anhedral 0.4.1 → 0.6.0

package/dist/templates/assets-private-proxy.d.ts

@@ -1,3 +0,0 @@
-import type { ProjectOptions } from '../scaffold.js';
-export declare function r2BucketName(projectName: string): string;
-export declare function scaffoldAssetsPrivateProxy(root: string, options: ProjectOptions): void;

package/dist/templates/assets-private-proxy.js

@@ -1,277 +0,0 @@
-import path from 'node:path';
-import { anhedralPrint } from '../print.js';
-import { childPackageName } from '../render.js';
-import { TOOLCHAIN_DEPENDENCIES } from '../dependencies.js';
-import { writeFile } from '../util.js';
-export function r2BucketName(projectName) {
-    const unscoped = projectName.replace(/^@[^/]+\//, '');
-    const normalized = unscoped.toLowerCase()
-        .replace(/[^a-z0-9-]+/g, '-')
-        .replace(/-+/g, '-')
-        .replace(/^-+|-+$/g, '') || 'anhedral';
-    const base = normalized.slice(0, 56).replace(/-+$/g, '') || 'anhedral';
-    return `${base}-assets`;
-}
-export function scaffoldAssetsPrivateProxy(root, options) {
-    const dir = path.join(root, 'apps/assets-private-proxy');
-    const wrangler = `pnpm dlx wrangler@${TOOLCHAIN_DEPENDENCIES.wrangler}`;
-    const bucketName = r2BucketName(options.projectName);
-    anhedralPrint.section('Private asset proxy (Cloudflare Worker + R2)');
-    anhedralPrint.step('Writing private-bucket delivery Worker');
-    writeFile(path.join(dir, 'package.json'), JSON.stringify({
-        name: childPackageName(options.projectName, 'assets-private-proxy'),
-        version: '0.1.0',
-        private: true,
-        type: 'module',
-        scripts: {
-            check: 'node --check src/index.js',
-            dev: `${wrangler} dev`,
-            deploy: `${wrangler} deploy`,
-            types: `${wrangler} types`,
-        },
-    }, null, 2) + '\n');
-    writeFile(path.join(dir, 'wrangler.jsonc'), `{
-  // Replace both assets.example.com values with a hostname in your active Cloudflare zone before deployment.
-  "name": "assets-private-proxy",
-  "main": "src/index.js",
-  "compatibility_date": "2026-07-16",
-  "compatibility_flags": ["nodejs_compat"],
-  "workers_dev": false,
-  "preview_urls": false,
-  "routes": [{ "pattern": "assets.example.com", "custom_domain": true }],
-  "vars": { "ASSET_HOSTNAME": "assets.example.com", "R2_PREFIX": "storage" },
-  "r2_buckets": [{ "binding": "ASSETS", "bucket_name": "${bucketName}" }],
-  "observability": {
-    "enabled": true,
-    "logs": { "enabled": true, "head_sampling_rate": 1 }
-  }
-}
-`);
-    writeFile(path.join(dir, 'src/index.js'), `/**
- * Public asset delivery for a private Anhedral R2 bucket.
- *
- * Cloudflare configuration:
- * - Worker name: assets-private-proxy
- * - Custom domain: replace assets.example.com in wrangler.jsonc
- * - R2 binding name: ASSETS
- * - Public object prefix: storage/confirmed/
- *
- * Uploads remain authenticated through the Anhedral application. This Worker
- * only allows public GET and HEAD access to objects whose unguessable key is
- * known. Use authenticated or application-signed requests instead when object
- * keys are not sufficient authorization for your product.
