dsh-edge 0.1.3 → 0.2.0-alpha.1

package/dist/plugins/dsh-edge-client-ui/client.js

@@ -8,11 +8,11 @@ window.__ModuleLoader__.load({
 		var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
 		//#endregion
 		let _deepseek_ai_dsh_client_ui_primitives = require("@deepseek-ai/dsh-client-ui-primitives");
-		let react_jsx_runtime = require("react/jsx-runtime");
 		let react = require("react");
 		let _deepseek_ai_dsh_client_runtime_client = require("@deepseek-ai/dsh-client-runtime/client");
+		let react_jsx_runtime = require("react/jsx-runtime");
 		//#endregion
-		//#region lib/types/client/store.js
+		//#region ../../../packages/client/ui-edge/src/client/store.ts
 		var import_umd = (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 			(function(global, factory) {
 				typeof exports === "object" && typeof module !== "undefined" ? factory(exports) : typeof define === "function" && define.amd ? define(["exports"], factory) : (global = typeof globalThis !== "undefined" ? globalThis : global || self, factory(global.compareVersions = {}));
@@ -180,10 +180,16 @@ window.__ModuleLoader__.load({
 				exports$1.validateStrict = validateStrict;
 			}));
 		})))();
-		/** Repeatable command for upgrading an existing Edge deployment. */
-		const DSH_EDGE_UPGRADE_COMMAND = "pnpm dlx dsh-edge@latest upgrade";
 		/** Public release history for the Edge distribution. */
 		const DSH_EDGE_RELEASES_URL = "https://github.com/pawaca/dsh-edge/releases";
+		/** Stable deployments follow latest; prerelease deployments stay on next. */
+		function releaseChannel(version) {
+			return (0, import_umd.validate)(version) && version.includes("-") ? "next" : "latest";
+		}
+		/** Repeatable command for upgrading without crossing release channels. */
+		function upgradeCommand(version) {
+			return `npx dsh-edge@${releaseChannel(version)} upgrade`;
+		}
 		function releaseStatus(current, latest) {
 			if (!(0, import_umd.validate)(current) || current === "0.0.0") return "development";
 			if (latest === void 0 || !(0, import_umd.validate)(latest)) return "unavailable";
@@ -223,16 +229,18 @@ window.__ModuleLoader__.load({
 					const health = await healthResponse.json();
 					if (!isHealth(health)) throw new Error("Invalid Edge health response");
 					if (generation !== this.loadGeneration) return;
+					const channel = releaseChannel(health.version);
 					this.store.update((state) => {
 						state.status = "ready";
 						state.health = health;
+						state.releaseChannel = channel;
 						state.releaseStatus = releaseStatus(health.version);
 						delete state.latestVersion;
 						delete state.error;
 					});
 					let latestVersion;
 					try {
-						const releaseResponse = await this.io.fetch("https://registry.npmjs.org/dsh-edge/latest", { signal: AbortSignal.timeout(5e3) });
+						const releaseResponse = await this.io.fetch(`https://registry.npmjs.org/dsh-edge/${channel}`, { signal: AbortSignal.timeout(5e3) });
 						if (releaseResponse.ok) {
 							const release = await releaseResponse.json();
 							if (release !== null && typeof release === "object" && typeof release.version === "string") latestVersion = release.version;
@@ -252,10 +260,11 @@ window.__ModuleLoader__.load({
 					});
 				}
 			}
-			/** Copy the stable upgrade command without affecting health or owner-session state. */
+			/** Copy the matching channel upgrade command without affecting deployment state. */
 			async copyUpgrade() {
 				try {
-					await this.io.copy(DSH_EDGE_UPGRADE_COMMAND);
+					const version = this.store.getSnapshot().health?.version ?? "0.0.0";
+					await this.io.copy(upgradeCommand(version));
 					this.store.update((state) => {
 						state.copied = true;
 						delete state.copyError;
@@ -290,9 +299,9 @@ window.__ModuleLoader__.load({
 			}
 		};
 		//#endregion
-		//#region \0dsh-css:D:\a\dsh-edge\dsh-edge\packages\client\ui-edge\src\client\EdgeSettingsSection.module.css.mjs
