dsh-edge 0.1.3 → 0.2.0-alpha.2

package/scripts/cli.mjs

@@ -5,6 +5,7 @@ import { realpathSync, writeSync } from 'node:fs'
 import { Writable } from 'node:stream'
 import { fileURLToPath } from 'node:url'
 import edgePackage from '../package.json' with { type: 'json' }
+import { observePublicActivation } from './activation.mjs'
 import {
   executeWrangler,
   InstallCancelledError,
@@ -18,6 +19,12 @@ const INTERRUPT_EXIT_CODES = new Map([
   ['SIGTERM', 143],
 ])
 const OUTPUT_DRAIN_TIMEOUT_MS = 1_000
+const HERO_MIN_COLUMNS = 68
+const DSH_EDGE_HERO = String.raw` ____  ____  _   _       _____ ____   ____ _____
+|  _ \/ ___|| | | |     | ____|  _ \ / ___| ____|
+| | | \___ \| |_| |_____|  _| | | | | |  _|  _|
+| |_| |___) |  _  |_____| |___| |_| | |_| | |___
+|____/|____/|_| |_|     |_____|____/ \____|_____|`
 
 export class InstallInterruptedError extends InstallCancelledError {
   constructor(signal) {
@@ -38,6 +45,25 @@ export function parseCommand(args) {
   throw usageError()
 }
 
+export function renderInstallerIntro(command, {
+  columns = 80,
+  isTTY = false,
+  version = edgePackage.version,
+  upstreamVersion = edgePackage.dshEdge.upstreamVersion,
+} = {}) {
+  if (!isTTY || columns < HERO_MIN_COLUMNS) {
+    return `dsh-edge ${command} · ${version} · Harness ${upstreamVersion}`
+  }
+  return [
+    '',
+    DSH_EDGE_HERO,
+    '',
+    'DeepSeek Harness on Cloudflare',
+    `dsh-edge ${version} · Harness ${upstreamVersion}`,
+    `community project · ${command}`,
+  ].join('\n')
+}
+
 export function createInstallerUi(
   clack = prompt,
   signal,
@@ -54,8 +80,13 @@ export function createInstallerUi(
     ? clack.note(message, title)
     : clack.note(message, title, { output })
   let deploymentSpinner
+  let activationSpinner
+  const terminal = output ?? process.stdout
   return {
-    intro: message => log(clack.intro, message),
+    intro: () => log(clack.intro, renderInstallerIntro(command, {
+      columns: terminal.columns ?? 80,
+      isTTY: terminal.isTTY === true,
+    })),
     step: message => log(clack.log.step, message),
     async selectRuntime() {
       return await requireAnswer(await clack.select(withOutput({
@@ -164,6 +195,20 @@ export function createInstallerUi(
       else deploymentSpinner.error('Cloudflare did not accept the Worker upload.')
       deploymentSpinner = undefined
     },
+    activationStart(message) {
+      activationSpinner = clack.spinner(withOutput({ indicator: 'timer', signal }))
+      activationSpinner.start(message)
+    },
+    activationFinish(result) {
+      if (activationSpinner === undefined) return
+      if (result?.status === 'ready') activationSpinner.stop('Public URL is ready.')
+      else if (result?.status === 'pending') {
+        activationSpinner.stop('Worker uploaded; public URL activation is still pending.')
+      } else {
+        activationSpinner.stop('Stopped waiting for public URL activation.')
+      }
+      activationSpinner = undefined
+    },
     failedDeployment(result) {
       note([
         `Worker: ${result.workerName}`,
@@ -193,6 +238,14 @@ export function createInstallerUi(
     },
     success(result) {
       const lines = [
+        ...(result.activation?.status === 'ready'
+          ? ['Status: Ready']
+          : [
+              'Status: Cloudflare is still activating the public URL.',
+              'First-time workers.dev activation can take about a minute.',
+              'If the URL shows a placeholder, wait a moment and refresh.',
+            ]),
+        '',
         `URL: ${result.publicUrl}`,
         `Owner access key: ${result.ownerSecret}`,
       ]
@@ -204,6 +257,7 @@ export function createInstallerUi(
           '1. Claim this temporary account within 60 minutes to keep the Worker and its data.',
           '2. Open the URL above.',
           '3. Enter the owner access key when prompted.',
+          '4. Save the owner access key for future upgrades.',
         )
       } else {
         lines.push(
@@ -211,10 +265,18 @@ export function createInstallerUi(
           'Next steps:',
           '1. Open the URL above.',
           '2. Enter the owner access key when prompted.',
+          '3. Save the owner access key for future upgrades.',
         )
       }
-      note(lines.join('\n'), command === 'upgrade' ? 'dsh-edge upgraded' : 'dsh-edge installed')
-      log(clack.outro, command === 'upgrade' ? 'Upgrade handoff complete.' : 'Installation handoff complete.')
+      const ready = result.activation?.status === 'ready'
+      const title = ready
+        ? (command === 'upgrade' ? 'dsh-edge upgrade is live' : 'dsh-edge is ready')
+        : 'Worker uploaded — activation pending'
+      note(lines.join('\n'), title)
+      const outro = ready
+        ? (command === 'upgrade' ? 'Your dsh-edge upgrade is live.' : 'Your dsh-edge is ready.')
+        : `${command === 'upgrade' ? 'Upgrade' : 'Installation'} succeeded; Cloudflare is still activating the public URL.`
+      log(clack.outro, outro)
     },
   }
 }
@@ -294,6 +356,7 @@ export async function runInstaller({
   controller.signal.addEventListener('abort', cancelBlockedOutput)
   const installOperation = install ?? (options => installEdgeImpl({
     ...options,
+    observeActivation: observePublicActivation,
     runWrangler: (args, runOptions) => wranglerRunner(args, {
       ...runOptions,
       forwardOutput: verbose || (runOptions?.forwardOutput ?? runOptions?.interactive ?? false),

