@automattic/vip 4.1.5 → 4.1.8

package/internal/edgeworkers/api_test.go

@@ -1,256 +0,0 @@
-package edgeworkers
-
-import (
-	"bytes"
-	"context"
-	json "encoding/json/v2"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"reflect"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/Automattic/vip/internal/gql"
-	"github.com/Automattic/vip/internal/keychain"
-	"github.com/Automattic/vip/internal/rechallenge"
-	"github.com/Khan/genqlient/graphql"
-)
-
-type edgeMemoryKeychain struct{ value string }
-
-func (m *edgeMemoryKeychain) Set(_, _, value string) error { m.value = value; return nil }
-func (m *edgeMemoryKeychain) Get(string, string) (string, error) {
-	if m.value == "" {
-		return "", keychain.ErrNotFound
-	}
-	return m.value, nil
-}
-func (m *edgeMemoryKeychain) Delete(string, string) error { m.value = ""; return nil }
-
-func TestAPICreateRechallengeReplaysOnceAndCachesByOperation(t *testing.T) {
-	for _, key := range []string{"VIP_PROXY", "vip_proxy", "SOCKS_PROXY", "socks_proxy", "HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy", "NO_PROXY", "no_proxy", "VIP_USE_SYSTEM_PROXY"} {
-		t.Setenv(key, "")
-	}
-	var srv *httptest.Server
-	calls := 0
-	sessionCalls := 0
-	opened := 0
-	var bodies [][]byte
-	var headers []string
-	srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		expires := time.Now().Add(time.Hour).Format(time.RFC3339)
-		switch r.URL.Path {
-		case "/sessions":
-			sessionCalls++
-			fmt.Fprintf(w, `{"challengeId":"c1","status":"pending","verificationUrl":"%s/verify","pollIntervalSeconds":1,"expiresAt":"%s"}`, srv.URL, expires)
-		case "/sessions/c1":
-			fmt.Fprintf(w, `{"challengeId":"c1","status":"verified","expiresAt":"%s","pollIntervalSeconds":1,"provider":"passkeys"}`, expires)
-		case "/sessions/c1/exchange":
-			fmt.Fprintf(w, `{"elevatedToken":{"token":"fixture-elevated","expiresAt":"%s","purpose":"createEdgeWorker"}}`, expires)
-		case "/graphql":
-			calls++
-			body, _ := io.ReadAll(r.Body)
-			bodies = append(bodies, body)
-			headers = append(headers, r.Header.Get("x-elevated-token"))
-			if calls == 1 {
-				fmt.Fprintf(w, `{"errors":[{"message":"elevation required","extensions":{"code":"elevated-permission-required","rechallenge":{"version":"v2","createSessionPath":"%s/sessions","statusPathTemplate":"%s/sessions/{challengeId}","exchangePathTemplate":"%s/sessions/{challengeId}/exchange","elevatedHeaderName":"x-elevated-token"}}}]}`, srv.URL, srv.URL, srv.URL)
-				return
-			}
-			fmt.Fprint(w, `{"data":{"createEdgeWorker":`+workerJSON+`}}`)
-		default:
-			t.Errorf("unexpected path %s", r.URL.Path)
-			http.Error(w, "unexpected", 400)
-		}
-	}))
-	defer srv.Close()
-	cache := &rechallenge.TokenCache{Keychain: &keychain.Keychain{Backend: &edgeMemoryKeychain{}, Service: "test-only"}}
-	runner := &rechallenge.Runner{Client: &rechallenge.Client{APIHost: srv.URL, HTTP: srv.Client()}, TokenCache: cache, Stdout: io.Discard, OpenURL: func(string) { opened++ }, Sleep: func(context.Context, time.Duration) error { return nil }}
-	client := gql.HTTPClientWithMiddleware(srv.URL, "fixture-token", []gql.Middleware{gql.NewErrorMiddleware(gql.ErrorConfig{ExitOnError: true, Exit: func(int) { t.Error("global exit on handled error") }, Stderr: io.Discard}), gql.NewRechallengeMiddleware(gql.RechallengeConfig{TokenCache: cache, Runner: runner, Interactive: func() bool { return true }, Stderr: io.Discard}), gql.NewRetryMiddleware(gql.RetryConfig{MaxAttempts: 3, NoDelay: true})})