-		const css = ".B8bxQq_section{gap:20px;max-width:720px;display:grid}.B8bxQq_section header h2,.B8bxQq_card h3{color:var(--dsw-alias-text-primary);margin:0}.B8bxQq_section header p,.B8bxQq_card p{color:var(--dsw-alias-label-secondary)}.B8bxQq_card{border:1px solid var(--dsw-alias-border-subtle);border-radius:12px;padding:18px}.B8bxQq_card dl{margin:12px 0}.B8bxQq_row{border-bottom:1px solid var(--dsw-alias-border-secondary);grid-template-columns:minmax(150px,1fr) minmax(0,2fr);gap:16px;padding:8px 0;display:grid}.B8bxQq_row:last-child{border-bottom:0}.B8bxQq_row dt{color:var(--dsw-alias-label-secondary)}.B8bxQq_row dd{overflow-wrap:anywhere;color:var(--dsw-alias-text-primary);margin:0}.B8bxQq_actions{flex-wrap:wrap;align-items:center;gap:12px;display:flex}.B8bxQq_actions a{color:var(--dsw-alias-brand-primary)}.B8bxQq_status{align-items:center;gap:8px;display:flex}.B8bxQq_notice{color:var(--dsw-alias-label-secondary)}.B8bxQq_error{color:var(--dsw-alias-state-error-primary)!important}@media (width<=560px){.B8bxQq_row{grid-template-columns:1fr;gap:4px}}";
-		const tagId = "dsh-edge-client-ui/EdgeSettingsSection.module.css";
+		//#region \0dsh-edge-css:src/client/EdgeSettingsSection.module.css.mjs
+		const css = "._68Y4qa_section{gap:20px;max-width:720px;display:grid}._68Y4qa_section header h2,._68Y4qa_card h3{color:var(--dsw-alias-text-primary);margin:0}._68Y4qa_section header p,._68Y4qa_card p{color:var(--dsw-alias-label-secondary)}._68Y4qa_card{border:1px solid var(--dsw-alias-border-subtle);border-radius:12px;padding:18px}._68Y4qa_card dl{margin:12px 0}._68Y4qa_row{border-bottom:1px solid var(--dsw-alias-border-secondary);grid-template-columns:minmax(150px,1fr) minmax(0,2fr);gap:16px;padding:8px 0;display:grid}._68Y4qa_row:last-child{border-bottom:0}._68Y4qa_row dt{color:var(--dsw-alias-label-secondary)}._68Y4qa_row dd{overflow-wrap:anywhere;color:var(--dsw-alias-text-primary);margin:0}._68Y4qa_actions{flex-wrap:wrap;align-items:center;gap:12px;display:flex}._68Y4qa_actions a{color:var(--dsw-alias-brand-primary)}._68Y4qa_status{align-items:center;gap:8px;display:flex}._68Y4qa_notice{color:var(--dsw-alias-label-secondary)}._68Y4qa_error{color:var(--dsw-alias-state-error-primary)!important}@media (width<=560px){._68Y4qa_row{grid-template-columns:1fr;gap:4px}}";
+		const tagId = "dsh-edge-client-ui/src/client/EdgeSettingsSection.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
 			const tag = document.createElement("style");
 			tag.dataset.plugin = "dsh-edge-client-ui";
@@ -301,20 +310,20 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var EdgeSettingsSection_module_css_default = {
-			"actions": "B8bxQq_actions",
-			"status": "B8bxQq_status",
-			"card": "B8bxQq_card",
-			"row": "B8bxQq_row",
-			"error": "B8bxQq_error",
-			"notice": "B8bxQq_notice",
-			"section": "B8bxQq_section"
+			"actions": "_68Y4qa_actions",
+			"card": "_68Y4qa_card",
+			"error": "_68Y4qa_error",
+			"notice": "_68Y4qa_notice",
+			"row": "_68Y4qa_row",
+			"section": "_68Y4qa_section",
+			"status": "_68Y4qa_status"
 		};
 		//#endregion
-		//#region lib/types/client/EdgeSettingsSection.js
+		//#region ../../../packages/client/ui-edge/src/client/EdgeSettingsSection.tsx
 		function Row({ label, value }) {
-			return (0, react_jsx_runtime.jsxs)("div", {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: EdgeSettingsSection_module_css_default.row,
-				children: [(0, react_jsx_runtime.jsx)("dt", { children: label }), (0, react_jsx_runtime.jsx)("dd", { children: value })]
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("dt", { children: label }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("dd", { children: value })]
 			});
 		}
 		function EdgeSettingsSection(props) {
@@ -323,13 +332,13 @@ window.__ModuleLoader__.load({
 				load();
 			}, [load]);
 			const state = useEdgeSettings((snapshot) => snapshot);
-			const deploymentDetails = state.status === "idle" || state.status === "loading" ? (0, react_jsx_runtime.jsx)("p", {