package/scripts/dev.mjs

@@ -0,0 +1,38 @@
+/** Serve the exact prebuilt artifact used by the installer. */
+
+import { createRequire } from 'node:module'
+import { randomUUID } from 'node:crypto'
+import { rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import { writePrebuiltModeWranglerConfig } from './wrangler-config.mjs'
+
+const mode = process.argv[2]
+if (mode !== 'direct' && mode !== 'isolated') {
+  process.stderr.write('Usage: node scripts/dev.mjs <direct|isolated> [wrangler dev options]\n')
+  process.exitCode = 2
+} else {
+  const appDirectory = fileURLToPath(new URL('..', import.meta.url))
+  const require = createRequire(import.meta.url)
+  // Keep the generated config beside `.dev.vars`; Wrangler resolves local
+  // secrets relative to the configuration file rather than the process cwd.
+  const configFile = join(appDirectory, `.wrangler.dev.${randomUUID()}.json`)
+  try {
+    await writePrebuiltModeWranglerConfig(mode, configFile)
+    const result = await execa(process.execPath, [
+      require.resolve('wrangler'),
+      'dev',
+      '--config', configFile,
+      '--env', mode === 'direct' ? '' : 'isolated',
+      ...process.argv.slice(3),
+    ], {
+      cwd: appDirectory,
+      stdio: 'inherit',
+      reject: false,
+    })
+    process.exitCode = result.exitCode ?? 1
+  } finally {
+    await rm(configFile, { force: true })
+  }
+}

package/scripts/install.d.mts

@@ -34,6 +34,8 @@ export interface InstallerUi {
   acceptTemporaryTerms(): Promise<boolean>
   deploymentStart?(message: string): void
   deploymentFinish?(succeeded: boolean): void
+  activationStart?(message: string): void
+  activationFinish?(result?: import('./activation.mjs').ActivationObservation): void
   failedDeployment?(result: { claimUrl: string; workerName: string }): void
   cleanupFailure(message: string): void
   recovery(result: InstallRecovery): void
@@ -52,6 +54,7 @@ export interface InstallRecovery {
 }
 
