dsh-edge 0.1.3 → 0.2.0-alpha.2

package/scripts/pnpm-invocation.d.mts

@@ -0,0 +1,14 @@
+export interface PnpmInvocationOptions {
+  nodeExecutable?: string
+}
+
+export interface PnpmInvocation {
+  command: string
+  args: string[]
+}
+
+export declare function resolvePnpmInvocation(
+  pnpm: string | undefined,
+  args: string[],
+  options?: PnpmInvocationOptions,
+): PnpmInvocation

package/scripts/pnpm-invocation.mjs

@@ -0,0 +1,25 @@
+/**
+ * Resolve a pnpm invocation across JavaScript-entry and standalone installs.
+ * @param {string | undefined} pnpm Package-manager path supplied by pnpm.
+ * @param {string[]} args Arguments to pass to pnpm.
+ * @param {{ nodeExecutable?: string }} [options] Resolution inputs.
+ * @returns {{ command: string, args: string[] }} Executable and arguments.
+ */
+export function resolvePnpmInvocation(pnpm, args, options = {}) {
+  if (pnpm === undefined || pnpm === '') {
+    throw new Error('Cannot run pnpm without a package-manager executable.')
+  }
+
+  const nodeExecutable = options.nodeExecutable ?? process.execPath
+  if (/\.[cm]?js$/iu.test(pnpm)) {
+    return {
+      command: nodeExecutable,
+      args: [pnpm, ...args],
+    }
+  }
+
+  return {
+    command: pnpm,
+    args,
+  }
+}

package/scripts/publish.d.mts

@@ -0,0 +1,25 @@
+export interface NpmRuntime {
+  readonly platform: NodeJS.Platform
+  readonly nodeExecutable: string
+  readonly pathExists: (path: string) => boolean
+}
+
+export interface NpmInvocation {
+  readonly command: string
+  readonly args: readonly string[]
+}
+
+export interface PackedIdentity {
+  readonly name: 'dsh-edge'
+  readonly version: string
+}
+
+export function targetTag(version: string): 'latest' | 'next'
+export function publishTag(version: string, current: string | undefined): 'latest' | 'next' | 'historical'
+export function readPackedIdentity(tarball: string): PackedIdentity
+export function assertReleaseIdentity(identity: PackedIdentity): PackedIdentity
+export function resolveNpmInvocation(
+  args: readonly string[],
+  environment?: NodeJS.ProcessEnv,
+  runtime?: NpmRuntime,
+): NpmInvocation