+			const deploymentDetails = state.status === "idle" || state.status === "loading" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 				className: EdgeSettingsSection_module_css_default.notice,
 				children: t("loading")
-			}) : state.status === "error" || state.health === void 0 ? (0, react_jsx_runtime.jsxs)("div", {
+			}) : state.status === "error" || state.health === void 0 ? /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: EdgeSettingsSection_module_css_default.notice,
 				role: "alert",
-				children: [(0, react_jsx_runtime.jsx)("p", { children: t("loadFailed") }), (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("loadFailed") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 					variant: "outline",
 					size: "sm",
 					onClick: () => {
@@ -337,95 +346,99 @@ window.__ModuleLoader__.load({
 					},
 					children: t("retry")
 				})]
-			}) : (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [(0, react_jsx_runtime.jsxs)("section", {
+			}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				className: EdgeSettingsSection_module_css_default.card,
 				"aria-labelledby": "edge-release-title",
 				children: [
-					(0, react_jsx_runtime.jsx)("h3", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
 						id: "edge-release-title",
 						children: t("release")
 					}),
-					(0, react_jsx_runtime.jsxs)("dl", { children: [
-						(0, react_jsx_runtime.jsx)(Row, {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("dl", { children: [
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
 							label: t("currentVersion"),
 							value: state.health.version
 						}),
-						(0, react_jsx_runtime.jsx)(Row, {
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
+							label: t("updateChannel"),
+							value: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: state.releaseChannel ?? "—" })
+						}),
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
 							label: t("latestVersion"),
 							value: state.latestVersion ?? "—"
 						}),
-						(0, react_jsx_runtime.jsx)(Row, {
+						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
 							label: t("upstreamVersion"),
 							value: state.health.upstreamVersion
 						})
 					] }),
-					(0, react_jsx_runtime.jsxs)("p", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
 						className: EdgeSettingsSection_module_css_default.status,
-						children: [state.releaseStatus === void 0 || state.releaseStatus === "unavailable" ? null : (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.StateDot, { state: state.releaseStatus === "update-available" ? "warning" : "done" }), state.releaseStatus === "latest" ? t("latest") : state.releaseStatus === "update-available" ? t("updateAvailable") : state.releaseStatus === "development" ? t("development") : t("unavailable")]
+						children: [state.releaseStatus === void 0 || state.releaseStatus === "unavailable" ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.StateDot, { state: state.releaseStatus === "update-available" ? "warning" : "done" }), state.releaseStatus === "latest" ? t("latest") : state.releaseStatus === "update-available" ? t("updateAvailable") : state.releaseStatus === "development" ? t("development") : t("unavailable")]
 					}),
-					(0, react_jsx_runtime.jsxs)("div", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 						className: EdgeSettingsSection_module_css_default.actions,
-						children: [state.releaseStatus === "update-available" ? (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+						children: [state.releaseStatus === "update-available" ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 							variant: "outline",
 							size: "sm",
 							onClick: () => {
 								copyUpgrade();
 							},
 							children: state.copied ? t("copied") : t("copyUpgrade")
-						}) : null, (0, react_jsx_runtime.jsx)("a", {
+						}) : null, /* @__PURE__ */ (0, react_jsx_runtime.jsx)("a", {
 							href: DSH_EDGE_RELEASES_URL,
 							target: "_blank",
 							rel: "noreferrer",
 							children: t("releaseNotes")
