dsh-edge 0.1.0 → 0.1.3

package/scripts/verify-packed.d.mts

@@ -0,0 +1,24 @@
+export interface NpmInvocationOptions {
+  platform?: NodeJS.Platform
+  nodeExecutable?: string
+  environment?: NodeJS.ProcessEnv
+  pathExists?: (path: string) => boolean
+}
+
+export interface NpmInvocation {
+  command: string
+  args: string[]
+}
+
+/**
+ * Resolve npm to a directly executable command on the current platform.
+ * @param options Resolution inputs used by the release verifier.
+ * @returns The executable and leading arguments for npm.
+ */
+export function resolveNpmInvocation(options?: NpmInvocationOptions): NpmInvocation
+
+/**
+ * Install and exercise one packed dsh-edge artifact outside the workspace.
+ * @param input Tarball path from the command line.
+ */
+export function verifyPacked(input?: string): void

package/scripts/verify-packed.mjs

@@ -1,32 +1,94 @@
 import { execFileSync } from 'node:child_process'
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs'
+import { existsSync, mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
-import { isAbsolute, join, resolve } from 'node:path'
+import { isAbsolute, join, resolve, win32 } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
-const input = process.argv[2]
-if (input === undefined) throw new Error('Usage: node scripts/verify-packed.mjs <tarball>')
-const tarball = isAbsolute(input) ? input : resolve(process.cwd(), input)
-const directory = mkdtempSync(join(tmpdir(), 'dsh-edge-packed-'))
+/**
+ * Resolve npm without asking Windows to execute its `.cmd` shim.
+ * @param {{ platform?: NodeJS.Platform, nodeExecutable?: string, environment?: NodeJS.ProcessEnv, pathExists?: (path: string) => boolean }} [options] Resolution inputs.
+ * @returns {{ command: string, args: string[] }} Executable and leading arguments for npm.
+ */
+export function resolveNpmInvocation(options = {}) {
+  const platform = options.platform ?? process.platform
+  if (platform !== 'win32') return { command: 'npm', args: [] }
 
-function run(command, args) {
-  execFileSync(command, args, { cwd: directory, stdio: 'inherit' })
+  const environment = options.environment ?? process.env
+  const path = Object.entries(environment)
+    .find(([name]) => name.toUpperCase() === 'PATH')?.[1]
+  if (path === undefined || path === '') {
+    throw new Error('Cannot run npm on Windows because PATH is unavailable')
+  }
+
+  const pathExists = options.pathExists ?? existsSync
+  for (const rawDirectory of path.split(win32.delimiter)) {
+    const directory = rawDirectory.startsWith('"') && rawDirectory.endsWith('"')
+      ? rawDirectory.slice(1, -1)
+      : rawDirectory
+    if (directory === '') continue
+    const shim = win32.join(directory, 'npm.cmd')
+    const cli = win32.join(directory, 'node_modules', 'npm', 'bin', 'npm-cli.js')
+    if (pathExists(shim) && pathExists(cli)) {
+      return { command: options.nodeExecutable ?? process.execPath, args: [cli] }
+    }
+  }
+
+  throw new Error('Cannot run npm on Windows because npm-cli.js is not adjacent to an npm.cmd entry on PATH')
 }
 
