dsh-edge 0.1.3 → 0.2.0-alpha.2

package/scripts/assemble-web.mjs

@@ -1,230 +0,0 @@
-/** Assemble the upstream Web shell and client-plugin graph as Worker assets. */
-
-import { createHash } from 'node:crypto'
-import {
-  cp,
-  mkdir,
-  readFile,
-  readdir,
-  rm,
-  stat,
-  writeFile,
-} from 'node:fs/promises'
-import { dirname, join, relative, resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
-const repoRoot = resolve(appRoot, '../..')
-const shellDist = join(repoRoot, 'apps/web/dist')
-const outputRoot = join(appRoot, 'dist')
-const deploymentPatches = [
-  join(repoRoot, 'packages/bundle/base/cordis.patch.yml'),
-  join(repoRoot, 'packages/bundle/web-app/cordis.patch.yml'),
-]
-// Deployment-owned browser features use the same client-plugin contract but
-// intentionally stay out of upstream's generic Web composition.
-const edgeClientPackages = ['dsh-edge-client-ui']
-
-// HMR is useful only when the upstream Node host also runs its bundle watcher.
-// Edge deploys immutable, content-addressed static assets instead.
-const edgeExcludedPackages = new Set([
-  // Requires the upstream Node-side bundle watcher.
-  '@deepseek-ai/dsh-client-hmr',
-  // These surfaces depend on generated Host remotes or writable Host settings
-  // that the minimal Edge ApiProxy does not advertise yet. Keeping them out of
-  // the graph is capability negotiation at assembly time; their upstream code
-  // remains unchanged and can be restored with the matching server domain.
-  '@deepseek-ai/dsh-cordis-client-runner',
-  '@deepseek-ai/dsh-client-ui-cordis',
-  '@deepseek-ai/dsh-client-ui-goal',
-  '@deepseek-ai/dsh-client-ui-message-feedback',
-  '@deepseek-ai/dsh-client-ui-plan',
-  '@deepseek-ai/dsh-client-ui-settings-models',
-  '@deepseek-ai/dsh-client-ui-settings-plugin-inventory',
-  '@deepseek-ai/dsh-client-ui-settings-plugins',
-  // Its header action calls the session.export endpoint, which Edge does not
-  // implement. Keep the unavailable action out of the assembled browser.
-  '@deepseek-ai/dsh-session-log-export',
-])
-const shellStaticPackages = new Set(['@deepseek-ai/dsh-client-ui-primitives'])
-const assetSecurityHeaders = `/*
-  Content-Security-Policy: frame-ancestors 'none'
-  X-Frame-Options: DENY
-`
-
-function shortHash(input) {
-  return createHash('sha1').update(input).digest('hex').slice(0, 12)
-}
-
-async function isDirectory(path) {
-  try {
-    return (await stat(path)).isDirectory()
-  } catch {
-    return false
-  }
-}
-
-async function findPackageJsonFiles(root) {
-  const found = []
-  const visit = async (directory) => {
-    for (const entry of await readdir(directory, { withFileTypes: true })) {
-      if (entry.name === 'node_modules' || entry.name === 'lib') continue
-      const path = join(directory, entry.name)
-      if (entry.isDirectory()) {
-        await visit(path)
-      } else if (entry.name === 'package.json') {
-        found.push(path)
-      }
-    }
-  }
-  await visit(root)
-  return found
-}
-
-async function removeSourceMaps(root) {
-  for (const entry of await readdir(root, { withFileTypes: true })) {
-    const path = join(root, entry.name)
-    if (entry.isDirectory()) {
-      await removeSourceMaps(path)
-    } else if (entry.name.endsWith('.map')) {
-      await rm(path)
-    }
-  }
-}
-
-function deploymentPackageNames(patch) {
-  const names = []
-  for (const match of patch.matchAll(/^\s+name:\s+'([^']+)'\s*$/gm)) {
-    if (!edgeExcludedPackages.has(match[1])) names.push(match[1])
-  }
-  return names
-}
-
-function clientBundleRelativePath(pkg) {
-  const client = pkg.exports?.['./client']
-  if (typeof client === 'string') return client
-  if (client !== null && typeof client === 'object' && typeof client.default === 'string') {
-    return client.default
-  }
-  throw new Error(`${pkg.name} is in the Web roster but exports no ./client bundle.`)
-}
-
-function injectBootManifest(html, graph) {
-  const json = JSON.stringify(graph).replaceAll('<', '\\u003c')
-  const script = `<script>window.__DSH_BOOT__ = ${json}</script>`
-  const head = html.indexOf('<head>')
-  return head === -1
-    ? `${script}${html}`
-    : `${html.slice(0, head + 6)}${script}${html.slice(head + 6)}`
-}
-
-function injectOwnerSessionGuard(html) {