 						})]
 					}),
-					state.copyError === void 0 ? null : (0, react_jsx_runtime.jsx)("p", {
+					state.copyError === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 						className: EdgeSettingsSection_module_css_default.error,
 						role: "alert",
 						children: t("copyFailed")
 					})
 				]
-			}), (0, react_jsx_runtime.jsxs)("section", {
+			}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 				className: EdgeSettingsSection_module_css_default.card,
 				"aria-labelledby": "edge-runtime-title",
-				children: [(0, react_jsx_runtime.jsx)("h3", {
+				children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
 					id: "edge-runtime-title",
 					children: t("runtime")
-				}), (0, react_jsx_runtime.jsxs)("dl", { children: [
-					(0, react_jsx_runtime.jsx)(Row, {
+				}), /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("dl", { children: [
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
 						label: t("runtime"),
 						value: state.health.shell === "just-bash-direct" ? t("direct") : t("isolated")
 					}),
-					(0, react_jsx_runtime.jsx)(Row, {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
 						label: t("storage"),
 						value: t("durableStorage")
 					}),
-					(0, react_jsx_runtime.jsx)(Row, {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsx)(Row, {
 						label: t("deploymentId"),
-						value: (0, react_jsx_runtime.jsx)("code", { children: state.health.deploymentId })
+						value: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("code", { children: state.health.deploymentId })
 					})
 				] })]
 			})] });
-			return (0, react_jsx_runtime.jsxs)("div", {
+			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 				className: EdgeSettingsSection_module_css_default.section,
 				children: [
-					(0, react_jsx_runtime.jsxs)("header", { children: [(0, react_jsx_runtime.jsx)("h2", { children: t("title") }), (0, react_jsx_runtime.jsx)("p", { children: t("intro") })] }),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("header", { children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h2", { children: t("title") }), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("intro") })] }),
 					deploymentDetails,
-					(0, react_jsx_runtime.jsxs)("section", {
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("section", {
 						className: EdgeSettingsSection_module_css_default.card,
 						"aria-labelledby": "edge-owner-title",
 						children: [
-							(0, react_jsx_runtime.jsx)("h3", {
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("h3", {
 								id: "edge-owner-title",
 								children: t("ownerSession")
 							}),
-							(0, react_jsx_runtime.jsx)("p", { children: t("ownerIntro") }),
-							state.signOutError === void 0 ? null : (0, react_jsx_runtime.jsx)("p", {
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", { children: t("ownerIntro") }),
+							state.signOutError === void 0 ? null : /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 								className: EdgeSettingsSection_module_css_default.error,
 								role: "alert",
 								children: t("signOutFailed")
 							}),
-							(0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)(_deepseek_ai_dsh_client_ui_primitives.Button, {
 								variant: "outline",
 								size: "sm",
 								disabled: state.signingOut,
@@ -440,7 +453,7 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
-		//#region lib/types/client/locales.js
+		//#region ../../../packages/client/ui-edge/src/client/locales.ts
 		/** English copy is the key-set source of truth for the Edge settings page. */
 		const en = {
 			nav: "DSH Edge",
@@ -448,7 +461,8 @@ window.__ModuleLoader__.load({
 			intro: "Deployment details and updates for this Cloudflare Worker.",
 			release: "Release",
 			currentVersion: "Installed version",
-			latestVersion: "Latest version",
+			updateChannel: "Update channel",
+			latestVersion: "Channel version",
 			upstreamVersion: "DeepSeek Harness base",
 			latest: "Up to date",