-try {
-  run('npm', ['install', '--ignore-scripts', '--no-audit', '--no-fund', tarball])
-  const packageDirectory = join(directory, 'node_modules', 'dsh-edge')
-  const license = join(packageDirectory, 'LICENSE')
-  const notices = join(packageDirectory, 'THIRD_PARTY_NOTICES.md')
-  if (!existsSync(license) || !readFileSync(license, 'utf8').startsWith('MIT License')) {
-    throw new Error('packed dsh-edge is missing its MIT license')
+/**
+ * Install and exercise one packed dsh-edge artifact outside the workspace.
+ * @param {string | undefined} input Tarball path from the command line.
+ */
+export function verifyPacked(input) {
+  if (input === undefined) throw new Error('Usage: node scripts/verify-packed.mjs <tarball>')
+  const tarball = isAbsolute(input) ? input : resolve(process.cwd(), input)
+  const directory = mkdtempSync(join(tmpdir(), 'dsh-edge-packed-'))
+
+  function run(command, args) {
+    execFileSync(command, args, { cwd: directory, stdio: 'inherit' })
   }
-  if (!existsSync(notices) || !readFileSync(notices, 'utf8').includes('# Third-Party Notices')) {
-    throw new Error('packed dsh-edge is missing third-party notices')
+
+  try {
+    const npm = resolveNpmInvocation()
+    run(npm.command, [...npm.args, 'install', '--ignore-scripts', '--no-audit', '--no-fund', tarball])
+    const packageDirectory = join(directory, 'node_modules', 'dsh-edge')
+    const manifest = JSON.parse(readFileSync(join(packageDirectory, 'package.json'), 'utf8'))
+    const dependencies = Object.keys(manifest.dependencies ?? {})
+    const sourceRuntimeDependency = dependencies.find(name => (
+      name.startsWith('@deepseek-ai/')
+      || name === '@cloudflare/computer'
+      || name === 'just-bash'
+    ))
+    if (sourceRuntimeDependency !== undefined) {
+      throw new Error(`packed dsh-edge still installs bundled source dependency ${sourceRuntimeDependency}`)
+    }
+    const license = join(packageDirectory, 'LICENSE')
+    const notices = join(packageDirectory, 'THIRD_PARTY_NOTICES.md')
+    const licenseText = existsSync(license) ? readFileSync(license, 'utf8') : ''
+    if (!licenseText.startsWith('MIT License') || !licenseText.includes('Copyright (c) 2026 pawaca')) {
+      throw new Error('packed dsh-edge is missing its MIT license')
+    }
+    if (licenseText.includes('Copyright (c) 2026 DeepSeek')) {
+      throw new Error('packed dsh-edge incorrectly assigns its copyright to DeepSeek')
+    }
+    const noticesText = existsSync(notices) ? readFileSync(notices, 'utf8') : ''
+    if (
+      !noticesText.includes('# Third-Party Notices')
+      || !noticesText.includes('not affiliated with or endorsed by DeepSeek')
+      || !noticesText.includes('Copyright (c) 2026 DeepSeek')
+    ) {
+      throw new Error('packed dsh-edge is missing third-party notices')
+    }
+    run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--version'])
+    run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--help'])
+    run(process.execPath, [join(packageDirectory, 'scripts', 'smoke-installed.mjs')])
+  } finally {
+    rmSync(directory, { recursive: true, force: true })
   }
-  run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--version'])
-  run(process.execPath, [join(packageDirectory, 'scripts', 'cli.mjs'), '--help'])
-  run(process.execPath, [join(packageDirectory, 'scripts', 'bundle.mjs'), 'direct'])
-  run(process.execPath, [join(packageDirectory, 'scripts', 'bundle.mjs'), 'isolated'])
-} finally {
-  rmSync(directory, { recursive: true, force: true })
+}
+
+if (process.argv[1] !== undefined
+  && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
+  verifyPacked(process.argv[2])
 }

package/scripts/wrangler-config.d.mts

@@ -5,14 +5,31 @@ export interface WranglerConfigOptions {
   sourceConfigPath?: string
 }
 
-export function renderModeWranglerConfig(
+export function renderSourceModeWranglerConfig(
   mode: RuntimeMode,
   source: string,
   options?: WranglerConfigOptions,
 ): string
 
-export function writeModeWranglerConfig(
+export function renderPrebuiltModeWranglerConfig(
+  mode: RuntimeMode,
+  source: string,
+  options?: WranglerConfigOptions,
+): string
+
+export function writeSourceModeWranglerConfig(
   mode: RuntimeMode,
   destination: string,
   options?: WranglerConfigOptions,
 ): Promise<void>
+
+export function writePrebuiltModeWranglerConfig(
+  mode: RuntimeMode,
+  destination: string,
+  options?: WranglerConfigOptions,
+): Promise<void>
+
+export function workerArtifactPath(
+  mode: RuntimeMode,
+  options?: Pick<WranglerConfigOptions, 'appDirectory'>,
+): string

package/scripts/wrangler-config.mjs

@@ -10,11 +10,76 @@ const DIRECT_SHELL_CORE_REPLACEMENT = 'src/direct-shell-core-empty.ts'
 const ISOLATED_DIRECT_SHELL = './direct-shell.ts'
 const ISOLATED_DIRECT_SHELL_REPLACEMENT = 'src/isolated-direct-shell-unavailable.ts'
 const RESERVED_ALIASES = new Set([DIRECT_SHELL_CORE, ISOLATED_DIRECT_SHELL])
+const WORKER_ARTIFACTS = Object.freeze({
+  direct: 'worker/direct/index.js',
+  isolated: 'worker/isolated/index.js',
+})
 