package/scripts/publish.mjs

@@ -0,0 +1,145 @@
+import { createHash } from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+import { existsSync, readFileSync } from 'node:fs'
+import { resolve, win32 } from 'node:path'
+import { setTimeout as sleep } from 'node:timers/promises'
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+import { compareVersions, validate } from 'compare-versions'
+import edgePackage from '../package.json' with { type: 'json' }
+
+const TRANSIENT_CODES = ['E409', 'E429', 'E500', 'E502', 'E503', 'E504', 'ETIMEDOUT', 'ECONNRESET', 'EAI_AGAIN']
+const PUBLISH_ATTEMPTS = 4
+const RETRY_BASE_MS = 2_000
+
+export function targetTag(version) {
+  return version.includes('-') ? 'next' : 'latest'
+}
+
+export function publishTag(version, current) {
+  return current === undefined || compareVersions(version, current) > 0 ? targetTag(version) : 'historical'
+}
+
+export function resolveNpmInvocation(args, environment = process.env, runtime = {
+  platform: process.platform,
+  nodeExecutable: process.execPath,
+  pathExists: existsSync,
+}) {
+  if (runtime.platform !== 'win32') return { command: 'npm', args }
+  const searchPath = Object.entries(environment).find(([name]) => name.toUpperCase() === 'PATH')?.[1]
+  if (searchPath === undefined) throw new Error('npm PATH is unavailable')
+  for (const rawDirectory of searchPath.split(win32.delimiter)) {
+    const directory = rawDirectory.startsWith('"') && rawDirectory.endsWith('"')
+      ? rawDirectory.slice(1, -1)
+      : rawDirectory
+    const shim = win32.join(directory, 'npm.cmd')
+    const cli = win32.join(directory, 'node_modules', 'npm', 'bin', 'npm-cli.js')
+    if (runtime.pathExists(shim) && runtime.pathExists(cli)) {
+      return { command: runtime.nodeExecutable, args: [cli, ...args] }
+    }
+  }
+  throw new Error('npm.cmd with an adjacent npm-cli.js was not found on PATH')
+}
+
+function npm(args, echo = false) {
+  const invocation = resolveNpmInvocation(args)
+  const result = spawnSync(invocation.command, [...invocation.args], {
+    encoding: 'utf8',
+  })
+  if (result.error !== undefined) throw result.error
+  if (echo) {
+    process.stdout.write(result.stdout ?? '')
+    process.stderr.write(result.stderr ?? '')
+  }
+  return {
+    status: result.status,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+  }
+}
+
+function registryIntegrity(name, version) {
+  const result = npm(['view', `${name}@${version}`, 'dist.integrity', '--json'])
+  if (result.status !== 0) {
+    const output = `${result.stdout}${result.stderr}`
+    if (output.includes('E404') || output.includes('404 Not Found')) return undefined
+    throw new Error(`npm view failed:\n${output}`)
+  }
+  const parsed = JSON.parse(result.stdout)
+  if (typeof parsed !== 'string' || parsed === '') throw new Error('registry returned invalid dist.integrity')
+  return parsed
+}
+
+function registryTags(name) {
+  const result = npm(['view', name, 'dist-tags', '--json'])
+  if (result.status !== 0) {
+    const output = `${result.stdout}${result.stderr}`
+    if (output.includes('E404') || output.includes('404 Not Found')) return {}
+    throw new Error(`npm view failed:\n${output}`)
+  }
+  const parsed = JSON.parse(result.stdout)
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error('registry returned invalid dist-tags')
+  }
+  return parsed
+}
+
+export function readPackedIdentity(tarball) {
+  const result = npm(['pack', tarball, '--dry-run', '--json', '--ignore-scripts', '--loglevel=error'])
+  if (result.status !== 0) {
+    throw new Error(`npm could not inspect the tarball:\n${result.stdout}${result.stderr}`)
+  }
+  const packed = JSON.parse(result.stdout)
+  const manifest = Array.isArray(packed) && packed.length === 1 ? packed[0] : undefined
+  if (manifest === null || typeof manifest !== 'object' || Array.isArray(manifest)) {
+    throw new Error('npm returned invalid packed metadata')
+  }
+  if (manifest.name !== edgePackage.name) {
+    throw new Error(`tarball contains ${String(manifest.name)} instead of ${edgePackage.name}`)
+  }
+  if (typeof manifest.version !== 'string' || !validate(manifest.version)) {
+    throw new Error('tarball contains an invalid package version')
+  }
+  if (manifest.id !== `${manifest.name}@${manifest.version}`) {
+    throw new Error('npm returned inconsistent packed identity')
+  }
+  return { name: manifest.name, version: manifest.version }
+}
+
+export function assertReleaseIdentity(identity) {
+  if (identity.version !== edgePackage.version) {
+    throw new Error(`tarball contains ${identity.name}@${identity.version}, but the checkout expects ${edgePackage.name}@${edgePackage.version}`)
+  }
+  return identity
+}
+
+async function publish(tarball) {
+  const identity = assertReleaseIdentity(readPackedIdentity(tarball))
+  const localIntegrity = `sha512-${createHash('sha512').update(readFileSync(tarball)).digest('base64')}`
+  const existing = registryIntegrity(identity.name, identity.version)
+  if (existing !== undefined) {
+    if (existing !== localIntegrity) throw new Error(`${identity.name}@${identity.version} already has different content`)
+    console.log(`${identity.name}@${identity.version} is already published with the same integrity`)
+    return
+  }
+
+  const desiredTag = targetTag(identity.version)
+  const tag = publishTag(identity.version, registryTags(identity.name)[desiredTag])
+  for (let attempt = 1; attempt <= PUBLISH_ATTEMPTS; attempt += 1) {
+    const result = npm(['publish', tarball, '--tag', tag, '--ignore-scripts'], true)
+    if (result.status === 0) return
+    if (registryIntegrity(identity.name, identity.version) === localIntegrity) return
+    const output = `${result.stdout}${result.stderr}`
+    if (attempt === PUBLISH_ATTEMPTS || !TRANSIENT_CODES.some(code => output.includes(`code ${code}`))) {
+      throw new Error(`npm publish failed:\n${output}`)
+    }
+    await sleep(RETRY_BASE_MS * 2 ** (attempt - 1))
+  }
+}
+
+const invoked = process.argv[1] === fileURLToPath(import.meta.url)
+if (invoked) {
+  const { values } = parseArgs({ options: { tarball: { type: 'string' } } })
+  if (values.tarball === undefined) throw new Error('Usage: publish.mjs --tarball <path>')
+  await publish(resolve(values.tarball))
+}