 			updateAvailable: "Update available",
@@ -481,7 +495,8 @@ window.__ModuleLoader__.load({
 			intro: "查看此 Cloudflare Worker 的部署信息和更新。",
 			release: "版本",
 			currentVersion: "当前版本",
-			latestVersion: "最新版本",
+			updateChannel: "更新渠道",
+			latestVersion: "渠道版本",
 			upstreamVersion: "DeepSeek Harness 基础版本",
 			latest: "已是最新版本",
 			updateAvailable: "有可用更新",
@@ -508,7 +523,7 @@ window.__ModuleLoader__.load({
 			signOutFailed: "退出失败，请重试。"
 		};
 		//#endregion
-		//#region lib/types/client/index.js
+		//#region ../../../packages/client/ui-edge/src/client/index.ts
 		const inject = ["slots", "locale"];
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register("settings.edge", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-edge",
-  "version": "0.1.3",
+  "version": "0.2.0-alpha.1",
   "description": "Run DeepSeek Harness on Cloudflare Workers as an independent community project",
   "author": "pawaca",
   "license": "MIT",
@@ -45,6 +45,7 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
+    "compare-versions": "6.1.1",
     "execa": "^10.0.0",
     "jsonc-parser": "^3.3.1",
     "wrangler": "4.123.0"
@@ -52,49 +53,48 @@
   "devDependencies": {
     "@cloudflare/computer": "0.2.0",
     "@cloudflare/workers-types": "5.20260812.1",
-    "just-bash": "3.3.0",
-    "playwright": "^1.49.0",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
-    "ws": "^8.21.0",
-    "@deepseek-ai/dsh-brand": "0.1.0-rc.7",
     "@deepseek-ai/cordis": "4.0.1",
     "@deepseek-ai/dsh-agent": "0.1.0-rc.7",
     "@deepseek-ai/dsh-agent-loop": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-anonymous-user-id": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-brand": "0.1.0-rc.7",
     "@deepseek-ai/dsh-credentials": "0.1.0-rc.7",
     "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-anonymous-user-id": "0.1.0-rc.7",
     "@deepseek-ai/dsh-launch-environment": "0.1.0-rc.7",
     "@deepseek-ai/dsh-llm": "0.1.0-rc.7",
     "@deepseek-ai/dsh-llm-deepseek": "0.1.0-rc.7",
     "@deepseek-ai/dsh-session": "0.1.0-rc.7",
     "@deepseek-ai/dsh-session-persistence": "0.1.0-rc.7",
     "@deepseek-ai/dsh-session-query": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-session-title": "0.1.0-rc.7",
     "@deepseek-ai/dsh-settings": "0.1.0-rc.7",
     "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-session-title": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-tool-web": "0.1.0-rc.7",
     "@deepseek-ai/dsh-tool-call-timeout-policy": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tool-web": "0.1.0-rc.7",
     "@deepseek-ai/dsh-tools": "0.1.0-rc.7",
     "@deepseek-ai/dsh-web": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-web-search-deepseek": "0.1.0-rc.7"
+    "@deepseek-ai/dsh-web-search-deepseek": "0.1.0-rc.7",
+    "just-bash": "3.3.0",
+    "playwright": "^1.49.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8",
+    "ws": "^8.21.0"
   },
   "scripts": {
-    "bundle:direct": "pnpm run web:build && node scripts/bundle.mjs direct",
-    "bundle:isolated": "pnpm run web:build && node scripts/bundle.mjs isolated",
-    "bundle:workers": "node scripts/bundle.mjs direct && node scripts/bundle.mjs isolated",
-    "dev": "pnpm run web:build && wrangler dev --env=\"\"",
-    "dev:isolated": "pnpm run web:build && wrangler dev --env isolated",
+    "bundle:direct": "pnpm run web:build && pnpm --dir standalone run build:worker:direct && node standalone/scripts/promote.mjs direct",
+    "bundle:isolated": "pnpm run web:build && pnpm --dir standalone run build:worker:isolated && node standalone/scripts/promote.mjs isolated",
+    "bundle:workers": "pnpm --dir standalone run build && pnpm --dir standalone run verify && node standalone/scripts/promote.mjs all",
+    "dev": "pnpm run bundle:direct && node scripts/dev.mjs direct",
+    "dev:isolated": "pnpm run bundle:isolated && node scripts/dev.mjs isolated",
     "dsh-edge": "node scripts/cli.mjs",
     "example:install": "node examples/install-keyless.mjs",