-	api := APIClient{Client: graphql.NewClient(srv.URL+"/graphql", client)}
-	for i := 0; i < 2; i++ {
-		if _, err := api.Create(context.Background(), 7, WriteInput{Name: "headers", WASMBinary: "AGFzbQ=="}); err != nil {
-			t.Fatal(err)
-		}
-	}
-	if calls != 3 || sessionCalls != 1 || opened != 1 || !bytes.Equal(bodies[0], bodies[1]) || !reflect.DeepEqual(headers, []string{"", "fixture-elevated", "fixture-elevated"}) {
-		t.Fatalf("calls=%d sessions=%d opened=%d headers=%v", calls, sessionCalls, opened, headers)
-	}
-	if token, _ := cache.Get("updateEdgeWorker"); token != nil {
-		t.Fatal("elevated token leaked to another operation")
-	}
-}
-
-const workerJSON = `{"id":9,"name":"headers","location":null,"phases":["client_response"],"onFailure":"continue","active":false,"createdAt":"2026-08-28T00:00:00.000Z","updatedAt":"2026-08-28T00:00:00.000Z","source":""}`
-
-type apiRequest struct {
-	Operation string         `json:"operationName"`
-	Query     string         `json:"query"`
-	Variables map[string]any `json:"variables"`
-}
-
-func testAPI(t *testing.T, body string) (APIClient, *[]apiRequest) {
-	t.Helper()
-	requests := []apiRequest{}
-	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		var req apiRequest
-		if err := json.UnmarshalRead(r.Body, &req); err != nil {
-			t.Error(err)
-		}
-		requests = append(requests, req)
-		w.Header().Set("Content-Type", "application/json")
-		fmt.Fprint(w, body)
-	}))
-	t.Cleanup(srv.Close)
-	return APIClient{Client: graphql.NewClient(srv.URL, srv.Client())}, &requests
-}
-
-func TestAPIReadsPreserveFieldsAndLimitSource(t *testing.T) {
-	for _, mode := range []string{"list", "get", "source"} {
-		t.Run(mode, func(t *testing.T) {
-			api, requests := testAPI(t, `{"data":{"app":{"environments":[{"id":7,"edgeWorkers":[`+workerJSON+`]}]}}}`)
-			var worker Worker
-			if mode == "list" {
-				workers, err := api.List(context.Background(), 42, 7)
-				if err != nil {
-					t.Fatal(err)
-				}
-				worker = workers[0]
-			} else {
-				w, err := api.Get(context.Background(), 42, 7, "headers", mode == "source")
-				if err != nil || w == nil {
-					t.Fatalf("%v %v", w, err)
-				}
-				worker = *w
-			}
-			if worker.ID != 9 || worker.Active || worker.CreatedAt != "2026-08-28T00:00:00.000Z" || !reflect.DeepEqual(worker.Phases, []string{"client_response"}) {
-				t.Fatalf("worker: %#v", worker)
-			}
-			if mode == "source" && (worker.Source == nil || *worker.Source != "") {
-				t.Fatalf("empty source lost: %#v", worker)
-			}
-			if len(*requests) != 1 {
-				t.Fatalf("requests: %v", *requests)
-			}
-			req := (*requests)[0]
-			if !strings.Contains(req.Query, "environments(id: $envId)") || req.Variables["appId"] != float64(42) || req.Variables["envId"] != float64(7) {
-				t.Fatalf("request: %#v", req)
-			}
-			if strings.Contains(req.Query, "wasmBinary") || strings.Contains(req.Query, "source") != (mode == "source") {
-				t.Fatalf("excessive fields: %s", req.Query)
-			}
-		})
-	}
-}
-
-func TestAPIReadEnvelopes(t *testing.T) {
-	for _, body := range []string{`{"data":null}`, `{"data":{"app":null}}`, `{"data":{"app":{"environments":[]}}}`, `{"data":{"app":{"environments":[null]}}}`, `{"data":{"app":{"environments":[{"edgeWorkers":null}]}}}`, `{"data":{"app":{"environments":[{"edgeWorkers":{}}]}}}`, `not json`} {
-		for _, mode := range []string{"list", "get", "source"} {
-			api, _ := testAPI(t, body)
-			var err error
-			if mode == "list" {
-				_, err = api.List(context.Background(), 42, 7)