-  const script = `<script>(() => {
-  const originalFetch = window.fetch.bind(window)
-  let redirecting = false
-  window.fetch = async (...args) => {
-    const input = args[0]
-    const href = input instanceof Request ? input.url : String(input)
-    const target = new URL(href, window.location.href)
-    const response = await originalFetch(...args)
-    if (!redirecting
-      && response.status === 401
-      && response.headers.get('www-authenticate') === 'DshEdgeOwner'
-      && target.origin === window.location.origin
-      && target.pathname.startsWith('/api/')) {
-      redirecting = true
-      window.location.replace('/login')
-    }
-    return response
-  }
-})()</script>`
-  const head = html.indexOf('<head>')
-  return head === -1
-    ? `${script}${html}`
-    : `${html.slice(0, head + 6)}${script}${html.slice(head + 6)}`
-}
-
-async function copyBundle(pkgPath, pkg, entries) {
-  const declaration = pkg.dsh?.client
-  if (declaration?.platform !== 'web') {
-    throw new Error(`${pkg.name} is in the upstream Web roster but has no web dsh.client declaration.`)
-  }
-  const source = resolve(dirname(pkgPath), clientBundleRelativePath(pkg))
-  const contents = await readFile(source)
-  const rev = shortHash(contents)
-  const destination = join(outputRoot, 'plugins', pkg.name, 'client.js')
-  await mkdir(dirname(destination), { recursive: true })
-  await writeFile(destination, contents)
-
-  entries.push({
-    id: pkg.name,
-    url: `/plugins/${pkg.name}/client.js?rev=${rev}`,
-    rev,
-    ...(Array.isArray(declaration.inject) ? { inject: declaration.inject } : {}),
-    ...(declaration.immediately === true ? { immediately: true } : {}),
-  })
-}
-
-async function main() {
-  if (!await isDirectory(shellDist)) {
-    throw new Error('Upstream Web shell is not built. Run `pnpm --workspace-root run build:web` first.')
-  }
-
-  const packagesByName = new Map()
-  for (const pkgPath of await findPackageJsonFiles(join(repoRoot, 'packages'))) {
-    const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
-    if (typeof pkg.name === 'string') packagesByName.set(pkg.name, { path: pkgPath, pkg })
-  }
-
-  const declared = []
-  for (const patchPath of deploymentPatches) {
-    declared.push(...deploymentPackageNames(await readFile(patchPath, 'utf8')))
-  }
-  declared.push(...edgeClientPackages)
-  const roster = []
-  const seen = new Set()
-  for (const name of declared) {
-    if (seen.has(name)) continue
-    const record = packagesByName.get(name)
-    // Vendor entries and package subpaths have no workspace package root; only
-    // workspace packages can declare the client bundles assembled here.
-    if (record === undefined) continue
-    if (record.pkg.dsh?.client?.platform !== 'web') continue
-    seen.add(name)
-    roster.push(name)
-  }
-  await rm(outputRoot, { recursive: true, force: true })
-  await cp(shellDist, outputRoot, { recursive: true })
-  // Match the published upstream Web package: production assets do not ship
-  // source maps, keeping the Worker upload compact without changing runtime JS.
-  await removeSourceMaps(outputRoot)
-
-  const entries = []
-  for (const name of roster) {
-    const record = packagesByName.get(name)
-    if (record === undefined) throw new Error(`Cannot resolve upstream Web package ${name}.`)
-    await copyBundle(record.path, record.pkg, entries)
-  }
-
-  const selected = new Set(entries.map(entry => entry.id))
-  for (const entry of entries) {
-    for (const dependency of entry.inject ?? []) {
-      if (!selected.has(dependency) && !shellStaticPackages.has(dependency)) {
-        throw new Error(`${entry.id} injects missing Edge Web package ${dependency}.`)
-      }
-    }
-  }
-
-  const graph = { rev: shortHash(JSON.stringify(entries)), entries }
-  const indexPath = join(outputRoot, 'index.html')
-  const index = await readFile(indexPath, 'utf8')
-  await writeFile(indexPath, injectOwnerSessionGuard(injectBootManifest(index, graph)))
-  // Cloudflare may serve index.html and SPA fallbacks without invoking the
-  // Worker. Apply the framing boundary at the asset layer so every alias of
-  // the executable shell receives the same policy while immutable assets can
-  // still bypass Worker execution.
