dsh-edge 0.2.0 → 0.3.0-alpha.2

package/scripts/install.mjs

@@ -1,4 +1,4 @@
-import { randomBytes } from 'node:crypto'
+import { createHash, randomBytes } from 'node:crypto'
 import { execFile } from 'node:child_process'
 import { chmod, mkdtemp, open, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
@@ -93,6 +93,7 @@ const SENSITIVE_ENV_KEY = /(KEY|PASSWORD|SECRET|TOKEN)/iu
 const WORKER_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u
 const CLAIM_URL = /https:\/\/dash\.cloudflare\.com\/claim-preview\?[^\s\u001b]+/u
 const MAX_CAPTURE_BYTES = 2 * 1024 * 1024
+const ATTACHMENT_STORAGE_BINDING = 'DSH_EDGE_ATTACHMENT_STORAGE'
 const WINDOWS_ACL_TIMEOUT_MS = 30_000
 const WINDOWS_PRIVATE_DIRECTORY_SCRIPT = String.raw`
 $ErrorActionPreference = 'Stop'
@@ -151,6 +152,13 @@ export class InstallerOutputError extends Error {
   }
 }
 
+class R2SubscriptionUnavailableError extends Error {
+  constructor(message) {
+    super(message)
+    this.name = 'R2SubscriptionUnavailableError'
+  }
+}
+
 /** Return account choices permitted by the selected runtime. */
 export function accountChoices(mode, accounts, command = 'install') {
   requireRuntimeMode(mode)
@@ -232,6 +240,82 @@ export function generateOwnerSecret() {
   return randomBytes(32).toString('base64url')
 }
 
+/** Derive one stable account-local R2 bucket name from the Worker service name. */
+export function attachmentBucketName(workerName) {
+  if (validateWorkerName(workerName) !== undefined) throw new Error('Worker name is invalid.')
+  const suffix = '-attachments'
+  if (workerName.length + suffix.length <= 63) return `${workerName}${suffix}`
+  const digest = createHash('sha256').update(workerName).digest('hex').slice(0, 8)
+  const prefix = workerName.slice(0, 42).replace(/-+$/u, '')
+  return `${prefix}-${digest}${suffix}`
+}
+
+function r2ActivationUrl(accountId) {
+  return `https://dash.cloudflare.com/${encodeURIComponent(accountId)}/r2/overview`
+}
+
+/** Create or reuse the permanent deployment's private R2 attachment bucket. */
+export async function ensureR2Bucket({
+  bucketName,
+  runWrangler,
+  environment,
+  profile,
+  signal,
+}) {
+  const infoArgs = ['r2', 'bucket', 'info', bucketName, '--json', ...profileArgs(profile)]
+  const initial = await runWrangler(infoArgs, { environment, signal })
+  throwIfR2SubscriptionUnavailable(initial)
+  if (initial.status === 0) {
+    requireR2BucketInfo(initial.stdout, bucketName)
+    return { bucketName, created: false }
+  }
+  const created = await runWrangler([
+    'r2', 'bucket', 'create', bucketName, ...profileArgs(profile),
+  ], { environment, signal })
+  throwIfR2SubscriptionUnavailable(created)
+  if (created.status === 0) return { bucketName, created: true }
+  // A concurrent installer may have won the create race; prove exact existence.
+  const recovered = await runWrangler(infoArgs, { environment, signal })
+  throwIfR2SubscriptionUnavailable(recovered)
+  if (recovered.status === 0) {
+    requireR2BucketInfo(recovered.stdout, bucketName)
+    return { bucketName, created: false }
+  }
+  throw new Error(commandFailure(
+    `Could not create or access private R2 bucket "${bucketName}". Check this account's R2 access and permissions, then retry`,
+    created,
+  ))
+}
+
+/** Verify R2 availability without creating a bucket or collecting deployment credentials. */
+async function verifyR2Subscription({ runWrangler, environment, profile, signal }) {
+  const result = await runWrangler([
+    'r2', 'bucket', 'list', ...profileArgs(profile),
+  ], { environment, signal })
+  throwIfR2SubscriptionUnavailable(result)
+  requireSuccess(result, 'Could not check Cloudflare R2 availability')
+}
+
+function throwIfR2SubscriptionUnavailable(result) {
+  if (!/\[code:\s*10042\]/u.test(`${result.stdout}\n${result.stderr}`)) return
+  throw new R2SubscriptionUnavailableError(commandFailure(
+    'Cloudflare R2 is not enabled for this account',
+    result,
+  ))
+}
+
+function requireR2BucketInfo(source, expectedName) {
+  let info
+  try {
+    info = JSON.parse(source)
+  } catch {
+    throw new Error('Wrangler returned malformed R2 bucket information.')
+  }
+  if (info === null || typeof info !== 'object' || info.name !== expectedName) {
+    throw new Error('Wrangler returned unexpected R2 bucket information.')
+  }
+}
+
 /** Build the least-privilege environment used by authenticated Wrangler commands. */
 export function wranglerEnvironment(environment = process.env) {
   return pickEnvironment(environment, [
@@ -319,6 +403,96 @@ export function parseWorkerExistence(result) {
   throw new Error(commandFailure('Could not check whether the Worker already exists', result))
 }
 