-			} else {
-				_, err = api.Get(context.Background(), 42, 7, "headers", mode == "source")
-			}
-			if err == nil {
-				t.Fatalf("%s accepted %s", mode, body)
-			}
-		}
-	}
-	api, _ := testAPI(t, `{"data":{"app":{"environments":[{"edgeWorkers":[]}]}}}`)
-	workers, err := api.List(context.Background(), 42, 7)
-	if err != nil || workers == nil || len(workers) != 0 {
-		t.Fatalf("empty list: %v %v", workers, err)
-	}
-	worker, err := api.Get(context.Background(), 42, 7, "missing", false)
-	if err != nil || worker != nil {
-		t.Fatalf("missing: %v %v", worker, err)
-	}
-}
-
-func TestAPIMutationPayloads(t *testing.T) {
-	empty := ""
-	input := WriteInput{Name: "headers", WASMBinary: "AGFzbQ==", Source: &empty, Location: LocationValue{Present: true}}
-	for _, tc := range []struct {
-		field, operation string
-		call             func(APIClient) error
-		want             map[string]any
-	}{
-		{"createEdgeWorker", "CreateEdgeWorker", func(a APIClient) error { _, err := a.Create(context.Background(), 7, input); return err }, map[string]any{"environmentId": float64(7), "name": "headers", "wasmBinary": "AGFzbQ==", "source": ""}},
-		{"updateEdgeWorker", "UpdateEdgeWorker", func(a APIClient) error { _, err := a.Update(context.Background(), 7, 9, input); return err }, map[string]any{"environmentId": float64(7), "edgeWorkerId": float64(9), "name": "headers", "wasmBinary": "AGFzbQ==", "source": "", "location": nil}},
-		{"setEdgeWorkerActive", "SetEdgeWorkerActive", func(a APIClient) error { _, err := a.SetActive(context.Background(), 7, 9, false); return err }, map[string]any{"environmentId": float64(7), "edgeWorkerId": float64(9), "active": false}},
-		{"deleteEdgeWorker", "DeleteEdgeWorker", func(a APIClient) error { return a.Delete(context.Background(), 7, 9) }, map[string]any{"environmentId": float64(7), "edgeWorkerId": float64(9)}},
-		{"validateEdgeWorker", "ValidateEdgeWorker", func(a APIClient) error {
-			result, err := a.Validate(context.Background(), 7, "AGFzbQ==")
-			if err == nil && (result.Valid || !reflect.DeepEqual(result.Errors, []string{"invalid"})) {
-				t.Errorf("result: %#v", result)
-			}
-			return err
-		}, map[string]any{"environmentId": float64(7), "wasmBinary": "AGFzbQ=="}},
-	} {
-		t.Run(tc.operation, func(t *testing.T) {
-			result := workerJSON
-			if tc.field == "deleteEdgeWorker" {
-				result = "true"
-			}
-			if tc.field == "validateEdgeWorker" {
-				result = `{"valid":false,"phases":[],"errors":["invalid"]}`
-			}
-			api, requests := testAPI(t, `{"data":{"`+tc.field+`":`+result+`}}`)
-			if err := tc.call(api); err != nil {
-				t.Fatal(err)
-			}
-			if len(*requests) != 1 || (*requests)[0].Operation != tc.operation || !reflect.DeepEqual((*requests)[0].Variables["input"], tc.want) {
-				t.Fatalf("requests: %#v", *requests)
-			}
-			for _, bad := range []string{`{"data":null}`, `{"data":{"` + tc.field + `":null}}`, `{"errors":[{"message":"denied"}]}`} {
-				a, _ := testAPI(t, bad)
-				if err := tc.call(a); err == nil {
-					t.Errorf("accepted %s", bad)
-				}
-			}
-		})
-	}
-	a, _ := testAPI(t, `{"data":{"deleteEdgeWorker":false}}`)
-	if err := a.Delete(context.Background(), 7, 9); err == nil || err.Error() != "deleteEdgeWorker did not confirm deletion." {
-		t.Fatalf("delete: %v", err)
-	}
-}
-
-func TestAPIErrorMiddlewareAndNoMutationRetry(t *testing.T) {
-	// Exercise the real middleware without routing our local fixture through a user's proxy.