-  await writeFile(join(outputRoot, '_headers'), assetSecurityHeaders)
-  console.log(`Assembled ${entries.length} upstream client plugins in ${relative(repoRoot, outputRoot)} (rev ${graph.rev}).`)
-}
-
-await main()

package/scripts/bundle.mjs

@@ -1,86 +0,0 @@
-import { createRequire } from 'node:module'
-import { lstat, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { execa } from 'execa'
-import edgePackage from '../package.json' with { type: 'json' }
-import { requireGzipBudget } from './bundle-size.mjs'
-import {
-  workerArtifactPath,
-  writeSourceModeWranglerConfig,
-} from './wrangler-config.mjs'
-
-const DIRECT_GZIP_BUDGET_BYTES = 900 * 1024
-const appDirectory = fileURLToPath(new URL('..', import.meta.url))
-const require = createRequire(import.meta.url)
-const wranglerCli = require.resolve('wrangler')
-const mode = process.argv[2]
-
-if (mode !== 'direct' && mode !== 'isolated') {
-  process.stderr.write('Usage: node scripts/bundle.mjs <direct|isolated>\n')
-  process.exitCode = 2
-} else {
-  const directory = await mkdtemp(join(tmpdir(), `dsh-edge-${mode}-bundle-`))
-  try {
-    const configFile = join(directory, 'wrangler.json')
-    const outputDirectory = join(directory, 'worker')
-    await writeSourceModeWranglerConfig(mode, configFile)
-    const result = await execa(process.execPath, [
-      wranglerCli,
-      'deploy',
-      '--config', configFile,
-      '--env', mode === 'direct' ? '' : 'isolated',
-      '--define',
-      `__DSH_EDGE_DEPLOYMENT_ID__:${JSON.stringify(`dsh-edge@${edgePackage.version}/${mode}`)}`,
-      '--dry-run',
-      '--outdir', outputDirectory,
-    ], {
-      cwd: appDirectory,
-      reject: false,
-      all: true,
-    })
-    const output = result.all ?? `${result.stdout}\n${result.stderr}`
-    process.stdout.write(output.endsWith('\n') ? output : `${output}\n`)
-    if (result.exitCode !== 0) {
-      process.exitCode = result.exitCode
-    } else {
-      if (mode === 'direct') {
-        const bytes = requireGzipBudget(output, DIRECT_GZIP_BUDGET_BYTES)
-        process.stdout.write(
-          `Direct Worker gzip budget: ${bytes}/${DIRECT_GZIP_BUDGET_BYTES} bytes.\n`,
-        )
-      }
-      await publishArtifact(mode, join(outputDirectory, 'index.js'))
-    }
-  } catch (error) {
-    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
-    process.exitCode = 1
-  } finally {
-    await rm(directory, { recursive: true, force: true })
-  }
-}
-
-async function publishArtifact(runtimeMode, source) {
-  const destination = workerArtifactPath(runtimeMode)
-  const destinationDirectory = fileURLToPath(new URL(`../worker/${runtimeMode}`, import.meta.url))
-  await removeGeneratedDirectory(destinationDirectory)
-  await mkdir(destinationDirectory, { recursive: true, mode: 0o755 })
-  const bundle = (await readFile(source, 'utf8'))
-    .replace(/\n\/\/# sourceMappingURL=index\.js\.map\s*$/u, '\n')
-  await writeFile(destination, bundle, { encoding: 'utf8', mode: 0o644, flag: 'wx' })
-  process.stdout.write(`Wrote ${runtimeMode} Worker artifact to ${destination}.\n`)
-}
-
-async function removeGeneratedDirectory(directory) {
-  try {
-    const entry = await lstat(directory)
-    if (!entry.isDirectory() || entry.isSymbolicLink()) {
-      throw new Error(`Refusing to replace non-directory Worker artifact path: ${directory}`)
-    }
-  } catch (error) {
-    if (error?.code === 'ENOENT') return
-    throw error
-  }
-  await rm(directory, { recursive: true })
-}