- */
-const CACHE_CONTROL = "public, max-age=86400, s-maxage=2592000, immutable";
-const PRIVATE_GENERATION_INPUT_SEGMENT = "/generation-inputs/";
-
-const worker = {
-  async fetch(request, env, ctx) {
-    const method = request.method.toUpperCase();
-    if (method !== "GET" && method !== "HEAD") {
-      return textNoStore("Method Not Allowed", 405, { allow: "GET, HEAD" });
-    }
-
-    const url = new URL(request.url);
-    if (url.hostname !== env.ASSET_HOSTNAME) return textNoStore("Forbidden", 403);
-    const key = decodeObjectKey(url.pathname);
-    const publicPrefix = env.R2_PREFIX + "/confirmed/";
-    if (!key || !key.startsWith(publicPrefix) || key.includes(PRIVATE_GENERATION_INPUT_SEGMENT)) {
-      return textNoStore("Not Found", 404);
-    }
-
-    try {
-      const cache = caches.default;
-      const cacheKey = buildCacheKey(url, key);
-      const canUseBodyCache = isCacheableBodyRequest(request, method);
-
-      if (method === "HEAD") {
-        const cached = await cache.match(cacheKey);
-        if (cached) return headFromResponse(cached, "HIT");
-        const object = await env.ASSETS.head(key);
-        if (!object) return textNoStore("Not Found", 404);
-        return new Response(null, {
-          status: 200,
-          headers: withAssetDebugHeaders(buildObjectHeaders(object), "BYPASS"),
-        });
-      }
-
-      if (canUseBodyCache) {
-        const cached = await cache.match(cacheKey);
-        if (cached) return withCacheStatus(cached, "HIT");
-      }
-
-      const object = await env.ASSETS.get(key, {
-        onlyIf: request.headers,
-        range: request.headers,
-      });
-      if (!object) return textNoStore("Not Found", 404);
-
-      const hasBody = "body" in object;
-      const headers = buildObjectHeaders(object);
-      const isRangeResponse = hasBody && request.headers.has("range");
-      if (isRangeResponse && object.range) {
-        const returnedRange = normalizeReturnedRange(object.range, object.size);
-        headers.set("content-range", "bytes " + returnedRange.offset + "-" + (returnedRange.offset + returnedRange.length - 1) + "/" + object.size);
-        headers.set("content-length", String(returnedRange.length));
-      }
-
-      if (!hasBody) {
-        const status = getFailedConditionalRequestStatus(request.headers);
-        headers.delete("content-length");
-        if (status === 412) headers.set("cache-control", "no-store");
-        return new Response(null, {
-          status,
-          headers: withAssetDebugHeaders(headers, "BYPASS"),
-        });
-      }
-
-      const response = new Response(object.body, {
-        status: isRangeResponse ? 206 : 200,
-        headers,
-      });
-      if (canUseBodyCache && response.status === 200) {
-        ctx.waitUntil(cache.put(cacheKey, response.clone()).catch((error) => {
-          console.error("Asset cache put failed", { key, error });
-        }));
-        return withCacheStatus(response, "MISS");
-      }
-      return withCacheStatus(response, "BYPASS");
-    } catch (error) {
-      console.error("Asset delivery failed", { key, error });
-      return textNoStore("Asset delivery failed", 500);
-    }
-  },
-};
-
-export default worker;
-
-function isCacheableBodyRequest(request, method) {
-  if (method !== "GET") return false;
-  return !request.headers.has("range")
-    && !request.headers.has("if-none-match")
-    && !request.headers.has("if-match")
-    && !request.headers.has("if-modified-since")
-    && !request.headers.has("if-unmodified-since");
-}
-
-function buildCacheKey(url, key) {
-  return new Request(url.origin + "/" + encodeObjectKey(key), { method: "GET" });
-}
-
-function decodeObjectKey(pathname) {
-  const rawKey = pathname.replace(/^\\/+/, "");
-  if (!rawKey) return null;
-  const parts = [];
-  for (const rawPart of rawKey.split("/")) {
-    if (!rawPart) continue;
-    let part;
-    try {
-      part = decodeURIComponent(rawPart);
