@treeseed/sdk 0.6.7 → 0.6.8

package/dist/reconcile/builtin-adapters.js

@@ -325,6 +325,31 @@ function ensureCloudflareDnsRecord(env, zoneId, record) {
     }
   })?.result ?? null;
 }
+function unquoteDnsTxtContent(value) {
+  const trimmed = value.trim();
+  return trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"') ? trimmed.slice(1, -1) : trimmed;
+}
+function dnsRecordContentMatches(actual, expected, type) {
+  const actualText = String(actual ?? "");
+  const expectedText = String(expected ?? "");
+  if (String(type ?? "").toUpperCase() === "TXT") {
+    return unquoteDnsTxtContent(actualText) === unquoteDnsTxtContent(expectedText);
+  }
+  return actualText === expectedText;
+}
+function dnsRecordProxiedMatches(actual, expected) {
+  return expected.proxied === void 0 || Boolean(actual?.proxied) === Boolean(expected.proxied);
+}
+function dnsRecordIdentityMatches(actual, expected) {
+  return actual?.name === expected.name && String(actual?.type ?? "").toUpperCase() === expected.type;
+}
+function dnsRecordMatches(actual, expected) {
+  return Boolean(actual) && dnsRecordIdentityMatches(actual, expected) && dnsRecordContentMatches(actual?.content, expected.content, expected.type) && dnsRecordProxiedMatches(actual, expected);
+}
+function dnsRecordsFromCurrentResult(input) {
+  const records = input.result?.state?.records;
+  return Array.isArray(records) ? records.filter((entry) => Boolean(entry) && typeof entry === "object") : [];
+}
 function getCloudflarePagesDomain(env, projectName, domain) {
   const accountId = env.CLOUDFLARE_ACCOUNT_ID;
   if (!accountId) {
@@ -1600,7 +1625,7 @@ function observeDnsRecordUnit(input) {
     (record) => listCloudflareDnsRecords(env, zoneId, record.name).find((entry) => entry?.name === record.name && entry?.type === record.type) ?? null
   ) : [];
   const matches = desiredRecords.length > 0 && liveRecords.every(
-    (entry, index) => Boolean(entry) && entry?.content === desiredRecords[index]?.content && (desiredRecords[index]?.proxied === void 0 || Boolean(entry?.proxied) === Boolean(desiredRecords[index]?.proxied))
+    (entry, index) => dnsRecordMatches(entry, desiredRecords[index])
   );
   return {
     exists: desiredRecords.length > 0 && liveRecords.every(Boolean),
@@ -1673,14 +1698,19 @@ function verifyDnsRecordUnit(input) {
     ]);
   }
   const checks = desiredRecords.map((record, index) => {
-    const live = listCloudflareDnsRecords(env, zoneId, record.name).find((entry) => entry?.name === record.name && entry?.type === record.type) ?? null;
-    const proxiedMatches = record.proxied === void 0 ? true : Boolean(live?.proxied) === Boolean(record.proxied);
+    const live = listCloudflareDnsRecords(env, zoneId, record.name).find((entry) => dnsRecordIdentityMatches(entry, record)) ?? null;
+    const reconciled = dnsRecordsFromCurrentResult(input).find(
+      (entry) => dnsRecordIdentityMatches(entry, record)
+    ) ?? null;
+    const effective = dnsRecordMatches(live, record) ? live : reconciled ?? live;
+    const contentMatches = dnsRecordContentMatches(effective?.content, record.content, record.type);
+    const proxiedMatches = dnsRecordProxiedMatches(effective, record);
     return verificationCheck(`dns-record:${index + 1}`, `DNS record ${record.type} ${record.name} matches the desired value`, "api", {
-      exists: Boolean(live?.id),
-      configured: live?.content === record.content && proxiedMatches,
+      exists: Boolean(effective?.id),
+      configured: contentMatches && proxiedMatches,
       expected: `${record.type} ${record.name} -> ${record.content}${record.proxied === void 0 ? "" : ` proxied=${record.proxied}`}`,
-      observed: live ? `${live.type} ${live.name} -> ${live.content}${typeof live.proxied === "boolean" ? ` proxied=${live.proxied}` : ""}` : null,
-      issues: live?.id ? live.content === record.content && proxiedMatches ? [] : [`DNS record ${record.name} does not match the expected value.`] : [`DNS record ${record.type} ${record.name} is missing.`]
+      observed: effective ? `${effective.type} ${effective.name} -> ${effective.content}${typeof effective.proxied === "boolean" ? ` proxied=${effective.proxied}` : ""}` : null,
+      issues: effective?.id ? contentMatches && proxiedMatches ? [] : [`DNS record ${record.name} does not match the expected value.`] : [`DNS record ${record.type} ${record.name} is missing.`]
     });
   });
   return summarizeVerification(input.unit.unitId, checks);