-	for _, key := range []string{"VIP_PROXY", "vip_proxy", "SOCKS_PROXY", "socks_proxy", "HTTPS_PROXY", "https_proxy", "HTTP_PROXY", "http_proxy", "ALL_PROXY", "all_proxy", "NO_PROXY", "no_proxy", "VIP_USE_SYSTEM_PROXY"} {
-		t.Setenv(key, "")
-	}
-	for _, status := range []int{200, 401, 503} {
-		t.Run(fmt.Sprint(status), func(t *testing.T) {
-			calls, exits := 0, 0
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				calls++
-				w.WriteHeader(status)
-				fmt.Fprint(w, `{"errors":[{"message":"denied"}]}`)
-			}))
-			defer srv.Close()
-			var stderr bytes.Buffer
-			client := gql.HTTPClientWithMiddleware(srv.URL, "test-token", []gql.Middleware{
-				gql.NewErrorMiddleware(gql.ErrorConfig{Stderr: &stderr, Exit: func(int) { exits++ }, ExitOnError: true}),
-				gql.NewRetryMiddleware(gql.RetryConfig{MaxAttempts: 3, NoDelay: true}),
-			})
-			api := APIClient{Client: graphql.NewClient(srv.URL+"/graphql", client)}
-			_, err := api.Create(context.Background(), 7, WriteInput{Name: "headers", WASMBinary: "AGFzbQ=="})
-			if err == nil || calls != 1 {
-				t.Fatalf("calls=%d err=%v", calls, err)
-			}
-			wantExits := 0
-			if status == 401 {
-				wantExits = 1
-			}
-			if exits != wantExits || (status != 401 && stderr.Len() != 0) {
-				t.Fatalf("exits=%d stderr=%q", exits, stderr.String())
-			}
-		})
-	}
-}

package/internal/edgeworkers/build.go

@@ -1,188 +0,0 @@
-package edgeworkers
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"errors"
-	"fmt"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-	"strings"
-
-	"golang.org/x/text/encoding/unicode"
-)
-
-type Artifact struct {
-	Path, Base64 string
-	SizeBytes    int64
-}
-type CompilerRequest struct {
-	Binary string
-	Args   []string
-	Dir    string
-	Env    []string
-}
-type CompilerResult struct {
-	Stdout, Stderr string
-	ExitCode       int
-}
-type CompilerRunner func(context.Context, CompilerRequest) (CompilerResult, error)
-type Compiler struct{ Run CompilerRunner }
-
-func RunCompiler(ctx context.Context, req CompilerRequest) (CompilerResult, error) {
-	// On Windows, execute asc's JS entry through Node rather than cmd.exe: paths
-	// and arguments remain literal even when they contain shell metacharacters.
-	binary, args := req.Binary, req.Args
-	if runtime.GOOS == "windows" {
-		binary = "node"
-		args = append([]string{filepath.Join(req.Dir, "node_modules", "assemblyscript", "bin", "asc.js")}, args...)
-	}
-	cmd := exec.CommandContext(ctx, binary, args...)