 export interface InstallResult {
+  activation?: import('./activation.mjs').ActivationObservation
   publicUrl: string
   versionId?: string
   account?: CloudflareAccount
@@ -130,6 +133,11 @@ export function installEdge(options: {
   environment?: NodeJS.ProcessEnv
   createTemporaryDirectory?: () => Promise<string>
   removePath?: typeof import('node:fs/promises').rm
+  observeActivation?: (options: {
+    publicUrl: string
+    mode: RuntimeMode
+    signal?: AbortSignal
+  }) => Promise<import('./activation.mjs').ActivationObservation>
   signal?: AbortSignal
 }): Promise<InstallResult>
 export function wranglerProcessInvocation(args: string[], options?: {

package/scripts/install.mjs

@@ -1,6 +1,6 @@
 import { randomBytes } from 'node:crypto'
 import { execFile } from 'node:child_process'
-import { chmod, mkdtemp, open, readFile, rm, writeFile } from 'node:fs/promises'
+import { chmod, mkdtemp, open, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
@@ -93,6 +93,48 @@ const SENSITIVE_ENV_KEY = /(KEY|PASSWORD|SECRET|TOKEN)/iu
 const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u
 const CLAIM_URL = /https:\/\/dash\.cloudflare\.com\/claim-preview\?[^\s\u001b]+/u
 const MAX_CAPTURE_BYTES = 2 * 1024 * 1024
+const WINDOWS_ACL_TIMEOUT_MS = 30_000
+const WINDOWS_PRIVATE_DIRECTORY_SCRIPT = String.raw`
+$ErrorActionPreference = 'Stop'
+$directory = [System.IO.Path]::GetFullPath($env:DSH_EDGE_PRIVATE_DIRECTORY)
+if (-not [System.IO.Directory]::Exists($directory)) {
+  throw 'Installer temporary directory does not exist.'
+}
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$acl = [System.Security.AccessControl.DirectorySecurity]::new()
+$acl.SetOwner($identity)
+$acl.SetAccessRuleProtection($true, $false)
+$inheritance = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
+$rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+  $identity,
+  [System.Security.AccessControl.FileSystemRights]::FullControl,
+  $inheritance,
+  [System.Security.AccessControl.PropagationFlags]::None,
+  [System.Security.AccessControl.AccessControlType]::Allow
+)
+$acl.AddAccessRule($rule)
+[System.IO.Directory]::SetAccessControl($directory, $acl)
+
+$verified = [System.IO.Directory]::GetAccessControl(
+  $directory,
+  [System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access
+)
+$owner = $verified.GetOwner([System.Security.Principal.SecurityIdentifier])
+$rules = @($verified.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+if (-not $verified.AreAccessRulesProtected -or $owner.Value -ne $identity.Value -or $rules.Count -ne 1) {
+  throw "Installer temporary directory DACL is not private (protected=$($verified.AreAccessRulesProtected), owner=$($owner.Value), user=$($identity.Value), rules=$($rules.Count))."
+}
+$verifiedRule = $rules[0]
+if (
+  $verifiedRule.IdentityReference.Value -ne $identity.Value -or
+  $verifiedRule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow -or
+  $verifiedRule.FileSystemRights -ne [System.Security.AccessControl.FileSystemRights]::FullControl -or
+  $verifiedRule.InheritanceFlags -ne $inheritance -or
+  $verifiedRule.PropagationFlags -ne [System.Security.AccessControl.PropagationFlags]::None
+) {
+  throw 'Installer temporary directory DACL has unexpected access rules.'
+}
+`
 