package/dist/scripts/cleanup-markdown.js

@@ -336,6 +336,10 @@ async function runCli(argv = process.argv.slice(2)) {
     const mode = args.check ? 'check' : 'write';
     const targets = await collectMarkdownTargets(args.targets);
     if (targets.length === 0) {
+        if (mode === 'check') {
+            console.log('No Markdown files found for cleanup.');
+            return 0;
+        }
         console.error('No Markdown files found for cleanup.');
         return 1;
     }

package/dist/scripts/publish-package.js

@@ -3,6 +3,11 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)));
 const extraArgs = process.argv.slice(2);
+const tagName = process.env.GITHUB_REF_NAME;
+if (tagName && !/^\d+\.\d+\.\d+$/.test(tagName)) {
+    console.error(`Refusing to publish @treeseed/sdk from non-stable tag "${tagName}".`);
+    process.exit(1);
+}
 const npmArgs = ['publish', '.', '--access', 'public'];
 if (process.env.GITHUB_ACTIONS === 'true') {
     npmArgs.push('--provenance');

package/dist/scripts/tenant-workflow-action.js

@@ -75,7 +75,16 @@ async function main() {
         process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
     }
 }
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+function isCliEntrypoint() {
+    if (!process.argv[1]) {
+        return false;
+    }
+    if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+        return true;
+    }
+    return /(?:^|\/)tenant-workflow-action\.(?:ts|js)$/u.test(process.argv[1]);
+}
+if (isCliEntrypoint()) {
     await main();
 }
-export { parseArgs };
+export { isCliEntrypoint, parseArgs };

package/dist/verification.js

@@ -3,6 +3,8 @@ import * as childProcess from "node:child_process";
 import { basename, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { createTreeseedManagedToolEnv, resolveTreeseedToolBinary } from "./managed-dependencies.js";
+const defaultActUbuntuLatestImage = "catthehacker/ubuntu:act-latest";
 function defaultWrite(message, stream = "stdout") {
   if (!message) return;
   (stream === "stderr" ? process.stderr : process.stdout).write(`${message}
@@ -11,7 +13,7 @@ function defaultWrite(message, stream = "stdout") {
 function run(command, args, cwd) {
   const result = childProcess.spawnSync(command, args, {
     cwd,
-    env: process.env,
+    env: createTreeseedManagedToolEnv(process.env),
     stdio: "inherit"
   });
   return result.status ?? 1;
@@ -19,7 +21,7 @@ function run(command, args, cwd) {
 function check(command, args, cwd) {
   const result = childProcess.spawnSync(command, args, {
     cwd,
-    env: process.env,
+    env: createTreeseedManagedToolEnv(process.env),
     stdio: "pipe",
     encoding: "utf8"
   });
@@ -39,6 +41,14 @@ function readPackageManifest(packageJsonPath) {
     return null;
   }
 }
+function createActArgs(eventName, workflowPath) {
+  const image = process.env.TREESEED_VERIFY_ACT_UBUNTU_LATEST_IMAGE?.trim() || defaultActUbuntuLatestImage;
+  const args = ["act", eventName, "-W", workflowPath, "-j", "verify"];
+  if (image) {
+    args.push("-P", `ubuntu-latest=${image}`);
+  }
+  return args;
+}
 function createWorkspaceActWorkflow(options) {
   const relativePackageRoot = relative(options.workspaceRoot, options.packageRoot).replace(/\\/g, "/");
   const siblingPreparationCommands = options.localTreeseedSiblingDependencies.map((packageName) => {
@@ -49,9 +59,9 @@ function createWorkspaceActWorkflow(options) {
     }
     const commands = [
       `if test -f ${packageDir}/package-lock.json; then`,
-      `  npm --prefix ${packageDir} ci`,
+      `  npm --prefix ${packageDir} ci --workspaces=false`,
       "else",
-      `  npm --prefix ${packageDir} install --no-audit --no-fund`,
+      `  npm --prefix ${packageDir} install --workspaces=false --no-audit --no-fund`,
       "fi"
     ];
     if (manifest.scripts?.["build:dist"]) {
@@ -102,9 +112,9 @@ ${siblingPreparationCommands.split("\n").map((line) => `          ${line}`).join
 ` : ""}      - name: Install dependencies
         run: |
           if test -f package-lock.json; then
-            npm ci
+            npm ci --workspaces=false
           else
-            npm install --no-audit --no-fund
+            npm install --workspaces=false --no-audit --no-fund
           fi
 