-	cmd.Dir = req.Dir
-	cmd.Env = req.Env
-	var stdout, stderr bytes.Buffer
-	cmd.Stdout = &stdout
-	cmd.Stderr = &stderr
-	err := cmd.Run()
-	result := CompilerResult{Stdout: stdout.String(), Stderr: stderr.String()}
-	var exitErr *exec.ExitError
-	if errors.As(err, &exitErr) {
-		result.ExitCode = exitErr.ExitCode()
-		return result, nil
-	}
-	return result, err
-}
-
-func encodeArtifact(file string) (Artifact, error) {
-	data, err := os.ReadFile(file)
-	if err != nil {
-		return Artifact{}, err
-	}
-	return Artifact{Path: file, Base64: base64.StdEncoding.EncodeToString(data), SizeBytes: int64(len(data))}, nil
-}
-
-func (c Compiler) Build(ctx context.Context, projectDir string, w LocalWorker) (Artifact, error) {
-	if _, err := ReadProjectDescriptor(projectDir); err != nil {
-		return Artifact{}, err
-	}
-	binName := "asc"
-	if runtime.GOOS == "windows" {
-		binName = "asc.cmd"
-	}
-	asc := filepath.Join(projectDir, "node_modules", ".bin", binName)
-	if !pathExists(asc) {
-		return Artifact{}, fmt.Errorf("The AssemblyScript compiler was not found at \"%s\". Run `npm install` in \"%s\" first.", asc, projectDir)
-	}
-	candidate, err := ResolvePathWithin(w.Dir, w.Manifest.Entry, "Worker entry")
-	if err != nil {
-		return Artifact{}, err
-	}
-	if !pathExists(candidate) {
-		return Artifact{}, fmt.Errorf("Worker entry file not found: \"%s\".", candidate)
-	}
-	entry, err := ResolveExistingPathWithin(w.Dir, w.Manifest.Entry, "Worker entry")
-	if err != nil {
-		return Artifact{}, err
-	}
-	if err := ValidateWorkerName(w.Manifest.Name, "worker name"); err != nil {
-		return Artifact{}, err
-	}
-	out, err := ResolveOutputPathWithin(projectDir, filepath.Join(BuildDir, w.Manifest.Name+".wasm"), "Worker build artifact", "Worker build directory")
-	if err != nil {
-		return Artifact{}, err
-	}
-	modules := filepath.Join(projectDir, "node_modules")
-	args := []string{entry, "--runtime", "stub", "--path", modules, "--outFile", out, "--optimizeLevel", "3", "--shrinkLevel", "2"}
-	if pathExists(filepath.Join(modules, "json-as")) {
-		args = append(args, "--transform", "json-as/transform")
-	}
-	env := []string{}
-	for _, item := range os.Environ() {
-		key, _, _ := strings.Cut(item, "=")
-		if key != "NODE_OPTIONS" {
-			env = append(env, item)
-		}
-	}
-	run := c.Run
-	if run == nil {
-		run = RunCompiler
-	}
-	result, err := run(ctx, CompilerRequest{Binary: asc, Args: args, Dir: projectDir, Env: env})
-	if err != nil {
-		return Artifact{}, fmt.Errorf("Failed to run the AssemblyScript compiler: %s", err)
-	}
-	if result.ExitCode != 0 {
-		details := result.Stderr
-		if details == "" {
-			details = result.Stdout
-		}
-		details = strings.TrimSpace(details)
-		suffix := "."
-		if details != "" {
-			suffix = ":\n" + details
-		}
-		return Artifact{}, fmt.Errorf("Compilation failed for worker \"%s\"%s", w.Manifest.Name, suffix)
-	}
-	out, err = ResolveOutputPathWithin(projectDir, filepath.Join(BuildDir, w.Manifest.Name+".wasm"), "Worker build artifact", "Worker build directory")
-	if err != nil {
-		return Artifact{}, err
-	}
-	return encodeArtifact(out)
-}
-
-func ReadPrebuilt(projectDir string, w LocalWorker) (Artifact, error) {
-	if err := ValidateWorkerName(w.Manifest.Name, "worker name"); err != nil {
-		return Artifact{}, err
-	}
-	root, err := ResolvePathWithin(projectDir, BuildDir, "Worker build directory")
-	if err != nil {
-		return Artifact{}, err
-	}
-	candidate := filepath.Join(root, w.Manifest.Name+".wasm")