-    } catch {
-      return null;
-    }
-    if (!part || part === "." || part === ".." || part.includes("/")) return null;
-    parts.push(part);
-  }
-  return parts.join("/") || null;
-}
-
-function encodeObjectKey(key) {
-  return key.split("/").map(encodeURIComponent).join("/");
-}
-
-function buildObjectHeaders(object) {
-  const headers = new Headers();
-  object.writeHttpMetadata(headers);
-  headers.set("accept-ranges", "bytes");
-  headers.set("cache-control", CACHE_CONTROL);
-  headers.set("etag", object.httpEtag);
-  headers.set("content-length", String(object.size));
-  headers.set("x-assets-proxy", "anhedral-r2-direct-v1");
-  if (object.uploaded instanceof Date) headers.set("last-modified", object.uploaded.toUTCString());
-  headers.delete("set-cookie");
-  if (headers.get("vary") === "*") headers.delete("vary");
-  return headers;
-}
-
-function headFromResponse(response, cacheStatus) {
-  const headers = new Headers(response.headers);
-  headers.set("x-assets-cache", cacheStatus);
-  return new Response(null, { status: response.status, headers });
-}
-
-function withCacheStatus(response, cacheStatus) {
-  const headers = new Headers(response.headers);
-  headers.set("x-assets-cache", cacheStatus);
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers,
-  });
-}
-
-function withAssetDebugHeaders(headers, cacheStatus) {
-  const nextHeaders = new Headers(headers);
-  nextHeaders.set("x-assets-cache", cacheStatus);
-  return nextHeaders;
-}
-
-function textNoStore(body, status, extraHeaders = {}) {
-  return new Response(body, {
-    status,
-    headers: { "cache-control": "no-store", ...extraHeaders },
-  });
-}
-
-function getFailedConditionalRequestStatus(headers) {
-  if (headers.has("if-none-match")) return 304;
-  if (!headers.has("if-match") && !headers.has("if-unmodified-since") && headers.has("if-modified-since")) return 304;
-  return 412;
-}
-
-function normalizeReturnedRange(range, objectSize) {
-  if (typeof range.suffix === "number") {
-    const length = Math.min(Math.max(0, range.suffix), objectSize);
-    return { offset: objectSize - length, length };
-  }
-  const offset = Math.min(Math.max(0, range.offset ?? 0), objectSize);
-  const availableLength = objectSize - offset;
-  const length = typeof range.length === "number"
-    ? Math.min(Math.max(0, range.length), availableLength)
-    : availableLength;
-  return { offset, length };
-}
-`);
-    writeFile(path.join(root, 'cloudflare/r2-cors.template.json'), JSON.stringify({
-        rules: [
-            {
-                id: 'anhedral-browser-uploads',
-                allowed: {
-                    origins: ['https://app.example.com', 'http://localhost:3000'],
-                    methods: ['GET', 'HEAD', 'PUT'],
-                    headers: ['Content-Type'],
-                },
-                exposeHeaders: ['ETag'],
-                maxAgeSeconds: 3600,
-            },
-        ],
-    }, null, 2) + '\n');
-    writeFile(path.join(root, 'cloudflare/README.md'), `# Anhedral Cloudflare resources
-
-The R2 bucket remains private. Browser uploads use short-lived, authenticated
-presigned URLs on the R2 S3 API hostname. Public downloads pass through the
-\`assets-private-proxy\` Worker, which exposes only keys below
-\`storage/confirmed/\` by default. Authenticated reads use the API's
-\`/api/storage/uploads/:uploadId/read-url\` endpoint instead.
-
-Before applying \`r2-cors.template.json\`, replace \`app.example.com\` and merge
-every exact web or extension origin that uploads to this bucket. Wrangler's
-\`r2 bucket cors set\` command replaces the complete live policy, so list and
-review the deployed policy before every update.
-
-\`CLOUDFLARE_API_TOKEN\` is an operations/CI credential used by Wrangler. It is
-not an application storage credential and must never be exposed to a browser,
-mobile build, desktop renderer, extension bundle, or Worker variable.