 export class InstallCancelledError extends Error {
   constructor() {
@@ -285,6 +327,7 @@ export async function installEdge({
   environment = process.env,
   createTemporaryDirectory = createPrivateTemporaryDirectory,
   removePath = rm,
+  observeActivation,
   signal,
 } = {}) {
   if (ui === undefined) throw new Error('installEdge requires an installer UI.')
@@ -481,7 +524,7 @@ export async function installEdge({
       })
       throw error
     }
-    const result = {
+    let result = {
       ...deployment,
       account,
       claimUrl,
@@ -490,6 +533,22 @@ export async function installEdge({
       temporary,
       workerName,
     }
+    if (observeActivation !== undefined) {
+      ui.activationStart?.('Activating the public URL… Cloudflare usually takes 10–30 seconds.')
+      try {
+        const activation = await observeActivation({
+          mode,
+          publicUrl: result.publicUrl,
+          signal,
+        })
+        result = { ...result, activation }
+        ui.activationFinish?.(activation)
+      } catch (error) {
+        ui.activationFinish?.()
+        ui.recovery(result)
+        throw error
+      }
+    }
     completedResult = result
   } catch (error) {
     primaryError = signal?.aborted ? abortReason(signal, 'Installation interrupted.') : error
@@ -1001,6 +1060,38 @@ async function readBoundedUtf8File(path, maxBytes) {
 
 async function createPrivateTemporaryDirectory() {
   const directory = await mkdtemp(join(tmpdir(), 'dsh-edge-install-'))
-  await chmod(directory, 0o700)
-  return directory
+  try {
+    if (process.platform === 'win32') {
+      const systemRoot = process.env.SystemRoot ?? process.env.WINDIR
+      if (systemRoot === undefined || systemRoot === '') {
+        throw new Error('Could not locate Windows PowerShell to secure installer credentials.')
+      }
+      const powershell = join(systemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe')
+      const encodedCommand = Buffer.from(WINDOWS_PRIVATE_DIRECTORY_SCRIPT, 'utf16le').toString('base64')
+      try {
+        await execa(powershell, [
+          '-NoLogo',
+          '-NoProfile',
+          '-NonInteractive',
+          '-EncodedCommand',
+          encodedCommand,
+        ], {
+          env: {
+            ...process.env,
+            DSH_EDGE_PRIVATE_DIRECTORY: directory,
+          },
+          timeout: WINDOWS_ACL_TIMEOUT_MS,
+          windowsHide: true,
+        })
+      } catch (error) {
+        throw new Error('Could not establish a private Windows ACL for installer credentials.', { cause: error })
+      }
+    } else {
+      await chmod(directory, 0o700)
+    }
+    return directory
+  } catch (error) {
+    await rm(directory, { recursive: true, force: true }).catch(() => {})
+    throw error
+  }
 }

package/scripts/legal-files.d.mts

@@ -0,0 +1,23 @@
+export interface BundledComponent {
+  author?: string | { name?: string }
+  license: string
+  name: string
+  path: string
+  repository?: string | { url?: string }
+  version: string
+}
+
+export interface LegalDocumentUse {
+  file: string
+  name: string
+  version: string
+}
+
+export interface LegalDocument {
+  id: string
+  text: string
+  uses: LegalDocumentUse[]
+}
+
+export declare function collectLicenseDocuments(components: BundledComponent[]): LegalDocument[]
+export declare function renderBundledTerms(components: BundledComponent[]): string

package/scripts/legal-files.mjs

@@ -1,82 +1,264 @@
-import { readFileSync, writeFileSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { readFileSync, readdirSync, realpathSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { resolvePnpmInvocation } from './pnpm-invocation.mjs'
 