-    "install:cloudflare": "pnpm run web:build && pnpm run bundle:workers && node scripts/cli.mjs install",
+    "install:cloudflare": "pnpm run bundle:workers && node scripts/cli.mjs install",
     "legal:write": "node scripts/legal-files.mjs write",
     "pack:verify": "node scripts/verify-packed.mjs",
-    "web:assemble": "node scripts/assemble-web.mjs",
-    "web:build": "pnpm --workspace-root run build:lib:host && pnpm --workspace-root run build:lib:client && pnpm --workspace-root run build:web && pnpm run web:assemble",
-    "test": "vitest run --root ../.. apps/dsh-edge/tests/agent.spec.ts apps/dsh-edge/tests/auth.spec.ts apps/dsh-edge/tests/cli.spec.ts apps/dsh-edge/tests/deployment-health.spec.ts apps/dsh-edge/tests/deployment.spec.ts apps/dsh-edge/tests/direct-shell.spec.ts apps/dsh-edge/tests/do-session-persistence.spec.ts apps/dsh-edge/tests/edge-api.spec.ts apps/dsh-edge/tests/edge-credentials.spec.ts apps/dsh-edge/tests/edge-remotes.spec.ts apps/dsh-edge/tests/installer.spec.ts apps/dsh-edge/tests/sse.spec.ts apps/dsh-edge/tests/verify-packed.spec.ts apps/dsh-edge/tests/web-search.spec.ts apps/dsh-edge/tests/workspace.spec.ts",
-    "test:integration": "pnpm run web:build && node tests/session.integration.mjs",
-    "test:snapshot": "vitest run --config vitest.snapshot.config.ts",
+    "web:build": "pnpm --dir standalone run build:web && node standalone/scripts/promote.mjs web",
+    "test": "vitest run --root ../.. --project edge-runtime",
+    "test:integration": "pnpm run bundle:workers && node tests/run-session-integration.mjs",
+    "test:snapshot": "vitest run --root ../.. --config apps/dsh-edge/vitest.snapshot.config.ts",
     "typecheck": "tsc --noEmit"
   }
 }

package/scripts/dev.mjs

@@ -0,0 +1,38 @@
+/** Serve the exact prebuilt artifact used by the installer. */
+
+import { createRequire } from 'node:module'
+import { randomUUID } from 'node:crypto'
+import { rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import { writePrebuiltModeWranglerConfig } from './wrangler-config.mjs'
+
+const mode = process.argv[2]
+if (mode !== 'direct' && mode !== 'isolated') {
+  process.stderr.write('Usage: node scripts/dev.mjs <direct|isolated> [wrangler dev options]\n')
+  process.exitCode = 2
+} else {
+  const appDirectory = fileURLToPath(new URL('..', import.meta.url))
+  const require = createRequire(import.meta.url)
+  // Keep the generated config beside `.dev.vars`; Wrangler resolves local
+  // secrets relative to the configuration file rather than the process cwd.
+  const configFile = join(appDirectory, `.wrangler.dev.${randomUUID()}.json`)
+  try {
+    await writePrebuiltModeWranglerConfig(mode, configFile)
+    const result = await execa(process.execPath, [
+      require.resolve('wrangler'),
+      'dev',
+      '--config', configFile,
+      '--env', mode === 'direct' ? '' : 'isolated',
+      ...process.argv.slice(3),
+    ], {
+      cwd: appDirectory,
+      stdio: 'inherit',
+      reject: false,
+    })
+    process.exitCode = result.exitCode ?? 1
+  } finally {
+    await rm(configFile, { force: true })
+  }
+}

package/scripts/install.mjs

@@ -1,6 +1,6 @@
 import { randomBytes } from 'node:crypto'
 import { execFile } from 'node:child_process'
-import { chmod, mkdtemp, open, readFile, rm, writeFile } from 'node:fs/promises'
+import { chmod, mkdtemp, open, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -93,6 +93,48 @@ const SENSITIVE_ENV_KEY = /(KEY|PASSWORD|SECRET|TOKEN)/iu
 const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u
 const CLAIM_URL = /https:\/\/dash\.cloudflare\.com\/claim-preview\?[^\s\u001b]+/u
 const MAX_CAPTURE_BYTES = 2 * 1024 * 1024
+const WINDOWS_ACL_TIMEOUT_MS = 30_000
+const WINDOWS_PRIVATE_DIRECTORY_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+$directory = [System.IO.Path]::GetFullPath($env:DSH_EDGE_PRIVATE_DIRECTORY)
+if (-not [System.IO.Directory]::Exists($directory)) {
+  throw 'Installer temporary directory does not exist.'