-`);
-    anhedralPrint.done('Private R2 asset proxy written');
-}

package/dist/templates/electron-updater.d.ts

@@ -1,3 +0,0 @@
-import type { ProjectOptions } from '../scaffold.js';
-export declare function desktopUpdatesBucketName(projectName: string): string;
-export declare function scaffoldElectronUpdater(root: string, options: ProjectOptions): void;

package/dist/templates/electron-updater.js

@@ -1,358 +0,0 @@
-import path from 'node:path';
-import { TOOLCHAIN_DEPENDENCIES } from '../dependencies.js';
-import { anhedralPrint } from '../print.js';
-import { childPackageName } from '../render.js';
-import { writeFile } from '../util.js';
-function normalizedResourceName(projectName) {
-    const unscoped = projectName.replace(/^@[^/]+\//, '');
-    const normalized = unscoped.toLowerCase()
-        .replace(/[^a-z0-9-]+/g, '-')
-        .replace(/-+/g, '-')
-        .replace(/^-+|-+$/g, '') || 'anhedral';
-    return normalized.slice(0, 48).replace(/-+$/g, '') || 'anhedral';
-}
-export function desktopUpdatesBucketName(projectName) {
-    return `${normalizedResourceName(projectName)}-desktop-updates`;
-}
-export function scaffoldElectronUpdater(root, options) {
-    const workerDir = path.join(root, 'apps/desktop-updater-worker');
-    const desktopDir = path.join(root, 'apps/desktop');
-    const wrangler = `pnpm dlx wrangler@${TOOLCHAIN_DEPENDENCIES.wrangler}`;
-    const bucketName = desktopUpdatesBucketName(options.projectName);
-    anhedralPrint.section('Electron updater (private R2 + Cloudflare Worker)');
-    anhedralPrint.step('Writing desktop update channel');
-    writeFile(path.join(workerDir, 'package.json'), JSON.stringify({
-        name: childPackageName(options.projectName, 'desktop-updater-worker'),
-        version: '0.1.0',
-        private: true,
-        type: 'module',
-        scripts: {
-            check: 'node --check src/index.js && node --test tests/*.test.js',
-            test: 'node --test tests/*.test.js',
-            dev: `${wrangler} dev`,
-            deploy: `${wrangler} deploy`,
-            types: `${wrangler} types`,
-        },
-    }, null, 2) + '\n');
-    writeFile(path.join(workerDir, 'wrangler.jsonc'), `{
-  // Replace both updates.example.com values with a hostname in your active Cloudflare zone.
-  "name": "desktop-updater",
-  "main": "src/index.js",
-  "compatibility_date": "2026-07-22",
-  "compatibility_flags": ["nodejs_compat"],
-  "workers_dev": false,
-  "preview_urls": false,
-  "routes": [{ "pattern": "updates.example.com", "custom_domain": true }],
-  "vars": { "UPDATE_HOSTNAME": "updates.example.com", "UPDATE_PREFIX": "releases" },
-  "r2_buckets": [{ "binding": "UPDATES", "bucket_name": "${bucketName}" }],
-  "observability": {
-    "enabled": true,
-    "logs": { "enabled": true, "head_sampling_rate": 1 }
-  }
-}
-`);
-    writeFile(path.join(workerDir, 'src/index.js'), `/**
- * Electron update delivery from a private R2 bucket.
- *
- * The bucket has no public r2.dev or bucket custom domain. This Worker is the
- * only public read path. Release CI uploads signed installers, blockmaps, and
- * update metadata with Wrangler; the Worker never permits writes or listings.
- */
-const ARTIFACT_CACHE_CONTROL = "public, max-age=31536000, immutable";
-const METADATA_CACHE_CONTROL = "no-store";
-
-export default {
-  async fetch(request, env) {
-    const method = request.method.toUpperCase();
-    if (method !== "GET" && method !== "HEAD") {
-      return textResponse("Method Not Allowed", 405, { allow: "GET, HEAD" });
-    }
-
-    const url = new URL(request.url);
-    if (url.hostname !== env.UPDATE_HOSTNAME) return textResponse("Forbidden", 403);
-    const key = decodeObjectKey(url.pathname);
-    const prefix = env.UPDATE_PREFIX.replace(/^\\/+|\\/+$/g, "") + "/";
-    if (!key || !key.startsWith(prefix)) return textResponse("Not Found", 404);
-
-    try {
-      if (method === "HEAD") {
-        const object = await env.UPDATES.head(key);
-        if (!object) return textResponse("Not Found", 404);
-        return new Response(null, { status: 200, headers: objectHeaders(object, key) });
-      }
-
-      const object = await env.UPDATES.get(key, {
-        onlyIf: request.headers,