+/** Inspect active Worker versions so upgrades preserve the existing attachment backend. */
+export async function detectExistingAttachmentStorage({
+  workerName,
+  mode,
+  runWrangler,
+  environment,
+  profile,
+  signal,
+}) {
+  const args = [
+    '--name', workerName, '--json',
+    ...runtimeEnvironmentArgs(mode),
+    ...profileArgs(profile),
+  ]
+  const status = await runWrangler(['deployments', 'status', ...args], {
+    environment,
+    signal,
+  })
+  requireSuccess(status, 'Could not inspect the existing Worker deployment')
+  const versionIds = deploymentVersionIds(status.stdout)
+  const backends = new Set()
+  for (const versionId of versionIds) {
+    const version = await runWrangler([
+      'versions', 'view', versionId, ...args,
+    ], { environment, signal })
+    requireSuccess(version, `Could not inspect existing Worker version ${versionId}`)
+    backends.add(versionAttachmentStorage(version.stdout))
+  }
+  if (backends.size !== 1) {
+    throw new Error('The active Worker versions use different attachment backends. Finish the existing rollout before upgrading.')
+  }
+  return backends.values().next().value
+}
+
+function deploymentVersionIds(source) {
+  let deployment
+  try {
+    deployment = JSON.parse(source)
+  } catch {
+    throw new Error('Wrangler returned malformed deployment status.')
+  }
+  if (!isRecord(deployment) || !Array.isArray(deployment.versions)) {
+    throw new Error('Wrangler returned unexpected deployment status.')
+  }
+  const ids = deployment.versions
+    .filter(version => isRecord(version) && typeof version.percentage === 'number'
+      && version.percentage > 0)
+    .map(version => version.version_id)
+  if (ids.length === 0 || ids.some(id => typeof id !== 'string' || id.length === 0)) {
+    throw new Error('Wrangler deployment status has no active Worker version.')
+  }
+  return [...new Set(ids)]
+}
+
+function versionAttachmentStorage(source) {
+  let version
+  try {
+    version = JSON.parse(source)
+  } catch {
+    throw new Error('Wrangler returned malformed Worker version details.')
+  }
+  const bindings = isRecord(version) && isRecord(version.resources)
+    ? version.resources.bindings
+    : undefined
+  if (!Array.isArray(bindings) || bindings.some(binding => !isRecord(binding))) {
+    throw new Error('Wrangler returned unexpected Worker version details.')
+  }
+  const attachment = bindings.filter(binding => binding.name === 'DSH_EDGE_ATTACHMENTS')
+  if (attachment.length > 1
+    || (attachment.length === 1 && attachment[0].type !== 'r2_bucket')) {
+    throw new Error('The existing Worker has an invalid attachment binding.')
+  }
+  const markers = bindings.filter(binding => binding.name === ATTACHMENT_STORAGE_BINDING)
+  if (markers.length > 1 || (markers.length === 1
+    && (markers[0].type !== 'plain_text'
+      || (markers[0].text !== 'temporary-do' && markers[0].text !== 'private-r2')))) {
+    throw new Error('The existing Worker has an invalid attachment storage marker.')
+  }
+  const marker = markers[0]?.text
+  if ((marker === 'temporary-do' && attachment.length !== 0)
+    || (marker === 'private-r2' && attachment.length !== 1)) {
+    throw new Error('The existing Worker attachment marker does not match its binding.')
+  }
+  if (marker !== undefined) return marker
+  // An R2 binding predating the explicit marker is still authoritative. A
+  // release with neither binding nor marker predates image attachments, so it
+  // has no image references to strand and can ask the owner to choose once.
+  return attachment.length === 1 ? 'private-r2' : undefined
+}
+
 /** Run the complete guided install with UI and Wrangler supplied as replaceable boundaries. */
 export async function installEdge({
   command = 'install',
@@ -380,6 +554,7 @@ export async function installEdge({
       : requireSelectedAccount(accountSelection, accounts)
 