package/scripts/smoke-installed.mjs

@@ -19,28 +19,33 @@ try {
     assert.equal((await stat(artifact)).isFile(), true, `missing ${mode} Worker artifact`)
   }
 
-  const configFile = join(directory, 'wrangler.json')
-  await writePrebuiltModeWranglerConfig('direct', configFile)
-  worker = await unstable_dev(workerArtifactPath('direct'), {
-    config: configFile,
-    vars: {
-      DEEPSEEK_API_KEY: 'packed-installer-test-key',
-      DSH_EDGE_ACCESS_KEY: ACCESS_KEY,
-    },
-    logLevel: 'error',
-    experimental: {
-      disableExperimentalWarning: true,
-      showInteractiveDevSession: false,
-      watch: false,
-    },
-  })
-  const response = await worker.fetch('http://dsh-edge.test/api/health')
-  assert.equal(response.status, 200)
-  const health = await response.json()
-  assert.equal(health.service, 'dsh-edge')
-  assert.equal(health.shell, 'just-bash-direct')
-  assert.equal(health.deploymentId, `dsh-edge@${edgePackage.version}/direct`)
-  process.stdout.write('Installed direct Worker artifact started successfully.\n')
+  for (const mode of ['direct', 'isolated']) {
+    const configFile = join(directory, `wrangler-${mode}.json`)
+    await writePrebuiltModeWranglerConfig(mode, configFile)
+    worker = await unstable_dev(workerArtifactPath(mode), {
+      config: configFile,
+      env: mode === 'direct' ? '' : 'isolated',
+      vars: {
+        DEEPSEEK_API_KEY: 'packed-installer-test-key',
+        DSH_EDGE_ACCESS_KEY: ACCESS_KEY,
+      },
+      logLevel: 'error',
+      experimental: {
+        disableExperimentalWarning: true,
+        showInteractiveDevSession: false,
+        watch: false,
+      },
+    })
+    const response = await worker.fetch('http://dsh-edge.test/api/health')
+    assert.equal(response.status, 200)
+    const health = await response.json()
+    assert.equal(health.service, 'dsh-edge')
+    assert.equal(health.shell, mode === 'direct' ? 'just-bash-direct' : 'just-bash-isolated')
+    assert.equal(health.deploymentId, `dsh-edge@${edgePackage.version}/${mode}`)
+    await worker.stop()
+    worker = undefined
+    process.stdout.write(`Installed ${mode} Worker artifact started successfully.\n`)
+  }
 } finally {
   await worker?.stop()
   await rm(directory, { recursive: true, force: true })