-        range: request.headers,
-      });
-      if (!object) return textResponse("Not Found", 404);
-
-      const headers = objectHeaders(object, key);
-      if (!("body" in object)) {
-        const status = failedConditionalStatus(request.headers);
-        headers.delete("content-length");
-        return new Response(null, { status, headers });
-      }
-
-      const isRange = request.headers.has("range") && object.range;
-      if (isRange) {
-        const returned = normalizeRange(object.range, object.size);
-        headers.set("content-range", "bytes " + returned.offset + "-" + (returned.offset + returned.length - 1) + "/" + object.size);
-        headers.set("content-length", String(returned.length));
-      }
-      return new Response(object.body, { status: isRange ? 206 : 200, headers });
-    } catch (error) {
-      console.error(JSON.stringify({
-        message: "desktop update delivery failed",
-        key,
-        error: error instanceof Error ? error.message : String(error),
-      }));
-      return textResponse("Update delivery failed", 500);
-    }
-  },
-};
-
-function decodeObjectKey(pathname) {
-  const parts = [];
-  for (const rawPart of pathname.replace(/^\\/+/, "").split("/")) {
-    if (!rawPart) continue;
-    let part;
-    try {
-      part = decodeURIComponent(rawPart);
-    } catch {
-      return null;
-    }
-    if (!part || part === "." || part === ".." || part.includes("/") || part.includes("\\\\")) return null;
-    parts.push(part);
-  }
-  return parts.join("/") || null;
-}
-
-function objectHeaders(object, key) {
-  const headers = new Headers();
-  object.writeHttpMetadata(headers);
-  headers.set("accept-ranges", "bytes");
-  headers.set("cache-control", key.endsWith(".yml") ? METADATA_CACHE_CONTROL : ARTIFACT_CACHE_CONTROL);
-  headers.set("content-length", String(object.size));
-  headers.set("etag", object.httpEtag);
-  headers.set("x-content-type-options", "nosniff");
-  headers.set("content-security-policy", "default-src 'none'");
-  if (object.uploaded instanceof Date) headers.set("last-modified", object.uploaded.toUTCString());
-  headers.delete("set-cookie");
-  return headers;
-}
-
-function failedConditionalStatus(headers) {
-  if (headers.has("if-none-match")) return 304;
-  if (!headers.has("if-match") && !headers.has("if-unmodified-since") && headers.has("if-modified-since")) return 304;
-  return 412;
-}
-
-function normalizeRange(range, objectSize) {
-  if (typeof range.suffix === "number") {
-    const length = Math.min(Math.max(0, range.suffix), objectSize);
-    return { offset: objectSize - length, length };
-  }
-  const offset = Math.min(Math.max(0, range.offset ?? 0), objectSize);
-  const available = objectSize - offset;
-  const length = typeof range.length === "number"
-    ? Math.min(Math.max(0, range.length), available)
-    : available;
-  return { offset, length };
-}
-
-function textResponse(body, status, extraHeaders = {}) {
-  return new Response(body, {
-    status,
-    headers: { "cache-control": "no-store", "content-type": "text/plain; charset=utf-8", ...extraHeaders },
-  });
-}
-`);
-    writeFile(path.join(workerDir, 'tests/worker.test.js'), `import assert from 'node:assert/strict';
-import test from 'node:test';
-import worker from '../src/index.js';
-
-function storedObject(body = new TextEncoder().encode('release-bytes'), overrides = {}) {
-  return {
-    body,
-    size: body.byteLength,
-    httpEtag: '"synthetic-etag"',
-    uploaded: new Date('2026-07-22T00:00:00.000Z'),
-    writeHttpMetadata(headers) { headers.set('content-type', 'application/octet-stream'); },
-    ...overrides,
-  };
-}
-
-function environment(overrides = {}) {
-  const object = storedObject();
-  return {
-    UPDATE_HOSTNAME: 'updates.example.com',
-    UPDATE_PREFIX: 'releases',
-    UPDATES: {
-      async head() { return object; },
-      async get() { return object; },
-    },
-    ...overrides,
-  };
-}
-
-test('allows only read methods on the configured host and release prefix', async () => {
-  const env = environment();
-  assert.equal((await worker.fetch(new Request('https://updates.example.com/releases/mac/arm64/app.zip', { method: 'POST' }), env)).status, 405);