-	if !pathExists(candidate) {
-		return Artifact{}, fmt.Errorf("No compiled artifact found for \"%s\" at \"%s\". Run `vip edge-workers build` first, or deploy without `--skip-build`.", w.Manifest.Name, candidate)
-	}
-	for _, item := range []struct{ path, label string }{{root, "Worker build directory"}, {candidate, "Worker build artifact"}} {
-		stat, err := os.Lstat(item.path)
-		if err != nil {
-			return Artifact{}, err
-		}
-		if stat.Mode()&os.ModeSymlink != 0 {
-			return Artifact{}, fmt.Errorf("%s must not be a symbolic link.", item.label)
-		}
-	}
-	root, err = ResolveExistingPathWithin(projectDir, BuildDir, "Worker build directory")
-	if err != nil {
-		return Artifact{}, err
-	}
-	file, err := ResolveExistingPathWithin(root, w.Manifest.Name+".wasm", "Worker build artifact")
-	if err != nil {
-		return Artifact{}, err
-	}
-	return encodeArtifact(file)
-}
-
-func ReadWorkerSource(w LocalWorker) (string, error) {
-	candidate, err := ResolvePathWithin(w.Dir, w.Manifest.Entry, "Worker entry")
-	if err != nil {
-		return "", err
-	}
-	if !pathExists(candidate) {
-		return "", fmt.Errorf("Could not read worker source at \"%s\".", candidate)
-	}
-	entry, err := ResolveExistingPathWithin(w.Dir, w.Manifest.Entry, "Worker entry")
-	if err != nil {
-		return "", err
-	}
-	data, err := os.ReadFile(entry)
-	if err != nil {
-		return "", fmt.Errorf("Could not read worker source at \"%s\".", entry)
-	}
-	// Match Buffer.toString('utf8'): replace each malformed sequence, not
-	// an entire run of malformed bytes (bytes.ToValidUTF8 collapses runs).
-	decoded, err := unicode.UTF8.NewDecoder().Bytes(data)
-	return string(decoded), err
-}

package/internal/edgeworkers/build_test.go

@@ -1,175 +0,0 @@
-package edgeworkers
-
-import (
-	"context"
-	"errors"
-	"os"
-	"path/filepath"
-	"reflect"
-	"strings"
-	"testing"
-)
-
-func TestScaffoldDoesNotOverwriteOrInstall(t *testing.T) {
-	dir := filepath.Join(t.TempDir(), "edge workers")
-	if err := ScaffoldProject(dir, "assemblyscript"); err != nil {
-		t.Fatal(err)
-	}
-	before, _ := os.ReadFile(filepath.Join(dir, "package.json"))
-	if !strings.Contains(string(before), `"0.5.0"`) || !strings.Contains(string(before), `"0.27.0"`) {
-		t.Fatalf("dependencies: %s", before)
-	}
-	if err := ScaffoldProject(dir, "assemblyscript"); err == nil {
-		t.Fatal("overwrote project")
-	}
-	after, _ := os.ReadFile(filepath.Join(dir, "package.json"))
-	if string(before) != string(after) {
-		t.Fatal("changed existing files")
-	}
-	if _, err := os.Stat(filepath.Join(dir, "node_modules")); !os.IsNotExist(err) {
-		t.Fatalf("installed: %v", err)
-	}
-	loc := &Location{Operator: "starts_with", Value: "/api/"}
-	if err := ScaffoldWorker(dir, "headers", loc); err != nil {
-		t.Fatal(err)
-	}
-	w, err := FindWorker(dir, "headers")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !reflect.DeepEqual(w.Manifest.Location, LocationValue{Present: true, Value: loc}) {
-		t.Fatalf("manifest: %#v", w.Manifest)
-	}
-	source, err := ReadWorkerSource(w)
-	if err != nil || !strings.Contains(source, "export { alloc, on_client_response }") {
-		t.Fatalf("source %q %v", source, err)
-	}
-	if err := ScaffoldWorker(dir, "headers", nil); err == nil {
-		t.Fatal("overwrote worker")
-	}
-	if err := ScaffoldWorker(dir, "../escape", nil); err == nil {
-		t.Fatal("accepted traversal")
-	}
-	if err := ScaffoldWorker(dir, "bad", &Location{Operator: "bad", Value: "/"}); err == nil {
