Add Edge Workers commands with safe deploy and explicit enable

[alexcriss]

Description

Add a complete vip edge-workers command suite for safely scaffolding, validating, deploying, inspecting, and managing WASM Edge Workers.

The workflow is intentionally review-first:

• init scaffolds an Edge Workers project with exact supported AssemblyScript/SDK dependencies and refuses destructive initialization.
• new <name> creates a validated worker manifest and starter source.
• build [name] / build --all compile deterministic WASM artifacts.
• validate <name> / validate --all perform server-side dry-run validation without uploading.
• deploy <name> / deploy --all prepare and print the complete plan before any remote mutation, then create or update by name.
• list and get <name> inspect deployed workers; source is fetched only when explicitly requested.
• enable, disable, and delete manage deployed workers with production/destructive confirmation safeguards.

This revision also adds explicit activation to deploy through --enable, while keeping upload-only deployment as the default.

Deploy/activation safety contract

• The corresponding platform API must land and deploy first; it guarantees that every create is inactive and accepts no active input.
• deploy --enable defaults to false and is not a confirmation bypass.
• Without --enable, creates and inactive updates remain inactive.
• With --enable, a create or inactive update uploads first and enables only after a successful upload.
• An already-active update becomes live on upload and skips a redundant enable request.
• Production shows the full deployment plan and uses one confirmation that explicitly says “Deploy” or “Deploy and enable” and names every target.
• --all prepares every worker before remote writes, then applies sequentially with accurate completed/failed/not-attempted reporting.
• If enable fails or times out, the final active state is unknown. The command reports the last confirmed upload state and requires get/list verification; it never claims the worker remained inactive.
• There is no automatic retry, rollback, disable, delete, or new non-interactive bypass.
• Success telemetry contains only low-cardinality counts/booleans; source, paths, worker names, and raw errors are excluded.

The operator guide documents the inactive-create dependency, location preserve/null-clear semantics, source storage behavior, live active updates, partial failures, --enable, and the required non-production lifecycle.

Changelog Description

Added

• Added vip edge-workers commands to scaffold, build, validate, deploy, inspect, enable, disable, and delete Edge Workers.
• Added vip edge-workers deploy --enable to explicitly enable newly created or inactive workers after a successful upload.

Changed

• Edge Worker deploys are upload-only by default and now preview current and intended active state before mutation.
• Edge Worker deployment failures now distinguish upload failures from ambiguous enable failures and provide state-verification guidance.

Pull request checklist

• No new environmental variables.
• Updated the Edge Workers operator documentation.
• Manually tested the complete lifecycle in an approved non-production environment (blocked until the platform inactive-create guarantee is deployed).
• Followed the pull request checklist and documented release/deployment ordering.
• Added/updated automated tests.

New release checklist

• Automated tests pass locally.
• The preparing-for-release checklist is completed.

Verification

Run with Node 24.19.0:

npm test
npm run build
npm run smoke:release
NODE_ENV=test DO_NOT_TRACK=1 node dist/bin/vip-edge-workers-deploy.js --help

Local results:

• Full test gate: 89 suites passed; 929 tests passed; 1 existing todo. Lint and typecheck passed with one test-only sequential-await warning.
• Focused Edge Workers deploy/enable gate: 4 suites and 68 tests passed.
• Build: 203 files compiled.
• Release smoke: 14/14 checks passed.
• Built help shows --enable with (default: false) and required no credentials or browser.

Steps to Test

Do not use a production target. After the platform inactive-create guarantee is deployed, use an approved non-production alias:

1. Build this branch:

   npm run build
   alias vipdev="node $(pwd)/dist/bin/vip.js"

2. Scaffold and review a project:

   mkdir edge-workers-test
   cd edge-workers-test
   vipdev edge-workers init
   cd edge-workers
   npm install
   vipdev edge-workers new security-headers --location starts_with:/api/
   # Implement and review workers/security-headers/assembly/index.ts.
   vipdev edge-workers build security-headers

3. Validate and perform the default upload-only create. Confirm list/get report the worker inactive:

   vipdev @example-app.develop edge-workers validate security-headers
   vipdev @example-app.develop edge-workers deploy security-headers
   vipdev @example-app.develop edge-workers list
   vipdev @example-app.develop edge-workers get security-headers --source

4. Exercise separate enable, disable, and deploy-with-enable:

   vipdev @example-app.develop edge-workers enable security-headers
   vipdev @example-app.develop edge-workers disable security-headers
   # Update the reviewed source while inactive.
   vipdev @example-app.develop edge-workers deploy security-headers --enable

5. While the worker is already active, update and deploy again with --enable. Verify the plan says it remains active and no redundant enable request is made.