     let workerName = DEFAULT_WORKER_NAME
+    let updatingExisting = false
     while (true) {
       workerName = await ui.workerName(workerName, validateWorkerName)
       if (temporary) break
@@ -394,24 +569,59 @@ export async function installEdge({
       }))
       if (command === 'upgrade') {
         if (!exists) throw new Error(`${workerName} does not exist in this account and runtime. Run dsh-edge install first.`)
+        updatingExisting = true
         break
       }
       if (!exists) break
       const action = await ui.workerConflict(workerName)
-      if (action === 'update') break
+      if (action === 'update') {
+        updatingExisting = true
+        break
+      }
       if (action === 'cancel') throw new InstallCancelledError()
       workerName = `${workerName}-2`
     }
 
-    const secretMode = await ui.selectOwnerSecretMode()
-    const ownerSecret = secretMode === 'generate'
-      ? generateOwnerSecret()
-      : await ui.ownerSecret(validateOwnerSecret)
-    const secretError = validateOwnerSecret(ownerSecret)
-    if (secretError !== undefined) throw new Error(secretError)
-    const deepSeekKey = await ui.deepSeekKey(validateDeepSeekKey)
-    const deepSeekError = validateDeepSeekKey(deepSeekKey)
-    if (deepSeekError !== undefined) throw new Error(deepSeekError)
+    const commandEnvironment = temporary
+      ? unauthenticatedEnvironment(environment)
+      : accountEnvironment(profileEnvironment ?? environment, account.id)
+    const existingAttachmentStorage = updatingExisting
+      ? await detectExistingAttachmentStorage({
+          workerName,
+          mode,
+          runWrangler,
+          environment: commandEnvironment,
+          profile,
+          signal,
+        })
+      : undefined
+    let attachmentStorage = updatingExisting
+      ? existingAttachmentStorage ?? await ui.selectInitialAttachmentStorage()
+      : temporary ? 'temporary-do' : 'private-r2'
+    requireAttachmentStorage(attachmentStorage)
+
+    const canSwitchToDurableObject = updatingExisting
+      && existingAttachmentStorage === undefined
+    while (attachmentStorage === 'private-r2') {
+      ui.step('Checking Cloudflare R2 availability…')
+      try {
+        await verifyR2Subscription({
+          runWrangler,
+          environment: commandEnvironment,
+          profile,
+          signal,
+        })
+        break
+      } catch (error) {
+        if (!(error instanceof R2SubscriptionUnavailableError)) throw error
+        const resolution = await promptR2Recovery(
+          ui,
+          account.id,
+          canSwitchToDurableObject,
+        )
+        if (resolution === 'temporary-do') attachmentStorage = 'temporary-do'
+      }
+    }
 
     const confirmed = await ui.confirm({
       mode,
@@ -419,17 +629,61 @@ export async function installEdge({
       accountLabel: temporary ? 'Temporary account' : account.name,
       workerName,
       paid: mode === 'isolated',
+      temporary,
+      attachmentStorage,
     })
     if (!confirmed) throw new InstallCancelledError()
     if (temporary && !await ui.acceptTemporaryTerms()) {
       throw new InstallCancelledError()
     }
 