-		t.Fatal("accepted location")
-	}
-	if pathExists(filepath.Join(dir, WorkersDir, "bad")) {
-		t.Fatal("partial scaffold")
-	}
-	target := filepath.Join(t.TempDir(), "linked")
-	if err := os.Symlink(t.TempDir(), target); err != nil {
-		t.Fatal(err)
-	}
-	if err := ScaffoldProject(target, "assemblyscript"); err == nil {
-		t.Fatal("followed symlink")
-	}
-}
-
-func TestCompilerArgumentsAndArtifacts(t *testing.T) {
-	dir := filepath.Join(t.TempDir(), "project with spaces & punctuation")
-	if err := ScaffoldProject(dir, "assemblyscript"); err != nil {
-		t.Fatal(err)
-	}
-	if err := ScaffoldWorker(dir, "headers", nil); err != nil {
-		t.Fatal(err)
-	}
-	w, _ := FindWorker(dir, "headers")
-	if _, err := (Compiler{}).Build(context.Background(), dir, w); err == nil || !strings.Contains(err.Error(), "npm install") {
-		t.Fatalf("missing asc: %v", err)
-	}
-	writeTestFile(t, dir, "node_modules/.bin/asc", "")
-	writeTestFile(t, dir, "node_modules/json-as/package.json", "{}")
-	t.Setenv("NODE_OPTIONS", "--inspect")
-	t.Setenv("EDGE_BUILD_TEST", "retained")
-	var seen CompilerRequest
-	compiler := Compiler{Run: func(_ context.Context, req CompilerRequest) (CompilerResult, error) {
-		seen = req
-		return CompilerResult{}, os.WriteFile(req.Args[6], []byte{0, 97, 115, 109}, 0600)
-	}}
-	art, err := compiler.Build(context.Background(), dir, w)
-	if err != nil {
-		t.Fatal(err)
-	}
-	entry, _ := filepath.EvalSymlinks(filepath.Join(w.Dir, w.Manifest.Entry))
-	want := []string{entry, "--runtime", "stub", "--path", filepath.Join(dir, "node_modules"), "--outFile", art.Path, "--optimizeLevel", "3", "--shrinkLevel", "2", "--transform", "json-as/transform"}
-	if !reflect.DeepEqual(seen.Args, want) || seen.Dir != dir || seen.Binary != filepath.Join(dir, "node_modules/.bin/asc") {
-		t.Fatalf("request: %#v", seen)
-	}
-	for _, s := range seen.Env {
-		if strings.HasPrefix(s, "NODE_OPTIONS=") {
-			t.Fatal("inherited NODE_OPTIONS")
-		}
-	}
-	if !strings.Contains(strings.Join(seen.Env, "\n"), "EDGE_BUILD_TEST=retained") {
-		t.Fatal("lost environment")
-	}
-	if art.Base64 != "AGFzbQ==" || art.SizeBytes != 4 {
-		t.Fatalf("artifact: %#v", art)
-	}
-	pre, err := ReadPrebuilt(dir, w)
-	if err != nil || pre != art {
-		t.Fatalf("prebuilt %#v %v", pre, err)
-	}
-	for _, tc := range []struct {
-		result CompilerResult
-		err    error
-		want   string
-	}{
-		{CompilerResult{ExitCode: 1, Stdout: "out", Stderr: " err "}, nil, "Compilation failed for worker \"headers\":\nerr"},
-		{CompilerResult{ExitCode: 1}, nil, "Compilation failed for worker \"headers\"."},
-		{CompilerResult{}, errors.New("launch"), "Failed to run the AssemblyScript compiler: launch"},
-	} {
-		compiler.Run = func(context.Context, CompilerRequest) (CompilerResult, error) { return tc.result, tc.err }
-		_, err := compiler.Build(context.Background(), dir, w)
-		if err == nil || err.Error() != tc.want {
-			t.Fatalf("error %v want %s", err, tc.want)
-		}
-	}
-}
-
-func TestSourceAndPrebuiltSafety(t *testing.T) {
-	dir := t.TempDir()
-	w := LocalWorker{Dir: dir, Manifest: Manifest{Name: "test", Entry: "entry.ts"}}
-	if _, err := ReadPrebuilt(dir, w); err == nil {
-		t.Fatal("accepted missing artifact")
-	}
-	if _, err := ReadWorkerSource(w); err == nil {
-		t.Fatal("accepted missing source")
-	}
-	writeTestFile(t, dir, "entry.ts", "")
-	src, err := ReadWorkerSource(w)
-	if err != nil || src != "" {
-		t.Fatalf("empty source %q %v", src, err)