-  assert.equal((await worker.fetch(new Request('https://other.example.com/releases/mac/arm64/app.zip'), env)).status, 403);
-  assert.equal((await worker.fetch(new Request('https://updates.example.com/private/app.zip'), env)).status, 404);
-  assert.equal((await worker.fetch(new Request('https://updates.example.com/releases/%2Fprivate.zip'), env)).status, 404);
-});
-
-test('streams artifacts and handles HEAD without exposing a body', async () => {
-  const env = environment();
-  const response = await worker.fetch(new Request('https://updates.example.com/releases/mac/arm64/app.zip'), env);
-  assert.equal(response.status, 200);
-  assert.equal(await response.text(), 'release-bytes');
-  assert.equal(response.headers.get('cache-control'), 'public, max-age=31536000, immutable');
-  assert.equal(response.headers.get('etag'), '"synthetic-etag"');
-
-  const head = await worker.fetch(new Request('https://updates.example.com/releases/mac/arm64/app.zip', { method: 'HEAD' }), env);
-  assert.equal(head.status, 200);
-  assert.equal(await head.text(), '');
-});
-
-test('returns ranges and conditional responses with safe cache policy', async () => {
-  const ranged = storedObject(new TextEncoder().encode('le'), { size: 13, range: { offset: 2, length: 2 } });
-  const rangeResponse = await worker.fetch(new Request('https://updates.example.com/releases/mac/arm64/app.zip', {
-    headers: { range: 'bytes=2-3' },
-  }), environment({ UPDATES: { async head() { return ranged; }, async get() { return ranged; } } }));
-  assert.equal(rangeResponse.status, 206);
-  assert.equal(rangeResponse.headers.get('content-range'), 'bytes 2-3/13');
-  assert.equal(rangeResponse.headers.get('content-length'), '2');
-
-  const notModified = storedObject(new Uint8Array(), { size: 13 });
-  delete notModified.body;
-  const conditional = await worker.fetch(new Request('https://updates.example.com/releases/mac/arm64/latest-mac.yml', {
-    headers: { 'if-none-match': '"synthetic-etag"' },
-  }), environment({ UPDATES: { async head() { return notModified; }, async get() { return notModified; } } }));
-  assert.equal(conditional.status, 304);
-  assert.equal(conditional.headers.get('cache-control'), 'no-store');
-  assert.equal(conditional.headers.has('content-length'), false);
-});
-`);
-    writeFile(path.join(desktopDir, 'scripts/publish-updates.mjs'), `import { readdirSync, statSync } from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-
-const WRANGLER_VERSION = ${JSON.stringify(TOOLCHAIN_DEPENDENCIES.wrangler)};
-const BUCKET_NAME = ${JSON.stringify(bucketName)};
-const RELEASE_DIRECTORY = path.resolve('apps/desktop/release');
-const ALLOWED_PLATFORMS = new Set(['mac', 'win', 'linux']);
-const ALLOWED_ARCHITECTURES = new Set(['x64', 'arm64']);
-const UPLOAD_COMMAND = process.env.ANHEDRAL_DESKTOP_UPDATE_UPLOAD_COMMAND || (process.platform === 'win32' ? 'pnpm.cmd' : 'pnpm');
-const UPLOAD_ARGS_PREFIX = process.env.ANHEDRAL_DESKTOP_UPDATE_UPLOAD_ARGS_PREFIX
-  ? JSON.parse(process.env.ANHEDRAL_DESKTOP_UPDATE_UPLOAD_ARGS_PREFIX)
-  : [];
-if (!Array.isArray(UPLOAD_ARGS_PREFIX) || !UPLOAD_ARGS_PREFIX.every((value) => typeof value === 'string')) {
-  throw new Error('ANHEDRAL_DESKTOP_UPDATE_UPLOAD_ARGS_PREFIX must be a JSON string array');
-}
-
-function option(name) {
-  const index = process.argv.indexOf('--' + name);
-  return index >= 0 ? process.argv[index + 1] : undefined;
-}
-
-const platform = option('platform');
-const arch = option('arch');
-if (!platform || !ALLOWED_PLATFORMS.has(platform)) {
-  throw new Error('--platform must be one of: mac, win, linux');
-}
-if (!arch || !ALLOWED_ARCHITECTURES.has(arch)) {
-  throw new Error('--arch must be one of: x64, arm64');
-}
-
-const metadataName = platform === 'mac' ? 'latest-mac.yml' : platform === 'linux' ? 'latest-linux.yml' : 'latest.yml';
-const artifactExtensions = platform === 'mac'
-  ? ['.dmg', '.zip', '.blockmap']
-  : platform === 'win'
-    ? ['.exe', '.zip', '.blockmap']
-    : ['.AppImage', '.deb', '.blockmap'];
-const files = readdirSync(RELEASE_DIRECTORY)
-  .filter((name) => name === metadataName || artifactExtensions.some((extension) => name.endsWith(extension)))
-  .filter((name) => name === metadataName || name.includes('-' + arch + '.'))