package/scripts/verify-packed.mjs

@@ -77,6 +77,14 @@ export function verifyPacked(input) {
       !noticesText.includes('# Third-Party Notices')
       || !noticesText.includes('not affiliated with or endorsed by DeepSeek')
       || !noticesText.includes('Copyright (c) 2026 DeepSeek')
+      || !noticesText.includes('## Bundled component inventory')
+      || !noticesText.includes('## Bundled license and notice texts')
+      || !noticesText.includes('`@cloudflare/computer@0.2.0` | `MIT`')
+      || !noticesText.includes('`diff@9.0.0` (`LICENSE`)')
+      || !noticesText.includes('Copyright (c) 2009-2015, Kevin Decker')
+      || !noticesText.includes('Redistributions in binary form must reproduce')
+      || !noticesText.includes('Apache License')
+      || noticesText.includes('apps/dsh-edge/standalone/pnpm-lock.yaml')
     ) {
       throw new Error('packed dsh-edge is missing third-party notices')
     }

package/scripts/wrangler-config-core.mjs

@@ -0,0 +1,107 @@
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const appDirectory = fileURLToPath(new URL('..', import.meta.url))
+const DIRECT_SHELL_CORE = '@cloudflare/computer/shell/core'
+const DIRECT_SHELL_CORE_REPLACEMENT = 'src/direct-shell-core-empty.ts'
+const ISOLATED_DIRECT_SHELL = './direct-shell.ts'
+const ISOLATED_DIRECT_SHELL_REPLACEMENT = 'src/isolated-direct-shell-unavailable.ts'
+const RESERVED_ALIASES = new Set([DIRECT_SHELL_CORE, ISOLATED_DIRECT_SHELL])
+const WORKER_ARTIFACTS = Object.freeze({
+  direct: 'worker/direct/index.js',
+  isolated: 'worker/isolated/index.js',
+})
+
+/** Render one mode-specific build configuration from an already parsed source object. */
+export function renderParsedSourceModeWranglerConfig(mode, parsed, options = {}) {
+  requireRuntimeMode(mode)
+  requireSourceConfig(parsed)
+  const root = options.appDirectory ?? appDirectory
+  const aliases = options.aliases ?? {}
+  if (!isStringRecord(aliases)) {
+    throw new Error('Source-build aliases must map module names to paths.')
+  }
+  const reservedAlias = Object.keys(aliases).find(alias => RESERVED_ALIASES.has(alias))
+  if (reservedAlias !== undefined) {
+    throw new Error(`Source-build aliases reserve ${reservedAlias} for mode builds.`)
+  }
+  if (options.assetsDirectory !== undefined
+    && (typeof options.assetsDirectory !== 'string' || options.assetsDirectory === '')) {
+    throw new Error('Source-build assetsDirectory must be a non-empty path.')
+  }
+  const config = structuredClone(parsed)
+  delete config.$schema
+  config.main = resolve(root, parsed.main)
+  config.assets.directory = options.assetsDirectory ?? resolve(root, parsed.assets.directory)
+  config.minify = true
+  if (mode === 'direct') {
+    config.alias = {
+      ...config.alias,
+      ...aliases,
+      [DIRECT_SHELL_CORE]: resolve(root, DIRECT_SHELL_CORE_REPLACEMENT),
+    }
+  } else {
+    config.alias = {
+      ...config.alias,
+      ...aliases,
+      [ISOLATED_DIRECT_SHELL]: resolve(root, ISOLATED_DIRECT_SHELL_REPLACEMENT),
+    }
+  }
+  return `${JSON.stringify(config, undefined, 2)}\n`
+}
+
+/** Render an upload configuration from an already parsed source object. */
+export function renderParsedPrebuiltModeWranglerConfig(mode, parsed, options = {}) {
+  requireRuntimeMode(mode)
+  requireSourceConfig(parsed)
+  const root = options.appDirectory ?? appDirectory
+  const config = structuredClone(parsed)
+  delete config.$schema
+  delete config.alias
+  delete config.minify
+  config.main = resolve(root, WORKER_ARTIFACTS[mode])
+  config.assets.directory = resolve(root, parsed.assets.directory)
+  config.no_bundle = true
+  config.find_additional_modules = false
+  return `${JSON.stringify(config, undefined, 2)}\n`
+}
+
+/** Return the released entrypoint for a runtime mode. */
+export function workerArtifactPath(mode, options = {}) {
+  requireRuntimeMode(mode)
+  return resolve(options.appDirectory ?? appDirectory, WORKER_ARTIFACTS[mode])
+}
+
+function requireSourceConfig(parsed) {
+  if (!isRecord(parsed)) throw new Error('wrangler.jsonc must contain one object.')
+  if (typeof parsed.main !== 'string' || parsed.main === '') {
+    throw new Error('wrangler.jsonc must declare a main entry point.')
+  }
+  if (!isRecord(parsed.assets) || typeof parsed.assets.directory !== 'string'
+    || parsed.assets.directory === '') {
+    throw new Error('wrangler.jsonc must declare an assets directory.')
+  }
+  if (parsed.alias !== undefined && !isStringRecord(parsed.alias)) {
+    throw new Error('wrangler.jsonc aliases must map module names to paths.')
+  }
+  const reservedAlias = parsed.alias === undefined
+    ? undefined
+    : Object.keys(parsed.alias).find(alias => RESERVED_ALIASES.has(alias))
+  if (reservedAlias !== undefined) {
+    throw new Error(`wrangler.jsonc reserves the ${reservedAlias} alias for mode builds.`)
+  }
+}
+
+function requireRuntimeMode(mode) {
+  if (mode !== 'direct' && mode !== 'isolated') {
+    throw new Error(`Unsupported runtime mode: ${String(mode)}`)
+  }
+}
+
+function isRecord(value) {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+}
+
+function isStringRecord(value) {
+  return isRecord(value) && Object.values(value).every(entry => typeof entry === 'string')
+}