+}
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = [System.Security.AccessControl.DirectorySecurity]::new()
+$acl.SetOwner($identity)
+$acl.SetAccessRuleProtection($true, $false)
+$inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
+$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+  $identity,
+  [System.Security.AccessControl.FileSystemRights]::FullControl,
+  $inheritance,
+  [System.Security.AccessControl.PropagationFlags]::None,
+  [System.Security.AccessControl.AccessControlType]::Allow
+)
+$acl.AddAccessRule($rule)
+[System.IO.Directory]::SetAccessControl($directory, $acl)
+
+$verified = [System.IO.Directory]::GetAccessControl(
+  $directory,
+  [System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access
+)
+$owner = $verified.GetOwner([System.Security.Principal.SecurityIdentifier])
+$rules = @($verified.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+if (-not $verified.AreAccessRulesProtected -or $owner.Value -ne $identity.Value -or $rules.Count -ne 1) {
+  throw "Installer temporary directory DACL is not private (protected=$($verified.AreAccessRulesProtected), owner=$($owner.Value), user=$($identity.Value), rules=$($rules.Count))."
+}
+$verifiedRule = $rules[0]
+if (
+  $verifiedRule.IdentityReference.Value -ne $identity.Value -or
+  $verifiedRule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow -or
+  $verifiedRule.FileSystemRights -ne [System.Security.AccessControl.FileSystemRights]::FullControl -or
+  $verifiedRule.InheritanceFlags -ne $inheritance -or
+  $verifiedRule.PropagationFlags -ne [System.Security.AccessControl.PropagationFlags]::None
+) {
+  throw 'Installer temporary directory DACL has unexpected access rules.'
+}
+`
 
 export class InstallCancelledError extends Error {
   constructor() {
@@ -1001,6 +1043,38 @@ async function readBoundedUtf8File(path, maxBytes) {
 
 async function createPrivateTemporaryDirectory() {
   const directory = await mkdtemp(join(tmpdir(), 'dsh-edge-install-'))
-  await chmod(directory, 0o700)
-  return directory
+  try {
+    if (process.platform === 'win32') {
+      const systemRoot = process.env.SystemRoot ?? process.env.WINDIR
+      if (systemRoot === undefined || systemRoot === '') {
+        throw new Error('Could not locate Windows PowerShell to secure installer credentials.')
+      }
+      const powershell = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+      const encodedCommand = Buffer.from(WINDOWS_PRIVATE_DIRECTORY_SCRIPT, 'utf16le').toString('base64')
+      try {
+        await execa(powershell, [
+          '-NoLogo',
+          '-NoProfile',
+          '-NonInteractive',
+          '-EncodedCommand',
+          encodedCommand,
+        ], {
+          env: {
+            ...process.env,
+            DSH_EDGE_PRIVATE_DIRECTORY: directory,
+          },
+          timeout: WINDOWS_ACL_TIMEOUT_MS,
+          windowsHide: true,
+        })
+      } catch (error) {
+        throw new Error('Could not establish a private Windows ACL for installer credentials.', { cause: error })
+      }
+    } else {
+      await chmod(directory, 0o700)
+    }
+    return directory
+  } catch (error) {
+    await rm(directory, { recursive: true, force: true }).catch(() => {})
+    throw error
+  }
 }

package/scripts/legal-files.d.mts

@@ -0,0 +1,23 @@
+export interface BundledComponent {
+  author?: string | { name?: string }
+  license: string
+  name: string
+  path: string
+  repository?: string | { url?: string }
+  version: string
+}
+
+export interface LegalDocumentUse {
+  file: string
+  name: string
+  version: string
+}
+
+export interface LegalDocument {
+  id: string
+  text: string
+  uses: LegalDocumentUse[]
+}
+
+export declare function collectLicenseDocuments(components: BundledComponent[]): LegalDocument[]
+export declare function renderBundledTerms(components: BundledComponent[]): string