6. Verify location tri-state behavior: omit location to preserve the stored rule, then set it to null to clear the rule and apply to all requests.

7. Disable the worker, then confirm permanent deletion:

   vipdev @example-app.develop edge-workers disable security-headers
   vipdev @example-app.develop edge-workers delete security-headers

If an enable request fails or times out at any point, stop: the final active state is unknown. Reconcile it with edge-workers get <name> or edge-workers list before taking another action. Do not retry, roll back, disable, or delete automatically.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

Pull request overview

Adds a new vip edge-workers command suite to scaffold, compile, validate, and deploy WASM-based edge workers on VIP, including an AssemblyScript toolchain and GraphQL API integration.

Changes:

• Introduces an edge-workers library (project discovery, manifests, location parsing) plus an AssemblyScript toolchain for scaffolding and local .wasm builds.
• Adds GraphQL API helpers for listing/getting/validating/creating/updating/enabling/disabling/deleting edge workers, and wires new CLI subcommands.
• Adds initial Jest coverage for the new lib modules and several bin commands (deploy, validate, list).

Reviewed changes

Copilot reviewed 14 out of 30 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/lib/edge-workers/types.ts	Defines shared edge-worker domain types (manifests, locations, API shapes).
src/lib/edge-workers/toolchains/index.ts	Introduces toolchain registry + getToolchain() lookup.
src/lib/edge-workers/toolchains/assemblyscript/templates.ts	Adds scaffolded AssemblyScript project/worker template contents.
src/lib/edge-workers/toolchains/assemblyscript/index.ts	Implements AssemblyScript scaffold + compiler invocation (asc) to produce .wasm.
src/lib/edge-workers/toolchains/assemblyscript/constants.ts	Centralizes AssemblyScript toolchain constants (SDK/version/paths).
src/lib/edge-workers/project.ts	Adds project resolution + descriptor/manifest IO + worker discovery.
src/lib/edge-workers/location.ts	Adds CLI parsing for --location <op>:<value>.
src/lib/edge-workers/index.ts	Adds build/read helpers for artifacts and worker source.
src/lib/api/edge-workers.ts	Adds GraphQL query/mutation wrappers for edge workers.
src/lib/api.ts	Adds extra debug logging for GraphQL error details / partial data.
src/bin/vip.js	Registers the new top-level edge-workers command.
src/bin/vip-edge-workers.js	Adds the vip edge-workers subcommand dispatcher.
src/bin/vip-edge-workers-validate.js	Adds vip edge-workers validate implementation.
src/bin/vip-edge-workers-new.js	Adds vip edge-workers new implementation.
src/bin/vip-edge-workers-list.js	Adds vip edge-workers list implementation with formatter output.
src/bin/vip-edge-workers-init.js	Adds vip edge-workers init implementation (project scaffolding).
src/bin/vip-edge-workers-get.js	Adds vip edge-workers get implementation (optionally prints source).
src/bin/vip-edge-workers-enable.js	Adds vip edge-workers enable implementation.
src/bin/vip-edge-workers-disable.js	Adds vip edge-workers disable implementation.
src/bin/vip-edge-workers-deploy.js	Adds vip edge-workers deploy implementation (validate + create/update).
src/bin/vip-edge-workers-delete.js	Adds vip edge-workers delete implementation with confirmation gate.
src/bin/vip-edge-workers-build.js	Adds vip edge-workers build implementation for local compilation.
package.json	Registers new published vip-edge-workers-* bin entrypoints.
npm-shrinkwrap.json	Updates shrinkwrap bin map to include new vip-edge-workers-* entrypoints.
tests/lib/edge-workers/toolchains.js	Adds tests for toolchain registry + AssemblyScript scaffolding behavior.
tests/lib/edge-workers/project.js	Adds tests for project resolution and worker discovery helpers.
tests/lib/edge-workers/location.js	Adds tests for --location parsing and validation.
tests/bin/vip-edge-workers-validate.js	Adds CLI-wrapper tests for validate behavior.
tests/bin/vip-edge-workers-list.js	Adds CLI-wrapper tests for list mapping and error handling.
tests/bin/vip-edge-workers-deploy.js	Adds CLI-wrapper tests for deploy create/update/validation behaviors.

Files not reviewed (1)

• npm-shrinkwrap.json: Generated file

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rebeccahum]

Left some comments

[rebeccahum]

Last one: #2918 (comment)

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.6% Duplication on New Code

See analysis details on SonarQube Cloud