-	}
-	outside := writeTestFile(t, t.TempDir(), "outside.wasm", "sentinel")
-	if err := os.Mkdir(filepath.Join(dir, BuildDir), 0755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.Symlink(outside, filepath.Join(dir, BuildDir, "test.wasm")); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := ReadPrebuilt(dir, w); err == nil || !strings.Contains(err.Error(), "symbolic link") {
-		t.Fatalf("artifact escape %v", err)
-	}
-}
-
-func TestSourceUTF8ReplacementMatchesNode(t *testing.T) {
-	dir := t.TempDir()
-	w := LocalWorker{Dir: dir, Manifest: Manifest{Entry: "source.ts"}}
-	for _, tc := range []struct {
-		data []byte
-		want string
-	}{
-		{[]byte{0xff, 0xff}, "\ufffd\ufffd"},
-		{[]byte{0xe1, 0x80}, "\ufffd"},
-		{[]byte{0xe1, 0x80, 0xff}, "\ufffd\ufffd"},
-	} {
-		if err := os.WriteFile(filepath.Join(dir, "source.ts"), tc.data, 0600); err != nil {
-			t.Fatal(err)
-		}
-		got, err := ReadWorkerSource(w)
-		if err != nil || got != tc.want {
-			t.Fatalf("source %x => %q want %q (%v)", tc.data, got, tc.want, err)
-		}
-	}
-}

package/internal/edgeworkers/confirmation.go

@@ -1,72 +0,0 @@
-package edgeworkers
-
-import (
-	"errors"
-	"fmt"
-	"strings"
-)
-
-type ProductionConfirmation struct {
-	Action, AppName, EnvType                            string
-	WorkerNames                                         []string
-	EnableAfterDeploy, SkipConfirmation, NonInteractive bool
-}
-
-func ConfirmProduction(req ProductionConfirmation, confirm func(string) (bool, error)) error {
-	if req.EnvType != "production" || req.SkipConfirmation {
-		return nil
-	}
-	action := req.Action
-	if action == "deploy" && req.EnableAfterDeploy {
-		action = "deploy and enable"
-	}
-	if req.NonInteractive {
-		return fmt.Errorf("Refusing to %s edge workers in production without confirmation. Pass --skip-confirmation to proceed non-interactively.", action)
-	}
-	target := EscapeTerminalText(req.AppName) + "." + EscapeTerminalText(req.EnvType)
-	var message string
-	if req.Action == "enable" {
-		if len(req.WorkerNames) == 0 {
-			return errors.New("No worker selected.")
-		}
-		message = fmt.Sprintf("Enable edge worker \"%s\" on %s?", EscapeTerminalText(req.WorkerNames[0]), target)
-	} else {
-		verb, preposition, label := "Deploy", "to", "edge workers"
-		if req.EnableAfterDeploy {
-			verb = "Deploy and enable"
-			preposition = "on"
-		}
-		if len(req.WorkerNames) == 1 {
-			label = "edge worker"
-		}
-		message = fmt.Sprintf("%s %d %s (%s) %s %s?", verb, len(req.WorkerNames), label, escapedJoin(req.WorkerNames, ", ", ""), preposition, target)
-	}
-	return confirmOrCancel(message, confirm)
-}
-func confirmOrCancel(message string, confirm func(string) (bool, error)) error {
-	ok, err := confirm(message)
-	if err != nil {
-		return err
-	}
-	if !ok {
-		return errors.New("Command cancelled by user.")
-	}
-	return nil
-}
-func ConfirmDeletion(app, env, name string, force bool, confirm func(string) (bool, error)) error {
-	if force {
-		return nil
-	}
-	return confirmOrCancel(fmt.Sprintf("Permanently delete edge worker \"%s\" from %s.%s?", EscapeTerminalText(name), EscapeTerminalText(app), EscapeTerminalText(env)), confirm)
-}
-func escapedJoin(values []string, separator, fallback string) string {
-	parts := make([]string, len(values))
-	for i, s := range values {
-		parts[i] = EscapeTerminalText(s)
-	}
-	joined := strings.Join(parts, separator)
-	if joined == "" {
-		return fallback
-	}
-	return joined
-}