+    const secretMode = await ui.selectOwnerSecretMode()
+    const ownerSecret = secretMode === 'generate'
+      ? generateOwnerSecret()
+      : await ui.ownerSecret(validateOwnerSecret)
+    const secretError = validateOwnerSecret(ownerSecret)
+    if (secretError !== undefined) throw new Error(secretError)
+    const deepSeekKey = await ui.deepSeekKey(validateDeepSeekKey)
+    const deepSeekError = validateDeepSeekKey(deepSeekKey)
+    if (deepSeekError !== undefined) throw new Error(deepSeekError)
+
+    let bucketName
+    if (attachmentStorage === 'private-r2') {
+      bucketName = attachmentBucketName(workerName)
+      ui.step(`Preparing private image storage (${bucketName})…`)
+      while (true) {
+        try {
+          await ensureR2Bucket({
+            bucketName,
+            runWrangler,
+            environment: commandEnvironment,
+            profile,
+            signal,
+          })
+          break
+        } catch (error) {
+          if (!(error instanceof R2SubscriptionUnavailableError)) throw error
+          const resolution = await promptR2Recovery(
+            ui,
+            account.id,
+            canSwitchToDurableObject,
+          )
+          if (resolution === 'temporary-do') {
+            attachmentStorage = 'temporary-do'
+            bucketName = undefined
+            break
+          }
+        }
+      }
+    }
+
     temporaryDirectory = await createTemporaryDirectory()
     const secretsFile = join(temporaryDirectory, 'secrets.json')
     const configFile = join(temporaryDirectory, 'wrangler.json')
     const outputFile = join(temporaryDirectory, 'wrangler-output.ndjson')
-    await writePrebuiltModeWranglerConfig(mode, configFile)
+    await writePrebuiltModeWranglerConfig(mode, configFile, {
+      ...bucketName === undefined ? {} : { r2BucketName: bucketName },
+    })
     await writeFile(secretsFile, JSON.stringify({
       DEEPSEEK_API_KEY: deepSeekKey,
       DSH_EDGE_ACCESS_KEY: ownerSecret,
@@ -439,9 +693,6 @@ export async function installEdge({
       ? 'Uploading the tested Worker release…'
       : 'Installing the tested Worker release…'
     ui.deploymentStart?.(deploymentMessage)
-    const commandEnvironment = temporary
-      ? unauthenticatedEnvironment(environment)
-      : accountEnvironment(profileEnvironment ?? environment, account.id)
     if (temporary) commandEnvironment.XDG_CONFIG_HOME = temporaryDirectory
     commandEnvironment.WRANGLER_LOG_SANITIZE = 'true'
     commandEnvironment.WRANGLER_OUTPUT_FILE_PATH = outputFile
@@ -527,6 +778,7 @@ export async function installEdge({
     let result = {
       ...deployment,
       account,
+      attachmentStorage,
       claimUrl,
       mode,
       ownerSecret,
@@ -843,6 +1095,10 @@ function isTerminalSafe(value) {
   return !CONTROL_CHARACTER.test(value) && !BIDI_CONTROL.test(value)
 }
 
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
 /** Create a chunk-safe terminal filter that retains plain text only. */
 export function createTerminalSanitizer() {
   let state = 'text'
@@ -983,16 +1239,48 @@ function requireRuntimeMode(mode) {
   }
 }
 
+function requireAttachmentStorage(storage) {
+  if (storage !== 'temporary-do' && storage !== 'private-r2') {
+    throw new Error(`Unsupported attachment storage: ${String(storage)}`)
+  }
+}
+
+function requireR2RecoveryAction(action, canSwitchToDurableObject) {
+  if (action === 'cancel') throw new InstallCancelledError()
+  if (action === 'retry') return action
+  if (action === 'temporary-do' && canSwitchToDurableObject) return action
+  throw new Error(`Unsupported R2 recovery action: ${String(action)}`)
+}
+
+async function promptR2Recovery(ui, accountId, canSwitchToDurableObject) {
+  return requireR2RecoveryAction(
+    await ui.r2SubscriptionUnavailable({
+      activationUrl: r2ActivationUrl(accountId),
+      canSwitchToDurableObject,
+    }),
+    canSwitchToDurableObject,
+  )
+}
+
 function requireSuccess(result, prefix) {
   if (result.outputFailure !== undefined) throw result.outputFailure
   if (result.status !== 0) throw new Error(commandFailure(prefix, result))
 }
 
 function commandFailure(prefix, result) {
-  const detail = stripAnsi(result.stderr || result.stdout).trim()
+  const detail = conciseDiagnostic(result.stderr || result.stdout)
   return detail === '' ? `${prefix}.` : `${prefix}: ${detail}`
 }
 