-const upstreamCopyright = 'Copyright (c) 2026 DeepSeek'
-const edgeCopyright = 'Copyright (c) 2026 pawaca'
+const MIT_TERMS = `Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-function paths(name) {
-  return {
-    source: fileURLToPath(new URL(`../../../${name}`, import.meta.url)),
-    target: fileURLToPath(new URL(`../${name}`, import.meta.url)),
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.`
+
+const edgeLicense = `MIT License
+
+Copyright (c) 2026 pawaca
+
+${MIT_TERMS}
+`
+
+const upstreamLicense = `MIT License
+
+Copyright (c) 2026 DeepSeek
+
+${MIT_TERMS}`
+
+const LEGAL_FILE = /^(?:licen[cs]e|copying|notice)(?:$|[._-])/iu
+const repositoryRoot = fileURLToPath(new URL('../../../', import.meta.url))
+const packageRoot = fileURLToPath(new URL('../', import.meta.url))
+const standaloneRoot = join(packageRoot, 'standalone')
+
+function bundledComponents() {
+  const invocation = resolvePnpmInvocation(process.env.npm_execpath ?? 'pnpm', [
+    '--dir',
+    standaloneRoot,
+    'licenses',
+    'list',
+    '--prod',
+    '--json',
+  ])
+  const result = spawnSync(invocation.command, invocation.args, { encoding: 'utf8' })
+  if (result.error !== undefined) throw result.error
+  if (result.status !== 0) {
+    throw new Error(`unable to inventory the standalone production closure:\n${result.stdout}${result.stderr}`)
   }
+
+  const report = JSON.parse(result.stdout)
+  const components = new Map()
+  for (const [license, packages] of Object.entries(report)) {
+    if (!Array.isArray(packages)) throw new Error(`invalid pnpm license group ${license}`)
+    for (const item of packages) {
+      if (typeof item?.name !== 'string' || !Array.isArray(item.versions) || !Array.isArray(item.paths)) {
+        throw new Error(`invalid pnpm license entry in ${license}`)
+      }
+      for (const path of item.paths) {
+        if (typeof path !== 'string') throw new Error(`invalid package path for ${item.name}`)
+        const manifest = JSON.parse(readFileSync(join(path, 'package.json'), 'utf8'))
+        if (manifest.os !== undefined || manifest.cpu !== undefined || manifest.libc !== undefined) continue
+        if (typeof manifest.version !== 'string' || !item.versions.includes(manifest.version)) {
+          throw new Error(`pnpm license versions do not cover ${item.name} at ${path}`)
+        }
+        const component = {
+          license,
+          name: item.name,
+          version: manifest.version,
+          path,
+          author: manifest.author,
+          repository: manifest.repository,
+        }
+        const key = `${component.name}\0${component.version}\0${component.license}`
+        const current = components.get(key)
+        if (current === undefined || component.path.localeCompare(current.path, 'en') < 0) {
+          components.set(key, component)
+        }
+      }
+    }
+  }
+  return [...components.values()].sort((left, right) => (
+    left.name.localeCompare(right.name, 'en')
+    || left.version.localeCompare(right.version, 'en')
+    || left.license.localeCompare(right.license, 'en')
+  ))
 }
 
-function renderLicense() {
-  const upstream = readFileSync(paths('LICENSE').source, 'utf8')
-  if (!upstream.includes(upstreamCopyright)) {
-    throw new Error('repository-root LICENSE no longer contains the expected DeepSeek copyright')
+function authorName(author) {
+  if (typeof author === 'string' && author.trim() !== '') return author.trim()
+  if (author !== null && typeof author === 'object' && typeof author.name === 'string' && author.name.trim() !== '') {
+    return author.name.trim()
   }
-  return upstream.replace(upstreamCopyright, edgeCopyright)
 }
 
