dsh-edge 0.1.0 → 0.1.1

package/scripts/assemble-web.mjs

@@ -23,7 +23,7 @@ const deploymentPatches = [
 ]
 // Deployment-owned browser features use the same client-plugin contract but
 // intentionally stay out of upstream's generic Web composition.
-const edgeClientPackages = ['@deepseek-ai/dsh-client-ui-edge']
+const edgeClientPackages = ['dsh-edge-client-ui']
 
 // HMR is useful only when the upstream Node host also runs its bundle watcher.
 // Edge deploys immutable, content-addressed static assets instead.

package/scripts/legal-files.mjs

@@ -1,7 +1,8 @@
-import { readFileSync } from 'node:fs'
+import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 
-const legalFiles = ['LICENSE', 'THIRD_PARTY_NOTICES.md']
+const upstreamCopyright = 'Copyright (c) 2026 DeepSeek'
+const edgeCopyright = 'Copyright (c) 2026 pawaca'
 
 function paths(name) {
   return {
@@ -10,15 +11,72 @@ function paths(name) {
   }
 }
 
+function renderLicense() {
+  const upstream = readFileSync(paths('LICENSE').source, 'utf8')
+  if (!upstream.includes(upstreamCopyright)) {
+    throw new Error('repository-root LICENSE no longer contains the expected DeepSeek copyright')
+  }
+  return upstream.replace(upstreamCopyright, edgeCopyright)
+}
+
+function renderNotices() {
+  const upstreamLicense = readFileSync(paths('LICENSE').source, 'utf8').trim()
+  const repositoryNotices = readFileSync(paths('THIRD_PARTY_NOTICES.md').source, 'utf8')
+  const inventoryStart = repositoryNotices.indexOf('## Vendored source')
+  if (inventoryStart < 0) {
+    throw new Error('repository-root THIRD_PARTY_NOTICES.md has no dependency inventory')
+  }
+  const upstreamInventory = repositoryNotices
+    .slice(inventoryStart)
+    .replace(/^## /gmu, '### ')
+    .trim()
+
+  return `<!-- Generated by apps/dsh-edge/scripts/legal-files.mjs — do not edit by hand.
+     Run \`pnpm --filter dsh-edge run legal:write\` to regenerate. -->
+
+# Third-Party Notices
+
+\`dsh-edge\` is an independent community project and is not affiliated with or endorsed by DeepSeek.
+
+## DeepSeek Harness
+
+\`dsh-edge\` includes and adapts DeepSeek Harness. DeepSeek Harness retains its upstream copyright and MIT license:
+
+\`\`\`text
+${upstreamLicense}
+\`\`\`
+
+## DeepSeek Harness dependency notices
+
+The following inventory is reproduced from the DeepSeek Harness source distribution. Each project remains under its own license; nothing in this file changes those terms.
+
+${upstreamInventory}
+`
+}
+
+function expectedFiles() {
+  return new Map([
+    ['LICENSE', renderLicense()],
+    ['THIRD_PARTY_NOTICES.md', renderNotices()],
+  ])
+}
+
 function verify() {
-  for (const name of legalFiles) {
-    const { source, target } = paths(name)
-    if (!readFileSync(target).equals(readFileSync(source))) {
-      throw new Error(`${name} differs from the repository-root authority`)
+  for (const [name, expected] of expectedFiles()) {
+    const { target } = paths(name)
+    if (readFileSync(target, 'utf8') !== expected) {
+      throw new Error(`${name} is stale; run \`pnpm --filter dsh-edge run legal:write\``)
     }
   }
 }
 
+function write() {
+  for (const [name, content] of expectedFiles()) {
+    writeFileSync(paths(name).target, content)
+  }
+}
+
 const action = process.argv[2]
 if (action === 'verify') verify()
-else throw new Error('Usage: node scripts/legal-files.mjs verify')
+else if (action === 'write') write()
+else throw new Error('Usage: node scripts/legal-files.mjs <verify|write>')

package/scripts/verify-packed.d.mts

@@ -0,0 +1,24 @@
+export interface NpmInvocationOptions {
+  platform?: NodeJS.Platform
+  nodeExecutable?: string
+  environment?: NodeJS.ProcessEnv
+  pathExists?: (path: string) => boolean
+}
+
+export interface NpmInvocation {
+  command: string
+  args: string[]
+}
+
+/**
+ * Resolve npm to a directly executable command on the current platform.
+ * @param options Resolution inputs used by the release verifier.
+ * @returns The executable and leading arguments for npm.
+ */
+export function resolveNpmInvocation(options?: NpmInvocationOptions): NpmInvocation
+
+/**
+ * Install and exercise one packed dsh-edge artifact outside the workspace.
+ * @param input Tarball path from the command line.
+ */
+export function verifyPacked(input?: string): void

package/scripts/verify-packed.mjs

@@ -1,32 +1,85 @@
 import { execFileSync } from 'node:child_process'
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { isAbsolute, join, resolve } from 'node:path'
+import { isAbsolute, join, resolve, win32 } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
-const input = process.argv[2]
-if (input === undefined) throw new Error('Usage: node scripts/verify-packed.mjs <tarball>')
-const tarball = isAbsolute(input) ? input : resolve(process.cwd(), input)
-const directory = mkdtempSync(join(tmpdir(), 'dsh-edge-packed-'))
+/**
+ * Resolve npm without asking Windows to execute its `.cmd` shim.
+ * @param {{ platform?: NodeJS.Platform, nodeExecutable?: string, environment?: NodeJS.ProcessEnv, pathExists?: (path: string) => boolean }} [options] Resolution inputs.
+ * @returns {{ command: string, args: string[] }} Executable and leading arguments for npm.
+ */
+export function resolveNpmInvocation(options = {}) {
+  const platform = options.platform ?? process.platform
+  if (platform !== 'win32') return { command: 'npm', args: [] }
 
