null;
+    url: string | null;
+    steps: GitHubActionsWorkflowJobStep[];
+    failedSteps: GitHubActionsWorkflowJobStep[];
+    logExcerpt?: string | null;
+};
+export type GitHubActionsWorkflowRunInspection = {
+    workflow: string;
+    state: GitHubActionsWorkflowState;
+    status: string | null;
+    conclusion: string | null;
+    runId: number | null;
+    url: string | null;
+    headSha: string | null;
+    branch: string | null;
+    createdAt: string | null;
+    updatedAt: string | null;
+    jobs: GitHubActionsWorkflowJob[];
+    failedJobs: GitHubActionsWorkflowJob[];
+    inspectCommand: string | null;
+    message: string | null;
+};
+export type GitHubActionsRepositoryInspection = {
+    name: string;
+    repoPath: string;
+    repository: string | null;
+    kind: 'root' | 'package';
+    branch: string | null;
+    headSha: string | null;
+    remoteHeadSha: string | null;
+    remoteSynced: boolean;
+    state: GitHubActionsWorkflowState;
+    message: string | null;
+    workflows: GitHubActionsWorkflowRunInspection[];
+};
+export type GitHubActionsVerificationFailure = {
+    type: 'repository' | 'workflow' | 'job';
+    repository: string | null;
+    repoName: string;
+    workflow: string | null;
+    runId: number | null;
+    jobId: number | null;
+    jobName: string | null;
+    state: GitHubActionsWorkflowState;
+    conclusion: string | null;
+    url: string | null;
+    inspectCommand: string | null;
+    message: string;
+    failedSteps: GitHubActionsWorkflowJobStep[];
+    logExcerpt?: string | null;
+};
+export type GitHubActionsVerificationSummary = {
+    repositories: number;
+    workflows: number;
+    success: number;
+    failure: number;
+    pending: number;
+    missing: number;
+    notPushed: number;
+    error: number;
+    failures: number;
+};
+export type GitHubActionsVerificationReport = {
+    checkedAt: string;
+    repositories: GitHubActionsRepositoryInspection[];
+    failures: GitHubActionsVerificationFailure[];
+    summary: GitHubActionsVerificationSummary;
+};
+type GitHubActionsVerificationOptions = {
+    client?: GitHubApiClient;
+    includeLogs?: boolean;
+    logLines?: number;
+};
+export declare function inspectGitHubActionsVerification(targets: GitHubActionsVerificationTarget[], { client, includeLogs, logLines, }?: GitHubActionsVerificationOptions): Promise<GitHubActionsVerificationReport>;
+export declare function skippedGitHubActionsGate(gate: GitHubActionsWorkflowGate, reason: string): {
+    name: string;
+    repository: string | null;
+    workflow: string;
+    branch: string;
+    headSha: string;
+    status: string;
+    reason: string;
+    conclusion: null;
+    runId: null;
+    url: null;
+};
+export declare function formatGitHubActionsGateFailure(gate: GitHubActionsWorkflowGate, result: Record<string, unknown>): string;
+export declare function waitForGitHubActionsGate(gate: GitHubActionsWorkflowGate, options?: {
+    timeoutSeconds?: number;
+    pollSeconds?: number;
+}): Promise<Record<string, unknown>>;
+export {};