-function renderNotices() {
-  const upstreamLicense = readFileSync(paths('LICENSE').source, 'utf8').trim()
-  const repositoryNotices = readFileSync(paths('THIRD_PARTY_NOTICES.md').source, 'utf8')
-  const inventoryStart = repositoryNotices.indexOf('## Vendored source')
-  if (inventoryStart < 0) {
-    throw new Error('repository-root THIRD_PARTY_NOTICES.md has no dependency inventory')
+function repositoryUrl(repository) {
+  if (typeof repository === 'string' && repository.trim() !== '') return repository.trim()
+  if (repository !== null && typeof repository === 'object' && typeof repository.url === 'string' && repository.url.trim() !== '') {
+    return repository.url.trim()
   }
-  const upstreamInventory = repositoryNotices
-    .slice(inventoryStart)
-    .replace(/^## /gmu, '### ')
+}
+
+function normalizeLegalText(text) {
+  return text
+    .replace(/^\uFEFF/u, '')
+    .replaceAll('\r\n', '\n')
+    .split('\n')
+    .map(line => line.trimEnd())
+    .join('\n')
     .trim()
+}
+
+function missingLicenseFallback(component, apacheTerms) {
+  const author = authorName(component.author) ?? `contributors to ${component.name}`
+  const repository = repositoryUrl(component.repository)
+  const provenance = [
+    `The published ${component.name}@${component.version} package declared ${component.license}`,
+    'but did not include a license or notice file.',
+    `Attribution from its package metadata: ${author}.`,
+    ...(repository === undefined ? [] : [`Repository: ${repository}.`]),
+  ].join(' ')
+  if (component.license === 'MIT' || component.license === 'MIT OR Apache-2.0') {
+    return `${provenance}\n\nThe MIT branch is reproduced for this distribution:\n\nMIT License\n\nPublished package author: ${author}\n\n${MIT_TERMS}`
+  }
+  if (component.license === 'Apache-2.0' && apacheTerms !== undefined) {
+    return `${provenance}\n\n${apacheTerms}`
+  }
+  throw new Error(`${component.name}@${component.version} has no distributable license text for ${component.license}`)
+}
+
+export function collectLicenseDocuments(components) {
+  const documents = new Map()
+  const componentsWithoutFiles = []
+  let apacheTerms
+  const addDocument = (text, use) => {
+    const normalized = normalizeLegalText(text)
+    if (normalized === '') throw new Error(`empty legal text for ${use.name}@${use.version}`)
+    const document = documents.get(normalized) ?? { text: normalized, uses: [] }
+    document.uses.push(use)
+    documents.set(normalized, document)
+  }
+
+  for (const component of components) {
+    const files = readdirSync(component.path)
+      .filter(name => LEGAL_FILE.test(name))
+      .sort((left, right) => left.localeCompare(right, 'en'))
+    if (files.length === 0) {
+      componentsWithoutFiles.push(component)
+      continue
+    }
+    for (const file of files) {
+      const text = normalizeLegalText(readFileSync(join(component.path, file), 'utf8'))
+      if (component.license === 'Apache-2.0' && /^Apache License\s+Version 2\.0/imu.test(text)) {
+        apacheTerms ??= text
+      }
+      addDocument(text, { file, name: component.name, version: component.version })
+    }
+  }
+
+  for (const component of componentsWithoutFiles) {
+    addDocument(missingLicenseFallback(component, apacheTerms), {
+      file: 'package metadata fallback',
+      name: component.name,
+      version: component.version,
+    })
+  }
 
+  return [...documents.values()]
+    .map(document => ({
+      ...document,
+      id: createHash('sha256').update(document.text).digest('hex').slice(0, 12),
+      uses: document.uses.sort((left, right) => (
+        left.name.localeCompare(right.name, 'en')
+        || left.version.localeCompare(right.version, 'en')
+        || left.file.localeCompare(right.file, 'en')
+      )),
+    }))
+    .sort((left, right) => left.id.localeCompare(right.id, 'en'))
+}
+
+export function renderBundledTerms(components) {
+  return collectLicenseDocuments(components)
+    .map(document => {
+      const uses = document.uses
+        .map(use => `- \`${use.name}@${use.version}\` (\`${use.file}\`)`)
+        .join('\n')
+      return `### License/notice ${document.id}\n\nApplies to:\n\n${uses}\n\n\`\`\`text\n${document.text}\n\`\`\``
+    })
+    .join('\n\n')
+}
+
+function renderNotices(components) {
+  const inventory = components
+    .map(component => `| \`${component.name}@${component.version}\` | \`${component.license}\` |`)
+    .join('\n')
+  const bundledTerms = renderBundledTerms(components)
   return `<!-- Generated by apps/dsh-edge/scripts/legal-files.mjs — do not edit by hand.
      Run \`pnpm --filter dsh-edge run legal:write\` to regenerate. -->
 