package/scripts/wrangler-config.d.mts

@@ -1,7 +1,9 @@
 import type { RuntimeMode } from './install.mjs'
 
 export interface WranglerConfigOptions {
+  aliases?: Record<string, string>
   appDirectory?: string
+  assetsDirectory?: string
   sourceConfigPath?: string
 }
 

package/scripts/wrangler-config.mjs

@@ -1,58 +1,26 @@
 import { readFile, writeFile } from 'node:fs/promises'
-import { resolve } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { parse, printParseErrorCode } from 'jsonc-parser'
+import {
+  renderParsedPrebuiltModeWranglerConfig,
+  renderParsedSourceModeWranglerConfig,
+  workerArtifactPath,
+} from './wrangler-config-core.mjs'
 
-const appDirectory = fileURLToPath(new URL('..', import.meta.url))
 const sourceConfigPath = fileURLToPath(new URL('../wrangler.jsonc', import.meta.url))
-const DIRECT_SHELL_CORE = '@cloudflare/computer/shell/core'
-const DIRECT_SHELL_CORE_REPLACEMENT = 'src/direct-shell-core-empty.ts'
-const ISOLATED_DIRECT_SHELL = './direct-shell.ts'
-const ISOLATED_DIRECT_SHELL_REPLACEMENT = 'src/isolated-direct-shell-unavailable.ts'
-const RESERVED_ALIASES = new Set([DIRECT_SHELL_CORE, ISOLATED_DIRECT_SHELL])
-const WORKER_ARTIFACTS = Object.freeze({
-  direct: 'worker/direct/index.js',
-  isolated: 'worker/isolated/index.js',
-})
+
+export { workerArtifactPath }
 