       - name: Verify package
@@ -114,7 +124,7 @@ ${siblingPreparationCommands.split("\n").map((line) => `          ${line}`).join
   );
   return {
     cwd: options.workspaceRoot,
-    args: ["act", options.eventName, "-W", workflowPath, "-j", "verify"]
+    args: createActArgs(options.eventName, workflowPath)
   };
 }
 function findWorkspaceRoot(packageRoot) {
@@ -186,7 +196,8 @@ function getTreeseedVerifyDriverStatus(options = {}) {
   const workflowPresent = existsSync(workflowPath);
   const workspace = resolveLocalWorkspaceContext(packageRoot);
   const checkCommand = options.checkCommand ?? check;
-  const ghAct = checkCommand("gh", ["act", "--version"], packageRoot);
+  const gh = options.checkCommand ? "gh" : resolveTreeseedToolBinary("gh") ?? "gh";
+  const ghAct = checkCommand(gh, ["act", "--version"], packageRoot);
   const docker = checkCommand("docker", ["info"], packageRoot);
   const prefersDirectForLocalWorkspace = !inGitHubActions && driver === "auto" && workspace.localTreeseedSiblingDependencies.length > 0;
   return {
@@ -211,6 +222,7 @@ function runTreeseedVerifyDriver(options = {}) {
   const status = getTreeseedVerifyDriverStatus(options);
   const runCommand = options.runCommand ?? run;
   const checkCommand = options.checkCommand ?? check;
+  const gh = options.runCommand || options.checkCommand ? "gh" : resolveTreeseedToolBinary("gh") ?? "gh";
   if (status.driver === "direct" || status.inGitHubActions) {
     return runCommand("npm", ["run", "verify:direct"], status.packageRoot);
   }
@@ -220,7 +232,7 @@ function runTreeseedVerifyDriver(options = {}) {
       return 1;
     }
     if (!status.ghActAvailable) {
-      const detail = checkCommand("gh", ["act", "--version"], status.packageRoot).detail;
+      const detail = checkCommand(gh, ["act", "--version"], status.packageRoot).detail;
       write(detail || "Treeseed verify requires `gh act` when TREESEED_VERIFY_DRIVER=act.", "stderr");
       return 1;
     }
@@ -236,15 +248,15 @@ function runTreeseedVerifyDriver(options = {}) {
         eventName: status.eventName,
         localTreeseedSiblingDependencies: status.localTreeseedSiblingDependencies
       });
-      return runCommand("gh", workspaceAct.args, workspaceAct.cwd);
+      return runCommand(gh, workspaceAct.args, workspaceAct.cwd);
     }
-    return runCommand("gh", ["act", status.eventName, "-W", ".github/workflows/verify.yml", "-j", "verify"], status.packageRoot);
+    return runCommand(gh, createActArgs(status.eventName, ".github/workflows/verify.yml"), status.packageRoot);
   }
   if (status.prefersDirectForLocalWorkspace) {
     return runCommand("npm", ["run", "verify:direct"], status.packageRoot);
   }
   if (status.canUseAct) {
-    return runCommand("gh", ["act", status.eventName, "-W", ".github/workflows/verify.yml", "-j", "verify"], status.packageRoot);
+    return runCommand(gh, createActArgs(status.eventName, ".github/workflows/verify.yml"), status.packageRoot);
   }
   if (!status.workflowPresent) {
     write("Treeseed verify warning: package-local verify workflow is missing; falling back to verify:direct.", "stderr");