 # Third-Party Notices
 
-\`dsh-edge\` is an independent community project and is not affiliated with or endorsed by DeepSeek.
+\`dsh-edge\` is an independent community project maintained by pawaca. It is not affiliated with or endorsed by DeepSeek.
 
 ## DeepSeek Harness
 
-\`dsh-edge\` includes and adapts DeepSeek Harness. DeepSeek Harness retains its upstream copyright and MIT license:
+\`dsh-edge\` assembles published DeepSeek Harness packages and applies six version-bound adaptations to the pinned \`0.1.0-rc.7\` release. DeepSeek Harness remains under its upstream MIT license:
 
 \`\`\`text
 ${upstreamLicense}
 \`\`\`
 
-## DeepSeek Harness dependency notices
+## Bundled component inventory
+
+The following ${components.length} package versions form the conservative, platform-neutral production closure used to assemble the Web and Worker artifacts in this distribution. Platform-specific build binaries that are not distributed in those artifacts are excluded; tree shaking can omit additional code. The inventory and legal texts are generated during packaging rather than referring recipients to a source checkout. License expressions are SPDX identifiers supplied by each package. Dependencies installed separately by npm remain declared in this package's \`package.json\`.
 
-The following inventory is reproduced from the DeepSeek Harness source distribution. Each project remains under its own license; nothing in this file changes those terms.
+| Component | License |
+| --- | --- |
+${inventory}
 
-${upstreamInventory}
+## Bundled license and notice texts
+
+License, copyright, attribution, and NOTICE files supplied by the published packages are reproduced below with line endings and trailing whitespace normalized and identical texts deduplicated. When a package omits those files, the entry records that fact, preserves its published metadata attribution, and reproduces a permitted branch of its declared SPDX terms.
+
+${bundledTerms}
 `
 }
 
-function expectedFiles() {
+function legalFiles() {
+  const notices = renderNotices(bundledComponents())
   return new Map([
-    ['LICENSE', renderLicense()],
-    ['THIRD_PARTY_NOTICES.md', renderNotices()],
+    [join(repositoryRoot, 'LICENSE'), edgeLicense],
+    [join(repositoryRoot, 'THIRD_PARTY_NOTICES.md'), notices],
+    [join(packageRoot, 'LICENSE'), edgeLicense],
+    [join(packageRoot, 'THIRD_PARTY_NOTICES.md'), notices],
   ])
 }
 
 function verify() {
-  for (const [name, expected] of expectedFiles()) {
-    const { target } = paths(name)
-    if (readFileSync(target, 'utf8') !== expected) {
-      throw new Error(`${name} is stale; run \`pnpm --filter dsh-edge run legal:write\``)
+  for (const [path, expected] of legalFiles()) {
+    if (readFileSync(path, 'utf8') !== expected) {
+      throw new Error(`${path} is stale; run \`pnpm --filter dsh-edge run legal:write\``)
     }
   }
 }
 
 function write() {
-  for (const [name, content] of expectedFiles()) {
-    writeFileSync(paths(name).target, content)
-  }
+  for (const [path, content] of legalFiles()) writeFileSync(path, content)
 }
 
-const action = process.argv[2]
-if (action === 'verify') verify()
-else if (action === 'write') write()
-else throw new Error('Usage: node scripts/legal-files.mjs <verify|write>')
+if (process.argv[1] !== undefined
+  && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
+  const action = process.argv[2]
+  if (action === 'verify') verify()
+  else if (action === 'write') write()
+  else throw new Error('Usage: node scripts/legal-files.mjs <verify|write>')
+}