 /** Render one mode-specific build configuration from the repository source. */
 export function renderSourceModeWranglerConfig(mode, source, options = {}) {
-  requireRuntimeMode(mode)
-  const root = options.appDirectory ?? appDirectory
   const parsed = parseSourceConfig(source)
-  const config = structuredClone(parsed)
-  delete config.$schema
-  config.main = resolve(root, parsed.main)
-  config.assets.directory = resolve(root, parsed.assets.directory)
-  config.minify = true
-  if (mode === 'direct') {
-    config.alias = {
-      ...config.alias,
-      [DIRECT_SHELL_CORE]: resolve(root, DIRECT_SHELL_CORE_REPLACEMENT),
-    }
-  } else {
-    config.alias = {
-      ...config.alias,
-      [ISOLATED_DIRECT_SHELL]: resolve(root, ISOLATED_DIRECT_SHELL_REPLACEMENT),
-    }
-  }
-  return `${JSON.stringify(config, undefined, 2)}\n`
+  return renderParsedSourceModeWranglerConfig(mode, parsed, options)
 }
 
 /** Render an upload configuration that deploys the released Worker without rebuilding it. */
 export function renderPrebuiltModeWranglerConfig(mode, source, options = {}) {
-  requireRuntimeMode(mode)
-  const root = options.appDirectory ?? appDirectory
   const parsed = parseSourceConfig(source)
-  const config = structuredClone(parsed)
-  delete config.$schema
-  delete config.alias
-  delete config.minify
-  config.main = resolve(root, WORKER_ARTIFACTS[mode])
-  config.assets.directory = resolve(root, parsed.assets.directory)
-  config.no_bundle = true
-  config.find_additional_modules = false
-  return `${JSON.stringify(config, undefined, 2)}\n`
+  return renderParsedPrebuiltModeWranglerConfig(mode, parsed, options)
 }
 
 /** Write the source configuration used to build one released Worker artifact. */
@@ -69,12 +37,6 @@ export async function writePrebuiltModeWranglerConfig(mode, destination, options
   await writePrivateConfig(destination, rendered)
 }
 
-/** Return the released entrypoint for a runtime mode. */
-export function workerArtifactPath(mode, options = {}) {
-  requireRuntimeMode(mode)
-  return resolve(options.appDirectory ?? appDirectory, WORKER_ARTIFACTS[mode])
-}
-
 async function writePrivateConfig(destination, rendered) {
   await writeFile(destination, rendered, { encoding: 'utf8', mode: 0o600, flag: 'wx' })
 }
@@ -90,36 +52,5 @@ function parseSourceConfig(source) {
     const detail = errors.map(error => printParseErrorCode(error.error)).join(', ')
     throw new Error(`Could not parse wrangler.jsonc: ${detail}.`)
   }
-  if (!isRecord(parsed)) throw new Error('wrangler.jsonc must contain one object.')
-  if (typeof parsed.main !== 'string' || parsed.main === '') {
-    throw new Error('wrangler.jsonc must declare a main entry point.')
-  }
-  if (!isRecord(parsed.assets) || typeof parsed.assets.directory !== 'string'
-    || parsed.assets.directory === '') {
-    throw new Error('wrangler.jsonc must declare an assets directory.')
-  }
-  if (parsed.alias !== undefined && !isStringRecord(parsed.alias)) {
-    throw new Error('wrangler.jsonc aliases must map module names to paths.')
-  }
-  const reservedAlias = parsed.alias === undefined
-    ? undefined
-    : Object.keys(parsed.alias).find(alias => RESERVED_ALIASES.has(alias))
-  if (reservedAlias !== undefined) {
-    throw new Error(`wrangler.jsonc reserves the ${reservedAlias} alias for mode builds.`)
-  }
   return parsed
 }
-
-function requireRuntimeMode(mode) {
-  if (mode !== 'direct' && mode !== 'isolated') {
-    throw new Error(`Unsupported runtime mode: ${String(mode)}`)
-  }
-}
-
-function isRecord(value) {
-  return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
-function isStringRecord(value) {
-  return isRecord(value) && Object.values(value).every(entry => typeof entry === 'string')
-}