-/** Render one absolute-path Wrangler configuration from the repository source. */
-export function renderModeWranglerConfig(mode, source, options = {}) {
+/** Render one mode-specific build configuration from the repository source. */
+export function renderSourceModeWranglerConfig(mode, source, options = {}) {
   requireRuntimeMode(mode)
   const root = options.appDirectory ?? appDirectory
+  const parsed = parseSourceConfig(source)
+  const config = structuredClone(parsed)
+  delete config.$schema
+  config.main = resolve(root, parsed.main)
+  config.assets.directory = resolve(root, parsed.assets.directory)
+  config.minify = true
+  if (mode === 'direct') {
+    config.alias = {
+      ...config.alias,
+      [DIRECT_SHELL_CORE]: resolve(root, DIRECT_SHELL_CORE_REPLACEMENT),
+    }
+  } else {
+    config.alias = {
+      ...config.alias,
+      [ISOLATED_DIRECT_SHELL]: resolve(root, ISOLATED_DIRECT_SHELL_REPLACEMENT),
+    }
+  }
+  return `${JSON.stringify(config, undefined, 2)}\n`
+}
+
+/** Render an upload configuration that deploys the released Worker without rebuilding it. */
+export function renderPrebuiltModeWranglerConfig(mode, source, options = {}) {
+  requireRuntimeMode(mode)
+  const root = options.appDirectory ?? appDirectory
+  const parsed = parseSourceConfig(source)
+  const config = structuredClone(parsed)
+  delete config.$schema
+  delete config.alias
+  delete config.minify
+  config.main = resolve(root, WORKER_ARTIFACTS[mode])
+  config.assets.directory = resolve(root, parsed.assets.directory)
+  config.no_bundle = true
+  config.find_additional_modules = false
+  return `${JSON.stringify(config, undefined, 2)}\n`
+}
+
+/** Write the source configuration used to build one released Worker artifact. */
+export async function writeSourceModeWranglerConfig(mode, destination, options = {}) {
+  const source = await readFile(options.sourceConfigPath ?? sourceConfigPath, 'utf8')
+  const rendered = renderSourceModeWranglerConfig(mode, source, options)
+  await writePrivateConfig(destination, rendered)
+}
+
+/** Write the private no-bundle configuration used by one installation attempt. */
+export async function writePrebuiltModeWranglerConfig(mode, destination, options = {}) {
+  const source = await readFile(options.sourceConfigPath ?? sourceConfigPath, 'utf8')
+  const rendered = renderPrebuiltModeWranglerConfig(mode, source, options)
+  await writePrivateConfig(destination, rendered)
+}
+
+/** Return the released entrypoint for a runtime mode. */
+export function workerArtifactPath(mode, options = {}) {
+  requireRuntimeMode(mode)
+  return resolve(options.appDirectory ?? appDirectory, WORKER_ARTIFACTS[mode])
+}
+
+async function writePrivateConfig(destination, rendered) {
+  await writeFile(destination, rendered, { encoding: 'utf8', mode: 0o600, flag: 'wx' })
+}
+
+function parseSourceConfig(source) {
   const errors = []
   const parsed = parse(source, errors, {
     allowEmptyContent: false,
@@ -42,31 +107,7 @@ export function renderModeWranglerConfig(mode, source, options = {}) {
   if (reservedAlias !== undefined) {
     throw new Error(`wrangler.jsonc reserves the ${reservedAlias} alias for mode builds.`)
   }
-
-  const config = structuredClone(parsed)
-  delete config.$schema
-  config.main = resolve(root, parsed.main)
-  config.assets.directory = resolve(root, parsed.assets.directory)
-  config.minify = true
-  if (mode === 'direct') {
-    config.alias = {
-      ...config.alias,
-      [DIRECT_SHELL_CORE]: resolve(root, DIRECT_SHELL_CORE_REPLACEMENT),
-    }
-  } else {
-    config.alias = {
-      ...config.alias,
-      [ISOLATED_DIRECT_SHELL]: resolve(root, ISOLATED_DIRECT_SHELL_REPLACEMENT),
-    }
-  }
-  return `${JSON.stringify(config, undefined, 2)}\n`
-}
-
-/** Write the private Wrangler configuration used by one installation attempt. */
-export async function writeModeWranglerConfig(mode, destination, options = {}) {
-  const source = await readFile(options.sourceConfigPath ?? sourceConfigPath, 'utf8')
-  const rendered = renderModeWranglerConfig(mode, source, options)
-  await writeFile(destination, rendered, { encoding: 'utf8', mode: 0o600, flag: 'wx' })
+  return parsed
 }
 
 function requireRuntimeMode(mode) {