+/** Remove known Node dependency noise from concise errors while verbose output stays unchanged. */
+function conciseDiagnostic(value) {
+  return stripAnsi(value).split(/\r?\n/u)
+    .filter(line => !/^\(node:\d+\) \[DEP0040\] DeprecationWarning: The `punycode` module is deprecated\./u.test(line.trim()))
+    .filter(line => !/^\(Use `node --trace-deprecation \.\.\.` to show where the warning was created\)$/u.test(line.trim()))
+    .join('\n')
+    .trim()
+}
+
 function describeError(error) {
   return error instanceof Error ? error.message : String(error)
 }

package/scripts/legal-files.mjs

@@ -41,6 +41,10 @@ const repositoryRoot = fileURLToPath(new URL('../../../', import.meta.url))
 const packageRoot = fileURLToPath(new URL('../', import.meta.url))
 const standaloneRoot = join(packageRoot, 'standalone')
 const edgeManifest = JSON.parse(readFileSync(join(packageRoot, 'package.json'), 'utf8'))
+const patchAudit = JSON.parse(readFileSync(join(standaloneRoot, 'patches', 'audit.json'), 'utf8'))
+if (!Array.isArray(patchAudit) || patchAudit.length === 0) {
+  throw new Error('The retained patch audit must be a non-empty array.')
+}
 
 function bundledComponents() {
   const invocation = resolvePnpmInvocation(process.env.npm_execpath ?? 'pnpm', [
@@ -212,7 +216,7 @@ function renderNotices(components) {
 
 ## DeepSeek Harness
 
-\`dsh-edge\` assembles published DeepSeek Harness packages and applies six version-bound adaptations to the pinned \`${edgeManifest.dshEdge.upstreamVersion}\` release. DeepSeek Harness remains under its upstream MIT license:
+\`dsh-edge\` assembles published DeepSeek Harness packages and applies ${String(patchAudit.length)} version-bound adaptations to the pinned \`${edgeManifest.dshEdge.upstreamVersion}\` release. DeepSeek Harness remains under its upstream MIT license:
 
 \`\`\`text
 ${upstreamLicense}

package/scripts/wrangler-config-core.mjs

@@ -11,6 +11,8 @@ const WORKER_ARTIFACTS = Object.freeze({
   direct: 'worker/direct/index.js',
   isolated: 'worker/isolated/index.js',
 })
+const ATTACHMENT_BINDING = 'DSH_EDGE_ATTACHMENTS'
+const ATTACHMENT_STORAGE_BINDING = 'DSH_EDGE_ATTACHMENT_STORAGE'
 
 /** Render one mode-specific build configuration from an already parsed source object. */
 export function renderParsedSourceModeWranglerConfig(mode, parsed, options = {}) {
@@ -34,6 +36,7 @@ export function renderParsedSourceModeWranglerConfig(mode, parsed, options = {})
   config.main = resolve(root, parsed.main)
   config.assets.directory = options.assetsDirectory ?? resolve(root, parsed.assets.directory)
   config.minify = true
+  applyAttachmentStorage(config, mode, options.r2BucketName)
   if (mode === 'direct') {
     config.alias = {
       ...config.alias,
@@ -63,9 +66,34 @@ export function renderParsedPrebuiltModeWranglerConfig(mode, parsed, options = {
   config.assets.directory = resolve(root, parsed.assets.directory)
   config.no_bundle = true
   config.find_additional_modules = false
+  applyAttachmentStorage(config, mode, options.r2BucketName)
   return `${JSON.stringify(config, undefined, 2)}\n`
 }
 
+function applyAttachmentStorage(config, mode, bucketName) {
+  if (bucketName !== undefined && (typeof bucketName !== 'string' || bucketName.length === 0)) {
+    throw new Error('R2 attachment bucket name must be a non-empty string.')
+  }
+  const target = mode === 'direct' ? config : config.env?.isolated
+  if (!isRecord(target)) {
+    throw new Error('wrangler.jsonc must declare the isolated environment.')
+  }
+  if (target.vars !== undefined && !isRecord(target.vars)) {
+    throw new Error('wrangler.jsonc vars must be an object.')
+  }
+  target.vars = {
+    ...target.vars,
+    [ATTACHMENT_STORAGE_BINDING]: bucketName === undefined ? 'temporary-do' : 'private-r2',
+  }
+  if (bucketName === undefined) return
+  const binding = [{ binding: ATTACHMENT_BINDING, bucket_name: bucketName }]
+  if (mode === 'direct') {
+    config.r2_buckets = binding
+    return
+  }
+  target.r2_buckets = binding
+}
+
 /** Return the released entrypoint for a runtime mode. */
 export function workerArtifactPath(mode, options = {}) {
   requireRuntimeMode(mode)

package/scripts/wrangler-config.d.mts

@@ -4,6 +4,7 @@ export interface WranglerConfigOptions {
   aliases?: Record<string, string>
   appDirectory?: string
   assetsDirectory?: string
+  r2BucketName?: string
   sourceConfigPath?: string
 }