-function run(command, args) {
-  execFileSync(command, args, { cwd: directory, stdio: 'inherit' })
+  const environment = options.environment ?? process.env
+  const path = Object.entries(environment)
+    .find(([name]) => name.toUpperCase() === 'PATH')?.[1]
+  if (path === undefined || path === '') {
+    throw new Error('Cannot run npm on Windows because PATH is unavailable')
+  }
+
+  const pathExists = options.pathExists ?? existsSync
+  for (const rawDirectory of path.split(win32.delimiter)) {
+    const directory = rawDirectory.startsWith('"') && rawDirectory.endsWith('"')
+      ? rawDirectory.slice(1, -1)
+      : rawDirectory
+    if (directory === '') continue
+    const shim = win32.join(directory, 'npm.cmd')
+    const cli = win32.join(directory, 'node_modules', 'npm', 'bin', 'npm-cli.js')
+    if (pathExists(shim) && pathExists(cli)) {
+      return { command: options.nodeExecutable ?? process.execPath, args: [cli] }
+    }
+  }
+
+  throw new Error('Cannot run npm on Windows because npm-cli.js is not adjacent to an npm.cmd entry on PATH')
 }
 
-try {
-  run('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', tarball])
-  const packageDirectory = join(directory, 'node_modules', 'dsh-edge')
-  const license = join(packageDirectory, 'LICENSE')
-  const notices = join(packageDirectory, 'THIRD_PARTY_NOTICES.md')
-  if (!existsSync(license) || !readFileSync(license, 'utf8').startsWith('MIT License')) {
-    throw new Error('packed dsh-edge is missing its MIT license')
+/**
+ * Install and exercise one packed dsh-edge artifact outside the workspace.
+ * @param {string | undefined} input Tarball path from the command line.
+ */
+export function verifyPacked(input) {
+  if (input === undefined) throw new Error('Usage: node scripts/verify-packed.mjs <tarball>')
+  const tarball = isAbsolute(input) ? input : resolve(process.cwd(), input)
+  const directory = mkdtempSync(join(tmpdir(), 'dsh-edge-packed-'))
+
+  function run(command, args) {
+    execFileSync(command, args, { cwd: directory, stdio: 'inherit' })
   }
-  if (!existsSync(notices) || !readFileSync(notices, 'utf8').includes('# Third-Party Notices')) {
-    throw new Error('packed dsh-edge is missing third-party notices')
+
+  try {
+    const npm = resolveNpmInvocation()
+    run(npm.command, [...npm.args, 'install', '--ignore-scripts', '--no-audit', '--no-fund', tarball])
+    const packageDirectory = join(directory, 'node_modules', 'dsh-edge')
+    const license = join(packageDirectory, 'LICENSE')
+    const notices = join(packageDirectory, 'THIRD_PARTY_NOTICES.md')
+    const licenseText = existsSync(license) ? readFileSync(license, 'utf8') : ''
+    if (!licenseText.startsWith('MIT License') || !licenseText.includes('Copyright (c) 2026 pawaca')) {
+      throw new Error('packed dsh-edge is missing its MIT license')
+    }
+    if (licenseText.includes('Copyright (c) 2026 DeepSeek')) {
+      throw new Error('packed dsh-edge incorrectly assigns its copyright to DeepSeek')
+    }
+    const noticesText = existsSync(notices) ? readFileSync(notices, 'utf8') : ''
+    if (
+      !noticesText.includes('# Third-Party Notices')
+      || !noticesText.includes('not affiliated with or endorsed by DeepSeek')
+      || !noticesText.includes('Copyright (c) 2026 DeepSeek')
+    ) {
+      throw new Error('packed dsh-edge is missing third-party notices')
+    }
+    run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--version'])
+    run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--help'])
+    run(process.execPath, [join(packageDirectory, 'scripts', 'bundle.mjs'), 'direct'])
+    run(process.execPath, [join(packageDirectory, 'scripts', 'bundle.mjs'), 'isolated'])
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
   }
-  run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--version'])
-  run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--help'])
-  run(process.execPath, [join(packageDirectory, 'scripts', 'bundle.mjs'), 'direct'])
-  run(process.execPath, [join(packageDirectory, 'scripts', 'bundle.mjs'), 'isolated'])
-} finally {
-  rmSync(directory, { recursive: true, force: true })
+}
+
+if (process.argv[1] !== undefined
+  && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
+  verifyPacked(process.argv[2])
 }