-  .filter((name) => statSync(path.join(RELEASE_DIRECTORY, name)).isFile());
-if (!files.includes(metadataName)) throw new Error('Missing electron-updater metadata: ' + metadataName);
-if (!files.some((name) => name !== metadataName && !name.endsWith('.blockmap'))) {
-  throw new Error('No desktop installer artifact was found for ' + platform + '/' + arch);
-}
-
-// Publish immutable artifacts first and the mutable channel metadata last.
-files.sort((left, right) => Number(left === metadataName) - Number(right === metadataName) || left.localeCompare(right));
-for (const name of files) {
-  const source = path.join(RELEASE_DIRECTORY, name);
-  const objectPath = BUCKET_NAME + '/releases/' + platform + '/' + arch + '/' + name;
-  const metadata = name.endsWith('.yml');
-  const args = [
-    'dlx',
-    'wrangler@' + WRANGLER_VERSION,
-    'r2',
-    'object',
-    'put',
-    objectPath,
-    '--remote',
-    '--file=' + source,
-    '--content-type=' + contentType(name),
-    '--cache-control=' + (metadata ? 'no-store' : 'public, max-age=31536000, immutable'),
-  ];
-  const result = spawnSync(UPLOAD_COMMAND, [...UPLOAD_ARGS_PREFIX, ...args], {
-    cwd: process.cwd(),
-    stdio: 'inherit',
-  });
-  if (result.error) throw result.error;
-  if (result.status !== 0) throw new Error('Unable to upload desktop update object: ' + objectPath);
-}
-
-function contentType(name) {
-  if (name.endsWith('.yml')) return 'text/yaml; charset=utf-8';
-  if (name.endsWith('.blockmap')) return 'application/octet-stream';
-  if (name.endsWith('.zip')) return 'application/zip';
-  if (name.endsWith('.dmg')) return 'application/x-apple-diskimage';
-  if (name.endsWith('.exe')) return 'application/vnd.microsoft.portable-executable';
-  if (name.endsWith('.deb')) return 'application/vnd.debian.binary-package';
-  return 'application/octet-stream';
-}
-
-console.log('Published ' + files.length + ' desktop update files to ' + BUCKET_NAME + '.');
-`);
-    writeFile(path.join(root, 'cloudflare/desktop-updates.md'), `# Electron desktop update channel
-
-The \`${bucketName}\` R2 bucket stays private. The generated
-\`desktop-updater\` Worker is the only public read path and serves signed
-installers, blockmaps, and electron-updater channel metadata through a
-Cloudflare-managed custom domain such as \`updates.example.com\`.
-
-Set the same HTTPS origin in \`apps/desktop/electron-builder.env\` as
-\`DESKTOP_UPDATE_BASE_URL\`. electron-builder expands platform and architecture
-macros below \`/releases/<os>/<arch>\`, and the packaged application reads that
-URL from its generated \`app-update.yml\` file. Keep the bucket's \`r2.dev\` URL
-and R2 bucket custom-domain access disabled.
-
-Publish signed artifacts before channel metadata. The generated publisher does
-this ordering automatically so an update check cannot discover a release whose
-installer or blockmap is not yet available.
-
-Provision and release from the repository root:
-
-\`\`\`sh
-pnpm desktop:updates:cloudflare:login
-# First replace updates.example.com in apps/desktop-updater-worker/wrangler.jsonc.
-pnpm desktop:updates:first-provision
-cp apps/desktop/electron-builder.env.example apps/desktop/electron-builder.env
-pnpm desktop:updates:build:mac
-pnpm desktop:updates:publish -- --platform mac --arch arm64
-\`\`\`
-
-Build each operating system on its native, signing-enabled CI runner. Increase
-the desktop package version for every release and upload each architecture from
-a clean \`apps/desktop/release\` directory. The publisher rejects unknown
-platforms/architectures and selects only artifacts carrying the requested
-architecture in the generated filename.
-`);
-    anhedralPrint.done('Electron desktop update channel written');
-}